@nocobase/plugin-flow-engine 2.1.0-beta.26 → 2.1.0-beta.29

package/dist/ai/ai-employees/nathan/prompt.md

@@ -50,18 +50,32 @@ Follow this exact order. Do NOT skip ahead to coding.
 
 2. Documentation lookup before writing any code
    - Use `document-search` skill guidance.
-   - You MUST call:
-     - `searchDocs`
-     - `readDocEntry`
+   - You MUST call `searchDocs`.
    - Always search docs before coding when the task involves any of the following:
      - RunJS / workflow / JS Block / JS Field / JS Item / JS Action / Event Flow / Linkage Rules
      - `ctx` APIs, runtime constraints, rendering, routing, requests, imports, React, Antd
      - any NocoBase-specific feature, component, schema, collection behavior, or API usage
    - Do not rely on memory, prior experience, or "common NocoBase patterns" as a substitute for this step.
    - Minimum requirement:
-     - search for the relevant module / keywords
-     - read the most relevant matching entry or entries
+     - use a compact Bash script that first searches file paths / filenames, then reads focused snippets from the best matches
+     - run broader content search only when path search is insufficient or ambiguous
      - extract the concrete constraints or APIs you will rely on
+     - start narrow; prefer returning an initial answer once focused snippets confirm the needed constraints
+   - Prefer one combined `searchDocs` call over multiple small calls. Good pattern:
+     ```bash
+     printf '## Candidate files\n'
+     rg --files interface-builder | grep -Ei 'runjs|js-|event|linkage' | head -50
+
+     printf '\n## JS Block\n'
+     sed -n '1,180p' interface-builder/blocks/other-blocks/js-block.md
+
+     printf '\n## RunJS\n'
+     sed -n '1,180p' interface-builder/runjs.md
+     ```
+   - Avoid broad full-tree scans such as `find .` or `rg ... .`. Pick likely top-level directories first, then search inside them.
+   - Do not pipe output into `rg`; use `grep` for pipeline filtering, and call `rg --files <dir>` or `rg -n <pattern> <dir>` with explicit path arguments.
+   - Use `rg -g '*.md' -g '*.mdx'`; do not use unsupported `rg --include` options.
+   - Stop searching once the snippets directly confirm the API or constraint needed for the code. Do not read adjacent overview, quickstart, definition, lifecycle, or development pages just for extra background unless the user asks for more depth.
    - Only after this step may you decide how to implement the solution.
 
 3. Data inspection when data model is involved
@@ -81,10 +95,32 @@ Follow this exact order. Do NOT skip ahead to coding.
    - `frontend-developer` is the implementation skill, not the starting shortcut.
    - Never use `frontend-developer` alone as justification to begin coding.
    - The code must be based on verified runtime context, verified documentation, and verified metadata when applicable.
+   - If you need to inspect the current editor code, call `readJSCode`. Never use `searchDocs` for current editor code, and never say the current code cannot be read.
+   - Call `readJSCode` before complex edits, after any failed patch, or whenever the current editor structure is uncertain.
+   - If the current work context already contains code and the user asks to add, modify, remove, fix, or extend behavior, call `patchJSCode` with a minimal patch instead of rewriting the whole editor.
+   - Call `writeJSCode` only when the editor is empty, the user asks for a complete replacement, or the change is truly a broad rewrite.
+   - For multiple independent localized edits, prefer sequential focused `patchJSCode` calls over one large patch.
+   - If a patch would change more than roughly 30 lines, replace a large function/component, or include large unchanged blocks, do not send a huge patch. Either split it into focused patches or use `writeJSCode` as a deliberate broad rewrite when the replacement is clearer than the diff.
+   - Do NOT put the complete code in a normal assistant message for validation.
 
 6. Validate before output (REQUIRED)
-   - `lintAndTestJS` must pass before output.
-   - If validation fails, fix the code and validate again.
+   - `lintAndTestJS` must pass before output. Omit the `code` argument so it validates the current editor code.
+   - If validation fails, do not guess or repeatedly patch from memory.
+   - Track the failing rule, line, and symbol. Do not make multiple cosmetic rewrites for the same diagnostic.
+   - Treat every validation failure as new evidence and classify it before changing code:
+     - Unknown or missing `ctx` member / runtime API / library exposure → call `getContextApis`, `getContextVars`, or `getContextEnvs` again, then search docs for that exact API or error.
+     - Unsupported syntax, sandbox restriction, import/render/request error, React/Antd usage error → call `searchDocs` again with the exact diagnostic text and the related feature keywords.
+     - Collection, field, relation, filter, or record-shape error → call the data metadata tools again for the exact collection or field involved.
+     - Plain JavaScript syntax or type error that is fully explained by the diagnostic → call `patchJSCode` with a minimal unified diff patch, then validate again.
+   - If one direct fix for the same lint rule still fails, stop changing that same expression. Re-read the exact code shape and consider whether the diagnostic is a static-check false positive or unsupported pattern before patching again.
+   - If `patchJSCode` fails to apply, call `readJSCode` before any retry, then decide whether a smaller patch or a full `writeJSCode` replacement is the clearer edit.
+   - After one failed direct fix, you MUST go back to runtime inspection, documentation lookup, metadata lookup, or ask the user before another code change.
+   - When calling `searchDocs` after validation failure, use a compact Bash script that searches the exact error text and nearby concepts, then reads focused snippets from likely matches.
+   - If the tools and docs still do not confirm the fix, stop and ask the user instead of trying another unverified implementation.
+   - When calling `patchJSCode`, provide only the unified diff patch. The tool reads the current editor code directly.
+   - Keep `patchJSCode` patches surgical: include only the changed lines plus the smallest necessary surrounding context.
+   - Do NOT rewrite the entire file, replace a whole component/function, or include unchanged large blocks in a patch unless the whole block genuinely changed.
+   - If more than roughly 30 lines would need to change, prefer `writeJSCode` only when this is a deliberate broad rewrite. For incremental requests, split into focused `patchJSCode` patches.
 
 # Coding Rules
 
@@ -118,9 +154,9 @@ Never inject unsanitized user input into DOM.
 # Output Rules
 
 - Markdown
-- Exactly ONE complete code block at end
-- No partial snippets
-- Brief explanation after code
+- Do NOT output a complete code block after using `writeJSCode` / `patchJSCode`.
+- Final response should be brief: say that the code has been written to the editor and validation passed.
+- If validation cannot pass, summarize the blocking diagnostics and ask for the missing verified information.
 
 # Standard
 

package/dist/ai/ai-employees/nathan/skills/frontend-developer/SKILLS.md

@@ -23,23 +23,40 @@ When helping users with JavaScript code, follow this process:
 
 2. **Write the Code**
    - Write clean, correct JavaScript/JSX code based on the user's requirements
+   - Use `readJSCode` before complex edits, after any patch failure, or whenever the current editor structure is uncertain. Never use documentation search to read current editor code.
+   - If the current work context already contains code and the user asks to add, modify, remove, fix, or extend behavior, use `patchJSCode` with a minimal patch instead of rewriting the whole editor
+   - Use `writeJSCode` only when the editor is empty, the user asks for a complete replacement, or the change is truly a broad rewrite
+   - If an edit would require a large patch, split it into focused patches. If the change replaces a large function/component or the patch would be larger than the full replacement, use `writeJSCode` as a deliberate broad rewrite.
    - Ensure the code follows best practices for NocoBase workflows
 
 3. **Validate the Code**
-   - Use `lintAndTestJS` to lint and test the code before final output
-   - Fix any errors reported by the linting tool
+   - Use `lintAndTestJS` with no `code` argument to lint and test the current editor code before final output
+   - Fix plain JavaScript syntax errors directly when the diagnostic fully explains the problem
+   - Use `patchJSCode` with a minimal unified diff patch for follow-up fixes instead of rewriting the full code
+   - Track the failing rule, line, and symbol. If one direct fix for the same lint rule still fails, stop changing the same expression and gather new evidence instead of trying cosmetic rewrites.
+   - Keep patches surgical: include only changed lines plus the smallest necessary context. Do not include unchanged large blocks or rewrite entire components/functions unless they genuinely changed.
+   - If `patchJSCode` fails to apply, call `readJSCode` before retrying. Do not say the current code cannot be read.
+   - If the error involves NocoBase runtime APIs, `ctx`, sandbox restrictions, imports, rendering, React, Antd, requests, collections, fields, or record structure, do not guess. Go back to the relevant inspection or documentation tools before changing code:
+     - Runtime exposure errors: call `getContextEnvs`, `getContextVars`, or `getContextApis` again
+     - NocoBase API / runtime / sandbox / UI errors: use the documentation search skill again with the exact error and relevant feature keywords
+     - Data model errors: use data metadata tools again for the exact collection, field, or relation
+   - After one failed direct fix, you must gather new evidence from tools or docs before another code change
    - Do not output final code unless it passes validation
 
 4. **Submit the Code**
    - Once validated, provide the final code to the user
    - Explain how the code works and what it does
+   - If `lintAndTestJS` validated and ran the current editor code successfully, remind the user that the code has not been saved permanently yet and they should click the save button manually.
 
 # Available Tools
 
 - `getContextVars`: Retrieves available variables from the current context. Variables are references only — you must explicitly resolve values via `await ctx.getVar(path)`. Supports dot-notation for progressive drilling (e.g., `ctx.popup.record.id`).
 - `getContextApis`: Returns available API methods from the context that can be used in the code.
 - `getContextEnvs`: Returns metadata about the current page, block, or flow model.
-- `lintAndTestJS`: Lints, performs sandbox checks, and trial-runs JavaScript/JSX code. Returns success/failure with diagnostics. **Always call this tool before outputting final code to verify it works.**
+- `readJSCode`: Reads the complete JavaScript/JSX code currently in the active editor. Use before complex patches, after patch failure, or whenever the current editor structure is uncertain.
+- `writeJSCode`: Writes complete JavaScript/JSX code directly into the current editor and returns write metadata. Use only for an empty editor, explicit complete replacement, or deliberate broad rewrite.
+- `patchJSCode`: Applies a minimal unified diff patch to the current editor code and writes it back. Provide only the patch; the tool reads the current editor code directly.
+- `lintAndTestJS`: Lints, performs sandbox checks, and trial-runs the current editor JavaScript/JSX code. Returns success/failure with diagnostics. **Always call this tool before final response to verify it works.**
 
 # Code Writing Guidelines
 

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/lintAndTestJS.js

@@ -41,9 +41,11 @@ var lintAndTestJS_default = (0, import_ai.defineTools)({
   },
   definition: {
     name: "lintAndTestJS",
-    description: "Lint, sandbox-check and trial-run a JavaScript snippet. Returns success/failure with diagnostics. Call this tool BEFORE outputting final code to verify it works.",
+    description: "Lint, sandbox-check and trial-run the current editor JavaScript/JSX code. Returns success/failure with diagnostics. Call this tool after writeJSCode or patchJSCode before final response.",
     schema: import_zod.z.object({
-      code: import_zod.z.string().describe("The JavaScript/JSX code to preview and validate")
+      code: import_zod.z.string().optional().describe(
+        "Optional JavaScript/JSX code to preview and validate. Omit this to validate the current editor code."
+      )
     })
   },
   invoke: async (ctx, _args, runtime) => {

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/patchJSCode.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+declare const _default: import("@nocobase/ai").ToolsOptions;
+export default _default;

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/patchJSCode.js

@@ -0,0 +1,65 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var patchJSCode_exports = {};
+__export(patchJSCode_exports, {
+  default: () => patchJSCode_default
+});
+module.exports = __toCommonJS(patchJSCode_exports);
+var import_ai = require("@nocobase/ai");
+var import_zod = require("zod");
+var patchJSCode_default = (0, import_ai.defineTools)({
+  scope: "SPECIFIED",
+  execution: "frontend",
+  defaultPermission: "ALLOW",
+  introduction: {
+    title: `{{t("ai.tools.patchJSCode.title")}}`,
+    about: `{{t("ai.tools.patchJSCode.about")}}`
+  },
+  definition: {
+    name: "patchJSCode",
+    description: "Apply a minimal unified diff patch to the code currently in the editor, then write the patched code back to the editor. Use this for adding, modifying, removing, fixing, or extending existing code. The tool reads the current editor code directly; only provide the patch. Keep patches surgical: include only changed lines plus the smallest necessary context, and do not include unchanged large blocks.",
+    schema: import_zod.z.object({
+      patch: import_zod.z.string().describe(
+        "Minimal unified diff patch to apply to the current editor code. Include only changed lines plus the smallest necessary context."
+      )
+    })
+  },
+  invoke: async (ctx, _args, runtime) => {
+    const { toolCallResults } = ctx.action.params.values || {};
+    const { result } = (toolCallResults == null ? void 0 : toolCallResults.find((item) => item.id === runtime.toolCallId)) ?? {};
+    if (toolCallResults && result) {
+      return {
+        status: result.status ?? "error",
+        content: JSON.stringify(result.content ?? {})
+      };
+    }
+    return {
+      status: "error",
+      content: JSON.stringify({ success: false, message: "Patch code failed: no result returned" })
+    };
+  }
+});

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/readJSCode.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+declare const _default: import("@nocobase/ai").ToolsOptions;
+export default _default;

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/readJSCode.js

@@ -0,0 +1,61 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var readJSCode_exports = {};
+__export(readJSCode_exports, {
+  default: () => readJSCode_default
+});
+module.exports = __toCommonJS(readJSCode_exports);
+var import_ai = require("@nocobase/ai");
+var import_zod = require("zod");
+var readJSCode_default = (0, import_ai.defineTools)({
+  scope: "SPECIFIED",
+  execution: "frontend",
+  defaultPermission: "ALLOW",
+  introduction: {
+    title: `{{t("ai.tools.readJSCode.title")}}`,
+    about: `{{t("ai.tools.readJSCode.about")}}`
+  },
+  definition: {
+    name: "readJSCode",
+    description: "Read the complete JavaScript/JSX code currently in the active editor. Use before complex patches, after patchJSCode fails, or whenever the current editor structure is uncertain. Do not use searchDocs to read editor code.",
+    schema: import_zod.z.object({})
+  },
+  invoke: async (ctx, _args, runtime) => {
+    const { toolCallResults } = ctx.action.params.values || {};
+    const { result } = (toolCallResults == null ? void 0 : toolCallResults.find((item) => item.id === runtime.toolCallId)) ?? {};
+    if (toolCallResults && result) {
+      return {
+        status: result.status ?? "error",
+        content: JSON.stringify(result.content ?? {})
+      };
+    }
+    return {
+      status: "error",
+      content: JSON.stringify({ success: false, message: "Read code failed: no result returned" })
+    };
+  }
+});

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/writeJSCode.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+declare const _default: import("@nocobase/ai").ToolsOptions;
+export default _default;

package/dist/ai/ai-employees/nathan/skills/frontend-developer/tools/writeJSCode.js

@@ -0,0 +1,65 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var writeJSCode_exports = {};
+__export(writeJSCode_exports, {
+  default: () => writeJSCode_default
+});
+module.exports = __toCommonJS(writeJSCode_exports);
+var import_ai = require("@nocobase/ai");
+var import_zod = require("zod");
+var writeJSCode_default = (0, import_ai.defineTools)({
+  scope: "SPECIFIED",
+  execution: "frontend",
+  defaultPermission: "ALLOW",
+  introduction: {
+    title: `{{t("ai.tools.writeJSCode.title")}}`,
+    about: `{{t("ai.tools.writeJSCode.about")}}`
+  },
+  definition: {
+    name: "writeJSCode",
+    description: "Write complete JavaScript/JSX code into the current code editor. Use only when the editor is empty, the user asks for a complete replacement, or the change is a deliberate broad rewrite. For adding, modifying, fixing, or extending existing code, use patchJSCode instead.",
+    schema: import_zod.z.object({
+      code: import_zod.z.string().describe(
+        "The complete JavaScript/JSX code to write into the current editor. Do not use for small incremental changes to existing code."
+      )
+    })
+  },
+  invoke: async (ctx, _args, runtime) => {
+    const { toolCallResults } = ctx.action.params.values || {};
+    const { result } = (toolCallResults == null ? void 0 : toolCallResults.find((item) => item.id === runtime.toolCallId)) ?? {};
+    if (toolCallResults && result) {
+      return {
+        status: result.status ?? "error",
+        content: JSON.stringify(result.content ?? {})
+      };
+    }
+    return {
+      status: "error",
+      content: JSON.stringify({ success: false, message: "Write code failed: no result returned" })
+    };
+  }
+});

package/dist/externalVersion.js

@@ -8,16 +8,16 @@
  */
 
 module.exports = {
-  "@nocobase/client": "2.1.0-beta.26",
+  "@nocobase/client": "2.1.0-beta.29",
   "lodash": "4.18.1",
-  "@nocobase/database": "2.1.0-beta.26",
-  "@nocobase/data-source-manager": "2.1.0-beta.26",
-  "@nocobase/resourcer": "2.1.0-beta.26",
-  "@nocobase/utils": "2.1.0-beta.26",
-  "@nocobase/cache": "2.1.0-beta.26",
-  "@nocobase/plugin-localization": "2.1.0-beta.26",
-  "@nocobase/server": "2.1.0-beta.26",
-  "@nocobase/actions": "2.1.0-beta.26",
+  "@nocobase/database": "2.1.0-beta.29",
+  "@nocobase/data-source-manager": "2.1.0-beta.29",
+  "@nocobase/resourcer": "2.1.0-beta.29",
+  "@nocobase/utils": "2.1.0-beta.29",
+  "@nocobase/cache": "2.1.0-beta.29",
+  "@nocobase/plugin-localization": "2.1.0-beta.29",
+  "@nocobase/server": "2.1.0-beta.29",
+  "@nocobase/actions": "2.1.0-beta.29",
   "@formily/json-schema": "2.3.7",
-  "@nocobase/ai": "2.1.0-beta.26"
+  "@nocobase/ai": "2.1.0-beta.29"
 };

package/dist/node_modules/ses/package.json

@@ -1 +1 @@
-{"name":"ses","version":"1.14.0","description":"Hardened JavaScript for Fearless Cooperation","keywords":["lockdown","harden","Compartment","assert","security","confinement","isolation","object capabilities","ocaps","secure execution","third-party code","prototype pollution","supply-chain attack","plugin"],"author":"Agoric","license":"Apache-2.0","homepage":"https://github.com/Agoric/SES-shim/tree/master/packages/ses#readme","repository":{"type":"git","url":"git+https://github.com/endojs/endo.git","directory":"packages/ses"},"bugs":{"url":"https://github.com/endojs/endo/issues"},"type":"module","main":"./dist/ses.cjs","module":"./index.js","unpkg":"./dist/ses.umd.js","types":"./types.d.ts","exports":{".":{"import":{"types":"./types.d.ts","xs":"./src-xs/index.js","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./lockdown":{"import":{"types":"./types.d.ts","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./hermes":{"require":{"types":"./dist/types.d.cts","default":"./dist/ses-hermes.cjs"}},"./tools.js":"./tools.js","./assert-shim.js":"./assert-shim.js","./lockdown-shim.js":{"xs":"./src-xs/lockdown-shim.js","default":"./lockdown-shim.js"},"./compartment-shim.js":{"xs":"./src-xs/compartment-shim.js","default":"./compartment-shim.js"},"./console-shim.js":"./console-shim.js","./package.json":"./package.json"},"scripts":{"build:vanilla":"node scripts/bundle.js","build:hermes":"node scripts/bundle.js hermes","build":"yarn build:vanilla && yarn build:hermes","clean":"rm -rf dist","cover":"c8 ava","demo":"python3 -m http.server","lint":"yarn lint:types && yarn lint:eslint","lint-fix":"eslint --fix .","lint:eslint":"eslint .","lint:types":"tsc","prepare":"npm run clean && npm run build","qt":"ava","test":"tsd && ava","test:hermes":"./scripts/hermes-test.sh","test:xs":"xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp","postpack":"git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\""},"dependencies":{"@endo/cache-map":"^1.1.0","@endo/env-options":"^1.1.11","@endo/immutable-arraybuffer":"^1.1.2"},"devDependencies":{"@babel/generator":"^7.26.3","@babel/parser":"~7.26.2","@babel/traverse":"~7.25.9","@babel/types":"~7.26.0","@endo/compartment-mapper":"^1.6.3","@endo/module-source":"^1.3.3","@endo/test262-runner":"^0.1.48","@types/babel__traverse":"^7.20.5","ava":"^6.1.3","babel-eslint":"^10.1.0","c8":"^7.14.0","core-js":"^3.31.0","eslint":"^8.57.1","eslint-config-airbnb-base":"^15.0.0","eslint-config-prettier":"^9.1.0","eslint-plugin-eslint-comments":"^3.2.0","eslint-plugin-import":"^2.31.0","hermes-engine-cli":"^0.12.0","prettier":"^3.5.3","terser":"^5.16.6","tsd":"^0.31.2","typescript":"~5.8.3"},"files":["./*.d.ts","./*.js","./*.map","LICENSE*","SECURITY*","dist","lib","src","tools"],"publishConfig":{"access":"public"},"eslintConfig":{"extends":["plugin:@endo/ses"]},"ava":{"files":["test/**/*.test.*"],"timeout":"2m"},"typeCoverage":{"atLeast":81.17},"gitHead":"9815aea9541f241389d2135c6097a7442bdffa17","_lastModified":"2026-05-07T16:21:50.072Z"}
+{"name":"ses","version":"1.14.0","description":"Hardened JavaScript for Fearless Cooperation","keywords":["lockdown","harden","Compartment","assert","security","confinement","isolation","object capabilities","ocaps","secure execution","third-party code","prototype pollution","supply-chain attack","plugin"],"author":"Agoric","license":"Apache-2.0","homepage":"https://github.com/Agoric/SES-shim/tree/master/packages/ses#readme","repository":{"type":"git","url":"git+https://github.com/endojs/endo.git","directory":"packages/ses"},"bugs":{"url":"https://github.com/endojs/endo/issues"},"type":"module","main":"./dist/ses.cjs","module":"./index.js","unpkg":"./dist/ses.umd.js","types":"./types.d.ts","exports":{".":{"import":{"types":"./types.d.ts","xs":"./src-xs/index.js","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./lockdown":{"import":{"types":"./types.d.ts","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./hermes":{"require":{"types":"./dist/types.d.cts","default":"./dist/ses-hermes.cjs"}},"./tools.js":"./tools.js","./assert-shim.js":"./assert-shim.js","./lockdown-shim.js":{"xs":"./src-xs/lockdown-shim.js","default":"./lockdown-shim.js"},"./compartment-shim.js":{"xs":"./src-xs/compartment-shim.js","default":"./compartment-shim.js"},"./console-shim.js":"./console-shim.js","./package.json":"./package.json"},"scripts":{"build:vanilla":"node scripts/bundle.js","build:hermes":"node scripts/bundle.js hermes","build":"yarn build:vanilla && yarn build:hermes","clean":"rm -rf dist","cover":"c8 ava","demo":"python3 -m http.server","lint":"yarn lint:types && yarn lint:eslint","lint-fix":"eslint --fix .","lint:eslint":"eslint .","lint:types":"tsc","prepare":"npm run clean && npm run build","qt":"ava","test":"tsd && ava","test:hermes":"./scripts/hermes-test.sh","test:xs":"xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp","postpack":"git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\""},"dependencies":{"@endo/cache-map":"^1.1.0","@endo/env-options":"^1.1.11","@endo/immutable-arraybuffer":"^1.1.2"},"devDependencies":{"@babel/generator":"^7.26.3","@babel/parser":"~7.26.2","@babel/traverse":"~7.25.9","@babel/types":"~7.26.0","@endo/compartment-mapper":"^1.6.3","@endo/module-source":"^1.3.3","@endo/test262-runner":"^0.1.48","@types/babel__traverse":"^7.20.5","ava":"^6.1.3","babel-eslint":"^10.1.0","c8":"^7.14.0","core-js":"^3.31.0","eslint":"^8.57.1","eslint-config-airbnb-base":"^15.0.0","eslint-config-prettier":"^9.1.0","eslint-plugin-eslint-comments":"^3.2.0","eslint-plugin-import":"^2.31.0","hermes-engine-cli":"^0.12.0","prettier":"^3.5.3","terser":"^5.16.6","tsd":"^0.31.2","typescript":"~5.8.3"},"files":["./*.d.ts","./*.js","./*.map","LICENSE*","SECURITY*","dist","lib","src","tools"],"publishConfig":{"access":"public"},"eslintConfig":{"extends":["plugin:@endo/ses"]},"ava":{"files":["test/**/*.test.*"],"timeout":"2m"},"typeCoverage":{"atLeast":81.17},"gitHead":"9815aea9541f241389d2135c6097a7442bdffa17","_lastModified":"2026-05-10T15:05:41.221Z"}

package/dist/node_modules/zod/package.json

@@ -1 +1 @@
-{"name":"zod","version":"4.3.5","type":"module","license":"MIT","author":"Colin McDonnell <zod@colinhacks.com>","description":"TypeScript-first schema declaration and validation library with static type inference","homepage":"https://zod.dev","llms":"https://zod.dev/llms.txt","llmsFull":"https://zod.dev/llms-full.txt","mcpServer":"https://mcp.inkeep.com/zod/mcp","funding":"https://github.com/sponsors/colinhacks","sideEffects":false,"files":["src","**/*.js","**/*.mjs","**/*.cjs","**/*.d.ts","**/*.d.mts","**/*.d.cts","**/package.json"],"keywords":["typescript","schema","validation","type","inference"],"main":"./index.cjs","types":"./index.d.cts","module":"./index.js","zshy":{"exports":{"./package.json":"./package.json",".":"./src/index.ts","./mini":"./src/mini/index.ts","./locales":"./src/locales/index.ts","./v3":"./src/v3/index.ts","./v4":"./src/v4/index.ts","./v4-mini":"./src/v4-mini/index.ts","./v4/mini":"./src/v4/mini/index.ts","./v4/core":"./src/v4/core/index.ts","./v4/locales":"./src/v4/locales/index.ts","./v4/locales/*":"./src/v4/locales/*"},"conditions":{"@zod/source":"src"}},"exports":{"./package.json":"./package.json",".":{"@zod/source":"./src/index.ts","types":"./index.d.cts","import":"./index.js","require":"./index.cjs"},"./mini":{"@zod/source":"./src/mini/index.ts","types":"./mini/index.d.cts","import":"./mini/index.js","require":"./mini/index.cjs"},"./locales":{"@zod/source":"./src/locales/index.ts","types":"./locales/index.d.cts","import":"./locales/index.js","require":"./locales/index.cjs"},"./v3":{"@zod/source":"./src/v3/index.ts","types":"./v3/index.d.cts","import":"./v3/index.js","require":"./v3/index.cjs"},"./v4":{"@zod/source":"./src/v4/index.ts","types":"./v4/index.d.cts","import":"./v4/index.js","require":"./v4/index.cjs"},"./v4-mini":{"@zod/source":"./src/v4-mini/index.ts","types":"./v4-mini/index.d.cts","import":"./v4-mini/index.js","require":"./v4-mini/index.cjs"},"./v4/mini":{"@zod/source":"./src/v4/mini/index.ts","types":"./v4/mini/index.d.cts","import":"./v4/mini/index.js","require":"./v4/mini/index.cjs"},"./v4/core":{"@zod/source":"./src/v4/core/index.ts","types":"./v4/core/index.d.cts","import":"./v4/core/index.js","require":"./v4/core/index.cjs"},"./v4/locales":{"@zod/source":"./src/v4/locales/index.ts","types":"./v4/locales/index.d.cts","import":"./v4/locales/index.js","require":"./v4/locales/index.cjs"},"./v4/locales/*":{"@zod/source":"./src/v4/locales/*","types":"./v4/locales/*","import":"./v4/locales/*","require":"./v4/locales/*"}},"repository":{"type":"git","url":"git+https://github.com/colinhacks/zod.git"},"bugs":{"url":"https://github.com/colinhacks/zod/issues"},"support":{"backing":{"npm-funding":true}},"scripts":{"clean":"git clean -xdf . -e node_modules","build":"zshy --project tsconfig.build.json","postbuild":"tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .","test:watch":"pnpm vitest","test":"pnpm vitest run","prepublishOnly":"tsx ../../scripts/check-versions.ts"},"_lastModified":"2026-05-07T16:21:51.070Z"}
+{"name":"zod","version":"4.3.5","type":"module","license":"MIT","author":"Colin McDonnell <zod@colinhacks.com>","description":"TypeScript-first schema declaration and validation library with static type inference","homepage":"https://zod.dev","llms":"https://zod.dev/llms.txt","llmsFull":"https://zod.dev/llms-full.txt","mcpServer":"https://mcp.inkeep.com/zod/mcp","funding":"https://github.com/sponsors/colinhacks","sideEffects":false,"files":["src","**/*.js","**/*.mjs","**/*.cjs","**/*.d.ts","**/*.d.mts","**/*.d.cts","**/package.json"],"keywords":["typescript","schema","validation","type","inference"],"main":"./index.cjs","types":"./index.d.cts","module":"./index.js","zshy":{"exports":{"./package.json":"./package.json",".":"./src/index.ts","./mini":"./src/mini/index.ts","./locales":"./src/locales/index.ts","./v3":"./src/v3/index.ts","./v4":"./src/v4/index.ts","./v4-mini":"./src/v4-mini/index.ts","./v4/mini":"./src/v4/mini/index.ts","./v4/core":"./src/v4/core/index.ts","./v4/locales":"./src/v4/locales/index.ts","./v4/locales/*":"./src/v4/locales/*"},"conditions":{"@zod/source":"src"}},"exports":{"./package.json":"./package.json",".":{"@zod/source":"./src/index.ts","types":"./index.d.cts","import":"./index.js","require":"./index.cjs"},"./mini":{"@zod/source":"./src/mini/index.ts","types":"./mini/index.d.cts","import":"./mini/index.js","require":"./mini/index.cjs"},"./locales":{"@zod/source":"./src/locales/index.ts","types":"./locales/index.d.cts","import":"./locales/index.js","require":"./locales/index.cjs"},"./v3":{"@zod/source":"./src/v3/index.ts","types":"./v3/index.d.cts","import":"./v3/index.js","require":"./v3/index.cjs"},"./v4":{"@zod/source":"./src/v4/index.ts","types":"./v4/index.d.cts","import":"./v4/index.js","require":"./v4/index.cjs"},"./v4-mini":{"@zod/source":"./src/v4-mini/index.ts","types":"./v4-mini/index.d.cts","import":"./v4-mini/index.js","require":"./v4-mini/index.cjs"},"./v4/mini":{"@zod/source":"./src/v4/mini/index.ts","types":"./v4/mini/index.d.cts","import":"./v4/mini/index.js","require":"./v4/mini/index.cjs"},"./v4/core":{"@zod/source":"./src/v4/core/index.ts","types":"./v4/core/index.d.cts","import":"./v4/core/index.js","require":"./v4/core/index.cjs"},"./v4/locales":{"@zod/source":"./src/v4/locales/index.ts","types":"./v4/locales/index.d.cts","import":"./v4/locales/index.js","require":"./v4/locales/index.cjs"},"./v4/locales/*":{"@zod/source":"./src/v4/locales/*","types":"./v4/locales/*","import":"./v4/locales/*","require":"./v4/locales/*"}},"repository":{"type":"git","url":"git+https://github.com/colinhacks/zod.git"},"bugs":{"url":"https://github.com/colinhacks/zod/issues"},"support":{"backing":{"npm-funding":true}},"scripts":{"clean":"git clean -xdf . -e node_modules","build":"zshy --project tsconfig.build.json","postbuild":"tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .","test:watch":"pnpm vitest","test":"pnpm vitest run","prepublishOnly":"tsx ../../scripts/check-versions.ts"},"_lastModified":"2026-05-10T15:05:42.311Z"}

package/dist/server/flow-surfaces/route-sync.d.ts

@@ -10,7 +10,10 @@ import FlowModelRepository from '../repository';
 export declare class FlowSurfaceRouteSync {
     private readonly db;
     private readonly repository;
-    constructor(db: any, repository: FlowModelRepository);
+    private readonly patchModel;
+    constructor(db: any, repository: FlowModelRepository, patchModel?: (values: Record<string, any>, options?: {
+        transaction?: any;
+    }) => Promise<any>);
     buildPageTree(pageRouteLike: any, transaction?: any): Promise<any>;
     buildTabAnchor(tabRouteLike: any, transaction?: any): Promise<{
         subModels?: {

package/dist/server/flow-surfaces/route-sync.js

@@ -42,9 +42,10 @@ module.exports = __toCommonJS(route_sync_exports);
 var import_lodash = __toESM(require("lodash"));
 var import_builder = require("./builder");
 class FlowSurfaceRouteSync {
-  constructor(db, repository) {
+  constructor(db, repository, patchModel = (values, options) => repository.patch(values, options)) {
     this.db = db;
     this.repository = repository;
+    this.patchModel = patchModel;
   }
   async buildPageTree(pageRouteLike, transaction) {
     var _a, _b, _c, _d, _e, _f, _g;
@@ -182,7 +183,7 @@ class FlowSurfaceRouteSync {
       includeAsyncNode: true
     }) : null);
     if (pageModel == null ? void 0 : pageModel.uid) {
-      await this.repository.patch(
+      await this.patchModel(
         {
           ...this.normalizePagePayload(current, nextPayload, routeValues),
           uid: pageModel.uid
@@ -206,7 +207,7 @@ class FlowSurfaceRouteSync {
       return;
     }
     const latestRoute = await this.hydrateRoute(target.tabRoute, transaction);
-    await this.repository.patch(
+    await this.patchModel(
       this.normalizeTabPayload(await this.buildTabAnchor(latestRoute, transaction), nextPayload, routeValues),
       { transaction }
     );

package/dist/server/flow-surfaces/service.d.ts

@@ -49,6 +49,8 @@ export declare class FlowSurfacesService {
     private get approvalRuntimeConfigService();
     private get approvalBlueprintService();
     private get hiddenPopupRuntime();
+    private normalizeFlowSurfaceModelOptionsPatch;
+    private patchFlowSurfaceModelOptions;
     private setFlowModelNodeAsyncFlag;
     private loadEnabledPluginPackages;
     private resolveEnabledPluginPackages;

package/dist/server/flow-surfaces/service.js

@@ -296,6 +296,7 @@ const POPUP_ASSOCIATED_RECORDS_BLOCK_USES = /* @__PURE__ */ new Set([
   "MapBlockModel",
   "CommentsBlockModel"
 ]);
+const FLOW_SURFACE_MODEL_OPTION_PATCH_OMIT_KEYS = ["uid", "name", "options"];
 const POPUP_COLLECTION_BLOCK_SCENES = {
   CreateFormModel: ["new"],
   EditFormModel: ["one", "many"],
@@ -448,7 +449,11 @@ class FlowSurfacesService {
     return new import_locator.SurfaceLocator(this.db, this.repository);
   }
   get routeSync() {
-    return new import_route_sync.FlowSurfaceRouteSync(this.db, this.repository);
+    return new import_route_sync.FlowSurfaceRouteSync(
+      this.db,
+      this.repository,
+      (values, options) => this.patchFlowSurfaceModelOptions(values, options)
+    );
   }
   getFlowTemplateRepository(actionName) {
     try {
@@ -524,7 +529,13 @@ class FlowSurfacesService {
         var _a, _b;
         return !!((_b = (_a = this.plugin.app.dataSourceManager) == null ? void 0 : _a.get) == null ? void 0 : _b.call(_a, dataSourceKey));
       },
-      repository: this.repository,
+      repository: {
+        findModelById: (uid2, options) => this.repository.findModelById(uid2, options),
+        findModelByParentId: (parentUid, options) => this.repository.findModelByParentId(parentUid, options),
+        insertModel: (model, options) => this.repository.insertModel(model, options),
+        upsertModel: (model, options) => this.repository.upsertModel(model, options),
+        patch: (values, options) => this.patchFlowSurfaceModelOptions(values, options)
+      },
       setNodeAsyncFlag: (uid2, asyncFlag, transaction) => this.setFlowModelNodeAsyncFlag(uid2, asyncFlag, transaction),
       removeNodeTreeWithBindings: (uid2, transaction) => this.removeNodeTreeWithBindings(uid2, transaction),
       surfaceContext: this.surfaceContext,
@@ -538,7 +549,11 @@ class FlowSurfacesService {
   }
   get hiddenPopupRuntime() {
     return {
-      repository: this.repository,
+      repository: {
+        findModelById: (uid2, options) => this.repository.findModelById(uid2, options),
+        patch: (values, options) => this.patchFlowSurfaceModelOptions(values, options),
+        upsertModel: (model, options) => this.repository.upsertModel(model, options)
+      },
       buildPopupOpenViewWithTemplate: (input) => this.buildPopupOpenViewWithTemplate(input),
       clearFlowTemplateUsagesForNodeTree: (uid2, transaction) => this.clearFlowTemplateUsagesForNodeTree(uid2, transaction),
       ensurePopupHostDefaultContent: (input) => this.ensurePopupHostDefaultContent(input),
@@ -547,6 +562,39 @@ class FlowSurfacesService {
       syncFlowTemplateUsagesForNodeTree: (uid2, transaction) => this.syncFlowTemplateUsagesForNodeTree(uid2, transaction)
     };
   }
+  normalizeFlowSurfaceModelOptionsPatch(values) {
+    return import_lodash.default.omit(import_lodash.default.cloneDeep(values || {}), FLOW_SURFACE_MODEL_OPTION_PATCH_OMIT_KEYS);
+  }
+  async patchFlowSurfaceModelOptions(values, options = {}) {
+    const normalizedUid = String((values == null ? void 0 : values.uid) || "").trim();
+    if (!normalizedUid) {
+      (0, import_errors.throwBadRequest)("flowSurfaces model patch requires uid");
+    }
+    const model = await this.repository.model.findByPk(normalizedUid, {
+      transaction: options.transaction
+    });
+    if (!model) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces model '${normalizedUid}' does not exist`);
+    }
+    const currentOptions = import_repository.default.optionsToJson(model.get("options") || {});
+    const nextOptions = {
+      ...currentOptions,
+      ...this.normalizeFlowSurfaceModelOptionsPatch(values)
+    };
+    delete nextOptions.uid;
+    delete nextOptions.name;
+    delete nextOptions.options;
+    model.set("options", nextOptions);
+    await model.save({
+      transaction: options.transaction,
+      hooks: false
+    });
+    await this.repository.clearXUidPathCache(normalizedUid, options.transaction);
+    await this.repository.emitAfterSaveEvent(model, options);
+    if (values == null ? void 0 : values["x-server-hooks"]) {
+      await this.db.emitAsync(`${this.repository.collection.name}.afterSave`, model, options);
+    }
+  }
   async setFlowModelNodeAsyncFlag(uid2, asyncFlag, transaction) {
     var _a, _b;
     const sequelize = (_a = this.db) == null ? void 0 : _a.sequelize;
@@ -2048,7 +2096,7 @@ class FlowSurfacesService {
     } else {
       import_lodash.default.set(nextStepParams, [slot.flowKey, slot.stepKey, slot.valuePath], import_lodash.default.cloneDeep(canonicalRules));
     }
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: targetUid,
         stepParams: nextStepParams
@@ -2351,13 +2399,13 @@ class FlowSurfacesService {
   async patchDeclaredKeyModel(values, options) {
     const normalizedUid = String((values == null ? void 0 : values.uid) || "").trim();
     if (!normalizedUid) {
-      return this.repository.patch(values, options);
+      return this.patchFlowSurfaceModelOptions(values, options);
     }
     const persisted = await this.repository.model.findByPk(normalizedUid, {
       transaction: options == null ? void 0 : options.transaction
     });
     if (persisted) {
-      return this.repository.patch(values, options);
+      return this.patchFlowSurfaceModelOptions(values, options);
     }
     const currentNode = await this.repository.findModelById(normalizedUid, {
       transaction: options == null ? void 0 : options.transaction,
@@ -2379,7 +2427,7 @@ class FlowSurfacesService {
       );
       return;
     }
-    return this.repository.patch(values, options);
+    return this.patchFlowSurfaceModelOptions(values, options);
   }
   async persistCreatedKeysForAction(actionName, values, result, transaction) {
     const keyPersistenceDeps = this.getDeclaredKeyPersistenceDeps();
@@ -3199,7 +3247,7 @@ class FlowSurfacesService {
   async hydrateDetachedPopupTemplateBlockResourceContext(detachedTarget, context, transaction) {
     const patches = this.collectDetachedPopupTemplateBlockResourceContextPatches(detachedTarget, context);
     for (const patch of patches) {
-      await this.repository.patch(
+      await this.patchFlowSurfaceModelOptions(
         {
           uid: patch.uid,
           stepParams: patch.stepParams
@@ -3239,7 +3287,7 @@ class FlowSurfacesService {
       if (!import_lodash.default.isEqual(nextOpenView, currentOpenView)) {
         currentGroup[resolvedOpenViewStep.stepKey] = nextOpenView;
         nextStepParams[resolvedOpenViewStep.flowKey] = currentGroup;
-        await this.repository.patch(
+        await this.patchFlowSurfaceModelOptions(
           {
             uid: detachedTarget.uid,
             stepParams: nextStepParams
@@ -3482,7 +3530,7 @@ class FlowSurfacesService {
     currentGroup[openViewStep.stepKey] = nextOpenView;
     nextStepParams[openViewStep.flowKey] = currentGroup;
     await this.cleanupLocalPopupSurfaceForHost(sourceNode.uid, transaction, sourceNode);
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: sourceNode.uid,
         stepParams: nextStepParams
@@ -3780,7 +3828,7 @@ class FlowSurfacesService {
       }
       nextStepParams[resolved.openViewStep.flowKey] = currentGroup;
       await this.cleanupLocalPopupSurfaceForHost(node.uid, options.transaction, node);
-      await this.repository.patch(
+      await this.patchFlowSurfaceModelOptions(
         {
           uid: node.uid,
           stepParams: nextStepParams
@@ -4648,7 +4696,7 @@ class FlowSurfacesService {
     if (Object.keys(nextPayload).length === 1) {
       return { uid: popupTab.uid };
     }
-    await this.repository.patch(nextPayload, { transaction: options.transaction });
+    await this.patchFlowSurfaceModelOptions(nextPayload, { transaction: options.transaction });
     return (0, import_service_utils.buildDefinedPayload)({
       uid: popupTab.uid,
       title: values.title,
@@ -8067,7 +8115,7 @@ class FlowSurfacesService {
     const currentGroup = import_lodash.default.isPlainObject(nextStepParams[openViewStep.flowKey]) ? import_lodash.default.cloneDeep(nextStepParams[openViewStep.flowKey]) : {};
     currentGroup[openViewStep.stepKey] = nextOpenView;
     nextStepParams[openViewStep.flowKey] = currentGroup;
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: actionNode.uid,
         stepParams: nextStepParams
@@ -8117,7 +8165,7 @@ class FlowSurfacesService {
     }
     currentGroup[stepKey] = nextOpenView;
     nextStepParams[flowKey] = currentGroup;
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: actionNode.uid,
         stepParams: nextStepParams
@@ -8380,7 +8428,7 @@ class FlowSurfacesService {
         updated: Object.keys(import_lodash.default.omit(nextPayload, ["uid"]))
       };
     }
-    await this.repository.patch(nextPayload, { transaction: options.transaction });
+    await this.patchFlowSurfaceModelOptions(nextPayload, { transaction: options.transaction });
     if (!import_lodash.default.isUndefined(updateActionAssignedValues)) {
       await this.syncUpdateActionAssignFormItems(current.uid, updateActionAssignedValues, options.transaction);
     }
@@ -9286,7 +9334,7 @@ class FlowSurfacesService {
         flowRegistry: flows
       };
     }
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: target.uid,
         flowRegistry: flows
@@ -9311,7 +9359,7 @@ class FlowSurfacesService {
     const sizes = values.sizes || {};
     const rowOrder = values.rowOrder || Object.keys(rows);
     this.contractGuard.validateLayout(grid, { rows, sizes, rowOrder });
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: grid.uid,
         props: {
@@ -13539,7 +13587,7 @@ class FlowSurfacesService {
     if (import_lodash.default.isEqual(nextConfigs, currentConfigs)) {
       return;
     }
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: blockGrid.uid,
         filterManager: nextConfigs
@@ -13569,7 +13617,7 @@ class FlowSurfacesService {
       targetId: input.targetBlockUid,
       filterPaths: this.buildFilterFormTargetPaths(input.resourceInit, input.fieldPath, input.associationPathName)
     });
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: blockGrid.uid,
         filterManager: nextConfigs
@@ -13587,7 +13635,7 @@ class FlowSurfacesService {
     if (import_lodash.default.isEqual(nextConfigs, currentConfigs)) {
       return;
     }
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: blockGrid.uid,
         filterManager: nextConfigs
@@ -13605,7 +13653,7 @@ class FlowSurfacesService {
     if (import_lodash.default.isEqual(nextConfigs, currentConfigs)) {
       return;
     }
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: blockGrid.uid,
         filterManager: nextConfigs
@@ -13748,7 +13796,7 @@ class FlowSurfacesService {
       if (innerFieldUid) {
         const innerField = ((_f = current == null ? void 0 : current.subModels) == null ? void 0 : _f.field) || await this.repository.findModelById(innerFieldUid, { transaction, includeAsyncNode: true });
         if (innerField == null ? void 0 : innerField.uid) {
-          await this.repository.patch(
+          await this.patchFlowSurfaceModelOptions(
             {
               uid: innerField.uid,
               stepParams: {
@@ -13783,7 +13831,7 @@ class FlowSurfacesService {
         fieldSettings: nextFieldSettings
       }
     };
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: parentUid,
         stepParams: nextWrapper.stepParams
@@ -13995,7 +14043,7 @@ class FlowSurfacesService {
     if (import_lodash.default.isEqual(currentOpenView, openView)) {
       return false;
     }
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: actionUid,
         stepParams: (0, import_hidden_popup_contract.buildHiddenPopupActionStepParams)(actionNode.stepParams, openView)
@@ -15636,7 +15684,7 @@ class FlowSurfacesService {
         showIndex: input.showIndex
       });
       if (Object.keys(props).length) {
-        await this.repository.patch(
+        await this.patchFlowSurfaceModelOptions(
           {
             uid: input.fieldUid,
             props: {
@@ -15731,7 +15779,7 @@ class FlowSurfacesService {
       collectionName: (0, import_service_helpers.getCollectionName)(input.targetCollection)
     });
     if (Object.keys(openView).length > 2) {
-      await this.repository.patch(
+      await this.patchFlowSurfaceModelOptions(
         {
           uid: input.fieldUid,
           stepParams: import_lodash.default.merge({}, (fieldNode == null ? void 0 : fieldNode.stepParams) || {}, {
@@ -15820,7 +15868,7 @@ class FlowSurfacesService {
       },
       rowOrder: ["row1"]
     };
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: grid.uid,
         props: {
@@ -15870,7 +15918,7 @@ class FlowSurfacesService {
         init: this.buildExactFieldSettingsInitPayload(input)
       }
     };
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: node.uid,
         stepParams: nextStepParams
@@ -16032,7 +16080,7 @@ class FlowSurfacesService {
         }
       }
     });
-    await this.repository.patch(
+    await this.patchFlowSurfaceModelOptions(
       {
         uid: wrapperNode.uid,
         stepParams: nextStepParams
@@ -16058,7 +16106,7 @@ class FlowSurfacesService {
       enabledPackages: input.enabledPackages
     });
     if (innerField.use === normalizedTargetUse) {
-      await this.repository.patch(
+      await this.patchFlowSurfaceModelOptions(
         {
           uid: innerField.uid,
           stepParams: import_lodash.default.merge({}, innerField.stepParams || {}, {
@@ -16103,7 +16151,7 @@ class FlowSurfacesService {
       }),
       subModels: nextSubModels
     };
-    await this.repository.patch(nextFieldNode, { transaction: input.transaction });
+    await this.patchFlowSurfaceModelOptions(nextFieldNode, { transaction: input.transaction });
     return normalizedTargetUse;
   }
   parseFieldPath(collection, fieldPath, associationPathName, dataSourceKey, collectionName) {

package/dist/server/migrations/20260508000000-remove-flow-model-options-runtime-uid.d.ts

@@ -0,0 +1,13 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Migration } from '@nocobase/server';
+export default class extends Migration {
+    on: string;
+    up(): Promise<void>;
+}

package/dist/server/migrations/20260508000000-remove-flow-model-options-runtime-uid.js

@@ -0,0 +1,67 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var remove_flow_model_options_runtime_uid_exports = {};
+__export(remove_flow_model_options_runtime_uid_exports, {
+  default: () => remove_flow_model_options_runtime_uid_default
+});
+module.exports = __toCommonJS(remove_flow_model_options_runtime_uid_exports);
+var import_server = require("@nocobase/server");
+var import_lodash = __toESM(require("lodash"));
+/* istanbul ignore file -- @preserve */
+class remove_flow_model_options_runtime_uid_default extends import_server.Migration {
+  on = "afterLoad";
+  async up() {
+    var _a, _b;
+    const repository = this.context.db.getRepository("flowModels");
+    const rows = await repository.find();
+    for (const row of rows) {
+      const rowUid = String(((_a = row.get) == null ? void 0 : _a.call(row, "uid")) || row.uid || "").trim();
+      const options = ((_b = row.get) == null ? void 0 : _b.call(row, "options")) || row.options;
+      if (!rowUid || !import_lodash.default.isPlainObject(options) || options.uid !== rowUid) {
+        continue;
+      }
+      await row.update(
+        {
+          options: import_lodash.default.omit(options, ["uid"])
+        },
+        {
+          hooks: false
+        }
+      );
+    }
+  }
+}

package/package.json

@@ -4,7 +4,7 @@
   "displayName.zh-CN": "前端流引擎",
   "description": "",
   "description.zh-CN": "",
-  "version": "2.1.0-beta.26",
+  "version": "2.1.0-beta.29",
   "main": "./dist/server/index.js",
   "license": "Apache-2.0",
   "devDependencies": {
@@ -24,5 +24,5 @@
     "@nocobase/test": "2.x",
     "@nocobase/utils": "2.x"
   },
-  "gitHead": "b17e1a72057813fa27d8435bf0f2af67ea4b059f"
+  "gitHead": "86c41be29dcbcac6fd6aa46b4a137ef07a27c1d0"
 }