@withone/cli 1.12.8 → 1.13.0

package/dist/index.js

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
+import {
+  FlowRunner,
+  OneApi,
+  TimeoutError,
+  buildActionKnowledgeWithGuidance,
+  filterByPermissions,
+  isActionAllowed,
+  isMethodAllowed,
+  listFlows,
+  loadFlow,
+  resolveFlowPath,
+  saveFlow
+} from "./chunk-NHI5URAV.js";
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";
@@ -295,317 +308,6 @@ function getAgentStatuses() {
   });
 }
 
-// src/lib/api.ts
-var API_BASE = "https://api.withone.ai/v1";
-var ApiError = class extends Error {
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-    this.name = "ApiError";
-  }
-};
-var OneApi = class {
-  constructor(apiKey) {
-    this.apiKey = apiKey;
-  }
-  async request(path6) {
-    return this.requestFull({ path: path6 });
-  }
-  async requestFull(opts) {
-    let url = `${API_BASE}${opts.path}`;
-    if (opts.queryParams && Object.keys(opts.queryParams).length > 0) {
-      const params = new URLSearchParams(opts.queryParams);
-      url += `?${params.toString()}`;
-    }
-    const headers = {
-      "x-one-secret": this.apiKey,
-      "Content-Type": "application/json",
-      ...opts.headers
-    };
-    const fetchOpts = {
-      method: opts.method || "GET",
-      headers
-    };
-    if (opts.body !== void 0) {
-      fetchOpts.body = JSON.stringify(opts.body);
-    }
-    const response = await fetch(url, fetchOpts);
-    if (!response.ok) {
-      const text4 = await response.text();
-      throw new ApiError(response.status, text4 || `HTTP ${response.status}`);
-    }
-    return response.json();
-  }
-  async validateApiKey() {
-    try {
-      await this.listConnections();
-      return true;
-    } catch (error2) {
-      if (error2 instanceof ApiError && error2.status === 401) {
-        return false;
-      }
-      throw error2;
-    }
-  }
-  async listConnections() {
-    const allConnections = [];
-    let page = 1;
-    let totalPages = 1;
-    do {
-      const response = await this.request(`/vault/connections?page=${page}&limit=100`);
-      allConnections.push(...response.rows || []);
-      totalPages = response.pages || 1;
-      page++;
-    } while (page <= totalPages);
-    return allConnections;
-  }
-  async listPlatforms() {
-    const allPlatforms = [];
-    let page = 1;
-    let totalPages = 1;
-    do {
-      const response = await this.request(`/available-connectors?page=${page}&limit=100`);
-      allPlatforms.push(...response.rows || []);
-      totalPages = response.pages || 1;
-      page++;
-    } while (page <= totalPages);
-    return allPlatforms;
-  }
-  async searchActions(platform, query, agentType) {
-    const isKnowledgeAgent = !agentType || agentType === "knowledge";
-    const queryParams = {
-      query,
-      limit: "5"
-    };
-    if (isKnowledgeAgent) {
-      queryParams.knowledgeAgent = "true";
-    } else {
-      queryParams.executeAgent = "true";
-    }
-    const response = await this.requestFull({
-      path: `/available-actions/search/${platform}`,
-      queryParams
-    });
-    return response || [];
-  }
-  async getActionDetails(actionId) {
-    const response = await this.requestFull({
-      path: "/knowledge",
-      queryParams: { _id: actionId }
-    });
-    const actions2 = response?.rows || [];
-    if (actions2.length === 0) {
-      throw new ApiError(404, `Action with ID ${actionId} not found`);
-    }
-    return actions2[0];
-  }
-  async getActionKnowledge(actionId) {
-    const action = await this.getActionDetails(actionId);
-    if (!action.knowledge || !action.method) {
-      return {
-        knowledge: "No knowledge was found",
-        method: "No method was found"
-      };
-    }
-    return {
-      knowledge: action.knowledge,
-      method: action.method
-    };
-  }
-  async executePassthroughRequest(args, preloadedAction) {
-    const action = preloadedAction ?? await this.getActionDetails(args.actionId);
-    const method = action.method;
-    const contentType = args.isFormData ? "multipart/form-data" : args.isFormUrlEncoded ? "application/x-www-form-urlencoded" : "application/json";
-    const requestHeaders = {
-      "x-one-secret": this.apiKey,
-      "x-one-connection-key": args.connectionKey,
-      "x-one-action-id": action._id,
-      "Content-Type": contentType,
-      ...args.headers
-    };
-    const finalActionPath = args.pathVariables ? replacePathVariables(action.path, args.pathVariables) : action.path;
-    const normalizedPath = finalActionPath.startsWith("/") ? finalActionPath : `/${finalActionPath}`;
-    const url = `${API_BASE.replace("/v1", "")}/v1/passthrough${normalizedPath}`;
-    const isCustomAction = action.tags?.includes("custom");
-    let requestData = args.data;
-    if (isCustomAction && method?.toLowerCase() !== "get") {
-      requestData = {
-        ...args.data,
-        connectionKey: args.connectionKey
-      };
-    }
-    let queryString = "";
-    if (args.queryParams && Object.keys(args.queryParams).length > 0) {
-      const params = new URLSearchParams(
-        Object.entries(args.queryParams).map(([k, v]) => [k, String(v)])
-      );
-      queryString = `?${params.toString()}`;
-    }
-    const fullUrl = `${url}${queryString}`;
-    const fetchOpts = {
-      method,
-      headers: requestHeaders
-    };
-    if (method?.toLowerCase() !== "get" && requestData !== void 0) {
-      if (args.isFormUrlEncoded) {
-        const params = new URLSearchParams();
-        if (requestData && typeof requestData === "object" && !Array.isArray(requestData)) {
-          Object.entries(requestData).forEach(([key, value]) => {
-            if (typeof value === "object") {
-              params.append(key, JSON.stringify(value));
-            } else {
-              params.append(key, String(value));
-            }
-          });
-        }
-        fetchOpts.body = params.toString();
-      } else if (args.isFormData) {
-        const boundary = `----FormBoundary${Date.now()}`;
-        requestHeaders["Content-Type"] = `multipart/form-data; boundary=${boundary}`;
-        let body = "";
-        if (requestData && typeof requestData === "object" && !Array.isArray(requestData)) {
-          Object.entries(requestData).forEach(([key, value]) => {
-            body += `--${boundary}\r
-`;
-            body += `Content-Disposition: form-data; name="${key}"\r
-\r
-`;
-            body += typeof value === "object" ? JSON.stringify(value) : String(value);
-            body += "\r\n";
-          });
-        }
-        body += `--${boundary}--\r
-`;
-        fetchOpts.body = body;
-        fetchOpts.headers = requestHeaders;
-      } else {
-        fetchOpts.body = JSON.stringify(requestData);
-      }
-    }
-    const sanitizedConfig = {
-      url: fullUrl,
-      method,
-      headers: {
-        ...requestHeaders,
-        "x-one-secret": "***REDACTED***"
-      },
-      params: args.queryParams ? Object.fromEntries(
-        Object.entries(args.queryParams).map(([k, v]) => [k, String(v)])
-      ) : void 0,
-      data: requestData
-    };
-    if (args.dryRun) {
-      return {
-        requestConfig: sanitizedConfig,
-        responseData: null
-      };
-    }
-    const response = await fetch(fullUrl, fetchOpts);
-    if (!response.ok) {
-      const text4 = await response.text();
-      throw new ApiError(response.status, text4 || `HTTP ${response.status}`);
-    }
-    const responseText = await response.text();
-    const responseData = responseText ? JSON.parse(responseText) : {};
-    return {
-      requestConfig: sanitizedConfig,
-      responseData
-    };
-  }
-  async waitForConnection(platform, timeoutMs = 5 * 60 * 1e3, pollIntervalMs = 5e3, onPoll) {
-    const startTime = Date.now();
-    const existingConnections = await this.listConnections();
-    const existingIds = new Set(existingConnections.map((c) => c.id));
-    while (Date.now() - startTime < timeoutMs) {
-      await sleep(pollIntervalMs);
-      onPoll?.();
-      const currentConnections = await this.listConnections();
-      const newConnection = currentConnections.find(
-        (c) => c.platform.toLowerCase() === platform.toLowerCase() && !existingIds.has(c.id)
-      );
-      if (newConnection) {
-        return newConnection;
-      }
-    }
-    throw new TimeoutError(`Timed out waiting for ${platform} connection`);
-  }
-};
-var TimeoutError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TimeoutError";
-  }
-};
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function replacePathVariables(path6, variables) {
-  if (!path6) return path6;
-  let result = path6;
-  result = result.replace(/\{\{([^}]+)\}\}/g, (_match, variable) => {
-    const trimmedVariable = variable.trim();
-    const value = variables[trimmedVariable];
-    if (value === void 0 || value === null || value === "") {
-      throw new Error(`Missing value for path variable: ${trimmedVariable}`);
-    }
-    return encodeURIComponent(value.toString()).replace(/%3A/gi, ":");
-  });
-  result = result.replace(/\{([^}]+)\}/g, (_match, variable) => {
-    const trimmedVariable = variable.trim();
-    const value = variables[trimmedVariable];
-    if (value === void 0 || value === null || value === "") {
-      throw new Error(`Missing value for path variable: ${trimmedVariable}`);
-    }
-    return encodeURIComponent(value.toString()).replace(/%3A/gi, ":");
-  });
-  return result;
-}
-var PERMISSION_METHODS = {
-  read: ["GET"],
-  write: ["GET", "POST", "PUT", "PATCH"],
-  admin: null
-};
-function filterByPermissions(actions2, permissions) {
-  const allowed = PERMISSION_METHODS[permissions];
-  if (allowed === null) return actions2;
-  return actions2.filter((a) => allowed.includes(a.method.toUpperCase()));
-}
-function isMethodAllowed(method, permissions) {
-  const allowed = PERMISSION_METHODS[permissions];
-  if (allowed === null) return true;
-  return allowed.includes(method.toUpperCase());
-}
-function isActionAllowed(actionId, allowedActionIds) {
-  return allowedActionIds.includes("*") || allowedActionIds.includes(actionId);
-}
-function buildActionKnowledgeWithGuidance(knowledge, method, platform, actionId) {
-  const baseUrl = "https://api.withone.ai";
-  return `${knowledge}
-
-API REQUEST STRUCTURE
-======================
-URL: ${baseUrl}/v1/passthrough/{{PATH}}
-
-IMPORTANT: When constructing the URL, only include the API endpoint path after the base URL.
-Do NOT include the full third-party API URL.
-
-Examples:
-  Correct: ${baseUrl}/v1/passthrough/crm/v3/objects/contacts/search
-  Incorrect: ${baseUrl}/v1/passthrough/https://api.hubapi.com/crm/v3/objects/contacts/search
-
-METHOD: ${method}
-
-HEADERS:
-- x-one-secret: {{process.env.ONE_SECRET}}
-- x-one-connection-key: {{process.env.ONE_${platform.toUpperCase()}_CONNECTION_KEY}}
-- x-one-action-id: ${actionId}
-- ... (other headers)
-
-BODY: {{BODY}}
-
-QUERY PARAMS: {{QUERY_PARAMS}}`;
-}
-
 // src/lib/browser.ts
 import open from "open";
 var ONE_APP_URL = "https://app.withone.ai";
@@ -2016,7 +1718,11 @@ var VALID_STEP_TYPES = [
   "loop",
   "parallel",
   "file-read",
-  "file-write"
+  "file-write",
+  "while",
+  "flow",
+  "paginate",
+  "bash"
 ];
 var VALID_INPUT_TYPES = ["string", "number", "boolean", "object", "array"];
 var VALID_ERROR_STRATEGIES = ["fail", "continue", "retry", "fallback"];
@@ -2077,123 +1783,193 @@ function validateFlowSchema(flow2) {
 function validateStepsArray(steps, pathPrefix, errors) {
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path6 = `${pathPrefix}[${i}]`;
+    const path4 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path6, message: "Step must be an object" });
+      errors.push({ path: path4, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path6}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path4}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path6}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path4}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !VALID_STEP_TYPES.includes(s.type)) {
-      errors.push({ path: `${path6}.type`, message: `Step type must be one of: ${VALID_STEP_TYPES.join(", ")}` });
+      errors.push({ path: `${path4}.type`, message: `Step type must be one of: ${VALID_STEP_TYPES.join(", ")}` });
     }
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!VALID_ERROR_STRATEGIES.includes(oe.strategy)) {
-        errors.push({ path: `${path6}.onError.strategy`, message: `Error strategy must be one of: ${VALID_ERROR_STRATEGIES.join(", ")}` });
+        errors.push({ path: `${path4}.onError.strategy`, message: `Error strategy must be one of: ${VALID_ERROR_STRATEGIES.join(", ")}` });
       }
     }
     const type = s.type;
     if (type === "action") {
       if (!s.action || typeof s.action !== "object") {
-        errors.push({ path: `${path6}.action`, message: 'Action step must have an "action" config object' });
+        errors.push({ path: `${path4}.action`, message: 'Action step must have an "action" config object' });
       } else {
         const a = s.action;
-        if (!a.platform) errors.push({ path: `${path6}.action.platform`, message: 'Action must have "platform"' });
-        if (!a.actionId) errors.push({ path: `${path6}.action.actionId`, message: 'Action must have "actionId"' });
-        if (!a.connectionKey) errors.push({ path: `${path6}.action.connectionKey`, message: 'Action must have "connectionKey"' });
+        if (!a.platform) errors.push({ path: `${path4}.action.platform`, message: 'Action must have "platform"' });
+        if (!a.actionId) errors.push({ path: `${path4}.action.actionId`, message: 'Action must have "actionId"' });
+        if (!a.connectionKey) errors.push({ path: `${path4}.action.connectionKey`, message: 'Action must have "connectionKey"' });
       }
     } else if (type === "transform") {
       if (!s.transform || typeof s.transform !== "object") {
-        errors.push({ path: `${path6}.transform`, message: 'Transform step must have a "transform" config object' });
+        errors.push({ path: `${path4}.transform`, message: 'Transform step must have a "transform" config object' });
       } else {
         const t = s.transform;
         if (!t.expression || typeof t.expression !== "string") {
-          errors.push({ path: `${path6}.transform.expression`, message: 'Transform must have a string "expression"' });
+          errors.push({ path: `${path4}.transform.expression`, message: 'Transform must have a string "expression"' });
         }
       }
     } else if (type === "code") {
       if (!s.code || typeof s.code !== "object") {
-        errors.push({ path: `${path6}.code`, message: 'Code step must have a "code" config object' });
+        errors.push({ path: `${path4}.code`, message: 'Code step must have a "code" config object' });
       } else {
         const c = s.code;
         if (!c.source || typeof c.source !== "string") {
-          errors.push({ path: `${path6}.code.source`, message: 'Code must have a string "source"' });
+          errors.push({ path: `${path4}.code.source`, message: 'Code must have a string "source"' });
         }
       }
     } else if (type === "condition") {
       if (!s.condition || typeof s.condition !== "object") {
-        errors.push({ path: `${path6}.condition`, message: 'Condition step must have a "condition" config object' });
+        errors.push({ path: `${path4}.condition`, message: 'Condition step must have a "condition" config object' });
       } else {
         const c = s.condition;
         if (!c.expression || typeof c.expression !== "string") {
-          errors.push({ path: `${path6}.condition.expression`, message: 'Condition must have a string "expression"' });
+          errors.push({ path: `${path4}.condition.expression`, message: 'Condition must have a string "expression"' });
         }
         if (!Array.isArray(c.then)) {
-          errors.push({ path: `${path6}.condition.then`, message: 'Condition must have a "then" steps array' });
+          errors.push({ path: `${path4}.condition.then`, message: 'Condition must have a "then" steps array' });
         } else {
-          validateStepsArray(c.then, `${path6}.condition.then`, errors);
+          validateStepsArray(c.then, `${path4}.condition.then`, errors);
         }
         if (c.else !== void 0) {
           if (!Array.isArray(c.else)) {
-            errors.push({ path: `${path6}.condition.else`, message: 'Condition "else" must be a steps array' });
+            errors.push({ path: `${path4}.condition.else`, message: 'Condition "else" must be a steps array' });
           } else {
-            validateStepsArray(c.else, `${path6}.condition.else`, errors);
+            validateStepsArray(c.else, `${path4}.condition.else`, errors);
           }
         }
       }
     } else if (type === "loop") {
       if (!s.loop || typeof s.loop !== "object") {
-        errors.push({ path: `${path6}.loop`, message: 'Loop step must have a "loop" config object' });
+        errors.push({ path: `${path4}.loop`, message: 'Loop step must have a "loop" config object' });
       } else {
         const l = s.loop;
         if (!l.over || typeof l.over !== "string") {
-          errors.push({ path: `${path6}.loop.over`, message: 'Loop must have a string "over" selector' });
+          errors.push({ path: `${path4}.loop.over`, message: 'Loop must have a string "over" selector' });
         }
         if (!l.as || typeof l.as !== "string") {
-          errors.push({ path: `${path6}.loop.as`, message: 'Loop must have a string "as" variable name' });
+          errors.push({ path: `${path4}.loop.as`, message: 'Loop must have a string "as" variable name' });
         }
         if (!Array.isArray(l.steps)) {
-          errors.push({ path: `${path6}.loop.steps`, message: 'Loop must have a "steps" array' });
+          errors.push({ path: `${path4}.loop.steps`, message: 'Loop must have a "steps" array' });
         } else {
-          validateStepsArray(l.steps, `${path6}.loop.steps`, errors);
+          validateStepsArray(l.steps, `${path4}.loop.steps`, errors);
         }
       }
     } else if (type === "parallel") {
       if (!s.parallel || typeof s.parallel !== "object") {
-        errors.push({ path: `${path6}.parallel`, message: 'Parallel step must have a "parallel" config object' });
+        errors.push({ path: `${path4}.parallel`, message: 'Parallel step must have a "parallel" config object' });
       } else {
         const par = s.parallel;
         if (!Array.isArray(par.steps)) {
-          errors.push({ path: `${path6}.parallel.steps`, message: 'Parallel must have a "steps" array' });
+          errors.push({ path: `${path4}.parallel.steps`, message: 'Parallel must have a "steps" array' });
         } else {
-          validateStepsArray(par.steps, `${path6}.parallel.steps`, errors);
+          validateStepsArray(par.steps, `${path4}.parallel.steps`, errors);
         }
       }
     } else if (type === "file-read") {
       if (!s.fileRead || typeof s.fileRead !== "object") {
-        errors.push({ path: `${path6}.fileRead`, message: 'File-read step must have a "fileRead" config object' });
+        errors.push({ path: `${path4}.fileRead`, message: 'File-read step must have a "fileRead" config object' });
       } else {
         const fr = s.fileRead;
         if (!fr.path || typeof fr.path !== "string") {
-          errors.push({ path: `${path6}.fileRead.path`, message: 'File-read must have a string "path"' });
+          errors.push({ path: `${path4}.fileRead.path`, message: 'File-read must have a string "path"' });
         }
       }
     } else if (type === "file-write") {
       if (!s.fileWrite || typeof s.fileWrite !== "object") {
-        errors.push({ path: `${path6}.fileWrite`, message: 'File-write step must have a "fileWrite" config object' });
+        errors.push({ path: `${path4}.fileWrite`, message: 'File-write step must have a "fileWrite" config object' });
       } else {
         const fw = s.fileWrite;
         if (!fw.path || typeof fw.path !== "string") {
-          errors.push({ path: `${path6}.fileWrite.path`, message: 'File-write must have a string "path"' });
+          errors.push({ path: `${path4}.fileWrite.path`, message: 'File-write must have a string "path"' });
         }
         if (fw.content === void 0) {
-          errors.push({ path: `${path6}.fileWrite.content`, message: 'File-write must have "content"' });
+          errors.push({ path: `${path4}.fileWrite.content`, message: 'File-write must have "content"' });
+        }
+      }
+    } else if (type === "while") {
+      if (!s.while || typeof s.while !== "object") {
+        errors.push({ path: `${path4}.while`, message: 'While step must have a "while" config object' });
+      } else {
+        const w = s.while;
+        if (!w.condition || typeof w.condition !== "string") {
+          errors.push({ path: `${path4}.while.condition`, message: 'While must have a string "condition"' });
+        }
+        if (!Array.isArray(w.steps)) {
+          errors.push({ path: `${path4}.while.steps`, message: 'While must have a "steps" array' });
+        } else {
+          validateStepsArray(w.steps, `${path4}.while.steps`, errors);
+        }
+        if (w.maxIterations !== void 0 && (typeof w.maxIterations !== "number" || w.maxIterations <= 0)) {
+          errors.push({ path: `${path4}.while.maxIterations`, message: "maxIterations must be a positive number" });
+        }
+      }
+    } else if (type === "flow") {
+      if (!s.flow || typeof s.flow !== "object") {
+        errors.push({ path: `${path4}.flow`, message: 'Flow step must have a "flow" config object' });
+      } else {
+        const f = s.flow;
+        if (!f.key || typeof f.key !== "string") {
+          errors.push({ path: `${path4}.flow.key`, message: 'Flow must have a string "key"' });
+        }
+        if (f.inputs !== void 0 && (typeof f.inputs !== "object" || Array.isArray(f.inputs))) {
+          errors.push({ path: `${path4}.flow.inputs`, message: "Flow inputs must be an object" });
+        }
+      }
+    } else if (type === "paginate") {
+      if (!s.paginate || typeof s.paginate !== "object") {
+        errors.push({ path: `${path4}.paginate`, message: 'Paginate step must have a "paginate" config object' });
+      } else {
+        const p7 = s.paginate;
+        if (!p7.action || typeof p7.action !== "object") {
+          errors.push({ path: `${path4}.paginate.action`, message: 'Paginate must have an "action" config object' });
+        } else {
+          const a = p7.action;
+          if (!a.platform) errors.push({ path: `${path4}.paginate.action.platform`, message: 'Action must have "platform"' });
+          if (!a.actionId) errors.push({ path: `${path4}.paginate.action.actionId`, message: 'Action must have "actionId"' });
+          if (!a.connectionKey) errors.push({ path: `${path4}.paginate.action.connectionKey`, message: 'Action must have "connectionKey"' });
+        }
+        if (!p7.pageTokenField || typeof p7.pageTokenField !== "string") {
+          errors.push({ path: `${path4}.paginate.pageTokenField`, message: 'Paginate must have a string "pageTokenField"' });
+        }
+        if (!p7.resultsField || typeof p7.resultsField !== "string") {
+          errors.push({ path: `${path4}.paginate.resultsField`, message: 'Paginate must have a string "resultsField"' });
+        }
+        if (!p7.inputTokenParam || typeof p7.inputTokenParam !== "string") {
+          errors.push({ path: `${path4}.paginate.inputTokenParam`, message: 'Paginate must have a string "inputTokenParam"' });
+        }
+        if (p7.maxPages !== void 0 && (typeof p7.maxPages !== "number" || p7.maxPages <= 0)) {
+          errors.push({ path: `${path4}.paginate.maxPages`, message: "maxPages must be a positive number" });
+        }
+      }
+    } else if (type === "bash") {
+      if (!s.bash || typeof s.bash !== "object") {
+        errors.push({ path: `${path4}.bash`, message: 'Bash step must have a "bash" config object' });
+      } else {
+        const b = s.bash;
+        if (!b.command || typeof b.command !== "string") {
+          errors.push({ path: `${path4}.bash.command`, message: 'Bash must have a string "command"' });
+        }
+        if (b.timeout !== void 0 && (typeof b.timeout !== "number" || b.timeout <= 0)) {
+          errors.push({ path: `${path4}.bash.timeout`, message: "timeout must be a positive number" });
+        }
+        if (b.parseJson !== void 0 && typeof b.parseJson !== "boolean") {
+          errors.push({ path: `${path4}.bash.parseJson`, message: "parseJson must be a boolean" });
         }
       }
     }
@@ -2205,18 +1981,19 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path6 = `${pathPrefix}[${i}]`;
+      const path4 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path6}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path4}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       if (step.condition) {
-        if (step.condition.then) collectIds(step.condition.then, `${path6}.condition.then`);
-        if (step.condition.else) collectIds(step.condition.else, `${path6}.condition.else`);
+        if (step.condition.then) collectIds(step.condition.then, `${path4}.condition.then`);
+        if (step.condition.else) collectIds(step.condition.else, `${path4}.condition.else`);
       }
-      if (step.loop?.steps) collectIds(step.loop.steps, `${path6}.loop.steps`);
-      if (step.parallel?.steps) collectIds(step.parallel.steps, `${path6}.parallel.steps`);
+      if (step.loop?.steps) collectIds(step.loop.steps, `${path4}.loop.steps`);
+      if (step.parallel?.steps) collectIds(step.parallel.steps, `${path4}.parallel.steps`);
+      if (step.while?.steps) collectIds(step.while.steps, `${path4}.while.steps`);
     }
   }
   collectIds(flow2.steps, "steps");
@@ -2241,6 +2018,9 @@ function validateSelectorReferences(flow2) {
       if (step.parallel?.steps) {
         for (const id of getAllStepIds(step.parallel.steps)) ids.add(id);
       }
+      if (step.while?.steps) {
+        for (const id of getAllStepIds(step.while.steps)) ids.add(id);
+      }
     }
     return ids;
   }
@@ -2266,7 +2046,7 @@ function validateSelectorReferences(flow2) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path6) {
+  function checkSelectors(selectors, path4) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -2274,12 +2054,12 @@ function validateSelectorReferences(flow2) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path6, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path4, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
         const stepId = parts[2];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path6, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path4, message: `Selector "${selector}" references undefined step "${stepId}"` });
         }
       }
     }
@@ -2311,6 +2091,27 @@ function validateSelectorReferences(flow2) {
       checkSelectors(extractSelectors(step.fileWrite.path), `${pathPrefix}.fileWrite.path`);
       checkSelectors(extractSelectors(step.fileWrite.content), `${pathPrefix}.fileWrite.content`);
     }
+    if (step.while) {
+      step.while.steps.forEach((s, i) => checkStep(s, `${pathPrefix}.while.steps[${i}]`));
+    }
+    if (step.flow) {
+      checkSelectors(extractSelectors(step.flow.key), `${pathPrefix}.flow.key`);
+      if (step.flow.inputs) {
+        checkSelectors(extractSelectors(step.flow.inputs), `${pathPrefix}.flow.inputs`);
+      }
+    }
+    if (step.paginate) {
+      checkSelectors(extractSelectors(step.paginate.action), `${pathPrefix}.paginate.action`);
+    }
+    if (step.bash) {
+      checkSelectors(extractSelectors(step.bash.command), `${pathPrefix}.bash.command`);
+      if (step.bash.cwd) {
+        checkSelectors(extractSelectors(step.bash.cwd), `${pathPrefix}.bash.cwd`);
+      }
+      if (step.bash.env) {
+        checkSelectors(extractSelectors(step.bash.env), `${pathPrefix}.bash.env`);
+      }
+    }
   }
   flow2.steps.forEach((step, i) => checkStep(step, `steps[${i}]`));
   return errors;
@@ -2325,656 +2126,8 @@ function validateFlow(flow2) {
   ];
 }
 
-// src/lib/flow-runner.ts
-import fs4 from "fs";
-import path5 from "path";
-import crypto from "crypto";
-
-// src/lib/flow-engine.ts
-import fs3 from "fs";
-import path4 from "path";
-function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function resolveSelector(selectorPath, context) {
-  if (!selectorPath.startsWith("$.")) return selectorPath;
-  const parts = selectorPath.slice(2).split(/\.|\[/).map((p7) => p7.replace(/\]$/, ""));
-  let current = context;
-  for (const part of parts) {
-    if (current === null || current === void 0) return void 0;
-    if (part === "*" && Array.isArray(current)) {
-      continue;
-    }
-    if (Array.isArray(current) && part === "*") {
-      continue;
-    }
-    if (Array.isArray(current)) {
-      const idx = Number(part);
-      if (!isNaN(idx)) {
-        current = current[idx];
-      } else {
-        current = current.map((item) => item?.[part]);
-      }
-    } else if (typeof current === "object") {
-      current = current[part];
-    } else {
-      return void 0;
-    }
-  }
-  return current;
-}
-function interpolateString(str, context) {
-  return str.replace(/\{\{(\$\.[^}]+)\}\}/g, (_match, selector) => {
-    const value = resolveSelector(selector, context);
-    if (value === void 0 || value === null) return "";
-    if (typeof value === "object") return JSON.stringify(value);
-    return String(value);
-  });
-}
-function resolveValue(value, context) {
-  if (typeof value === "string") {
-    if (value.startsWith("$.") && !value.includes("{{")) {
-      return resolveSelector(value, context);
-    }
-    if (value.includes("{{$.")) {
-      return interpolateString(value, context);
-    }
-    return value;
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => resolveValue(item, context));
-  }
-  if (value && typeof value === "object") {
-    const resolved = {};
-    for (const [k, v] of Object.entries(value)) {
-      resolved[k] = resolveValue(v, context);
-    }
-    return resolved;
-  }
-  return value;
-}
-function evaluateExpression(expr, context) {
-  const fn = new Function("$", `return (${expr})`);
-  return fn(context);
-}
-async function executeActionStep(step, context, api, permissions, allowedActionIds) {
-  const action = step.action;
-  const platform = resolveValue(action.platform, context);
-  const actionId = resolveValue(action.actionId, context);
-  const connectionKey = resolveValue(action.connectionKey, context);
-  const data = action.data ? resolveValue(action.data, context) : void 0;
-  const pathVars = action.pathVars ? resolveValue(action.pathVars, context) : void 0;
-  const queryParams = action.queryParams ? resolveValue(action.queryParams, context) : void 0;
-  const headers = action.headers ? resolveValue(action.headers, context) : void 0;
-  if (!isActionAllowed(actionId, allowedActionIds)) {
-    throw new Error(`Action "${actionId}" is not in the allowed action list`);
-  }
-  const actionDetails = await api.getActionDetails(actionId);
-  if (!isMethodAllowed(actionDetails.method, permissions)) {
-    throw new Error(`Method "${actionDetails.method}" is not allowed under "${permissions}" permission level`);
-  }
-  const result = await api.executePassthroughRequest({
-    platform,
-    actionId,
-    connectionKey,
-    data,
-    pathVariables: pathVars,
-    queryParams,
-    headers
-  }, actionDetails);
-  return {
-    status: "success",
-    response: result.responseData,
-    output: result.responseData
-  };
-}
-function executeTransformStep(step, context) {
-  const output = evaluateExpression(step.transform.expression, context);
-  return { status: "success", output, response: output };
-}
-async function executeCodeStep(step, context) {
-  const source = step.code.source;
-  const AsyncFunction = Object.getPrototypeOf(async function() {
-  }).constructor;
-  const fn = new AsyncFunction("$", source);
-  const output = await fn(context);
-  return { status: "success", output, response: output };
-}
-async function executeConditionStep(step, context, api, permissions, allowedActionIds, options) {
-  const condition = step.condition;
-  const result = evaluateExpression(condition.expression, context);
-  const branch = result ? condition.then : condition.else || [];
-  const branchResults = await executeSteps(branch, context, api, permissions, allowedActionIds, options);
-  return {
-    status: "success",
-    output: { conditionResult: !!result, stepsExecuted: branchResults },
-    response: { conditionResult: !!result }
-  };
-}
-async function executeLoopStep(step, context, api, permissions, allowedActionIds, options) {
-  const loop = step.loop;
-  const items = resolveValue(loop.over, context);
-  if (!Array.isArray(items)) {
-    throw new Error(`Loop "over" must resolve to an array, got ${typeof items}`);
-  }
-  const maxIterations = loop.maxIterations || 1e3;
-  const bounded = items.slice(0, maxIterations);
-  const savedLoop = { ...context.loop };
-  if (loop.maxConcurrency && loop.maxConcurrency > 1) {
-    const results2 = new Array(bounded.length);
-    for (let batchStart = 0; batchStart < bounded.length; batchStart += loop.maxConcurrency) {
-      const batch = bounded.slice(batchStart, batchStart + loop.maxConcurrency);
-      const batchResults = await Promise.all(
-        batch.map(async (item, batchIdx) => {
-          const i = batchStart + batchIdx;
-          const iterContext = {
-            ...context,
-            loop: {
-              [loop.as]: item,
-              item,
-              i,
-              ...loop.indexAs ? { [loop.indexAs]: i } : {}
-            },
-            steps: { ...context.steps }
-          };
-          await executeSteps(loop.steps, iterContext, api, permissions, allowedActionIds, options);
-          Object.assign(context.steps, iterContext.steps);
-          return iterContext.loop[loop.as];
-        })
-      );
-      for (let j = 0; j < batchResults.length; j++) {
-        results2[batchStart + j] = batchResults[j];
-      }
-    }
-    context.loop = savedLoop;
-    return { status: "success", output: results2, response: results2 };
-  }
-  const results = [];
-  for (let i = 0; i < bounded.length; i++) {
-    context.loop = {
-      [loop.as]: bounded[i],
-      item: bounded[i],
-      i
-    };
-    if (loop.indexAs) {
-      context.loop[loop.indexAs] = i;
-    }
-    await executeSteps(loop.steps, context, api, permissions, allowedActionIds, options);
-    results.push(context.loop[loop.as]);
-  }
-  context.loop = savedLoop;
-  return { status: "success", output: results, response: results };
-}
-async function executeParallelStep(step, context, api, permissions, allowedActionIds, options) {
-  const parallel = step.parallel;
-  const maxConcurrency = parallel.maxConcurrency || 5;
-  const steps = parallel.steps;
-  const results = [];
-  for (let i = 0; i < steps.length; i += maxConcurrency) {
-    const batch = steps.slice(i, i + maxConcurrency);
-    const batchResults = await Promise.all(
-      batch.map((s) => executeSingleStep(s, context, api, permissions, allowedActionIds, options))
-    );
-    results.push(...batchResults);
-  }
-  return { status: "success", output: results, response: results };
-}
-function executeFileReadStep(step, context) {
-  const config = step.fileRead;
-  const filePath = resolveValue(config.path, context);
-  const resolvedPath = path4.resolve(filePath);
-  const content = fs3.readFileSync(resolvedPath, "utf-8");
-  const output = config.parseJson ? JSON.parse(content) : content;
-  return { status: "success", output, response: output };
-}
-function executeFileWriteStep(step, context) {
-  const config = step.fileWrite;
-  const filePath = resolveValue(config.path, context);
-  const content = resolveValue(config.content, context);
-  const resolvedPath = path4.resolve(filePath);
-  const dir = path4.dirname(resolvedPath);
-  if (!fs3.existsSync(dir)) {
-    fs3.mkdirSync(dir, { recursive: true });
-  }
-  const stringContent = typeof content === "string" ? content : JSON.stringify(content, null, 2);
-  if (config.append) {
-    fs3.appendFileSync(resolvedPath, stringContent);
-  } else {
-    fs3.writeFileSync(resolvedPath, stringContent);
-  }
-  return { status: "success", output: { path: resolvedPath, bytesWritten: stringContent.length }, response: { path: resolvedPath } };
-}
-async function executeSingleStep(step, context, api, permissions, allowedActionIds, options) {
-  if (step.if) {
-    const condResult = evaluateExpression(step.if, context);
-    if (!condResult) {
-      const result = { status: "skipped" };
-      context.steps[step.id] = result;
-      return result;
-    }
-  }
-  if (step.unless) {
-    const condResult = evaluateExpression(step.unless, context);
-    if (condResult) {
-      const result = { status: "skipped" };
-      context.steps[step.id] = result;
-      return result;
-    }
-  }
-  const startTime = Date.now();
-  let lastError;
-  const maxAttempts = step.onError?.strategy === "retry" && step.onError.retries ? step.onError.retries + 1 : 1;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    try {
-      if (attempt > 1) {
-        options.onEvent?.({
-          event: "step:retry",
-          stepId: step.id,
-          attempt,
-          maxRetries: step.onError.retries
-        });
-        const delay = step.onError?.retryDelayMs || 1e3;
-        await sleep2(delay);
-      }
-      let result;
-      switch (step.type) {
-        case "action":
-          result = await executeActionStep(step, context, api, permissions, allowedActionIds);
-          break;
-        case "transform":
-          result = executeTransformStep(step, context);
-          break;
-        case "code":
-          result = await executeCodeStep(step, context);
-          break;
-        case "condition":
-          result = await executeConditionStep(step, context, api, permissions, allowedActionIds, options);
-          break;
-        case "loop":
-          result = await executeLoopStep(step, context, api, permissions, allowedActionIds, options);
-          break;
-        case "parallel":
-          result = await executeParallelStep(step, context, api, permissions, allowedActionIds, options);
-          break;
-        case "file-read":
-          result = executeFileReadStep(step, context);
-          break;
-        case "file-write":
-          result = executeFileWriteStep(step, context);
-          break;
-        default:
-          throw new Error(`Unknown step type: ${step.type}`);
-      }
-      result.durationMs = Date.now() - startTime;
-      if (attempt > 1) result.retries = attempt - 1;
-      context.steps[step.id] = result;
-      return result;
-    } catch (err) {
-      lastError = err instanceof Error ? err : new Error(String(err));
-      if (attempt === maxAttempts) {
-        break;
-      }
-    }
-  }
-  const errorMessage = lastError?.message || "Unknown error";
-  const strategy = step.onError?.strategy || "fail";
-  if (strategy === "continue") {
-    const result = {
-      status: "failed",
-      error: errorMessage,
-      durationMs: Date.now() - startTime
-    };
-    context.steps[step.id] = result;
-    return result;
-  }
-  if (strategy === "fallback" && step.onError?.fallbackStepId) {
-    const result = {
-      status: "failed",
-      error: errorMessage,
-      durationMs: Date.now() - startTime
-    };
-    context.steps[step.id] = result;
-    return result;
-  }
-  throw lastError;
-}
-async function executeSteps(steps, context, api, permissions, allowedActionIds, options, completedStepIds) {
-  const results = [];
-  for (const step of steps) {
-    if (completedStepIds?.has(step.id)) {
-      results.push(context.steps[step.id] || { status: "success" });
-      continue;
-    }
-    options.onEvent?.({
-      event: "step:start",
-      stepId: step.id,
-      stepName: step.name,
-      type: step.type,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    try {
-      const result = await executeSingleStep(step, context, api, permissions, allowedActionIds, options);
-      results.push(result);
-      options.onEvent?.({
-        event: "step:complete",
-        stepId: step.id,
-        status: result.status,
-        durationMs: result.durationMs,
-        retries: result.retries
-      });
-    } catch (error2) {
-      const errorMsg = error2 instanceof Error ? error2.message : String(error2);
-      options.onEvent?.({
-        event: "step:error",
-        stepId: step.id,
-        error: errorMsg,
-        strategy: step.onError?.strategy || "fail"
-      });
-      throw error2;
-    }
-  }
-  return results;
-}
-async function executeFlow(flow2, inputs, api, permissions, allowedActionIds, options = {}, resumeState) {
-  for (const [name, decl] of Object.entries(flow2.inputs)) {
-    if (decl.required !== false && inputs[name] === void 0 && decl.default === void 0) {
-      throw new Error(`Missing required input: "${name}" \u2014 ${decl.description || ""}`);
-    }
-  }
-  const resolvedInputs = {};
-  for (const [name, decl] of Object.entries(flow2.inputs)) {
-    if (inputs[name] !== void 0) {
-      resolvedInputs[name] = inputs[name];
-    } else if (decl.default !== void 0) {
-      resolvedInputs[name] = decl.default;
-    }
-  }
-  const context = resumeState?.context || {
-    input: resolvedInputs,
-    env: process.env,
-    steps: {},
-    loop: {}
-  };
-  const completedStepIds = resumeState ? new Set(resumeState.completedSteps) : void 0;
-  if (options.dryRun) {
-    options.onEvent?.({
-      event: "flow:dry-run",
-      flowKey: flow2.key,
-      resolvedInputs,
-      steps: flow2.steps.map((s) => ({ id: s.id, name: s.name, type: s.type })),
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    return context;
-  }
-  options.onEvent?.({
-    event: "flow:start",
-    flowKey: flow2.key,
-    totalSteps: flow2.steps.length,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  const flowStart = Date.now();
-  try {
-    await executeSteps(flow2.steps, context, api, permissions, allowedActionIds, options, completedStepIds);
-    const stepEntries = Object.values(context.steps);
-    const completed = stepEntries.filter((s) => s.status === "success").length;
-    const failed = stepEntries.filter((s) => s.status === "failed").length;
-    const skipped = stepEntries.filter((s) => s.status === "skipped").length;
-    options.onEvent?.({
-      event: "flow:complete",
-      flowKey: flow2.key,
-      status: "success",
-      durationMs: Date.now() - flowStart,
-      stepsCompleted: completed,
-      stepsFailed: failed,
-      stepsSkipped: skipped
-    });
-  } catch (error2) {
-    const errorMsg = error2 instanceof Error ? error2.message : String(error2);
-    options.onEvent?.({
-      event: "flow:error",
-      flowKey: flow2.key,
-      status: "failed",
-      error: errorMsg,
-      durationMs: Date.now() - flowStart
-    });
-    throw error2;
-  }
-  return context;
-}
-
-// src/lib/flow-runner.ts
-var FLOWS_DIR = ".one/flows";
-var RUNS_DIR = ".one/flows/.runs";
-var LOGS_DIR = ".one/flows/.logs";
-function ensureDir(dir) {
-  if (!fs4.existsSync(dir)) {
-    fs4.mkdirSync(dir, { recursive: true });
-  }
-}
-function generateRunId() {
-  return crypto.randomBytes(6).toString("hex");
-}
-var FlowRunner = class _FlowRunner {
-  runId;
-  flowKey;
-  state;
-  logPath;
-  statePath;
-  paused = false;
-  constructor(flow2, inputs, runId) {
-    this.runId = runId || generateRunId();
-    this.flowKey = flow2.key;
-    ensureDir(RUNS_DIR);
-    ensureDir(LOGS_DIR);
-    this.statePath = path5.join(RUNS_DIR, `${flow2.key}-${this.runId}.state.json`);
-    this.logPath = path5.join(LOGS_DIR, `${flow2.key}-${this.runId}.log`);
-    this.state = {
-      runId: this.runId,
-      flowKey: flow2.key,
-      status: "running",
-      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      inputs,
-      completedSteps: [],
-      context: {
-        input: inputs,
-        env: {},
-        steps: {},
-        loop: {}
-      }
-    };
-  }
-  getRunId() {
-    return this.runId;
-  }
-  getLogPath() {
-    return this.logPath;
-  }
-  getStatePath() {
-    return this.statePath;
-  }
-  requestPause() {
-    this.paused = true;
-  }
-  log(level, msg, data) {
-    const entry = {
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      level,
-      msg,
-      ...data
-    };
-    fs4.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
-  }
-  saveState() {
-    fs4.writeFileSync(this.statePath, JSON.stringify(this.state, null, 2));
-  }
-  createEventHandler(externalHandler) {
-    return (event) => {
-      this.log(
-        event.event.includes("error") ? "warn" : "info",
-        event.event,
-        event
-      );
-      if (event.event === "step:complete" && event.stepId) {
-        this.state.completedSteps.push(event.stepId);
-        this.state.currentStepId = void 0;
-      }
-      if (event.event === "step:start" && event.stepId) {
-        this.state.currentStepId = event.stepId;
-      }
-      externalHandler?.(event);
-      if (this.paused && event.event === "step:complete") {
-        this.state.status = "paused";
-        this.state.pausedAt = (/* @__PURE__ */ new Date()).toISOString();
-        this.saveState();
-      }
-    };
-  }
-  async execute(flow2, api, permissions, allowedActionIds, options = {}) {
-    this.log("info", "Flow started", { flowKey: this.flowKey, runId: this.runId });
-    this.state.status = "running";
-    this.saveState();
-    const eventHandler = this.createEventHandler(options.onEvent);
-    try {
-      const context = await executeFlow(
-        flow2,
-        this.state.inputs,
-        api,
-        permissions,
-        allowedActionIds,
-        { ...options, onEvent: eventHandler }
-      );
-      this.state.status = "completed";
-      this.state.completedAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.state.context = context;
-      this.saveState();
-      this.log("info", "Flow completed", { status: "success" });
-      return context;
-    } catch (error2) {
-      const errorMsg = error2 instanceof Error ? error2.message : String(error2);
-      this.state.status = "failed";
-      this.state.context.steps = this.state.context.steps || {};
-      this.saveState();
-      this.log("error", "Flow failed", { error: errorMsg });
-      throw error2;
-    }
-  }
-  async resume(flow2, api, permissions, allowedActionIds, options = {}) {
-    this.log("info", "Flow resumed", { flowKey: this.flowKey, runId: this.runId });
-    this.state.status = "running";
-    this.state.pausedAt = void 0;
-    this.saveState();
-    const eventHandler = this.createEventHandler(options.onEvent);
-    try {
-      const context = await executeFlow(
-        flow2,
-        this.state.inputs,
-        api,
-        permissions,
-        allowedActionIds,
-        { ...options, onEvent: eventHandler },
-        {
-          context: this.state.context,
-          completedSteps: this.state.completedSteps
-        }
-      );
-      this.state.status = "completed";
-      this.state.completedAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.state.context = context;
-      this.saveState();
-      this.log("info", "Flow completed after resume", { status: "success" });
-      return context;
-    } catch (error2) {
-      const errorMsg = error2 instanceof Error ? error2.message : String(error2);
-      this.state.status = "failed";
-      this.saveState();
-      this.log("error", "Flow failed after resume", { error: errorMsg });
-      throw error2;
-    }
-  }
-  static loadRunState(runId) {
-    ensureDir(RUNS_DIR);
-    const files = fs4.readdirSync(RUNS_DIR).filter((f) => f.includes(runId) && f.endsWith(".state.json"));
-    if (files.length === 0) return null;
-    try {
-      const content = fs4.readFileSync(path5.join(RUNS_DIR, files[0]), "utf-8");
-      return JSON.parse(content);
-    } catch {
-      return null;
-    }
-  }
-  static fromRunState(state) {
-    const runner = Object.create(_FlowRunner.prototype);
-    runner.runId = state.runId;
-    runner.flowKey = state.flowKey;
-    runner.state = state;
-    runner.paused = false;
-    runner.statePath = path5.join(RUNS_DIR, `${state.flowKey}-${state.runId}.state.json`);
-    runner.logPath = path5.join(LOGS_DIR, `${state.flowKey}-${state.runId}.log`);
-    return runner;
-  }
-  static listRuns(flowKey) {
-    ensureDir(RUNS_DIR);
-    const files = fs4.readdirSync(RUNS_DIR).filter((f) => f.endsWith(".state.json"));
-    const runs = [];
-    for (const file of files) {
-      try {
-        const content = fs4.readFileSync(path5.join(RUNS_DIR, file), "utf-8");
-        const state = JSON.parse(content);
-        if (!flowKey || state.flowKey === flowKey) {
-          runs.push(state);
-        }
-      } catch {
-      }
-    }
-    return runs.sort((a, b) => new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime());
-  }
-};
-function resolveFlowPath(keyOrPath) {
-  if (keyOrPath.includes("/") || keyOrPath.includes("\\") || keyOrPath.endsWith(".json")) {
-    return path5.resolve(keyOrPath);
-  }
-  return path5.resolve(FLOWS_DIR, `${keyOrPath}.flow.json`);
-}
-function loadFlow(keyOrPath) {
-  const flowPath = resolveFlowPath(keyOrPath);
-  if (!fs4.existsSync(flowPath)) {
-    throw new Error(`Flow not found: ${flowPath}`);
-  }
-  const content = fs4.readFileSync(flowPath, "utf-8");
-  return JSON.parse(content);
-}
-function listFlows() {
-  const flowsDir = path5.resolve(FLOWS_DIR);
-  if (!fs4.existsSync(flowsDir)) return [];
-  const files = fs4.readdirSync(flowsDir).filter((f) => f.endsWith(".flow.json"));
-  const flows = [];
-  for (const file of files) {
-    try {
-      const content = fs4.readFileSync(path5.join(flowsDir, file), "utf-8");
-      const flow2 = JSON.parse(content);
-      flows.push({
-        key: flow2.key,
-        name: flow2.name,
-        description: flow2.description,
-        inputCount: Object.keys(flow2.inputs).length,
-        stepCount: flow2.steps.length,
-        path: path5.join(flowsDir, file)
-      });
-    } catch {
-    }
-  }
-  return flows;
-}
-function saveFlow(flow2, outputPath) {
-  const flowPath = outputPath ? path5.resolve(outputPath) : path5.resolve(FLOWS_DIR, `${flow2.key}.flow.json`);
-  const dir = path5.dirname(flowPath);
-  ensureDir(dir);
-  fs4.writeFileSync(flowPath, JSON.stringify(flow2, null, 2) + "\n");
-  return flowPath;
-}
-
 // src/commands/flow.ts
-import fs5 from "fs";
+import fs3 from "fs";
 function getConfig2() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -3118,7 +2271,9 @@ ${pc7.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
   try {
     const context = await runner.execute(flow2, api, permissions, actionIds, {
       dryRun: options.dryRun,
+      mock: options.mock,
       verbose: options.verbose,
+      allowBash: options.allowBash,
       onEvent
     });
     process.off("SIGINT", sigintHandler);
@@ -3204,7 +2359,7 @@ async function flowValidateCommand(keyOrPath) {
   let flowData;
   try {
     const flowPath = resolveFlowPath(keyOrPath);
-    const content = fs5.readFileSync(flowPath, "utf-8");
+    const content = fs3.readFileSync(flowPath, "utf-8");
     flowData = JSON.parse(content);
   } catch (err) {
     spinner5.stop("Validation failed");
@@ -3802,6 +2957,128 @@ The \`source\` field contains a JS function body. The flow context is available
 }
 \`\`\`
 
+### \`while\` \u2014 Condition-driven loop (do-while)
+
+Iterates until a condition becomes falsy. The first iteration always runs (do-while semantics), then the condition is checked before each subsequent iteration. Useful for pagination.
+
+\`\`\`json
+{
+  "id": "paginate",
+  "name": "Paginate through all pages",
+  "type": "while",
+  "while": {
+    "condition": "$.steps.paginate.output.lastResult.nextPageToken != null",
+    "maxIterations": 50,
+    "steps": [
+      {
+        "id": "fetchPage",
+        "name": "Fetch next page",
+        "type": "action",
+        "action": {
+          "platform": "gmail",
+          "actionId": "GMAIL_LIST_MESSAGES_ACTION_ID",
+          "connectionKey": "$.input.gmailKey",
+          "queryParams": {
+            "pageToken": "$.steps.paginate.output.lastResult.nextPageToken"
+          }
+        }
+      }
+    ]
+  }
+}
+\`\`\`
+
+| Field | Type | Description |
+|---|---|---|
+| \`condition\` | string | JS expression evaluated before each iteration (after iteration 0) |
+| \`maxIterations\` | number | Safety cap, default: 100 |
+| \`steps\` | FlowStep[] | Steps to execute each iteration |
+
+The step output contains \`lastResult\` (last step's output from most recent iteration), \`iteration\` (count), and \`results\` (array of all iteration outputs). Reference via \`$.steps.<id>.output.lastResult\`.
+
+### \`flow\` \u2014 Execute a sub-flow
+
+Loads and executes another saved flow, enabling flow composition. Circular flows are detected and blocked.
+
+\`\`\`json
+{
+  "id": "processCustomer",
+  "name": "Run customer enrichment flow",
+  "type": "flow",
+  "flow": {
+    "key": "enrich-customer",
+    "inputs": {
+      "email": "$.steps.getCustomer.response.email",
+      "connectionKey": "$.input.hubspotConnectionKey"
+    }
+  }
+}
+\`\`\`
+
+| Field | Type | Description |
+|---|---|---|
+| \`key\` | string | Flow key or path (supports selectors) |
+| \`inputs\` | object | Input values mapped to the sub-flow's declared inputs (supports selectors) |
+
+### \`paginate\` \u2014 Auto-collect paginated API results
+
+Automatically pages through a paginated API, collecting all results into a single array.
+
+\`\`\`json
+{
+  "id": "allMessages",
+  "name": "Fetch all Gmail messages",
+  "type": "paginate",
+  "paginate": {
+    "action": {
+      "platform": "gmail",
+      "actionId": "GMAIL_LIST_MESSAGES_ACTION_ID",
+      "connectionKey": "$.input.gmailKey",
+      "queryParams": { "maxResults": 100 }
+    },
+    "pageTokenField": "nextPageToken",
+    "resultsField": "messages",
+    "inputTokenParam": "queryParams.pageToken",
+    "maxPages": 10
+  }
+}
+\`\`\`
+
+| Field | Type | Description |
+|---|---|---|
+| \`action\` | FlowActionConfig | The API action to call (same format as action steps) |
+| \`pageTokenField\` | string | Dot-path in the API response to the next page token |
+| \`resultsField\` | string | Dot-path in the API response to the results array |
+| \`inputTokenParam\` | string | Dot-path in the action config where the page token is injected |
+| \`maxPages\` | number | Maximum pages to fetch, default: 10 |
+
+### \`bash\` \u2014 Execute shell commands
+
+Runs a shell command. **Requires \`--allow-bash\` flag** for security.
+
+\`\`\`json
+{
+  "id": "analyzeData",
+  "name": "Analyze data with Claude",
+  "type": "bash",
+  "bash": {
+    "command": "claude --print 'Analyze: {{$.steps.fetchData.response}}' --output-format json",
+    "timeout": 120000,
+    "parseJson": true
+  }
+}
+\`\`\`
+
+| Field | Type | Description |
+|---|---|---|
+| \`command\` | string | Shell command to execute (supports selectors and interpolation) |
+| \`timeout\` | number | Timeout in ms, default: 30000 |
+| \`parseJson\` | boolean | Parse stdout as JSON, default: false |
+| \`cwd\` | string | Working directory (supports selectors) |
+| \`env\` | object | Additional environment variables |
+
+**Security:** Bash steps are blocked by default. Pass \`--allow-bash\` to \`one flow execute\` to enable them.
+
 ## 6. Error Handling
 
 ### \`onError\` strategies
@@ -4083,6 +3360,12 @@ one --agent flow execute <key> -i connectionKey=value -i param=value
 # Execute with dry run (validate only)
 one --agent flow execute <key> --dry-run -i connectionKey=value
 
+# Execute with mock mode (dry-run + mock API responses, runs transforms/code normally)
+one --agent flow execute <key> --dry-run --mock -i connectionKey=value
+
+# Execute with bash steps enabled
+one --agent flow execute <key> --allow-bash -i connectionKey=value
+
 # Execute with verbose output
 one --agent flow execute <key> -v -i connectionKey=value
 
@@ -4101,6 +3384,11 @@ one --agent flow resume <runId>
 - Connection keys are **inputs**, not hardcoded \u2014 makes workflows portable and shareable
 - Use \`$.input.*\` for input values, \`$.steps.*\` for step results
 - Action IDs in examples (like \`STRIPE_SEARCH_CUSTOMERS_ACTION_ID\`) are placeholders \u2014 always use \`one actions search\` to find the real IDs
+- **Parallel step outputs** are accessible both by index (\`$.steps.parallelStep.output[0]\`) and by substep ID (\`$.steps.substepId.response\`)
+- **Loop step outputs** include iteration details via \`$.steps.myLoop.response.iterations[0].innerStepId.response\`
+- **Code steps** support \`await require('crypto')\`, \`await require('buffer')\`, \`await require('url')\`, \`await require('path')\` \u2014 \`fs\`, \`http\`, \`child_process\`, etc. are blocked
+- **Bash steps** require \`--allow-bash\` flag for security
+- **State is persisted** after every step completion \u2014 resume picks up where it left off
 `;
 var TOPICS = [
   { topic: "overview", description: "Setup, --agent flag, discovery workflow" },
@@ -4406,9 +3694,14 @@ validation rules, and platform-specific details.
 // src/commands/update.ts
 import { createRequire } from "module";
 import { spawn as spawn2 } from "child_process";
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
 var require2 = createRequire(import.meta.url);
 var { version: currentVersion } = require2("../package.json");
-async function checkLatestVersion() {
+var CACHE_PATH = join(homedir(), ".one", "update-check.json");
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+async function fetchLatestVersion() {
   try {
     const res = await fetch("https://registry.npmjs.org/@withone/cli/latest");
     if (!res.ok) return null;
@@ -4418,6 +3711,32 @@ async function checkLatestVersion() {
     return null;
   }
 }
+function readCache() {
+  try {
+    return JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeCache(latestVersion) {
+  try {
+    mkdirSync(join(homedir(), ".one"), { recursive: true });
+    writeFileSync(CACHE_PATH, JSON.stringify({ lastCheck: Date.now(), latestVersion }));
+  } catch {
+  }
+}
+async function checkLatestVersion() {
+  const version2 = await fetchLatestVersion();
+  if (version2) writeCache(version2);
+  return version2;
+}
+async function checkLatestVersionCached() {
+  const cache = readCache();
+  if (cache && Date.now() - cache.lastCheck < CHECK_INTERVAL_MS) {
+    return cache.latestVersion;
+  }
+  return checkLatestVersion();
+}
 function getCurrentVersion() {
   return currentVersion;
 }
@@ -4508,7 +3827,7 @@ program.hook("preAction", (thisCommand) => {
   }
   const commandName = thisCommand.args?.[0];
   if (commandName !== "update") {
-    updateCheckPromise = checkLatestVersion();
+    updateCheckPromise = checkLatestVersionCached();
   }
 });
 program.hook("postAction", async () => {
@@ -4564,7 +3883,7 @@ var flow = program.command("flow").alias("f").description("Create, execute, and
 flow.command("create [key]").description("Create a new workflow from JSON definition").option("--definition <json>", "Workflow definition as JSON string").option("-o, --output <path>", "Custom output path (default .one/flows/<key>.flow.json)").action(async (key, options) => {
   await flowCreateCommand(key, options);
 });
-flow.command("execute <keyOrPath>").alias("x").description("Execute a workflow by key or file path").option("-i, --input <name=value>", "Input parameter (repeatable)", collect, []).option("--dry-run", "Validate and show execution plan without running").option("-v, --verbose", "Show full request/response for each step").action(async (keyOrPath, options) => {
+flow.command("execute <keyOrPath>").alias("x").description("Execute a workflow by key or file path").option("-i, --input <name=value>", "Input parameter (repeatable)", collect, []).option("--dry-run", "Validate and show execution plan without running").option("--mock", "With --dry-run: execute transforms/code with mock API responses").option("--allow-bash", "Allow bash step execution (disabled by default for security)").option("-v, --verbose", "Show full request/response for each step").action(async (keyOrPath, options) => {
   await flowExecuteCommand(keyOrPath, options);
 });
 flow.command("list").alias("ls").description("List all workflows in .one/flows/").action(async () => {