@nocobase/flow-engine 2.0.0-beta.9 → 2.0.1

package/lib/utils/runjsValue.d.ts

@@ -0,0 +1,29 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type RunJSValue = {
+    code: string;
+    version?: string;
+};
+/**
+ * Strictly detect RunJSValue to avoid conflicting with normal constant objects.
+ * - MUST be a plain object (not array)
+ * - MUST include string `code`
+ * - MAY include string `version`
+ * - MUST NOT include any other enumerable keys
+ */
+export declare function isRunJSValue(value: any): value is RunJSValue;
+export declare function normalizeRunJSValue(value: RunJSValue): Required<RunJSValue>;
+/**
+ * Heuristic extraction of ctx variable usage from RunJS code.
+ *
+ * Returns a map: varName -> string[] subPaths
+ * - subPath '' means the variable root is used (or dependency is dynamic), caller MAY treat it as wildcard.
+ * - Only best-effort parsing; correctness prefers over-approximation.
+ */
+export declare function extractUsedVariablePathsFromRunJS(code: string): Record<string, string[]>;

package/lib/utils/runjsValue.js

@@ -0,0 +1,275 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var runjsValue_exports = {};
+__export(runjsValue_exports, {
+  extractUsedVariablePathsFromRunJS: () => extractUsedVariablePathsFromRunJS,
+  isRunJSValue: () => isRunJSValue,
+  normalizeRunJSValue: () => normalizeRunJSValue
+});
+module.exports = __toCommonJS(runjsValue_exports);
+const RUNJS_ALLOWED_KEYS = /* @__PURE__ */ new Set(["code", "version"]);
+function isRunJSValue(value) {
+  if (!value || typeof value !== "object") return false;
+  if (Array.isArray(value)) return false;
+  const keys = Object.keys(value);
+  if (!keys.includes("code")) return false;
+  if (typeof value.code !== "string") return false;
+  if ("version" in value && value.version != null && typeof value.version !== "string") return false;
+  for (const k of keys) {
+    if (!RUNJS_ALLOWED_KEYS.has(k)) return false;
+  }
+  return true;
+}
+__name(isRunJSValue, "isRunJSValue");
+function normalizeRunJSValue(value) {
+  return {
+    code: String((value == null ? void 0 : value.code) ?? ""),
+    version: String((value == null ? void 0 : value.version) ?? "v1")
+  };
+}
+__name(normalizeRunJSValue, "normalizeRunJSValue");
+function stripStringsAndComments(code) {
+  let out = "";
+  let state = "code";
+  for (let i = 0; i < code.length; i++) {
+    const ch = code[i];
+    const next = i + 1 < code.length ? code[i + 1] : "";
+    if (state === "code") {
+      if (ch === "/" && next === "/") {
+        out += "  ";
+        i++;
+        state = "line";
+        continue;
+      }
+      if (ch === "/" && next === "*") {
+        out += "  ";
+        i++;
+        state = "block";
+        continue;
+      }
+      if (ch === "'") {
+        out += " ";
+        state = "single";
+        continue;
+      }
+      if (ch === '"') {
+        out += " ";
+        state = "double";
+        continue;
+      }
+      out += ch;
+      continue;
+    }
+    if (state === "line") {
+      if (ch === "\n") {
+        out += "\n";
+        state = "code";
+      } else {
+        out += " ";
+      }
+      continue;
+    }
+    if (state === "block") {
+      if (ch === "*" && next === "/") {
+        out += "  ";
+        i++;
+        state = "code";
+      } else {
+        out += ch === "\n" ? "\n" : " ";
+      }
+      continue;
+    }
+    if (state === "single") {
+      if (ch === "\\") {
+        out += "  ";
+        i++;
+        continue;
+      }
+      if (ch === "'") {
+        out += " ";
+        state = "code";
+      } else {
+        out += ch === "\n" ? "\n" : " ";
+      }
+      continue;
+    }
+    if (ch === "\\") {
+      out += "  ";
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      out += " ";
+      state = "code";
+    } else {
+      out += ch === "\n" ? "\n" : " ";
+    }
+  }
+  return out;
+}
+__name(stripStringsAndComments, "stripStringsAndComments");
+function stripComments(code) {
+  let out = "";
+  let state = "code";
+  for (let i = 0; i < code.length; i++) {
+    const ch = code[i];
+    const next = i + 1 < code.length ? code[i + 1] : "";
+    if (state === "code") {
+      if (ch === "/" && next === "/") {
+        out += "  ";
+        i++;
+        state = "line";
+        continue;
+      }
+      if (ch === "/" && next === "*") {
+        out += "  ";
+        i++;
+        state = "block";
+        continue;
+      }
+      if (ch === "'") {
+        out += ch;
+        state = "single";
+        continue;
+      }
+      if (ch === '"') {
+        out += ch;
+        state = "double";
+        continue;
+      }
+      out += ch;
+      continue;
+    }
+    if (state === "line") {
+      if (ch === "\n") {
+        out += "\n";
+        state = "code";
+      } else {
+        out += " ";
+      }
+      continue;
+    }
+    if (state === "block") {
+      if (ch === "*" && next === "/") {
+        out += "  ";
+        i++;
+        state = "code";
+      } else {
+        out += ch === "\n" ? "\n" : " ";
+      }
+      continue;
+    }
+    if (state === "single") {
+      out += ch;
+      if (ch === "\\") {
+        const nextCh = i + 1 < code.length ? code[i + 1] : "";
+        if (nextCh) {
+          out += nextCh;
+          i++;
+        }
+        continue;
+      }
+      if (ch === "'") {
+        state = "code";
+      }
+      continue;
+    }
+    out += ch;
+    if (ch === "\\") {
+      const nextCh = i + 1 < code.length ? code[i + 1] : "";
+      if (nextCh) {
+        out += nextCh;
+        i++;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      state = "code";
+    }
+  }
+  return out;
+}
+__name(stripComments, "stripComments");
+function normalizeSubPath(raw) {
+  if (!raw) return { subPath: "", wildcard: false };
+  let s = raw;
+  s = s.replace(/\[['"]([a-zA-Z_$][a-zA-Z0-9_$]*)['"]\]/g, ".$1");
+  const bracketRe = /\[([^\]]+)\]/g;
+  let m;
+  while (m = bracketRe.exec(s)) {
+    const inner = String(m[1] ?? "").trim();
+    if (/^\d+$/.test(inner)) continue;
+    if (/^['"][a-zA-Z_$][a-zA-Z0-9_$]*['"]$/.test(inner)) continue;
+    return { subPath: s.startsWith(".") ? s.slice(1) : s, wildcard: true };
+  }
+  if (s.startsWith(".")) s = s.slice(1);
+  return { subPath: s, wildcard: false };
+}
+__name(normalizeSubPath, "normalizeSubPath");
+function extractUsedVariablePathsFromRunJS(code) {
+  if (typeof code !== "string" || !code.trim()) return {};
+  const src = stripStringsAndComments(code);
+  const srcWithStrings = stripComments(code);
+  const usage = /* @__PURE__ */ new Map();
+  const add = /* @__PURE__ */ __name((varName, subPath) => {
+    if (!varName) return;
+    const set = usage.get(varName) || /* @__PURE__ */ new Set();
+    set.add(subPath || "");
+    usage.set(varName, set);
+  }, "add");
+  const dotRe = /ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*(?:(?:\.[a-zA-Z_$][a-zA-Z0-9_$]*)|(?:\[[^\]]+\]))*)(?!\s*\()/g;
+  let match;
+  while (match = dotRe.exec(src)) {
+    const pathAfterCtx = match[1] || "";
+    const firstKeyMatch = pathAfterCtx.match(/^([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+    if (!firstKeyMatch) continue;
+    const firstKey = firstKeyMatch[1];
+    const rest = pathAfterCtx.slice(firstKey.length);
+    const { subPath, wildcard } = normalizeSubPath(rest);
+    add(firstKey, wildcard ? "" : subPath);
+  }
+  const bracketRootRe = /ctx\s*\[\s*(['"])([a-zA-Z_$][a-zA-Z0-9_$]*)\1\s*\]((?:(?:\.[a-zA-Z_$][a-zA-Z0-9_$]*)|(?:\[[^\]]+\]))*)(?!\s*\()/g;
+  while (match = bracketRootRe.exec(srcWithStrings)) {
+    const varName = match[2] || "";
+    const rest = match[3] || "";
+    const { subPath, wildcard } = normalizeSubPath(rest);
+    add(varName, wildcard ? "" : subPath);
+  }
+  const out = {};
+  for (const [k, set] of usage.entries()) {
+    out[k] = Array.from(set);
+  }
+  return out;
+}
+__name(extractUsedVariablePathsFromRunJS, "extractUsedVariablePathsFromRunJS");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  extractUsedVariablePathsFromRunJS,
+  isRunJSValue,
+  normalizeRunJSValue
+});

package/lib/utils/safeGlobals.d.ts

@@ -6,13 +6,23 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+export declare function registerRunJSSafeWindowGlobals(keys: Iterable<string> | null | undefined): void;
+export declare function registerRunJSSafeDocumentGlobals(keys: Iterable<string> | null | undefined): void;
+export declare function __resetRunJSSafeGlobalsRegistryForTests(): void;
+export declare function createSafeWindow(extra?: Record<string, any>): Record<string, any>;
+export declare function createSafeDocument(extra?: Record<string, any>): Record<string, any>;
+export declare function createSafeNavigator(extra?: Record<string, any>): {};
 /**
- * 统一的安全全局对象代理：window/document/navigator
- * - window：仅允许常用的定时器、console、Math、Date、FormData、addEventListener、open（安全包装）、location（安全代理）
- * - document：仅允许 createElement/querySelector/querySelectorAll
- * - navigator：仅提供极少量低风险能力（clipboard.writeText、onLine、language、languages）
- * - 不允许随意访问未声明的属性，最小权限原则
+ * Create a safe globals object for RunJS execution.
+ *
+ * - Always tries to provide `navigator`
+ * - Best-effort provides `window` and `document` in browser environments
+ * - Never throws (so callers can decide how to handle missing globals)
  */
-export declare function createSafeWindow(extra?: Record<string, any>): {};
-export declare function createSafeDocument(extra?: Record<string, any>): {};
-export declare function createSafeNavigator(extra?: Record<string, any>): {};
+export declare function createSafeRunJSGlobals(extraGlobals?: Record<string, any>): Record<string, any>;
+/**
+ * Execute RunJS with safe globals (window/document/navigator).
+ *
+ * Keeps `this` binding by calling `ctx.runjs(...)` instead of passing bare function references.
+ */
+export declare function runjsWithSafeGlobals(ctx: unknown, code: string, options?: any, extraGlobals?: Record<string, any>): Promise<any>;

package/lib/utils/safeGlobals.js

@@ -27,14 +27,75 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var safeGlobals_exports = {};
 __export(safeGlobals_exports, {
+  __resetRunJSSafeGlobalsRegistryForTests: () => __resetRunJSSafeGlobalsRegistryForTests,
   createSafeDocument: () => createSafeDocument,
   createSafeNavigator: () => createSafeNavigator,
-  createSafeWindow: () => createSafeWindow
+  createSafeRunJSGlobals: () => createSafeRunJSGlobals,
+  createSafeWindow: () => createSafeWindow,
+  registerRunJSSafeDocumentGlobals: () => registerRunJSSafeDocumentGlobals,
+  registerRunJSSafeWindowGlobals: () => registerRunJSSafeWindowGlobals,
+  runjsWithSafeGlobals: () => runjsWithSafeGlobals
 });
 module.exports = __toCommonJS(safeGlobals_exports);
+function getRunJSSafeGlobalsRegistry() {
+  var _a, _b;
+  const g = globalThis;
+  if (((_a = g.__nocobaseRunJSSafeGlobalsRegistry) == null ? void 0 : _a.windowAllow) && ((_b = g.__nocobaseRunJSSafeGlobalsRegistry) == null ? void 0 : _b.documentAllow)) {
+    return g.__nocobaseRunJSSafeGlobalsRegistry;
+  }
+  const reg = {
+    windowAllow: /* @__PURE__ */ new Set(),
+    documentAllow: /* @__PURE__ */ new Set()
+  };
+  g.__nocobaseRunJSSafeGlobalsRegistry = reg;
+  return reg;
+}
+__name(getRunJSSafeGlobalsRegistry, "getRunJSSafeGlobalsRegistry");
+function registerRunJSSafeWindowGlobals(keys) {
+  if (!keys) return;
+  const reg = getRunJSSafeGlobalsRegistry();
+  for (const k of keys) {
+    if (typeof k !== "string") continue;
+    const key = k.trim();
+    if (!key) continue;
+    reg.windowAllow.add(key);
+  }
+}
+__name(registerRunJSSafeWindowGlobals, "registerRunJSSafeWindowGlobals");
+function registerRunJSSafeDocumentGlobals(keys) {
+  if (!keys) return;
+  const reg = getRunJSSafeGlobalsRegistry();
+  for (const k of keys) {
+    if (typeof k !== "string") continue;
+    const key = k.trim();
+    if (!key) continue;
+    reg.documentAllow.add(key);
+  }
+}
+__name(registerRunJSSafeDocumentGlobals, "registerRunJSSafeDocumentGlobals");
+function __resetRunJSSafeGlobalsRegistryForTests() {
+  var _a, _b, _c, _d;
+  const g = globalThis;
+  if (g.__nocobaseRunJSSafeGlobalsRegistry) {
+    try {
+      (_b = (_a = g.__nocobaseRunJSSafeGlobalsRegistry.windowAllow) == null ? void 0 : _a.clear) == null ? void 0 : _b.call(_a);
+      (_d = (_c = g.__nocobaseRunJSSafeGlobalsRegistry.documentAllow) == null ? void 0 : _c.clear) == null ? void 0 : _d.call(_c);
+    } catch {
+    }
+  }
+}
+__name(__resetRunJSSafeGlobalsRegistryForTests, "__resetRunJSSafeGlobalsRegistryForTests");
+function isAllowedDynamicWindowKey(key) {
+  return getRunJSSafeGlobalsRegistry().windowAllow.has(key);
+}
+__name(isAllowedDynamicWindowKey, "isAllowedDynamicWindowKey");
+function isAllowedDynamicDocumentKey(key) {
+  return getRunJSSafeGlobalsRegistry().documentAllow.has(key);
+}
+__name(isAllowedDynamicDocumentKey, "isAllowedDynamicDocumentKey");
 function createSafeWindow(extra) {
   const getSafeBaseHref = /* @__PURE__ */ __name(() => `${window.location.origin}${window.location.pathname}`, "getSafeBaseHref");
-  const safeOpen = /* @__PURE__ */ __name((url, target, features) => {
+  const safeOpen = /* @__PURE__ */ __name((url, target2, features) => {
     const isSafeUrl = /* @__PURE__ */ __name((u) => {
       try {
         const parsed = new URL(u, getSafeBaseHref());
@@ -137,6 +198,8 @@ function createSafeWindow(extra) {
     Math,
     Date,
     FormData,
+    ...typeof Blob !== "undefined" ? { Blob } : {},
+    ...typeof URL !== "undefined" ? { URL } : {},
     // 事件侦听仅绑定到真实 window，便于少量需要的全局监听
     addEventListener: addEventListener.bind(window),
     // 安全的 window.open 代理
@@ -145,15 +208,40 @@ function createSafeWindow(extra) {
     location: safeLocation,
     ...extra || {}
   };
-  return new Proxy(
-    {},
-    {
-      get(_target, prop) {
-        if (prop in allowedGlobals) return allowedGlobals[prop];
-        throw new Error(`Access to global property "${prop}" is not allowed.`);
+  const target = /* @__PURE__ */ Object.create(null);
+  return new Proxy(target, {
+    get(t, prop) {
+      if (typeof prop !== "string") {
+        return Reflect.get(t, prop);
+      }
+      if (prop in allowedGlobals) return allowedGlobals[prop];
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return t[prop];
+      if (isAllowedDynamicWindowKey(prop)) {
+        const v = window[prop];
+        if (typeof v === "function") return v.bind(window);
+        return v;
+      }
+      throw new Error(`Access to global property "${prop}" is not allowed.`);
+    },
+    set(t, prop, value) {
+      if (typeof prop !== "string") {
+        Reflect.set(t, prop, value);
+        return true;
+      }
+      if (prop in allowedGlobals) {
+        throw new Error(`Mutation of global property "${prop}" is not allowed.`);
       }
+      t[prop] = value;
+      return true;
+    },
+    has(t, prop) {
+      if (typeof prop !== "string") return Reflect.has(t, prop);
+      if (prop in allowedGlobals) return true;
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
+      if (isAllowedDynamicWindowKey(prop)) return true;
+      return false;
     }
-  );
+  });
 }
 __name(createSafeWindow, "createSafeWindow");
 function createSafeDocument(extra) {
@@ -163,15 +251,40 @@ function createSafeDocument(extra) {
     querySelectorAll: document.querySelectorAll.bind(document),
     ...extra || {}
   };
-  return new Proxy(
-    {},
-    {
-      get(_target, prop) {
-        if (prop in allowed) return allowed[prop];
-        throw new Error(`Access to document property "${prop}" is not allowed.`);
+  const target = /* @__PURE__ */ Object.create(null);
+  return new Proxy(target, {
+    get(t, prop) {
+      if (typeof prop !== "string") {
+        return Reflect.get(t, prop);
+      }
+      if (prop in allowed) return allowed[prop];
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return t[prop];
+      if (isAllowedDynamicDocumentKey(prop)) {
+        const v = document[prop];
+        if (typeof v === "function") return v.bind(document);
+        return v;
+      }
+      throw new Error(`Access to document property "${prop}" is not allowed.`);
+    },
+    set(t, prop, value) {
+      if (typeof prop !== "string") {
+        Reflect.set(t, prop, value);
+        return true;
+      }
+      if (prop in allowed) {
+        throw new Error(`Mutation of document property "${prop}" is not allowed.`);
       }
+      t[prop] = value;
+      return true;
+    },
+    has(t, prop) {
+      if (typeof prop !== "string") return Reflect.has(t, prop);
+      if (prop in allowed) return true;
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
+      if (isAllowedDynamicDocumentKey(prop)) return true;
+      return false;
     }
-  );
+  });
 }
 __name(createSafeDocument, "createSafeDocument");
 function createSafeNavigator(extra) {
@@ -212,9 +325,43 @@ function createSafeNavigator(extra) {
   );
 }
 __name(createSafeNavigator, "createSafeNavigator");
+function createSafeRunJSGlobals(extraGlobals) {
+  const globals = {};
+  try {
+    const navigator = createSafeNavigator();
+    globals.navigator = navigator;
+    try {
+      globals.window = createSafeWindow({ navigator });
+    } catch {
+    }
+  } catch {
+  }
+  try {
+    globals.document = createSafeDocument();
+  } catch {
+  }
+  return extraGlobals ? { ...globals, ...extraGlobals } : globals;
+}
+__name(createSafeRunJSGlobals, "createSafeRunJSGlobals");
+async function runjsWithSafeGlobals(ctx, code, options, extraGlobals) {
+  if (!ctx || typeof ctx !== "object" && typeof ctx !== "function") return void 0;
+  const runjs = ctx.runjs;
+  if (typeof runjs !== "function") return void 0;
+  return ctx.runjs(
+    code,
+    createSafeRunJSGlobals(extraGlobals),
+    options
+  );
+}
+__name(runjsWithSafeGlobals, "runjsWithSafeGlobals");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  __resetRunJSSafeGlobalsRegistryForTests,
   createSafeDocument,
   createSafeNavigator,
-  createSafeWindow
+  createSafeRunJSGlobals,
+  createSafeWindow,
+  registerRunJSSafeDocumentGlobals,
+  registerRunJSSafeWindowGlobals,
+  runjsWithSafeGlobals
 });

package/lib/utils/schema-utils.d.ts

@@ -44,3 +44,13 @@ export declare function resolveStepUiSchema<TModel extends FlowModel = FlowModel
  * - hideInSettings 可为布尔值或函数（接收 FlowRuntimeContext）。
  */
 export declare function shouldHideStepInSettings<TModel extends FlowModel = FlowModel>(model: TModel, flow: any, step: StepDefinition): Promise<boolean>;
+/**
+ * 解析步骤在设置菜单中的禁用状态与提示文案。
+ * - 支持 StepDefinition.disabledInSettings 与 ActionDefinition.disabledInSettings（step 优先）。
+ * - 支持 StepDefinition.disabledReasonInSettings 与 ActionDefinition.disabledReasonInSettings（step 优先）。
+ * - 以上属性均支持静态值与函数（接收 FlowRuntimeContext）。
+ */
+export declare function resolveStepDisabledInSettings<TModel extends FlowModel = FlowModel>(model: TModel, flow: any, step: StepDefinition): Promise<{
+    disabled: boolean;
+    reason?: string;
+}>;

package/lib/utils/schema-utils.js

@@ -28,6 +28,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var schema_utils_exports = {};
 __export(schema_utils_exports, {
   compileUiSchema: () => compileUiSchema,
+  resolveStepDisabledInSettings: () => resolveStepDisabledInSettings,
   resolveStepUiSchema: () => resolveStepUiSchema,
   resolveUiMode: () => resolveUiMode,
   shouldHideStepInSettings: () => shouldHideStepInSettings
@@ -217,9 +218,69 @@ async function shouldHideStepInSettings(model, flow, step) {
   return !!hideInSettings;
 }
 __name(shouldHideStepInSettings, "shouldHideStepInSettings");
+async function resolveStepDisabledInSettings(model, flow, step) {
+  var _a;
+  if (!step) return { disabled: false };
+  let disabledInSettings = step.disabledInSettings;
+  let disabledReasonInSettings = step.disabledReasonInSettings;
+  if ((typeof disabledInSettings === "undefined" || typeof disabledReasonInSettings === "undefined") && step.use) {
+    try {
+      const action = (_a = model.getAction) == null ? void 0 : _a.call(model, step.use);
+      if (typeof disabledInSettings === "undefined") {
+        disabledInSettings = action == null ? void 0 : action.disabledInSettings;
+      }
+      if (typeof disabledReasonInSettings === "undefined") {
+        disabledReasonInSettings = action == null ? void 0 : action.disabledReasonInSettings;
+      }
+    } catch (error) {
+      console.warn(`Failed to get action ${step.use}:`, error);
+    }
+  }
+  let ctx = null;
+  const getContext = /* @__PURE__ */ __name(() => {
+    if (ctx) return ctx;
+    ctx = new import_flowContext.FlowRuntimeContext(model, flow.key, "settings");
+    (0, import_setupRuntimeContextSteps.setupRuntimeContextSteps)(ctx, flow.steps, model, flow.key);
+    ctx.defineProperty("currentStep", { value: step });
+    return ctx;
+  }, "getContext");
+  let disabled = false;
+  if (typeof disabledInSettings === "function") {
+    try {
+      disabled = !!await disabledInSettings(getContext());
+    } catch (error) {
+      console.warn(`Error evaluating disabledInSettings for step '${step.key || ""}' in flow '${flow.key}':`, error);
+      return { disabled: false };
+    }
+  } else {
+    disabled = !!disabledInSettings;
+  }
+  if (!disabled) {
+    return { disabled: false };
+  }
+  let reason;
+  if (typeof disabledReasonInSettings === "function") {
+    try {
+      const resolved = await disabledReasonInSettings(getContext());
+      if (typeof resolved !== "undefined" && resolved !== null && resolved !== "") {
+        reason = String(resolved);
+      }
+    } catch (error) {
+      console.warn(
+        `Error evaluating disabledReasonInSettings for step '${step.key || ""}' in flow '${flow.key}':`,
+        error
+      );
+    }
+  } else if (typeof disabledReasonInSettings !== "undefined" && disabledReasonInSettings !== null && disabledReasonInSettings !== "") {
+    reason = String(disabledReasonInSettings);
+  }
+  return { disabled: true, reason };
+}
+__name(resolveStepDisabledInSettings, "resolveStepDisabledInSettings");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   compileUiSchema,
+  resolveStepDisabledInSettings,
   resolveStepUiSchema,
   resolveUiMode,
   shouldHideStepInSettings

package/lib/views/createViewMeta.d.ts

@@ -8,13 +8,6 @@
  */
 import type { FlowContext, PropertyMetaFactory } from '../flowContext';
 import type { FlowView } from './FlowView';
-/**
- * Create a meta factory for ctx.view that includes:
- * - buildVariablesParams: { record } via inferRecordRef
- * - properties.record: full collection meta via buildRecordMeta
- * - type/preventClose/inputArgs/navigation fields for better variable selection UX
- */
-export declare function createViewMeta(ctx: FlowContext): PropertyMetaFactory;
 /**
  * 为 ctx.popup 构建元信息：
  * - popup.record：当前弹窗记录（服务端解析）