@nocobase/flow-engine 2.2.0-beta.1 → 2.2.0-beta.11

package/lib/utils/index.js

@@ -33,6 +33,7 @@ __export(utils_exports, {
   FlowExitAllException: () => import_exceptions.FlowExitAllException,
   FlowExitException: () => import_exceptions.FlowExitException,
   MENU_KEYS: () => import_constants.MENU_KEYS,
+  RUNJS_OPEN_VIEW_ROUTE_STATE: () => import_openViewRouteState.RUNJS_OPEN_VIEW_ROUTE_STATE,
   buildRecordMeta: () => import_variablesParams.buildRecordMeta,
   clearAutoFlowError: () => import_autoFlowError.clearAutoFlowError,
   collectContextParamsForTemplate: () => import_variablesParams.collectContextParamsForTemplate,
@@ -42,15 +43,14 @@ __export(utils_exports, {
   createCollectionContextMeta: () => import_createCollectionContextMeta.createCollectionContextMeta,
   createCurrentRecordMetaFactory: () => import_variablesParams.createCurrentRecordMetaFactory,
   createEphemeralContext: () => import_createEphemeralContext.createEphemeralContext,
+  createOpenViewRouteState: () => import_openViewRouteState.createOpenViewRouteState,
   createRecordMetaFactory: () => import_variablesParams.createRecordMetaFactory,
   createRecordResolveOnServerWithLocal: () => import_variablesParams.createRecordResolveOnServerWithLocal,
-  createSafeDocument: () => import_safeGlobals.createSafeDocument,
-  createSafeNavigator: () => import_safeGlobals.createSafeNavigator,
-  createSafeRunJSGlobals: () => import_safeGlobals.createSafeRunJSGlobals,
-  createSafeWindow: () => import_safeGlobals.createSafeWindow,
   decodeBase64Url: () => import_dateVariable.decodeBase64Url,
+  decodeOpenViewRouteState: () => import_openViewRouteState.decodeOpenViewRouteState,
   defineAction: () => import_flow_definitions.defineAction,
   encodeBase64Url: () => import_dateVariable.encodeBase64Url,
+  encodeOpenViewRouteState: () => import_openViewRouteState.encodeOpenViewRouteState,
   escapeT: () => import_translation.escapeT,
   extractPropertyPath: () => import_context.extractPropertyPath,
   extractUsedVariableNames: () => import_variablesParams.extractUsedVariableNames,
@@ -66,6 +66,7 @@ __export(utils_exports, {
   isCtxDateExpression: () => import_dateVariable.isCtxDateExpression,
   isCtxDatePathPrefix: () => import_dateVariable.isCtxDatePathPrefix,
   isInheritedFrom: () => import_inheritance.isInheritedFrom,
+  isOpenViewRouteStateToken: () => import_openViewRouteState.isOpenViewRouteStateToken,
   isRunJSValue: () => import_runjsValue.isRunJSValue,
   isVariableExpression: () => import_context.isVariableExpression,
   normalizeRunJSValue: () => import_runjsValue.normalizeRunJSValue,
@@ -84,7 +85,6 @@ __export(utils_exports, {
   resolveStepDisabledInSettings: () => import_schema_utils.resolveStepDisabledInSettings,
   resolveStepUiSchema: () => import_schema_utils.resolveStepUiSchema,
   resolveUiMode: () => import_schema_utils.resolveUiMode,
-  runjsWithSafeGlobals: () => import_safeGlobals.runjsWithSafeGlobals,
   serializeCtxDateValue: () => import_dateVariable.serializeCtxDateValue,
   setAutoFlowError: () => import_autoFlowError.setAutoFlowError,
   setupRuntimeContextSteps: () => import_setupRuntimeContextSteps.setupRuntimeContextSteps,
@@ -107,8 +107,8 @@ var import_variablesParams = require("./variablesParams");
 var import_context = require("./context");
 var import_autoFlowError = require("./autoFlowError");
 var import_parsePathnameToViewParams = require("./parsePathnameToViewParams");
+var import_openViewRouteState = require("./openViewRouteState");
 var import_dateVariable = require("./dateVariable");
-var import_safeGlobals = require("./safeGlobals");
 var import_runjsValue = require("./runjsValue");
 var import_resolveRunJSObjectValues = require("./resolveRunJSObjectValues");
 var import_runjsTemplateCompat = require("./runjsTemplateCompat");
@@ -126,6 +126,7 @@ var import_randomId = require("./randomId");
   FlowExitAllException,
   FlowExitException,
   MENU_KEYS,
+  RUNJS_OPEN_VIEW_ROUTE_STATE,
   buildRecordMeta,
   clearAutoFlowError,
   collectContextParamsForTemplate,
@@ -135,15 +136,14 @@ var import_randomId = require("./randomId");
   createCollectionContextMeta,
   createCurrentRecordMetaFactory,
   createEphemeralContext,
+  createOpenViewRouteState,
   createRecordMetaFactory,
   createRecordResolveOnServerWithLocal,
-  createSafeDocument,
-  createSafeNavigator,
-  createSafeRunJSGlobals,
-  createSafeWindow,
   decodeBase64Url,
+  decodeOpenViewRouteState,
   defineAction,
   encodeBase64Url,
+  encodeOpenViewRouteState,
   escapeT,
   extractPropertyPath,
   extractUsedVariableNames,
@@ -159,6 +159,7 @@ var import_randomId = require("./randomId");
   isCtxDateExpression,
   isCtxDatePathPrefix,
   isInheritedFrom,
+  isOpenViewRouteStateToken,
   isRunJSValue,
   isVariableExpression,
   normalizeRunJSValue,
@@ -177,7 +178,6 @@ var import_randomId = require("./randomId");
   resolveStepDisabledInSettings,
   resolveStepUiSchema,
   resolveUiMode,
-  runjsWithSafeGlobals,
   serializeCtxDateValue,
   setAutoFlowError,
   setupRuntimeContextSteps,

package/lib/utils/loadedPageCache.d.ts

@@ -17,6 +17,7 @@ type DirtyKeyOptions = {
 export declare const createLoadedPageCache: () => {
     getDirtyKeyForModel(model?: FlowModel | null, options?: DirtyKeyOptions): string | undefined;
     markDirty(key?: string): void;
+    markDirtyForOptions(options?: LoadedPageOptions): void;
     shouldBypass(options?: LoadedPageOptions, isFlowSettingsEnabled?: () => boolean): boolean;
     clear(options?: LoadedPageOptions): void;
     mountModelToParent: <T extends FlowModel<import("..").DefaultStructure> = FlowModel<import("..").DefaultStructure>>(model: T, forceReplace?: boolean) => T;

package/lib/utils/loadedPageCache.js

@@ -113,6 +113,12 @@ const createLoadedPageCache = /* @__PURE__ */ __name(() => {
         dirtyKeys.add(key);
       }
     },
+    markDirtyForOptions(options) {
+      const key = getLoadedPageKey(options);
+      if (key) {
+        dirtyKeys.add(key);
+      }
+    },
     shouldBypass(options, isFlowSettingsEnabled) {
       const key = getLoadedPageKey(options);
       if (!key || !dirtyKeys.has(key)) {

package/lib/utils/openViewRouteState.d.ts

@@ -0,0 +1,28 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+declare const OPEN_VIEW_ROUTE_MODES: readonly ["drawer", "dialog", "embed"];
+declare const OPEN_VIEW_ROUTE_SIZES: readonly ["small", "medium", "large"];
+export type OpenViewRouteMode = (typeof OPEN_VIEW_ROUTE_MODES)[number];
+export type OpenViewRouteSize = (typeof OPEN_VIEW_ROUTE_SIZES)[number];
+export type OpenViewRouteState = {
+    mode?: OpenViewRouteMode;
+    size?: OpenViewRouteSize;
+};
+export declare const RUNJS_OPEN_VIEW_ROUTE_STATE: unique symbol;
+export declare function createOpenViewRouteState(input?: {
+    mode?: unknown;
+    size?: unknown;
+}): OpenViewRouteState | undefined;
+export declare function isOpenViewRouteStateToken(value: unknown): value is string;
+export declare function encodeOpenViewRouteState(viewUid: string, input?: {
+    mode?: unknown;
+    size?: unknown;
+}): string;
+export declare function decodeOpenViewRouteState(viewUid: string, token: unknown): OpenViewRouteState;
+export {};

package/lib/utils/openViewRouteState.js

@@ -0,0 +1,125 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var openViewRouteState_exports = {};
+__export(openViewRouteState_exports, {
+  RUNJS_OPEN_VIEW_ROUTE_STATE: () => RUNJS_OPEN_VIEW_ROUTE_STATE,
+  createOpenViewRouteState: () => createOpenViewRouteState,
+  decodeOpenViewRouteState: () => decodeOpenViewRouteState,
+  encodeOpenViewRouteState: () => encodeOpenViewRouteState,
+  isOpenViewRouteStateToken: () => isOpenViewRouteStateToken
+});
+module.exports = __toCommonJS(openViewRouteState_exports);
+const OPEN_VIEW_ROUTE_MODES = ["drawer", "dialog", "embed"];
+const OPEN_VIEW_ROUTE_SIZES = ["small", "medium", "large"];
+const OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+const OPEN_VIEW_ROUTE_STATE_TOKEN_LENGTH = 8;
+const RUNJS_OPEN_VIEW_ROUTE_STATE = Symbol.for("nocobase.runjs.openViewRouteState");
+function isOpenViewRouteMode(value) {
+  return typeof value === "string" && OPEN_VIEW_ROUTE_MODES.includes(value);
+}
+__name(isOpenViewRouteMode, "isOpenViewRouteMode");
+function isOpenViewRouteSize(value) {
+  return typeof value === "string" && OPEN_VIEW_ROUTE_SIZES.includes(value);
+}
+__name(isOpenViewRouteSize, "isOpenViewRouteSize");
+function createOpenViewRouteState(input) {
+  const state = {};
+  if (isOpenViewRouteMode(input == null ? void 0 : input.mode)) {
+    state.mode = input.mode;
+  }
+  if (isOpenViewRouteSize(input == null ? void 0 : input.size)) {
+    state.size = input.size;
+  }
+  return state.mode || state.size ? state : void 0;
+}
+__name(createOpenViewRouteState, "createOpenViewRouteState");
+function hashString(value) {
+  let hash = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+}
+__name(hashString, "hashString");
+function stateToCode(state) {
+  const modeIndex = state.mode ? OPEN_VIEW_ROUTE_MODES.indexOf(state.mode) + 1 : 0;
+  const sizeIndex = state.size ? OPEN_VIEW_ROUTE_SIZES.indexOf(state.size) + 1 : 0;
+  const code = modeIndex * 4 + sizeIndex;
+  return code > 0 ? code : void 0;
+}
+__name(stateToCode, "stateToCode");
+function codeToState(code) {
+  const modeIndex = Math.floor(code / 4);
+  const sizeIndex = code % 4;
+  return createOpenViewRouteState({
+    mode: modeIndex ? OPEN_VIEW_ROUTE_MODES[modeIndex - 1] : void 0,
+    size: sizeIndex ? OPEN_VIEW_ROUTE_SIZES[sizeIndex - 1] : void 0
+  });
+}
+__name(codeToState, "codeToState");
+function tokenForCode(viewUid, code) {
+  let seed = hashString(`${viewUid}:${code}`);
+  let token = "";
+  for (let i = 0; i < OPEN_VIEW_ROUTE_STATE_TOKEN_LENGTH; i++) {
+    seed = Math.imul(seed ^ code + i * 17, 16777619) >>> 0;
+    token += OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET[seed % OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET.length];
+  }
+  return token;
+}
+__name(tokenForCode, "tokenForCode");
+function isOpenViewRouteStateToken(value) {
+  return typeof value === "string" && value.length === OPEN_VIEW_ROUTE_STATE_TOKEN_LENGTH && [...value].every((char) => OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET.includes(char));
+}
+__name(isOpenViewRouteStateToken, "isOpenViewRouteStateToken");
+function encodeOpenViewRouteState(viewUid, input) {
+  const state = createOpenViewRouteState(input);
+  const code = state ? stateToCode(state) : void 0;
+  return code ? tokenForCode(viewUid, code) : void 0;
+}
+__name(encodeOpenViewRouteState, "encodeOpenViewRouteState");
+function decodeOpenViewRouteState(viewUid, token) {
+  if (!isOpenViewRouteStateToken(token)) {
+    return void 0;
+  }
+  for (let code = 1; code < 16; code++) {
+    if (tokenForCode(viewUid, code) === token) {
+      return codeToState(code);
+    }
+  }
+  return void 0;
+}
+__name(decodeOpenViewRouteState, "decodeOpenViewRouteState");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RUNJS_OPEN_VIEW_ROUTE_STATE,
+  createOpenViewRouteState,
+  decodeOpenViewRouteState,
+  encodeOpenViewRouteState,
+  isOpenViewRouteStateToken
+});

package/lib/utils/parsePathnameToViewParams.d.ts

@@ -6,6 +6,7 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+import { type OpenViewRouteState } from './openViewRouteState';
 export interface ViewParam {
     /** 视图唯一标识符，一般为某个 Model 实例的 uid */
     viewUid: string;
@@ -15,6 +16,8 @@ export interface ViewParam {
     filterByTk?: string | Record<string, string | number>;
     /** source Id */
     sourceId?: string;
+    /** RunJS ctx.openView runtime display overrides decoded from URL. */
+    openViewRouteState?: OpenViewRouteState;
 }
 export interface ParsePathnameToViewParamsOptions {
     rootPrefix?: string;

package/lib/utils/parsePathnameToViewParams.js

@@ -30,6 +30,7 @@ __export(parsePathnameToViewParams_exports, {
   parsePathnameToViewParams: () => parsePathnameToViewParams
 });
 module.exports = __toCommonJS(parsePathnameToViewParams_exports);
+var import_openViewRouteState = require("./openViewRouteState");
 const normalizePathname = /* @__PURE__ */ __name((pathname) => {
   if (!pathname || pathname === "/") {
     return "/";
@@ -77,7 +78,23 @@ const parsePathnameToViewParams = /* @__PURE__ */ __name((pathname, options = {}
       } else {
         break;
       }
-    } else if (currentView && i + 1 < segments.length) {
+    } else if (currentView) {
+      if (segment === "opts") {
+        if (i + 1 < segments.length) {
+          const routeState = (0, import_openViewRouteState.decodeOpenViewRouteState)(currentView.viewUid, segments[i + 1]);
+          if (routeState) {
+            currentView.openViewRouteState = routeState;
+          }
+          i += 2;
+        } else {
+          i++;
+        }
+        continue;
+      }
+      if (i + 1 >= segments.length) {
+        i++;
+        continue;
+      }
       const rawValue = segments[i + 1];
       let decoded = rawValue;
       try {

package/lib/utils/resolveRunJSObjectValues.js

@@ -31,8 +31,8 @@ __export(resolveRunJSObjectValues_exports, {
 });
 module.exports = __toCommonJS(resolveRunJSObjectValues_exports);
 var import_runjsValue = require("./runjsValue");
-var import_safeGlobals = require("./safeGlobals");
 async function resolveRunJSObjectValues(ctx, raw) {
+  var _a;
   const out = {};
   if (!raw || typeof raw !== "object") return out;
   if (Array.isArray(raw)) return out;
@@ -41,7 +41,8 @@ async function resolveRunJSObjectValues(ctx, raw) {
     if ((0, import_runjsValue.isRunJSValue)(value)) {
       const { code, version } = (0, import_runjsValue.normalizeRunJSValue)(value);
       if (!code.trim()) continue;
-      const ret = await (0, import_safeGlobals.runjsWithSafeGlobals)(ctx, code, { version });
+      const runjsCtx = ctx;
+      const ret = await ((_a = runjsCtx == null ? void 0 : runjsCtx.runjs) == null ? void 0 : _a.call(runjsCtx, code, void 0, { version }));
       if (!(ret == null ? void 0 : ret.success)) {
         throw new Error(`RunJS execution failed for "${key}"`);
       }

package/lib/utils/runjsModuleLoader.js

@@ -34,27 +34,6 @@ __export(runjsModuleLoader_exports, {
 module.exports = __toCommonJS(runjsModuleLoader_exports);
 var import_runjsLibs = require("../runjsLibs");
 var import_resolveModuleUrl = require("./resolveModuleUrl");
-var import_safeGlobals = require("./safeGlobals");
-function snapshotOwnKeys(obj) {
-  try {
-    if (!obj || typeof obj !== "object" && typeof obj !== "function") return [];
-    return Object.getOwnPropertyNames(obj);
-  } catch (_) {
-    return [];
-  }
-}
-__name(snapshotOwnKeys, "snapshotOwnKeys");
-function diffAddedKeys(afterKeys, beforeKeys) {
-  if (!afterKeys.length) return [];
-  if (!beforeKeys.length) return [...afterKeys];
-  const beforeSet = new Set(beforeKeys);
-  const added = [];
-  for (const k of afterKeys) {
-    if (!beforeSet.has(k)) added.push(k);
-  }
-  return added;
-}
-__name(diffAddedKeys, "diffAddedKeys");
 async function withRunjsModuleLoadLock(task) {
   const g = globalThis;
   g.__nocobaseRunjsModuleLoadLock = (g.__nocobaseRunjsModuleLoadLock || Promise.resolve()).catch(() => {
@@ -222,8 +201,6 @@ async function prefetchEsmModule(url, options) {
 __name(prefetchEsmModule, "prefetchEsmModule");
 async function runjsRequireAsync(requirejs, url) {
   return await withRunjsModuleLoadLock(async () => {
-    const beforeWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-    const beforeDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
     let result;
     let error;
     try {
@@ -242,13 +219,6 @@ async function runjsRequireAsync(requirejs, url) {
       });
     } catch (e) {
       error = e;
-    } finally {
-      const afterWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-      const afterDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
-      const addedWinKeys = diffAddedKeys(afterWinKeys, beforeWinKeys);
-      const addedDocKeys = diffAddedKeys(afterDocKeys, beforeDocKeys);
-      (0, import_safeGlobals.registerRunJSSafeWindowGlobals)(addedWinKeys);
-      (0, import_safeGlobals.registerRunJSSafeDocumentGlobals)(addedDocKeys);
     }
     if (error) throw error;
     return result;

package/lib/views/ViewNavigation.js

@@ -32,6 +32,7 @@ __export(ViewNavigation_exports, {
 });
 module.exports = __toCommonJS(ViewNavigation_exports);
 var import_reactive = require("../reactive");
+var import_utils = require("../utils");
 function encodeFilterByTk(val) {
   if (val === void 0 || val === null) return "";
   if (val && typeof val === "object" && !Array.isArray(val)) {
@@ -63,6 +64,10 @@ function generatePathnameFromViewParams(viewParams, options = {}) {
       segments.push("view");
     }
     segments.push(viewParam.viewUid);
+    const openViewRouteStateToken = (0, import_utils.encodeOpenViewRouteState)(viewParam.viewUid, viewParam.openViewRouteState);
+    if (openViewRouteStateToken) {
+      segments.push("opts", openViewRouteStateToken);
+    }
     if (viewParam.tabUid) {
       segments.push("tab", viewParam.tabUid);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/flow-engine",
-  "version": "2.2.0-beta.1",
+  "version": "2.2.0-beta.11",
   "private": false,
   "description": "A standalone flow engine for NocoBase, managing workflows, models, and actions.",
   "main": "lib/index.js",
@@ -8,8 +8,8 @@
   "dependencies": {
     "@formily/antd-v5": "1.x",
     "@formily/reactive": "2.x",
-    "@nocobase/sdk": "2.2.0-beta.1",
-    "@nocobase/shared": "2.2.0-beta.1",
+    "@nocobase/sdk": "2.2.0-beta.11",
+    "@nocobase/shared": "2.2.0-beta.11",
     "ahooks": "^3.7.2",
     "axios": "^1.7.0",
     "dayjs": "^1.11.9",
@@ -37,5 +37,5 @@
   ],
   "author": "NocoBase Team",
   "license": "Apache-2.0",
-  "gitHead": "f82fa9d0c3aa8e00e53dd94e404a312483b4866b"
+  "gitHead": "8dab25af2bb83a81da68158d0dcf836f96103d61"
 }

package/src/JSRunner.ts

@@ -39,6 +39,117 @@ export function shouldPreprocessRunJSTemplates(
   return options?.version !== 'v2';
 }
 
+const RUNJS_BROWSER_GLOBAL_NAMES = [
+  'fetch',
+  'localStorage',
+  'sessionStorage',
+  'XMLHttpRequest',
+  'WebSocket',
+  'Worker',
+  'SharedWorker',
+  'ServiceWorker',
+  'BroadcastChannel',
+  'EventSource',
+  'indexedDB',
+  'caches',
+  'Function',
+  'eval',
+  'globalThis',
+  'Intl',
+  'Blob',
+  'URL',
+  'location',
+] as const;
+
+export const RUNJS_ALLOWED_BARE_GLOBAL_NAMES = [
+  'ctx',
+  'console',
+  'window',
+  'document',
+  'navigator',
+  'setTimeout',
+  'clearTimeout',
+  'setInterval',
+  'clearInterval',
+  'Array',
+  'ArrayBuffer',
+  'BigInt',
+  'BigInt64Array',
+  'BigUint64Array',
+  'Boolean',
+  'DataView',
+  'Date',
+  'Error',
+  'EvalError',
+  'FinalizationRegistry',
+  'Float32Array',
+  'Float64Array',
+  'Int8Array',
+  'Int16Array',
+  'Int32Array',
+  'Map',
+  'Math',
+  'Number',
+  'Object',
+  'Promise',
+  'Proxy',
+  'RangeError',
+  'ReferenceError',
+  'Reflect',
+  'RegExp',
+  'Set',
+  'String',
+  'Symbol',
+  'SyntaxError',
+  'TypeError',
+  'URIError',
+  'Uint8Array',
+  'Uint8ClampedArray',
+  'Uint16Array',
+  'Uint32Array',
+  'WeakMap',
+  'WeakRef',
+  'WeakSet',
+  'JSON',
+  'decodeURI',
+  'decodeURIComponent',
+  'encodeURI',
+  'encodeURIComponent',
+  'isFinite',
+  'isNaN',
+  'parseFloat',
+  'parseInt',
+  'undefined',
+  'NaN',
+  'Infinity',
+  ...RUNJS_BROWSER_GLOBAL_NAMES,
+] as const;
+
+function collectRunJSBrowserGlobals(providedGlobals: Record<string, unknown> = {}) {
+  const windowGlobal = providedGlobals.window;
+  if (!windowGlobal || typeof windowGlobal !== 'object') {
+    return {};
+  }
+
+  const windowRecord = windowGlobal as Record<string, unknown>;
+  const globals: Record<string, unknown> = {};
+  RUNJS_BROWSER_GLOBAL_NAMES.forEach((name) => {
+    if (Object.prototype.hasOwnProperty.call(providedGlobals, name)) {
+      return;
+    }
+    try {
+      const value = windowRecord[name];
+      if (typeof value === 'undefined') {
+        return;
+      }
+      globals[name] = name === 'fetch' && typeof value === 'function' ? value.bind(windowGlobal) : value;
+    } catch {
+      // Ignore browser globals that cannot be read in the current environment.
+    }
+  });
+  return globals;
+}
+
 // Heuristic: detect likely bare `{{ctx.xxx}}` usage in executable positions (not quoted string literals).
 const BARE_CTX_TEMPLATE_RE = /(^|[=(:,[\s)])(\{\{\s*(ctx(?:\.|\[|\?\.)[^}]*)\s*\}\})/m;
 
@@ -98,31 +209,7 @@ export class JSRunner {
     };
 
     const providedGlobals = options.globals || {};
-    const liftedGlobals: Record<string, any> = {};
-
-    // Auto-lift selected globals from safe window into top-level sandbox globals
-    // so user code can access them directly (e.g. `new Blob(...)`).
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'Blob')) {
-      try {
-        const blobCtor = (providedGlobals as any).window?.Blob;
-        if (typeof blobCtor !== 'undefined') {
-          liftedGlobals.Blob = blobCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'URL')) {
-      try {
-        const urlCtor = (providedGlobals as any).window?.URL;
-        if (typeof urlCtor !== 'undefined') {
-          liftedGlobals.URL = urlCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
+    const liftedGlobals = collectRunJSBrowserGlobals(providedGlobals);
 
     this.globals = {
       console,

package/src/__tests__/JSRunner.test.ts

@@ -9,7 +9,6 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { JSRunner, shouldPreprocessRunJSTemplates } from '../JSRunner';
-import { createSafeWindow } from '../utils';
 
 describe('JSRunner', () => {
   let originalSearch: string;
@@ -68,7 +67,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -84,7 +83,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         Blob: explicitBlob,
       },
     });
@@ -97,7 +96,7 @@ describe('JSRunner', () => {
   it('auto-lifts URL from injected window to top-level globals', async () => {
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -114,7 +113,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         URL: explicitURL,
       },
     });