@withone/cli 1.20.1 → 1.20.3

package/dist/index.js

@@ -2455,6 +2455,16 @@ ${JSON.stringify(st.example, null, 2)}
 - **Interpolation** (\`{{$.input.x}}\`): Use inside string values where the selector is embedded in text \u2014 e.g., \`"Hello {{$.steps.getUser.response.name}}"\`. The resolved value is always stringified. Use this in \`data\`, \`pathVars\`, and \`queryParams\` when mixing selectors with literal text.
 - **Rule of thumb**: If the value is purely a selector, use bare. If it's a string containing a selector, use \`{{...}}\`.
 
+### Selectors vs expressions
+
+Selectors in data fields (\`data\`, \`queryParams\`, \`pathVars\`, \`connectionKey\`) are **dot-path lookups only** \u2014 they do not support JavaScript operators like \`||\` or \`&&\`. For default values, use the \`default\` field on the input definition:
+
+\`\`\`json
+{ "inputs": { "maxResults": { "type": "number", "default": 10 } } }
+\`\`\`
+
+The \`if\`, \`unless\`, \`condition.expression\`, \`while.condition\`, \`transform.expression\`, and \`code.source\` fields **do** support full JavaScript expressions (e.g., \`$.input.email && $.input.email.length > 0\`).
+
 ### \`output\` vs \`response\` on step results
 
 Every completed step produces both \`output\` and \`response\`:
@@ -2745,11 +2755,12 @@ function validateSelectorReferences(flow2) {
     return ids;
   }
   const allStepIds = getAllStepIds(flow2.steps);
+  const SELECTOR_TOKEN_RE = /\$\.[a-zA-Z_][\w.\[\]*]*/g;
   function extractSelectors(value) {
     const selectors = [];
     if (typeof value === "string") {
-      if (value.startsWith("$.")) {
-        selectors.push(value);
+      for (const match of value.matchAll(SELECTOR_TOKEN_RE)) {
+        selectors.push(match[0]);
       }
       const interpolated = value.matchAll(/\{\{(\$\.[^}]+)\}\}/g);
       for (const match of interpolated) {
@@ -2784,6 +2795,24 @@ function validateSelectorReferences(flow2) {
       }
     }
   }
+  const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
+  function checkOperatorsInSelectorField(value, path5) {
+    if (typeof value === "string" && value.startsWith("$.")) {
+      if (value.includes("||")) {
+        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+      } else if (value.includes("&&")) {
+        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+      }
+    } else if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const [k, v] of Object.entries(value)) {
+        checkOperatorsInSelectorField(v, `${path5}.${k}`);
+      }
+    } else if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        checkOperatorsInSelectorField(value[i], `${path5}[${i}]`);
+      }
+    }
+  }
   function checkStep(step, pathPrefix) {
     if (step.if) checkSelectors(extractSelectors(step.if), `${pathPrefix}.if`);
     if (step.unless) checkSelectors(extractSelectors(step.unless), `${pathPrefix}.unless`);
@@ -2796,7 +2825,12 @@ function validateSelectorReferences(flow2) {
             if (fd.stepsArray) continue;
             const value = config[fieldName];
             if (value !== void 0) {
-              checkSelectors(extractSelectors(value), `${pathPrefix}.${descriptor.configKey}.${fieldName}`);
+              const fieldKey = `${descriptor.configKey}.${fieldName}`;
+              const fieldPath = `${pathPrefix}.${fieldKey}`;
+              checkSelectors(extractSelectors(value), fieldPath);
+              if (!EXPRESSION_FIELDS.has(fieldKey)) {
+                checkOperatorsInSelectorField(value, fieldPath);
+              }
             }
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.20.1",
+  "version": "1.20.3",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/references/flows.md

@@ -102,6 +102,20 @@ Connection inputs with a `connection` field auto-resolve if the user has exactly
 
 A pure `$.xxx` value resolves to the raw type. A string containing `{{$.xxx}}` does string interpolation.
 
+### Selectors vs expressions
+
+Selectors in data fields (`data`, `queryParams`, `pathVars`, `connectionKey`) are **dot-path lookups only** — they do not support JavaScript operators like `||` or `&&`. For default values, use the `default` field on the input definition:
+
+```json
+{
+  "inputs": {
+    "maxResults": { "type": "number", "default": 10 }
+  }
+}
+```
+
+The `if`, `unless`, `condition.expression`, `while.condition`, `transform.expression`, and `code.source` fields **do** support full JavaScript expressions (e.g., `$.input.email && $.input.email.length > 0`).
+
 ## Step Types
 
 ### `action` — Execute a One API action
@@ -172,14 +186,47 @@ A pure `$.xxx` value resolves to the raw type. A string containing `{{$.xxx}}` d
 
 ### `parallel` — Run steps concurrently
 
+Use when fetching from 2+ independent data sources before combining results. Each substep must have the full step schema (`id`, `name`, `type`, and type-specific config).
+
 ```json
 {
-  "id": "lookups",
+  "id": "fetchAll",
+  "name": "Fetch email and calendar data in parallel",
   "type": "parallel",
-  "parallel": { "maxConcurrency": 5, "steps": [...] }
+  "parallel": {
+    "maxConcurrency": 5,
+    "steps": [
+      {
+        "id": "fetchEmails",
+        "name": "Fetch recent emails",
+        "type": "action",
+        "action": {
+          "platform": "gmail",
+          "actionId": "conn_mod_def::GmailListMessages::xxx",
+          "connectionKey": "$.input.gmailKey",
+          "pathVars": { "userId": "me" },
+          "queryParams": { "maxResults": 10 }
+        }
+      },
+      {
+        "id": "fetchEvents",
+        "name": "Fetch today's calendar events",
+        "type": "action",
+        "action": {
+          "platform": "google-calendar",
+          "actionId": "conn_mod_def::CalendarListEvents::xxx",
+          "connectionKey": "$.input.calendarKey",
+          "pathVars": { "calendarId": "primary" },
+          "queryParams": { "maxResults": 10 }
+        }
+      }
+    ]
+  }
 }
 ```
 
+After a parallel step, access each substep's output by its `id`: `$.steps.fetchEmails.response`, `$.steps.fetchEvents.response`.
+
 ### `file-read` / `file-write` — Filesystem access
 
 ```json
@@ -247,7 +294,18 @@ Strategies: `fail` (default), `continue`, `retry`, `fallback`.
 
 Conditional execution: `"if": "$.steps.find.response.data.length > 0"`
 
-## AI-Augmented Pattern: file-write -> bash -> code
+## AI-Augmented Patterns
+
+### When to use parallel steps
+
+Use `parallel` when your workflow fetches from 2+ independent data sources before combining them. Common patterns:
+- Fetch Gmail + Calendar + Sheets → compile into daily briefing
+- Search Exa + scrape with Firecrawl → merge research data
+- Query BigQuery + list Google Drive files → combine for analysis
+
+Each substep inside `parallel.steps` must have the full step schema: `id`, `name`, `type`, and the type-specific config (`action`, `code`, etc.). Follow a parallel step with a `code` or `transform` step to combine the results.
+
+### file-write -> bash -> code
 
 When raw data needs analysis, use this pattern:
 1. `file-write` — save data to temp file (API responses are too large to inline)