@withone/cli 2.11.1 → 2.12.0

package/README.md

@@ -739,12 +739,14 @@ Drop a `.onerc` file in your project root to override global settings per-projec
 |-----|---------|
 | `ONE_SECRET` | API key (also honored as env var) |
 | `ONE_API_BASE` | API base URL, `https://api.withone.ai` or `https://development-api.withone.ai` only (the env var accepts any origin) |
-| `ONE_PERMISSIONS` | `admin` / `write` / `read` |
-| `ONE_CONNECTION_KEYS` | Comma-separated connection-key allowlist |
-| `ONE_ACTION_IDS` | Comma-separated action-ID allowlist |
-| `ONE_KNOWLEDGE_AGENT` | `true` / `false` — knowledge-only mode |
+| `ONE_PERMISSIONS` | `admin` / `write` / `read`, can only lower the configured level |
+| `ONE_CONNECTION_KEYS` | Comma-separated connection-key allowlist, intersected with the configured one |
+| `ONE_ACTION_IDS` | Comma-separated action-ID allowlist, intersected with the configured one |
+| `ONE_KNOWLEDGE_AGENT` | `true` turns knowledge-only mode on; it cannot turn it off |
 
-Precedence: env var > `.onerc` > `~/.one/config.json`.
+Precedence: env var > `.onerc` > `~/.one/config.json`. The access keys are the exception: a `.onerc` can only narrow the access settings in your config, never widen them, because it can arrive with a cloned repository. A value that would widen them is ignored with a warning; use `one config` instead.
+
+The access settings are enforced on every call to a connected app, whatever the command: `actions execute`, flows, sync and its validation runs. Headers named `x-one-secret`, `x-one-connection-key` or `x-one-action-id` cannot be passed with `--headers`, method-override headers are judged against the permission level, and a path variable cannot be `.` or `..`.
 
 ```bash
 # .onerc

package/dist/{chunk-UYOXEMF5.js → chunk-6IRGRC3G.js}

@@ -5,11 +5,11 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-NC3HVQ7O.js";
+} from "./chunk-EITBMRUB.js";
 import {
   getOpenAiApiKey,
   homeDir
-} from "./chunk-FR4VGZUI.js";
+} from "./chunk-EWHFGWB3.js";
 
 // src/lib/memory/schema.ts
 var SCHEMA_VERSION = "2.3.1";

package/dist/{chunk-RUVW6QYK.js → chunk-7ZBRP3BJ.js}

@@ -6,9 +6,12 @@ import {
   isAgentMode
 } from "./chunk-Q6PWTATS.js";
 import {
+  IDENTITY_HEADERS,
   appendAnalyticsQueue,
   appendUsageLog,
+  checkPassthroughAccess,
   claimUsageLog,
+  getAccessControlFromAllSources,
   getApiKey,
   getCacheTtl,
   getDeviceId,
@@ -16,6 +19,8 @@ import {
   getProjectRoot,
   getWhoAmI,
   homeDir,
+  isActionAllowed,
+  isMethodAllowed,
   markTelemetryNoticeShown,
   readAnalyticsQueue,
   readConfig,
@@ -24,7 +29,7 @@ import {
   writeAnalyticsQueue,
   writeUsageLog,
   writeUsageState
-} from "./chunk-FR4VGZUI.js";
+} from "./chunk-EWHFGWB3.js";
 
 // src/lib/flow-runner.ts
 import fs5 from "fs";
@@ -725,11 +730,17 @@ function parseRetryAfter(value) {
   return void 0;
 }
 var OneApi = class {
-  constructor(apiKey, apiBase) {
+  constructor(apiKey, apiBase, accessSettings) {
     this.apiKey = apiKey;
+    this.accessSettings = accessSettings;
     this.apiBase = apiBase ?? "https://api.withone.ai/v1";
   }
   apiBase;
+  /**
+   * The local access settings every passthrough call is checked against.
+   * Read from config and `.onerc` at call time unless a caller supplies them.
+   */
+  accessSettings;
   async request(path7) {
     return this.requestFull({ path: path7 });
   }
@@ -967,10 +978,13 @@ var OneApi = class {
     const action = preloadedAction ?? await this.getActionDetails(args.actionId);
     const method = action.method;
     const contentType = args.isFormData ? "multipart/form-data" : args.isFormUrlEncoded ? "application/x-www-form-urlencoded" : "application/json";
+    checkPassthroughAccess(this.accessSettings ?? getAccessControlFromAllSources(), {
+      actionId: action._id,
+      connectionKey: args.connectionKey,
+      method,
+      headers: args.headers
+    });
     const requestHeaders = {
-      "x-one-secret": this.apiKey,
-      "x-one-connection-key": args.connectionKey,
-      "x-one-action-id": action._id,
       "Content-Type": contentType,
       Accept: "application/json, text/event-stream, */*",
       // Who is calling, for the Logs page. Before the caller's own headers so
@@ -978,9 +992,17 @@ var OneApi = class {
       ...callerHeaders(),
       ...args.headers
     };
+    for (const name of Object.keys(requestHeaders)) {
+      if (IDENTITY_HEADERS.includes(name.toLowerCase())) delete requestHeaders[name];
+    }
+    requestHeaders["x-one-secret"] = this.apiKey;
+    requestHeaders["x-one-connection-key"] = args.connectionKey;
+    requestHeaders["x-one-action-id"] = action._id;
     const finalActionPath = args.pathVariables ? replacePathVariables(action.path, args.pathVariables) : action.path;
     const normalizedPath = finalActionPath.startsWith("/") ? finalActionPath : `/${finalActionPath}`;
-    const url = `${this.apiBase.replace("/v1", "")}/v1/passthrough${normalizedPath}`;
+    const passthroughBase = `${this.apiBase.replace("/v1", "")}/v1/passthrough`;
+    const url = `${passthroughBase}${normalizedPath}`;
+    assertUnderPassthrough(passthroughBase, url);
     const isCustomAction = action.tags?.includes("custom");
     let requestData = args.data;
     if (isCustomAction && method?.toLowerCase() !== "get") {
@@ -1200,6 +1222,20 @@ var TimeoutError = class extends Error {
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
+function encodePathValue(name, value) {
+  const text = value.toString();
+  if (text === "." || text === "..") {
+    throw new Error(`Path variable "${name}" cannot be "${text}".`);
+  }
+  return encodeURIComponent(text).replace(/%3A/gi, ":");
+}
+function assertUnderPassthrough(passthroughBase, url) {
+  const prefix = new URL(passthroughBase).pathname.replace(/\/+$/, "");
+  const resolved = new URL(url).pathname;
+  if (resolved !== prefix && !resolved.startsWith(`${prefix}/`)) {
+    throw new Error(`Action path resolves outside ${prefix} (${resolved}).`);
+  }
+}
 function replacePathVariables(path7, variables) {
   if (!path7) return path7;
   let result = path7;
@@ -1209,7 +1245,7 @@ function replacePathVariables(path7, variables) {
     if (value === void 0 || value === null || value === "") {
       throw new Error(`Missing value for path variable: ${trimmedVariable}`);
     }
-    return encodeURIComponent(value.toString()).replace(/%3A/gi, ":");
+    return encodePathValue(trimmedVariable, value);
   });
   result = result.replace(/\{([^}]+)\}/g, (_match, variable) => {
     const trimmedVariable = variable.trim();
@@ -1217,23 +1253,10 @@ function replacePathVariables(path7, variables) {
     if (value === void 0 || value === null || value === "") {
       throw new Error(`Missing value for path variable: ${trimmedVariable}`);
     }
-    return encodeURIComponent(value.toString()).replace(/%3A/gi, ":");
+    return encodePathValue(trimmedVariable, value);
   });
   return result;
 }
-var PERMISSION_METHODS = {
-  read: ["GET"],
-  write: ["GET", "POST", "PUT", "PATCH"],
-  admin: null
-};
-function isMethodAllowed(method, permissions) {
-  const allowed = PERMISSION_METHODS[permissions];
-  if (allowed === null) return true;
-  return allowed.includes(method.toUpperCase());
-}
-function isActionAllowed(actionId, allowedActionIds) {
-  return allowedActionIds.includes("*") || allowedActionIds.includes(actionId);
-}
 
 // src/lib/cache.ts
 import fs3 from "fs";
@@ -2977,7 +3000,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-36I4G5BS.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-6QTY3U2C.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3907,9 +3930,6 @@ export {
   ApiError,
   OneApi,
   TimeoutError,
-  PERMISSION_METHODS,
-  isMethodAllowed,
-  isActionAllowed,
   knowledgeCachePath,
   readCache,
   writeCache,

package/dist/{chunk-WWPH6JOO.js → chunk-DGQOAFXJ.js}

@@ -1,6 +1,6 @@
 import {
   requireMemoryInit
-} from "./chunk-VYOIHD4B.js";
+} from "./chunk-J7JWBH45.js";
 import {
   error,
   isAgentMode,
@@ -8,7 +8,7 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-UYOXEMF5.js";
+} from "./chunk-6IRGRC3G.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-NC3HVQ7O.js → chunk-EITBMRUB.js}

@@ -3,7 +3,7 @@ import {
   readConfig,
   setOpenAiApiKey,
   writeConfig
-} from "./chunk-FR4VGZUI.js";
+} from "./chunk-EWHFGWB3.js";
 
 // src/lib/memory/config.ts
 var DEFAULT_MEMORY_CONFIG = {

package/dist/{chunk-FR4VGZUI.js → chunk-EWHFGWB3.js}

@@ -10,6 +10,76 @@ function homeDir() {
 import fs from "fs";
 import path from "path";
 import { randomUUID } from "crypto";
+
+// src/lib/access-gate.ts
+var PERMISSION_METHODS = {
+  read: ["GET"],
+  write: ["GET", "POST", "PUT", "PATCH"],
+  admin: null
+};
+function isMethodAllowed(method, permissions) {
+  const allowed = PERMISSION_METHODS[permissions];
+  if (allowed === null) return true;
+  return allowed.includes(method.toUpperCase());
+}
+function isActionAllowed(actionId, allowedActionIds) {
+  return allowedActionIds.includes("*") || allowedActionIds.includes(actionId);
+}
+function isConnectionAllowed(connectionKey, allowedConnectionKeys) {
+  return allowedConnectionKeys.includes("*") || allowedConnectionKeys.includes(connectionKey);
+}
+var IDENTITY_HEADERS = ["x-one-secret", "x-one-connection-key", "x-one-action-id"];
+var METHOD_OVERRIDE_HEADERS = ["x-http-method-override", "x-http-method", "x-method-override"];
+var AccessDeniedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AccessDeniedError";
+  }
+};
+function checkPassthroughAccess(settings, req) {
+  const permissions = settings.permissions ?? "admin";
+  const actionIds = settings.actionIds ?? ["*"];
+  const connectionKeys = settings.connectionKeys ?? ["*"];
+  if (settings.knowledgeAgent) {
+    throw new AccessDeniedError("Action execution is disabled (knowledge-only mode).");
+  }
+  if (!isActionAllowed(req.actionId, actionIds)) {
+    throw new AccessDeniedError(`Action "${req.actionId}" is not in the allowed action list.`);
+  }
+  if (!isConnectionAllowed(req.connectionKey, connectionKeys)) {
+    throw new AccessDeniedError(`Connection key "${req.connectionKey}" is not allowed.`);
+  }
+  if (!isMethodAllowed(req.method, permissions)) {
+    throw new AccessDeniedError(`Method "${req.method}" is not allowed under "${permissions}" permission level.`);
+  }
+  for (const [name, value] of Object.entries(req.headers ?? {})) {
+    const lower = name.toLowerCase();
+    if (IDENTITY_HEADERS.includes(lower)) {
+      throw new AccessDeniedError(
+        `Header "${name}" is set by the CLI and cannot be passed. Use --connection-key and the action id instead.`
+      );
+    }
+    if (METHOD_OVERRIDE_HEADERS.includes(lower) && !isMethodAllowed(String(value), permissions)) {
+      throw new AccessDeniedError(
+        `Header "${name}: ${value}" asks for a method that is not allowed under "${permissions}" permission level.`
+      );
+    }
+  }
+}
+var LEVEL_RANK = { read: 0, write: 1, admin: 2 };
+function isPermissionLevel(value) {
+  return value in LEVEL_RANK;
+}
+function stricterLevel(a, b) {
+  return LEVEL_RANK[a] <= LEVEL_RANK[b] ? a : b;
+}
+function intersectAllowlists(a, b) {
+  if (a.includes("*")) return b;
+  if (b.includes("*")) return a;
+  return a.filter((x) => b.includes(x));
+}
+
+// src/lib/config.ts
 function configDir() {
   return path.join(homeDir(), ".one");
 }
@@ -158,21 +228,44 @@ function setOpenAiApiKey(key) {
   }
   writeConfig(resolved.config, resolved.scope ?? "global");
 }
+var warnedOneRcAccess = false;
 function getAccessControlFromAllSources() {
   const rc = readOneRc();
   const fileAc = getAccessControl();
   const merged = { ...fileAc };
-  if (rc.ONE_PERMISSIONS) {
-    merged.permissions = rc.ONE_PERMISSIONS;
-  }
-  if (rc.ONE_CONNECTION_KEYS) {
-    merged.connectionKeys = rc.ONE_CONNECTION_KEYS.split(",").map((s) => s.trim()).filter(Boolean);
-  }
-  if (rc.ONE_ACTION_IDS) {
-    merged.actionIds = rc.ONE_ACTION_IDS.split(",").map((s) => s.trim()).filter(Boolean);
+  const ignored = [];
+  const rcLevel = rc.ONE_PERMISSIONS?.trim();
+  if (rcLevel) {
+    const current = fileAc.permissions ?? "admin";
+    if (isPermissionLevel(rcLevel)) {
+      merged.permissions = stricterLevel(current, rcLevel);
+      if (merged.permissions !== rcLevel) ignored.push(`ONE_PERMISSIONS=${rcLevel}`);
+    } else {
+      ignored.push(`ONE_PERMISSIONS=${rcLevel}`);
+    }
   }
-  if (rc.ONE_KNOWLEDGE_AGENT) {
-    merged.knowledgeAgent = rc.ONE_KNOWLEDGE_AGENT === "true";
+  const narrowList = (rcKey, current) => {
+    const raw = rc[rcKey];
+    if (!raw) return current;
+    const asked = raw.split(",").map((s) => s.trim()).filter(Boolean);
+    if (asked.length === 0) return current;
+    const result = intersectAllowlists(current ?? ["*"], asked);
+    if (asked.some((x) => !result.includes(x))) ignored.push(`${rcKey}=${raw}`);
+    return result;
+  };
+  merged.connectionKeys = narrowList("ONE_CONNECTION_KEYS", fileAc.connectionKeys);
+  merged.actionIds = narrowList("ONE_ACTION_IDS", fileAc.actionIds);
+  if (merged.connectionKeys === void 0) delete merged.connectionKeys;
+  if (merged.actionIds === void 0) delete merged.actionIds;
+  const rcKnowledge = rc.ONE_KNOWLEDGE_AGENT?.trim();
+  if (rcKnowledge === "true") merged.knowledgeAgent = true;
+  else if (rcKnowledge && fileAc.knowledgeAgent) ignored.push(`ONE_KNOWLEDGE_AGENT=${rcKnowledge}`);
+  if (ignored.length > 0 && !warnedOneRcAccess) {
+    warnedOneRcAccess = true;
+    process.stderr.write(
+      `Ignoring ${ignored.join(", ")} from .onerc: .onerc can only narrow the access settings in your config. Use \`one config\` to widen them.
+`
+    );
   }
   return merged;
 }
@@ -439,6 +532,11 @@ function writeUsageState(state) {
 
 export {
   homeDir,
+  PERMISSION_METHODS,
+  isMethodAllowed,
+  isActionAllowed,
+  IDENTITY_HEADERS,
+  checkPassthroughAccess,
   getProjectRoot,
   getProjectConfigPath,
   getGlobalConfigPath,

package/dist/{chunk-VYOIHD4B.js → chunk-J7JWBH45.js}

@@ -5,11 +5,11 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getMemoryConfigOrDefault
-} from "./chunk-NC3HVQ7O.js";
+} from "./chunk-EITBMRUB.js";
 import {
   getOpenAiApiKey,
   readConfig
-} from "./chunk-FR4VGZUI.js";
+} from "./chunk-EWHFGWB3.js";
 
 // src/commands/mem/util.ts
 function requireMemoryInit() {

package/dist/{chunk-5O5OUAHJ.js → chunk-WZTPSXHP.js}

@@ -4,7 +4,7 @@ import {
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-VYOIHD4B.js";
+} from "./chunk-J7JWBH45.js";
 import {
   isAgentMode,
   note
@@ -12,7 +12,7 @@ import {
 import {
   getBackend,
   upsertRecord
-} from "./chunk-UYOXEMF5.js";
+} from "./chunk-6IRGRC3G.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{embedding-MVPO6QW7.js → embedding-7Q22D23K.js}

@@ -2,8 +2,8 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-NC3HVQ7O.js";
-import "./chunk-FR4VGZUI.js";
+} from "./chunk-EITBMRUB.js";
+import "./chunk-EWHFGWB3.js";
 export {
   defaultSearchableText,
   embed,

package/dist/{flow-runner-36I4G5BS.js → flow-runner-6QTY3U2C.js}

@@ -12,10 +12,10 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-RUVW6QYK.js";
+} from "./chunk-7ZBRP3BJ.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
-import "./chunk-FR4VGZUI.js";
+import "./chunk-EWHFGWB3.js";
 export {
   FlowRunner,
   collectStepTypes,

package/dist/index.js

@@ -6,7 +6,6 @@ import {
   FLOW_SCHEMA,
   FlowRunner,
   OneApi,
-  PERMISSION_METHODS,
   TimeoutError,
   clearAll,
   clearEntry,
@@ -25,9 +24,7 @@ import {
   getStepTypeDescriptor,
   installContextToParams,
   installMcpConfig,
-  isActionAllowed,
   isFresh,
-  isMethodAllowed,
   knowledgeCachePath,
   listCacheEntries,
   listFlows,
@@ -42,10 +39,10 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-RUVW6QYK.js";
+} from "./chunk-7ZBRP3BJ.js";
 import {
   memSqlCommand
-} from "./chunk-WWPH6JOO.js";
+} from "./chunk-DGQOAFXJ.js";
 import {
   collectIdentityKeys,
   countRecords,
@@ -76,7 +73,7 @@ import {
   writeDraftProfile,
   writePageToMemory,
   writeProfile
-} from "./chunk-5O5OUAHJ.js";
+} from "./chunk-WZTPSXHP.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -90,7 +87,7 @@ import {
   requireMemoryInit,
   semanticSearchUpgradeHint,
   semanticSearchUpgradeLine
-} from "./chunk-VYOIHD4B.js";
+} from "./chunk-J7JWBH45.js";
 import {
   cancel,
   createSpinner,
@@ -112,7 +109,7 @@ import {
   listBackendPlugins,
   loadBackendFromConfig,
   updateRecord
-} from "./chunk-UYOXEMF5.js";
+} from "./chunk-6IRGRC3G.js";
 import {
   DEFAULT_MEMORY_CONFIG,
   defaultSearchableText,
@@ -122,8 +119,9 @@ import {
   memoryConfigExists,
   setOpenAiApiKey,
   updateMemoryConfig
-} from "./chunk-NC3HVQ7O.js";
+} from "./chunk-EITBMRUB.js";
 import {
+  PERMISSION_METHODS,
   configExists,
   ensureWhoAmI,
   getAccessControl,
@@ -138,6 +136,8 @@ import {
   getWhoAmI,
   globalConfigExists,
   homeDir,
+  isActionAllowed,
+  isMethodAllowed,
   projectConfigExists,
   readConfig,
   readGlobalConfig,
@@ -148,7 +148,7 @@ import {
   updateApiBase,
   updateWhoAmI,
   writeConfig
-} from "./chunk-FR4VGZUI.js";
+} from "./chunk-EWHFGWB3.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -7427,7 +7427,7 @@ async function syncModel(api, profile, options) {
         updateModelState(platform, model, { status: "failed", pagesProcessed, lastCursor }),
         (async () => {
           try {
-            const { getBackend: getBackend2 } = await import("./runtime-J4TQCY7Z.js");
+            const { getBackend: getBackend2 } = await import("./runtime-WB4J6RQK.js");
             const backend = await getBackend2();
             await Promise.race([
               backend.close(),
@@ -7793,7 +7793,7 @@ async function syncModel(api, profile, options) {
         db.exec(`DROP TABLE IF EXISTS _seen_ids`);
       }
       if (options.toMemory !== false) {
-        const backend = await (await import("./runtime-J4TQCY7Z.js")).getBackend();
+        const backend = await (await import("./runtime-WB4J6RQK.js")).getBackend();
         const type = `${platform}/${model}`;
         const existing = await backend.listKeysByType(type);
         const sourcePrefix = `${type}:`;
@@ -7894,7 +7894,7 @@ async function syncModel(api, profile, options) {
     let statusCounts;
     if (options.toMemory !== false) {
       try {
-        const backend = await (await import("./runtime-J4TQCY7Z.js")).getBackend();
+        const backend = await (await import("./runtime-WB4J6RQK.js")).getBackend();
         const typeName = `${platform}/${model}`;
         const [active, archived] = await Promise.all([
           backend.count(typeName, { status: "active" }),
@@ -9616,7 +9616,7 @@ ${result.total} results`);
   }
 }
 async function syncSqlCommand(platformModel, sql) {
-  const { syncSqlCommand: runSyncSql } = await import("./sql-XCMEVSVD.js");
+  const { syncSqlCommand: runSyncSql } = await import("./sql-BNSA2GZM.js");
   await runSyncSql(platformModel, sql);
 }
 async function syncDeleteCommand(platformModel, options) {
@@ -9694,7 +9694,7 @@ async function syncDeleteCommand(platformModel, options) {
 async function maybeAutoMigrateLegacy(platform, models) {
   const dbSize = getDatabaseSize(platform);
   if (!dbSize || dbSize === "0 B") return;
-  const { getBackend: getBackend2 } = await import("./runtime-J4TQCY7Z.js");
+  const { getBackend: getBackend2 } = await import("./runtime-WB4J6RQK.js");
   const backend = await getBackend2();
   let memoryHasData = false;
   for (const model of models) {
@@ -9710,7 +9710,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-IKK2N3VW.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-KKNH3745.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -9719,7 +9719,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p6.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-IKK2N3VW.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-KKNH3745.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -9780,7 +9780,7 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = await readSyncState();
-  const { getBackend: getBackend2 } = await import("./runtime-J4TQCY7Z.js");
+  const { getBackend: getBackend2 } = await import("./runtime-WB4J6RQK.js");
   const backend = await getBackend2();
   const syncs = await Promise.all(profiles.map(async (p9) => {
     const modelState = state[p9.platform]?.[p9.model];
@@ -10056,7 +10056,7 @@ function registerSyncSubcommands(sync) {
     await syncSqlCommand(platformModel, sql);
   });
   sync.command("schema <platform/model>").description("Inspect the JSON structure of synced records (field paths, types, examples) \u2014 useful before writing `sync sql` queries").action(async (platformModel) => {
-    const { syncSchemaCommand } = await import("./schema-JKYKFQZD.js");
+    const { syncSchemaCommand } = await import("./schema-SDZZ7XZT.js");
     await syncSchemaCommand(platformModel);
   });
   sync.command("delete <platform/model>").description('Delete records from local sync data (e.g. one sync delete notion/pages --id "abc-123")').option("--id <value>", "Delete record by ID").option("--where <conditions>", 'Delete records matching conditions (e.g. "status=archived")').option("--where-sql <predicate>", `Delete using a raw SQL WHERE clause (e.g. "json_extract(data, '$.type') = 'promotion'")`).option("--yes", "Skip confirmation prompt").action(async (platformModel, options) => {
@@ -10833,7 +10833,7 @@ async function memDoctorCommand() {
   }
   if (cfg.embedding.provider === "openai") {
     try {
-      const { embed: embed2 } = await import("./embedding-MVPO6QW7.js");
+      const { embed: embed2 } = await import("./embedding-7Q22D23K.js");
       const result = await embed2("connectivity check");
       checks.push({
         name: "OpenAI embedding provider reachable",

package/dist/{migrate-IKK2N3VW.js → migrate-KKNH3745.js}

@@ -3,13 +3,13 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-5O5OUAHJ.js";
+} from "./chunk-WZTPSXHP.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-VYOIHD4B.js";
+import "./chunk-J7JWBH45.js";
 import "./chunk-Q6PWTATS.js";
-import "./chunk-UYOXEMF5.js";
-import "./chunk-NC3HVQ7O.js";
-import "./chunk-FR4VGZUI.js";
+import "./chunk-6IRGRC3G.js";
+import "./chunk-EITBMRUB.js";
+import "./chunk-EWHFGWB3.js";
 export {
   buildIdentityMap,
   dotPathToJsonbExpr,

package/dist/{runtime-J4TQCY7Z.js → runtime-WB4J6RQK.js}

@@ -5,9 +5,9 @@ import {
   resetBackendSingleton,
   updateRecord,
   upsertRecord
-} from "./chunk-UYOXEMF5.js";
-import "./chunk-NC3HVQ7O.js";
-import "./chunk-FR4VGZUI.js";
+} from "./chunk-6IRGRC3G.js";
+import "./chunk-EITBMRUB.js";
+import "./chunk-EWHFGWB3.js";
 export {
   addRecord,
   closeBackendIfCached,

package/dist/{schema-JKYKFQZD.js → schema-SDZZ7XZT.js}

@@ -1,16 +1,16 @@
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-VYOIHD4B.js";
+} from "./chunk-J7JWBH45.js";
 import {
   isAgentMode,
   note
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-UYOXEMF5.js";
-import "./chunk-NC3HVQ7O.js";
-import "./chunk-FR4VGZUI.js";
+} from "./chunk-6IRGRC3G.js";
+import "./chunk-EITBMRUB.js";
+import "./chunk-EWHFGWB3.js";
 
 // src/lib/memory/sync/schema.ts
 import pc from "picocolors";

package/dist/sql-BNSA2GZM.js

@@ -0,0 +1,13 @@
+import {
+  memSqlCommand,
+  syncSqlCommand
+} from "./chunk-DGQOAFXJ.js";
+import "./chunk-J7JWBH45.js";
+import "./chunk-Q6PWTATS.js";
+import "./chunk-6IRGRC3G.js";
+import "./chunk-EITBMRUB.js";
+import "./chunk-EWHFGWB3.js";
+export {
+  memSqlCommand,
+  syncSqlCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.11.1",
+  "version": "2.12.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/dist/sql-XCMEVSVD.js

@@ -1,13 +0,0 @@
-import {
-  memSqlCommand,
-  syncSqlCommand
-} from "./chunk-WWPH6JOO.js";
-import "./chunk-VYOIHD4B.js";
-import "./chunk-Q6PWTATS.js";
-import "./chunk-UYOXEMF5.js";
-import "./chunk-NC3HVQ7O.js";
-import "./chunk-FR4VGZUI.js";
-export {
-  memSqlCommand,
-  syncSqlCommand
-};