@nocobase/flow-engine 2.2.0-alpha.1 → 2.2.0-alpha.2

package/lib/utils/resolveRunJSObjectValues.js

@@ -31,8 +31,8 @@ __export(resolveRunJSObjectValues_exports, {
 });
 module.exports = __toCommonJS(resolveRunJSObjectValues_exports);
 var import_runjsValue = require("./runjsValue");
-var import_safeGlobals = require("./safeGlobals");
 async function resolveRunJSObjectValues(ctx, raw) {
+  var _a;
   const out = {};
   if (!raw || typeof raw !== "object") return out;
   if (Array.isArray(raw)) return out;
@@ -41,7 +41,8 @@ async function resolveRunJSObjectValues(ctx, raw) {
     if ((0, import_runjsValue.isRunJSValue)(value)) {
       const { code, version } = (0, import_runjsValue.normalizeRunJSValue)(value);
       if (!code.trim()) continue;
-      const ret = await (0, import_safeGlobals.runjsWithSafeGlobals)(ctx, code, { version });
+      const runjsCtx = ctx;
+      const ret = await ((_a = runjsCtx == null ? void 0 : runjsCtx.runjs) == null ? void 0 : _a.call(runjsCtx, code, void 0, { version }));
       if (!(ret == null ? void 0 : ret.success)) {
         throw new Error(`RunJS execution failed for "${key}"`);
       }

package/lib/utils/runjsModuleLoader.js

@@ -34,27 +34,6 @@ __export(runjsModuleLoader_exports, {
 module.exports = __toCommonJS(runjsModuleLoader_exports);
 var import_runjsLibs = require("../runjsLibs");
 var import_resolveModuleUrl = require("./resolveModuleUrl");
-var import_safeGlobals = require("./safeGlobals");
-function snapshotOwnKeys(obj) {
-  try {
-    if (!obj || typeof obj !== "object" && typeof obj !== "function") return [];
-    return Object.getOwnPropertyNames(obj);
-  } catch (_) {
-    return [];
-  }
-}
-__name(snapshotOwnKeys, "snapshotOwnKeys");
-function diffAddedKeys(afterKeys, beforeKeys) {
-  if (!afterKeys.length) return [];
-  if (!beforeKeys.length) return [...afterKeys];
-  const beforeSet = new Set(beforeKeys);
-  const added = [];
-  for (const k of afterKeys) {
-    if (!beforeSet.has(k)) added.push(k);
-  }
-  return added;
-}
-__name(diffAddedKeys, "diffAddedKeys");
 async function withRunjsModuleLoadLock(task) {
   const g = globalThis;
   g.__nocobaseRunjsModuleLoadLock = (g.__nocobaseRunjsModuleLoadLock || Promise.resolve()).catch(() => {
@@ -222,8 +201,6 @@ async function prefetchEsmModule(url, options) {
 __name(prefetchEsmModule, "prefetchEsmModule");
 async function runjsRequireAsync(requirejs, url) {
   return await withRunjsModuleLoadLock(async () => {
-    const beforeWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-    const beforeDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
     let result;
     let error;
     try {
@@ -242,13 +219,6 @@ async function runjsRequireAsync(requirejs, url) {
       });
     } catch (e) {
       error = e;
-    } finally {
-      const afterWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-      const afterDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
-      const addedWinKeys = diffAddedKeys(afterWinKeys, beforeWinKeys);
-      const addedDocKeys = diffAddedKeys(afterDocKeys, beforeDocKeys);
-      (0, import_safeGlobals.registerRunJSSafeWindowGlobals)(addedWinKeys);
-      (0, import_safeGlobals.registerRunJSSafeDocumentGlobals)(addedDocKeys);
     }
     if (error) throw error;
     return result;

package/lib/views/ViewNavigation.js

@@ -32,6 +32,7 @@ __export(ViewNavigation_exports, {
 });
 module.exports = __toCommonJS(ViewNavigation_exports);
 var import_reactive = require("../reactive");
+var import_utils = require("../utils");
 function encodeFilterByTk(val) {
   if (val === void 0 || val === null) return "";
   if (val && typeof val === "object" && !Array.isArray(val)) {
@@ -63,6 +64,10 @@ function generatePathnameFromViewParams(viewParams, options = {}) {
       segments.push("view");
     }
     segments.push(viewParam.viewUid);
+    const openViewRouteStateToken = (0, import_utils.encodeOpenViewRouteState)(viewParam.viewUid, viewParam.openViewRouteState);
+    if (openViewRouteStateToken) {
+      segments.push("opts", openViewRouteStateToken);
+    }
     if (viewParam.tabUid) {
       segments.push("tab", viewParam.tabUid);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/flow-engine",
-  "version": "2.2.0-alpha.1",
+  "version": "2.2.0-alpha.2",
   "private": false,
   "description": "A standalone flow engine for NocoBase, managing workflows, models, and actions.",
   "main": "lib/index.js",
@@ -8,8 +8,8 @@
   "dependencies": {
     "@formily/antd-v5": "1.x",
     "@formily/reactive": "2.x",
-    "@nocobase/sdk": "2.2.0-alpha.1",
-    "@nocobase/shared": "2.2.0-alpha.1",
+    "@nocobase/sdk": "2.2.0-alpha.2",
+    "@nocobase/shared": "2.2.0-alpha.2",
     "ahooks": "^3.7.2",
     "axios": "^1.7.0",
     "dayjs": "^1.11.9",
@@ -37,5 +37,5 @@
   ],
   "author": "NocoBase Team",
   "license": "Apache-2.0",
-  "gitHead": "303663aba6c6eefa27e6a6435b4c0352074ec40f"
+  "gitHead": "9dd5224bb8f6c1ac12d766b9f175bdc29bddd845"
 }

package/src/JSRunner.ts

@@ -39,6 +39,117 @@ export function shouldPreprocessRunJSTemplates(
   return options?.version !== 'v2';
 }
 
+const RUNJS_BROWSER_GLOBAL_NAMES = [
+  'fetch',
+  'localStorage',
+  'sessionStorage',
+  'XMLHttpRequest',
+  'WebSocket',
+  'Worker',
+  'SharedWorker',
+  'ServiceWorker',
+  'BroadcastChannel',
+  'EventSource',
+  'indexedDB',
+  'caches',
+  'Function',
+  'eval',
+  'globalThis',
+  'Intl',
+  'Blob',
+  'URL',
+  'location',
+] as const;
+
+export const RUNJS_ALLOWED_BARE_GLOBAL_NAMES = [
+  'ctx',
+  'console',
+  'window',
+  'document',
+  'navigator',
+  'setTimeout',
+  'clearTimeout',
+  'setInterval',
+  'clearInterval',
+  'Array',
+  'ArrayBuffer',
+  'BigInt',
+  'BigInt64Array',
+  'BigUint64Array',
+  'Boolean',
+  'DataView',
+  'Date',
+  'Error',
+  'EvalError',
+  'FinalizationRegistry',
+  'Float32Array',
+  'Float64Array',
+  'Int8Array',
+  'Int16Array',
+  'Int32Array',
+  'Map',
+  'Math',
+  'Number',
+  'Object',
+  'Promise',
+  'Proxy',
+  'RangeError',
+  'ReferenceError',
+  'Reflect',
+  'RegExp',
+  'Set',
+  'String',
+  'Symbol',
+  'SyntaxError',
+  'TypeError',
+  'URIError',
+  'Uint8Array',
+  'Uint8ClampedArray',
+  'Uint16Array',
+  'Uint32Array',
+  'WeakMap',
+  'WeakRef',
+  'WeakSet',
+  'JSON',
+  'decodeURI',
+  'decodeURIComponent',
+  'encodeURI',
+  'encodeURIComponent',
+  'isFinite',
+  'isNaN',
+  'parseFloat',
+  'parseInt',
+  'undefined',
+  'NaN',
+  'Infinity',
+  ...RUNJS_BROWSER_GLOBAL_NAMES,
+] as const;
+
+function collectRunJSBrowserGlobals(providedGlobals: Record<string, unknown> = {}) {
+  const windowGlobal = providedGlobals.window;
+  if (!windowGlobal || typeof windowGlobal !== 'object') {
+    return {};
+  }
+
+  const windowRecord = windowGlobal as Record<string, unknown>;
+  const globals: Record<string, unknown> = {};
+  RUNJS_BROWSER_GLOBAL_NAMES.forEach((name) => {
+    if (Object.prototype.hasOwnProperty.call(providedGlobals, name)) {
+      return;
+    }
+    try {
+      const value = windowRecord[name];
+      if (typeof value === 'undefined') {
+        return;
+      }
+      globals[name] = name === 'fetch' && typeof value === 'function' ? value.bind(windowGlobal) : value;
+    } catch {
+      // Ignore browser globals that cannot be read in the current environment.
+    }
+  });
+  return globals;
+}
+
 // Heuristic: detect likely bare `{{ctx.xxx}}` usage in executable positions (not quoted string literals).
 const BARE_CTX_TEMPLATE_RE = /(^|[=(:,[\s)])(\{\{\s*(ctx(?:\.|\[|\?\.)[^}]*)\s*\}\})/m;
 
@@ -98,31 +209,7 @@ export class JSRunner {
     };
 
     const providedGlobals = options.globals || {};
-    const liftedGlobals: Record<string, any> = {};
-
-    // Auto-lift selected globals from safe window into top-level sandbox globals
-    // so user code can access them directly (e.g. `new Blob(...)`).
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'Blob')) {
-      try {
-        const blobCtor = (providedGlobals as any).window?.Blob;
-        if (typeof blobCtor !== 'undefined') {
-          liftedGlobals.Blob = blobCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'URL')) {
-      try {
-        const urlCtor = (providedGlobals as any).window?.URL;
-        if (typeof urlCtor !== 'undefined') {
-          liftedGlobals.URL = urlCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
+    const liftedGlobals = collectRunJSBrowserGlobals(providedGlobals);
 
     this.globals = {
       console,

package/src/__tests__/JSRunner.test.ts

@@ -9,7 +9,6 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { JSRunner, shouldPreprocessRunJSTemplates } from '../JSRunner';
-import { createSafeWindow } from '../utils';
 
 describe('JSRunner', () => {
   let originalSearch: string;
@@ -68,7 +67,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -84,7 +83,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         Blob: explicitBlob,
       },
     });
@@ -97,7 +96,7 @@ describe('JSRunner', () => {
   it('auto-lifts URL from injected window to top-level globals', async () => {
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -114,7 +113,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         URL: explicitURL,
       },
     });

package/src/__tests__/flowContext.test.ts

@@ -14,6 +14,8 @@ import { FlowEngine } from '../flowEngine';
 import { FlowModel } from '../models/flowModel';
 import { RunJSContextRegistry } from '../runjs-context/registry';
 import { setupRunJSContexts } from '../runjs-context/setup';
+import { createViewScopedEngine } from '../ViewScopedFlowEngine';
+import { DATA_SOURCE_DIRTY_EVENT } from '../views/viewEvents';
 
 describe('FlowContext properties and methods', () => {
   it('should return static property value', () => {
@@ -177,6 +179,49 @@ describe('FlowContext properties and methods', () => {
     });
   });
 
+  it('should expose current role as a top-level variable', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: 'admin' } } });
+
+    expect(ctx.role).toBe('admin');
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toBe('admin');
+
+    const roleNode = ctx.getPropertyMetaTree().find((node) => node.name === 'role');
+    expect(roleNode).toMatchObject({
+      name: 'role',
+      title: '{{t("Current role")}}',
+      paths: ['role'],
+    });
+  });
+
+  it('should expose actual role names for union role mode', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: '__union__' } } });
+    ctx.defineProperty('user', {
+      value: {
+        roles: [
+          { name: 'admin', title: 'Admin' },
+          { name: 'member', title: 'Member' },
+        ],
+      },
+    });
+
+    expect(ctx.role).toEqual(['admin', 'member']);
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toEqual(['admin', 'member']);
+  });
+
+  it('should expose an empty role list for union role mode without user roles', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: '__union__' } } });
+    ctx.defineProperty('user', { value: {} });
+
+    expect(ctx.role).toEqual([]);
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toEqual([]);
+  });
+
   it('should throw sync error in get', () => {
     const ctx = new FlowContext();
     ctx.defineProperty('error', {
@@ -1386,6 +1431,92 @@ describe('FlowEngine context', () => {
     expect(engine.context.appName).toBe('NocoBase');
   });
 
+  it('ctx.api should return a dirty-aware wrapper for static api properties', async () => {
+    const engine = new FlowEngine();
+    const update = vi.fn(async () => ({ data: { data: { id: 1 } } }));
+    const api = {
+      auth: { locale: 'zh-CN' },
+      request: vi.fn(async () => ({ data: { ok: true } })),
+      resource: vi.fn(() => ({ update })),
+    };
+    engine.context.defineProperty('api', { value: api });
+
+    await engine.context.api.resource('posts').update({ filterByTk: 1, values: { title: 't' } });
+
+    expect(update).toHaveBeenCalledTimes(1);
+    expect(engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(engine.context.api).toBe(engine.context.api);
+  });
+
+  it('ctx.api should stay dirty-aware when resolved from a scoped context delegate', async () => {
+    const root = new FlowEngine();
+    const scoped = createViewScopedEngine(root);
+    const update = vi.fn(async () => ({ data: { data: { id: 1 } } }));
+    root.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request: vi.fn(async () => ({ data: { ok: true } })),
+        resource: vi.fn(() => ({ update })),
+      },
+    });
+
+    await scoped.context.api.resource('posts').update({ filterByTk: 1, values: { title: 't' } });
+
+    expect(update).toHaveBeenCalledTimes(1);
+    expect(root.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(scoped.context.engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+  });
+
+  it('ctx.request should use the dirty-aware api wrapper', async () => {
+    const engine = new FlowEngine();
+    const request = vi.fn(async () => ({ data: { ok: true } }));
+    engine.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request,
+        resource: vi.fn(),
+      },
+    });
+
+    await engine.context.request({
+      resource: 'posts',
+      action: 'update',
+      headers: { 'X-Data-Source': 'analytics' },
+      params: { filterByTk: 1 },
+    } as any);
+
+    expect(request).toHaveBeenCalledTimes(1);
+    expect(engine.getDataSourceDirtyVersion('analytics', 'posts')).toBe(1);
+  });
+
+  it('ctx.request should use the caller context when resolved through a scoped delegate', async () => {
+    const root = new FlowEngine();
+    const scoped = createViewScopedEngine(root);
+    const callerCtx = new FlowContext();
+    const dirtyEvents: Array<{ dataSourceKey: string; resourceNames: string[] }> = [];
+    const request = vi.fn(async () => ({ data: { ok: true } }));
+    root.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request,
+        resource: vi.fn(),
+      },
+    });
+    callerCtx.addDelegate(scoped.context);
+    scoped.context.engine.emitter.on(DATA_SOURCE_DIRTY_EVENT, (event) => dirtyEvents.push(event));
+
+    await callerCtx.request({
+      resource: 'posts',
+      action: 'update',
+      params: { filterByTk: 1 },
+    } as any);
+
+    expect(request).toHaveBeenCalledTimes(1);
+    expect(root.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(scoped.context.engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(dirtyEvents).toEqual([{ dataSourceKey: 'main', resourceNames: ['posts'] }]);
+  });
+
   it('ctx.sql should resolve template variables from caller context in delegate chain', async () => {
     const engine = new FlowEngine();
     const request = vi.fn(async () => ({ data: { data: [] } }));

package/src/__tests__/flowEngine.dataSourceDirty.test.ts

@@ -11,6 +11,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { FlowEngine } from '../flowEngine';
 import { MultiRecordResource } from '../resources/multiRecordResource';
 import { SingleRecordResource } from '../resources/singleRecordResource';
+import { DATA_SOURCE_DIRTY_EVENT } from '../views/viewEvents';
 
 describe('FlowEngine dataSource dirty registry', () => {
   it('tracks versions per dataSourceKey + resourceName', () => {
@@ -60,4 +61,54 @@ describe('FlowEngine dataSource dirty registry', () => {
     // plus root collection (safety)
     expect(markSpy).toHaveBeenCalledWith('main', 'users');
   });
+
+  it('marks dirty once for record write helpers when using the dirty-aware context api', async () => {
+    const engine = new FlowEngine();
+    const request = vi.fn(async () => ({ data: { data: { id: 1 }, meta: {} } }));
+    const dirtyEvents: Array<{ dataSourceKey: string; resourceNames: string[] }> = [];
+    engine.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request,
+        resource: vi.fn(),
+      },
+    });
+    engine.emitter.on(DATA_SOURCE_DIRTY_EVENT, (event) => dirtyEvents.push(event));
+
+    const multi = engine.createResource(MultiRecordResource);
+    multi.setDataSourceKey('main').setResourceName('posts');
+    await multi.create({ title: 't' } as any, { refresh: false });
+
+    expect(request).toHaveBeenCalledTimes(1);
+    expect(engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(dirtyEvents).toEqual([{ dataSourceKey: 'main', resourceNames: ['posts'] }]);
+
+    const single = engine.createResource(SingleRecordResource);
+    single.setDataSourceKey('main').setResourceName('posts').setFilterByTk(1);
+    await single.save({ title: 'u' } as any, { refresh: false });
+
+    expect(request).toHaveBeenCalledTimes(2);
+    expect(engine.getDataSourceDirtyVersion('main', 'posts')).toBe(2);
+    expect(dirtyEvents).toEqual([
+      { dataSourceKey: 'main', resourceNames: ['posts'] },
+      { dataSourceKey: 'main', resourceNames: ['posts'] },
+    ]);
+  });
+
+  it('still marks dirty for direct runAction writes', async () => {
+    const engine = new FlowEngine();
+    engine.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request: vi.fn(async () => ({ data: { data: { id: 1 }, meta: {} } })),
+        resource: vi.fn(),
+      },
+    });
+
+    const multi = engine.createResource(MultiRecordResource);
+    multi.setDataSourceKey('main').setResourceName('posts');
+    await multi.runAction('create', { data: { title: 't' } });
+
+    expect(engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+  });
 });

package/src/__tests__/flowI18n.test.ts

@@ -17,6 +17,17 @@ describe('FlowI18n', () => {
     expect(i18n.translate("{{ t('Hello') }}")).toBe('你好');
   });
 
+  it('keeps embedded quotes of a different type inside the key', () => {
+    // A single-quoted key whose text contains double quotes (and vice versa) must not be truncated at the first inner
+    // quote.
+    const key = 'Unlike "Post-action event", it listens for data changes.';
+    const table: Record<string, string> = { [key]: '与“操作后事件”不同，它监听数据变动。' };
+    const i18n = new FlowI18n({ i18n: { t: (k: string) => table[k] ?? k } });
+
+    expect(i18n.translate(`{{t('${key}', { ns: "workflow" })}}`)).toBe(table[key]);
+    expect(i18n.translate(`{{t("It's here", { ns: "workflow" })}}`)).toBe("It's here");
+  });
+
   it('template compile ignores malformed options', () => {
     const spy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
     const i18n = new FlowI18n({ i18n: { t: (k: string) => k } });

package/src/__tests__/flowModel.openView.navigation.test.ts

@@ -104,4 +104,32 @@ describe('FlowModelContext.openView - navigation enforcement', () => {
     expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
     expect(child.dispatchEvent.mock.calls[0][0]).toBe('click');
   });
+
+  it('inherits current model input args when opening an external popup', async () => {
+    const { parent, child } = setup();
+    parent['getInputArgs'] = vi.fn(() => ({
+      filterByTk: 2,
+      sourceId: 10,
+      defaultInputKeys: ['filterByTk', 'sourceId'],
+    }));
+
+    await (parent.context as any).openView('child-uid', { mode: 'dialog' });
+
+    expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
+    expect(child.dispatchEvent.mock.calls[0][1]).toMatchObject({
+      mode: 'dialog',
+      filterByTk: 2,
+      sourceId: 10,
+    });
+    expect(child.dispatchEvent.mock.calls[0][1]).not.toHaveProperty('defaultInputKeys');
+  });
+
+  it('does not debounce external popup dispatches', async () => {
+    const { parent, child } = setup();
+
+    await (parent.context as any).openView('child-uid', { mode: 'dialog', filterByTk: 1 });
+
+    expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
+    expect(child.dispatchEvent.mock.calls[0][2]).toBeUndefined();
+  });
 });

package/src/__tests__/flowSettings.test.ts

@@ -557,6 +557,78 @@ describe('FlowSettings', () => {
     });
   });
 
+  describe('Dynamic Flow Source Providers', () => {
+    test('should return current model as the default dynamic flow source', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+
+      expect(sources).toHaveLength(1);
+      expect(sources[0].key).toBe('self');
+      expect(sources[0].label).toBe('Current block');
+      expect(sources[0].model).toBe(model);
+    });
+
+    test('should register, resolve, and dispose dynamic flow source providers', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+      const target = new FlowModel({ uid: 'target-model', flowEngine: engine });
+
+      const dispose = flowSettings.registerDynamicFlowSourceProvider({
+        key: 'test-provider',
+        visible: (m) => m.uid === model.uid,
+        getSources: () => [{ key: 'target', label: 'Target model', model: target, sort: 10 }],
+      });
+
+      expect(flowSettings.hasDynamicFlowSourceProvider(model)).toBe(true);
+      expect(flowSettings.hasDynamicFlowSourceProvider(target)).toBe(false);
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+      expect(sources.map((source) => source.key)).toEqual(['self', 'target']);
+
+      dispose();
+
+      expect(flowSettings.hasDynamicFlowSourceProvider(model)).toBe(false);
+      await expect(flowSettings.getDynamicFlowSources(model)).resolves.toHaveLength(1);
+    });
+
+    test('should skip duplicate dynamic flow source keys and model uids', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+      const target = new FlowModel({ uid: 'target-model', flowEngine: engine });
+
+      flowSettings.registerDynamicFlowSourceProvider({
+        key: 'test-provider',
+        getSources: () => [
+          { key: 'target', label: 'Target model', model: target },
+          { key: 'target', label: 'Duplicate key', model: new FlowModel({ uid: 'other-model', flowEngine: engine }) },
+          { key: 'duplicate-uid', label: 'Duplicate uid', model: target },
+        ],
+      });
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+
+      expect(sources.map((source) => source.key)).toEqual(['self', 'target']);
+    });
+
+    test('should ignore failing dynamic flow source providers', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+
+      flowSettings.registerDynamicFlowSourceProvider({
+        key: 'failing-provider',
+        getSources: () => {
+          throw new Error('provider failed');
+        },
+      });
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+
+      expect(sources.map((source) => source.key)).toEqual(['self']);
+      expect(consoleSpy.warn).toHaveBeenCalledWith(
+        "FlowSettings: Dynamic flow source provider 'failing-provider' failed.",
+        expect.any(Error),
+      );
+    });
+  });
+
   describe('Step Settings Dialog', () => {
     test('should call openStepSettingsDialog with correct parameters', async () => {
       const { openStepSettingsDialog } = await import('../components/settings/wrappers/contextual/StepSettingsDialog');