@nocobase/flow-engine 2.1.31 → 2.2.0-alpha.10

package/src/flowContext.ts

@@ -3609,7 +3609,17 @@ export class FlowEngineContext extends BaseFlowEngineContext {
         doc = {};
       }
       const deprecatedCtx = createRunJSDeprecationProxy(runCtx, { doc });
-      const globals: Record<string, any> = { ctx: deprecatedCtx, ...(options?.globals || {}) };
+      const browserGlobals: Record<string, any> = {};
+      if (typeof window !== 'undefined') {
+        browserGlobals.window = window;
+        if (typeof navigator !== 'undefined') {
+          browserGlobals.navigator = navigator;
+        }
+      }
+      if (typeof document !== 'undefined') {
+        browserGlobals.document = document;
+      }
+      const globals: Record<string, any> = { ctx: deprecatedCtx, ...browserGlobals, ...(options?.globals || {}) };
       const { timeoutMs } = options || {};
       return new JSRunner({ globals, timeoutMs });
     });

package/src/flowI18n.ts

@@ -64,7 +64,9 @@ export class FlowI18n {
    * @private
    */
   private isTemplate(str: string): boolean {
-    return /\{\{\s*t\s*\(\s*["'`].*?["'`]\s*(?:,\s*.*?)?\s*\)\s*\}\}/g.test(str);
+    // The closing quote is a backreference to the opening one (group 1) so an embedded quote of a different type — e.g.
+    // {{t('… "Post-action event" …')}} — does not terminate the key early.
+    return /\{\{\s*t\s*\(\s*(["'`])(?:\\.|(?!\1).)*?\1\s*(?:,\s*.*?)?\s*\)\s*\}\}/.test(str);
   }
 
   /**
@@ -72,9 +74,12 @@ export class FlowI18n {
    * @private
    */
   private compileTemplate(template: string): string {
+    // `(["'`])` captures the opening quote; the key allows escaped chars (`\\.`) and any char that is not that same
+    // quote (`(?!\1).`), and `\1` closes on the matching quote. This keeps embedded quotes of a different type inside
+    // the key instead of truncating it at the first quote of any kind.
     return template.replace(
-      /\{\{\s*t\s*\(\s*["'`](.*?)["'`]\s*(?:,\s*((?:[^{}]|\{[^}]*\})*?))?\s*\)\s*\}\}/g,
-      (match, key, optionsStr) => {
+      /\{\{\s*t\s*\(\s*(["'`])((?:\\.|(?!\1).)*?)\1\s*(?:,\s*((?:[^{}]|\{[^}]*\})*?))?\s*\)\s*\}\}/g,
+      (match, _quote, key, optionsStr) => {
         try {
           let templateOptions = {};
           if (optionsStr) {

package/src/runjs-context/helpers.ts

@@ -46,12 +46,17 @@ export function createJSRunnerWithVersion(this: FlowContext, options?: JSRunnerO
     doc = {};
   }
   const deprecatedCtx = createRunJSDeprecationProxy(runCtx, { doc });
-  const globals: Record<string, any> = { ctx: deprecatedCtx, ...(options?.globals || {}) };
-  // 对字段/区块类上下文，默认注入 window/document 以支持在沙箱中访问 DOM API
-  if (modelClass === 'JSFieldModel' || modelClass === 'JSBlockModel') {
-    if (typeof window !== 'undefined') globals.window = window as any;
-    if (typeof document !== 'undefined') globals.document = document as any;
+  const browserGlobals: Record<string, any> = {};
+  if (typeof window !== 'undefined') {
+    browserGlobals.window = window;
+    if (typeof navigator !== 'undefined') {
+      browserGlobals.navigator = navigator;
+    }
   }
+  if (typeof document !== 'undefined') {
+    browserGlobals.document = document;
+  }
+  const globals: Record<string, any> = { ctx: deprecatedCtx, ...browserGlobals, ...(options?.globals || {}) };
   // 透传 JSRunnerOptions 其余配置（如 timeoutMs）
   const { timeoutMs } = options || {};
   return new JSRunner({ globals, timeoutMs });
@@ -59,7 +64,8 @@ export function createJSRunnerWithVersion(this: FlowContext, options?: JSRunnerO
 
 export function getRunJSScenesForModel(modelClass: string, version: RunJSVersion = 'v1'): string[] {
   const meta = RunJSContextRegistry.getMeta(version, modelClass);
-  return Array.isArray(meta?.scenes) ? [...meta!.scenes!] : [];
+  const scenes = meta?.scenes;
+  return Array.isArray(scenes) ? [...scenes] : [];
 }
 
 export function getRunJSScenesForContext(ctx: FlowContext, { version = 'v1' as RunJSVersion } = {}): string[] {

package/src/types.ts

@@ -147,6 +147,8 @@ export enum ActionScene {
   DYNAMIC_EVENT_FLOW,
   /** 菜单项联动规则可用 */
   MENU_LINKAGE_RULES,
+  /** 标签页联动规则可用 */
+  TAB_LINKAGE_RULES,
 }
 
 /**

package/src/utils/index.ts

@@ -87,15 +87,6 @@ export {
   serializeCtxDateValue,
 } from './dateVariable';
 
-// 安全全局对象（window/document）
-export {
-  createSafeDocument,
-  createSafeWindow,
-  createSafeNavigator,
-  createSafeRunJSGlobals,
-  runjsWithSafeGlobals,
-} from './safeGlobals';
-
 // RunJS value helpers
 export { isRunJSValue, normalizeRunJSValue, extractUsedVariablePathsFromRunJS, type RunJSValue } from './runjsValue';
 

package/src/utils/resolveRunJSObjectValues.ts

@@ -8,7 +8,6 @@
  */
 
 import { isRunJSValue, normalizeRunJSValue } from './runjsValue';
-import { runjsWithSafeGlobals } from './safeGlobals';
 
 /**
  * Resolve an object's values, executing any RunJSValue entries via ctx.runjs.
@@ -29,7 +28,11 @@ export async function resolveRunJSObjectValues(ctx: unknown, raw: unknown): Prom
     if (isRunJSValue(value)) {
       const { code, version } = normalizeRunJSValue(value);
       if (!code.trim()) continue;
-      const ret = await runjsWithSafeGlobals(ctx, code, { version });
+      const runjsCtx = ctx as
+        | { runjs?: (code: string, variables?: Record<string, any>, options?: Record<string, any>) => Promise<any> }
+        | undefined
+        | null;
+      const ret = await runjsCtx?.runjs?.(code, undefined, { version });
       if (!ret?.success) {
         throw new Error(`RunJS execution failed for "${key}"`);
       }

package/src/utils/runjsModuleLoader.ts

@@ -9,7 +9,6 @@
 
 import { setRunJSLibOverride } from '../runjsLibs';
 import { resolveModuleUrl } from './resolveModuleUrl';
-import { registerRunJSSafeDocumentGlobals, registerRunJSSafeWindowGlobals } from './safeGlobals';
 
 /**
  * RunJS 外部模块加载辅助（浏览器侧）。
@@ -38,26 +37,6 @@ type ParsedPackageSpecifier = {
   subpath?: string;
 };
 
-function snapshotOwnKeys(obj: any): string[] {
-  try {
-    if (!obj || (typeof obj !== 'object' && typeof obj !== 'function')) return [];
-    return Object.getOwnPropertyNames(obj);
-  } catch (_) {
-    return [];
-  }
-}
-
-function diffAddedKeys(afterKeys: string[], beforeKeys: string[]): string[] {
-  if (!afterKeys.length) return [];
-  if (!beforeKeys.length) return [...afterKeys];
-  const beforeSet = new Set(beforeKeys);
-  const added: string[] = [];
-  for (const k of afterKeys) {
-    if (!beforeSet.has(k)) added.push(k);
-  }
-  return added;
-}
-
 /**
  * 使用全局 Promise 链实现“互斥锁”：
  * - 锁存放在 `globalThis.__nocobaseRunjsModuleLoadLock`；
@@ -298,9 +277,6 @@ async function prefetchEsmModule(url: string, options?: { timeoutMs?: number }):
  */
 export async function runjsRequireAsync(requirejs: RequireJsLike, url: string): Promise<any> {
   return await withRunjsModuleLoadLock(async () => {
-    const beforeWinKeys = typeof window !== 'undefined' ? snapshotOwnKeys(window) : [];
-    const beforeDocKeys = typeof document !== 'undefined' ? snapshotOwnKeys(document) : [];
-
     let result: any;
     let error: any;
     try {
@@ -319,14 +295,6 @@ export async function runjsRequireAsync(requirejs: RequireJsLike, url: string):
       });
     } catch (e) {
       error = e;
-    } finally {
-      const afterWinKeys = typeof window !== 'undefined' ? snapshotOwnKeys(window) : [];
-      const afterDocKeys = typeof document !== 'undefined' ? snapshotOwnKeys(document) : [];
-      const addedWinKeys = diffAddedKeys(afterWinKeys, beforeWinKeys);
-      const addedDocKeys = diffAddedKeys(afterDocKeys, beforeDocKeys);
-      // Best-effort: allow RunJS safe window/document to access globals introduced by this module load.
-      registerRunJSSafeWindowGlobals(addedWinKeys);
-      registerRunJSSafeDocumentGlobals(addedDocKeys);
     }
 
     if (error) throw error;

package/lib/utils/safeGlobals.d.ts

@@ -1,28 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-export declare function registerRunJSSafeWindowGlobals(keys: Iterable<string> | null | undefined): void;
-export declare function registerRunJSSafeDocumentGlobals(keys: Iterable<string> | null | undefined): void;
-export declare function __resetRunJSSafeGlobalsRegistryForTests(): void;
-export declare function createSafeWindow(extra?: Record<string, any>): Record<string, any>;
-export declare function createSafeDocument(extra?: Record<string, any>): Record<string, any>;
-export declare function createSafeNavigator(extra?: Record<string, any>): {};
-/**
- * Create a safe globals object for RunJS execution.
- *
- * - Always tries to provide `navigator`
- * - Best-effort provides `window` and `document` in browser environments
- * - Never throws (so callers can decide how to handle missing globals)
- */
-export declare function createSafeRunJSGlobals(extraGlobals?: Record<string, any>): Record<string, any>;
-/**
- * Execute RunJS with safe globals (window/document/navigator).
- *
- * Keeps `this` binding by calling `ctx.runjs(...)` instead of passing bare function references.
- */
-export declare function runjsWithSafeGlobals(ctx: unknown, code: string, options?: any, extraGlobals?: Record<string, any>): Promise<any>;

package/lib/utils/safeGlobals.js

@@ -1,367 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var safeGlobals_exports = {};
-__export(safeGlobals_exports, {
-  __resetRunJSSafeGlobalsRegistryForTests: () => __resetRunJSSafeGlobalsRegistryForTests,
-  createSafeDocument: () => createSafeDocument,
-  createSafeNavigator: () => createSafeNavigator,
-  createSafeRunJSGlobals: () => createSafeRunJSGlobals,
-  createSafeWindow: () => createSafeWindow,
-  registerRunJSSafeDocumentGlobals: () => registerRunJSSafeDocumentGlobals,
-  registerRunJSSafeWindowGlobals: () => registerRunJSSafeWindowGlobals,
-  runjsWithSafeGlobals: () => runjsWithSafeGlobals
-});
-module.exports = __toCommonJS(safeGlobals_exports);
-function getRunJSSafeGlobalsRegistry() {
-  var _a, _b;
-  const g = globalThis;
-  if (((_a = g.__nocobaseRunJSSafeGlobalsRegistry) == null ? void 0 : _a.windowAllow) && ((_b = g.__nocobaseRunJSSafeGlobalsRegistry) == null ? void 0 : _b.documentAllow)) {
-    return g.__nocobaseRunJSSafeGlobalsRegistry;
-  }
-  const reg = {
-    windowAllow: /* @__PURE__ */ new Set(),
-    documentAllow: /* @__PURE__ */ new Set()
-  };
-  g.__nocobaseRunJSSafeGlobalsRegistry = reg;
-  return reg;
-}
-__name(getRunJSSafeGlobalsRegistry, "getRunJSSafeGlobalsRegistry");
-function registerRunJSSafeWindowGlobals(keys) {
-  if (!keys) return;
-  const reg = getRunJSSafeGlobalsRegistry();
-  for (const k of keys) {
-    if (typeof k !== "string") continue;
-    const key = k.trim();
-    if (!key) continue;
-    reg.windowAllow.add(key);
-  }
-}
-__name(registerRunJSSafeWindowGlobals, "registerRunJSSafeWindowGlobals");
-function registerRunJSSafeDocumentGlobals(keys) {
-  if (!keys) return;
-  const reg = getRunJSSafeGlobalsRegistry();
-  for (const k of keys) {
-    if (typeof k !== "string") continue;
-    const key = k.trim();
-    if (!key) continue;
-    reg.documentAllow.add(key);
-  }
-}
-__name(registerRunJSSafeDocumentGlobals, "registerRunJSSafeDocumentGlobals");
-function __resetRunJSSafeGlobalsRegistryForTests() {
-  var _a, _b, _c, _d;
-  const g = globalThis;
-  if (g.__nocobaseRunJSSafeGlobalsRegistry) {
-    try {
-      (_b = (_a = g.__nocobaseRunJSSafeGlobalsRegistry.windowAllow) == null ? void 0 : _a.clear) == null ? void 0 : _b.call(_a);
-      (_d = (_c = g.__nocobaseRunJSSafeGlobalsRegistry.documentAllow) == null ? void 0 : _c.clear) == null ? void 0 : _d.call(_c);
-    } catch {
-    }
-  }
-}
-__name(__resetRunJSSafeGlobalsRegistryForTests, "__resetRunJSSafeGlobalsRegistryForTests");
-function isAllowedDynamicWindowKey(key) {
-  return getRunJSSafeGlobalsRegistry().windowAllow.has(key);
-}
-__name(isAllowedDynamicWindowKey, "isAllowedDynamicWindowKey");
-function isAllowedDynamicDocumentKey(key) {
-  return getRunJSSafeGlobalsRegistry().documentAllow.has(key);
-}
-__name(isAllowedDynamicDocumentKey, "isAllowedDynamicDocumentKey");
-function createSafeWindow(extra) {
-  const getSafeBaseHref = /* @__PURE__ */ __name(() => `${window.location.origin}${window.location.pathname}`, "getSafeBaseHref");
-  const safeOpen = /* @__PURE__ */ __name((url, target2, features) => {
-    const isSafeUrl = /* @__PURE__ */ __name((u) => {
-      try {
-        const parsed = new URL(u, getSafeBaseHref());
-        const protocol = parsed.protocol.toLowerCase();
-        if (protocol === "about:") return parsed.href === "about:blank";
-        return protocol === "http:" || protocol === "https:";
-      } catch {
-        return false;
-      }
-    }, "isSafeUrl");
-    if (!isSafeUrl(url)) {
-      throw new Error("Unsafe URL: window.open only allows http/https/about:blank.");
-    }
-    const sanitizedTarget = "_blank";
-    const enforceFeatures = /* @__PURE__ */ __name((f) => {
-      const set = /* @__PURE__ */ new Set();
-      if (f) {
-        f.split(",").map((s) => s.trim()).filter(Boolean).forEach((part) => {
-          const key = part.split("=")[0].trim().toLowerCase();
-          if (key !== "noopener" && key !== "noreferrer") set.add(part);
-        });
-      }
-      set.add("noopener");
-      set.add("noreferrer");
-      return Array.from(set).join(",");
-    }, "enforceFeatures");
-    const sanitizedFeatures = enforceFeatures(features);
-    const newWin = window.open.call(window, url, sanitizedTarget, sanitizedFeatures);
-    if (newWin && "opener" in newWin) {
-      try {
-        newWin.opener = null;
-      } catch {
-      }
-    }
-    return newWin;
-  }, "safeOpen");
-  const guardedNavigate = /* @__PURE__ */ __name((rawUrl, opts) => {
-    const parsed = new URL(rawUrl, getSafeBaseHref());
-    const protocol = parsed.protocol.toLowerCase();
-    const isAboutBlank = protocol === "about:" && parsed.href === "about:blank";
-    const isHttp = protocol === "http:" || protocol === "https:";
-    if (!isHttp && !isAboutBlank) {
-      throw new Error("Unsafe URL: only http/https/about:blank are allowed.");
-    }
-    if (isAboutBlank) {
-      return (opts == null ? void 0 : opts.replace) ? window.location.replace("about:blank") : window.location.assign("about:blank");
-    }
-    const sameOrigin = parsed.protocol === window.location.protocol && parsed.hostname === window.location.hostname && parsed.port === window.location.port;
-    if (sameOrigin) {
-      return (opts == null ? void 0 : opts.replace) ? window.location.replace(parsed.href) : window.location.assign(parsed.href);
-    }
-    const win = safeOpen(parsed.href);
-    if (!win) throw new Error("Popup blocked: cross-origin navigation is opened in a new tab.");
-  }, "guardedNavigate");
-  const safeLocation = new Proxy(
-    {},
-    {
-      get(_t, prop) {
-        switch (prop) {
-          case "origin":
-            return window.location.origin;
-          case "protocol":
-            return window.location.protocol;
-          case "host":
-            return window.location.host;
-          case "hostname":
-            return window.location.hostname;
-          case "port":
-            return window.location.port;
-          case "pathname":
-            return window.location.pathname;
-          case "assign":
-            return (u) => guardedNavigate(u, { replace: false });
-          case "replace":
-            return (u) => guardedNavigate(u, { replace: true });
-          case "reload":
-            return window.location.reload.bind(window.location);
-          case "href":
-            throw new Error("Reading location.href is not allowed.");
-          default:
-            throw new Error(`Access to location property "${prop}" is not allowed.`);
-        }
-      },
-      set(_t, prop, value) {
-        if (prop === "href") {
-          guardedNavigate(String(value), { replace: false });
-          return true;
-        }
-        throw new Error("Mutation on location is not allowed.");
-      }
-    }
-  );
-  const allowedGlobals = {
-    // 需绑定到原始 window，避免严格模式下触发 Illegal invocation
-    setTimeout: window.setTimeout.bind(window),
-    clearTimeout: window.clearTimeout.bind(window),
-    setInterval: window.setInterval.bind(window),
-    clearInterval: window.clearInterval.bind(window),
-    console,
-    Math,
-    Date,
-    FormData,
-    ...typeof Blob !== "undefined" ? { Blob } : {},
-    ...typeof URL !== "undefined" ? { URL } : {},
-    // 事件侦听仅绑定到真实 window，便于少量需要的全局监听
-    addEventListener: addEventListener.bind(window),
-    // 安全的 window.open 代理
-    open: safeOpen,
-    // 安全的 location 代理
-    location: safeLocation,
-    ...extra || {}
-  };
-  const target = /* @__PURE__ */ Object.create(null);
-  return new Proxy(target, {
-    get(t, prop) {
-      if (typeof prop !== "string") {
-        return Reflect.get(t, prop);
-      }
-      if (prop in allowedGlobals) return allowedGlobals[prop];
-      if (Object.prototype.hasOwnProperty.call(t, prop)) return t[prop];
-      if (isAllowedDynamicWindowKey(prop)) {
-        const v = window[prop];
-        if (typeof v === "function") return v.bind(window);
-        return v;
-      }
-      throw new Error(`Access to global property "${prop}" is not allowed.`);
-    },
-    set(t, prop, value) {
-      if (typeof prop !== "string") {
-        Reflect.set(t, prop, value);
-        return true;
-      }
-      if (prop in allowedGlobals) {
-        throw new Error(`Mutation of global property "${prop}" is not allowed.`);
-      }
-      t[prop] = value;
-      return true;
-    },
-    has(t, prop) {
-      if (typeof prop !== "string") return Reflect.has(t, prop);
-      if (prop in allowedGlobals) return true;
-      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
-      if (isAllowedDynamicWindowKey(prop)) return true;
-      return false;
-    }
-  });
-}
-__name(createSafeWindow, "createSafeWindow");
-function createSafeDocument(extra) {
-  const allowed = {
-    createElement: document.createElement.bind(document),
-    querySelector: document.querySelector.bind(document),
-    querySelectorAll: document.querySelectorAll.bind(document),
-    ...extra || {}
-  };
-  const target = /* @__PURE__ */ Object.create(null);
-  return new Proxy(target, {
-    get(t, prop) {
-      if (typeof prop !== "string") {
-        return Reflect.get(t, prop);
-      }
-      if (prop in allowed) return allowed[prop];
-      if (Object.prototype.hasOwnProperty.call(t, prop)) return t[prop];
-      if (isAllowedDynamicDocumentKey(prop)) {
-        const v = document[prop];
-        if (typeof v === "function") return v.bind(document);
-        return v;
-      }
-      throw new Error(`Access to document property "${prop}" is not allowed.`);
-    },
-    set(t, prop, value) {
-      if (typeof prop !== "string") {
-        Reflect.set(t, prop, value);
-        return true;
-      }
-      if (prop in allowed) {
-        throw new Error(`Mutation of document property "${prop}" is not allowed.`);
-      }
-      t[prop] = value;
-      return true;
-    },
-    has(t, prop) {
-      if (typeof prop !== "string") return Reflect.has(t, prop);
-      if (prop in allowed) return true;
-      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
-      if (isAllowedDynamicDocumentKey(prop)) return true;
-      return false;
-    }
-  });
-}
-__name(createSafeDocument, "createSafeDocument");
-function createSafeNavigator(extra) {
-  var _a;
-  const nav = typeof window !== "undefined" && window.navigator || void 0;
-  const clipboard = {};
-  const writeText = (_a = nav == null ? void 0 : nav.clipboard) == null ? void 0 : _a.writeText;
-  if (typeof writeText === "function") {
-    clipboard.writeText = writeText.bind(nav.clipboard);
-  }
-  const allowed = {
-    clipboard
-  };
-  Object.defineProperty(allowed, "onLine", {
-    get: /* @__PURE__ */ __name(() => !!(nav == null ? void 0 : nav.onLine), "get"),
-    enumerable: true,
-    configurable: false
-  });
-  Object.defineProperty(allowed, "language", {
-    get: /* @__PURE__ */ __name(() => nav == null ? void 0 : nav.language, "get"),
-    enumerable: true,
-    configurable: false
-  });
-  Object.defineProperty(allowed, "languages", {
-    get: /* @__PURE__ */ __name(() => (nav == null ? void 0 : nav.languages) ? [...nav.languages] : void 0, "get"),
-    enumerable: true,
-    configurable: false
-  });
-  Object.assign(allowed, extra || {});
-  return new Proxy(
-    {},
-    {
-      get(_t, prop) {
-        if (prop in allowed) return allowed[prop];
-        throw new Error(`Access to navigator property "${String(prop)}" is not allowed.`);
-      }
-    }
-  );
-}
-__name(createSafeNavigator, "createSafeNavigator");
-function createSafeRunJSGlobals(extraGlobals) {
-  const globals = {};
-  try {
-    const navigator = createSafeNavigator();
-    globals.navigator = navigator;
-    try {
-      globals.window = createSafeWindow({ navigator });
-    } catch {
-    }
-  } catch {
-  }
-  try {
-    globals.document = createSafeDocument();
-  } catch {
-  }
-  return extraGlobals ? { ...globals, ...extraGlobals } : globals;
-}
-__name(createSafeRunJSGlobals, "createSafeRunJSGlobals");
-async function runjsWithSafeGlobals(ctx, code, options, extraGlobals) {
-  if (!ctx || typeof ctx !== "object" && typeof ctx !== "function") return void 0;
-  const runjs = ctx.runjs;
-  if (typeof runjs !== "function") return void 0;
-  return ctx.runjs(
-    code,
-    createSafeRunJSGlobals(extraGlobals),
-    options
-  );
-}
-__name(runjsWithSafeGlobals, "runjsWithSafeGlobals");
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  __resetRunJSSafeGlobalsRegistryForTests,
-  createSafeDocument,
-  createSafeNavigator,
-  createSafeRunJSGlobals,
-  createSafeWindow,
-  registerRunJSSafeDocumentGlobals,
-  registerRunJSSafeWindowGlobals,
-  runjsWithSafeGlobals
-});

package/src/utils/__tests__/runjsRequireAsyncAutoWhitelist.test.ts

@@ -1,38 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { beforeEach, describe, expect, it } from 'vitest';
-import { runjsRequireAsync } from '../runjsModuleLoader';
-import { __resetRunJSSafeGlobalsRegistryForTests, createSafeWindow } from '../safeGlobals';
-
-beforeEach(() => {
-  __resetRunJSSafeGlobalsRegistryForTests();
-});
-
-describe('runjsRequireAsync auto whitelist', () => {
-  it('should allow safeWindow to access globals introduced during requireAsync', async () => {
-    const key = '__nb_require_async_added_global__';
-    delete (window as any)[key];
-
-    const safeWin: any = createSafeWindow();
-    expect(() => safeWin[key]).toThrow(/not allowed/);
-
-    const requirejs: any = (deps: string[], onLoad: (...args: any[]) => void) => {
-      // Simulate a remote library attaching itself to the real window.
-      (window as any)[key] = { ok: true };
-      onLoad(undefined);
-    };
-
-    await runjsRequireAsync(requirejs, 'https://example.com/fake-lib.js');
-
-    expect(safeWin[key]).toEqual({ ok: true });
-
-    delete (window as any)[key];
-  });
-});