@withone/cli 2.9.2 → 2.11.0

package/dist/index.js

@@ -42,7 +42,7 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-UP2L4XJH.js";
+} from "./chunk-5CPQHXTO.js";
 import {
   memSqlCommand
 } from "./chunk-O3HDWHHS.js";
@@ -152,7 +152,7 @@ import {
 
 // src/cli.ts
 import { createRequire } from "module";
-import path12 from "path";
+import path14 from "path";
 import { Command } from "commander";
 
 // src/commands/init.ts
@@ -180,6 +180,27 @@ function getConnectionUrl(platform, params) {
 function getApiKeyUrl() {
   return `${oneAppUrl()}/settings/api-keys`;
 }
+function connectSetupParams(scope, extra) {
+  const params = new URLSearchParams();
+  if (scope.orgId) params.set("orgId", scope.orgId);
+  if (scope.projectId) params.set("projectId", scope.projectId);
+  if (scope.envFile) params.set("env", scope.envFile);
+  for (const [key, value] of extra) if (value) params.set(key, value);
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+function getConnectSetupUrl(opts) {
+  const target = opts.clientId ? encodeURIComponent(opts.clientId) : "new";
+  const qs = connectSetupParams(opts, [
+    ["set", opts.permissionSetId],
+    ["port", String(opts.port)],
+    ["state", opts.state]
+  ]);
+  return `${oneAppUrl()}/cli/connect/${target}${qs}#z=${opts.handoff}`;
+}
+function getConnectDoneUrl(clientId, outcome, scope) {
+  return `${oneAppUrl()}/cli/connect/${encodeURIComponent(clientId)}${connectSetupParams(scope, [["outcome", outcome]])}`;
+}
 async function openConnectionPage(platform, params) {
   await open(getConnectionUrl(platform, params));
 }
@@ -1065,25 +1086,25 @@ async function loginCommand() {
   let targetScope = "global";
   const existingKey = getApiKey();
   if (existingKey) {
-    const pc17 = (await import("picocolors")).default;
+    const pc18 = (await import("picocolors")).default;
     const resolved = resolveConfig();
     const whoami2 = resolved.config?.whoami;
     const env2 = getEnvFromApiKey(existingKey);
-    const envLabel2 = env2 === "test" ? pc17.yellow("test") : pc17.green("live");
-    const currentScope = resolved.scope === "project" ? pc17.cyan("local config") : pc17.magenta("global config");
+    const envLabel2 = env2 === "test" ? pc18.yellow("test") : pc18.green("live");
+    const currentScope = resolved.scope === "project" ? pc18.cyan("local config") : pc18.magenta("global config");
     const lines = ["You are already logged in.", ""];
     if (whoami2) {
       const contextParts2 = [];
       if (whoami2.organization) contextParts2.push(whoami2.organization.name);
       if (whoami2.project) contextParts2.push(whoami2.project.name);
       const scopeDisplay2 = contextParts2.length > 0 ? contextParts2.join(" / ") : "Personal";
-      lines.push(`${pc17.bold(scopeDisplay2)} ${pc17.dim("\xB7")} ${envLabel2}`);
-      lines.push(`${whoami2.user.name} ${pc17.dim(`(${whoami2.user.email})`)}`);
-      if (whoami2.organization) lines.push(`${pc17.dim("Org:")} ${whoami2.organization.name}`);
-      if (whoami2.project) lines.push(`${pc17.dim("Project:")} ${whoami2.project.name}`);
+      lines.push(`${pc18.bold(scopeDisplay2)} ${pc18.dim("\xB7")} ${envLabel2}`);
+      lines.push(`${whoami2.user.name} ${pc18.dim(`(${whoami2.user.email})`)}`);
+      if (whoami2.organization) lines.push(`${pc18.dim("Org:")} ${whoami2.organization.name}`);
+      if (whoami2.project) lines.push(`${pc18.dim("Project:")} ${whoami2.project.name}`);
     }
     lines.push("");
-    lines.push(`${pc17.dim("Stored in")} ${currentScope}`);
+    lines.push(`${pc18.dim("Stored in")} ${currentScope}`);
     p2.note(lines.join("\n"));
     const scopeChoice = await p2.select({
       message: "Where would you like to log in?",
@@ -1102,42 +1123,42 @@ async function loginCommand() {
   if (!result) return;
   const { apiKey, whoami, keyName, grant, knowledgeOnly } = result;
   saveCredentials(apiKey, targetScope, { keyName, whoami, knowledgeOnly });
-  const pc16 = (await import("picocolors")).default;
+  const pc17 = (await import("picocolors")).default;
   const env = getEnvFromApiKey(apiKey);
   const contextParts = [];
   if (whoami.organization) contextParts.push(whoami.organization.name);
   if (whoami.project) contextParts.push(whoami.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc16.yellow("test") : pc16.green("live");
-  const configLabel = targetScope === "project" ? pc16.cyan("local config") : pc16.magenta("global config");
+  const envLabel = env === "test" ? pc17.yellow("test") : pc17.green("live");
+  const configLabel = targetScope === "project" ? pc17.cyan("local config") : pc17.magenta("global config");
   const infoLines = [
-    `${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`,
-    `${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`
+    `${pc17.bold(scopeDisplay)} ${pc17.dim("\xB7")} ${envLabel}`,
+    `${whoami.user.name} ${pc17.dim(`(${whoami.user.email})`)}`
   ];
-  if (keyName) infoLines.push(`${pc16.dim("Key:")} ${keyName}`);
-  infoLines.push(...grantNoteLines(grant, pc16.dim("Access:")));
-  if (whoami.organization) infoLines.push(`${pc16.dim("Org:")} ${whoami.organization.name}`);
-  if (whoami.project) infoLines.push(`${pc16.dim("Project:")} ${whoami.project.name}`);
+  if (keyName) infoLines.push(`${pc17.dim("Key:")} ${keyName}`);
+  infoLines.push(...grantNoteLines(grant, pc17.dim("Access:")));
+  if (whoami.organization) infoLines.push(`${pc17.dim("Org:")} ${whoami.organization.name}`);
+  if (whoami.project) infoLines.push(`${pc17.dim("Project:")} ${whoami.project.name}`);
   infoLines.push("");
-  infoLines.push(`${pc16.dim("Stored in")} ${configLabel}`);
+  infoLines.push(`${pc17.dim("Stored in")} ${configLabel}`);
   p2.note(infoLines.join("\n"), "Logged in");
   console.log();
-  console.log(`  ${pc16.dim("Next steps:")}`);
-  console.log(`  ${pc16.cyan("one add <platform>")}  ${pc16.dim("\u2014")} Connect a platform (e.g. gmail, slack, stripe)`);
+  console.log(`  ${pc17.dim("Next steps:")}`);
+  console.log(`  ${pc17.cyan("one add <platform>")}  ${pc17.dim("\u2014")} Connect a platform (e.g. gmail, slack, stripe)`);
   console.log();
-  console.log(pc16.bold("  Copy-paste this to your AI agent:"));
+  console.log(pc17.bold("  Copy-paste this to your AI agent:"));
   console.log();
-  console.log(pc16.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(pc16.cyan("  \u2502"));
-  console.log(pc16.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
-  console.log(pc16.cyan("  \u2502  lets you interact with 1000+ third-party platforms (Gmail,"));
-  console.log(pc16.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
-  console.log(pc16.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
-  console.log(pc16.cyan("  \u2502  third-party platform or external service, use the `one`"));
-  console.log(pc16.cyan("  \u2502  skill. Please save this to your project instructions or"));
-  console.log(pc16.cyan("  \u2502  memory so you remember it in future conversations."));
-  console.log(pc16.cyan("  \u2502"));
-  console.log(pc16.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc17.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc17.cyan("  \u2502"));
+  console.log(pc17.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
+  console.log(pc17.cyan("  \u2502  lets you interact with 1000+ third-party platforms (Gmail,"));
+  console.log(pc17.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
+  console.log(pc17.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
+  console.log(pc17.cyan("  \u2502  third-party platform or external service, use the `one`"));
+  console.log(pc17.cyan("  \u2502  skill. Please save this to your project instructions or"));
+  console.log(pc17.cyan("  \u2502  memory so you remember it in future conversations."));
+  console.log(pc17.cyan("  \u2502"));
+  console.log(pc17.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
   p2.outro("Happy building!");
 }
@@ -1322,8 +1343,8 @@ function tildify(filePath) {
 function scopeLabel(scope) {
   return scope === "project" ? pc3.cyan("[project]") : pc3.magenta("[global]");
 }
-function scopedMessage(scope, message) {
-  return `${scopeLabel(scope)} ${message}`;
+function scopedMessage(scope, message2) {
+  return `${scopeLabel(scope)} ${message2}`;
 }
 async function handleExistingConfig(apiKey, scope, options) {
   const statuses = getAgentStatuses();
@@ -1910,8 +1931,8 @@ async function promptConnectIntegrations(apiKey, connParams) {
       { value: "more", label: "Browse all 1000+ platforms" },
       { value: "skip", label: "Skip for now", hint: "you can always run one add later" }
     ];
-    const message = first ? "Connect your first integration?" : "Connect another?";
-    const choice = await p3.select({ message, options });
+    const message2 = first ? "Connect your first integration?" : "Connect another?";
+    const choice = await p3.select({ message: message2, options });
     if (p3.isCancel(choice) || choice === "skip") {
       break;
     }
@@ -3295,7 +3316,7 @@ var CUSTOM_ACTION_NOTE = '\n\nThis is a custom action: ALSO include "connectionK
 function codeGuideAction(action, knowledge, platform, tags, apiBase) {
   const base = apiBase.replace(/\/$/, "");
   const method = action.method.toUpperCase();
-  const path13 = action.path.startsWith("/") ? action.path : `/${action.path}`;
+  const path15 = action.path.startsWith("/") ? action.path : `/${action.path}`;
   const connEnv = `ONE_${platformEnvSegment(platform)}_CONNECTION_KEY`;
   const customNote = tags.includes("custom") ? CUSTOM_ACTION_NOTE : "";
   return `### ${actionHeading(action)}
@@ -3304,7 +3325,7 @@ function codeGuideAction(action, knowledge, platform, tags, apiBase) {
 ${knowledge ?? NO_KNOWLEDGE}
 
 ## Calling this action from code
-URL:    ${base}/passthrough${path13}
+URL:    ${base}/passthrough${path15}
 Method: ${method}
 Headers:
 - x-one-secret: the value of the ONE_SECRET env var
@@ -3315,7 +3336,7 @@ Headers:
 Environment variables: ONE_SECRET (their One API key) and ${connEnv} (the key of their ${platform} connection), both from the One dashboard.
 
 \`\`\`typescript
-const response = await fetch("${base}/passthrough${path13}", {
+const response = await fetch("${base}/passthrough${path15}", {
 method: "${method}",
 headers: {
 "x-one-secret": process.env.ONE_SECRET,
@@ -4065,32 +4086,32 @@ function validateStepsArray(steps, pathPrefix, errors) {
   const validTypes = FLOW_SCHEMA.stepTypes.map((st) => st.type);
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path13 = `${pathPrefix}[${i}]`;
+    const path15 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path13, message: "Step must be an object" });
+      errors.push({ path: path15, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path13}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path15}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path13}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path15}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !validTypes.includes(s.type)) {
-      errors.push({ path: `${path13}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
+      errors.push({ path: `${path15}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
       continue;
     }
     if (s.requires !== void 0) {
       if (!Array.isArray(s.requires)) {
-        errors.push({ path: `${path13}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
+        errors.push({ path: `${path15}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
       } else {
         for (let r = 0; r < s.requires.length; r++) {
           const sel = s.requires[r];
           if (typeof sel !== "string") {
-            errors.push({ path: `${path13}.requires[${r}]`, message: '"requires" entry must be a selector string' });
+            errors.push({ path: `${path15}.requires[${r}]`, message: '"requires" entry must be a selector string' });
           } else if (!sel.startsWith("$.")) {
-            errors.push({ path: `${path13}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
+            errors.push({ path: `${path15}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
           }
         }
       }
@@ -4098,7 +4119,7 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!FLOW_SCHEMA.errorStrategies.includes(oe.strategy)) {
-        errors.push({ path: `${path13}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
+        errors.push({ path: `${path15}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
       }
     }
     const descriptor = getStepTypeDescriptor(s.type);
@@ -4108,14 +4129,14 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (!configObj || typeof configObj !== "object") {
       const hint = detectFlatConfigHint(s, descriptor);
       errors.push({
-        path: `${path13}.${configKey}`,
+        path: `${path15}.${configKey}`,
         message: `${capitalize(descriptor.type)} step must have a "${configKey}" config object${hint}`
       });
       continue;
     }
     const config2 = configObj;
     for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
-      const fieldPath = `${path13}.${configKey}.${fieldName}`;
+      const fieldPath = `${path15}.${configKey}.${fieldName}`;
       const value = config2[fieldName];
       if (fd.required && (value === void 0 || value === null || value === "")) {
         errors.push({ path: fieldPath, message: `${capitalize(descriptor.type)} must have ${fd.type === "string" ? "a string" : fd.type === "array" ? "a" : "a"} "${fieldName}"` });
@@ -4148,30 +4169,30 @@ function validateStepsArray(steps, pathPrefix, errors) {
       }
     }
     if (descriptor.type === "action") {
-      validateConnectionForm(config2, `${path13}.${configKey}`, errors);
+      validateConnectionForm(config2, `${path15}.${configKey}`, errors);
     }
     if (descriptor.type === "code") {
       const hasSource = typeof config2.source === "string" && config2.source.length > 0;
       const hasModule = typeof config2.module === "string" && config2.module.length > 0;
       if (!hasSource && !hasModule) {
-        errors.push({ path: `${path13}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
+        errors.push({ path: `${path15}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
       } else if (hasSource && hasModule) {
-        errors.push({ path: `${path13}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
+        errors.push({ path: `${path15}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
       }
       if (hasModule) {
         const m = config2.module;
         if (m.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(m)) {
-          errors.push({ path: `${path13}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
+          errors.push({ path: `${path15}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
         } else if (m.split(/[\\/]/).includes("..")) {
-          errors.push({ path: `${path13}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
+          errors.push({ path: `${path15}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
         } else if (!m.endsWith(".mjs")) {
-          errors.push({ path: `${path13}.${configKey}.module`, message: "Code module must be a .mjs file" });
+          errors.push({ path: `${path15}.${configKey}.module`, message: "Code module must be a .mjs file" });
         }
       }
       if (hasSource) {
         const syntaxError = checkCodeSourceSyntax(config2.source);
         if (syntaxError) {
-          errors.push({ path: `${path13}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
+          errors.push({ path: `${path15}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
         }
       }
     }
@@ -4243,16 +4264,16 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path13 = `${pathPrefix}[${i}]`;
+      const path15 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path13}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path15}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       for (const { configKey, fieldName } of nestedKeys) {
         const config2 = step[configKey];
         if (config2 && Array.isArray(config2[fieldName])) {
-          collectIds(config2[fieldName], `${path13}.${configKey}.${fieldName}`);
+          collectIds(config2[fieldName], `${path15}.${configKey}.${fieldName}`);
         }
       }
     }
@@ -4300,7 +4321,7 @@ function validateSelectorReferences(flow2, rootDir) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path13, precedingStepIds) {
+  function checkSelectors(selectors, path15, precedingStepIds) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -4308,15 +4329,15 @@ function validateSelectorReferences(flow2, rootDir) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path13, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path15, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
         const stepId = parts[2].replace(/[\[\]]/g, "").split(/[\[\]]/)[0];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path13, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path15, message: `Selector "${selector}" references undefined step "${stepId}"` });
         } else if (precedingStepIds && !precedingStepIds.has(stepId)) {
           errors.push({
-            path: path13,
+            path: path15,
             message: `Selector "${selector}" references step "${stepId}" which is declared after the current step. Steps execute in declaration order, so this will always resolve to undefined at runtime \u2014 move the dependency earlier in the steps array.`
           });
         }
@@ -4324,20 +4345,20 @@ function validateSelectorReferences(flow2, rootDir) {
     }
   }
   const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
-  function checkOperatorsInSelectorField(value, path13) {
+  function checkOperatorsInSelectorField(value, path15) {
     if (typeof value === "string" && value.startsWith("$.")) {
       if (value.includes("||")) {
-        errors.push({ path: path13, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+        errors.push({ path: path15, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
       } else if (value.includes("&&")) {
-        errors.push({ path: path13, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+        errors.push({ path: path15, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
       }
     } else if (value && typeof value === "object" && !Array.isArray(value)) {
       for (const [k, v] of Object.entries(value)) {
-        checkOperatorsInSelectorField(v, `${path13}.${k}`);
+        checkOperatorsInSelectorField(v, `${path15}.${k}`);
       }
     } else if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        checkOperatorsInSelectorField(value[i], `${path13}[${i}]`);
+        checkOperatorsInSelectorField(value[i], `${path15}[${i}]`);
       }
     }
   }
@@ -4422,10 +4443,10 @@ var VALID_OUTPUT_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "bo
 function isOutputSchemaObject(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function walkOutputSchema(schema, path13) {
+function walkOutputSchema(schema, path15) {
   let current = schema;
-  for (let i = 0; i < path13.length; i++) {
-    const seg = path13[i];
+  for (let i = 0; i < path15.length; i++) {
+    const seg = path15[i];
     if (typeof current === "string") {
       return current === "unknown" || current === "object" || current === "array" ? "opaque" : "opaque";
     }
@@ -5892,6 +5913,488 @@ async function relayEventTypesCommand(platform) {
   }
 }
 
+// src/commands/connect.ts
+import crypto2 from "crypto";
+import fs6 from "fs";
+import path6 from "path";
+import open4 from "open";
+import pc10 from "picocolors";
+
+// src/lib/connect-callback.ts
+import http2 from "http";
+var PORT_RANGE_START2 = 49152;
+var PORT_RANGE_END2 = 65535;
+var MAX_PORT_ATTEMPTS2 = 5;
+var MAX_ID_LENGTH = 200;
+var MAX_ERROR_LENGTH2 = 200;
+var ID_PATTERN = /^[A-Za-z0-9_:.-]+$/;
+function statusPage2(title, body) {
+  return `<!DOCTYPE html>
+<html><head><title>One CLI</title></head>
+<body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#0a0a0a;color:#fafafa">
+<div style="text-align:center">
+<h1 style="font-size:20px;margin:0 0 8px">${title}</h1>
+<p style="color:#a1a1aa;font-size:14px">${body}</p>
+</div></body></html>`;
+}
+var CANCELLED_HTML2 = statusPage2("Nothing was changed", "You can close this tab and run <code>one connect create</code> again.");
+var FAILED_HTML2 = statusPage2("The app wasn't set up", "Return to your terminal for details.");
+function cleanId(value) {
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  return trimmed.length <= MAX_ID_LENGTH && ID_PATTERN.test(trimmed) ? trimmed : void 0;
+}
+function cleanText(value) {
+  if (value === null) return void 0;
+  const cleaned = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, "").trim();
+  return cleaned ? Array.from(cleaned).slice(0, MAX_ERROR_LENGTH2).join("") : void 0;
+}
+function parseConnectCallback(url, expectedState) {
+  if (url.pathname !== "/callback") return { status: 404 };
+  const state = url.searchParams.get("state");
+  if (!state) return { status: 400 };
+  if (state !== expectedState) return { status: 403 };
+  const error2 = cleanText(url.searchParams.get("error"));
+  if (error2 === "cancelled") return { status: 200, outcome: { kind: "cancelled" } };
+  if (error2) return { status: 200, outcome: { kind: "failed", reason: error2 } };
+  const outcome = url.searchParams.get("outcome");
+  const clientId = cleanId(url.searchParams.get("clientId"));
+  const rawSet = url.searchParams.get("permissionSetId");
+  const permissionSetId = rawSet ? cleanId(rawSet) : null;
+  if (outcome !== "created" && outcome !== "updated" && outcome !== "unchanged" || !clientId || permissionSetId === void 0) {
+    return { status: 400 };
+  }
+  return { status: 200, outcome: { kind: "done", outcome, clientId, permissionSetId } };
+}
+function randomPort2() {
+  return PORT_RANGE_START2 + Math.floor(Math.random() * (PORT_RANGE_END2 - PORT_RANGE_START2));
+}
+function startConnectCallbackServer(expectedState, doneUrl) {
+  return new Promise((resolveSetup, rejectSetup) => {
+    let attempts = 0;
+    let resolveResult;
+    const result = new Promise((res) => {
+      resolveResult = res;
+    });
+    function tryListen() {
+      const port = randomPort2();
+      attempts++;
+      const server = http2.createServer((req, res) => {
+        const { status: status2, outcome } = parseConnectCallback(new URL(req.url || "/", `http://localhost:${port}`), expectedState);
+        if (!outcome) {
+          res.writeHead(status2, { "Content-Type": "text/plain" });
+          res.end(status2 === 403 ? "State mismatch" : status2 === 404 ? "Not found" : "Missing required parameters");
+          return;
+        }
+        if (outcome.kind === "done") {
+          res.writeHead(302, { Location: doneUrl(outcome) });
+          res.end();
+        } else {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(outcome.kind === "cancelled" ? CANCELLED_HTML2 : FAILED_HTML2);
+        }
+        resolveResult(outcome);
+      });
+      server.on("error", (err) => {
+        if ((err.code === "EADDRINUSE" || err.code === "EACCES") && attempts < MAX_PORT_ATTEMPTS2) {
+          tryListen();
+          return;
+        }
+        rejectSetup(err);
+      });
+      server.listen(port, "127.0.0.1", () => resolveSetup({ server, port, result }));
+    }
+    tryListen();
+  });
+}
+
+// src/lib/connect-app.ts
+import fs5 from "fs";
+import path5 from "path";
+import zlib from "zlib";
+import { pathToFileURL } from "url";
+var CONFIG_FILES = ["one.connect.ts", "one.connect.mts", "one.connect.mjs", "one.connect.js"];
+var TYPES_FILE = "one-connect-env.d.ts";
+function askedTools(config2) {
+  return config2.ask === "everything" ? [] : Object.entries(config2.ask ?? {});
+}
+var ACCESS_METHODS = {
+  "read-only": ["GET"],
+  "read-write": ["GET", "POST", "PUT", "PATCH"],
+  "full-access": null
+};
+var HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+var ACTION_ID_PREFIX = "conn_mod_def::";
+function findConfigFile(cwd, explicit) {
+  if (explicit) {
+    const resolved = path5.resolve(cwd, explicit);
+    return fs5.existsSync(resolved) ? resolved : null;
+  }
+  for (const name of CONFIG_FILES) {
+    const candidate = path5.join(cwd, name);
+    if (fs5.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+async function loadConfigFile(file) {
+  try {
+    const mod = await import(pathToFileURL(file).href);
+    return mod.default ?? mod;
+  } catch (error2) {
+    const { code, message: message2 = "" } = error2;
+    if (code === "ERR_MODULE_NOT_FOUND" && message2.includes("'@withone/connect'")) {
+      throw new Error(
+        `it imports @withone/connect, which isn't installed in this project. Run \`npm i @withone/connect\` first.`
+      );
+    }
+    if (code === "ERR_PACKAGE_PATH_NOT_EXPORTED" && /@withone[\\/]connect/.test(message2)) {
+      throw new Error(
+        `this project's @withone/connect is older than 0.19.0, which added @withone/connect/config. Run \`npm i @withone/connect@latest\` first.`
+      );
+    }
+    if (code === "ERR_UNKNOWN_FILE_EXTENSION" && /\.m?ts$/.test(file)) {
+      throw new Error(
+        `Node ${process.versions.node} can't load ${path5.basename(file)}. Use Node 22.18 or later, or rename it to one.connect.mjs and type it with /** @type {import("@withone/connect/config").ConnectAppConfig} */.`
+      );
+    }
+    throw error2;
+  }
+}
+function validateConfig(value) {
+  const errors = [];
+  const v = value;
+  if (!v || typeof v !== "object") return { errors: ["The config must export an object (use defineConnectApp)."] };
+  if (typeof v.name !== "string" || !v.name.trim()) errors.push("`name` is required.");
+  if (!Array.isArray(v.redirectUris) || v.redirectUris.length === 0) {
+    errors.push("`redirectUris` needs at least one callback URL.");
+  } else {
+    for (const uri of v.redirectUris) {
+      if (typeof uri !== "string" || !/^https?:\/\//.test(uri)) errors.push(`Redirect URI "${uri}" must be an http(s) URL.`);
+    }
+  }
+  if (v.reason !== void 0 && (typeof v.reason !== "string" || v.reason.trim().length === 0 || v.reason.length > 200)) {
+    errors.push("`reason` must be one sentence of at most 200 characters.");
+  }
+  if (v.branding) {
+    for (const key of ["panelColor", "buttonColor"]) {
+      if (!HEX_COLOR.test(String(v.branding[key] ?? ""))) errors.push(`\`branding.${key}\` must be a #RRGGBB colour.`);
+    }
+  }
+  const asked = v.ask;
+  if (asked === void 0) {
+    errors.push('`ask` is required: name the tools the app asks for, or write `ask: "everything"`.');
+  } else if (typeof asked === "string") {
+    if (asked !== "everything") errors.push(`\`ask\` is "${asked}"; it must be a map of tools or "everything".`);
+  } else if (!asked || typeof asked !== "object" || Array.isArray(asked)) {
+    errors.push('`ask` must be a map of tools or "everything".');
+  } else if (Object.keys(asked).length === 0) {
+    errors.push('`ask` names no tools. Name at least one, or write `ask: "everything"`.');
+  }
+  const tools = asked && typeof asked === "object" && !Array.isArray(asked) ? Object.entries(asked) : [];
+  for (const [tool, ask] of tools) {
+    const access = ask?.access;
+    if (access === "custom") {
+      const actions2 = ask.actions;
+      if (!Array.isArray(actions2) || actions2.length === 0) errors.push(`\`ask.${tool}\` is custom, so it needs at least one action.`);
+    } else if (typeof access !== "string" || !(access in ACCESS_METHODS)) {
+      errors.push(`\`ask.${tool}.access\` must be read-only, read-write, full-access or custom.`);
+    }
+  }
+  return errors.length > 0 ? { errors } : { config: v };
+}
+function actionName(title) {
+  const words = title.split(/[^A-Za-z0-9]+/).filter(Boolean);
+  return words.map((word, i) => i === 0 ? word.toLowerCase() : word[0].toUpperCase() + word.slice(1).toLowerCase()).join("");
+}
+function actionNames(actions2) {
+  const byName = /* @__PURE__ */ new Map();
+  const shared = /* @__PURE__ */ new Set();
+  for (const action of actions2) {
+    const name = actionName(action.title);
+    if (!name) continue;
+    if (byName.has(name)) shared.add(name);
+    else byName.set(name, action.systemId);
+  }
+  for (const name of shared) byName.delete(name);
+  return byName;
+}
+function resolveActions(refs, names, ids) {
+  const resolved = [];
+  const unknown = [];
+  for (const ref2 of refs) {
+    const id = ref2.startsWith(ACTION_ID_PREFIX) ? ids.has(ref2) ? ref2 : void 0 : names.get(ref2);
+    if (id) resolved.push(id);
+    else unknown.push(ref2);
+  }
+  return unknown.length > 0 ? { unknown } : { ids: [...new Set(resolved)] };
+}
+function connectorRule(connectionDefinitionId, ask, actionIds = []) {
+  if (ask.access === "custom") return { type: "connectionDefinition", connectionDefinitionId, methods: null, actionIds };
+  return { type: "connectionDefinition", connectionDefinitionId, methods: ACCESS_METHODS[ask.access], actionIds: null };
+}
+function clientFields(config2) {
+  const fields = { name: config2.name.trim(), redirectUris: config2.redirectUris };
+  if (config2.description) fields.description = config2.description;
+  if (config2.logoUrl) fields.logoUrl = config2.logoUrl;
+  if (config2.homepageUrl) fields.homepageUrl = config2.homepageUrl;
+  if (config2.reason) fields.consentReason = config2.reason.trim();
+  if (config2.branding) {
+    fields.frontend = {
+      panelColor: config2.branding.panelColor,
+      buttonColor: config2.branding.buttonColor,
+      cobrandEmail: config2.branding.cobrandEmail ?? false
+    };
+  }
+  return fields;
+}
+function buildHandoff(config2, rules) {
+  return {
+    v: 2,
+    app: clientFields(config2),
+    ask: config2.ask === "everything" ? { kind: "everything" } : { kind: "tools", rules }
+  };
+}
+function encodeHandoff(handoff) {
+  return zlib.deflateRawSync(Buffer.from(JSON.stringify(handoff), "utf8"), { level: 9 }).toString("base64url");
+}
+var MAX_HANDOFF_LENGTH = 32e3;
+var MAX_WINDOWS_OPEN_LENGTH = 11e3;
+function defaultEnvFile(cwd) {
+  const local = path5.join(cwd, ".env.local");
+  return fs5.existsSync(local) ? local : path5.join(cwd, ".env");
+}
+function readEnvValue(text5, key) {
+  const match = text5.match(new RegExp(`^${key}=(.*)$`, "m"));
+  return match ? match[1].trim().replace(/^["']|["']$/g, "") : void 0;
+}
+function upsertEnv(text5, values) {
+  let next = text5;
+  const appended = [];
+  for (const [key, value] of Object.entries(values)) {
+    const line = new RegExp(`^${key}=.*$`, "m");
+    if (line.test(next)) {
+      if (value !== null) next = next.replace(line, `${key}=${value}`);
+    } else {
+      appended.push(`${key}=${value ?? ""}`);
+    }
+  }
+  if (appended.length === 0) return next;
+  const separator = next.length === 0 || next.endsWith("\n") ? "" : "\n";
+  return `${next}${separator}${appended.join("\n")}
+`;
+}
+function removeEnvKeys(text5, keys) {
+  return keys.reduce((next, key) => next.replace(new RegExp(`^${key}=.*(?:\r?
+|$)`, "m"), ""), text5);
+}
+function renderTypes(tools, actionsByTool) {
+  const literal = (value) => JSON.stringify(value);
+  const union = (values) => values.length > 0 ? values.map(literal).join(" | ") : "never";
+  const actionLines = Object.entries(actionsByTool).sort(([a], [b]) => a.localeCompare(b)).map(([tool, names]) => `      ${literal(tool)}: ${union([...names].sort())};`);
+  return [
+    "// Generated by `one connect types`. Run it again after changing the tools in one.connect.ts.",
+    'import "@withone/connect/config";',
+    "",
+    'declare module "@withone/connect/config" {',
+    "  interface ConnectRegistry {",
+    `    tools: ${union([...tools].sort())};`,
+    "    actions: {",
+    ...actionLines,
+    "    };",
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+
+// src/commands/connect.ts
+var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
+function requireApi() {
+  const apiKey = getApiKey();
+  if (!apiKey) error("Not configured. Run `one init` first.");
+  return new OneApi(apiKey, getApiBase());
+}
+async function readConfig2(cwd, explicit) {
+  const file = findConfigFile(cwd, explicit);
+  if (!file) {
+    error(
+      explicit ? `No config at ${explicit}.` : "No one.connect.ts here. Create one with defineConnectApp from @withone/connect/config."
+    );
+  }
+  let loaded;
+  try {
+    loaded = await loadConfigFile(file);
+  } catch (error2) {
+    error(`Couldn't load ${path6.basename(file)}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
+  const checked = validateConfig(loaded);
+  if ("errors" in checked) error(`${path6.basename(file)} has problems:
+  ${checked.errors.join("\n  ")}`);
+  return { file, config: checked.config };
+}
+function message(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function buildRules(api, config2) {
+  const asked = askedTools(config2);
+  if (asked.length === 0) return [];
+  const platforms = await api.listPlatforms();
+  const idBySlug = new Map(platforms.map((p9) => [p9.platform, p9.id]));
+  const unknownTools = asked.map(([slug]) => slug).filter((slug) => !idBySlug.has(slug));
+  if (unknownTools.length > 0) {
+    error(`Not in One's catalog: ${unknownTools.join(", ")}. Run \`one platforms\` for the slugs.`);
+  }
+  const rules = [];
+  for (const [slug, ask] of asked) {
+    const definitionId = idBySlug.get(slug);
+    if (ask.access !== "custom") {
+      rules.push(connectorRule(definitionId, ask));
+      continue;
+    }
+    const actions2 = await api.listAllAvailableActions(slug);
+    const resolved = resolveActions(ask.actions, actionNames(actions2), new Set(actions2.map((a) => a.systemId)));
+    if ("unknown" in resolved) {
+      error(
+        `${slug} has no action named ${resolved.unknown.join(", ")}. Run \`one connect types\` for the names, or \`one actions find ${slug} "<what it does>" --no-knowledge\` for an id.`
+      );
+    }
+    rules.push(connectorRule(definitionId, ask, resolved.ids));
+  }
+  return rules;
+}
+async function connectCreateCommand(options) {
+  const cwd = process.cwd();
+  const api = requireApi();
+  const { file, config: config2 } = await readConfig2(cwd, options.config);
+  const envFile = options.envFile ? path6.resolve(cwd, options.envFile) : defaultEnvFile(cwd);
+  const envText = fs6.existsSync(envFile) ? fs6.readFileSync(envFile, "utf8") : "";
+  const existingId = readEnvValue(envText, "ONE_CLIENT_ID") || void 0;
+  const spinner = createSpinner();
+  spinner.start(`Reading ${path6.basename(file)}...`);
+  let server;
+  let timer;
+  try {
+    const rules = await buildRules(api, config2);
+    const whoami = await ensureWhoAmI(api);
+    const scope = {
+      orgId: whoami?.organization?.id,
+      projectId: whoami?.project?.id,
+      envFile: path6.basename(envFile)
+    };
+    const handoff = encodeHandoff(buildHandoff(config2, rules));
+    if (handoff.length > MAX_HANDOFF_LENGTH) {
+      error(
+        `${path6.basename(file)} is too big to hand to the browser (${Math.ceil(handoff.length / 1024)} KB compressed, limit ${Math.floor(MAX_HANDOFF_LENGTH / 1024)} KB). Give tools with long custom lists an access level instead.`
+      );
+    }
+    const state = crypto2.randomBytes(16).toString("hex");
+    const started = await startConnectCallbackServer(
+      state,
+      (done) => getConnectDoneUrl(done.clientId, done.outcome, scope)
+    );
+    server = started.server;
+    const url = getConnectSetupUrl({
+      ...scope,
+      clientId: existingId,
+      permissionSetId: readEnvValue(envText, "ONE_PERMISSION_SET") || void 0,
+      port: started.port,
+      state,
+      handoff
+    });
+    const tooLongToOpen = process.platform === "win32" && url.length > MAX_WINDOWS_OPEN_LENGTH;
+    const opening = options.open !== false && !tooLongToOpen;
+    if (opening) await open4(url).catch(() => void 0);
+    const verb = existingId ? "Approve the update" : "Create the app";
+    if (isAgentMode()) {
+      process.stderr.write(`${verb} in the browser: ${url}
+`);
+    } else {
+      spinner.stop(opening ? `${verb} in your browser` : `${verb}: open this link in your browser`);
+      console.log(`  ${pc10.underline(url)}`);
+      console.log();
+      spinner.start("Waiting for you to approve it...");
+    }
+    const outcome = await Promise.race([
+      started.result,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), SETUP_TIMEOUT_MS);
+      })
+    ]);
+    if (!outcome) error("Timed out waiting for the browser. Run `one connect create` again.");
+    if (outcome.kind === "cancelled") error("Cancelled in the browser. Nothing was changed.");
+    if (outcome.kind === "failed") error(`The setup page reported: ${outcome.reason}`);
+    const created = outcome.outcome === "created";
+    const asksForEverything = config2.ask === "everything";
+    fs6.writeFileSync(
+      envFile,
+      upsertEnv(asksForEverything ? removeEnvKeys(envText, ["ONE_PERMISSION_SET"]) : envText, {
+        ONE_CLIENT_ID: outcome.clientId,
+        ONE_REDIRECT_URI: config2.redirectUris[0],
+        ...!asksForEverything && outcome.permissionSetId ? { ONE_PERMISSION_SET: outcome.permissionSetId } : {},
+        ...created ? { ONE_CLIENT_SECRET: null, ONE_CONNECT_KEY: null } : {}
+      })
+    );
+    const result = {
+      outcome: outcome.outcome,
+      clientId: outcome.clientId,
+      permissionSetId: asksForEverything ? null : outcome.permissionSetId,
+      asksForEverything,
+      redirectUris: config2.redirectUris,
+      envFile: path6.relative(cwd, envFile) || envFile
+    };
+    if (isAgentMode()) {
+      json(result);
+      return;
+    }
+    spinner.stop(
+      created ? `Created ${config2.name}` : outcome.outcome === "updated" ? `Updated ${config2.name}` : `${config2.name} is up to date`
+    );
+    console.log();
+    console.log(`  ${pc10.dim("Client ID:")}       ${outcome.clientId}`);
+    if (asksForEverything) console.log(`  ${pc10.dim("Asks for:")}        everything the user has connected`);
+    else if (outcome.permissionSetId) console.log(`  ${pc10.dim("Permission set:")}  ${outcome.permissionSetId}`);
+    console.log(`  ${pc10.dim("Wrote")}            ${result.envFile}`);
+    if (created) {
+      console.log(`  ${pc10.dim("The two secrets came from the browser page, never through here.")}`);
+    }
+    console.log();
+  } catch (error2) {
+    spinner.stop("Failed");
+    error(`Error: ${message(error2)}`);
+  } finally {
+    if (timer) clearTimeout(timer);
+    server?.close();
+  }
+}
+async function connectTypesCommand(options) {
+  const cwd = process.cwd();
+  const api = requireApi();
+  const spinner = createSpinner();
+  spinner.start("Reading One's catalog...");
+  try {
+    const file = findConfigFile(cwd, options.config);
+    const config2 = file ? validateConfig(await loadConfigFile(file)) : null;
+    const tools = config2 && "config" in config2 ? askedTools(config2.config).map(([slug]) => slug) : [];
+    const platforms = await api.listPlatforms();
+    const known = new Set(platforms.map((p9) => p9.platform));
+    const actionsByTool = {};
+    for (const tool of tools.filter((t) => known.has(t))) {
+      actionsByTool[tool] = [...actionNames(await api.listAllAvailableActions(tool)).keys()];
+    }
+    const target = path6.join(file ? path6.dirname(file) : cwd, TYPES_FILE);
+    fs6.writeFileSync(target, renderTypes([...known], actionsByTool));
+    if (isAgentMode()) {
+      json({ file: target, tools: known.size, actions: actionsByTool });
+      return;
+    }
+    spinner.stop(`Wrote ${path6.relative(cwd, target) || target}`);
+    console.log(`  ${pc10.dim(`${known.size} tools; action names for ${Object.keys(actionsByTool).join(", ") || "none yet (add tools to ask, then run it again)"}`)}`);
+  } catch (error2) {
+    spinner.stop("Failed");
+    error(`Error: ${message(error2)}`);
+  }
+}
+
 // src/lib/memory/sync/models.ts
 function parseActionType(actionKey) {
   const parts = actionKey.split("::");
@@ -6013,11 +6516,11 @@ function handleId(response, config2, records) {
 }
 
 // src/lib/memory/sync/state.ts
-import fs5 from "fs";
-import path5 from "path";
-var SYNC_DIR = path5.join(".one", "sync");
-var STATE_DIR = path5.join(SYNC_DIR, "state");
-var LEGACY_SINGLE_FILE = path5.join(SYNC_DIR, "sync_state.json");
+import fs7 from "fs";
+import path7 from "path";
+var SYNC_DIR = path7.join(".one", "sync");
+var STATE_DIR = path7.join(SYNC_DIR, "state");
+var LEGACY_SINGLE_FILE = path7.join(SYNC_DIR, "sync_state.json");
 var legacyMigrationDone = false;
 function rowToState(row) {
   return {
@@ -6045,9 +6548,9 @@ function stateToRow(platform, model, state, lastError) {
 async function migrateLegacyOnce() {
   if (legacyMigrationDone) return;
   legacyMigrationDone = true;
-  if (fs5.existsSync(LEGACY_SINGLE_FILE)) {
+  if (fs7.existsSync(LEGACY_SINGLE_FILE)) {
     try {
-      const raw = fs5.readFileSync(LEGACY_SINGLE_FILE, "utf-8");
+      const raw = fs7.readFileSync(LEGACY_SINGLE_FILE, "utf-8");
       const legacy = JSON.parse(raw);
       const backend = await getBackend();
       for (const [platform, models] of Object.entries(legacy)) {
@@ -6057,32 +6560,32 @@ async function migrateLegacyOnce() {
           await backend.setSyncState(stateToRow(platform, model, modelState));
         }
       }
-      fs5.unlinkSync(LEGACY_SINGLE_FILE);
+      fs7.unlinkSync(LEGACY_SINGLE_FILE);
     } catch {
       try {
-        fs5.unlinkSync(LEGACY_SINGLE_FILE);
+        fs7.unlinkSync(LEGACY_SINGLE_FILE);
       } catch {
       }
     }
   }
-  if (fs5.existsSync(STATE_DIR)) {
+  if (fs7.existsSync(STATE_DIR)) {
     try {
       const backend = await getBackend();
-      const platforms = fs5.readdirSync(STATE_DIR);
+      const platforms = fs7.readdirSync(STATE_DIR);
       for (const platform of platforms) {
-        const platformDir = path5.join(STATE_DIR, platform);
+        const platformDir = path7.join(STATE_DIR, platform);
         let entries;
         try {
-          entries = fs5.readdirSync(platformDir);
+          entries = fs7.readdirSync(platformDir);
         } catch {
           continue;
         }
         for (const entry of entries) {
           if (!entry.endsWith(".json")) continue;
           const model = entry.slice(0, -".json".length);
-          const filePath = path5.join(platformDir, entry);
+          const filePath = path7.join(platformDir, entry);
           try {
-            const raw = fs5.readFileSync(filePath, "utf-8");
+            const raw = fs7.readFileSync(filePath, "utf-8");
             const modelState = JSON.parse(raw);
             const existing = await backend.getSyncState(platform, model);
             if (!existing) {
@@ -6092,7 +6595,7 @@ async function migrateLegacyOnce() {
           }
         }
       }
-      fs5.rmSync(STATE_DIR, { recursive: true, force: true });
+      fs7.rmSync(STATE_DIR, { recursive: true, force: true });
     } catch {
     }
   }
@@ -6136,12 +6639,12 @@ async function removeModelState(platform, model) {
 }
 
 // src/lib/memory/sync/lock.ts
-import fs6 from "fs";
-import path6 from "path";
-var LOCK_DIR_REL = path6.join(".one", "sync", "locks");
+import fs8 from "fs";
+import path8 from "path";
+var LOCK_DIR_REL = path8.join(".one", "sync", "locks");
 var STALE_MS = 30 * 60 * 1e3;
 function lockPath(platform, model) {
-  return path6.join(LOCK_DIR_REL, `${platform}_${model}`);
+  return path8.join(LOCK_DIR_REL, `${platform}_${model}`);
 }
 function isProcessAlive(pid) {
   try {
@@ -6152,21 +6655,21 @@ function isProcessAlive(pid) {
   }
 }
 var SyncLockError = class extends Error {
-  constructor(message) {
-    super(message);
+  constructor(message2) {
+    super(message2);
     this.name = "SyncLockError";
   }
 };
 function acquireSyncLock(platform, model) {
-  fs6.mkdirSync(LOCK_DIR_REL, { recursive: true });
+  fs8.mkdirSync(LOCK_DIR_REL, { recursive: true });
   const dir = lockPath(platform, model);
-  const pidFile = path6.join(dir, "pid");
+  const pidFile = path8.join(dir, "pid");
   try {
-    fs6.mkdirSync(dir);
+    fs8.mkdirSync(dir);
   } catch (err) {
     const stat = (() => {
       try {
-        return fs6.statSync(dir);
+        return fs8.statSync(dir);
       } catch {
         return null;
       }
@@ -6175,7 +6678,7 @@ function acquireSyncLock(platform, model) {
       const age = Date.now() - stat.mtimeMs;
       let ownerPid = null;
       try {
-        const raw = fs6.readFileSync(pidFile, "utf-8");
+        const raw = fs8.readFileSync(pidFile, "utf-8");
         const parsed = parseInt(raw.trim(), 10);
         if (!isNaN(parsed)) ownerPid = parsed;
       } catch {
@@ -6184,8 +6687,8 @@ function acquireSyncLock(platform, model) {
       const veryOld = age > STALE_MS;
       if (ownerDead || veryOld) {
         try {
-          fs6.rmSync(dir, { recursive: true, force: true });
-          fs6.mkdirSync(dir);
+          fs8.rmSync(dir, { recursive: true, force: true });
+          fs8.mkdirSync(dir);
         } catch {
           throw new SyncLockError(
             `Could not take over stale lock at ${dir}. Remove it manually if no sync is running.`
@@ -6202,13 +6705,13 @@ function acquireSyncLock(platform, model) {
     }
   }
   try {
-    fs6.writeFileSync(pidFile, String(process.pid));
+    fs8.writeFileSync(pidFile, String(process.pid));
   } catch {
   }
   return {
     release() {
       try {
-        fs6.rmSync(dir, { recursive: true, force: true });
+        fs8.rmSync(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -6217,9 +6720,9 @@ function acquireSyncLock(platform, model) {
 
 // src/lib/memory/sync/hooks.ts
 import { spawn as spawn2 } from "child_process";
-import fs7 from "fs";
-import path7 from "path";
-var EVENTS_DIR = path7.join(".one", "sync", "events");
+import fs9 from "fs";
+import path9 from "path";
+var EVENTS_DIR = path9.join(".one", "sync", "events");
 function classifyRecords(db, model, records, idField, tableExists2) {
   if (!tableExists2 || records.length === 0) {
     return { inserts: records, updates: [] };
@@ -6265,10 +6768,10 @@ async function fireHooks(hookCommand, events) {
 function appendEventLog(events) {
   if (events.length === 0) return;
   const { platform, model } = events[0];
-  fs7.mkdirSync(EVENTS_DIR, { recursive: true });
-  const logPath = path7.join(EVENTS_DIR, `${platform}_${model}.jsonl`);
+  fs9.mkdirSync(EVENTS_DIR, { recursive: true });
+  const logPath = path9.join(EVENTS_DIR, `${platform}_${model}.jsonl`);
   const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  fs7.appendFileSync(logPath, lines);
+  fs9.appendFileSync(logPath, lines);
 }
 function runShellHook(command, events) {
   return new Promise((resolve) => {
@@ -6372,8 +6875,8 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function interpolate(template, record) {
-  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path13) => {
-    const parts = path13.split(".");
+  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path15) => {
+    const parts = path15.split(".");
     let value = record;
     for (const part2 of parts) {
       if (typeof value !== "object" || value === null) return "";
@@ -6401,8 +6904,8 @@ function deepMerge(target, source) {
   }
   return result;
 }
-function getByDotPath2(obj, path13) {
-  const parts = path13.split(".");
+function getByDotPath2(obj, path15) {
+  const parts = path15.split(".");
   let current = obj;
   for (const part2 of parts) {
     if (current === null || current === void 0 || typeof current !== "object") return void 0;
@@ -6411,8 +6914,8 @@ function getByDotPath2(obj, path13) {
   return current;
 }
 function stripExcludedFields(obj, paths) {
-  for (const path13 of paths) {
-    stripOnePath(obj, path13.replace(/\[\]/g, ".*").split("."));
+  for (const path15 of paths) {
+    stripOnePath(obj, path15.replace(/\[\]/g, ".*").split("."));
   }
 }
 function stripOnePath(obj, parts) {
@@ -6833,8 +7336,8 @@ function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function stripFields(record, paths) {
-  for (const path13 of paths) {
-    stripOnePath2(record, path13.split("."));
+  for (const path15 of paths) {
+    stripOnePath2(record, path15.split("."));
   }
 }
 function stripOnePath2(obj, parts) {
@@ -7927,19 +8430,19 @@ function inferProfileFromKnowledge(knowledge, modelName, platform) {
 
 // src/lib/memory/sync/schedule.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import fs9 from "fs";
+import fs11 from "fs";
 import os from "os";
-import path9 from "path";
+import path11 from "path";
 
 // src/lib/memory/sync/schedule-registry.ts
-import fs8 from "fs";
-import path8 from "path";
-var REGISTRY_DIR = () => path8.join(homeDir(), ".one", "sync");
-var REGISTRY_FILE = () => path8.join(REGISTRY_DIR(), "schedules.json");
+import fs10 from "fs";
+import path10 from "path";
+var REGISTRY_DIR = () => path10.join(homeDir(), ".one", "sync");
+var REGISTRY_FILE = () => path10.join(REGISTRY_DIR(), "schedules.json");
 function readRaw() {
   try {
-    if (!fs8.existsSync(REGISTRY_FILE())) return { schedules: [] };
-    const raw = fs8.readFileSync(REGISTRY_FILE(), "utf-8");
+    if (!fs10.existsSync(REGISTRY_FILE())) return { schedules: [] };
+    const raw = fs10.readFileSync(REGISTRY_FILE(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.schedules)) return { schedules: [] };
     return parsed;
@@ -7948,13 +8451,13 @@ function readRaw() {
   }
 }
 function writeRaw(file) {
-  fs8.mkdirSync(REGISTRY_DIR(), { recursive: true });
+  fs10.mkdirSync(REGISTRY_DIR(), { recursive: true });
   const tmp = REGISTRY_FILE() + ".tmp";
-  fs8.writeFileSync(tmp, JSON.stringify(file, null, 2));
-  fs8.renameSync(tmp, REGISTRY_FILE());
+  fs10.writeFileSync(tmp, JSON.stringify(file, null, 2));
+  fs10.renameSync(tmp, REGISTRY_FILE());
 }
 function makeScheduleId(platform, cwd) {
-  const slug = path8.basename(cwd).replace(/[^a-zA-Z0-9_-]/g, "-").toLowerCase();
+  const slug = path10.basename(cwd).replace(/[^a-zA-Z0-9_-]/g, "-").toLowerCase();
   return `${platform}-${slug}`;
 }
 function listRegistered() {
@@ -7988,7 +8491,7 @@ function removeRegistered(id) {
 
 // src/lib/memory/sync/schedule.ts
 var MARKER = "# one-sync";
-var LOG_DIR_REL = path9.join(".one", "sync", "logs");
+var LOG_DIR_REL = path11.join(".one", "sync", "logs");
 function durationToCron(every) {
   const match = every.match(/^(\d+)([mhd])$/);
   if (!match) return null;
@@ -8026,8 +8529,8 @@ function isWindows() {
 function resolveOneBinary() {
   try {
     const entry = process.argv[1];
-    if (entry && fs9.existsSync(entry)) {
-      return fs9.realpathSync(entry);
+    if (entry && fs11.existsSync(entry)) {
+      return fs11.realpathSync(entry);
     }
   } catch {
   }
@@ -8105,7 +8608,7 @@ function migrateLegacyCronEntries() {
     const modelsMatch = command.match(/--models\s+(\S+)/);
     const models = modelsMatch ? modelsMatch[1].split(",") : void 0;
     const logMatch = command.match(/>>\s+"([^"]+)"/);
-    const logFile = logMatch ? logMatch[1] : path9.resolve(cwd, LOG_DIR_REL, `${platform}.log`);
+    const logFile = logMatch ? logMatch[1] : path11.resolve(cwd, LOG_DIR_REL, `${platform}.log`);
     const id = makeScheduleId(platform, cwd);
     if (registeredIds.has(id)) continue;
     upsertRegistered({
@@ -8139,9 +8642,9 @@ function addSchedule(opts) {
   const cwd = process.cwd();
   const id = makeScheduleId(opts.platform, cwd);
   const replaced = getRegistered(id) !== void 0;
-  const logDir = path9.join(cwd, LOG_DIR_REL);
-  fs9.mkdirSync(logDir, { recursive: true });
-  const logFile = path9.join(logDir, `${opts.platform}.log`);
+  const logDir = path11.join(cwd, LOG_DIR_REL);
+  fs11.mkdirSync(logDir, { recursive: true });
+  const logFile = path11.join(logDir, `${opts.platform}.log`);
   const entry = {
     id,
     platform: opts.platform,
@@ -8195,15 +8698,15 @@ function removeSchedule(idOrPlatform, options) {
 function scheduleStatus() {
   const entries = listSchedules();
   return entries.map((entry) => {
-    const logExists = fs9.existsSync(entry.logFile);
-    const logSize = logExists ? fs9.statSync(entry.logFile).size : 0;
+    const logExists = fs11.existsSync(entry.logFile);
+    const logSize = logExists ? fs11.statSync(entry.logFile).size : 0;
     let logTail = [];
     let lastRunAt = null;
     if (logExists) {
       try {
-        lastRunAt = fs9.statSync(entry.logFile).mtime.toISOString();
+        lastRunAt = fs11.statSync(entry.logFile).mtime.toISOString();
         if (logSize > 0) {
-          const content = fs9.readFileSync(entry.logFile, "utf-8");
+          const content = fs11.readFileSync(entry.logFile, "utf-8");
           logTail = content.trim().split("\n").slice(-10);
         }
       } catch {
@@ -8211,8 +8714,8 @@ function scheduleStatus() {
     }
     let drift = "ok";
     if (!entry.cronInstalled) drift = "missing-cron";
-    else if (!fs9.existsSync(entry.nodeBin)) drift = "stale-node-bin";
-    else if (!fs9.existsSync(entry.cliBin)) drift = "stale-cli-bin";
+    else if (!fs11.existsSync(entry.nodeBin)) drift = "stale-node-bin";
+    else if (!fs11.existsSync(entry.cliBin)) drift = "stale-cli-bin";
     return { entry, logExists, logSize, logTail, lastRunAt, drift };
   });
 }
@@ -8485,11 +8988,11 @@ function isNoise(s) {
   if (/^-?\d+(\.\d+)?([eE][-+]?\d+)?$/.test(s)) return true;
   return false;
 }
-function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
-  let s = stats.get(path13);
+function recordSample(stats, path15, value, jsType, recordIndex, totalSamples) {
+  let s = stats.get(path15);
   if (!s) {
     s = {
-      path: path13,
+      path: path15,
       total: totalSamples,
       recordIndices: /* @__PURE__ */ new Set(),
       lenSum: 0,
@@ -8498,7 +9001,7 @@ function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
       primaryType: jsType,
       examples: []
     };
-    stats.set(path13, s);
+    stats.set(path15, s);
   }
   s.recordIndices.add(recordIndex);
   s.lenSum += value.length;
@@ -8507,28 +9010,28 @@ function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
   if (s.primaryType !== jsType) s.primaryType = "mixed";
   if (s.examples.length < 3 && value.length < 200) s.examples.push(value);
 }
-function walkRecord(record, path13, stats, recordIndex, totalSamples) {
+function walkRecord(record, path15, stats, recordIndex, totalSamples) {
   if (record === null || record === void 0) return;
   if (typeof record === "string") {
     const trimmed = record.trim();
-    if (trimmed) recordSample(stats, path13, trimmed, "string", recordIndex, totalSamples);
+    if (trimmed) recordSample(stats, path15, trimmed, "string", recordIndex, totalSamples);
     return;
   }
   if (typeof record === "number" || typeof record === "boolean") {
     const str = String(record);
     const kind = typeof record === "number" ? "number" : "boolean";
-    if (str) recordSample(stats, path13, str, kind, recordIndex, totalSamples);
+    if (str) recordSample(stats, path15, str, kind, recordIndex, totalSamples);
     return;
   }
   if (Array.isArray(record)) {
-    const childPath = path13 ? `${path13}[]` : "[]";
+    const childPath = path15 ? `${path15}[]` : "[]";
     for (const item of record) walkRecord(item, childPath, stats, recordIndex, totalSamples);
     return;
   }
   if (typeof record === "object") {
     for (const [key, value] of Object.entries(record)) {
       if (key.startsWith("_")) continue;
-      const childPath = path13 ? `${path13}.${key}` : key;
+      const childPath = path15 ? `${path15}.${key}` : key;
       walkRecord(value, childPath, stats, recordIndex, totalSamples);
     }
   }
@@ -8566,7 +9069,7 @@ function suggestSearchablePaths(records, limit = 15) {
 // src/lib/memory/sync/index.ts
 import { spawn as spawn4 } from "child_process";
 import * as p6 from "@clack/prompts";
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 async function syncInstallCommand() {
   if (await isSqliteAvailable()) {
     if (isAgentMode()) {
@@ -8631,15 +9134,15 @@ async function syncDoctorCommand() {
     return;
   }
   for (const c of checks) {
-    const mark = c.ok ? pc10.green("\u2713") : pc10.red("\u2717");
-    console.log(`  ${mark} ${c.name}${c.detail ? pc10.dim(` \u2014 ${c.detail}`) : ""}`);
+    const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
+    console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
   }
   if (!allOk) {
     console.log(`
-${pc10.yellow("Sync is not ready.")} Try: ${pc10.bold("one sync install")}`);
+${pc11.yellow("Sync is not ready.")} Try: ${pc11.bold("one sync install")}`);
   } else {
     console.log(`
-${pc10.green("Sync is ready.")}`);
+${pc11.green("Sync is ready.")}`);
   }
 }
 function getApi() {
@@ -8682,11 +9185,11 @@ async function syncProfilesCommand(platform) {
     if (p9.enrich) extras.push("enrich");
     if (p9.identityKey || p9.identityKeys) extras.push("identity");
     if (p9.dateFilter) extras.push("incremental");
-    const tags = extras.length > 0 ? ` ${pc10.dim(`[${extras.join(", ")}]`)}` : "";
-    console.log(`  ${pc10.bold(`${p9.platform}/${p9.model}`.padEnd(35))} ${p9.description}${tags}`);
+    const tags = extras.length > 0 ? ` ${pc11.dim(`[${extras.join(", ")}]`)}` : "";
+    console.log(`  ${pc11.bold(`${p9.platform}/${p9.model}`.padEnd(35))} ${p9.description}${tags}`);
   }
   console.log(`
-${profiles.length} built-in profile(s). Run ${pc10.bold("one sync init <platform> <model>")} to use one.`);
+${profiles.length} built-in profile(s). Run ${pc11.bold("one sync init <platform> <model>")} to use one.`);
 }
 async function syncModelsCommand(platform) {
   const api = getApi();
@@ -8704,7 +9207,7 @@ async function syncModelsCommand(platform) {
       return;
     }
     const lines = models.map(
-      (m) => `  ${pc10.bold(m.name.padEnd(30))} ${pc10.dim(m.listAction.method)} ${pc10.dim(m.listAction.path)}`
+      (m) => `  ${pc11.bold(m.name.padEnd(30))} ${pc11.dim(m.listAction.method)} ${pc11.dim(m.listAction.path)}`
     );
     note(lines.join("\n"), `${platform} \u2014 ${models.length} models`);
   } catch (err) {
@@ -8808,15 +9311,15 @@ async function syncInitCommand(platform, model, options) {
         note(JSON.stringify(template, null, 2), "Sync profile template");
         if (inferred && inferred.reasoning.length > 0) {
           console.log(`
-${pc10.bold("Inferred from knowledge:")}`);
-          for (const r of inferred.reasoning) console.log(`  ${pc10.dim("\u2022")} ${r}`);
+${pc11.bold("Inferred from knowledge:")}`);
+          for (const r of inferred.reasoning) console.log(`  ${pc11.dim("\u2022")} ${r}`);
         }
         if (testReport) {
           console.log(`
-${pc10.bold("Test results:")}`);
+${pc11.bold("Test results:")}`);
           for (const c of testReport.checks) {
-            const mark = c.ok ? pc10.green("\u2713") : pc10.red("\u2717");
-            console.log(`  ${mark} ${c.name}${c.detail ? pc10.dim(` \u2014 ${c.detail}`) : ""}`);
+            const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
+            console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
           }
         }
         console.log(`
@@ -8899,17 +9402,17 @@ async function syncTestCommand(platformModel, options = {}) {
     return;
   }
   for (const c of report2.checks) {
-    const mark = c.ok ? pc10.green("\u2713") : pc10.red("\u2717");
-    console.log(`  ${mark} ${c.name}${c.detail ? pc10.dim(` \u2014 ${c.detail}`) : ""}`);
+    const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
+    console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
   }
   if (report2.detectedColumns && report2.detectedColumns.length > 0) {
     console.log(`
-  ${pc10.bold("Detected columns:")}`);
+  ${pc11.bold("Detected columns:")}`);
     for (const col of report2.detectedColumns.slice(0, 20)) {
-      console.log(`    ${col.name.padEnd(30)} ${pc10.dim(col.type)}`);
+      console.log(`    ${col.name.padEnd(30)} ${pc11.dim(col.type)}`);
     }
     if (report2.detectedColumns.length > 20) {
-      console.log(pc10.dim(`    ... and ${report2.detectedColumns.length - 20} more`));
+      console.log(pc11.dim(`    ... and ${report2.detectedColumns.length - 20} more`));
     }
   }
   if (report2.identityKeysPreview) {
@@ -8917,45 +9420,45 @@ async function syncTestCommand(platformModel, options = {}) {
     const total = perRecord.reduce((a, b) => a + b, 0);
     const min = perRecord.length ? Math.min(...perRecord) : 0;
     const max = perRecord.length ? Math.max(...perRecord) : 0;
-    const mark = total === 0 ? pc10.yellow("~") : pc10.green("\u2713");
+    const mark = total === 0 ? pc11.yellow("~") : pc11.green("\u2713");
     console.log(`
-  ${pc10.bold("Merge + identity keys")} ${pc10.dim(`(cross-platform \u2014 #128)`)}`);
+  ${pc11.bold("Merge + identity keys")} ${pc11.dim(`(cross-platform \u2014 #128)`)}`);
     console.log(`    ${mark} ${perRecord.length} sample${perRecord.length === 1 ? "" : "s"}, ${min}\u2013${max} key${max === 1 ? "" : "s"} per record`);
     if (sampleKeys.length > 0) {
-      console.log(`    ${pc10.dim("e.g.")} ${sampleKeys.slice(0, 8).map((k) => pc10.cyan(k)).join(", ")}`);
+      console.log(`    ${pc11.dim("e.g.")} ${sampleKeys.slice(0, 8).map((k) => pc11.cyan(k)).join(", ")}`);
     } else if (resolvesAfterEnrich) {
-      console.log(`    ${pc10.dim("note:")} 0 on these list-shape samples \u2014 this profile enriches, and its identityKeys paths resolve in the enrich phase.`);
+      console.log(`    ${pc11.dim("note:")} 0 on these list-shape samples \u2014 this profile enriches, and its identityKeys paths resolve in the enrich phase.`);
     } else {
-      console.log(`    ${pc10.yellow("note:")} no identity keys resolved on these samples \u2014 check the identityKey/identityKeys paths.`);
+      console.log(`    ${pc11.yellow("note:")} no identity keys resolved on these samples \u2014 check the identityKey/identityKeys paths.`);
     }
     if (entityFanOut) {
-      console.log(`    ${pc10.yellow("warn:")} identityKey resolved to MULTIPLE values on ${entityFanOut.count} of ${perRecord.length} samples \u2014 those records get NO merge key.`);
-      console.log(`          ${pc10.dim("saw:")} ${entityFanOut.sampleValues.map((v) => pc10.cyan(v)).join(", ")}`);
-      console.log(`          ${pc10.dim('A singular identityKey means "this record IS this entity", so a fan-out has no safe answer.')}`);
-      console.log(`          ${pc10.dim("Point it at a single-valued path, or move it to identityKeys[] for participant associations.")}`);
+      console.log(`    ${pc11.yellow("warn:")} identityKey resolved to MULTIPLE values on ${entityFanOut.count} of ${perRecord.length} samples \u2014 those records get NO merge key.`);
+      console.log(`          ${pc11.dim("saw:")} ${entityFanOut.sampleValues.map((v) => pc11.cyan(v)).join(", ")}`);
+      console.log(`          ${pc11.dim('A singular identityKey means "this record IS this entity", so a fan-out has no safe answer.')}`);
+      console.log(`          ${pc11.dim("Point it at a single-valued path, or move it to identityKeys[] for participant associations.")}`);
     }
   }
   if (searchablePreview) {
     console.log(`
-  ${pc10.bold("Searchable preview")} ${pc10.dim(`(${searchablePreview.mode}, ${searchablePreview.sampledRecords} sample${searchablePreview.sampledRecords === 1 ? "" : "s"})`)}`);
-    console.log(`    ${pc10.dim("length:")}  ${searchablePreview.length} chars (first sample)`);
-    console.log(`    ${pc10.dim("text:")}    ${searchablePreview.text.slice(0, 300)}${searchablePreview.length > 300 ? pc10.dim(" \u2026") : ""}`);
+  ${pc11.bold("Searchable preview")} ${pc11.dim(`(${searchablePreview.mode}, ${searchablePreview.sampledRecords} sample${searchablePreview.sampledRecords === 1 ? "" : "s"})`)}`);
+    console.log(`    ${pc11.dim("length:")}  ${searchablePreview.length} chars (first sample)`);
+    console.log(`    ${pc11.dim("text:")}    ${searchablePreview.text.slice(0, 300)}${searchablePreview.length > 300 ? pc11.dim(" \u2026") : ""}`);
     if (searchablePreview.paths) {
-      console.log(`    ${pc10.dim("paths:")}  ${pc10.dim('(hit rate across all samples \u2014 differentiates "wrong path" from "field sometimes missing")')}`);
+      console.log(`    ${pc11.dim("paths:")}  ${pc11.dim('(hit rate across all samples \u2014 differentiates "wrong path" from "field sometimes missing")')}`);
       for (const p9 of searchablePreview.paths) {
         const rate = `${p9.hits}/${p9.total}`;
-        const mark = p9.hits === p9.total ? pc10.green("\u2713") : p9.hits === 0 ? pc10.red("\u2717") : pc10.yellow("~");
-        const trailer = p9.sample ? pc10.dim(` \u2192 "${p9.sample}"`) : p9.hits === 0 ? pc10.dim(" (no sample matched \u2014 typo, or field never populated in this page)") : "";
+        const mark = p9.hits === p9.total ? pc11.green("\u2713") : p9.hits === 0 ? pc11.red("\u2717") : pc11.yellow("~");
+        const trailer = p9.sample ? pc11.dim(` \u2192 "${p9.sample}"`) : p9.hits === 0 ? pc11.dim(" (no sample matched \u2014 typo, or field never populated in this page)") : "";
         console.log(`      ${mark} ${rate.padStart(5)} ${p9.path}${trailer}`);
       }
     } else {
-      console.log(`    ${pc10.yellow("note:")} no memory.searchable declared \u2014 using the default walker (walks every field, often noisy).`);
-      console.log(`    ${pc10.dim("tip:")}  run \`one sync suggest-searchable ${platform}/${model}\` for an auto-ranked starter list, or pick paths by hand and add them to profile.memory.searchable.`);
+      console.log(`    ${pc11.yellow("note:")} no memory.searchable declared \u2014 using the default walker (walks every field, often noisy).`);
+      console.log(`    ${pc11.dim("tip:")}  run \`one sync suggest-searchable ${platform}/${model}\` for an auto-ranked starter list, or pick paths by hand and add them to profile.memory.searchable.`);
     }
   }
   console.log(
     `
-${report2.ok ? pc10.green("Profile looks good.") : pc10.red("Profile has issues.")} ` + (report2.ok ? `Run: ${pc10.bold(`one sync run ${platform} --models ${model}`)}` : "Fix the issues above and test again.")
+${report2.ok ? pc11.green("Profile looks good.") : pc11.red("Profile has issues.")} ` + (report2.ok ? `Run: ${pc11.bold(`one sync run ${platform} --models ${model}`)}` : "Fix the issues above and test again.")
   );
 }
 function buildSearchablePreview(profile, samples) {
@@ -8963,7 +9466,7 @@ function buildSearchablePreview(profile, samples) {
   const first = samples[0];
   const paths = getSearchablePaths(profile);
   if (paths) {
-    const perPathAgg = paths.map((path13) => ({ path: path13, hits: 0, total: samples.length, sample: "" }));
+    const perPathAgg = paths.map((path15) => ({ path: path15, hits: 0, total: samples.length, sample: "" }));
     for (const record of samples) {
       const { paths: perPath } = extractSearchableFromPaths(record, paths);
       perPath.forEach((p9, i) => {
@@ -8996,8 +9499,8 @@ async function syncRunCommand(platform, options) {
   if (profileDrift.length > 0 && !isAgentMode()) {
     for (const d of profileDrift) {
       console.log(
-        `  ${pc10.yellow("!")} ${platform}/${d.model} is missing ${d.missing.map((f) => pc10.bold(f)).join(", ")} from the current built-in profile.
-    Run ${pc10.bold(`one sync init ${platform} ${d.model}`)} to pick ${d.missing.length > 1 ? "them" : "it"} up.`
+        `  ${pc11.yellow("!")} ${platform}/${d.model} is missing ${d.missing.map((f) => pc11.bold(f)).join(", ")} from the current built-in profile.
+    Run ${pc11.bold(`one sync init ${platform} ${d.model}`)} to pick ${d.missing.length > 1 ? "them" : "it"} up.`
       );
     }
   }
@@ -9040,21 +9543,21 @@ async function syncRunCommand(platform, options) {
     return;
   }
   for (const r of results) {
-    const status2 = r.status === "complete" ? pc10.green("complete") : r.status === "dry-run" ? pc10.yellow("dry-run") : pc10.red("failed");
-    console.log(`  ${pc10.bold(r.model)} \u2014 ${r.recordsSynced} records, ${r.pagesProcessed} pages, ${r.duration} [${status2}]`);
+    const status2 = r.status === "complete" ? pc11.green("complete") : r.status === "dry-run" ? pc11.yellow("dry-run") : pc11.red("failed");
+    console.log(`  ${pc11.bold(r.model)} \u2014 ${r.recordsSynced} records, ${r.pagesProcessed} pages, ${r.duration} [${status2}]`);
     if (r.reconcileSkipped) {
-      console.log(`    ${pc10.yellow("--full-refresh reconcile skipped \u2014 pagination truncated (e.g. --max-pages). Re-run without the cap to prune stale rows.")}`);
+      console.log(`    ${pc11.yellow("--full-refresh reconcile skipped \u2014 pagination truncated (e.g. --max-pages). Re-run without the cap to prune stale rows.")}`);
     }
     const sc = r.statusCounts;
     if (sc && (sc.archived > 0 || sc.active > 0)) {
-      const archivedColor = sc.archived > sc.active ? pc10.red : pc10.dim;
-      console.log(`    memory: ${pc10.green(String(sc.active))} active, ${archivedColor(String(sc.archived))} archived`);
+      const archivedColor = sc.archived > sc.active ? pc11.red : pc11.dim;
+      console.log(`    memory: ${pc11.green(String(sc.active))} active, ${archivedColor(String(sc.archived))} archived`);
     }
     if (r.error) {
       const errParts = [r.error.message];
       if (r.error.httpStatus) errParts.push(`HTTP ${r.error.httpStatus}`);
       if (r.error.retryAfter) errParts.push(`retry after ${r.error.retryAfter}s`);
-      console.log(`    ${pc10.red(errParts.join(" \u2014 "))}`);
+      console.log(`    ${pc11.red(errParts.join(" \u2014 "))}`);
     }
   }
 }
@@ -9080,8 +9583,8 @@ async function syncQueryCommand(platformModel, options) {
       json(result);
       return;
     }
-    console.log(pc10.dim(`Query: ${result.query}`));
-    console.log(pc10.dim(`Source: local | Last sync: ${result.lastSync ?? "never"} | Age: ${result.syncAge ?? "n/a"}`));
+    console.log(pc11.dim(`Query: ${result.query}`));
+    console.log(pc11.dim(`Source: local | Last sync: ${result.lastSync ?? "never"} | Age: ${result.syncAge ?? "n/a"}`));
     console.log(JSON.stringify(result.results, null, 2));
     console.log(`
 ${result.total} results`);
@@ -9103,7 +9606,7 @@ async function syncSearchCommand(query, options) {
       return;
     }
     for (const r of result.results) {
-      console.log(`  ${pc10.bold(`${r.platform}/${r.model}`)} ${pc10.dim(`(rank: ${r.rank.toFixed(2)})`)}`);
+      console.log(`  ${pc11.bold(`${r.platform}/${r.model}`)} ${pc11.dim(`(rank: ${r.rank.toFixed(2)})`)}`);
       console.log(`    ${JSON.stringify(r.record)}`);
     }
     console.log(`
@@ -9254,25 +9757,25 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
     return;
   }
   console.log(`
-  ${pc10.bold("memory.searchable \u2014 ranked suggestions")} ${pc10.dim(`(${samples.length} samples)`)}`);
+  ${pc11.bold("memory.searchable \u2014 ranked suggestions")} ${pc11.dim(`(${samples.length} samples)`)}`);
   if (suggestions.length === 0) {
-    console.log(`    ${pc10.yellow("no high-signal leaves found")} \u2014 page may be all UUIDs / timestamps / enum markers. Inspect the sample with \`sync test\` and pick paths manually.`);
+    console.log(`    ${pc11.yellow("no high-signal leaves found")} \u2014 page may be all UUIDs / timestamps / enum markers. Inspect the sample with \`sync test\` and pick paths manually.`);
     return;
   }
   for (const s of suggestions) {
     const hitPct = Math.round(s.hitRate * 100);
     const noisePct = Math.round(s.noiseFraction * 100);
-    const noiseBadge = noisePct > 0 ? pc10.dim(` noise=${noisePct}%`) : "";
+    const noiseBadge = noisePct > 0 ? pc11.dim(` noise=${noisePct}%`) : "";
     console.log(
-      `    ${pc10.green(String(s.score).padStart(5))}  ${pc10.cyan(s.path.padEnd(52))}` + pc10.dim(` ${hitPct}% hit`) + pc10.dim(` avg=${s.avgLength}ch`) + noiseBadge + (s.sampleValue ? pc10.dim(`
+      `    ${pc11.green(String(s.score).padStart(5))}  ${pc11.cyan(s.path.padEnd(52))}` + pc11.dim(` ${hitPct}% hit`) + pc11.dim(` avg=${s.avgLength}ch`) + noiseBadge + (s.sampleValue ? pc11.dim(`
           \u2192 "${s.sampleValue.slice(0, 140)}"`) : "")
     );
   }
   console.log(`
-  ${pc10.bold("Paste-ready:")}`);
-  console.log("    " + pc10.cyan(`one sync init ${platform} ${model} --config '${JSON.stringify(configPatch)}'`));
+  ${pc11.bold("Paste-ready:")}`);
+  console.log("    " + pc11.cyan(`one sync init ${platform} ${model} --config '${JSON.stringify(configPatch)}'`));
   console.log(`
-  ${pc10.dim("then preview: ")}${pc10.cyan(`one sync test ${platform}/${model} --show-searchable`)}`);
+  ${pc11.dim("then preview: ")}${pc11.cyan(`one sync test ${platform}/${model} --show-searchable`)}`);
 }
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
@@ -9306,10 +9809,10 @@ async function syncListCommand(platform) {
     return;
   }
   for (const s of syncs) {
-    const status2 = s.status === "idle" ? pc10.green("idle") : s.status === "syncing" ? pc10.yellow(`syncing \u2014 page ${s.pagesProcessed}`) : pc10.red("failed");
-    const legacy = s.legacyDbSize && s.legacyDbSize !== "0 B" ? pc10.yellow(`  legacy .db ${s.legacyDbSize}`) : "";
+    const status2 = s.status === "idle" ? pc11.green("idle") : s.status === "syncing" ? pc11.yellow(`syncing \u2014 page ${s.pagesProcessed}`) : pc11.red("failed");
+    const legacy = s.legacyDbSize && s.legacyDbSize !== "0 B" ? pc11.yellow(`  legacy .db ${s.legacyDbSize}`) : "";
     console.log(
-      `  ${pc10.bold(`${s.platform}/${s.model}`.padEnd(35))} ${String(s.totalRecords).padStart(8)} records  ${status2}  ${pc10.dim(s.lastSync ? `last: ${s.lastSync}` : "never synced")}` + legacy
+      `  ${pc11.bold(`${s.platform}/${s.model}`.padEnd(35))} ${String(s.totalRecords).padStart(8)} records  ${status2}  ${pc11.dim(s.lastSync ? `last: ${s.lastSync}` : "never synced")}` + legacy
     );
   }
 }
@@ -9388,8 +9891,8 @@ async function syncScheduleAddCommand(platform, options) {
     }
     const verb = replaced ? "Replaced existing schedule" : "Scheduled sync";
     outro(
-      `${verb} ${pc10.bold(entry.id)} \u2014 every ${pc10.bold(entry.every)} (cron: ${pc10.dim(entry.cronExpr)})
-Logs: ${pc10.dim(entry.logFile)}`
+      `${verb} ${pc11.bold(entry.id)} \u2014 every ${pc11.bold(entry.every)} (cron: ${pc11.dim(entry.cronExpr)})
+Logs: ${pc11.dim(entry.logFile)}`
     );
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -9408,14 +9911,14 @@ async function syncScheduleListCommand() {
     }
     for (const e of entries) {
       const modelsStr = e.models ? ` [${e.models.join(",")}]` : "";
-      const installed = e.cronInstalled ? pc10.green("\u25CF") : pc10.red("\u2717");
+      const installed = e.cronInstalled ? pc11.green("\u25CF") : pc11.red("\u2717");
       console.log(
-        `  ${installed} ${pc10.bold(e.id.padEnd(32))} every ${pc10.bold(e.every.padEnd(5))} ${pc10.dim(e.cronExpr.padEnd(13))}${modelsStr}`
+        `  ${installed} ${pc11.bold(e.id.padEnd(32))} every ${pc11.bold(e.every.padEnd(5))} ${pc11.dim(e.cronExpr.padEnd(13))}${modelsStr}`
       );
-      console.log(`      ${pc10.dim("cwd:")} ${e.cwd}`);
+      console.log(`      ${pc11.dim("cwd:")} ${e.cwd}`);
     }
     console.log(`
-${pc10.dim("\u25CF = cron line installed  \u2717 = registry drift, run `sync schedule repair <id>`")}`);
+${pc11.dim("\u25CF = cron line installed  \u2717 = registry drift, run `sync schedule repair <id>`")}`);
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
   }
@@ -9439,7 +9942,7 @@ async function syncScheduleRemoveCommand(idOrPlatform, options) {
       return;
     }
     for (const r of result.removed) {
-      console.log(`  ${pc10.green("\u2713")} removed ${pc10.bold(r.id)} ${pc10.dim(`(${r.cwd})`)}`);
+      console.log(`  ${pc11.green("\u2713")} removed ${pc11.bold(r.id)} ${pc11.dim(`(${r.cwd})`)}`);
     }
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -9457,21 +9960,21 @@ async function syncScheduleStatusCommand() {
       return;
     }
     for (const s of statuses) {
-      const driftMarker = s.drift === "ok" ? pc10.green("\u25CF") : s.drift === "missing-cron" ? pc10.red("\u2717 missing cron line") : pc10.yellow(`\u26A0 ${s.drift}`);
-      console.log(`  ${driftMarker} ${pc10.bold(s.entry.id)} \u2014 every ${s.entry.every} (${pc10.dim(s.entry.cronExpr)})`);
-      console.log(`      ${pc10.dim("cwd:")} ${s.entry.cwd}`);
-      console.log(`      ${pc10.dim("last run:")} ${s.lastRunAt ?? pc10.yellow("never")}`);
-      console.log(`      ${pc10.dim("log:")} ${s.entry.logFile} ${s.logExists ? pc10.dim(`(${s.logSize} bytes)`) : pc10.yellow("(empty)")}`);
+      const driftMarker = s.drift === "ok" ? pc11.green("\u25CF") : s.drift === "missing-cron" ? pc11.red("\u2717 missing cron line") : pc11.yellow(`\u26A0 ${s.drift}`);
+      console.log(`  ${driftMarker} ${pc11.bold(s.entry.id)} \u2014 every ${s.entry.every} (${pc11.dim(s.entry.cronExpr)})`);
+      console.log(`      ${pc11.dim("cwd:")} ${s.entry.cwd}`);
+      console.log(`      ${pc11.dim("last run:")} ${s.lastRunAt ?? pc11.yellow("never")}`);
+      console.log(`      ${pc11.dim("log:")} ${s.entry.logFile} ${s.logExists ? pc11.dim(`(${s.logSize} bytes)`) : pc11.yellow("(empty)")}`);
       if (s.logTail.length > 0) {
-        console.log(pc10.dim("      last lines:"));
+        console.log(pc11.dim("      last lines:"));
         for (const line of s.logTail.slice(-3)) {
-          console.log(pc10.dim(`        ${line}`));
+          console.log(pc11.dim(`        ${line}`));
         }
       }
     }
     if (statuses.some((s) => s.drift !== "ok")) {
       console.log(`
-${pc10.yellow("Drift detected.")} Run ${pc10.bold("one sync schedule repair <id>")} to heal.`);
+${pc11.yellow("Drift detected.")} Run ${pc11.bold("one sync schedule repair <id>")} to heal.`);
     }
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -9484,7 +9987,7 @@ async function syncScheduleRepairCommand(id) {
       json({ status: "repaired", ...healed });
       return;
     }
-    outro(`Repaired ${pc10.bold(healed.id)}: re-installed cron line with current node/cli paths.`);
+    outro(`Repaired ${pc11.bold(healed.id)}: re-installed cron line with current node/cli paths.`);
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
   }
@@ -9920,16 +10423,16 @@ function projectEmbeddingApiKey(cfg) {
 }
 function redactSecrets(cfg) {
   const copy = JSON.parse(JSON.stringify(cfg));
-  for (const path13 of SECRET_PATHS) {
-    const val = getPath(copy, path13);
+  for (const path15 of SECRET_PATHS) {
+    const val = getPath(copy, path15);
     if (typeof val === "string" && val.length > 0) {
-      setPath(copy, path13, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
+      setPath(copy, path15, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
     }
   }
   return copy;
 }
-function getPath(obj, path13) {
-  const parts = path13.split(".");
+function getPath(obj, path15) {
+  const parts = path15.split(".");
   let cur = obj;
   for (const part2 of parts) {
     if (cur == null || typeof cur !== "object") return void 0;
@@ -9937,8 +10440,8 @@ function getPath(obj, path13) {
   }
   return cur;
 }
-function setPath(obj, path13, value) {
-  const parts = path13.split(".");
+function setPath(obj, path15, value) {
+  const parts = path15.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part2 = parts[i];
@@ -9948,8 +10451,8 @@ function setPath(obj, path13, value) {
   cur[parts[parts.length - 1]] = value;
   return obj;
 }
-function unsetPath(obj, path13) {
-  const parts = path13.split(".");
+function unsetPath(obj, path15) {
+  const parts = path15.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part2 = parts[i];
@@ -9975,7 +10478,7 @@ function parseValue(raw) {
 }
 
 // src/commands/mem/records.ts
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 async function memAddCommand(type, dataRaw, flags) {
   requireMemoryInit();
   const data = parseJsonArg(dataRaw, "data");
@@ -10174,7 +10677,7 @@ function summarizeRecord(r) {
     const v = d[field];
     if (typeof v === "string" && v.trim()) return v.trim().slice(0, 80);
   }
-  return pc11.dim("(untitled)");
+  return pc12.dim("(untitled)");
 }
 function relativeTime(iso) {
   if (!iso) return "";
@@ -10237,7 +10740,7 @@ async function memFindByKeyCommand(key, secondKey, flags) {
     });
     return;
   }
-  const label = matchedKeys.map((k) => pc11.cyan(k)).join(pc11.dim(" + "));
+  const label = matchedKeys.map((k) => pc12.cyan(k)).join(pc12.dim(" + "));
   if (records.length === 0) {
     console.log(`
   No records linked to ${label}.
@@ -10245,27 +10748,27 @@ async function memFindByKeyCommand(key, secondKey, flags) {
     return;
   }
   console.log();
-  console.log(`  ${label} ${pc11.dim("\u2014")} ${records.length}${truncated ? "+" : ""} record${records.length === 1 ? "" : "s"} across ${byType.size} type${byType.size === 1 ? "" : "s"}`);
+  console.log(`  ${label} ${pc12.dim("\u2014")} ${records.length}${truncated ? "+" : ""} record${records.length === 1 ? "" : "s"} across ${byType.size} type${byType.size === 1 ? "" : "s"}`);
   console.log();
   const typeWidth = Math.min(30, Math.max(...[...byType.keys()].map((t) => t.length)));
   for (const [type, list] of byType) {
-    console.log(`  ${pc11.bold(type.padEnd(typeWidth))}  ${pc11.dim(`${list.length} record${list.length === 1 ? "" : "s"}`)}`);
+    console.log(`  ${pc12.bold(type.padEnd(typeWidth))}  ${pc12.dim(`${list.length} record${list.length === 1 ? "" : "s"}`)}`);
     for (const r of list.slice(0, perType)) {
-      console.log(`    ${pc11.dim("\xB7")} ${summarizeRecord(r)}  ${pc11.dim(relativeTime(r.updated_at))}  ${pc11.dim(r.id)}`);
+      console.log(`    ${pc12.dim("\xB7")} ${summarizeRecord(r)}  ${pc12.dim(relativeTime(r.updated_at))}  ${pc12.dim(r.id)}`);
     }
     if (list.length > perType) {
-      console.log(`    ${pc11.dim(`\u2026 and ${list.length - perType} more (raise --limit)`)}`);
+      console.log(`    ${pc12.dim(`\u2026 and ${list.length - perType} more (raise --limit)`)}`);
     }
   }
   if (truncated) {
     console.log();
-    console.log(`  ${pc11.yellow("\u26A0")} Stopped at ${FIND_BY_KEY_FETCH_CAP} matches \u2014 there are more, and types sorting after the last one shown are missing entirely. Re-run with --type <type> to see them.`);
+    console.log(`  ${pc12.yellow("\u26A0")} Stopped at ${FIND_BY_KEY_FETCH_CAP} matches \u2014 there are more, and types sorting after the last one shown are missing entirely. Re-run with --type <type> to see them.`);
   }
   console.log();
 }
 
 // src/commands/mem/doctor.ts
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 async function memDoctorCommand() {
   const checks = [];
   const cfg = getMemoryConfig();
@@ -10372,23 +10875,23 @@ function emit(checks, capInfo) {
     return;
   }
   for (const c of checks) {
-    const mark = c.ok ? pc12.green("\u2713") : pc12.red("\u2717");
-    const detail = c.detail ? pc12.dim(` \u2014 ${c.detail}`) : "";
+    const mark = c.ok ? pc13.green("\u2713") : pc13.red("\u2717");
+    const detail = c.detail ? pc13.dim(` \u2014 ${c.detail}`) : "";
     console.log(`  ${mark} ${c.name}${detail}`);
   }
   if (!allOk) {
-    console.log("\n" + pc12.yellow("Memory is not fully healthy."));
+    console.log("\n" + pc13.yellow("Memory is not fully healthy."));
     process.exitCode = 1;
   } else {
-    console.log("\n" + pc12.green("Memory is healthy."));
+    console.log("\n" + pc13.green("Memory is healthy."));
   }
   const line = semanticSearchUpgradeLine({ vectorSearchAvailable: capInfo.vectorSearchAvailable });
   if (line) console.log(`
-${pc12.dim(line)}`);
+${pc13.dim(line)}`);
 }
 
 // src/commands/mem/export.ts
-import fs10 from "fs";
+import fs12 from "fs";
 import { once } from "events";
 async function writeLine(stream, line) {
   if (!stream.write(line)) {
@@ -10400,7 +10903,7 @@ async function memExportCommand(outfile) {
   const backend = await getBackend();
   const stats = await backend.stats();
   const toFile = !!outfile && outfile !== "-";
-  const stream = toFile ? fs10.createWriteStream(outfile, "utf-8") : process.stdout;
+  const stream = toFile ? fs12.createWriteStream(outfile, "utf-8") : process.stdout;
   const all = await listAllTypes(backend);
   const pageSize = 500;
   let written = 0;
@@ -10431,9 +10934,9 @@ async function memExportCommand(outfile) {
 }
 async function memImportCommand(file) {
   requireMemoryInit();
-  if (!fs10.existsSync(file)) error(`File not found: ${file}`);
+  if (!fs12.existsSync(file)) error(`File not found: ${file}`);
   const backend = await getBackend();
-  const raw = fs10.readFileSync(file, "utf-8");
+  const raw = fs12.readFileSync(file, "utf-8");
   const lines = raw.split("\n").filter((l) => l.trim().length > 0);
   let inserted = 0;
   let updated = 0;
@@ -10679,7 +11182,7 @@ function registerMemoryCommands(program2) {
 }
 
 // src/commands/cache.ts
-import pc13 from "picocolors";
+import pc14 from "picocolors";
 async function cacheClearCommand(actionId) {
   if (actionId) {
     const deleted = clearEntry(actionId);
@@ -10688,9 +11191,9 @@ async function cacheClearCommand(actionId) {
       return;
     }
     if (deleted) {
-      console.log(`Cleared cache for ${pc13.cyan(actionId)}`);
+      console.log(`Cleared cache for ${pc14.cyan(actionId)}`);
     } else {
-      console.log(`No cache entry found for ${pc13.dim(actionId)}`);
+      console.log(`No cache entry found for ${pc14.dim(actionId)}`);
     }
   } else {
     const count = clearAll();
@@ -10727,7 +11230,7 @@ async function cacheListCommand(options) {
     type: e.type,
     key: e.entry.key,
     age: formatAge(getAge(e.entry)),
-    status: isFresh(e.entry) ? pc13.green("fresh") : pc13.yellow("expired")
+    status: isFresh(e.entry) ? pc14.green("fresh") : pc14.yellow("expired")
   }));
   printTable(
     [
@@ -10780,13 +11283,13 @@ async function cacheUpdateAllCommand() {
   if (errors.length > 0) {
     console.log();
     for (const e of errors) {
-      console.log(`  ${pc13.red("\u2717")} ${e.key}: ${pc13.dim(e.error)}`);
+      console.log(`  ${pc14.red("\u2717")} ${e.key}: ${pc14.dim(e.error)}`);
     }
   }
 }
 
 // src/commands/guide.ts
-import pc14 from "picocolors";
+import pc15 from "picocolors";
 
 // src/lib/guide-content.ts
 var GUIDE_OVERVIEW = `# One CLI \u2014 Agent Guide
@@ -10901,6 +11404,9 @@ one --agent relay deliveries --endpoint-id <id>                 # Check delivery
 - \`--create-webhook\` auto-registers the webhook URL with the source platform
 - Use \`actions find\` (and \`actions load\` for more) to learn both the incoming payload shape AND the destination API shape before building templates
 
+### One Connect apps \u2014 created from \`one.connect.ts\`
+\`one connect create\` reads \`one.connect.ts\`, typed by \`defineConnectApp\` from \`@withone/connect/config\` (install \`@withone/connect\` 0.20.0 or later in the project first), and opens a setup page where the human reviews the app (or, once .env holds its \`ONE_CLIENT_ID\`, its new version) and approves it with their dashboard session; an API key never creates or changes a Connect app. A new app's client secret and connect key are made and shown there once; the CLI never receives them. It waits up to 10 minutes, then writes \`ONE_CLIENT_ID\`, \`ONE_REDIRECT_URI\` and, for a list of tools, \`ONE_PERMISSION_SET\` to the env file. \`one connect types\` writes \`one-connect-env.d.ts\` so tool slugs and action names autocomplete. \`ask\` is required: the tools, each with \`access\` \`read-only\`, \`read-write\`, \`full-access\`, or \`custom\` with \`actions\` (names, or ids from \`actions find\`), or \`"everything"\`, which asks for every connection the user has and removes \`ONE_PERMISSION_SET\` from the env file.
+
 ### 4. Memory + Sync \u2014 Unified store with hybrid FTS + semantic search
 One ships a local memory store (a real Postgres process bootstrapped on demand via the bundled \`embedded-postgres\` plugin, with a \`postgres\` plugin for remote/self-hosted) that backs both user-authored notes (\`one mem add\`) and synced platform data (\`one sync run\`). Auto-initializes on first use \u2014 no separate install step. Run \`one guide memory\` and \`one guide sync\` for the full references.
 
@@ -11992,14 +12498,14 @@ async function guideCommand(topic = "all") {
     json({ topic, title, content, availableTopics });
     return;
   }
-  intro(pc14.bgCyan(pc14.black(" One Guide ")));
+  intro(pc15.bgCyan(pc15.black(" One Guide ")));
   console.log();
   console.log(content);
-  console.log(pc14.dim("\u2500".repeat(60)));
+  console.log(pc15.dim("\u2500".repeat(60)));
   console.log(
-    pc14.dim("Available topics: ") + availableTopics.map((t) => pc14.cyan(t.topic)).join(", ")
+    pc15.dim("Available topics: ") + availableTopics.map((t) => pc15.cyan(t.topic)).join(", ")
   );
-  console.log(pc14.dim(`Run ${pc14.cyan("one guide <topic>")} for a specific section.`));
+  console.log(pc15.dim(`Run ${pc15.cyan("one guide <topic>")} for a specific section.`));
 }
 
 // src/lib/platform-meta.ts
@@ -12319,24 +12825,24 @@ function buildWorkflowIdeas(connections) {
 }
 
 // src/commands/logout.ts
-import fs11 from "fs";
+import fs13 from "fs";
 import * as p8 from "@clack/prompts";
-function formatWhoami(config2, apiKey, pc16) {
+function formatWhoami(config2, apiKey, pc17) {
   const whoami = config2.whoami;
   const env = getEnvFromApiKey(apiKey);
-  const envLabel = env === "test" ? pc16.yellow("test") : pc16.green("live");
+  const envLabel = env === "test" ? pc17.yellow("test") : pc17.green("live");
   const lines = [];
   if (whoami) {
     const contextParts = [];
     if (whoami.organization) contextParts.push(whoami.organization.name);
     if (whoami.project) contextParts.push(whoami.project.name);
     const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-    lines.push(`${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`);
-    lines.push(`${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`);
-    if (config2.apiKeyName) lines.push(`${pc16.dim("Key:")} ${config2.apiKeyName}`);
+    lines.push(`${pc17.bold(scopeDisplay)} ${pc17.dim("\xB7")} ${envLabel}`);
+    lines.push(`${whoami.user.name} ${pc17.dim(`(${whoami.user.email})`)}`);
+    if (config2.apiKeyName) lines.push(`${pc17.dim("Key:")} ${config2.apiKeyName}`);
   } else {
     const keyLabel = config2.apiKeyName ?? `${apiKey.slice(0, 8)}...`;
-    lines.push(`${pc16.dim("Key:")} ${keyLabel} ${pc16.dim("\xB7")} ${envLabel}`);
+    lines.push(`${pc17.dim("Key:")} ${keyLabel} ${pc17.dim("\xB7")} ${envLabel}`);
   }
   return lines;
 }
@@ -12354,18 +12860,18 @@ async function logoutCommand() {
     const globalPath = getGlobalConfigPath();
     const projectPath = getProjectConfigPath();
     let cleared = false;
-    if (fs11.existsSync(projectPath)) {
-      fs11.unlinkSync(projectPath);
+    if (fs13.existsSync(projectPath)) {
+      fs13.unlinkSync(projectPath);
       cleared = true;
     }
-    if (fs11.existsSync(globalPath)) {
-      fs11.unlinkSync(globalPath);
+    if (fs13.existsSync(globalPath)) {
+      fs13.unlinkSync(globalPath);
       cleared = true;
     }
     json({ status: cleared ? "logged_out" : "not_logged_in", message: cleared ? "Credentials cleared." : "No config found." });
     return;
   }
-  const pc16 = (await import("picocolors")).default;
+  const pc17 = (await import("picocolors")).default;
   const globalConfig = readGlobalConfig();
   const projectConfig = readProjectConfig();
   const hasGlobal = globalConfig?.apiKey != null;
@@ -12374,13 +12880,13 @@ async function logoutCommand() {
   if (hasGlobal && hasProject) {
     const infoLines = ["You are logged in with multiple configs.", ""];
     if (projectConfig) {
-      infoLines.push(`${pc16.cyan("Local config:")}`);
-      infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc16));
+      infoLines.push(`${pc17.cyan("Local config:")}`);
+      infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc17));
       infoLines.push("");
     }
     if (globalConfig) {
-      infoLines.push(`${pc16.magenta("Global config:")}`);
-      infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc16));
+      infoLines.push(`${pc17.magenta("Global config:")}`);
+      infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc17));
     }
     p8.note(infoLines.join("\n"));
     const choice = await p8.select({
@@ -12398,14 +12904,14 @@ async function logoutCommand() {
     targetScope = choice;
   } else if (hasProject) {
     const infoLines = ["You are logged in.", ""];
-    infoLines.push(`${pc16.dim("Stored in")} ${pc16.cyan("local config")}`);
-    infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc16));
+    infoLines.push(`${pc17.dim("Stored in")} ${pc17.cyan("local config")}`);
+    infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc17));
     p8.note(infoLines.join("\n"));
     targetScope = "project";
   } else if (hasGlobal) {
     const infoLines = ["You are logged in.", ""];
-    infoLines.push(`${pc16.dim("Stored in")} ${pc16.magenta("global config")}`);
-    infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc16));
+    infoLines.push(`${pc17.dim("Stored in")} ${pc17.magenta("global config")}`);
+    infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc17));
     p8.note(infoLines.join("\n"));
     targetScope = "global";
   } else {
@@ -12428,11 +12934,11 @@ async function logoutCommand() {
   }
   if (targetScope === "project" || targetScope === "both") {
     const projectPath = getProjectConfigPath();
-    if (fs11.existsSync(projectPath)) fs11.unlinkSync(projectPath);
+    if (fs13.existsSync(projectPath)) fs13.unlinkSync(projectPath);
   }
   if (targetScope === "global" || targetScope === "both") {
     const globalPath = getGlobalConfigPath();
-    if (fs11.existsSync(globalPath)) fs11.unlinkSync(globalPath);
+    if (fs13.existsSync(globalPath)) fs13.unlinkSync(globalPath);
   }
   p8.log.success("Credentials cleared.");
   p8.log.info("Your API key is still active. Manage keys at app.withone.ai/settings");
@@ -12440,11 +12946,11 @@ async function logoutCommand() {
 }
 
 // src/lib/project-skills.ts
-import crypto2 from "crypto";
-import fs12 from "fs";
+import crypto3 from "crypto";
+import fs14 from "fs";
 import os2 from "os";
-import path10 from "path";
-import zlib from "zlib";
+import path12 from "path";
+import zlib2 from "zlib";
 var OPTIONAL_SKILLS = [
   {
     name: "connect",
@@ -12475,42 +12981,42 @@ function findAgentTarget(id) {
   return SKILL_AGENT_TARGETS.find((a) => a.id === id.trim().toLowerCase());
 }
 function findProjectRoot(start) {
-  let dir = path10.resolve(start);
+  let dir = path12.resolve(start);
   for (; ; ) {
-    if (fs12.existsSync(path10.join(dir, "package.json")) || fs12.existsSync(path10.join(dir, ".git"))) return dir;
-    const parent = path10.dirname(dir);
+    if (fs14.existsSync(path12.join(dir, "package.json")) || fs14.existsSync(path12.join(dir, ".git"))) return dir;
+    const parent = path12.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function findInstalledPackage(start, packageName) {
-  let dir = path10.resolve(start);
+  let dir = path12.resolve(start);
   for (; ; ) {
-    const pkgDir = path10.join(dir, "node_modules", ...packageName.split("/"));
-    const manifest = path10.join(pkgDir, "package.json");
-    if (fs12.existsSync(manifest)) {
+    const pkgDir = path12.join(dir, "node_modules", ...packageName.split("/"));
+    const manifest = path12.join(pkgDir, "package.json");
+    if (fs14.existsSync(manifest)) {
       try {
-        const { version: version2 } = JSON.parse(fs12.readFileSync(manifest, "utf-8"));
+        const { version: version2 } = JSON.parse(fs14.readFileSync(manifest, "utf-8"));
         if (version2) return { dir: pkgDir, version: version2 };
       } catch {
       }
     }
-    const parent = path10.dirname(dir);
+    const parent = path12.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 var SkillSourceError = class extends Error {
-  constructor(message, code) {
-    super(message);
+  constructor(message2, code) {
+    super(message2);
     this.code = code;
   }
 };
 function projectSkillSource(skill, projectDir) {
   const installed = findInstalledPackage(projectDir, skill.packageName);
   if (!installed) return null;
-  const dir = path10.join(installed.dir, ...skill.packagePath.split("/"));
-  if (!fs12.existsSync(path10.join(dir, "SKILL.md"))) {
+  const dir = path12.join(installed.dir, ...skill.packagePath.split("/"));
+  if (!fs14.existsSync(path12.join(dir, "SKILL.md"))) {
     throw new SkillSourceError(
       `${skill.packageName} ${installed.version} does not include the ${skill.title} skill. Upgrade it: npm install ${skill.packageName}@latest`,
       "skill-missing"
@@ -12549,15 +13055,15 @@ async function registrySkillSource(skill, fetchImpl = fetch) {
   if (!matchesIntegrity(bytes, integrity)) {
     throw new SkillSourceError(`${skill.packageName}@${version2} failed its integrity check; nothing was installed.`, "integrity");
   }
-  const files = readTarEntries(zlib.gunzipSync(bytes), `package/${skill.packagePath}/`);
+  const files = readTarEntries(zlib2.gunzipSync(bytes), `package/${skill.packagePath}/`);
   if (!files.some((f) => f.path === "SKILL.md")) {
     throw new SkillSourceError(`${skill.packageName}@${version2} does not include the ${skill.title} skill.`, "not-in-package");
   }
-  const tmp = fs12.mkdtempSync(path10.join(os2.tmpdir(), "one-skill-"));
+  const tmp = fs14.mkdtempSync(path12.join(os2.tmpdir(), "one-skill-"));
   for (const file of files) {
-    const dest = path10.join(tmp, ...file.path.split("/"));
-    fs12.mkdirSync(path10.dirname(dest), { recursive: true });
-    fs12.writeFileSync(dest, file.data);
+    const dest = path12.join(tmp, ...file.path.split("/"));
+    fs14.mkdirSync(path12.dirname(dest), { recursive: true });
+    fs14.writeFileSync(dest, file.data);
   }
   return {
     kind: "registry",
@@ -12566,7 +13072,7 @@ async function registrySkillSource(skill, fetchImpl = fetch) {
     origin: tarball,
     cleanup: () => {
       try {
-        fs12.rmSync(tmp, { recursive: true, force: true });
+        fs14.rmSync(tmp, { recursive: true, force: true });
       } catch {
       }
     }
@@ -12578,7 +13084,7 @@ function matchesIntegrity(bytes, integrity) {
     if (dash < 0) return false;
     const algorithm = entry.slice(0, dash);
     if (!["sha512", "sha384", "sha256"].includes(algorithm)) return false;
-    return crypto2.createHash(algorithm).update(bytes).digest("base64") === entry.slice(dash + 1);
+    return crypto3.createHash(algorithm).update(bytes).digest("base64") === entry.slice(dash + 1);
   });
 }
 function readTarEntries(tar, prefix) {
@@ -12610,7 +13116,7 @@ function readTarEntries(tar, prefix) {
       if ((type === "0" || type === "\0") && full.startsWith(prefix)) {
         const rel = full.slice(prefix.length);
         const parts = rel.split("/");
-        if (rel && !path10.isAbsolute(rel) && !parts.includes("..") && !parts.includes("")) {
+        if (rel && !path12.isAbsolute(rel) && !parts.includes("..") && !parts.includes("")) {
           out.push({ path: rel, data: Buffer.from(body) });
         }
       }
@@ -12621,11 +13127,11 @@ function readTarEntries(tar, prefix) {
 }
 var SKILL_STAMP = ".one-skill.json";
 function canonicalSkillDir(skill, plan) {
-  return path10.join(plan.root, ...UNIVERSAL_PROJECT_DIR.split("/"), skill.dirName);
+  return path12.join(plan.root, ...UNIVERSAL_PROJECT_DIR.split("/"), skill.dirName);
 }
 function readStamp(dir) {
   try {
-    return JSON.parse(fs12.readFileSync(path10.join(dir, SKILL_STAMP), "utf-8"));
+    return JSON.parse(fs14.readFileSync(path12.join(dir, SKILL_STAMP), "utf-8"));
   } catch {
     return null;
   }
@@ -12635,9 +13141,9 @@ function resolveAgentFolders(plan) {
   const chosen = SKILL_AGENT_TARGETS.filter((agent) => {
     if (explicit) return plan.agents.includes(agent.id);
     if (plan.scope === "global") {
-      return fs12.existsSync(path10.join(plan.root, path10.dirname(agent.homeDir)));
+      return fs14.existsSync(path12.join(plan.root, path12.dirname(agent.homeDir)));
     }
-    return agent.projectMarker === null || fs12.existsSync(path10.join(plan.root, agent.projectMarker));
+    return agent.projectMarker === null || fs14.existsSync(path12.join(plan.root, agent.projectMarker));
   });
   const readers = [];
   const byDir = /* @__PURE__ */ new Map();
@@ -12652,33 +13158,33 @@ function resolveAgentFolders(plan) {
   return { readers, folders: [...byDir].map(([dir, agents]) => ({ dir, agents })) };
 }
 function copyDir(src, dest) {
-  fs12.mkdirSync(dest, { recursive: true });
-  for (const entry of fs12.readdirSync(src, { withFileTypes: true })) {
+  fs14.mkdirSync(dest, { recursive: true });
+  for (const entry of fs14.readdirSync(src, { withFileTypes: true })) {
     if (entry.name === SKILL_STAMP) continue;
-    const from = path10.join(src, entry.name);
-    const to = path10.join(dest, entry.name);
+    const from = path12.join(src, entry.name);
+    const to = path12.join(dest, entry.name);
     if (entry.isDirectory()) copyDir(from, to);
-    else fs12.copyFileSync(from, to);
+    else fs14.copyFileSync(from, to);
   }
 }
 function removePath(target) {
   try {
-    const stat = fs12.lstatSync(target);
-    if (stat.isSymbolicLink()) fs12.unlinkSync(target);
-    else fs12.rmSync(target, { recursive: true, force: true });
+    const stat = fs14.lstatSync(target);
+    if (stat.isSymbolicLink()) fs14.unlinkSync(target);
+    else fs14.rmSync(target, { recursive: true, force: true });
   } catch {
   }
 }
 function linkDir(target, linkPath) {
   removePath(linkPath);
-  fs12.mkdirSync(path10.dirname(linkPath), { recursive: true });
+  fs14.mkdirSync(path12.dirname(linkPath), { recursive: true });
   try {
-    fs12.symlinkSync(path10.relative(path10.dirname(linkPath), target), linkPath, "dir");
+    fs14.symlinkSync(path12.relative(path12.dirname(linkPath), target), linkPath, "dir");
     return "symlink";
   } catch {
   }
   try {
-    fs12.symlinkSync(target, linkPath, "junction");
+    fs14.symlinkSync(target, linkPath, "junction");
     return "junction";
   } catch {
   }
@@ -12709,17 +13215,17 @@ function installSkill(skill, source, plan, cliVersion2) {
     installedBy: `@withone/cli@${cliVersion2}`,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  fs12.writeFileSync(path10.join(canonical, SKILL_STAMP), JSON.stringify(stamp, null, 2) + "\n");
+  fs14.writeFileSync(path12.join(canonical, SKILL_STAMP), JSON.stringify(stamp, null, 2) + "\n");
   return { skill, version: source.version, source: source.kind, origin: source.origin, scope: plan.scope, root: plan.root, canonical, readers, links };
 }
 function removeSkill(skill, plan) {
   const canonical = canonicalSkillDir(skill, plan);
   const stamp = readStamp(canonical);
-  if (!stamp && !fs12.existsSync(path10.join(canonical, "SKILL.md"))) return { removed: false, paths: [] };
+  if (!stamp && !fs14.existsSync(path12.join(canonical, "SKILL.md"))) return { removed: false, paths: [] };
   const paths = [];
   for (const link of stamp?.links ?? []) {
     const full = fromStamp(plan.root, link.path);
-    if (fs12.existsSync(full) || isDanglingLink(full)) {
+    if (fs14.existsSync(full) || isDanglingLink(full)) {
       removePath(full);
       paths.push(full);
     }
@@ -12732,18 +13238,18 @@ function toPosix(p9) {
   return p9.split("\\").join("/");
 }
 function fromStamp(root, rel) {
-  return path10.join(root, ...toPosix(rel).split("/"));
+  return path12.join(root, ...toPosix(rel).split("/"));
 }
 function isDanglingLink(p9) {
   try {
-    return fs12.lstatSync(p9).isSymbolicLink();
+    return fs14.lstatSync(p9).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function installedSkill(skill, plan) {
   const canonical = canonicalSkillDir(skill, plan);
-  if (!fs12.existsSync(path10.join(canonical, "SKILL.md"))) return null;
+  if (!fs14.existsSync(path12.join(canonical, "SKILL.md"))) return null;
   const stamp = readStamp(canonical);
   return { scope: plan.scope, root: plan.root, canonical, version: stamp?.version ?? null, source: stamp?.source ?? null, links: stamp?.links ?? [] };
 }
@@ -12752,7 +13258,7 @@ function globalRoot() {
 }
 function refreshProjectSkills(cwd, cliVersion2) {
   const root = findProjectRoot(cwd);
-  if (!root || path10.resolve(root) === path10.resolve(homeDir())) return [];
+  if (!root || path12.resolve(root) === path12.resolve(homeDir())) return [];
   const results = [];
   for (const skill of OPTIONAL_SKILLS) {
     const canonical = canonicalSkillDir(skill, { scope: "project", root });
@@ -12775,8 +13281,8 @@ function refreshProjectSkills(cwd, cliVersion2) {
 }
 
 // src/commands/skills.ts
-import path11 from "path";
-import pc15 from "picocolors";
+import path13 from "path";
+import pc16 from "picocolors";
 function requireSkill(name) {
   const skill = findOptionalSkill(name);
   if (!skill) {
@@ -12799,7 +13305,7 @@ function resolvePlan(options) {
   const agents = parseAgents(options.agents);
   if (options.global) return { scope: "global", root: globalRoot(), agents };
   const root = findProjectRoot(process.cwd());
-  if (!root || path11.resolve(root) === path11.resolve(homeDir())) {
+  if (!root || path13.resolve(root) === path13.resolve(homeDir())) {
     error("No project here: run this inside your app (a folder with package.json or .git), or pass --global.");
   }
   return { scope: "project", root, agents };
@@ -12815,7 +13321,7 @@ async function resolveSource(skill, plan) {
   }
 }
 function display(p9, root) {
-  const rel = path11.relative(root, p9);
+  const rel = path13.relative(root, p9);
   return rel && !rel.startsWith("..") ? rel : p9;
 }
 function report(command, result, packageInProject) {
@@ -12831,7 +13337,7 @@ function report(command, result, packageInProject) {
       root: result.root,
       installedTo: [
         { path: result.canonical, kind: "folder", agents: result.readers },
-        ...result.links.map((l) => ({ path: path11.join(result.root, ...l.path.split("/")), kind: l.kind, agents: l.agents }))
+        ...result.links.map((l) => ({ path: path13.join(result.root, ...l.path.split("/")), kind: l.kind, agents: l.agents }))
       ],
       next: nextSteps(result, packageInProject)
     });
@@ -12839,20 +13345,20 @@ function report(command, result, packageInProject) {
   }
   const scopeLabel2 = result.scope === "project" ? "this project" : "every project on this machine";
   console.log();
-  console.log(`  ${pc15.green("\u2713")} ${pc15.bold(`${result.skill.title} skill ${result.version}`)} installed for ${scopeLabel2}`);
+  console.log(`  ${pc16.green("\u2713")} ${pc16.bold(`${result.skill.title} skill ${result.version}`)} installed for ${scopeLabel2}`);
   console.log();
-  const from = result.source === "project" ? `${where(result.origin)} ${pc15.dim("(the version your code uses)")}` : `npm ${pc15.dim(result.scope === "project" ? `(latest ${result.skill.packageName}; not installed in this project yet)` : `(latest ${result.skill.packageName})`)}`;
-  console.log(`  ${pc15.dim("From")}  ${from}`);
+  const from = result.source === "project" ? `${where(result.origin)} ${pc16.dim("(the version your code uses)")}` : `npm ${pc16.dim(result.scope === "project" ? `(latest ${result.skill.packageName}; not installed in this project yet)` : `(latest ${result.skill.packageName})`)}`;
+  console.log(`  ${pc16.dim("From")}  ${from}`);
   const rows = [
     { path: where(result.canonical), agents: result.readers },
-    ...result.links.map((l) => ({ path: `${l.path}${l.kind === "copy" ? pc15.dim(" (copy)") : ""}`, agents: l.agents }))
+    ...result.links.map((l) => ({ path: `${l.path}${l.kind === "copy" ? pc16.dim(" (copy)") : ""}`, agents: l.agents }))
   ];
   rows.forEach((row, i) => {
-    const agents = row.agents.length ? pc15.dim(row.agents.join(", ")) : pc15.dim("shared copy the links point to");
-    console.log(`  ${pc15.dim(i === 0 ? "To  " : "    ")}  ${row.path}  ${agents}`);
+    const agents = row.agents.length ? pc16.dim(row.agents.join(", ")) : pc16.dim("shared copy the links point to");
+    console.log(`  ${pc16.dim(i === 0 ? "To  " : "    ")}  ${row.path}  ${agents}`);
   });
   console.log();
-  console.log(`  ${pc15.bold("Next")}`);
+  console.log(`  ${pc16.bold("Next")}`);
   nextSteps(result, packageInProject).forEach((step, i) => console.log(`  ${i + 1}. ${step}`));
   console.log();
 }
@@ -12915,7 +13421,7 @@ async function skillsUpdateCommand(name, options) {
     console.log("No optional skills are installed here. See: one skills list");
     return;
   }
-  for (const r of updated) console.log(`  ${pc15.green("\u2713")} ${r.skill.title} skill ${r.version} ${pc15.dim(display(r.canonical, r.root))}`);
+  for (const r of updated) console.log(`  ${pc16.green("\u2713")} ${r.skill.title} skill ${r.version} ${pc16.dim(display(r.canonical, r.root))}`);
 }
 async function skillsRemoveCommand(name, options) {
   const skill = requireSkill(name);
@@ -12929,12 +13435,12 @@ async function skillsRemoveCommand(name, options) {
     console.log(`${skill.title} skill is not installed ${plan.scope === "global" ? "globally" : "in this project"}.`);
     return;
   }
-  console.log(`  ${pc15.green("\u2713")} Removed the ${skill.title} skill`);
-  for (const p9 of result.paths) console.log(`    ${pc15.dim(display(p9, plan.root))}`);
+  console.log(`  ${pc16.green("\u2713")} Removed the ${skill.title} skill`);
+  for (const p9 of result.paths) console.log(`    ${pc16.dim(display(p9, plan.root))}`);
 }
 async function skillsListCommand() {
   const projectRoot = findProjectRoot(process.cwd());
-  const inProject = projectRoot && path11.resolve(projectRoot) !== path11.resolve(homeDir()) ? projectRoot : null;
+  const inProject = projectRoot && path13.resolve(projectRoot) !== path13.resolve(homeDir()) ? projectRoot : null;
   const optional = OPTIONAL_SKILLS.map((skill) => {
     const project = inProject ? installedSkill(skill, { scope: "project", root: inProject }) : null;
     const global = installedSkill(skill, { scope: "global", root: globalRoot() });
@@ -12962,11 +13468,11 @@ async function skillsListCommand() {
     return;
   }
   console.log();
-  console.log(`  ${pc15.bold("one")}      ${oneSkill.installed ? pc15.green(`installed ${oneSkill.version ?? ""}`.trim()) : pc15.yellow("not installed")}  ${pc15.dim("managed by one init")}`);
+  console.log(`  ${pc16.bold("one")}      ${oneSkill.installed ? pc16.green(`installed ${oneSkill.version ?? ""}`.trim()) : pc16.yellow("not installed")}  ${pc16.dim("managed by one init")}`);
   for (const s of optional) {
-    const state = s.project ? pc15.green(`project ${s.project.version ?? ""}`.trim()) + (s.project.upToDate ? "" : pc15.yellow(` (package is ${s.packageInProject}: run one skills update ${s.skill})`)) : s.global ? pc15.green(`global ${s.global.version ?? ""}`.trim()) : pc15.dim(`not installed \u2014 one skills add ${s.skill}`);
-    console.log(`  ${pc15.bold(s.skill.padEnd(8))} ${state}`);
-    console.log(`  ${" ".repeat(8)} ${pc15.dim(s.description)}`);
+    const state = s.project ? pc16.green(`project ${s.project.version ?? ""}`.trim()) + (s.project.upToDate ? "" : pc16.yellow(` (package is ${s.packageInProject}: run one skills update ${s.skill})`)) : s.global ? pc16.green(`global ${s.global.version ?? ""}`.trim()) : pc16.dim(`not installed \u2014 one skills add ${s.skill}`);
+    console.log(`  ${pc16.bold(s.skill.padEnd(8))} ${state}`);
+    console.log(`  ${" ".repeat(8)} ${pc16.dim(s.description)}`);
   }
   console.log();
 }
@@ -12999,6 +13505,10 @@ program.name("one").option("--agent", "Machine-readable JSON output (no colors,
     one skills update [connect]           Re-copy from the installed @withone/connect after an upgrade
     one skills remove connect             Remove it
 
+  Connect apps (one.connect.ts, typed by @withone/connect/config):
+    one connect create                    Approve the app (or its new version) in the browser, then write .env
+    one connect types                     Write one-connect-env.d.ts so tool slugs and action names autocomplete
+
   Guide:
     one guide [topic]                     Full CLI guide (topics: overview, actions, workflows, memory, sync, all)
 
@@ -13212,8 +13722,8 @@ config.command("reset").description("Remove the project config for the current d
         return;
       }
     }
-    const fs14 = await import("fs");
-    fs14.unlinkSync(globalPath);
+    const fs16 = await import("fs");
+    fs16.unlinkSync(globalPath);
     if (isAgentMode()) {
       json({ deleted: true, scope: "global" });
     } else {
@@ -13230,15 +13740,15 @@ config.command("reset").description("Remove the project config for the current d
     }
     return;
   }
-  const fs13 = await import("fs");
-  const configContent = fs13.readFileSync(resolved.path, "utf-8");
-  fs13.unlinkSync(resolved.path);
+  const fs15 = await import("fs");
+  const configContent = fs15.readFileSync(resolved.path, "utf-8");
+  fs15.unlinkSync(resolved.path);
   const next = resolveConfig();
-  fs13.mkdirSync(path12.dirname(resolved.path), { recursive: true });
-  fs13.writeFileSync(resolved.path, configContent);
+  fs15.mkdirSync(path14.dirname(resolved.path), { recursive: true });
+  fs15.writeFileSync(resolved.path, configContent);
   let fallbackLabel;
   if (next.scope === "project") {
-    fallbackLabel = `parent project config (${path12.basename(next.projectRoot)})`;
+    fallbackLabel = `parent project config (${path14.basename(next.projectRoot)})`;
   } else if (next.scope === "global") {
     fallbackLabel = "global config";
   } else {
@@ -13247,7 +13757,7 @@ config.command("reset").description("Remove the project config for the current d
   if (!isAgentMode()) {
     const p9 = await import("@clack/prompts");
     const confirmed = await p9.confirm({
-      message: `Delete project config for ${path12.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
+      message: `Delete project config for ${path14.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
       initialValue: false
     });
     if (p9.isCancel(confirmed) || !confirmed) {
@@ -13255,9 +13765,9 @@ config.command("reset").description("Remove the project config for the current d
       return;
     }
   }
-  fs13.unlinkSync(resolved.path);
+  fs15.unlinkSync(resolved.path);
   try {
-    fs13.rmdirSync(path12.dirname(resolved.path));
+    fs15.rmdirSync(path14.dirname(resolved.path));
   } catch {
   }
   if (isAgentMode()) {
@@ -13333,6 +13843,13 @@ flow.command("inspect <runId>").description("Inspect a past run's per-step outpu
 flow.command("scaffold [template]").description("Generate a workflow scaffold (templates: basic, conditional, loop, ai)").action(async (template) => {
   await flowScaffoldCommand(template);
 });
+var connectApp = program.command("connect").description("Create and update a One Connect app from one.connect.ts");
+connectApp.command("create").description("Open the setup page to approve the app (or, once .env holds its ONE_CLIENT_ID, its new version); a new app gets its two secrets there. Then write .env").option("--config <file>", "Config file (default: one.connect.ts, .mts, .mjs or .js in this directory)").option("--env-file <file>", "Env file to write (default: .env.local if it exists, else .env)").option("--no-open", "Print the setup page link instead of opening it").action(async (options) => {
+  await connectCreateCommand(options);
+});
+connectApp.command("types").description("Write one-connect-env.d.ts: every tool slug, and action names for the tools the config asks for").option("--config <file>", "Config file (default: one.connect.ts, .mts, .mjs or .js in this directory)").action(async (options) => {
+  await connectTypesCommand(options);
+});
 var relay = program.command("relay").alias("r").description("Receive webhooks from platforms and relay them via passthrough actions");
 relay.command("create").description("Create a new relay endpoint for a connection").requiredOption("--connection-key <key>", "Connection key for the source platform").option("--description <desc>", "Description of the relay endpoint").option("--event-filters <json>", `JSON array of event types to filter (e.g. '["customer.created"]')`).option("--tags <json>", "JSON array of tags").option("--metadata <json>", `JSON object of platform-specific metadata required to register the webhook (e.g. GitHub: '{"GITHUB_OWNER":"org","GITHUB_REPOSITORY":"repo"}', Typeform: '{"TYPEFORM_FORM_ID":"abc"}')`).option("--create-webhook", "Automatically register the webhook with the source platform").action(async (options) => {
   await relayCreateCommand(options);
@@ -13420,22 +13937,22 @@ program.command("whoami").description("Show the user, organization, and project
     });
     return;
   }
-  const pc16 = (await import("picocolors")).default;
+  const pc17 = (await import("picocolors")).default;
   const contextParts = [];
   if (whoami.organization) contextParts.push(whoami.organization.name);
   if (whoami.project) contextParts.push(whoami.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc16.yellow("test") : pc16.green("live");
-  const configLabel = configScope === "project" ? pc16.cyan("project config") : pc16.magenta("global config");
+  const envLabel = env === "test" ? pc17.yellow("test") : pc17.green("live");
+  const configLabel = configScope === "project" ? pc17.cyan("project config") : pc17.magenta("global config");
   console.log();
-  console.log(`  ${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`);
-  console.log(`  ${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`);
-  if (keyName) console.log(`  ${pc16.dim("Key:")} ${keyName}`);
-  if (whoami.organization) console.log(`  ${pc16.dim("Org:")} ${whoami.organization.name} ${pc16.dim(`(${whoami.organization.id})`)}`);
-  if (whoami.project) console.log(`  ${pc16.dim("Project:")} ${whoami.project.name} ${pc16.dim(`(${whoami.project.id})`)}`);
+  console.log(`  ${pc17.bold(scopeDisplay)} ${pc17.dim("\xB7")} ${envLabel}`);
+  console.log(`  ${whoami.user.name} ${pc17.dim(`(${whoami.user.email})`)}`);
+  if (keyName) console.log(`  ${pc17.dim("Key:")} ${keyName}`);
+  if (whoami.organization) console.log(`  ${pc17.dim("Org:")} ${whoami.organization.name} ${pc17.dim(`(${whoami.organization.id})`)}`);
+  if (whoami.project) console.log(`  ${pc17.dim("Project:")} ${whoami.project.name} ${pc17.dim(`(${whoami.project.id})`)}`);
   console.log();
-  console.log(`  ${pc16.dim("Using")} ${configLabel}`);
-  console.log(`  ${pc16.dim("API:")} ${apiBase}`);
+  console.log(`  ${pc17.dim("Using")} ${configLabel}`);
+  console.log(`  ${pc17.dim("API:")} ${apiBase}`);
   console.log();
 });
 program.command("add [platform]").description("Shortcut for: connection add").option("--tag <name>", "Tag the new connection (disambiguates multiple connections per platform in sync/flow profiles)").action(async (platform, options) => {