@withone/cli 1.47.2 → 1.47.4

package/dist/index.js

@@ -3323,7 +3323,7 @@ function validateStepIds(flow2) {
   collectIds(flow2.steps, "steps");
   return errors;
 }
-function validateSelectorReferences(flow2) {
+function validateSelectorReferences(flow2, rootDir) {
   const errors = [];
   const inputNames = new Set(Object.keys(flow2.inputs));
   const nestedKeys = getNestedStepsKeys();
@@ -3441,6 +3441,17 @@ function validateSelectorReferences(flow2) {
             const fieldName = step.type === "code" ? "source" : "expression";
             checkSelectors(extractSelectors(text5), `${pathPrefix}.${descriptor.configKey}.${fieldName}`, preceding2);
           }
+          const modulePath = step.type === "code" ? c.module : void 0;
+          if (rootDir && typeof modulePath === "string" && modulePath.length > 0) {
+            const abs = path4.resolve(rootDir, modulePath);
+            if (fs4.existsSync(abs)) {
+              try {
+                const moduleText = fs4.readFileSync(abs, "utf-8");
+                checkSelectors(extractSelectors(moduleText), `${pathPrefix}.${descriptor.configKey}.module`, preceding2);
+              } catch {
+              }
+            }
+          }
         }
       }
       for (const { configKey, fieldName } of nestedKeys) {
@@ -3608,7 +3619,7 @@ function validateFlow(flow2, rootDir) {
   const f = flow2;
   return [
     ...validateStepIds(f),
-    ...validateSelectorReferences(f),
+    ...validateSelectorReferences(f, rootDir),
     ...validateOutputSchemas(f),
     ...rootDir ? validateCodeModules(f, rootDir) : []
   ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.47.2",
+  "version": "1.47.4",
   "description": "CLI for managing One",
   "type": "module",
   "files": [
@@ -30,7 +30,7 @@
     "@clack/prompts": "^0.9.1",
     "commander": "^13.1.0",
     "open": "^10.1.0",
-    "pgserve": "^2.2.3",
+    "pgserve": "2.2.3",
     "picocolors": "^1.1.1",
     "smol-toml": "^1.6.0"
   },

package/skills/one/references/flows.md

@@ -145,7 +145,7 @@ Two rules: (1) prepend the stdin-read line, (2) replace `return X` with `process
 one --agent flow validate <key>
 ```
 
-`flow validate` parses every inline `code.source` and runs `node --check` on every `code.module` file, so syntax errors (brace/paren mismatches, duplicate `let`, etc.) surface here instead of after upstream steps have already run. It also extracts `$.steps.X` and `$.input.X` references from inside `code.source` and `transform.expression` and reports any reference to an undefined step/input or to a step declared **after** the current one (forward references resolve to `undefined` at runtime — silent data loss). The same checks run automatically at the start of `flow execute` so a broken step in position 15 fails the run immediately rather than 15 minutes in.
+`flow validate` parses every inline `code.source` and runs `node --check` on every `code.module` file, so syntax errors (brace/paren mismatches, duplicate `let`, etc.) surface here instead of after upstream steps have already run. It also extracts `$.steps.X` and `$.input.X` references from inside `code.source`, `transform.expression`, **and external `code.module` `.mjs` files**, and reports any reference to an undefined step/input or to a step declared **after** the current one (forward references resolve to `undefined` at runtime — silent data loss). The same checks run automatically at the start of `flow execute` so a broken step in position 15 fails the run immediately rather than 15 minutes in.
 
 ### Step 6: Execute