@withone/cli 2.1.0 → 2.3.0

package/dist/{chunk-OLQ55K6B.js → chunk-5MDUKW5N.js}

@@ -1,10 +1,10 @@
 import {
   getMemoryConfigOrDefault
-} from "./chunk-YMUY55U2.js";
+} from "./chunk-WMVVWO6N.js";
 import {
   getOpenAiApiKey,
   readConfig
-} from "./chunk-6UB623BG.js";
+} from "./chunk-GGDXUXLM.js";
 
 // src/lib/output.ts
 import * as p from "@clack/prompts";

package/dist/{chunk-6EQDEYVD.js → chunk-BWTPQPII.js}

@@ -5,7 +5,7 @@ import {
 import {
   getCacheTtl,
   homeDir
-} from "./chunk-6UB623BG.js";
+} from "./chunk-GGDXUXLM.js";
 
 // src/lib/flow-runner.ts
 import fs3 from "fs";
@@ -2285,7 +2285,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-L3JG2WCY.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-YGRRUARS.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{chunk-YTM6HJKA.js → chunk-C7GJ5GUQ.js}

@@ -6,11 +6,11 @@ import {
   note,
   okJson,
   requireMemoryInit
-} from "./chunk-OLQ55K6B.js";
+} from "./chunk-5MDUKW5N.js";
 import {
   getBackend,
   upsertRecord
-} from "./chunk-IMU2X3ZV.js";
+} from "./chunk-Y5JEZWWM.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{chunk-6UB623BG.js → chunk-GGDXUXLM.js}

@@ -217,6 +217,7 @@ function saveCredentials(apiKey, scope, opts) {
   };
   if (opts.keyName) next.apiKeyName = opts.keyName;
   else delete next.apiKeyName;
+  if (opts.knowledgeOnly) next.accessControl = { ...existing?.accessControl, knowledgeAgent: true };
   writeConfig(next, scope);
 }
 function getCacheTtl() {

package/dist/{chunk-GKAIRI4Y.js → chunk-V4LY2G2F.js}

@@ -3,10 +3,10 @@ import {
   isAgentMode,
   json,
   requireMemoryInit
-} from "./chunk-OLQ55K6B.js";
+} from "./chunk-5MDUKW5N.js";
 import {
   getBackend
-} from "./chunk-IMU2X3ZV.js";
+} from "./chunk-Y5JEZWWM.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-YMUY55U2.js → chunk-WMVVWO6N.js}

@@ -3,7 +3,7 @@ import {
   readConfig,
   setOpenAiApiKey,
   writeConfig
-} from "./chunk-6UB623BG.js";
+} from "./chunk-GGDXUXLM.js";
 
 // src/lib/memory/config.ts
 var DEFAULT_MEMORY_CONFIG = {

package/dist/{chunk-IMU2X3ZV.js → chunk-Y5JEZWWM.js}

@@ -5,11 +5,11 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-YMUY55U2.js";
+} from "./chunk-WMVVWO6N.js";
 import {
   getOpenAiApiKey,
   homeDir
-} from "./chunk-6UB623BG.js";
+} from "./chunk-GGDXUXLM.js";
 
 // src/lib/memory/schema.ts
 var SCHEMA_VERSION = "2.3.1";

package/dist/{embedding-OXX4OF65.js → embedding-DRTGVWP3.js}

@@ -2,8 +2,8 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-YMUY55U2.js";
-import "./chunk-6UB623BG.js";
+} from "./chunk-WMVVWO6N.js";
+import "./chunk-GGDXUXLM.js";
 export {
   defaultSearchableText,
   embed,

package/dist/{flow-runner-L3JG2WCY.js → flow-runner-YGRRUARS.js}

@@ -12,9 +12,9 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-6EQDEYVD.js";
+} from "./chunk-BWTPQPII.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-6UB623BG.js";
+import "./chunk-GGDXUXLM.js";
 export {
   FlowRunner,
   collectStepTypes,

package/dist/index.js

@@ -28,10 +28,10 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-6EQDEYVD.js";
+} from "./chunk-BWTPQPII.js";
 import {
   memSqlCommand
-} from "./chunk-GKAIRI4Y.js";
+} from "./chunk-V4LY2G2F.js";
 import {
   collectIdentityKeys,
   countRecords,
@@ -62,7 +62,7 @@ import {
   writeDraftProfile,
   writePageToMemory,
   writeProfile
-} from "./chunk-YTM6HJKA.js";
+} from "./chunk-C7GJ5GUQ.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -86,7 +86,7 @@ import {
   semanticSearchUpgradeLine,
   setAgentMode,
   silenceWarningsInAgentMode
-} from "./chunk-OLQ55K6B.js";
+} from "./chunk-5MDUKW5N.js";
 import {
   SCHEMA_VERSION,
   addRecord,
@@ -96,7 +96,7 @@ import {
   listBackendPlugins,
   loadBackendFromConfig,
   updateRecord
-} from "./chunk-IMU2X3ZV.js";
+} from "./chunk-Y5JEZWWM.js";
 import {
   DEFAULT_MEMORY_CONFIG,
   defaultSearchableText,
@@ -106,7 +106,7 @@ import {
   memoryConfigExists,
   setOpenAiApiKey,
   updateMemoryConfig
-} from "./chunk-YMUY55U2.js";
+} from "./chunk-WMVVWO6N.js";
 import {
   appendAnalyticsQueue,
   appendUsageLog,
@@ -143,7 +143,7 @@ import {
   writeConfig,
   writeUsageLog,
   writeUsageState
-} from "./chunk-6UB623BG.js";
+} from "./chunk-GGDXUXLM.js";
 
 // src/cli.ts
 import { createRequire as createRequire3 } from "module";
@@ -1476,6 +1476,7 @@ var PORT_RANGE_START = 49152;
 var PORT_RANGE_END = 65535;
 var MAX_PORT_ATTEMPTS = 5;
 var MAX_KEY_NAME_LENGTH = 120;
+var MAX_GRANT_LENGTH = 4e3;
 var MAX_ERROR_LENGTH = 200;
 var CHECK_MARK = `<div style="width:48px;height:48px;border-radius:50%;background:rgba(34,197,94,0.1);display:flex;align-items:center;justify-content:center;margin:0 auto 16px">
 <svg width="24" height="24" fill="none" stroke="#22c55e" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/></svg>
@@ -1539,9 +1540,11 @@ function startCallbackServer(expectedState) {
             return;
           }
           const keyName = cleanParam(url.searchParams.get("name"), MAX_KEY_NAME_LENGTH);
+          const grant = cleanParam(url.searchParams.get("grant"), MAX_GRANT_LENGTH);
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end(SUCCESS_HTML);
-          resolveResult({ kind: "key", apiKey, keyName });
+          const knowledgeOnly = url.searchParams.get("knowledge") === "1";
+          resolveResult({ kind: "key", apiKey, keyName, grant, knowledgeOnly });
           return;
         }
         const error2 = cleanParam(url.searchParams.get("error"), MAX_ERROR_LENGTH);
@@ -1593,6 +1596,9 @@ function noteWidth() {
   const usable = (typeof columns === "number" && columns > 0 ? columns : 80) - 8;
   return Math.max(usable, 40);
 }
+function grantNoteLines(grant, label) {
+  return grant ? wrapForNote(`${label} ${grant}`).split("\n") : [];
+}
 async function browserLogin(opts) {
   const state = crypto.randomUUID();
   const spin = createSpinner();
@@ -1650,7 +1656,13 @@ ${describeInstallContext(context)}`
     const apiBase = getApiBase();
     const api = new OneApi(outcome.apiKey, apiBase);
     const whoami = await api.whoami();
-    return { apiKey: outcome.apiKey, whoami, keyName: outcome.keyName };
+    return {
+      apiKey: outcome.apiKey,
+      whoami,
+      keyName: outcome.keyName,
+      grant: outcome.grant,
+      knowledgeOnly: outcome.knowledgeOnly
+    };
   } catch (err) {
     spin.stop("Authentication failed.");
     if (err instanceof Error && err.message === "timeout") {
@@ -1709,8 +1721,8 @@ async function loginCommand() {
   }
   const result = await browserLogin({ scope: targetScope });
   if (!result) return;
-  const { apiKey, whoami, keyName } = result;
-  saveCredentials(apiKey, targetScope, { keyName, whoami });
+  const { apiKey, whoami, keyName, grant, knowledgeOnly } = result;
+  saveCredentials(apiKey, targetScope, { keyName, whoami, knowledgeOnly });
   const pc16 = (await import("picocolors")).default;
   const env = getEnvFromApiKey(apiKey);
   const contextParts = [];
@@ -1724,6 +1736,7 @@ async function loginCommand() {
     `${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`
   ];
   if (keyName) infoLines.push(`${pc16.dim("Key:")} ${keyName}`);
+  infoLines.push(...grantNoteLines(grant, pc16.dim("Access:")));
   if (whoami.organization) infoLines.push(`${pc16.dim("Org:")} ${whoami.organization.name}`);
   if (whoami.project) infoLines.push(`${pc16.dim("Project:")} ${whoami.project.name}`);
   infoLines.push("");
@@ -1780,6 +1793,8 @@ async function nonInteractiveInit(options) {
   const scope = options.global ? "global" : options.project ? "project" : "global";
   let apiKey;
   let keyName;
+  let grant;
+  let knowledgeOnly = false;
   let whoami;
   if (auth === "browser") {
     const result = await browserLogin({ scope });
@@ -1788,6 +1803,8 @@ async function nonInteractiveInit(options) {
     }
     apiKey = result.apiKey;
     keyName = result.keyName;
+    grant = result.grant;
+    knowledgeOnly = result.knowledgeOnly;
     whoami = result.whoami;
   } else {
     const key = options.apiKey?.trim();
@@ -1811,7 +1828,7 @@ async function nonInteractiveInit(options) {
     apiKey = key;
     whoami = validated;
   }
-  saveCredentials(apiKey, scope, { keyName, whoami });
+  saveCredentials(apiKey, scope, { keyName, whoami, knowledgeOnly });
   if (options.openaiKey?.trim()) {
     try {
       setOpenAiApiKey(options.openaiKey.trim());
@@ -1834,6 +1851,7 @@ async function nonInteractiveInit(options) {
         env: getEnvFromApiKey(apiKey)
       },
       keyName,
+      grant,
       skillInstalled: installed,
       skillFailed: failed
     });
@@ -1851,6 +1869,7 @@ async function nonInteractiveInit(options) {
   console.log(`  ${pc4.dim("Account:")} ${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}`);
   console.log(`  ${pc4.dim("User:")}    ${whoami.user.name} ${pc4.dim(`(${whoami.user.email})`)}`);
   if (keyName) console.log(`  ${pc4.dim("Key:")}     ${keyName}`);
+  if (grant) console.log(`  ${pc4.dim("Access:")}  ${grant}`);
   console.log(`  ${pc4.dim("Config:")}  ${tildify(configPath)}`);
   if (installed.length > 0) {
     console.log(`  ${pc4.dim("Skill:")}   ${pc4.green("installed")} ${pc4.dim("\xB7 " + installed.join(", "))}`);
@@ -2046,6 +2065,8 @@ async function handleUpdateKey(statuses, scope) {
   }
   let newKey;
   let keyName;
+  let grant;
+  let knowledgeOnly = false;
   let whoamiResult;
   if (authMethod === "browser") {
     const result = await browserLogin({ scope });
@@ -2055,6 +2076,8 @@ async function handleUpdateKey(statuses, scope) {
     }
     newKey = result.apiKey;
     keyName = result.keyName;
+    grant = result.grant;
+    knowledgeOnly = result.knowledgeOnly;
     whoamiResult = result.whoami;
   } else {
     p3.note(`Get your API key at:
@@ -2108,7 +2131,8 @@ ${pc4.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
     [
       `${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}`,
       `${whoamiResult.user.name} ${pc4.dim(`(${whoamiResult.user.email})`)}`,
-      ...keyName ? [`${pc4.dim("Key:")} ${keyName}`] : []
+      ...keyName ? [`${pc4.dim("Key:")} ${keyName}`] : [],
+      ...grantNoteLines(grant, pc4.dim("Access:"))
     ].join("\n"),
     "Account"
   );
@@ -2124,7 +2148,7 @@ ${pc4.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
-  saveCredentials(newKey, scope, { keyName, whoami: whoamiResult });
+  saveCredentials(newKey, scope, { keyName, whoami: whoamiResult, knowledgeOnly });
   if (reinstalled.length > 0) {
     p3.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
   }
@@ -2370,11 +2394,16 @@ async function freshSetup(scope, options) {
       [
         `${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}`,
         `${result.whoami.user.name} ${pc4.dim(`(${result.whoami.user.email})`)}`,
-        ...result.keyName ? [`${pc4.dim("Key:")} ${result.keyName}`] : []
+        ...result.keyName ? [`${pc4.dim("Key:")} ${result.keyName}`] : [],
+        ...grantNoteLines(result.grant, pc4.dim("Access:"))
       ].join("\n"),
       "Account"
     );
-    saveCredentials(apiKey, scope, { keyName: result.keyName, whoami: result.whoami });
+    saveCredentials(apiKey, scope, {
+      keyName: result.keyName,
+      whoami: result.whoami,
+      knowledgeOnly: result.knowledgeOnly
+    });
   } else {
     p3.note(`Get your API key at:
 ${pc4.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
@@ -7384,7 +7413,7 @@ async function syncModel(api, profile, options) {
         updateModelState(platform, model, { status: "failed", pagesProcessed, lastCursor }),
         (async () => {
           try {
-            const { getBackend: getBackend2 } = await import("./runtime-SX36HGBA.js");
+            const { getBackend: getBackend2 } = await import("./runtime-DTKLN6KX.js");
             const backend = await getBackend2();
             await Promise.race([
               backend.close(),
@@ -7750,7 +7779,7 @@ async function syncModel(api, profile, options) {
         db.exec(`DROP TABLE IF EXISTS _seen_ids`);
       }
       if (options.toMemory !== false) {
-        const backend = await (await import("./runtime-SX36HGBA.js")).getBackend();
+        const backend = await (await import("./runtime-DTKLN6KX.js")).getBackend();
         const type = `${platform}/${model}`;
         const existing = await backend.listKeysByType(type);
         const sourcePrefix = `${type}:`;
@@ -7851,7 +7880,7 @@ async function syncModel(api, profile, options) {
     let statusCounts;
     if (options.toMemory !== false) {
       try {
-        const backend = await (await import("./runtime-SX36HGBA.js")).getBackend();
+        const backend = await (await import("./runtime-DTKLN6KX.js")).getBackend();
         const typeName = `${platform}/${model}`;
         const [active, archived] = await Promise.all([
           backend.count(typeName, { status: "active" }),
@@ -9573,7 +9602,7 @@ ${result.total} results`);
   }
 }
 async function syncSqlCommand(platformModel, sql) {
-  const { syncSqlCommand: runSyncSql } = await import("./sql-SYCWUPNP.js");
+  const { syncSqlCommand: runSyncSql } = await import("./sql-5GNNGVNH.js");
   await runSyncSql(platformModel, sql);
 }
 async function syncDeleteCommand(platformModel, options) {
@@ -9651,7 +9680,7 @@ async function syncDeleteCommand(platformModel, options) {
 async function maybeAutoMigrateLegacy(platform, models) {
   const dbSize = getDatabaseSize(platform);
   if (!dbSize || dbSize === "0 B") return;
-  const { getBackend: getBackend2 } = await import("./runtime-SX36HGBA.js");
+  const { getBackend: getBackend2 } = await import("./runtime-DTKLN6KX.js");
   const backend = await getBackend2();
   let memoryHasData = false;
   for (const model of models) {
@@ -9667,7 +9696,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-TACDLGPD.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-DWRR6FWW.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -9676,7 +9705,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p6.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-TACDLGPD.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-DWRR6FWW.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -9737,7 +9766,7 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = await readSyncState();
-  const { getBackend: getBackend2 } = await import("./runtime-SX36HGBA.js");
+  const { getBackend: getBackend2 } = await import("./runtime-DTKLN6KX.js");
   const backend = await getBackend2();
   const syncs = await Promise.all(profiles.map(async (p9) => {
     const modelState = state[p9.platform]?.[p9.model];
@@ -10013,7 +10042,7 @@ function registerSyncSubcommands(sync) {
     await syncSqlCommand(platformModel, sql);
   });
   sync.command("schema <platform/model>").description("Inspect the JSON structure of synced records (field paths, types, examples) \u2014 useful before writing `sync sql` queries").action(async (platformModel) => {
-    const { syncSchemaCommand } = await import("./schema-RJC2WQQ6.js");
+    const { syncSchemaCommand } = await import("./schema-SQA46NFA.js");
     await syncSchemaCommand(platformModel);
   });
   sync.command("delete <platform/model>").description('Delete records from local sync data (e.g. one sync delete notion/pages --id "abc-123")').option("--id <value>", "Delete record by ID").option("--where <conditions>", 'Delete records matching conditions (e.g. "status=archived")').option("--where-sql <predicate>", `Delete using a raw SQL WHERE clause (e.g. "json_extract(data, '$.type') = 'promotion'")`).option("--yes", "Skip confirmation prompt").action(async (platformModel, options) => {
@@ -10790,7 +10819,7 @@ async function memDoctorCommand() {
   }
   if (cfg.embedding.provider === "openai") {
     try {
-      const { embed: embed2 } = await import("./embedding-OXX4OF65.js");
+      const { embed: embed2 } = await import("./embedding-DRTGVWP3.js");
       const result = await embed2("connectivity check");
       checks.push({
         name: "OpenAI embedding provider reachable",

package/dist/{migrate-TACDLGPD.js → migrate-DWRR6FWW.js}

@@ -3,12 +3,12 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-YTM6HJKA.js";
+} from "./chunk-C7GJ5GUQ.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-OLQ55K6B.js";
-import "./chunk-IMU2X3ZV.js";
-import "./chunk-YMUY55U2.js";
-import "./chunk-6UB623BG.js";
+import "./chunk-5MDUKW5N.js";
+import "./chunk-Y5JEZWWM.js";
+import "./chunk-WMVVWO6N.js";
+import "./chunk-GGDXUXLM.js";
 export {
   buildIdentityMap,
   dotPathToJsonbExpr,

package/dist/{runtime-SX36HGBA.js → runtime-DTKLN6KX.js}

@@ -5,9 +5,9 @@ import {
   resetBackendSingleton,
   updateRecord,
   upsertRecord
-} from "./chunk-IMU2X3ZV.js";
-import "./chunk-YMUY55U2.js";
-import "./chunk-6UB623BG.js";
+} from "./chunk-Y5JEZWWM.js";
+import "./chunk-WMVVWO6N.js";
+import "./chunk-GGDXUXLM.js";
 export {
   addRecord,
   closeBackendIfCached,

package/dist/{schema-RJC2WQQ6.js → schema-SQA46NFA.js}

@@ -3,12 +3,12 @@ import {
   note,
   okJson,
   requireMemoryInit
-} from "./chunk-OLQ55K6B.js";
+} from "./chunk-5MDUKW5N.js";
 import {
   getBackend
-} from "./chunk-IMU2X3ZV.js";
-import "./chunk-YMUY55U2.js";
-import "./chunk-6UB623BG.js";
+} from "./chunk-Y5JEZWWM.js";
+import "./chunk-WMVVWO6N.js";
+import "./chunk-GGDXUXLM.js";
 
 // src/lib/memory/sync/schema.ts
 import pc from "picocolors";

package/dist/sql-5GNNGVNH.js

@@ -0,0 +1,12 @@
+import {
+  memSqlCommand,
+  syncSqlCommand
+} from "./chunk-V4LY2G2F.js";
+import "./chunk-5MDUKW5N.js";
+import "./chunk-Y5JEZWWM.js";
+import "./chunk-WMVVWO6N.js";
+import "./chunk-GGDXUXLM.js";
+export {
+  memSqlCommand,
+  syncSqlCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/dist/sql-SYCWUPNP.js

@@ -1,12 +0,0 @@
-import {
-  memSqlCommand,
-  syncSqlCommand
-} from "./chunk-GKAIRI4Y.js";
-import "./chunk-OLQ55K6B.js";
-import "./chunk-IMU2X3ZV.js";
-import "./chunk-YMUY55U2.js";
-import "./chunk-6UB623BG.js";
-export {
-  memSqlCommand,
-  syncSqlCommand
-};