@withone/connect 0.19.0 → 0.20.0

package/README.md

@@ -57,7 +57,7 @@ The button, the routes and the calls are the same either way. Only what your ser
 | Expires | Nothing | The access token per your app's Token lifetime; the refresh token after 30 days |
 | You also run | Nothing | A daily refresh job |
 | When a user revokes | The next call throws `reconnect_required` | The next refresh throws `refresh_failed` |
-| A call outside the grant | `403` with `blockedByGrant: true` | `403` (`blockedByGrant` stays `false`) |
+| A call outside the grant | `403` with `blockedByGrant: true` | The same |
 | Pick it when | You are starting out | You need the bearer token itself, or your app already stores tokens |
 
 The mode is the credential you pass to `createOneConnect`: `connectKey` and `userStore` for key mode, `tokenStore` for token mode. Sections 1 to 6 use key mode; [section 7](#7--token-mode) shows what changes for token mode.
@@ -104,12 +104,22 @@ export default defineConnectApp({
 });
 ```
 
+An agent or CLI that works across whatever its users have asks for everything instead:
+
+```ts
+export default defineConnectApp({
+  name: "Mastra",
+  redirectUris: ["http://localhost:3000/api/one/callback"],
+  ask: "everything",
+});
+```
+
 ```bash
 one connect types    # optional: tool slugs and action names autocomplete
 one connect create   # opens your browser to approve it, then writes .env
 ```
 
-The CLI opens a page in your signed-in browser showing the app as your users will see it. You approve it there; a new app's client secret and connect key are made on that page and shown once, so they never pass through the terminal. The CLI then writes `ONE_CLIENT_ID`, `ONE_PERMISSION_SET` and `ONE_REDIRECT_URI` to `.env`. `access` is `read-only`, `read-write`, `full-access`, or `custom` with `actions`, named as `one connect types` wrote them or by id. On Node older than 22.18, name the file `one.connect.mjs` and type it with `/** @type {import("@withone/connect/config").ConnectAppConfig} */`.
+The CLI opens a page in your signed-in browser showing the app as your users will see it. You approve it there; a new app's client secret and connect key are made on that page and shown once, so they never pass through the terminal. The CLI then writes `ONE_CLIENT_ID`, `ONE_REDIRECT_URI` and, for a list of tools, `ONE_PERMISSION_SET` to `.env` (an app that asks for everything has none, so the CLI removes it). `access` is `read-only`, `read-write`, `full-access`, or `custom` with `actions`, named as `one connect types` wrote them or by id. On Node older than 22.18, name the file `one.connect.mjs` and type it with `/** @type {import("@withone/connect/config").ConnectAppConfig} */`.
 
 | Prop | |
 |---|---|
@@ -117,7 +127,7 @@ The CLI opens a page in your signed-in browser showing the app as your users wil
 | `reason` | One sentence on the card telling users why, at most 200 characters. |
 | `description`, `logoUrl`, `homepageUrl` | Optional. |
 | `branding` | `panelColor`, `buttonColor` (`#RRGGBB`), `cobrandEmail`. |
-| `ask` | Per tool slug: `access` is `read-only`, `read-write`, `full-access`, or `custom` with `actions`. Omit it to let users choose from everything they have connected. |
+| `ask` | Required. Per tool slug: `access` is `read-only`, `read-write`, `full-access`, or `custom` with `actions`; users see those and can only narrow them. Or `"everything"`: users see every connection they have at full access, can connect any other app from Popular apps or Browse all, and can narrow any of them. |
 
 ## 2 · The server client
 

package/dist/config.cjs.js

@@ -16,6 +16,9 @@
  *     },
  *   });
  *
+ * Or, for an agent or CLI that works across whatever its users have,
+ * `ask: "everything"`.
+ *
  * Types and one identity helper; nothing here calls One. `one connect
  * create` reads the file and opens a page in your signed-in browser, where
  * you approve the app (or, on a re-run, its new version). A new app's
@@ -54,6 +57,10 @@
 
 /** One tool's ask: a level, or a hand-picked list of actions. */
 
+/** The tools an app asks for, keyed by slug. */
+
+/** What an app asks for: named tools, or everything its users have. */
+
 /** A colour as `#RRGGBB`. */
 
 /** How the connect card and its sign-in email look. Omit it to keep

package/dist/config.d.ts

@@ -14,6 +14,9 @@
  *     },
  *   });
  *
+ * Or, for an agent or CLI that works across whatever its users have,
+ * `ask: "everything"`.
+ *
  * Types and one identity helper; nothing here calls One. `one connect
  * create` reads the file and opens a page in your signed-in browser, where
  * you approve the app (or, on a re-run, its new version). A new app's
@@ -61,6 +64,12 @@ export type ConnectToolAsk<T extends string = string> = {
     access: "custom";
     actions: readonly [ConnectActionRef<T>, ...ConnectActionRef<T>[]];
 };
+/** The tools an app asks for, keyed by slug. */
+export type ConnectToolsAsk = {
+    [T in ConnectToolSlug]?: ConnectToolAsk<T>;
+};
+/** What an app asks for: named tools, or everything its users have. */
+export type ConnectAppAsk = ConnectToolsAsk | "everything";
 /** A colour as `#RRGGBB`. */
 export type ConnectHexColor = `#${string}`;
 /** How the connect card and its sign-in email look. Omit it to keep
@@ -88,11 +97,15 @@ export interface ConnectAppConfig {
      *  200 characters. */
     reason?: string;
     branding?: ConnectAppBranding;
-    /** The tools the app asks for, keyed by slug. Omit it to let users
-     *  choose from everything they have connected. */
-    ask?: {
-        [T in ConnectToolSlug]?: ConnectToolAsk<T>;
-    };
+    /**
+     * What the app asks for. Required, so the file always says it:
+     * - a map of tools, keyed by slug: users see exactly those and can only
+     *   narrow them;
+     * - `"everything"`: users see every connection they have, at full
+     *   access, and can connect any other app from Popular apps or Browse
+     *   all. They can narrow any of them before they authorize.
+     */
+    ask: ConnectAppAsk;
 }
 /**
  * Returns `config` unchanged. It exists for the editor: the argument is

package/dist/config.esm.js

@@ -14,6 +14,9 @@
  *     },
  *   });
  *
+ * Or, for an agent or CLI that works across whatever its users have,
+ * `ask: "everything"`.
+ *
  * Types and one identity helper; nothing here calls One. `one connect
  * create` reads the file and opens a page in your signed-in browser, where
  * you approve the app (or, on a re-run, its new version). A new app's
@@ -52,6 +55,10 @@
 
 /** One tool's ask: a level, or a hand-picked list of actions. */
 
+/** The tools an app asks for, keyed by slug. */
+
+/** What an app asks for: named tools, or everything its users have. */
+
 /** A colour as `#RRGGBB`. */
 
 /** How the connect card and its sign-in email look. Omit it to keep

package/dist/types.d.ts

@@ -77,9 +77,9 @@ export interface ConnectButtonLogo {
     name: string;
     imageUrl: string;
 }
-/** @deprecated Renamed to `ConnectButtonLogoInput`; removed in 0.20.0. */
+/** @deprecated Renamed to `ConnectButtonLogoInput`; removed in 0.21.0. */
 export type ConnectButtonPlatformInput = ConnectButtonLogoInput;
-/** @deprecated Renamed to `ConnectButtonLogo`; removed in 0.20.0. */
+/** @deprecated Renamed to `ConnectButtonLogo`; removed in 0.21.0. */
 export type ConnectButtonPlatform = ConnectButtonLogo;
 export type ConnectButtonVariant = "default" | "accent" | "block";
 export type ConnectButtonSize = "sm" | "md" | "lg";
@@ -94,7 +94,7 @@ export interface ConnectButtonProps {
      *  into a "+N" chip. Decoration only; the permission set decides what
      *  One asks for. */
     logos?: ConnectButtonLogoInput[];
-    /** @deprecated Renamed to `logos`; removed in 0.20.0. */
+    /** @deprecated Renamed to `logos`; removed in 0.21.0. */
     platforms?: ConnectButtonLogoInput[];
     /** Whether this user has a live grant, from your server. When set, it
      *  decides the Connected state. When omitted, the button shows

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/connect",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "One Connect for your app: the button your users press, the two backend routes as one import, and a server client that calls One with the grant. Users keep their connections in One; your app holds only what they granted.",
   "files": [
     "dist",

package/skills/one-connect/SKILL.md

@@ -30,7 +30,7 @@ the server keeps differs.
 | Server keeps | one connect key for the app, one id per user | an access and a refresh token per user |
 | Expires | nothing | yes; the app runs a daily refresh job |
 | User revoked | next call throws `reconnect_required` | next refresh throws `refresh_failed` |
-| Call outside the grant | `403`, `blockedByGrant: true` | `403`, `blockedByGrant` stays `false` |
+| Call outside the grant | `403`, `blockedByGrant: true` | the same |
 
 Use **key mode** unless the human asks for token mode, the app needs the
 bearer token itself, or the app already passes a `tokenStore`. Do not switch
@@ -61,7 +61,7 @@ export default defineConnectApp({
   logoUrl: "https://acme.app/logo.png",                  // optional, square, public https
   homepageUrl: "https://acme.app",                       // optional
   branding: { panelColor: "#0A0C0B", buttonColor: "#0A0C0B", cobrandEmail: false }, // optional
-  ask: {                                                 // optional: omit to let users pick from everything they have
+  ask: {                                                 // required: these tools, or "everything"
     gmail: { access: "custom", actions: ["sendEmail", "listAndViewEmailThreads"] },
     "google-calendar": { access: "full-access" },
     notion: { access: "read-write" },
@@ -72,6 +72,11 @@ export default defineConnectApp({
 Each tool in `ask` is keyed by its slug and takes `access`: `read-only`,
 `read-write` (no deletes), `full-access`, or `custom` with `actions`.
 
+For an agent or CLI that works across whatever its users have, write
+`ask: "everything"` instead: users see every connection they have, at full
+access, can connect any other app, and can narrow any of them. The CLI then
+writes no `ONE_PERMISSION_SET`.
+
 **2. Find slugs and action names** with the CLI, which reads One's catalog
 with its own key:
 
@@ -396,8 +401,8 @@ const accessToken = await oneConnect.getAccessToken(userId); // when the app nee
 - When the user revokes access, the next refresh throws `refresh_failed`
   (not `reconnect_required`) and the tokens are cleared. Ask them to connect
   again.
-- `blockedByGrant` stays `false` in token mode; treat any `403` as outside
-  the grant.
+- A call outside the grant comes back as in key mode: `403`,
+  `blockedByGrant: true`, `refusal: "grant"`.
 
 Tokens expire, and two things keep them fresh. Only the first is automatic:
 

package/src/config.ts

@@ -14,6 +14,9 @@
  *     },
  *   });
  *
+ * Or, for an agent or CLI that works across whatever its users have,
+ * `ask: "everything"`.
+ *
  * Types and one identity helper; nothing here calls One. `one connect
  * create` reads the file and opens a page in your signed-in browser, where
  * you approve the app (or, on a re-run, its new version). A new app's
@@ -74,6 +77,12 @@ export type ConnectToolAsk<T extends string = string> =
       actions: readonly [ConnectActionRef<T>, ...ConnectActionRef<T>[]];
     };
 
+/** The tools an app asks for, keyed by slug. */
+export type ConnectToolsAsk = { [T in ConnectToolSlug]?: ConnectToolAsk<T> };
+
+/** What an app asks for: named tools, or everything its users have. */
+export type ConnectAppAsk = ConnectToolsAsk | "everything";
+
 /** A colour as `#RRGGBB`. */
 export type ConnectHexColor = `#${string}`;
 
@@ -103,9 +112,15 @@ export interface ConnectAppConfig {
    *  200 characters. */
   reason?: string;
   branding?: ConnectAppBranding;
-  /** The tools the app asks for, keyed by slug. Omit it to let users
-   *  choose from everything they have connected. */
-  ask?: { [T in ConnectToolSlug]?: ConnectToolAsk<T> };
+  /**
+   * What the app asks for. Required, so the file always says it:
+   * - a map of tools, keyed by slug: users see exactly those and can only
+   *   narrow them;
+   * - `"everything"`: users see every connection they have, at full
+   *   access, and can connect any other app from Popular apps or Browse
+   *   all. They can narrow any of them before they authorize.
+   */
+  ask: ConnectAppAsk;
 }
 
 /**

package/src/types.ts

@@ -83,9 +83,9 @@ export interface ConnectButtonLogo {
   imageUrl: string;
 }
 
-/** @deprecated Renamed to `ConnectButtonLogoInput`; removed in 0.20.0. */
+/** @deprecated Renamed to `ConnectButtonLogoInput`; removed in 0.21.0. */
 export type ConnectButtonPlatformInput = ConnectButtonLogoInput;
-/** @deprecated Renamed to `ConnectButtonLogo`; removed in 0.20.0. */
+/** @deprecated Renamed to `ConnectButtonLogo`; removed in 0.21.0. */
 export type ConnectButtonPlatform = ConnectButtonLogo;
 
 export type ConnectButtonVariant = "default" | "accent" | "block";
@@ -102,7 +102,7 @@ export interface ConnectButtonProps {
    *  into a "+N" chip. Decoration only; the permission set decides what
    *  One asks for. */
   logos?: ConnectButtonLogoInput[];
-  /** @deprecated Renamed to `logos`; removed in 0.20.0. */
+  /** @deprecated Renamed to `logos`; removed in 0.21.0. */
   platforms?: ConnectButtonLogoInput[];
   /** Whether this user has a live grant, from your server. When set, it
    *  decides the Connected state. When omitted, the button shows