@nocobase/plugin-flow-engine 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/server/flow-surfaces/reaction/types.d.ts

@@ -163,6 +163,13 @@ export type FlowSurfaceReactionCapabilityBase<TKind extends FlowSurfaceReactionK
 };
 export type FlowSurfaceFieldValueCapability = FlowSurfaceReactionCapabilityBase<'fieldValue', FlowSurfaceFieldValueRule> & {
     targetFields: FlowSurfaceFieldOption[];
+    conditionMeta: {
+        operatorsByPath: Record<string, string[]>;
+        fieldMetaByPath?: Record<string, {
+            type?: string;
+            interface?: string;
+        }>;
+    };
     valueExprMeta: {
         supportedSources: Array<'literal' | 'path' | 'runjs'>;
         runjsScene: 'fieldValue';
@@ -172,17 +179,29 @@ export type FlowSurfaceLinkageCapability = (FlowSurfaceReactionCapabilityBase<'b
     supportedActions: Array<Record<string, any>>;
     conditionMeta: {
         operatorsByPath: Record<string, string[]>;
+        fieldMetaByPath?: Record<string, {
+            type?: string;
+            interface?: string;
+        }>;
     };
 }) | (FlowSurfaceReactionCapabilityBase<'actionLinkage', FlowSurfaceActionLinkageRule> & {
     supportedActions: Array<Record<string, any>>;
     conditionMeta: {
         operatorsByPath: Record<string, string[]>;
+        fieldMetaByPath?: Record<string, {
+            type?: string;
+            interface?: string;
+        }>;
     };
 }) | (FlowSurfaceReactionCapabilityBase<'fieldLinkage', FlowSurfaceFieldLinkageRule> & {
     supportedActions: Array<Record<string, any>>;
     targetFields: FlowSurfaceFieldOption[];
     conditionMeta: {
         operatorsByPath: Record<string, string[]>;
+        fieldMetaByPath?: Record<string, {
+            type?: string;
+            interface?: string;
+        }>;
     };
     valueExprMeta?: {
         supportedSources: Array<'literal' | 'path' | 'runjs'>;

package/dist/server/flow-surfaces/relation-backing-foreign-key.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare function collectRelationBackingForeignKeyNames(collection: any): Set<string>;
+export declare function isRelationBackingForeignKeyField(collection: any, fieldOrFieldName: any): boolean;

package/dist/server/flow-surfaces/relation-backing-foreign-key.js

@@ -0,0 +1,79 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var relation_backing_foreign_key_exports = {};
+__export(relation_backing_foreign_key_exports, {
+  collectRelationBackingForeignKeyNames: () => collectRelationBackingForeignKeyNames,
+  isRelationBackingForeignKeyField: () => isRelationBackingForeignKeyField
+});
+module.exports = __toCommonJS(relation_backing_foreign_key_exports);
+var import_service_helpers = require("./service-helpers");
+const CURRENT_COLLECTION_FOREIGN_KEY_RELATION_TYPES = /* @__PURE__ */ new Set(["belongsto"]);
+const CURRENT_COLLECTION_FOREIGN_KEY_RELATION_INTERFACES = /* @__PURE__ */ new Set(["m2o"]);
+const CONDITIONAL_CURRENT_COLLECTION_FOREIGN_KEY_RELATION_INTERFACES = /* @__PURE__ */ new Set(["o2o"]);
+const RELATION_INTERFACES_WITH_FOREIGN_KEYS_OUTSIDE_CURRENT_COLLECTION = /* @__PURE__ */ new Set(["o2m", "m2m", "mbm"]);
+const RELATION_TYPES_WITH_FOREIGN_KEYS_OUTSIDE_CURRENT_COLLECTION = /* @__PURE__ */ new Set(["hasone", "hasmany", "belongstomany"]);
+function collectRelationBackingForeignKeyNames(collection) {
+  const fields = (0, import_service_helpers.getCollectionFields)(collection);
+  const scalarFieldNames = new Set(
+    fields.filter((field) => !(0, import_service_helpers.isAssociationField)(field)).map((field) => String((0, import_service_helpers.getFieldName)(field) || "").trim()).filter(Boolean)
+  );
+  const names = /* @__PURE__ */ new Set();
+  fields.forEach((field) => {
+    const foreignKey = getCurrentCollectionRelationForeignKey(field);
+    if (foreignKey && scalarFieldNames.has(foreignKey)) {
+      names.add(foreignKey);
+    }
+  });
+  return names;
+}
+function isRelationBackingForeignKeyField(collection, fieldOrFieldName) {
+  const fieldName = typeof fieldOrFieldName === "string" ? fieldOrFieldName.trim() : String((0, import_service_helpers.getFieldName)(fieldOrFieldName) || "").trim();
+  return !!fieldName && collectRelationBackingForeignKeyNames(collection).has(fieldName);
+}
+function getCurrentCollectionRelationForeignKey(field) {
+  var _a;
+  if (!(0, import_service_helpers.isAssociationField)(field)) {
+    return "";
+  }
+  if (!relationCanStoreForeignKeyInCurrentCollection(field)) {
+    return "";
+  }
+  return String((field == null ? void 0 : field.foreignKey) || ((_a = field == null ? void 0 : field.options) == null ? void 0 : _a.foreignKey) || "").trim();
+}
+function relationCanStoreForeignKeyInCurrentCollection(field) {
+  const type = String((0, import_service_helpers.getFieldType)(field) || "").trim().toLowerCase();
+  const fieldInterface = String((0, import_service_helpers.getFieldInterface)(field) || "").trim().toLowerCase();
+  if (RELATION_TYPES_WITH_FOREIGN_KEYS_OUTSIDE_CURRENT_COLLECTION.has(type) || RELATION_INTERFACES_WITH_FOREIGN_KEYS_OUTSIDE_CURRENT_COLLECTION.has(fieldInterface)) {
+    return false;
+  }
+  return CURRENT_COLLECTION_FOREIGN_KEY_RELATION_TYPES.has(type) || CURRENT_COLLECTION_FOREIGN_KEY_RELATION_INTERFACES.has(fieldInterface) || CONDITIONAL_CURRENT_COLLECTION_FOREIGN_KEY_RELATION_INTERFACES.has(fieldInterface);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  collectRelationBackingForeignKeyNames,
+  isRelationBackingForeignKeyField
+});

package/dist/server/flow-surfaces/runjs-authoring/ast/source.d.ts

@@ -23,6 +23,7 @@ export declare function getPreviousSignificantTokenInfo(sourceLike: string | str
 export declare function skipQuotedLiteral(source: string, start: number, quote: string): number;
 export declare function skipTemplateLiteral(source: string, start: number): number;
 export declare function findFunctionRanges(masked: string): SourceRange[];
+export declare function collectAstFunctionBodyRanges(ast: unknown): SourceRange[];
 export declare function collectFunctionRanges(masked: string, pattern: RegExp, ranges: SourceRange[]): void;
 export declare function collectArrowExpressionRanges(masked: string, ranges: SourceRange[]): void;
 export declare function collectMethodFunctionRanges(masked: string, ranges: SourceRange[]): void;

package/dist/server/flow-surfaces/runjs-authoring/ast/source.js

@@ -27,6 +27,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var source_exports = {};
 __export(source_exports, {
   collectArrowExpressionRanges: () => collectArrowExpressionRanges,
+  collectAstFunctionBodyRanges: () => collectAstFunctionBodyRanges,
   collectBraceRanges: () => collectBraceRanges,
   collectComputedMethodCandidates: () => collectComputedMethodCandidates,
   collectFunctionRanges: () => collectFunctionRanges,
@@ -69,6 +70,7 @@ __export(source_exports, {
 });
 module.exports = __toCommonJS(source_exports);
 var import_constants = require("../runtime/constants");
+var import_walk = require("./walk");
 function maskJavaScriptSource(source) {
   const chars = source.split("");
   const maskRange = (start, end) => {
@@ -406,6 +408,23 @@ function findFunctionRanges(masked) {
   collectMethodFunctionRanges(masked, ranges);
   return mergeRanges(ranges);
 }
+function collectAstFunctionBodyRanges(ast) {
+  const ranges = [];
+  const addBodyRange = (node) => {
+    var _a, _b;
+    const start = (_a = node.body) == null ? void 0 : _a.start;
+    const end = (_b = node.body) == null ? void 0 : _b.end;
+    if (typeof start === "number" && typeof end === "number" && end > start) {
+      ranges.push({ start, end });
+    }
+  };
+  (0, import_walk.walkAstSimple)(ast, {
+    FunctionDeclaration: addBodyRange,
+    FunctionExpression: addBodyRange,
+    ArrowFunctionExpression: addBodyRange
+  });
+  return mergeRanges(ranges);
+}
 function collectFunctionRanges(masked, pattern, ranges) {
   for (const match of masked.matchAll(pattern)) {
     const openBrace = masked.indexOf("{", match.index || 0);
@@ -853,6 +872,7 @@ function getAstSource(node, source) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   collectArrowExpressionRanges,
+  collectAstFunctionBodyRanges,
   collectBraceRanges,
   collectComputedMethodCandidates,
   collectFunctionRanges,

package/dist/server/flow-surfaces/runjs-authoring/rules.js

@@ -32,7 +32,6 @@ __export(rules_exports, {
 });
 module.exports = __toCommonJS(rules_exports);
 var import_blocked_capability_reroute = require("./blocked-capability-reroute");
-var import_blocked_global_stop = require("./blocked-global-stop");
 var import_ctx_libs_member_mismatch_stop = require("./ctx-libs-member-mismatch-stop");
 var import_ctx_root_mismatch_stop = require("./ctx-root-mismatch-stop");
 var import_missing_top_level_return = require("./missing-top-level-return");
@@ -61,7 +60,6 @@ const RUNJS_AUTHORING_RULES = [
   import_replace_innerhtml_with_render.replaceInnerHtmlWithRenderRule,
   import_render_top_level_function_wrapper.renderTopLevelFunctionWrapperRule,
   import_render_unreachable_render_call.renderUnreachableRenderCallRule,
-  import_blocked_global_stop.blockedGlobalStopRule,
   import_unknown_global_stop.unknownGlobalStopRule,
   import_blocked_capability_reroute.blockedCapabilityRerouteRule,
   import_react_runtime_contract_stop.reactRuntimeContractStopRule,

package/dist/server/flow-surfaces/runjs-authoring/runtime/constants.d.ts

@@ -21,7 +21,6 @@ export declare const BLOCKED_CTX_CAPABILITIES: Record<string, {
     capability: string;
     reroute: string;
 }>;
-export declare const FORBIDDEN_BARE_GLOBALS: Set<string>;
 export declare const RUNJS_ALLOWED_BARE_GLOBALS: Set<string>;
 export declare const RUNJS_ALLOWED_BARE_GLOBALS_BY_MODEL_USE: Record<string, Set<string>>;
 export declare const NON_METHOD_CALL_KEYWORDS: Set<string>;

package/dist/server/flow-surfaces/runjs-authoring/runtime/constants.js

@@ -50,7 +50,6 @@ __export(constants_exports, {
   FLOW_RESOURCE_CLASS_NAMES: () => FLOW_RESOURCE_CLASS_NAMES,
   FLOW_RESOURCE_METHODS_BY_TYPE: () => FLOW_RESOURCE_METHODS_BY_TYPE,
   FLOW_RESOURCE_METHOD_SUGGESTIONS: () => FLOW_RESOURCE_METHOD_SUGGESTIONS,
-  FORBIDDEN_BARE_GLOBALS: () => FORBIDDEN_BARE_GLOBALS,
   INIT_RESOURCE_CLASS_NAMES: () => INIT_RESOURCE_CLASS_NAMES,
   KNOWN_MODEL_USES: () => KNOWN_MODEL_USES,
   MAX_RUNJS_ERRORS_PER_SOURCE: () => MAX_RUNJS_ERRORS_PER_SOURCE,
@@ -160,6 +159,7 @@ const SURFACE_ALLOWED_MODEL_USES = {
 };
 const ALLOWED_CTX_ROOTS = /* @__PURE__ */ new Set([
   "acl",
+  "ai",
   "antd",
   "antdIcons",
   "api",
@@ -224,7 +224,12 @@ const ALLOWED_CTX_ROOTS = /* @__PURE__ */ new Set([
 ]);
 const CHART_CTX_ROOTS = /* @__PURE__ */ new Set(["data"]);
 const BLOCKED_CTX_CAPABILITIES = {};
-const FORBIDDEN_BARE_GLOBALS = /* @__PURE__ */ new Set([
+const RUNJS_ALLOWED_BARE_GLOBALS = /* @__PURE__ */ new Set([
+  "ctx",
+  "console",
+  "window",
+  "document",
+  "navigator",
   "fetch",
   "localStorage",
   "sessionStorage",
@@ -237,22 +242,6 @@ const FORBIDDEN_BARE_GLOBALS = /* @__PURE__ */ new Set([
   "EventSource",
   "indexedDB",
   "caches",
-  "Function",
-  "eval",
-  "globalThis",
-  "Intl",
-  "process",
-  "require",
-  "module",
-  "exports",
-  "location"
-]);
-const RUNJS_ALLOWED_BARE_GLOBALS = /* @__PURE__ */ new Set([
-  "ctx",
-  "console",
-  "window",
-  "document",
-  "navigator",
   "setTimeout",
   "clearTimeout",
   "setInterval",
@@ -296,9 +285,14 @@ const RUNJS_ALLOWED_BARE_GLOBALS = /* @__PURE__ */ new Set([
   "WeakMap",
   "WeakRef",
   "WeakSet",
+  "Function",
+  "eval",
+  "globalThis",
+  "Intl",
   "JSON",
   "Blob",
   "URL",
+  "location",
   "decodeURI",
   "decodeURIComponent",
   "encodeURI",
@@ -714,7 +708,6 @@ function escapeRegExp(value) {
   FLOW_RESOURCE_CLASS_NAMES,
   FLOW_RESOURCE_METHODS_BY_TYPE,
   FLOW_RESOURCE_METHOD_SUGGESTIONS,
-  FORBIDDEN_BARE_GLOBALS,
   INIT_RESOURCE_CLASS_NAMES,
   KNOWN_MODEL_USES,
   MAX_RUNJS_ERRORS_PER_SOURCE,

package/dist/server/flow-surfaces/runjs-authoring/runtime/types.d.ts

@@ -40,9 +40,6 @@ export type RunJsScanResult = RunJsAstInspection & {
         match: string;
     }>;
     dynamicCtxAccesses: IndexedEntry[];
-    forbiddenBareGlobals: Array<IndexedEntry & {
-        name: string;
-    }>;
     functionRanges: SourceRange[];
     invalidCtxLibMemberAccesses: InvalidCtxLibMemberAccess[];
     invalidReactRuntimeBindings: InvalidReactRuntimeBinding[];
@@ -65,15 +62,6 @@ export type RunJsScanResult = RunJsAstInspection & {
     }>;
     topLevelReturns: IndexedEntry[];
     unboundReactCreateElementCalls: IndexedEntry[];
-    windowDocumentNavigatorAliases: Array<{
-        alias: string;
-        index: number;
-        root: string;
-    }>;
-    windowDocumentNavigatorUses: Array<IndexedEntry & {
-        member: string;
-        root: string;
-    }>;
 };
 export type RunJsInspectionRuntime = {
     context: RunJsAuthoringContext;

package/dist/server/flow-surfaces/runjs-authoring/scan/filter.js

@@ -900,7 +900,13 @@ function buildRunJsResourceFilterOperatorError(operator, index, input) {
   };
 }
 function buildRunJsResourceDateFilterValueError(operator, index, valueNode, input) {
-  if (!isRunJsDateFilterOperator(operator)) {
+  const fieldType = String((0, import_service_helpers.getFieldType)(input.field) || "").trim();
+  const fieldInterface = String((0, import_service_helpers.getFieldInterface)(input.field) || "").trim();
+  const shouldValidateDateValue = isRunJsDateFilterOperator(operator) || (0, import_filter_group.isFlowSurfaceDateLikeFieldMeta)({
+    type: fieldType,
+    interface: fieldInterface
+  });
+  if (!shouldValidateDateValue) {
     return null;
   }
   const valueObject = resolveRunJsStaticFilterObjectNode(
@@ -924,7 +930,11 @@ function buildRunJsResourceDateFilterValueError(operator, index, valueNode, inpu
     return null;
   }
   try {
-    (0, import_filter_group.normalizeFlowSurfaceStrictFilterDateValue)(operator, resolvedValue.value, `${input.fieldPath}.${operator}`);
+    (0, import_filter_group.normalizeFlowSurfaceDateConditionValue)(operator, resolvedValue.value, `${input.fieldPath}.${operator}`, {
+      fieldPath: input.fieldPath,
+      fieldType,
+      fieldInterface
+    });
     return null;
   } catch (error) {
     return buildRunJsStrictDateFilterValueError(operator, index, resolvedValue.value, input, error);

package/dist/server/flow-surfaces/runjs-authoring/scan/index.d.ts

@@ -149,16 +149,6 @@ export declare function scanJavaScriptSource(source: string, ast?: any, context?
         alias: string;
         index: number;
     }[];
-    windowDocumentNavigatorUses: {
-        root: string;
-        member: string;
-        index: number;
-    }[];
-    windowDocumentNavigatorAliases: {
-        alias: string;
-        root: string;
-        index: number;
-    }[];
     ctxAliases: {
         alias: string;
         index: number;
@@ -179,10 +169,6 @@ export declare function scanJavaScriptSource(source: string, ast?: any, context?
         ruleId: "runjs-ctx-member-not-callable";
     }[];
     invalidCtxLibMemberAccesses: import("../internal-types").InvalidCtxLibMemberAccess[];
-    forbiddenBareGlobals: {
-        name: string;
-        index: number;
-    }[];
     ctxMemberAccesses: {
         member: string;
         index: number;

package/dist/server/flow-surfaces/runjs-authoring/scan/index.js

@@ -43,7 +43,7 @@ var import_filter = require("./filter");
 var import_constants = require("../runtime/constants");
 function scanJavaScriptSource(source, ast, context = {}, modelUse = "") {
   const masked = (0, import_source.maskJavaScriptSource)(source);
-  const functionRanges = (0, import_source.findFunctionRanges)(masked);
+  const functionRanges = collectScanFunctionRanges(masked, ast);
   const blockRanges = (0, import_source.collectBraceRanges)(masked);
   const staticBlockRanges = (0, import_source.collectStaticBlockRanges)(masked);
   const sourceBindings = (0, import_bindings.collectSourceBindings)(masked, functionRanges, blockRanges, staticBlockRanges);
@@ -71,10 +71,7 @@ function scanJavaScriptSource(source, ast, context = {}, modelUse = "") {
   const flowResourceAliases = (0, import_source_patterns.collectFlowResourceAliases)(masked, sourceBindings);
   const directDomWrites = (0, import_source_patterns.collectDirectDomWrites)(source, masked, sourceBindings);
   const directDomAliases = (0, import_source_patterns.collectDirectDomAliases)(masked, sourceBindings);
-  const windowDocumentNavigatorUses = (0, import_source_patterns.collectWindowDocumentNavigatorUses)(source, masked, sourceBindings);
-  const windowDocumentNavigatorAliases = (0, import_source_patterns.collectWindowDocumentNavigatorAliases)(masked, sourceBindings);
   const ctxAliases = (0, import_source_patterns.collectCtxAliases)(masked, sourceBindings);
-  const forbiddenBareGlobals = (0, import_source_patterns.collectForbiddenBareGlobals)(masked, sourceBindings);
   return {
     source,
     masked,
@@ -126,19 +123,24 @@ function scanJavaScriptSource(source, ast, context = {}, modelUse = "") {
     ),
     directDomWrites,
     directDomAliases,
-    windowDocumentNavigatorUses,
-    windowDocumentNavigatorAliases,
     ctxAliases,
     ctxLibMemberCaseMismatches: (0, import_source_patterns.collectCtxLibMemberCaseMismatches)(source, masked, sourceBindings),
     invalidCtxApiMemberAccesses: (astInspection == null ? void 0 : astInspection.invalidCtxApiMemberAccesses) || [],
     invalidCtxNonFunctionCalls: (astInspection == null ? void 0 : astInspection.invalidCtxNonFunctionCalls) || [],
     invalidCtxLibMemberAccesses: (astInspection == null ? void 0 : astInspection.invalidCtxLibMemberAccesses) || [],
-    forbiddenBareGlobals,
     ctxMemberAccesses: (0, import_source_patterns.collectCtxMemberAccesses)(masked, sourceBindings),
     dynamicCtxAccesses: (0, import_static_values.findUnboundCtxMatches)(masked, /\bctx\s*(?:\?\.\s*)?\[/g, sourceBindings),
     isTopLevelFunctionWrapper: (0, import_source_patterns.isTopLevelFunctionWrapper)(masked, functionRanges, topLevelReachableCtxRenderCalls)
   };
 }
+function collectScanFunctionRanges(masked, ast) {
+  if (!ast) {
+    return (0, import_source.findFunctionRanges)(masked);
+  }
+  const ranges = (0, import_source.collectAstFunctionBodyRanges)(ast);
+  (0, import_source.collectArrowExpressionRanges)(masked, ranges);
+  return (0, import_source.mergeRanges)(ranges);
+}
 function collectAstUnknownBareGlobalsFromAst(ast, identifierBindings, modelUse) {
   var _a;
   const allowedGlobals = new Set(import_constants.RUNJS_ALLOWED_BARE_GLOBALS);
@@ -151,7 +153,7 @@ function collectAstUnknownBareGlobalsFromAst(ast, identifierBindings, modelUse)
       if (!name) {
         return;
       }
-      if (allowedGlobals.has(name) || import_constants.FORBIDDEN_BARE_GLOBALS.has(name)) {
+      if (allowedGlobals.has(name)) {
         return;
       }
       const index = typeof node.start === "number" ? node.start : 0;

package/dist/server/flow-surfaces/runjs-authoring/scan/source-patterns.d.ts

@@ -7,10 +7,6 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import type { CtxLibMemberCaseMismatch, FlowResourceAlias, ReactComponentAlias, ResourceCallInReactHook, SourceBinding, SourceRange, StringLiteralBinding } from '../internal-types';
-export declare function collectForbiddenBareGlobals(masked: string, bindings: SourceBinding[]): {
-    name: string;
-    index: number;
-}[];
 export declare function collectInvalidApiResourceCalls(source: string, masked: string, bindings: SourceBinding[]): {
     index: number;
     match: string;
@@ -64,16 +60,6 @@ export declare function collectDirectDomWrites(source: string, masked: string, b
     index: number;
     match: string;
 }[];
-export declare function collectWindowDocumentNavigatorUses(source: string, masked: string, bindings: SourceBinding[]): {
-    root: string;
-    member: string;
-    index: number;
-}[];
-export declare function collectWindowDocumentNavigatorAliases(masked: string, bindings: SourceBinding[]): {
-    alias: string;
-    root: string;
-    index: number;
-}[];
 export declare function collectDirectDomAliases(masked: string, bindings: SourceBinding[]): {
     alias: string;
     index: number;

package/dist/server/flow-surfaces/runjs-authoring/scan/source-patterns.js

@@ -33,7 +33,6 @@ __export(source_patterns_exports, {
   collectDirectDomAliases: () => collectDirectDomAliases,
   collectDirectDomWrites: () => collectDirectDomWrites,
   collectFlowResourceAliases: () => collectFlowResourceAliases,
-  collectForbiddenBareGlobals: () => collectForbiddenBareGlobals,
   collectInvalidApiResourceCalls: () => collectInvalidApiResourceCalls,
   collectInvalidFlowResourceListCalls: () => collectInvalidFlowResourceListCalls,
   collectInvalidResourceTypeCalls: () => collectInvalidResourceTypeCalls,
@@ -43,8 +42,6 @@ __export(source_patterns_exports, {
   collectReactHookCalls: () => collectReactHookCalls,
   collectResourceCallsInReactHooks: () => collectResourceCallsInReactHooks,
   collectUnboundReactCreateElementCalls: () => collectUnboundReactCreateElementCalls,
-  collectWindowDocumentNavigatorAliases: () => collectWindowDocumentNavigatorAliases,
-  collectWindowDocumentNavigatorUses: () => collectWindowDocumentNavigatorUses,
   getResourceLikeCtxRunjsEntrypoint: () => getResourceLikeCtxRunjsEntrypoint,
   isResourceLikeCtxRequest: () => isResourceLikeCtxRequest,
   isTopLevelFunctionWrapper: () => isTopLevelFunctionWrapper
@@ -53,18 +50,6 @@ module.exports = __toCommonJS(source_patterns_exports);
 var import_constants = require("../runtime/constants");
 var import_bindings = require("../ast/bindings");
 var import_source = require("../ast/source");
-function collectForbiddenBareGlobals(masked, bindings) {
-  const entries = [];
-  for (const name of import_constants.FORBIDDEN_BARE_GLOBALS) {
-    const pattern = new RegExp(`(?<![.$\\w])${(0, import_source.escapeRegExp)(name)}\\b`, "g");
-    for (const match of masked.matchAll(pattern)) {
-      if (!(0, import_bindings.isNameBoundAtIndex)(bindings, name, match.index || 0) && !isObjectPropertyKey(masked, match.index || 0, name)) {
-        entries.push({ name, index: match.index || 0 });
-      }
-    }
-  }
-  return entries.sort((left, right) => left.index - right.index);
-}
 function collectInvalidApiResourceCalls(source, masked, bindings) {
   var _a, _b, _c, _d, _e, _f, _g, _h;
   const resourceMethods = /* @__PURE__ */ new Set(["list", "get", "create", "update", "destroy"]);
@@ -618,6 +603,16 @@ function collectDirectDomWrites(source, masked, bindings) {
     }
     entries.push({ index, match: match[0].replace(/\s*(?:\?\.)?\($/, "") });
   }
+  for (const match of masked.matchAll(
+    /\b(document)\s*(?:\?\.|\.)\s*body\s*(?:\?\.|\.)\s*(innerHTML|insertAdjacentHTML)\b|(?<![.$\w])((window|globalThis)\s*(?:\?\.|\.)\s*document)\s*(?:\?\.|\.)\s*body\s*(?:\?\.|\.)\s*(innerHTML|insertAdjacentHTML)\b/g
+  )) {
+    const index = match.index || 0;
+    const root = match[1] || match[4];
+    if (root && (0, import_bindings.isNameBoundAtIndex)(bindings, root, index)) {
+      continue;
+    }
+    entries.push({ index, match: match[0] });
+  }
   for (const match of commentMasked.matchAll(
     /\b(ctx)\s*(?:\?\.|\.)\s*element\s*(?:\?\.\s*)?\[\s*(?:(['"])([A-Za-z_$][\w$]*)\2|([^\]]+))\s*\]/g
   )) {
@@ -639,71 +634,24 @@ function collectDirectDomWrites(source, masked, bindings) {
     }
   }
   for (const match of commentMasked.matchAll(
-    /\b(element)\s*(?:\?\.\s*)?\[\s*(?:(['"])([A-Za-z_$][\w$]*)\2|([^\]]+))\s*\]/g
+    /(?<![.$\w])(window|globalThis)\s*(?:\?\.\s*)?\[\s*(['"])document\2\s*\]\s*(?:(?:\?\.|\.)\s*createElement|(?:\?\.\s*)?\[\s*(['"])createElement\3\s*\])/g
   )) {
     const index = match.index || 0;
-    const member = match[3] || "";
-    const dynamicMember = Boolean(match[4]);
-    if (isCodeTokenAt(masked, index, match[1]) && !(0, import_bindings.isNameBoundAtIndex)(bindings, match[1], index) && (dynamicMember || isDirectDomMember(member))) {
+    if (isCodeTokenAt(masked, index, match[1]) && !(0, import_bindings.isNameBoundAtIndex)(bindings, match[1], index)) {
       entries.push({ index, match: match[0] });
     }
   }
-  return entries;
-}
-function collectWindowDocumentNavigatorUses(source, masked, bindings) {
-  const commentMasked = (0, import_source.maskJavaScriptComments)(source);
-  const entries = [...masked.matchAll(/\b(window|document|navigator)\s*(?:\?\.|\.)\s*([A-Za-z_$][\w$]*)/g)].filter((match) => !(0, import_bindings.isNameBoundAtIndex)(bindings, match[1], match.index || 0)).map((match) => ({
-    root: match[1],
-    member: match[2],
-    index: match.index || 0
-  }));
   for (const match of commentMasked.matchAll(
-    /\b(window|document|navigator)\s*(?:\?\.\s*)?\[\s*(?:(['"])([A-Za-z_$][\w$]*)\2|([^\]]+))\s*\]/g
+    /\b(element)\s*(?:\?\.\s*)?\[\s*(?:(['"])([A-Za-z_$][\w$]*)\2|([^\]]+))\s*\]/g
   )) {
     const index = match.index || 0;
-    const root = match[1];
-    if (!isCodeTokenAt(masked, index, root) || (0, import_bindings.isNameBoundAtIndex)(bindings, root, index)) {
-      continue;
-    }
-    entries.push({
-      root,
-      member: match[3] || "[dynamic]",
-      index
-    });
-  }
-  return entries.sort((left, right) => left.index - right.index);
-}
-function collectWindowDocumentNavigatorAliases(masked, bindings) {
-  const entries = [];
-  collectAliasMatches(
-    masked,
-    [
-      /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(window|document|navigator)\b/g,
-      /(?<![.$\w])([A-Za-z_$][\w$]*)\s*=\s*(window|document|navigator)\b/g
-    ],
-    (match) => {
-      const alias = match[1];
-      const root = match[2];
-      const rootIndex = (match.index || 0) + match[0].lastIndexOf(root);
-      if (alias === root || (0, import_bindings.isNameBoundAtIndex)(bindings, root, rootIndex)) {
-        return;
-      }
-      entries.push({ alias, root, index: rootIndex });
-    }
-  );
-  for (const match of masked.matchAll(
-    /\b(?:const|let|var)\s*\{([^}]*)\}\s*=\s*(window|document|navigator)\b(?!\s*(?:\.|\?\.))/g
-  )) {
-    const root = match[2];
-    const rootIndex = (match.index || 0) + match[0].lastIndexOf(root);
-    if ((0, import_bindings.isNameBoundAtIndex)(bindings, root, rootIndex)) {
-      continue;
+    const member = match[3] || "";
+    const dynamicMember = Boolean(match[4]);
+    if (isCodeTokenAt(masked, index, match[1]) && !(0, import_bindings.isNameBoundAtIndex)(bindings, match[1], index) && (dynamicMember || isDirectDomMember(member))) {
+      entries.push({ index, match: match[0] });
     }
-    collectObjectBindingAliases(match[1]).forEach((alias) => {
-      entries.push({ alias, root, index: rootIndex });
-    });
   }
-  return dedupeAliasEntries(entries);
+  return entries;
 }
 function collectDirectDomAliases(masked, bindings) {
   const entries = [];
@@ -871,7 +819,6 @@ function isResourceLikeRunjsEntrypointExpression(value) {
   collectDirectDomAliases,
   collectDirectDomWrites,
   collectFlowResourceAliases,
-  collectForbiddenBareGlobals,
   collectInvalidApiResourceCalls,
   collectInvalidFlowResourceListCalls,
   collectInvalidResourceTypeCalls,
@@ -881,8 +828,6 @@ function isResourceLikeRunjsEntrypointExpression(value) {
   collectReactHookCalls,
   collectResourceCallsInReactHooks,
   collectUnboundReactCreateElementCalls,
-  collectWindowDocumentNavigatorAliases,
-  collectWindowDocumentNavigatorUses,
   getResourceLikeCtxRunjsEntrypoint,
   isResourceLikeCtxRequest,
   isTopLevelFunctionWrapper

package/dist/server/flow-surfaces/runjs-authoring/types.d.ts

@@ -6,7 +6,7 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-export type RunJsAuthoringRepairClass = 'syntax-stop' | 'nested-runjs-stop' | 'source-limit-stop' | 'switch-to-resource-api' | 'missing-top-level-return' | 'value-surface-forbids-render' | 'unknown-surface-stop' | 'unknown-model-stop' | 'replace-innerhtml-with-render' | 'render-top-level-function-wrapper' | 'render-unreachable-render-call' | 'blocked-global-stop' | 'unknown-global-stop' | 'blocked-capability-reroute' | 'react-runtime-contract-stop' | 'resource-runtime-contract-stop' | 'ctx-libs-member-mismatch-stop' | 'ctx-root-mismatch-stop';
+export type RunJsAuthoringRepairClass = 'syntax-stop' | 'nested-runjs-stop' | 'source-limit-stop' | 'switch-to-resource-api' | 'missing-top-level-return' | 'value-surface-forbids-render' | 'unknown-surface-stop' | 'unknown-model-stop' | 'replace-innerhtml-with-render' | 'render-top-level-function-wrapper' | 'render-unreachable-render-call' | 'unknown-global-stop' | 'blocked-capability-reroute' | 'react-runtime-contract-stop' | 'resource-runtime-contract-stop' | 'ctx-libs-member-mismatch-stop' | 'ctx-root-mismatch-stop';
 export type RunJsAuthoringSurfaceStyle = 'render' | 'value' | 'action';
 export interface RunJsAuthoringRuleDefinition {
     repairClass: RunJsAuthoringRepairClass;