@nocobase/plugin-flow-engine 2.0.60 → 2.0.62

package/dist/externalVersion.js

@@ -8,15 +8,15 @@
  */
 
 module.exports = {
-  "@nocobase/client": "2.0.60",
+  "@nocobase/client": "2.0.62",
   "lodash": "4.18.1",
-  "@nocobase/database": "2.0.60",
-  "@nocobase/data-source-manager": "2.0.60",
-  "@nocobase/resourcer": "2.0.60",
-  "@nocobase/utils": "2.0.60",
-  "@nocobase/cache": "2.0.60",
-  "@nocobase/plugin-localization": "2.0.60",
-  "@nocobase/server": "2.0.60",
-  "@nocobase/ai": "2.0.60",
-  "@nocobase/actions": "2.0.60"
+  "@nocobase/database": "2.0.62",
+  "@nocobase/data-source-manager": "2.0.62",
+  "@nocobase/resourcer": "2.0.62",
+  "@nocobase/utils": "2.0.62",
+  "@nocobase/cache": "2.0.62",
+  "@nocobase/plugin-localization": "2.0.62",
+  "@nocobase/server": "2.0.62",
+  "@nocobase/ai": "2.0.62",
+  "@nocobase/actions": "2.0.62"
 };

package/dist/node_modules/ses/package.json

@@ -1 +1 @@
-{"name":"ses","version":"1.14.0","description":"Hardened JavaScript for Fearless Cooperation","keywords":["lockdown","harden","Compartment","assert","security","confinement","isolation","object capabilities","ocaps","secure execution","third-party code","prototype pollution","supply-chain attack","plugin"],"author":"Agoric","license":"Apache-2.0","homepage":"https://github.com/Agoric/SES-shim/tree/master/packages/ses#readme","repository":{"type":"git","url":"git+https://github.com/endojs/endo.git","directory":"packages/ses"},"bugs":{"url":"https://github.com/endojs/endo/issues"},"type":"module","main":"./dist/ses.cjs","module":"./index.js","unpkg":"./dist/ses.umd.js","types":"./types.d.ts","exports":{".":{"import":{"types":"./types.d.ts","xs":"./src-xs/index.js","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./lockdown":{"import":{"types":"./types.d.ts","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./hermes":{"require":{"types":"./dist/types.d.cts","default":"./dist/ses-hermes.cjs"}},"./tools.js":"./tools.js","./assert-shim.js":"./assert-shim.js","./lockdown-shim.js":{"xs":"./src-xs/lockdown-shim.js","default":"./lockdown-shim.js"},"./compartment-shim.js":{"xs":"./src-xs/compartment-shim.js","default":"./compartment-shim.js"},"./console-shim.js":"./console-shim.js","./package.json":"./package.json"},"scripts":{"build:vanilla":"node scripts/bundle.js","build:hermes":"node scripts/bundle.js hermes","build":"yarn build:vanilla && yarn build:hermes","clean":"rm -rf dist","cover":"c8 ava","demo":"python3 -m http.server","lint":"yarn lint:types && yarn lint:eslint","lint-fix":"eslint --fix .","lint:eslint":"eslint .","lint:types":"tsc","prepare":"npm run clean && npm run build","qt":"ava","test":"tsd && ava","test:hermes":"./scripts/hermes-test.sh","test:xs":"xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp","postpack":"git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\""},"dependencies":{"@endo/cache-map":"^1.1.0","@endo/env-options":"^1.1.11","@endo/immutable-arraybuffer":"^1.1.2"},"devDependencies":{"@babel/generator":"^7.26.3","@babel/parser":"~7.26.2","@babel/traverse":"~7.25.9","@babel/types":"~7.26.0","@endo/compartment-mapper":"^1.6.3","@endo/module-source":"^1.3.3","@endo/test262-runner":"^0.1.48","@types/babel__traverse":"^7.20.5","ava":"^6.1.3","babel-eslint":"^10.1.0","c8":"^7.14.0","core-js":"^3.31.0","eslint":"^8.57.1","eslint-config-airbnb-base":"^15.0.0","eslint-config-prettier":"^9.1.0","eslint-plugin-eslint-comments":"^3.2.0","eslint-plugin-import":"^2.31.0","hermes-engine-cli":"^0.12.0","prettier":"^3.5.3","terser":"^5.16.6","tsd":"^0.31.2","typescript":"~5.8.3"},"files":["./*.d.ts","./*.js","./*.map","LICENSE*","SECURITY*","dist","lib","src","tools"],"publishConfig":{"access":"public"},"eslintConfig":{"extends":["plugin:@endo/ses"]},"ava":{"files":["test/**/*.test.*"],"timeout":"2m"},"typeCoverage":{"atLeast":81.17},"gitHead":"9815aea9541f241389d2135c6097a7442bdffa17","_lastModified":"2026-05-29T10:15:28.682Z"}
+{"name":"ses","version":"1.14.0","description":"Hardened JavaScript for Fearless Cooperation","keywords":["lockdown","harden","Compartment","assert","security","confinement","isolation","object capabilities","ocaps","secure execution","third-party code","prototype pollution","supply-chain attack","plugin"],"author":"Agoric","license":"Apache-2.0","homepage":"https://github.com/Agoric/SES-shim/tree/master/packages/ses#readme","repository":{"type":"git","url":"git+https://github.com/endojs/endo.git","directory":"packages/ses"},"bugs":{"url":"https://github.com/endojs/endo/issues"},"type":"module","main":"./dist/ses.cjs","module":"./index.js","unpkg":"./dist/ses.umd.js","types":"./types.d.ts","exports":{".":{"import":{"types":"./types.d.ts","xs":"./src-xs/index.js","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./lockdown":{"import":{"types":"./types.d.ts","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./hermes":{"require":{"types":"./dist/types.d.cts","default":"./dist/ses-hermes.cjs"}},"./tools.js":"./tools.js","./assert-shim.js":"./assert-shim.js","./lockdown-shim.js":{"xs":"./src-xs/lockdown-shim.js","default":"./lockdown-shim.js"},"./compartment-shim.js":{"xs":"./src-xs/compartment-shim.js","default":"./compartment-shim.js"},"./console-shim.js":"./console-shim.js","./package.json":"./package.json"},"scripts":{"build:vanilla":"node scripts/bundle.js","build:hermes":"node scripts/bundle.js hermes","build":"yarn build:vanilla && yarn build:hermes","clean":"rm -rf dist","cover":"c8 ava","demo":"python3 -m http.server","lint":"yarn lint:types && yarn lint:eslint","lint-fix":"eslint --fix .","lint:eslint":"eslint .","lint:types":"tsc","prepare":"npm run clean && npm run build","qt":"ava","test":"tsd && ava","test:hermes":"./scripts/hermes-test.sh","test:xs":"xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp","postpack":"git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\""},"dependencies":{"@endo/cache-map":"^1.1.0","@endo/env-options":"^1.1.11","@endo/immutable-arraybuffer":"^1.1.2"},"devDependencies":{"@babel/generator":"^7.26.3","@babel/parser":"~7.26.2","@babel/traverse":"~7.25.9","@babel/types":"~7.26.0","@endo/compartment-mapper":"^1.6.3","@endo/module-source":"^1.3.3","@endo/test262-runner":"^0.1.48","@types/babel__traverse":"^7.20.5","ava":"^6.1.3","babel-eslint":"^10.1.0","c8":"^7.14.0","core-js":"^3.31.0","eslint":"^8.57.1","eslint-config-airbnb-base":"^15.0.0","eslint-config-prettier":"^9.1.0","eslint-plugin-eslint-comments":"^3.2.0","eslint-plugin-import":"^2.31.0","hermes-engine-cli":"^0.12.0","prettier":"^3.5.3","terser":"^5.16.6","tsd":"^0.31.2","typescript":"~5.8.3"},"files":["./*.d.ts","./*.js","./*.map","LICENSE*","SECURITY*","dist","lib","src","tools"],"publishConfig":{"access":"public"},"eslintConfig":{"extends":["plugin:@endo/ses"]},"ava":{"files":["test/**/*.test.*"],"timeout":"2m"},"typeCoverage":{"atLeast":81.17},"gitHead":"9815aea9541f241389d2135c6097a7442bdffa17","_lastModified":"2026-06-10T17:41:35.706Z"}

package/dist/node_modules/zod/package.json

@@ -1 +1 @@
-{"name":"zod","version":"4.3.5","type":"module","license":"MIT","author":"Colin McDonnell <zod@colinhacks.com>","description":"TypeScript-first schema declaration and validation library with static type inference","homepage":"https://zod.dev","llms":"https://zod.dev/llms.txt","llmsFull":"https://zod.dev/llms-full.txt","mcpServer":"https://mcp.inkeep.com/zod/mcp","funding":"https://github.com/sponsors/colinhacks","sideEffects":false,"files":["src","**/*.js","**/*.mjs","**/*.cjs","**/*.d.ts","**/*.d.mts","**/*.d.cts","**/package.json"],"keywords":["typescript","schema","validation","type","inference"],"main":"./index.cjs","types":"./index.d.cts","module":"./index.js","zshy":{"exports":{"./package.json":"./package.json",".":"./src/index.ts","./mini":"./src/mini/index.ts","./locales":"./src/locales/index.ts","./v3":"./src/v3/index.ts","./v4":"./src/v4/index.ts","./v4-mini":"./src/v4-mini/index.ts","./v4/mini":"./src/v4/mini/index.ts","./v4/core":"./src/v4/core/index.ts","./v4/locales":"./src/v4/locales/index.ts","./v4/locales/*":"./src/v4/locales/*"},"conditions":{"@zod/source":"src"}},"exports":{"./package.json":"./package.json",".":{"@zod/source":"./src/index.ts","types":"./index.d.cts","import":"./index.js","require":"./index.cjs"},"./mini":{"@zod/source":"./src/mini/index.ts","types":"./mini/index.d.cts","import":"./mini/index.js","require":"./mini/index.cjs"},"./locales":{"@zod/source":"./src/locales/index.ts","types":"./locales/index.d.cts","import":"./locales/index.js","require":"./locales/index.cjs"},"./v3":{"@zod/source":"./src/v3/index.ts","types":"./v3/index.d.cts","import":"./v3/index.js","require":"./v3/index.cjs"},"./v4":{"@zod/source":"./src/v4/index.ts","types":"./v4/index.d.cts","import":"./v4/index.js","require":"./v4/index.cjs"},"./v4-mini":{"@zod/source":"./src/v4-mini/index.ts","types":"./v4-mini/index.d.cts","import":"./v4-mini/index.js","require":"./v4-mini/index.cjs"},"./v4/mini":{"@zod/source":"./src/v4/mini/index.ts","types":"./v4/mini/index.d.cts","import":"./v4/mini/index.js","require":"./v4/mini/index.cjs"},"./v4/core":{"@zod/source":"./src/v4/core/index.ts","types":"./v4/core/index.d.cts","import":"./v4/core/index.js","require":"./v4/core/index.cjs"},"./v4/locales":{"@zod/source":"./src/v4/locales/index.ts","types":"./v4/locales/index.d.cts","import":"./v4/locales/index.js","require":"./v4/locales/index.cjs"},"./v4/locales/*":{"@zod/source":"./src/v4/locales/*","types":"./v4/locales/*","import":"./v4/locales/*","require":"./v4/locales/*"}},"repository":{"type":"git","url":"git+https://github.com/colinhacks/zod.git"},"bugs":{"url":"https://github.com/colinhacks/zod/issues"},"support":{"backing":{"npm-funding":true}},"scripts":{"clean":"git clean -xdf . -e node_modules","build":"zshy --project tsconfig.build.json","postbuild":"tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .","test:watch":"pnpm vitest","test":"pnpm vitest run","prepublishOnly":"tsx ../../scripts/check-versions.ts"},"_lastModified":"2026-05-29T10:15:27.845Z"}
+{"name":"zod","version":"4.3.5","type":"module","license":"MIT","author":"Colin McDonnell <zod@colinhacks.com>","description":"TypeScript-first schema declaration and validation library with static type inference","homepage":"https://zod.dev","llms":"https://zod.dev/llms.txt","llmsFull":"https://zod.dev/llms-full.txt","mcpServer":"https://mcp.inkeep.com/zod/mcp","funding":"https://github.com/sponsors/colinhacks","sideEffects":false,"files":["src","**/*.js","**/*.mjs","**/*.cjs","**/*.d.ts","**/*.d.mts","**/*.d.cts","**/package.json"],"keywords":["typescript","schema","validation","type","inference"],"main":"./index.cjs","types":"./index.d.cts","module":"./index.js","zshy":{"exports":{"./package.json":"./package.json",".":"./src/index.ts","./mini":"./src/mini/index.ts","./locales":"./src/locales/index.ts","./v3":"./src/v3/index.ts","./v4":"./src/v4/index.ts","./v4-mini":"./src/v4-mini/index.ts","./v4/mini":"./src/v4/mini/index.ts","./v4/core":"./src/v4/core/index.ts","./v4/locales":"./src/v4/locales/index.ts","./v4/locales/*":"./src/v4/locales/*"},"conditions":{"@zod/source":"src"}},"exports":{"./package.json":"./package.json",".":{"@zod/source":"./src/index.ts","types":"./index.d.cts","import":"./index.js","require":"./index.cjs"},"./mini":{"@zod/source":"./src/mini/index.ts","types":"./mini/index.d.cts","import":"./mini/index.js","require":"./mini/index.cjs"},"./locales":{"@zod/source":"./src/locales/index.ts","types":"./locales/index.d.cts","import":"./locales/index.js","require":"./locales/index.cjs"},"./v3":{"@zod/source":"./src/v3/index.ts","types":"./v3/index.d.cts","import":"./v3/index.js","require":"./v3/index.cjs"},"./v4":{"@zod/source":"./src/v4/index.ts","types":"./v4/index.d.cts","import":"./v4/index.js","require":"./v4/index.cjs"},"./v4-mini":{"@zod/source":"./src/v4-mini/index.ts","types":"./v4-mini/index.d.cts","import":"./v4-mini/index.js","require":"./v4-mini/index.cjs"},"./v4/mini":{"@zod/source":"./src/v4/mini/index.ts","types":"./v4/mini/index.d.cts","import":"./v4/mini/index.js","require":"./v4/mini/index.cjs"},"./v4/core":{"@zod/source":"./src/v4/core/index.ts","types":"./v4/core/index.d.cts","import":"./v4/core/index.js","require":"./v4/core/index.cjs"},"./v4/locales":{"@zod/source":"./src/v4/locales/index.ts","types":"./v4/locales/index.d.cts","import":"./v4/locales/index.js","require":"./v4/locales/index.cjs"},"./v4/locales/*":{"@zod/source":"./src/v4/locales/*","types":"./v4/locales/*","import":"./v4/locales/*","require":"./v4/locales/*"}},"repository":{"type":"git","url":"git+https://github.com/colinhacks/zod.git"},"bugs":{"url":"https://github.com/colinhacks/zod/issues"},"support":{"backing":{"npm-funding":true}},"scripts":{"clean":"git clean -xdf . -e node_modules","build":"zshy --project tsconfig.build.json","postbuild":"tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .","test:watch":"pnpm vitest","test":"pnpm vitest run","prepublishOnly":"tsx ../../scripts/check-versions.ts"},"_lastModified":"2026-06-10T17:41:35.192Z"}

package/dist/server/repository.d.ts

@@ -25,6 +25,12 @@ export interface FlowModelAttachOptions {
     subType: 'array' | 'object';
     position?: FlowModelAttachPosition;
 }
+type FlowModelMovePosition = 'before' | 'after';
+interface FlowModelMoveOptions {
+    sourceId: string;
+    targetId: string;
+    position?: FlowModelMovePosition;
+}
 type BreakRemoveOnType = {
     [key: string]: any;
 };
@@ -59,6 +65,8 @@ export declare class FlowModelRepository extends Repository {
     getParentProperty(uid: string, options?: GetPropertiesOptions): Promise<any>;
     getJsonSchema(uid: string, options?: GetJsonSchemaOptions): Promise<any>;
     static optionsToJson(options: any): any;
+    private static getSortNumber;
+    private static compareBySortAndUid;
     nodesToSchema(nodes: any, rootUid: any): {
         uid: any;
         "x-async": boolean;
@@ -90,6 +98,12 @@ export declare class FlowModelRepository extends Repository {
     protected childrenCount(uid: any, transaction: any): Promise<number>;
     protected isLeafNode(uid: any, transaction: any): Promise<boolean>;
     protected findParentUid(uid: any, transaction?: any): Promise<string>;
+    private findSiblingInfo;
+    private findSiblingSortRows;
+    private writeSiblingSorts;
+    private normalizeSiblingSorts;
+    private isAncestorOf;
+    private updateModelParentOptions;
     protected findNodeSchemaWithParent(uid: any, transaction: any): Promise<{
         parentUid: string;
         schema: any;
@@ -122,6 +136,6 @@ export declare class FlowModelRepository extends Repository {
         subKey?: string;
     }): Promise<any>;
     attach(uid: string, attachOptions: FlowModelAttachOptions, options?: Transactionable): Promise<any>;
-    move(options: any): Promise<any>;
+    move(options: FlowModelMoveOptions, transactionOptions?: Transactionable): Promise<any>;
 }
 export default FlowModelRepository;

package/dist/server/repository.js

@@ -207,6 +207,32 @@ const _FlowModelRepository = class _FlowModelRepository extends import_database.
   static optionsToJson(options) {
     return import_lodash.default.isPlainObject(options) ? options : JSON.parse(options);
   }
+  static getSortNumber(value) {
+    if (typeof value === "number" && Number.isFinite(value)) {
+      return value;
+    }
+    if (typeof value === "string" && value.trim()) {
+      const parsed = Number(value);
+      if (Number.isFinite(parsed)) {
+        return parsed;
+      }
+    }
+    return null;
+  }
+  static compareBySortAndUid(a, b) {
+    const aSort = _FlowModelRepository.getSortNumber(a.sort);
+    const bSort = _FlowModelRepository.getSortNumber(b.sort);
+    if (aSort !== null && bSort !== null && aSort !== bSort) {
+      return aSort - bSort;
+    }
+    if (aSort !== null && bSort === null) {
+      return -1;
+    }
+    if (aSort === null && bSort !== null) {
+      return 1;
+    }
+    return String(a.uid || "").localeCompare(String(b.uid || ""));
+  }
   nodesToSchema(nodes, rootUid) {
     const nodeAttributeSanitize = (node) => {
       const schema = {
@@ -215,8 +241,9 @@ const _FlowModelRepository = class _FlowModelRepository extends import_database.
         ["uid"]: node["uid"],
         ["x-async"]: !!node.async
       };
-      if (import_lodash.default.isNumber(node.sort)) {
-        schema["x-index"] = node.sort;
+      const sort = _FlowModelRepository.getSortNumber(node.sort);
+      if (sort !== null) {
+        schema["x-index"] = sort;
       }
       return schema;
     };
@@ -228,7 +255,12 @@ const _FlowModelRepository = class _FlowModelRepository extends import_database.
       if (children.length > 0) {
         const childrenGroupByType = import_lodash.default.groupBy(children, "type");
         for (const childType of Object.keys(childrenGroupByType)) {
-          const properties = childrenGroupByType[childType].map((child) => buildTree(child)).sort((a, b) => a["x-index"] - b["x-index"]);
+          const properties = childrenGroupByType[childType].map((child) => buildTree(child)).sort(
+            (a, b) => _FlowModelRepository.compareBySortAndUid(
+              { sort: a["x-index"], uid: a.uid },
+              { sort: b["x-index"], uid: b.uid }
+            )
+          );
           rootNode[childType] = childType == "items" ? properties.length == 1 ? properties[0] : properties : properties.reduce((carry, item) => {
             carry[item.name] = item;
             delete item["name"];
@@ -289,7 +321,10 @@ const _FlowModelRepository = class _FlowModelRepository extends import_database.
     await this.clearXUidPathCache(rootUid, transaction2);
     if (!newSchema["properties"]) {
       const s = await this.model.findByPk(rootUid, { transaction: transaction2 });
-      s.set("options", { ...s.toJSON(), ...newSchema });
+      s.set("options", {
+        ...import_lodash.default.omit(_FlowModelRepository.optionsToJson(s.get("options") || {}), ["uid"]),
+        ...import_lodash.default.omit(newSchema, ["uid", "name", "options"])
+      });
       await s.save({ transaction: transaction2, hooks: false });
       await this.emitAfterSaveEvent(s, options);
       if (newSchema["x-server-hooks"]) {
@@ -478,17 +513,25 @@ const _FlowModelRepository = class _FlowModelRepository extends import_database.
       const oldParentUid = n["parent"];
       const newParentUid = uidMap[oldParentUid] ?? null;
       const optionsObj = this.replaceStepParamsModelUids(
-        import_lodash.default.isPlainObject(n.options) ? n.options : JSON.parse(n.options),
+        import_lodash.default.cloneDeep(_FlowModelRepository.optionsToJson(n.options)),
         uidMap
       );
+      delete optionsObj.uid;
+      delete optionsObj.name;
+      delete optionsObj.childOptions;
+      delete optionsObj["x-async"];
       if (newParentUid) {
         optionsObj.parent = newParentUid;
         optionsObj.parentId = newParentUid;
+      } else {
+        delete optionsObj.parent;
+        delete optionsObj.parentId;
       }
       const schemaNode = {
+        ...optionsObj,
         uid: newUid,
-        ["x-async"]: !!n.async,
-        ...optionsObj
+        name: newUid,
+        ["x-async"]: !!n.async
       };
       if (newParentUid) {
         schemaNode.childOptions = {
@@ -847,7 +890,7 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     await nodeModel.update(
       {
         options: {
-          ...nodeModel.get("options"),
+          ...import_lodash.default.omit(_FlowModelRepository.optionsToJson(nodeModel.get("options") || {}), ["uid"]),
           ...import_lodash.default.omit(schema, ["x-async", "name", "uid", "properties"])
         }
       },
@@ -889,6 +932,115 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     });
     return parent ? parent.get("ancestor") : null;
   }
+  async findSiblingInfo(uid2, transaction2) {
+    const rows = await this.database.sequelize.query(
+      this.sqlAdapter(`SELECT ParentPath.ancestor as parent, NodeInfo.type as type
+        FROM ${this.flowModelTreePathTableName} as ParentPath
+        LEFT JOIN ${this.flowModelTreePathTableName} as NodeInfo
+          ON NodeInfo.ancestor = ParentPath.descendant
+          AND NodeInfo.descendant = ParentPath.descendant
+          AND NodeInfo.depth = 0
+        WHERE ParentPath.descendant = :uid AND ParentPath.depth = 1`),
+      {
+        type: "SELECT",
+        replacements: { uid: uid2 },
+        transaction: transaction2
+      }
+    );
+    const row = rows[0];
+    if (!(row == null ? void 0 : row.parent) || !(row == null ? void 0 : row.type)) {
+      return null;
+    }
+    return {
+      parentUid: row.parent,
+      type: row.type
+    };
+  }
+  async findSiblingSortRows(parentUid, type, transaction2) {
+    const treeTable = this.flowModelTreePathTableName;
+    const rows = await this.database.sequelize.query(
+      this.sqlAdapter(`SELECT ChildPath.descendant as uid, ChildPath.sort as sort
+        FROM ${treeTable} as ChildPath
+        LEFT JOIN ${treeTable} as NodeInfo
+          ON NodeInfo.ancestor = ChildPath.descendant
+          AND NodeInfo.descendant = ChildPath.descendant
+          AND NodeInfo.depth = 0
+        WHERE ChildPath.ancestor = :parentUid
+          AND ChildPath.depth = 1
+          AND NodeInfo.type = :type`),
+      {
+        type: "SELECT",
+        replacements: { parentUid, type },
+        transaction: transaction2
+      }
+    );
+    return rows.sort((a, b) => _FlowModelRepository.compareBySortAndUid(a, b));
+  }
+  async writeSiblingSorts(parentUid, orderedUids, transaction2) {
+    const treeTable = this.flowModelTreePathTableName;
+    for (const [index, uid2] of orderedUids.entries()) {
+      await this.database.sequelize.query(
+        this.sqlAdapter(
+          `UPDATE ${treeTable} SET sort = :sort WHERE ancestor = :parentUid AND descendant = :uid AND depth = 1`
+        ),
+        {
+          type: "UPDATE",
+          replacements: {
+            parentUid,
+            uid: uid2,
+            sort: index + 1
+          },
+          transaction: transaction2
+        }
+      );
+    }
+    await this.clearXUidPathCache(parentUid, transaction2);
+  }
+  async normalizeSiblingSorts(info, transaction2) {
+    if (!info) {
+      return;
+    }
+    const siblingRows = await this.findSiblingSortRows(info.parentUid, info.type, transaction2);
+    await this.writeSiblingSorts(
+      info.parentUid,
+      siblingRows.map((row) => row.uid),
+      transaction2
+    );
+  }
+  async isAncestorOf(ancestorUid, descendantUid, transaction2) {
+    const rows = await this.database.sequelize.query(
+      this.sqlAdapter(`SELECT 1 as v
+        FROM ${this.flowModelTreePathTableName}
+        WHERE ancestor = :ancestorUid
+          AND descendant = :descendantUid
+          AND depth > 0
+        LIMIT 1`),
+      {
+        type: "SELECT",
+        replacements: { ancestorUid, descendantUid },
+        transaction: transaction2
+      }
+    );
+    return rows.length > 0;
+  }
+  async updateModelParentOptions(uid2, parentId, subKey, subType, transaction2) {
+    const modelInstance = await this.model.findByPk(uid2, { transaction: transaction2 });
+    if (!modelInstance) {
+      throw new Error(`flowModels:move sourceId '${uid2}' not found`);
+    }
+    await modelInstance.update(
+      {
+        options: {
+          ...import_lodash.default.omit(_FlowModelRepository.optionsToJson(modelInstance.get("options") || {}), ["uid"]),
+          parentId,
+          parent: parentId,
+          subKey,
+          subType
+        }
+      },
+      { transaction: transaction2, hooks: false }
+    );
+  }
   async findNodeSchemaWithParent(uid2, transaction2) {
     const schema = await this.database.getRepository("flowModels").findOne({
       filter: {
@@ -1155,22 +1307,30 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     for (const child of children) {
       const { subKey, subType } = this.optionsToJson(child.options);
       if (!subKey) continue;
-      const model = _FlowModelRepository.nodesToModel(nodes, child["uid"]) || {
-        uid: child["uid"],
+      const model2 = _FlowModelRepository.nodesToModel(nodes, child["uid"]) || {
         ...this.optionsToJson(child.options),
+        uid: child["uid"],
         sortIndex: child.sort
       };
-      model.sortIndex = child.sort;
+      model2.sortIndex = child.sort;
       if (subType === "array") {
         if (!subModels[subKey]) subModels[subKey] = [];
-        subModels[subKey].push(model);
+        subModels[subKey].push(model2);
       } else {
-        subModels[subKey] = model;
+        subModels[subKey] = model2;
       }
     }
     for (const key in subModels) {
       if (Array.isArray(subModels[key])) {
-        subModels[key].sort((a, b) => (a.sortIndex ?? 0) - (b.sortIndex ?? 0));
+        subModels[key] = subModels[key].sort(
+          (a, b) => _FlowModelRepository.compareBySortAndUid(
+            { sort: a.sortIndex, uid: a.uid },
+            { sort: b.sortIndex, uid: b.uid }
+          )
+        ).map((item, index) => {
+          item.sortIndex = index + 1;
+          return item;
+        });
       }
     }
     const filteredSubModels = {};
@@ -1181,11 +1341,19 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
         continue;
       filteredSubModels[key] = value;
     }
-    return {
-      uid: rootNode["uid"],
+    const model = {
       ...this.optionsToJson(rootNode.options),
+      uid: rootNode["uid"],
       ...Object.keys(filteredSubModels).length > 0 ? { subModels: filteredSubModels } : {}
     };
+    if (rootNode.parent) {
+      model.parent = rootNode.parent;
+      model.parentId = rootNode.parent;
+    } else {
+      delete model.parent;
+      delete model.parentId;
+    }
+    return model;
   }
   async insertModel(model, options) {
     const nodes = _FlowModelRepository.modelToSingleNodes(model);
@@ -1194,6 +1362,7 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     return await this.findModelById(rootUid, options);
   }
   async updateSingleNode(node, options) {
+    var _a;
     const instance = await this.model.findByPk(node["uid"], {
       transaction: options == null ? void 0 : options.transaction
     });
@@ -1201,8 +1370,12 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
       await instance.update(
         {
           options: {
-            ...instance.get("options"),
-            ...import_lodash.default.omit(node, ["x-async", "name", "uid", "childOptions"])
+            ...import_lodash.default.omit(instance.get("options"), ["uid"]),
+            ...import_lodash.default.omit(node, ["x-async", "name", "uid", "childOptions"]),
+            ...((_a = node.childOptions) == null ? void 0 : _a.parentUid) ? {
+              parent: node.childOptions.parentUid,
+              parentId: node.childOptions.parentUid
+            } : {}
           }
         },
         {
@@ -1376,7 +1549,7 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     await modelInstance.update(
       {
         options: {
-          ...modelInstance.get("options"),
+          ...import_lodash.default.omit(modelInstance.get("options"), ["uid"]),
           parentId,
           parent: parentId,
           subKey,
@@ -1399,11 +1572,74 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     );
     return await this.findModelById(modelUid, { transaction: transaction2, includeAsyncNode: true });
   }
-  async move(options) {
+  async move(options, transactionOptions) {
     const { sourceId, targetId, position } = options;
-    return await this.insertAdjacent(position === "after" ? "afterEnd" : "beforeBegin", targetId, {
-      ["uid"]: sourceId
-    });
+    const sourceUid = String(sourceId || "").trim();
+    const targetUid = String(targetId || "").trim();
+    if (!sourceUid || !targetUid) {
+      throw new Error("flowModels:move missing required params");
+    }
+    if (position !== "before" && position !== "after") {
+      throw new Error("flowModels:move invalid position");
+    }
+    const transaction2 = transactionOptions == null ? void 0 : transactionOptions.transaction;
+    const sourceInstance = await this.model.findByPk(sourceUid, { transaction: transaction2 });
+    if (!sourceInstance) {
+      throw new Error(`flowModels:move sourceId '${sourceUid}' not found`);
+    }
+    if (sourceUid === targetUid) {
+      await this.normalizeSiblingSorts(await this.findSiblingInfo(sourceUid, transaction2), transaction2);
+      return null;
+    }
+    const sourceInfo = await this.findSiblingInfo(sourceUid, transaction2);
+    const targetInfo = await this.findSiblingInfo(targetUid, transaction2);
+    if (!targetInfo) {
+      throw new Error("flowModels:move target is not attached to a parent");
+    }
+    const targetInstance = await this.model.findByPk(targetUid, { transaction: transaction2 });
+    const targetOptions = _FlowModelRepository.optionsToJson((targetInstance == null ? void 0 : targetInstance.get("options")) || {});
+    const targetSubType = targetOptions.subType === "object" ? "object" : "array";
+    if (targetInfo.parentUid === sourceUid || await this.isAncestorOf(sourceUid, targetInfo.parentUid, transaction2)) {
+      throw new Error("flowModels:move cycle detected");
+    }
+    if ((sourceInfo == null ? void 0 : sourceInfo.parentUid) === targetInfo.parentUid && sourceInfo.type === targetInfo.type) {
+      const siblingRows = await this.findSiblingSortRows(sourceInfo.parentUid, sourceInfo.type, transaction2);
+      const sourceRow = siblingRows.find((row) => row.uid === sourceUid);
+      const targetIndex = siblingRows.findIndex((row) => row.uid === targetUid);
+      if (!sourceRow || targetIndex === -1) {
+        throw new Error("flowModels:move source and target must be sibling nodes under the same parent/subKey");
+      }
+      const rowsWithoutSource = siblingRows.filter((row) => row.uid !== sourceUid);
+      const insertIndex = rowsWithoutSource.findIndex((row) => row.uid === targetUid);
+      rowsWithoutSource.splice(position === "after" ? insertIndex + 1 : insertIndex, 0, sourceRow);
+      await this.writeSiblingSorts(
+        sourceInfo.parentUid,
+        rowsWithoutSource.map((row) => row.uid),
+        transaction2
+      );
+      return await this.findModelById(sourceUid, { transaction: transaction2 });
+    }
+    await this.normalizeSiblingSorts(sourceInfo, transaction2);
+    await this.normalizeSiblingSorts(targetInfo, transaction2);
+    await this.updateModelParentOptions(sourceUid, targetInfo.parentUid, targetInfo.type, targetSubType, transaction2);
+    await this.insertSingleNode(
+      {
+        uid: sourceUid,
+        name: sourceUid,
+        childOptions: {
+          parentUid: targetInfo.parentUid,
+          type: targetInfo.type,
+          position: {
+            type: position,
+            target: targetUid
+          }
+        }
+      },
+      { transaction: transaction2, removeParentsIfNoChildren: false }
+    );
+    await this.normalizeSiblingSorts(sourceInfo, transaction2);
+    await this.normalizeSiblingSorts(await this.findSiblingInfo(sourceUid, transaction2), transaction2);
+    return await this.findModelById(sourceUid, { transaction: transaction2 });
   }
 };
 __decorateClass([
@@ -1466,6 +1702,9 @@ __decorateClass([
 __decorateClass([
   transaction()
 ], _FlowModelRepository.prototype, "attach", 1);
+__decorateClass([
+  transaction()
+], _FlowModelRepository.prototype, "move", 1);
 let FlowModelRepository = _FlowModelRepository;
 var repository_default = FlowModelRepository;
 // Annotate the CommonJS export names for ESM import in node:

package/dist/server/template/contexts.d.ts

@@ -50,6 +50,8 @@ export declare class ServerBaseContext {
     delegate(ctx: ServerBaseContext): void;
     /** 清空所有委托 */
     clearDelegates(): void;
+    getSandboxKeys(): string[];
+    getSandboxValue(key: string, current?: ServerBaseContext): any;
     /** 创建并返回代理对象（同一实例下保持稳定引用） */
     createProxy(): any;
 }

package/dist/server/template/contexts.js

@@ -42,6 +42,10 @@ __export(contexts_exports, {
 });
 module.exports = __toCommonJS(contexts_exports);
 var import_lodash = __toESM(require("lodash"));
+const BLOCKED_SANDBOX_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor", "then"]);
+function isBlockedSandboxKey(key) {
+  return BLOCKED_SANDBOX_KEYS.has(key);
+}
 class ServerBaseContext {
   _props = {};
   _methods = {};
@@ -106,6 +110,36 @@ class ServerBaseContext {
   clearDelegates() {
     this._delegates = [];
   }
+  getSandboxKeys() {
+    const keys = /* @__PURE__ */ new Set();
+    for (const key of Object.keys(this._props)) {
+      if (!isBlockedSandboxKey(key)) keys.add(key);
+    }
+    for (const key of Object.keys(this._methods)) {
+      if (!isBlockedSandboxKey(key)) keys.add(key);
+    }
+    for (const d of this._delegates) {
+      for (const key of d.getSandboxKeys()) {
+        if (!isBlockedSandboxKey(key)) keys.add(key);
+      }
+    }
+    return Array.from(keys);
+  }
+  getSandboxValue(key, current = this.createProxy()) {
+    if (isBlockedSandboxKey(key)) return void 0;
+    if (Object.prototype.hasOwnProperty.call(this._props, key)) {
+      return this._getOwn(key, current);
+    }
+    if (Object.prototype.hasOwnProperty.call(this._methods, key)) {
+      const fn = this._methods[key];
+      return typeof fn === "function" ? fn.bind(this) : fn;
+    }
+    for (const d of this._delegates) {
+      if (!d.getSandboxKeys().includes(key)) continue;
+      return d.getSandboxValue(key, current);
+    }
+    return void 0;
+  }
   /** 创建并返回代理对象（同一实例下保持稳定引用） */
   createProxy() {
     if (this._proxy) return this._proxy;

package/dist/server/template/resolver.js

@@ -42,6 +42,16 @@ __export(resolver_exports, {
 module.exports = __toCommonJS(resolver_exports);
 var import_ses = require("ses");
 var import_lodash = __toESM(require("lodash"));
+var import_utils = require("@nocobase/utils");
+var import_contexts = require("./contexts");
+const BLOCKED_SANDBOX_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+const sandboxProxyCache = /* @__PURE__ */ new WeakMap();
+const sandboxProxyMeta = /* @__PURE__ */ new WeakMap();
+const EMPTY_SANDBOX_CONTEXT = {
+  getSandboxKeys: () => [],
+  getSandboxValue: () => void 0
+};
+let resolverLockdownReady = false;
 async function resolveJsonTemplate(template, ctx) {
   const compile = async (source) => {
     if (typeof source === "string" && /\{\{.*?\}\}/.test(source)) {
@@ -75,6 +85,210 @@ async function replacePlaceholders(input, ctx) {
   }
   return result;
 }
+function isObjectLike(value) {
+  return value !== null && (typeof value === "object" || typeof value === "function");
+}
+function isTrustedPromise(value) {
+  return value instanceof Promise;
+}
+function isBlockedSandboxKey(key) {
+  return typeof key === "string" && BLOCKED_SANDBOX_KEYS.has(key);
+}
+function getSandboxDataDescriptor(source, key) {
+  if (isBlockedSandboxKey(key) || typeof key === "symbol") return void 0;
+  const descriptor = Reflect.getOwnPropertyDescriptor(source, key);
+  if (!descriptor || !("value" in descriptor)) return void 0;
+  if (key === "then" && typeof descriptor.value === "function") return void 0;
+  return descriptor;
+}
+function getPrimitiveDataDescriptor(source, key) {
+  if (source == null || isObjectLike(source)) return void 0;
+  return getSandboxDataDescriptor(Object(source), key);
+}
+function isSandboxContextSource(value) {
+  return value === EMPTY_SANDBOX_CONTEXT || value instanceof import_contexts.ServerBaseContext;
+}
+function wrapSandboxValue(value) {
+  if (isTrustedPromise(value)) {
+    return Promise.prototype.then.call(value, (resolved) => wrapSandboxValue(resolved));
+  }
+  if (!isObjectLike(value)) return value;
+  if (sandboxProxyMeta.has(value)) return value;
+  const cached = sandboxProxyCache.get(value);
+  if (cached) return cached;
+  const kind = isSandboxContextSource(value) ? "context" : typeof value === "function" ? "function" : "data";
+  const proxy = kind === "context" ? createSandboxContextProxy(value) : kind === "function" ? createSandboxFunctionProxy(value) : createSandboxDataProxy(value);
+  sandboxProxyCache.set(value, proxy);
+  sandboxProxyMeta.set(proxy, { kind, source: value });
+  return proxy;
+}
+function wrapRootSandboxContext(ctx) {
+  return wrapSandboxValue(isSandboxContextSource(ctx) ? ctx : EMPTY_SANDBOX_CONTEXT);
+}
+function ensureResolverLockdown() {
+  if (resolverLockdownReady) return;
+  (0, import_utils.lockdownSes)({
+    consoleTaming: "unsafe",
+    errorTaming: "unsafe",
+    overrideTaming: "moderate",
+    stackFiltering: "verbose"
+  });
+  resolverLockdownReady = true;
+}
+function createSandboxContextProxy(source) {
+  return new Proxy(/* @__PURE__ */ Object.create(null), {
+    get: (_target, key) => {
+      if (isBlockedSandboxKey(key) || typeof key !== "string") return void 0;
+      if (!source.getSandboxKeys().includes(key)) return void 0;
+      return wrapSandboxValue(source.getSandboxValue(key));
+    },
+    has: (_target, key) => typeof key === "string" && source.getSandboxKeys().includes(key),
+    ownKeys: () => source.getSandboxKeys(),
+    getOwnPropertyDescriptor: (_target, key) => {
+      if (isBlockedSandboxKey(key) || typeof key !== "string" || !source.getSandboxKeys().includes(key)) {
+        return void 0;
+      }
+      return {
+        configurable: true,
+        enumerable: true,
+        value: wrapSandboxValue(source.getSandboxValue(key))
+      };
+    },
+    getPrototypeOf: () => null,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+function createSandboxFunctionProxy(source) {
+  const callable = (...args) => Reflect.apply(source, void 0, args);
+  return new Proxy(callable, {
+    apply: (_target, _thisArg, argArray) => wrapSandboxValue(Reflect.apply(source, void 0, argArray)),
+    get: (_target, key) => {
+      if (key === "length" || key === "name") return Reflect.get(source, key);
+      return void 0;
+    },
+    has: (_target, key) => key === "length" || key === "name",
+    ownKeys: () => [],
+    getOwnPropertyDescriptor: () => void 0,
+    getPrototypeOf: () => null,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+function createSandboxDataProxy(source) {
+  const target = Array.isArray(source) ? new Array(source.length) : /* @__PURE__ */ Object.create(null);
+  return new Proxy(target, {
+    get: (_target, key) => {
+      const descriptor = getSandboxDataDescriptor(source, key);
+      if (!descriptor) return void 0;
+      const value = descriptor.value;
+      return typeof value === "function" ? wrapSandboxValue(value.bind(source)) : wrapSandboxValue(value);
+    },
+    has: (_target, key) => {
+      if (isBlockedSandboxKey(key) || typeof key !== "string") return false;
+      return !!getSandboxDataDescriptor(source, key);
+    },
+    ownKeys: () => {
+      const keys = Reflect.ownKeys(source).filter((key) => {
+        if (typeof key !== "string" || isBlockedSandboxKey(key)) return false;
+        return !!getSandboxDataDescriptor(source, key);
+      });
+      if (Array.isArray(source) && !keys.includes("length")) keys.push("length");
+      return keys;
+    },
+    getOwnPropertyDescriptor: (proxyTarget, key) => {
+      if (isBlockedSandboxKey(key) || typeof key === "symbol") return void 0;
+      if (Array.isArray(source) && key === "length") {
+        return Reflect.getOwnPropertyDescriptor(proxyTarget, key);
+      }
+      const descriptor = getSandboxDataDescriptor(source, key);
+      if (!descriptor) return void 0;
+      return {
+        configurable: true,
+        enumerable: descriptor.enumerable,
+        writable: false,
+        value: wrapSandboxValue(descriptor.value)
+      };
+    },
+    getPrototypeOf: () => null,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+async function unwrapSandboxValue(value, seen = /* @__PURE__ */ new WeakMap()) {
+  const resolved = isTrustedPromise(value) ? await value : value;
+  if (!isObjectLike(resolved)) return resolved;
+  const meta = sandboxProxyMeta.get(resolved);
+  if ((meta == null ? void 0 : meta.kind) === "function" || typeof resolved === "function") return void 0;
+  const source = (meta == null ? void 0 : meta.source) ?? resolved;
+  if (!isObjectLike(source)) return source;
+  if (seen.has(source)) return seen.get(source);
+  if (isSandboxContextSource(source)) {
+    const out2 = {};
+    seen.set(source, out2);
+    for (const key of source.getSandboxKeys()) {
+      if (BLOCKED_SANDBOX_KEYS.has(key)) continue;
+      out2[key] = await unwrapSandboxValue(wrapSandboxValue(source.getSandboxValue(key)), seen);
+    }
+    return out2;
+  }
+  if (Array.isArray(source)) {
+    const out2 = [];
+    seen.set(source, out2);
+    const lengthDescriptor = Reflect.getOwnPropertyDescriptor(source, "length");
+    const length = typeof (lengthDescriptor == null ? void 0 : lengthDescriptor.value) === "number" ? lengthDescriptor.value : 0;
+    for (let index = 0; index < length; index++) {
+      const descriptor = Reflect.getOwnPropertyDescriptor(source, String(index));
+      if (!descriptor || !("value" in descriptor)) continue;
+      out2.push(await unwrapSandboxValue(descriptor.value, seen));
+    }
+    return out2;
+  }
+  if (source instanceof Date) return source;
+  const out = {};
+  seen.set(source, out);
+  for (const key of Object.keys(source)) {
+    if (BLOCKED_SANDBOX_KEYS.has(key)) continue;
+    const descriptor = getSandboxDataDescriptor(source, key);
+    if (!descriptor) continue;
+    out[key] = await unwrapSandboxValue(descriptor.value, seen);
+  }
+  return out;
+}
+function getRootSandboxValue(ctx, key) {
+  if (BLOCKED_SANDBOX_KEYS.has(key)) return void 0;
+  if (isSandboxContextSource(ctx)) {
+    if (!ctx.getSandboxKeys().includes(key)) return void 0;
+    return wrapSandboxValue(ctx.getSandboxValue(key));
+  }
+  return void 0;
+}
+async function getSandboxProperty(value, key) {
+  if (BLOCKED_SANDBOX_KEYS.has(key)) return void 0;
+  const resolved = isTrustedPromise(value) ? await value : value;
+  if (resolved == null) return void 0;
+  const meta = isObjectLike(resolved) ? sandboxProxyMeta.get(resolved) : void 0;
+  const source = (meta == null ? void 0 : meta.source) ?? resolved;
+  if (isSandboxContextSource(source)) {
+    if (!source.getSandboxKeys().includes(key)) return void 0;
+    return wrapSandboxValue(source.getSandboxValue(key));
+  }
+  if (typeof source === "function") {
+    return key === "length" || key === "name" ? Reflect.get(source, key) : void 0;
+  }
+  if (!isObjectLike(source)) {
+    const descriptor2 = getPrimitiveDataDescriptor(source, key);
+    if (!descriptor2 || typeof descriptor2.value === "function") return void 0;
+    return wrapSandboxValue(descriptor2.value);
+  }
+  const descriptor = getSandboxDataDescriptor(source, key);
+  if (!descriptor) return void 0;
+  const current = descriptor.value;
+  return typeof current === "function" ? wrapSandboxValue(current.bind(source)) : wrapSandboxValue(current);
+}
 async function evaluate(expr, ctx) {
   try {
     const raw = expr.trim();
@@ -84,40 +298,36 @@ async function evaluate(expr, ctx) {
     if (dotOnly) {
       const first = dotOnly[1];
       const rest = dotOnly[2];
-      const base = await ctx[first];
-      if (!rest) return base;
+      const base = getRootSandboxValue(ctx, first);
+      if (!rest) return await unwrapSandboxValue(wrapSandboxValue(base));
       const resolved = await asyncGetValuesByPath(base, rest);
       if (typeof resolved !== "undefined" || !rest.includes("-")) {
-        return resolved;
+        return await unwrapSandboxValue(resolved);
       }
     }
     const transformed = preprocessExpression(raw);
+    ensureResolverLockdown();
     const compartment = new Compartment({
-      ctx,
-      __get: (varName, path) => getAtPath(ctx, varName, path),
-      console
+      ctx: wrapRootSandboxContext(ctx),
+      __get: wrapSandboxValue((varName, path) => getAtPath(ctx, varName, path))
     });
     const wrapped = `(async () => { try { return ${transformed}; } catch (e) { return undefined; } })()`;
-    return await compartment.evaluate(wrapped);
+    return await unwrapSandboxValue(await compartment.evaluate(wrapped));
   } catch (_2) {
     return void 0;
   }
 }
 async function getAtPath(ctx, varName, path) {
   try {
-    let current = await ctx[varName];
+    let current = getRootSandboxValue(ctx, varName);
     if (!path) return current;
     const norm = String(path || "").replace(/^\./, "");
     const segments = import_lodash.default.toPath(norm);
     for (const seg of segments) {
       if (current == null) return void 0;
-      let val = current[seg];
-      if (val && typeof val["then"] === "function") {
-        val = await val;
-      }
-      current = val;
+      current = await getSandboxProperty(current, seg);
     }
-    return current;
+    return wrapSandboxValue(current);
   } catch (_2) {
     return void 0;
   }
@@ -134,18 +344,19 @@ async function asyncGetValuesByPath(obj, path, defaultValue) {
       if (Array.isArray(currentValue)) {
         shouldReturnArray = true;
         const rest = keys.slice(i).join(".");
-        const parts = await Promise.all(currentValue.map((el) => asyncGetValuesByPath(el, rest, defaultValue)));
+        const parts = await Promise.all(
+          Array.prototype.map.call(currentValue, (el) => asyncGetValuesByPath(el, rest, defaultValue))
+        );
         for (const p of parts) {
-          if (Array.isArray(p)) result.push(...p);
-          else if (typeof p !== "undefined") result.push(p);
+          if (Array.isArray(p)) {
+            for (let index = 0; index < p.length; index++) {
+              if (typeof p[index] !== "undefined") result.push(p[index]);
+            }
+          } else if (typeof p !== "undefined") result.push(p);
         }
         break;
       }
-      let val = currentValue == null ? void 0 : currentValue[key];
-      if (val && typeof val.then === "function") {
-        val = await val;
-      }
-      currentValue = val;
+      currentValue = await getSandboxProperty(currentValue, key);
       if (i === keys.length - 1) {
         result.push(currentValue);
       }

package/package.json

@@ -4,7 +4,7 @@
   "displayName.zh-CN": "前端流引擎",
   "description": "",
   "description.zh-CN": "",
-  "version": "2.0.60",
+  "version": "2.0.62",
   "main": "./dist/server/index.js",
   "license": "Apache-2.0",
   "devDependencies": {
@@ -24,5 +24,5 @@
     "@nocobase/test": "2.x",
     "@nocobase/utils": "2.x"
   },
-  "gitHead": "c9bdc985d79d20e88c93cb2eee9bbf24a382ee08"
+  "gitHead": "b21b0a5111d188ba495eb579fdae674c5680fff2"
 }