@withone/cli 2.4.0 → 2.6.0

package/dist/{migrate-3LSEIPRF.js → migrate-KWEEEQ3E.js}

@@ -3,9 +3,10 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-XKUTG7JD.js";
+} from "./chunk-PUQKTRYC.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-NOFJ4NYD.js";
+import "./chunk-VMFWA43Q.js";
+import "./chunk-Q6PWTATS.js";
 import "./chunk-NOPTG4GC.js";
 import "./chunk-3HRC3IPE.js";
 import "./chunk-HTXZZQ6U.js";

package/dist/{schema-FICQRMZ7.js → schema-YJ7JTGFL.js}

@@ -1,9 +1,11 @@
 import {
-  isAgentMode,
-  note,
   okJson,
   requireMemoryInit
-} from "./chunk-NOFJ4NYD.js";
+} from "./chunk-VMFWA43Q.js";
+import {
+  isAgentMode,
+  note
+} from "./chunk-Q6PWTATS.js";
 import {
   getBackend
 } from "./chunk-NOPTG4GC.js";

package/dist/{sql-AKQSXRV2.js → sql-NDMMFQP6.js}

@@ -1,8 +1,9 @@
 import {
   memSqlCommand,
   syncSqlCommand
-} from "./chunk-7FPQOAQ4.js";
-import "./chunk-NOFJ4NYD.js";
+} from "./chunk-O3HDWHHS.js";
+import "./chunk-VMFWA43Q.js";
+import "./chunk-Q6PWTATS.js";
 import "./chunk-NOPTG4GC.js";
 import "./chunk-3HRC3IPE.js";
 import "./chunk-HTXZZQ6U.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/SKILL.md

@@ -47,7 +47,7 @@ Always follow this sequence when the user wants to do something on a connected p
 one --agent connection list
 ```
 
-Returns connected platforms with their connection keys (needed for execution), platform names in kebab-case (needed for finding actions), and an `access` field per connection telling you what you may run there.
+Returns connected platforms with their connection keys (needed for execution), platform names in kebab-case (needed for finding actions), and an `access` field per connection telling you what you may run there. `access` is what One enforces for this key (the choices made on the consent page, or later in the dashboard), narrowed by any limits set with `one config`; `access.level` names it the way the consent page does: `full`, `read-write`, `read-only`, `custom` or `none`. When telling the user their access, use those words (Full access, Read & write, Read only, Custom, No access).
 
 **Read `access` before you plan a workflow** — it saves you from discovering a restriction as a 403 halfway through:
 
@@ -57,6 +57,8 @@ Returns connected platforms with their connection keys (needed for execution), p
 | `{"policy": "methods", "methods": ["GET"]}` | Only actions with these HTTP methods will execute — don't propose writes |
 | `{"policy": "actions", "actions": [...]}` | Only these exact actions may run. Each has `actionId`, `title`, `method` — **use them directly**: `actions load <actionId>` reads their docs, no find needed |
 
+`accessSource` is `"server"` when One reported the key's access, or `"local"` when it could not (the `accessHint` says so) — then `access` reflects only this CLI's settings and One may allow less: tell the user it is unverified rather than calling it full access.
+
 Two more fields appear only when relevant:
 - `"knowledgeOnly": true` — `actions execute` is disabled. `actions find` returns each action's whole document with how to call it from code; write integration code instead of executing.
 - `"unresolvedActionIds": [...]` — allowlisted ids that couldn't be looked up; treat them as unavailable and tell the user.