@nocobase/flow-engine 2.0.0-alpha.2

package/lib/utils/params-resolvers.js

@@ -0,0 +1,309 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var params_resolvers_exports = {};
+__export(params_resolvers_exports, {
+  enqueueVariablesResolve: () => enqueueVariablesResolve,
+  preprocessExpression: () => preprocessExpression,
+  resolveCreateModelOptions: () => resolveCreateModelOptions,
+  resolveDefaultParams: () => resolveDefaultParams,
+  resolveExpressions: () => resolveExpressions
+});
+module.exports = __toCommonJS(params_resolvers_exports);
+var import_lodash = __toESM(require("lodash"));
+var import_client = require("@nocobase/utils/client");
+async function resolveDefaultParams(defaultParams, ctx) {
+  if (!defaultParams) {
+    return {};
+  }
+  if (typeof defaultParams === "function") {
+    try {
+      const result = await defaultParams(ctx);
+      return result || {};
+    } catch (error) {
+      console.error("Error resolving defaultParams function:", error);
+      return {};
+    }
+  }
+  return defaultParams;
+}
+__name(resolveDefaultParams, "resolveDefaultParams");
+async function resolveCreateModelOptions(createModelOptions, ctx, extra) {
+  if (!createModelOptions) {
+    return {};
+  }
+  if (typeof createModelOptions === "function") {
+    try {
+      const result = await createModelOptions(ctx, extra);
+      return result || {};
+    } catch (error) {
+      console.error("Error resolving createModelOptions function:", error);
+      return {};
+    }
+  }
+  return createModelOptions;
+}
+__name(resolveCreateModelOptions, "resolveCreateModelOptions");
+const VAR_AGGREGATOR = { queue: [], timer: null, inflightByRun: /* @__PURE__ */ new Map() };
+const BATCH_FLUSH_DELAY_MS = 10;
+function sortKeysDeep(input) {
+  if (Array.isArray(input)) return input.map(sortKeysDeep);
+  if (import_lodash.default.isPlainObject(input)) {
+    const entries = Object.entries(input).map(([k, v]) => [k, sortKeysDeep(v)]);
+    const sortedEntries = import_lodash.default.sortBy(entries, ([k]) => k);
+    return Object.fromEntries(sortedEntries);
+  }
+  return input;
+}
+__name(sortKeysDeep, "sortKeysDeep");
+function stableStringifyOrdered(obj) {
+  try {
+    return JSON.stringify(sortKeysDeep(obj));
+  } catch {
+    try {
+      return JSON.stringify(obj);
+    } catch {
+      return String(obj);
+    }
+  }
+}
+__name(stableStringifyOrdered, "stableStringifyOrdered");
+function enqueueVariablesResolve(ctx, payload) {
+  const agg = VAR_AGGREGATOR;
+  const runId = ctx.runId || "GLOBAL";
+  const dedupKey = stableStringifyOrdered(payload);
+  let runMap = agg.inflightByRun.get(runId);
+  if (!runMap) {
+    runMap = /* @__PURE__ */ new Map();
+    agg.inflightByRun.set(runId, runMap);
+  }
+  const existing = runMap.get(dedupKey);
+  if (existing) return existing;
+  let resolveFn;
+  let rejectFn;
+  const p = new Promise((resolve, reject) => {
+    resolveFn = resolve;
+    rejectFn = reject;
+  });
+  runMap.set(dedupKey, p);
+  const id = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const item = { id, ctx, payload, resolve: resolveFn, reject: rejectFn, runId, dedupKey };
+  agg.queue.push(item);
+  const flush = /* @__PURE__ */ __name(async () => {
+    var _a, _b, _c, _d, _e, _f;
+    const items = agg.queue.splice(0, agg.queue.length);
+    agg.timer = null;
+    if (!items.length) return;
+    const api = (_a = items[0].ctx) == null ? void 0 : _a.api;
+    if (!api) {
+      for (const it of items) {
+        try {
+          it.resolve(it.payload.template);
+        } catch (e) {
+          it.reject(e);
+        } finally {
+          (_b = agg.inflightByRun.get(it.runId)) == null ? void 0 : _b.delete(it.dedupKey);
+        }
+      }
+      return;
+    }
+    try {
+      const batch = items.map((it) => ({
+        id: it.id,
+        template: it.payload.template,
+        contextParams: it.payload.contextParams || {}
+      }));
+      const res = await api.request({ method: "POST", url: "variables:resolve", data: { values: { batch } } });
+      const top = res.data ?? res;
+      const root = top.data ?? top;
+      const arr1 = root == null ? void 0 : root.results;
+      const resultsArr = Array.isArray(arr1) ? arr1 : Array.isArray(root) ? root : [];
+      const map = /* @__PURE__ */ new Map();
+      for (const r of resultsArr) {
+        const k = (r == null ? void 0 : r.id) != null ? String(r.id) : "";
+        if (k) map.set(k, r == null ? void 0 : r.data);
+      }
+      for (const it of items) {
+        try {
+          const k = String(it.id);
+          const resolved = map.has(k) ? map.get(k) : it.payload.template;
+          it.resolve(resolved);
+        } catch (e) {
+          it.reject(e);
+        } finally {
+          (_c = agg.inflightByRun.get(it.runId)) == null ? void 0 : _c.delete(it.dedupKey);
+        }
+      }
+    } catch (e) {
+      for (const it of items) {
+        try {
+          (_e = (_d = ctx == null ? void 0 : ctx.logger) == null ? void 0 : _d.warn) == null ? void 0 : _e.call(_d, { err: e }, "variables:resolve(batch) failed, fallback");
+          it.resolve(it.payload.template);
+        } catch (err) {
+          it.reject(err);
+        } finally {
+          (_f = agg.inflightByRun.get(it.runId)) == null ? void 0 : _f.delete(it.dedupKey);
+        }
+      }
+    }
+  }, "flush");
+  if (!agg.timer) {
+    agg.timer = setTimeout(flush, BATCH_FLUSH_DELAY_MS);
+  }
+  return p;
+}
+__name(enqueueVariablesResolve, "enqueueVariablesResolve");
+async function resolveExpressions(params, ctx) {
+  const compile = /* @__PURE__ */ __name(async (source) => {
+    if (typeof source === "string" && /\{\{.*?\}\}/.test(source)) {
+      return await compileExpression(source, ctx);
+    }
+    if (Array.isArray(source)) {
+      return Promise.all(source.map(compile));
+    }
+    if (source && typeof source === "object") {
+      const result = {};
+      for (const [key, value] of Object.entries(source)) {
+        result[key] = await compile(value);
+      }
+      return result;
+    }
+    return source;
+  }, "compile");
+  return compile(params);
+}
+__name(resolveExpressions, "resolveExpressions");
+async function processExpression(expression, ctx) {
+  const processedExpr = await preprocessExpression(expression.trim(), ctx);
+  const result = await ctx.runjs(`return ${processedExpr}`, { t: ctx.t });
+  return (result == null ? void 0 : result.success) ? result.value : void 0;
+}
+__name(processExpression, "processExpression");
+async function preprocessExpression(expression, ctx) {
+  const pathRegex = /ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*(?:(?:\.[a-zA-Z_$][a-zA-Z0-9_$]*)|(?:\[[^\]]+\]))*)(?!\s*\()/g;
+  const pathMatches = [];
+  const firstLevelKeys = /* @__PURE__ */ new Set();
+  let match;
+  while ((match = pathRegex.exec(expression)) !== null) {
+    const fullPath = match[0];
+    const pathAfterCtx = match[1];
+    const firstKeyMatch = pathAfterCtx.match(/^([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+    if (firstKeyMatch) {
+      const firstKey = firstKeyMatch[1];
+      const restPath = pathAfterCtx.substring(firstKey.length);
+      pathMatches.push({
+        fullPath,
+        firstKey,
+        restPath
+        // 单层路径时为空字符串，多层路径可能包含数组索引
+      });
+      firstLevelKeys.add(firstKey);
+    }
+  }
+  if (pathMatches.length === 0) {
+    return expression;
+  }
+  const recordProxyMap = /* @__PURE__ */ new Map();
+  for (const firstKey of firstLevelKeys) {
+    try {
+      const rawValue = await ctx[firstKey];
+      const isRecordProxy = rawValue && rawValue.__isRecordProxy__ === true;
+      recordProxyMap.set(firstKey, isRecordProxy);
+    } catch (error) {
+      recordProxyMap.set(firstKey, false);
+    }
+  }
+  pathMatches.sort((a, b) => b.fullPath.length - a.fullPath.length);
+  let processedExpr = expression;
+  for (const { fullPath, firstKey, restPath } of pathMatches) {
+    const isRecordProxy = recordProxyMap.get(firstKey) || false;
+    let processedPath;
+    if (restPath === "") {
+      processedPath = `await ctx.${firstKey}`;
+    } else {
+      processedPath = isRecordProxy ? `await (await ctx.${firstKey})${restPath}` : `(await ctx.${firstKey})${restPath}`;
+    }
+    const escapedFullPath = fullPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const regex = new RegExp(`\\b${escapedFullPath}\\b`, "g");
+    processedExpr = processedExpr.replace(regex, processedPath);
+  }
+  return processedExpr;
+}
+__name(preprocessExpression, "preprocessExpression");
+async function compileExpression(expression, ctx) {
+  const matchDotOnly = /* @__PURE__ */ __name((expr) => {
+    const m = expr.trim().match(/^ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*(?:\.[a-zA-Z_$][a-zA-Z0-9_$]*)*)$/);
+    return m ? m[1] : null;
+  }, "matchDotOnly");
+  const resolveDotOnlyPath = /* @__PURE__ */ __name(async (dotPath) => {
+    const segs = dotPath.split(".");
+    const first = segs.shift();
+    if (!first) return void 0;
+    const base = await ctx[first];
+    if (segs.length === 0) return base;
+    return (0, import_client.getValuesByPath)(base, segs.join("."));
+  }, "resolveDotOnlyPath");
+  const singleMatch = expression.match(/^\{\{\s*(.+)\s*\}\}$/);
+  if (singleMatch) {
+    const inner = singleMatch[1];
+    const dotPath = matchDotOnly(inner);
+    if (dotPath) {
+      return await resolveDotOnlyPath(dotPath);
+    }
+    return await processExpression(inner, ctx);
+  }
+  const matches = [...expression.matchAll(/\{\{\s*(.+?)\s*\}\}/g)];
+  let result = expression;
+  for (const [fullMatch, innerExpr] of matches) {
+    const dotPath = matchDotOnly(innerExpr);
+    const value = dotPath ? await resolveDotOnlyPath(dotPath) : await processExpression(innerExpr, ctx);
+    if (value !== void 0) {
+      const replacement = typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
+      result = result.replace(fullMatch, replacement);
+    }
+  }
+  return result;
+}
+__name(compileExpression, "compileExpression");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  enqueueVariablesResolve,
+  preprocessExpression,
+  resolveCreateModelOptions,
+  resolveDefaultParams,
+  resolveExpressions
+});

package/lib/utils/parsePathnameToViewParams.d.ts

@@ -0,0 +1,34 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export interface ViewParam {
+    /** 视图唯一标识符，一般为某个 Model 实例的 uid */
+    viewUid: string;
+    /** 标签页唯一标识符 */
+    tabUid?: string;
+    /** 弹窗记录的 id */
+    filterByTk?: string;
+    /** source Id */
+    sourceId?: string;
+}
+/**
+ * 解析路径名为视图参数数组
+ *
+ * 支持解析包含多个视图的路径，每个视图可以包含 tab、filterByTk、sourceId 等参数
+ *
+ * @param pathname - 要解析的路径名，格式如 '/admin/xxx/view/xxx/tab/xxx'
+ * @returns 视图参数数组，每个元素对应一个视图
+ *
+ * @example
+ * ```typescript
+ * parsePathnameToViewParams('/admin/xxx') // [{ viewUid: 'xxx' }]
+ * parsePathnameToViewParams('/admin/xxx/tab/yyy') // [{ viewUid: 'xxx', tabUid: 'yyy' }]
+ * parsePathnameToViewParams('/admin/xxx/view/yyy') // [{ viewUid: 'xxx' }, { viewUid: 'yyy' }]
+ * ```
+ */
+export declare const parsePathnameToViewParams: (pathname: string) => ViewParam[];

package/lib/utils/parsePathnameToViewParams.js

@@ -0,0 +1,84 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parsePathnameToViewParams_exports = {};
+__export(parsePathnameToViewParams_exports, {
+  parsePathnameToViewParams: () => parsePathnameToViewParams
+});
+module.exports = __toCommonJS(parsePathnameToViewParams_exports);
+const parsePathnameToViewParams = /* @__PURE__ */ __name((pathname) => {
+  if (!pathname || pathname === "/") {
+    return [];
+  }
+  const segments = pathname.replace(/^\/+/, "").split("/").filter(Boolean);
+  if (segments.length < 2) {
+    return [];
+  }
+  const result = [];
+  let currentView = null;
+  let i = 0;
+  while (i < segments.length) {
+    const segment = segments[i];
+    if (segment === "admin" || segment === "view") {
+      if (currentView) {
+        result.push(currentView);
+      }
+      if (i + 1 < segments.length) {
+        currentView = { viewUid: segments[i + 1] };
+        i += 2;
+      } else {
+        break;
+      }
+    } else if (currentView && i + 1 < segments.length) {
+      const value = segments[i + 1];
+      switch (segment) {
+        case "tab":
+          currentView.tabUid = value;
+          break;
+        case "filterbytk":
+          currentView.filterByTk = value;
+          break;
+        case "sourceid":
+          currentView.sourceId = value;
+          break;
+        default:
+          break;
+      }
+      i += 2;
+    } else {
+      i++;
+    }
+  }
+  if (currentView) {
+    result.push(currentView);
+  }
+  return result;
+}, "parsePathnameToViewParams");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePathnameToViewParams
+});

package/lib/utils/safeGlobals.d.ts

@@ -0,0 +1,16 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+/**
+ * 统一的安全全局对象代理：window/document
+ * - 默认仅允许常用的定时器、console、Math、Date、addEventListener（绑定原 window）
+ * - document 仅允许 createElement/querySelector/querySelectorAll
+ * - 不允许随意访问未声明的属性，最小权限原则
+ */
+export declare function createSafeWindow(extra?: Record<string, any>): {};
+export declare function createSafeDocument(extra?: Record<string, any>): {};

package/lib/utils/safeGlobals.js

@@ -0,0 +1,179 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var safeGlobals_exports = {};
+__export(safeGlobals_exports, {
+  createSafeDocument: () => createSafeDocument,
+  createSafeWindow: () => createSafeWindow
+});
+module.exports = __toCommonJS(safeGlobals_exports);
+function createSafeWindow(extra) {
+  const getSafeBaseHref = /* @__PURE__ */ __name(() => `${window.location.origin}${window.location.pathname}`, "getSafeBaseHref");
+  const safeOpen = /* @__PURE__ */ __name((url, target, features) => {
+    const isSafeUrl = /* @__PURE__ */ __name((u) => {
+      try {
+        const parsed = new URL(u, getSafeBaseHref());
+        const protocol = parsed.protocol.toLowerCase();
+        if (protocol === "about:") return parsed.href === "about:blank";
+        return protocol === "http:" || protocol === "https:";
+      } catch {
+        return false;
+      }
+    }, "isSafeUrl");
+    if (!isSafeUrl(url)) {
+      throw new Error("Unsafe URL: window.open only allows http/https/about:blank.");
+    }
+    const sanitizedTarget = "_blank";
+    const enforceFeatures = /* @__PURE__ */ __name((f) => {
+      const set = /* @__PURE__ */ new Set();
+      if (f) {
+        f.split(",").map((s) => s.trim()).filter(Boolean).forEach((part) => {
+          const key = part.split("=")[0].trim().toLowerCase();
+          if (key !== "noopener" && key !== "noreferrer") set.add(part);
+        });
+      }
+      set.add("noopener");
+      set.add("noreferrer");
+      return Array.from(set).join(",");
+    }, "enforceFeatures");
+    const sanitizedFeatures = enforceFeatures(features);
+    const newWin = window.open.call(window, url, sanitizedTarget, sanitizedFeatures);
+    if (newWin && "opener" in newWin) {
+      try {
+        newWin.opener = null;
+      } catch {
+      }
+    }
+    return newWin;
+  }, "safeOpen");
+  const guardedNavigate = /* @__PURE__ */ __name((rawUrl, opts) => {
+    const parsed = new URL(rawUrl, getSafeBaseHref());
+    const protocol = parsed.protocol.toLowerCase();
+    const isAboutBlank = protocol === "about:" && parsed.href === "about:blank";
+    const isHttp = protocol === "http:" || protocol === "https:";
+    if (!isHttp && !isAboutBlank) {
+      throw new Error("Unsafe URL: only http/https/about:blank are allowed.");
+    }
+    if (isAboutBlank) {
+      return (opts == null ? void 0 : opts.replace) ? window.location.replace("about:blank") : window.location.assign("about:blank");
+    }
+    const sameOrigin = parsed.protocol === window.location.protocol && parsed.hostname === window.location.hostname && parsed.port === window.location.port;
+    if (sameOrigin) {
+      return (opts == null ? void 0 : opts.replace) ? window.location.replace(parsed.href) : window.location.assign(parsed.href);
+    }
+    const win = safeOpen(parsed.href);
+    if (!win) throw new Error("Popup blocked: cross-origin navigation is opened in a new tab.");
+  }, "guardedNavigate");
+  const safeLocation = new Proxy(
+    {},
+    {
+      get(_t, prop) {
+        switch (prop) {
+          case "origin":
+            return window.location.origin;
+          case "protocol":
+            return window.location.protocol;
+          case "host":
+            return window.location.host;
+          case "hostname":
+            return window.location.hostname;
+          case "port":
+            return window.location.port;
+          case "pathname":
+            return window.location.pathname;
+          case "assign":
+            return (u) => guardedNavigate(u, { replace: false });
+          case "replace":
+            return (u) => guardedNavigate(u, { replace: true });
+          case "reload":
+            throw new Error("Access to location.reload is not allowed.");
+          case "href":
+            throw new Error("Reading location.href is not allowed.");
+          default:
+            throw new Error(`Access to location property "${prop}" is not allowed.`);
+        }
+      },
+      set(_t, prop, value) {
+        if (prop === "href") {
+          guardedNavigate(String(value), { replace: false });
+          return true;
+        }
+        throw new Error("Mutation on location is not allowed.");
+      }
+    }
+  );
+  const allowedGlobals = {
+    // 需绑定到原始 window，避免严格模式下触发 Illegal invocation
+    setTimeout: window.setTimeout.bind(window),
+    clearTimeout: window.clearTimeout.bind(window),
+    setInterval: window.setInterval.bind(window),
+    clearInterval: window.clearInterval.bind(window),
+    console,
+    Math,
+    Date,
+    // 事件侦听仅绑定到真实 window，便于少量需要的全局监听
+    addEventListener: addEventListener.bind(window),
+    // 安全的 window.open 代理
+    open: safeOpen,
+    // 安全的 location 代理
+    location: safeLocation,
+    ...extra || {}
+  };
+  return new Proxy(
+    {},
+    {
+      get(_target, prop) {
+        if (prop in allowedGlobals) return allowedGlobals[prop];
+        throw new Error(`Access to global property "${prop}" is not allowed.`);
+      }
+    }
+  );
+}
+__name(createSafeWindow, "createSafeWindow");
+function createSafeDocument(extra) {
+  const allowed = {
+    createElement: document.createElement.bind(document),
+    querySelector: document.querySelector.bind(document),
+    querySelectorAll: document.querySelectorAll.bind(document),
+    ...extra || {}
+  };
+  return new Proxy(
+    {},
+    {
+      get(_target, prop) {
+        if (prop in allowed) return allowed[prop];
+        throw new Error(`Access to document property "${prop}" is not allowed.`);
+      }
+    }
+  );
+}
+__name(createSafeDocument, "createSafeDocument");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createSafeDocument,
+  createSafeWindow
+});

package/lib/utils/schema-utils.d.ts

@@ -0,0 +1,40 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { ISchema } from '@formily/json-schema';
+import type { FlowModel } from '../models';
+import { FlowRuntimeContext } from '../flowContext';
+import type { StepDefinition, StepUIMode } from '../types';
+/**
+ * 解析 uiMode，支持静态值和函数形式
+ * 函数可以接收 FlowRuntimeContext
+ * @param {StepUIMode | ((ctx: FlowRuntimeContext<TModel>) => StepUIMode | Promise<StepUIMode>)} uiMode UI模式定义
+ * @param {FlowRuntimeContext<TModel>} ctx 上下文
+ * @returns {Promise<StepUIMode>} 解析后的 UI 模式
+ */
+export declare function resolveUiMode<TModel extends FlowModel = FlowModel>(uiMode: StepUIMode | ((ctx: FlowRuntimeContext<TModel>) => StepUIMode | Promise<StepUIMode>) | undefined, ctx: FlowRuntimeContext<TModel>): Promise<StepUIMode>;
+/**
+ * 编译 UI Schema 中的表达式
+ *
+ * @param scope 编译作用域，包含可用的变量和函数（如 t, randomString 等）
+ * @param uiSchema 待编译的 UI Schema
+ * @param options 编译选项
+ * @returns 编译后的 UI Schema
+ */
+export declare function compileUiSchema(scope: Record<string, any>, uiSchema: any, options?: {
+    noCache?: boolean;
+}): any;
+/**
+ * 解析并合并步骤的完整uiSchema
+ * 这个函数提取了在多个组件中重复使用的uiSchema解析和合并逻辑
+ * @param model 模型实例
+ * @param flow 流程定义
+ * @param step 步骤定义
+ * @returns 合并后的uiSchema对象，如果为空则返回null
+ */
+export declare function resolveStepUiSchema<TModel extends FlowModel = FlowModel>(model: TModel, flow: any, step: StepDefinition): Promise<Record<string, ISchema> | null>;