@withone/cli 2.12.0 → 2.13.0

package/README.md

@@ -748,6 +748,8 @@ Precedence: env var > `.onerc` > `~/.one/config.json`. The access keys are the e
 
 The access settings are enforced on every call to a connected app, whatever the command: `actions execute`, flows, sync and its validation runs. Headers named `x-one-secret`, `x-one-connection-key` or `x-one-action-id` cannot be passed with `--headers`, method-override headers are judged against the permission level, and a path variable cannot be `.` or `..`.
 
+They also apply to commands that change One's own resources. Creating, updating or activating a relay needs the `write` level and deleting one needs `admin`; `connection delete` needs `admin`; knowledge-only refuses all of them. A relay's `passthrough` actions are checked like `actions execute` when they are set, because they run later on One's servers. `url` and `agent` relay actions are allowed only when the connection and action allowlists are both `*`. With a connection allowlist, relay endpoints, events and deliveries on other connections are hidden or refused.
+
 ```bash
 # .onerc
 ONE_SECRET=sk_live_xxx

package/dist/{chunk-EITBMRUB.js → chunk-2OIJGF77.js}

@@ -3,7 +3,7 @@ import {
   readConfig,
   setOpenAiApiKey,
   writeConfig
-} from "./chunk-EWHFGWB3.js";
+} from "./chunk-XUAUDMQE.js";
 
 // src/lib/memory/config.ts
 var DEFAULT_MEMORY_CONFIG = {

package/dist/{chunk-6IRGRC3G.js → chunk-4H5L3SBY.js}

@@ -5,11 +5,11 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-EITBMRUB.js";
+} from "./chunk-2OIJGF77.js";
 import {
   getOpenAiApiKey,
   homeDir
-} from "./chunk-EWHFGWB3.js";
+} from "./chunk-XUAUDMQE.js";
 
 // src/lib/memory/schema.ts
 var SCHEMA_VERSION = "2.3.1";

package/dist/{chunk-J7JWBH45.js → chunk-B5YDLVY5.js}

@@ -5,11 +5,11 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getMemoryConfigOrDefault
-} from "./chunk-EITBMRUB.js";
+} from "./chunk-2OIJGF77.js";
 import {
   getOpenAiApiKey,
   readConfig
-} from "./chunk-EWHFGWB3.js";
+} from "./chunk-XUAUDMQE.js";
 
 // src/commands/mem/util.ts
 function requireMemoryInit() {

package/dist/{chunk-WZTPSXHP.js → chunk-LEJKEGB6.js}

@@ -4,7 +4,7 @@ import {
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-J7JWBH45.js";
+} from "./chunk-B5YDLVY5.js";
 import {
   isAgentMode,
   note
@@ -12,7 +12,7 @@ import {
 import {
   getBackend,
   upsertRecord
-} from "./chunk-6IRGRC3G.js";
+} from "./chunk-4H5L3SBY.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{chunk-DGQOAFXJ.js → chunk-TSMVFVQ3.js}

@@ -1,6 +1,6 @@
 import {
   requireMemoryInit
-} from "./chunk-J7JWBH45.js";
+} from "./chunk-B5YDLVY5.js";
 import {
   error,
   isAgentMode,
@@ -8,7 +8,7 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-6IRGRC3G.js";
+} from "./chunk-4H5L3SBY.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-7ZBRP3BJ.js → chunk-UZC3IHLW.js}

@@ -29,7 +29,7 @@ import {
   writeAnalyticsQueue,
   writeUsageLog,
   writeUsageState
-} from "./chunk-EWHFGWB3.js";
+} from "./chunk-XUAUDMQE.js";
 
 // src/lib/flow-runner.ts
 import fs5 from "fs";
@@ -3000,7 +3000,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-6QTY3U2C.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-Y4DW3UD3.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{chunk-EWHFGWB3.js → chunk-XUAUDMQE.js}

@@ -78,6 +78,42 @@ function intersectAllowlists(a, b) {
   if (b.includes("*")) return a;
   return a.filter((x) => b.includes(x));
 }
+function checkManagementAccess(settings, op, what) {
+  const permissions = settings.permissions ?? "admin";
+  if (settings.knowledgeAgent) {
+    throw new AccessDeniedError(`${what} is disabled (knowledge-only mode).`);
+  }
+  const method = op === "delete" ? "DELETE" : "POST";
+  if (!isMethodAllowed(method, permissions)) {
+    throw new AccessDeniedError(`${what} needs ${op === "delete" ? 'the "admin"' : 'the "write" or "admin"'} permission level (current: "${permissions}").`);
+  }
+}
+function allowlistsUnrestricted(settings) {
+  return (settings.actionIds ?? ["*"]).includes("*") && (settings.connectionKeys ?? ["*"]).includes("*");
+}
+async function checkRelayActions(settings, actions, methodOf) {
+  if (actions === void 0 || actions === null) return;
+  if (!Array.isArray(actions)) throw new AccessDeniedError("--actions must be a JSON array.");
+  for (const [i, raw] of actions.entries()) {
+    const action = raw ?? {};
+    if (action.type === "passthrough") {
+      const actionId = String(action.actionId ?? "");
+      const connectionKey = String(action.connectionKey ?? "");
+      if (!actionId || !connectionKey) {
+        throw new AccessDeniedError(`Relay action [${i}] needs an actionId and a connectionKey.`);
+      }
+      checkPassthroughAccess({ ...settings, permissions: "admin", knowledgeAgent: false }, { actionId, connectionKey, method: "GET" });
+      const headers = action.headers && typeof action.headers === "object" ? action.headers : void 0;
+      checkPassthroughAccess(settings, { actionId, connectionKey, method: await methodOf(actionId), headers });
+      continue;
+    }
+    if (!allowlistsUnrestricted(settings)) {
+      throw new AccessDeniedError(
+        `Relay action [${i}] of type "${String(action.type)}" forwards events outside the connection and action allowlists, so it is allowed only when both are "*".`
+      );
+    }
+  }
+}
 
 // src/lib/config.ts
 function configDir() {
@@ -535,8 +571,11 @@ export {
   PERMISSION_METHODS,
   isMethodAllowed,
   isActionAllowed,
+  isConnectionAllowed,
   IDENTITY_HEADERS,
   checkPassthroughAccess,
+  checkManagementAccess,
+  checkRelayActions,
   getProjectRoot,
   getProjectConfigPath,
   getGlobalConfigPath,

package/dist/{embedding-7Q22D23K.js → embedding-YIXO45HW.js}

@@ -2,8 +2,8 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-EITBMRUB.js";
-import "./chunk-EWHFGWB3.js";
+} from "./chunk-2OIJGF77.js";
+import "./chunk-XUAUDMQE.js";
 export {
   defaultSearchableText,
   embed,

package/dist/{flow-runner-6QTY3U2C.js → flow-runner-Y4DW3UD3.js}

@@ -12,10 +12,10 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-7ZBRP3BJ.js";
+} from "./chunk-UZC3IHLW.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
-import "./chunk-EWHFGWB3.js";
+import "./chunk-XUAUDMQE.js";
 export {
   FlowRunner,
   collectStepTypes,

package/dist/index.js

@@ -39,10 +39,10 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-7ZBRP3BJ.js";
+} from "./chunk-UZC3IHLW.js";
 import {
   memSqlCommand
-} from "./chunk-DGQOAFXJ.js";
+} from "./chunk-TSMVFVQ3.js";
 import {
   collectIdentityKeys,
   countRecords,
@@ -73,7 +73,7 @@ import {
   writeDraftProfile,
   writePageToMemory,
   writeProfile
-} from "./chunk-WZTPSXHP.js";
+} from "./chunk-LEJKEGB6.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -87,7 +87,7 @@ import {
   requireMemoryInit,
   semanticSearchUpgradeHint,
   semanticSearchUpgradeLine
-} from "./chunk-J7JWBH45.js";
+} from "./chunk-B5YDLVY5.js";
 import {
   cancel,
   createSpinner,
@@ -109,7 +109,7 @@ import {
   listBackendPlugins,
   loadBackendFromConfig,
   updateRecord
-} from "./chunk-6IRGRC3G.js";
+} from "./chunk-4H5L3SBY.js";
 import {
   DEFAULT_MEMORY_CONFIG,
   defaultSearchableText,
@@ -119,9 +119,11 @@ import {
   memoryConfigExists,
   setOpenAiApiKey,
   updateMemoryConfig
-} from "./chunk-EITBMRUB.js";
+} from "./chunk-2OIJGF77.js";
 import {
   PERMISSION_METHODS,
+  checkManagementAccess,
+  checkRelayActions,
   configExists,
   ensureWhoAmI,
   getAccessControl,
@@ -137,6 +139,7 @@ import {
   globalConfigExists,
   homeDir,
   isActionAllowed,
+  isConnectionAllowed,
   isMethodAllowed,
   projectConfigExists,
   readConfig,
@@ -148,7 +151,7 @@ import {
   updateApiBase,
   updateWhoAmI,
   writeConfig
-} from "./chunk-EWHFGWB3.js";
+} from "./chunk-XUAUDMQE.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -2448,6 +2451,11 @@ async function connectionDeleteCommand(connectionKey, options) {
   if (!apiKey) {
     error("Not configured. Run `one init` first.");
   }
+  try {
+    checkManagementAccess(getAccessControlFromAllSources(), "delete", "Deleting a connection");
+  } catch (error2) {
+    error(error2 instanceof Error ? error2.message : String(error2));
+  }
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Finding connection...");
@@ -5525,9 +5533,45 @@ function getConfig3() {
   if (!apiKey) {
     error("Not configured. Run `one init` first.");
   }
-  const ac = getAccessControlFromAllSources();
-  const connectionKeys = ac.connectionKeys || ["*"];
-  return { apiKey, connectionKeys };
+  const settings = getAccessControlFromAllSources();
+  const connectionKeys = settings.connectionKeys || ["*"];
+  return { apiKey, connectionKeys, settings };
+}
+async function connectionIdFilter(api, settings) {
+  const keys = settings.connectionKeys ?? ["*"];
+  if (keys.includes("*")) return () => true;
+  const connections = await api.listConnections();
+  const ids = new Set(connections.filter((c) => isConnectionAllowed(c.key, keys)).map((c) => c.id));
+  return (id) => ids.has(id);
+}
+function restricted(settings) {
+  return !(settings.connectionKeys ?? ["*"]).includes("*");
+}
+async function allowedEndpoint(api, settings, id) {
+  const allowed = await connectionIdFilter(api, settings);
+  const endpoint = await api.getRelayEndpoint(id);
+  if (!allowed(endpoint.connectionId)) {
+    throw new Error(`Relay endpoint "${id}" is on a connection that is not allowed.`);
+  }
+  return endpoint;
+}
+async function allowedEvent(api, settings, id) {
+  const allowed = await connectionIdFilter(api, settings);
+  const event = await api.getRelayEvent(id);
+  if (!allowed(event.connectionId)) {
+    throw new Error(`Relay event "${id}" is on a connection that is not allowed.`);
+  }
+  return event;
+}
+function actionMethod(api) {
+  return async (actionId) => (await resolveActionDetails(api, actionId)).details.method;
+}
+function guard(check) {
+  try {
+    check();
+  } catch (error2) {
+    error(error2 instanceof Error ? error2.message : String(error2));
+  }
 }
 function parseJsonArg3(value, argName) {
   try {
@@ -5537,7 +5581,8 @@ function parseJsonArg3(value, argName) {
   }
 }
 async function relayCreateCommand(options) {
-  const { apiKey, connectionKeys } = getConfig3();
+  const { apiKey, connectionKeys, settings } = getConfig3();
+  guard(() => checkManagementAccess(settings, "write", "Creating a relay endpoint"));
   if (!connectionKeys.includes("*") && !connectionKeys.includes(options.connectionKey)) {
     error(`Connection key "${options.connectionKey}" is not allowed.`);
   }
@@ -5577,7 +5622,7 @@ async function relayCreateCommand(options) {
   }
 }
 async function relayListCommand(options) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Loading relay endpoints...");
@@ -5586,10 +5631,13 @@ async function relayListCommand(options) {
     if (options.limit) query.limit = options.limit;
     if (options.page) query.page = options.page;
     const result = await api.listRelayEndpoints(query);
-    const endpoints = result.rows || [];
+    const allowed = await connectionIdFilter(api, settings);
+    const endpoints = (result.rows || []).filter((e) => allowed(e.connectionId));
     if (isAgentMode()) {
       json({
-        total: result.total,
+        // With a connection allowlist the server's total also counts rows
+        // the allowlist hides, so report only what is shown.
+        total: restricted(settings) ? endpoints.length : result.total,
         showing: endpoints.length,
         endpoints: endpoints.map((e) => ({
           id: e.id,
@@ -5630,12 +5678,12 @@ async function relayListCommand(options) {
   }
 }
 async function relayGetCommand(id) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Loading relay endpoint...");
   try {
-    const result = await api.getRelayEndpoint(id);
+    const result = await allowedEndpoint(api, settings, id);
     if (isAgentMode()) {
       json(result);
       return;
@@ -5661,7 +5709,8 @@ async function relayGetCommand(id) {
   }
 }
 async function relayUpdateCommand(id, options) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
+  guard(() => checkManagementAccess(settings, "write", "Updating a relay endpoint"));
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Updating relay endpoint...");
@@ -5672,6 +5721,9 @@ async function relayUpdateCommand(id, options) {
     if (options.eventFilters) body.eventFilters = parseJsonArg3(options.eventFilters, "--event-filters");
     if (options.tags) body.tags = parseJsonArg3(options.tags, "--tags");
     if (options.actions) body.actions = parseJsonArg3(options.actions, "--actions");
+    const existing = await allowedEndpoint(api, settings, id);
+    const effective = body.actions ?? (options.active === true ? existing.actions : void 0);
+    await checkRelayActions(settings, effective, actionMethod(api));
     const result = await api.updateRelayEndpoint(id, body);
     if (isAgentMode()) {
       json(result);
@@ -5688,11 +5740,13 @@ async function relayUpdateCommand(id, options) {
   }
 }
 async function relayDeleteCommand(id) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
+  guard(() => checkManagementAccess(settings, "delete", "Deleting a relay endpoint"));
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Deleting relay endpoint...");
   try {
+    await allowedEndpoint(api, settings, id);
     const result = await api.deleteRelayEndpoint(id);
     if (isAgentMode()) {
       json({ deleted: true, id: result.id });
@@ -5707,12 +5761,15 @@ async function relayDeleteCommand(id) {
   }
 }
 async function relayActivateCommand(id, options) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
+  guard(() => checkManagementAccess(settings, "write", "Activating a relay endpoint"));
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Activating relay endpoint...");
   try {
     const actions2 = parseJsonArg3(options.actions, "--actions");
+    await allowedEndpoint(api, settings, id);
+    await checkRelayActions(settings, actions2, actionMethod(api));
     const body = { actions: actions2 };
     if (options.webhookSecret) body.webhookSecret = options.webhookSecret;
     const result = await api.activateRelayEndpoint(id, body);
@@ -5731,7 +5788,7 @@ async function relayActivateCommand(id, options) {
   }
 }
 async function relayEventsCommand(options) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Loading relay events...");
@@ -5744,10 +5801,13 @@ async function relayEventsCommand(options) {
     if (options.after) query.after = options.after;
     if (options.before) query.before = options.before;
     const result = await api.listRelayEvents(query);
-    const events = result.rows || [];
+    const allowed = await connectionIdFilter(api, settings);
+    const events = (result.rows || []).filter((e) => allowed(e.connectionId));
     if (isAgentMode()) {
       json({
-        total: result.total,
+        // With a connection allowlist the server's total also counts rows
+        // the allowlist hides, so report only what is shown.
+        total: restricted(settings) ? events.length : result.total,
         showing: events.length,
         events: events.map((e) => ({
           id: e.id,
@@ -5783,12 +5843,12 @@ async function relayEventsCommand(options) {
   }
 }
 async function relayEventGetCommand(id) {
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Loading relay event...");
   try {
-    const result = await api.getRelayEvent(id);
+    const result = await allowedEvent(api, settings, id);
     if (isAgentMode()) {
       json(result);
       return;
@@ -5811,11 +5871,13 @@ async function relayDeliveriesCommand(options) {
   if (!options.endpointId && !options.eventId) {
     error("Provide either --endpoint-id or --event-id");
   }
-  const { apiKey } = getConfig3();
+  const { apiKey, settings } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
   const spinner = createSpinner();
   spinner.start("Loading deliveries...");
   try {
+    if (options.endpointId) await allowedEndpoint(api, settings, options.endpointId);
+    else await allowedEvent(api, settings, options.eventId);
     const deliveries = options.endpointId ? await api.listRelayEndpointDeliveries(options.endpointId) : await api.listRelayEventDeliveries(options.eventId);
     const items = Array.isArray(deliveries) ? deliveries : deliveries.rows || [];
     if (isAgentMode()) {
@@ -7427,7 +7489,7 @@ async function syncModel(api, profile, options) {
         updateModelState(platform, model, { status: "failed", pagesProcessed, lastCursor }),
         (async () => {
           try {
-            const { getBackend: getBackend2 } = await import("./runtime-WB4J6RQK.js");
+            const { getBackend: getBackend2 } = await import("./runtime-2OVXKNJS.js");
             const backend = await getBackend2();
             await Promise.race([
               backend.close(),
@@ -7793,7 +7855,7 @@ async function syncModel(api, profile, options) {
         db.exec(`DROP TABLE IF EXISTS _seen_ids`);
       }
       if (options.toMemory !== false) {
-        const backend = await (await import("./runtime-WB4J6RQK.js")).getBackend();
+        const backend = await (await import("./runtime-2OVXKNJS.js")).getBackend();
         const type = `${platform}/${model}`;
         const existing = await backend.listKeysByType(type);
         const sourcePrefix = `${type}:`;
@@ -7894,7 +7956,7 @@ async function syncModel(api, profile, options) {
     let statusCounts;
     if (options.toMemory !== false) {
       try {
-        const backend = await (await import("./runtime-WB4J6RQK.js")).getBackend();
+        const backend = await (await import("./runtime-2OVXKNJS.js")).getBackend();
         const typeName = `${platform}/${model}`;
         const [active, archived] = await Promise.all([
           backend.count(typeName, { status: "active" }),
@@ -9616,7 +9678,7 @@ ${result.total} results`);
   }
 }
 async function syncSqlCommand(platformModel, sql) {
-  const { syncSqlCommand: runSyncSql } = await import("./sql-BNSA2GZM.js");
+  const { syncSqlCommand: runSyncSql } = await import("./sql-KRQUWOPT.js");
   await runSyncSql(platformModel, sql);
 }
 async function syncDeleteCommand(platformModel, options) {
@@ -9694,7 +9756,7 @@ async function syncDeleteCommand(platformModel, options) {
 async function maybeAutoMigrateLegacy(platform, models) {
   const dbSize = getDatabaseSize(platform);
   if (!dbSize || dbSize === "0 B") return;
-  const { getBackend: getBackend2 } = await import("./runtime-WB4J6RQK.js");
+  const { getBackend: getBackend2 } = await import("./runtime-2OVXKNJS.js");
   const backend = await getBackend2();
   let memoryHasData = false;
   for (const model of models) {
@@ -9710,7 +9772,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-KKNH3745.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-RJ7F2LPT.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -9719,7 +9781,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p6.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-KKNH3745.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-RJ7F2LPT.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -9780,7 +9842,7 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = await readSyncState();
-  const { getBackend: getBackend2 } = await import("./runtime-WB4J6RQK.js");
+  const { getBackend: getBackend2 } = await import("./runtime-2OVXKNJS.js");
   const backend = await getBackend2();
   const syncs = await Promise.all(profiles.map(async (p9) => {
     const modelState = state[p9.platform]?.[p9.model];
@@ -10056,7 +10118,7 @@ function registerSyncSubcommands(sync) {
     await syncSqlCommand(platformModel, sql);
   });
   sync.command("schema <platform/model>").description("Inspect the JSON structure of synced records (field paths, types, examples) \u2014 useful before writing `sync sql` queries").action(async (platformModel) => {
-    const { syncSchemaCommand } = await import("./schema-SDZZ7XZT.js");
+    const { syncSchemaCommand } = await import("./schema-FIIT33OD.js");
     await syncSchemaCommand(platformModel);
   });
   sync.command("delete <platform/model>").description('Delete records from local sync data (e.g. one sync delete notion/pages --id "abc-123")').option("--id <value>", "Delete record by ID").option("--where <conditions>", 'Delete records matching conditions (e.g. "status=archived")').option("--where-sql <predicate>", `Delete using a raw SQL WHERE clause (e.g. "json_extract(data, '$.type') = 'promotion'")`).option("--yes", "Skip confirmation prompt").action(async (platformModel, options) => {
@@ -10833,7 +10895,7 @@ async function memDoctorCommand() {
   }
   if (cfg.embedding.provider === "openai") {
     try {
-      const { embed: embed2 } = await import("./embedding-7Q22D23K.js");
+      const { embed: embed2 } = await import("./embedding-YIXO45HW.js");
       const result = await embed2("connectivity check");
       checks.push({
         name: "OpenAI embedding provider reachable",

package/dist/{migrate-KKNH3745.js → migrate-RJ7F2LPT.js}

@@ -3,13 +3,13 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-WZTPSXHP.js";
+} from "./chunk-LEJKEGB6.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-J7JWBH45.js";
+import "./chunk-B5YDLVY5.js";
 import "./chunk-Q6PWTATS.js";
-import "./chunk-6IRGRC3G.js";
-import "./chunk-EITBMRUB.js";
-import "./chunk-EWHFGWB3.js";
+import "./chunk-4H5L3SBY.js";
+import "./chunk-2OIJGF77.js";
+import "./chunk-XUAUDMQE.js";
 export {
   buildIdentityMap,
   dotPathToJsonbExpr,

package/dist/{runtime-WB4J6RQK.js → runtime-2OVXKNJS.js}

@@ -5,9 +5,9 @@ import {
   resetBackendSingleton,
   updateRecord,
   upsertRecord
-} from "./chunk-6IRGRC3G.js";
-import "./chunk-EITBMRUB.js";
-import "./chunk-EWHFGWB3.js";
+} from "./chunk-4H5L3SBY.js";
+import "./chunk-2OIJGF77.js";
+import "./chunk-XUAUDMQE.js";
 export {
   addRecord,
   closeBackendIfCached,

package/dist/{schema-SDZZ7XZT.js → schema-FIIT33OD.js}

@@ -1,16 +1,16 @@
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-J7JWBH45.js";
+} from "./chunk-B5YDLVY5.js";
 import {
   isAgentMode,
   note
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-6IRGRC3G.js";
-import "./chunk-EITBMRUB.js";
-import "./chunk-EWHFGWB3.js";
+} from "./chunk-4H5L3SBY.js";
+import "./chunk-2OIJGF77.js";
+import "./chunk-XUAUDMQE.js";
 
 // src/lib/memory/sync/schema.ts
 import pc from "picocolors";

package/dist/sql-KRQUWOPT.js

@@ -0,0 +1,13 @@
+import {
+  memSqlCommand,
+  syncSqlCommand
+} from "./chunk-TSMVFVQ3.js";
+import "./chunk-B5YDLVY5.js";
+import "./chunk-Q6PWTATS.js";
+import "./chunk-4H5L3SBY.js";
+import "./chunk-2OIJGF77.js";
+import "./chunk-XUAUDMQE.js";
+export {
+  memSqlCommand,
+  syncSqlCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.12.0",
+  "version": "2.13.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/dist/sql-BNSA2GZM.js

@@ -1,13 +0,0 @@
-import {
-  memSqlCommand,
-  syncSqlCommand
-} from "./chunk-DGQOAFXJ.js";
-import "./chunk-J7JWBH45.js";
-import "./chunk-Q6PWTATS.js";
-import "./chunk-6IRGRC3G.js";
-import "./chunk-EITBMRUB.js";
-import "./chunk-EWHFGWB3.js";
-export {
-  memSqlCommand,
-  syncSqlCommand
-};