@withone/cli 1.20.2 → 1.20.3

package/dist/index.js

@@ -2455,6 +2455,16 @@ ${JSON.stringify(st.example, null, 2)}
 - **Interpolation** (\`{{$.input.x}}\`): Use inside string values where the selector is embedded in text \u2014 e.g., \`"Hello {{$.steps.getUser.response.name}}"\`. The resolved value is always stringified. Use this in \`data\`, \`pathVars\`, and \`queryParams\` when mixing selectors with literal text.
 - **Rule of thumb**: If the value is purely a selector, use bare. If it's a string containing a selector, use \`{{...}}\`.
 
+### Selectors vs expressions
+
+Selectors in data fields (\`data\`, \`queryParams\`, \`pathVars\`, \`connectionKey\`) are **dot-path lookups only** \u2014 they do not support JavaScript operators like \`||\` or \`&&\`. For default values, use the \`default\` field on the input definition:
+
+\`\`\`json
+{ "inputs": { "maxResults": { "type": "number", "default": 10 } } }
+\`\`\`
+
+The \`if\`, \`unless\`, \`condition.expression\`, \`while.condition\`, \`transform.expression\`, and \`code.source\` fields **do** support full JavaScript expressions (e.g., \`$.input.email && $.input.email.length > 0\`).
+
 ### \`output\` vs \`response\` on step results
 
 Every completed step produces both \`output\` and \`response\`:
@@ -2745,11 +2755,12 @@ function validateSelectorReferences(flow2) {
     return ids;
   }
   const allStepIds = getAllStepIds(flow2.steps);
+  const SELECTOR_TOKEN_RE = /\$\.[a-zA-Z_][\w.\[\]*]*/g;
   function extractSelectors(value) {
     const selectors = [];
     if (typeof value === "string") {
-      if (value.startsWith("$.")) {
-        selectors.push(value);
+      for (const match of value.matchAll(SELECTOR_TOKEN_RE)) {
+        selectors.push(match[0]);
       }
       const interpolated = value.matchAll(/\{\{(\$\.[^}]+)\}\}/g);
       for (const match of interpolated) {
@@ -2784,6 +2795,24 @@ function validateSelectorReferences(flow2) {
       }
     }
   }
+  const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
+  function checkOperatorsInSelectorField(value, path5) {
+    if (typeof value === "string" && value.startsWith("$.")) {
+      if (value.includes("||")) {
+        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+      } else if (value.includes("&&")) {
+        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+      }
+    } else if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const [k, v] of Object.entries(value)) {
+        checkOperatorsInSelectorField(v, `${path5}.${k}`);
+      }
+    } else if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        checkOperatorsInSelectorField(value[i], `${path5}[${i}]`);
+      }
+    }
+  }
   function checkStep(step, pathPrefix) {
     if (step.if) checkSelectors(extractSelectors(step.if), `${pathPrefix}.if`);
     if (step.unless) checkSelectors(extractSelectors(step.unless), `${pathPrefix}.unless`);
@@ -2796,7 +2825,12 @@ function validateSelectorReferences(flow2) {
             if (fd.stepsArray) continue;
             const value = config[fieldName];
             if (value !== void 0) {
-              checkSelectors(extractSelectors(value), `${pathPrefix}.${descriptor.configKey}.${fieldName}`);
+              const fieldKey = `${descriptor.configKey}.${fieldName}`;
+              const fieldPath = `${pathPrefix}.${fieldKey}`;
+              checkSelectors(extractSelectors(value), fieldPath);
+              if (!EXPRESSION_FIELDS.has(fieldKey)) {
+                checkOperatorsInSelectorField(value, fieldPath);
+              }
             }
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.20.2",
+  "version": "1.20.3",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/references/flows.md

@@ -102,6 +102,20 @@ Connection inputs with a `connection` field auto-resolve if the user has exactly
 
 A pure `$.xxx` value resolves to the raw type. A string containing `{{$.xxx}}` does string interpolation.
 
+### Selectors vs expressions
+
+Selectors in data fields (`data`, `queryParams`, `pathVars`, `connectionKey`) are **dot-path lookups only** — they do not support JavaScript operators like `||` or `&&`. For default values, use the `default` field on the input definition:
+
+```json
+{
+  "inputs": {
+    "maxResults": { "type": "number", "default": 10 }
+  }
+}
+```
+
+The `if`, `unless`, `condition.expression`, `while.condition`, `transform.expression`, and `code.source` fields **do** support full JavaScript expressions (e.g., `$.input.email && $.input.email.length > 0`).
+
 ## Step Types
 
 ### `action` — Execute a One API action