@nocobase/plugin-flow-engine 3.0.0-alpha.7 → 3.0.0-alpha.8

package/dist/externalVersion.js

@@ -8,16 +8,16 @@
  */
 
 module.exports = {
-  "@nocobase/client": "3.0.0-alpha.7",
+  "@nocobase/client": "3.0.0-alpha.8",
   "lodash": "4.18.1",
-  "@nocobase/database": "3.0.0-alpha.7",
-  "@nocobase/data-source-manager": "3.0.0-alpha.7",
-  "@nocobase/resourcer": "3.0.0-alpha.7",
-  "@nocobase/server": "3.0.0-alpha.7",
-  "@nocobase/utils": "3.0.0-alpha.7",
-  "@nocobase/cache": "3.0.0-alpha.7",
-  "@nocobase/actions": "3.0.0-alpha.7",
+  "@nocobase/database": "3.0.0-alpha.8",
+  "@nocobase/data-source-manager": "3.0.0-alpha.8",
+  "@nocobase/resourcer": "3.0.0-alpha.8",
+  "@nocobase/server": "3.0.0-alpha.8",
+  "@nocobase/utils": "3.0.0-alpha.8",
+  "@nocobase/cache": "3.0.0-alpha.8",
+  "@nocobase/actions": "3.0.0-alpha.8",
   "sequelize": "6.35.2",
   "@formily/json-schema": "2.3.7",
-  "@nocobase/ai": "3.0.0-alpha.7"
+  "@nocobase/ai": "3.0.0-alpha.8"
 };

package/dist/node_modules/@ant-design/icons-svg/package.json

@@ -1 +1 @@
-{"name":"@ant-design/icons-svg","version":"4.3.1","sideEffects":false,"description":"Abstract nodes for ant design icons.","contributors":["HeskeyBaozi <hezhiyu233@foxmail.com>"],"homepage":"https://github.com/ant-design/ant-design-icons/","license":"MIT","main":"lib/index.js","module":"es/index.js","files":["lib","es","inline-svg","inline-namespaced-svg"],"repository":{"type":"git","url":"git+https://github.com/ant-design/ant-design-icons.git"},"scripts":{"g":"npm run generate","generate":"cross-env NODE_ENV=production gulp --require ts-node/register/transpile-only","type-check":"tsc --noEmit","build:es":"tsc --project tsconfig.build.json --module esnext --outDir es","build:lib":"tsc --project tsconfig.build.json --module commonjs --outDir lib","build":"cross-env NODE_ENV=production && npm run build:es && npm run build:lib","test":"cross-env NODE_ENV=test && npm run test:unit","test:unit":"jest","prepublishOnly":"npm run test && npm run g && npm run build && npm run type-check && npm run digest","digest":"node scripts/digest.js"},"bugs":{"url":"https://github.com/ant-design/ant-design-icons/issues"},"devDependencies":{"@babel/core":"^7.8.6","@babel/preset-env":"^7.8.6","@babel/preset-typescript":"^7.8.3","@rgrove/parse-xml":"^2.0.2","@types/gulp":"^4.0.6","@types/gulp-concat":"^0.0.32","@types/gulp-rename":"^0.0.33","@types/jest":"^25.1.3","@types/lodash.camelcase":"^4.3.6","@types/lodash.template":"^4.4.6","@types/lodash.upperfirst":"^4.3.6","@types/node":"^13.9.3","@types/ramda":"^0.26.43","@types/rgrove__parse-xml":"^1.1.0","@types/svgo":"^1.3.1","@types/through2":"^2.0.34","@typescript-eslint/eslint-plugin":"^2.21.0","@typescript-eslint/parser":"^2.21.0","babel-jest":"^25.1.0","cross-env":"^7.0.0","del":"^5.1.0","eslint":"^7.16.0","globby":"^11.0.0","gulp":"^4.0.2","gulp-clone":"^2.0.1","gulp-concat":"^2.6.1","gulp-header":"^2.0.9","gulp-rename":"^2.0.0","jest":"^25.1.0","lodash.camelcase":"^4.3.0","lodash.template":"^4.5.0","lodash.upperfirst":"^4.3.1","ramda":"^0.27.0","svgo":"^1.3.2","through2":"^3.0.1","ts-node":"^8.6.2","typescript":"^4.0.0","vinyl":"^2.2.0"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org"},"_lastModified":"2026-08-05T22:30:56.655Z"}
+{"name":"@ant-design/icons-svg","version":"4.3.1","sideEffects":false,"description":"Abstract nodes for ant design icons.","contributors":["HeskeyBaozi <hezhiyu233@foxmail.com>"],"homepage":"https://github.com/ant-design/ant-design-icons/","license":"MIT","main":"lib/index.js","module":"es/index.js","files":["lib","es","inline-svg","inline-namespaced-svg"],"repository":{"type":"git","url":"git+https://github.com/ant-design/ant-design-icons.git"},"scripts":{"g":"npm run generate","generate":"cross-env NODE_ENV=production gulp --require ts-node/register/transpile-only","type-check":"tsc --noEmit","build:es":"tsc --project tsconfig.build.json --module esnext --outDir es","build:lib":"tsc --project tsconfig.build.json --module commonjs --outDir lib","build":"cross-env NODE_ENV=production && npm run build:es && npm run build:lib","test":"cross-env NODE_ENV=test && npm run test:unit","test:unit":"jest","prepublishOnly":"npm run test && npm run g && npm run build && npm run type-check && npm run digest","digest":"node scripts/digest.js"},"bugs":{"url":"https://github.com/ant-design/ant-design-icons/issues"},"devDependencies":{"@babel/core":"^7.8.6","@babel/preset-env":"^7.8.6","@babel/preset-typescript":"^7.8.3","@rgrove/parse-xml":"^2.0.2","@types/gulp":"^4.0.6","@types/gulp-concat":"^0.0.32","@types/gulp-rename":"^0.0.33","@types/jest":"^25.1.3","@types/lodash.camelcase":"^4.3.6","@types/lodash.template":"^4.4.6","@types/lodash.upperfirst":"^4.3.6","@types/node":"^13.9.3","@types/ramda":"^0.26.43","@types/rgrove__parse-xml":"^1.1.0","@types/svgo":"^1.3.1","@types/through2":"^2.0.34","@typescript-eslint/eslint-plugin":"^2.21.0","@typescript-eslint/parser":"^2.21.0","babel-jest":"^25.1.0","cross-env":"^7.0.0","del":"^5.1.0","eslint":"^7.16.0","globby":"^11.0.0","gulp":"^4.0.2","gulp-clone":"^2.0.1","gulp-concat":"^2.6.1","gulp-header":"^2.0.9","gulp-rename":"^2.0.0","jest":"^25.1.0","lodash.camelcase":"^4.3.0","lodash.template":"^4.5.0","lodash.upperfirst":"^4.3.1","ramda":"^0.27.0","svgo":"^1.3.2","through2":"^3.0.1","ts-node":"^8.6.2","typescript":"^4.0.0","vinyl":"^2.2.0"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org"},"_lastModified":"2026-08-10T06:31:30.087Z"}

package/dist/node_modules/acorn/package.json

@@ -1 +1 @@
-{"name":"acorn","description":"ECMAScript parser","homepage":"https://github.com/acornjs/acorn","main":"dist/acorn.js","types":"dist/acorn.d.ts","module":"dist/acorn.mjs","exports":{".":[{"import":"./dist/acorn.mjs","require":"./dist/acorn.js","default":"./dist/acorn.js"},"./dist/acorn.js"],"./package.json":"./package.json"},"version":"8.11.2","engines":{"node":">=0.4.0"},"maintainers":[{"name":"Marijn Haverbeke","email":"marijnh@gmail.com","web":"https://marijnhaverbeke.nl"},{"name":"Ingvar Stepanyan","email":"me@rreverser.com","web":"https://rreverser.com/"},{"name":"Adrian Heine","web":"http://adrianheine.de"}],"repository":{"type":"git","url":"https://github.com/acornjs/acorn.git"},"license":"MIT","scripts":{"prepare":"cd ..; npm run build:main"},"bin":{"acorn":"./bin/acorn"},"_lastModified":"2026-08-05T22:30:57.737Z"}
+{"name":"acorn","description":"ECMAScript parser","homepage":"https://github.com/acornjs/acorn","main":"dist/acorn.js","types":"dist/acorn.d.ts","module":"dist/acorn.mjs","exports":{".":[{"import":"./dist/acorn.mjs","require":"./dist/acorn.js","default":"./dist/acorn.js"},"./dist/acorn.js"],"./package.json":"./package.json"},"version":"8.11.2","engines":{"node":">=0.4.0"},"maintainers":[{"name":"Marijn Haverbeke","email":"marijnh@gmail.com","web":"https://marijnhaverbeke.nl"},{"name":"Ingvar Stepanyan","email":"me@rreverser.com","web":"https://rreverser.com/"},{"name":"Adrian Heine","web":"http://adrianheine.de"}],"repository":{"type":"git","url":"https://github.com/acornjs/acorn.git"},"license":"MIT","scripts":{"prepare":"cd ..; npm run build:main"},"bin":{"acorn":"./bin/acorn"},"_lastModified":"2026-08-10T06:31:31.082Z"}

package/dist/node_modules/acorn-jsx/package.json

@@ -1 +1 @@
-{"name":"acorn-jsx","description":"Modern, fast React.js JSX parser","homepage":"https://github.com/acornjs/acorn-jsx","version":"5.3.2","maintainers":[{"name":"Ingvar Stepanyan","email":"me@rreverser.com","web":"http://rreverser.com/"}],"repository":{"type":"git","url":"https://github.com/acornjs/acorn-jsx"},"license":"MIT","scripts":{"test":"node test/run.js"},"peerDependencies":{"acorn":"^6.0.0 || ^7.0.0 || ^8.0.0"},"devDependencies":{"acorn":"^8.0.1"},"_lastModified":"2026-08-05T22:30:58.198Z"}
+{"name":"acorn-jsx","description":"Modern, fast React.js JSX parser","homepage":"https://github.com/acornjs/acorn-jsx","version":"5.3.2","maintainers":[{"name":"Ingvar Stepanyan","email":"me@rreverser.com","web":"http://rreverser.com/"}],"repository":{"type":"git","url":"https://github.com/acornjs/acorn-jsx"},"license":"MIT","scripts":{"test":"node test/run.js"},"peerDependencies":{"acorn":"^6.0.0 || ^7.0.0 || ^8.0.0"},"devDependencies":{"acorn":"^8.0.1"},"_lastModified":"2026-08-10T06:31:31.550Z"}

package/dist/node_modules/acorn-walk/package.json

@@ -1 +1 @@
-{"name":"acorn-walk","description":"ECMAScript (ESTree) AST walker","homepage":"https://github.com/acornjs/acorn","main":"dist/walk.js","types":"dist/walk.d.ts","module":"dist/walk.mjs","exports":{".":[{"import":"./dist/walk.mjs","require":"./dist/walk.js","default":"./dist/walk.js"},"./dist/walk.js"],"./package.json":"./package.json"},"version":"8.3.4","engines":{"node":">=0.4.0"},"dependencies":{"acorn":"^8.11.0"},"maintainers":[{"name":"Marijn Haverbeke","email":"marijnh@gmail.com","web":"https://marijnhaverbeke.nl"},{"name":"Ingvar Stepanyan","email":"me@rreverser.com","web":"https://rreverser.com/"},{"name":"Adrian Heine","web":"http://adrianheine.de"}],"repository":{"type":"git","url":"https://github.com/acornjs/acorn.git"},"scripts":{"prepare":"cd ..; npm run build:walk"},"license":"MIT","_lastModified":"2026-08-05T22:30:58.312Z"}
+{"name":"acorn-walk","description":"ECMAScript (ESTree) AST walker","homepage":"https://github.com/acornjs/acorn","main":"dist/walk.js","types":"dist/walk.d.ts","module":"dist/walk.mjs","exports":{".":[{"import":"./dist/walk.mjs","require":"./dist/walk.js","default":"./dist/walk.js"},"./dist/walk.js"],"./package.json":"./package.json"},"version":"8.3.4","engines":{"node":">=0.4.0"},"dependencies":{"acorn":"^8.11.0"},"maintainers":[{"name":"Marijn Haverbeke","email":"marijnh@gmail.com","web":"https://marijnhaverbeke.nl"},{"name":"Ingvar Stepanyan","email":"me@rreverser.com","web":"https://rreverser.com/"},{"name":"Adrian Heine","web":"http://adrianheine.de"}],"repository":{"type":"git","url":"https://github.com/acornjs/acorn.git"},"scripts":{"prepare":"cd ..; npm run build:walk"},"license":"MIT","_lastModified":"2026-08-10T06:31:31.683Z"}

package/dist/node_modules/ses/package.json

@@ -1 +1 @@
-{"name":"ses","version":"1.14.0","description":"Hardened JavaScript for Fearless Cooperation","keywords":["lockdown","harden","Compartment","assert","security","confinement","isolation","object capabilities","ocaps","secure execution","third-party code","prototype pollution","supply-chain attack","plugin"],"author":"Agoric","license":"Apache-2.0","homepage":"https://github.com/Agoric/SES-shim/tree/master/packages/ses#readme","repository":{"type":"git","url":"git+https://github.com/endojs/endo.git","directory":"packages/ses"},"bugs":{"url":"https://github.com/endojs/endo/issues"},"type":"module","main":"./dist/ses.cjs","module":"./index.js","unpkg":"./dist/ses.umd.js","types":"./types.d.ts","exports":{".":{"import":{"types":"./types.d.ts","xs":"./src-xs/index.js","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./lockdown":{"import":{"types":"./types.d.ts","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./hermes":{"require":{"types":"./dist/types.d.cts","default":"./dist/ses-hermes.cjs"}},"./tools.js":"./tools.js","./assert-shim.js":"./assert-shim.js","./lockdown-shim.js":{"xs":"./src-xs/lockdown-shim.js","default":"./lockdown-shim.js"},"./compartment-shim.js":{"xs":"./src-xs/compartment-shim.js","default":"./compartment-shim.js"},"./console-shim.js":"./console-shim.js","./package.json":"./package.json"},"scripts":{"build:vanilla":"node scripts/bundle.js","build:hermes":"node scripts/bundle.js hermes","build":"yarn build:vanilla && yarn build:hermes","clean":"rm -rf dist","cover":"c8 ava","demo":"python3 -m http.server","lint":"yarn lint:types && yarn lint:eslint","lint-fix":"eslint --fix .","lint:eslint":"eslint .","lint:types":"tsc","prepare":"npm run clean && npm run build","qt":"ava","test":"tsd && ava","test:hermes":"./scripts/hermes-test.sh","test:xs":"xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp","postpack":"git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\""},"dependencies":{"@endo/cache-map":"^1.1.0","@endo/env-options":"^1.1.11","@endo/immutable-arraybuffer":"^1.1.2"},"devDependencies":{"@babel/generator":"^7.26.3","@babel/parser":"~7.26.2","@babel/traverse":"~7.25.9","@babel/types":"~7.26.0","@endo/compartment-mapper":"^1.6.3","@endo/module-source":"^1.3.3","@endo/test262-runner":"^0.1.48","@types/babel__traverse":"^7.20.5","ava":"^6.1.3","babel-eslint":"^10.1.0","c8":"^7.14.0","core-js":"^3.31.0","eslint":"^8.57.1","eslint-config-airbnb-base":"^15.0.0","eslint-config-prettier":"^9.1.0","eslint-plugin-eslint-comments":"^3.2.0","eslint-plugin-import":"^2.31.0","hermes-engine-cli":"^0.12.0","prettier":"^3.5.3","terser":"^5.16.6","tsd":"^0.31.2","typescript":"~5.8.3"},"files":["./*.d.ts","./*.js","./*.map","LICENSE*","SECURITY*","dist","lib","src","tools"],"publishConfig":{"access":"public"},"eslintConfig":{"extends":["plugin:@endo/ses"]},"ava":{"files":["test/**/*.test.*"],"timeout":"2m"},"typeCoverage":{"atLeast":81.17},"gitHead":"9815aea9541f241389d2135c6097a7442bdffa17","_lastModified":"2026-08-05T22:30:57.301Z"}
+{"name":"ses","version":"1.14.0","description":"Hardened JavaScript for Fearless Cooperation","keywords":["lockdown","harden","Compartment","assert","security","confinement","isolation","object capabilities","ocaps","secure execution","third-party code","prototype pollution","supply-chain attack","plugin"],"author":"Agoric","license":"Apache-2.0","homepage":"https://github.com/Agoric/SES-shim/tree/master/packages/ses#readme","repository":{"type":"git","url":"git+https://github.com/endojs/endo.git","directory":"packages/ses"},"bugs":{"url":"https://github.com/endojs/endo/issues"},"type":"module","main":"./dist/ses.cjs","module":"./index.js","unpkg":"./dist/ses.umd.js","types":"./types.d.ts","exports":{".":{"import":{"types":"./types.d.ts","xs":"./src-xs/index.js","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./lockdown":{"import":{"types":"./types.d.ts","default":"./index.js"},"require":{"types":"./dist/types.d.cts","default":"./dist/ses.cjs"}},"./hermes":{"require":{"types":"./dist/types.d.cts","default":"./dist/ses-hermes.cjs"}},"./tools.js":"./tools.js","./assert-shim.js":"./assert-shim.js","./lockdown-shim.js":{"xs":"./src-xs/lockdown-shim.js","default":"./lockdown-shim.js"},"./compartment-shim.js":{"xs":"./src-xs/compartment-shim.js","default":"./compartment-shim.js"},"./console-shim.js":"./console-shim.js","./package.json":"./package.json"},"scripts":{"build:vanilla":"node scripts/bundle.js","build:hermes":"node scripts/bundle.js hermes","build":"yarn build:vanilla && yarn build:hermes","clean":"rm -rf dist","cover":"c8 ava","demo":"python3 -m http.server","lint":"yarn lint:types && yarn lint:eslint","lint-fix":"eslint --fix .","lint:eslint":"eslint .","lint:types":"tsc","prepare":"npm run clean && npm run build","qt":"ava","test":"tsd && ava","test:hermes":"./scripts/hermes-test.sh","test:xs":"xst dist/ses.umd.js test/_lockdown-safe.js && node scripts/generate-test-xs.js && xst tmp/test-xs.js && rm -rf tmp","postpack":"git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\""},"dependencies":{"@endo/cache-map":"^1.1.0","@endo/env-options":"^1.1.11","@endo/immutable-arraybuffer":"^1.1.2"},"devDependencies":{"@babel/generator":"^7.26.3","@babel/parser":"~7.26.2","@babel/traverse":"~7.25.9","@babel/types":"~7.26.0","@endo/compartment-mapper":"^1.6.3","@endo/module-source":"^1.3.3","@endo/test262-runner":"^0.1.48","@types/babel__traverse":"^7.20.5","ava":"^6.1.3","babel-eslint":"^10.1.0","c8":"^7.14.0","core-js":"^3.31.0","eslint":"^8.57.1","eslint-config-airbnb-base":"^15.0.0","eslint-config-prettier":"^9.1.0","eslint-plugin-eslint-comments":"^3.2.0","eslint-plugin-import":"^2.31.0","hermes-engine-cli":"^0.12.0","prettier":"^3.5.3","terser":"^5.16.6","tsd":"^0.31.2","typescript":"~5.8.3"},"files":["./*.d.ts","./*.js","./*.map","LICENSE*","SECURITY*","dist","lib","src","tools"],"publishConfig":{"access":"public"},"eslintConfig":{"extends":["plugin:@endo/ses"]},"ava":{"files":["test/**/*.test.*"],"timeout":"2m"},"typeCoverage":{"atLeast":81.17},"gitHead":"9815aea9541f241389d2135c6097a7442bdffa17","_lastModified":"2026-08-10T06:31:30.633Z"}

package/dist/node_modules/zod/package.json

@@ -1 +1 @@
-{"name":"zod","version":"4.3.5","type":"module","license":"MIT","author":"Colin McDonnell <zod@colinhacks.com>","description":"TypeScript-first schema declaration and validation library with static type inference","homepage":"https://zod.dev","llms":"https://zod.dev/llms.txt","llmsFull":"https://zod.dev/llms-full.txt","mcpServer":"https://mcp.inkeep.com/zod/mcp","funding":"https://github.com/sponsors/colinhacks","sideEffects":false,"files":["src","**/*.js","**/*.mjs","**/*.cjs","**/*.d.ts","**/*.d.mts","**/*.d.cts","**/package.json"],"keywords":["typescript","schema","validation","type","inference"],"main":"./index.cjs","types":"./index.d.cts","module":"./index.js","zshy":{"exports":{"./package.json":"./package.json",".":"./src/index.ts","./mini":"./src/mini/index.ts","./locales":"./src/locales/index.ts","./v3":"./src/v3/index.ts","./v4":"./src/v4/index.ts","./v4-mini":"./src/v4-mini/index.ts","./v4/mini":"./src/v4/mini/index.ts","./v4/core":"./src/v4/core/index.ts","./v4/locales":"./src/v4/locales/index.ts","./v4/locales/*":"./src/v4/locales/*"},"conditions":{"@zod/source":"src"}},"exports":{"./package.json":"./package.json",".":{"@zod/source":"./src/index.ts","types":"./index.d.cts","import":"./index.js","require":"./index.cjs"},"./mini":{"@zod/source":"./src/mini/index.ts","types":"./mini/index.d.cts","import":"./mini/index.js","require":"./mini/index.cjs"},"./locales":{"@zod/source":"./src/locales/index.ts","types":"./locales/index.d.cts","import":"./locales/index.js","require":"./locales/index.cjs"},"./v3":{"@zod/source":"./src/v3/index.ts","types":"./v3/index.d.cts","import":"./v3/index.js","require":"./v3/index.cjs"},"./v4":{"@zod/source":"./src/v4/index.ts","types":"./v4/index.d.cts","import":"./v4/index.js","require":"./v4/index.cjs"},"./v4-mini":{"@zod/source":"./src/v4-mini/index.ts","types":"./v4-mini/index.d.cts","import":"./v4-mini/index.js","require":"./v4-mini/index.cjs"},"./v4/mini":{"@zod/source":"./src/v4/mini/index.ts","types":"./v4/mini/index.d.cts","import":"./v4/mini/index.js","require":"./v4/mini/index.cjs"},"./v4/core":{"@zod/source":"./src/v4/core/index.ts","types":"./v4/core/index.d.cts","import":"./v4/core/index.js","require":"./v4/core/index.cjs"},"./v4/locales":{"@zod/source":"./src/v4/locales/index.ts","types":"./v4/locales/index.d.cts","import":"./v4/locales/index.js","require":"./v4/locales/index.cjs"},"./v4/locales/*":{"@zod/source":"./src/v4/locales/*","types":"./v4/locales/*","import":"./v4/locales/*","require":"./v4/locales/*"}},"repository":{"type":"git","url":"git+https://github.com/colinhacks/zod.git"},"bugs":{"url":"https://github.com/colinhacks/zod/issues"},"support":{"backing":{"npm-funding":true}},"scripts":{"clean":"git clean -xdf . -e node_modules","build":"zshy --project tsconfig.build.json","postbuild":"tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .","test:watch":"pnpm vitest","test":"pnpm vitest run","prepublishOnly":"tsx ../../scripts/check-versions.ts"},"_lastModified":"2026-08-05T22:30:59.486Z"}
+{"name":"zod","version":"4.3.5","type":"module","license":"MIT","author":"Colin McDonnell <zod@colinhacks.com>","description":"TypeScript-first schema declaration and validation library with static type inference","homepage":"https://zod.dev","llms":"https://zod.dev/llms.txt","llmsFull":"https://zod.dev/llms-full.txt","mcpServer":"https://mcp.inkeep.com/zod/mcp","funding":"https://github.com/sponsors/colinhacks","sideEffects":false,"files":["src","**/*.js","**/*.mjs","**/*.cjs","**/*.d.ts","**/*.d.mts","**/*.d.cts","**/package.json"],"keywords":["typescript","schema","validation","type","inference"],"main":"./index.cjs","types":"./index.d.cts","module":"./index.js","zshy":{"exports":{"./package.json":"./package.json",".":"./src/index.ts","./mini":"./src/mini/index.ts","./locales":"./src/locales/index.ts","./v3":"./src/v3/index.ts","./v4":"./src/v4/index.ts","./v4-mini":"./src/v4-mini/index.ts","./v4/mini":"./src/v4/mini/index.ts","./v4/core":"./src/v4/core/index.ts","./v4/locales":"./src/v4/locales/index.ts","./v4/locales/*":"./src/v4/locales/*"},"conditions":{"@zod/source":"src"}},"exports":{"./package.json":"./package.json",".":{"@zod/source":"./src/index.ts","types":"./index.d.cts","import":"./index.js","require":"./index.cjs"},"./mini":{"@zod/source":"./src/mini/index.ts","types":"./mini/index.d.cts","import":"./mini/index.js","require":"./mini/index.cjs"},"./locales":{"@zod/source":"./src/locales/index.ts","types":"./locales/index.d.cts","import":"./locales/index.js","require":"./locales/index.cjs"},"./v3":{"@zod/source":"./src/v3/index.ts","types":"./v3/index.d.cts","import":"./v3/index.js","require":"./v3/index.cjs"},"./v4":{"@zod/source":"./src/v4/index.ts","types":"./v4/index.d.cts","import":"./v4/index.js","require":"./v4/index.cjs"},"./v4-mini":{"@zod/source":"./src/v4-mini/index.ts","types":"./v4-mini/index.d.cts","import":"./v4-mini/index.js","require":"./v4-mini/index.cjs"},"./v4/mini":{"@zod/source":"./src/v4/mini/index.ts","types":"./v4/mini/index.d.cts","import":"./v4/mini/index.js","require":"./v4/mini/index.cjs"},"./v4/core":{"@zod/source":"./src/v4/core/index.ts","types":"./v4/core/index.d.cts","import":"./v4/core/index.js","require":"./v4/core/index.cjs"},"./v4/locales":{"@zod/source":"./src/v4/locales/index.ts","types":"./v4/locales/index.d.cts","import":"./v4/locales/index.js","require":"./v4/locales/index.cjs"},"./v4/locales/*":{"@zod/source":"./src/v4/locales/*","types":"./v4/locales/*","import":"./v4/locales/*","require":"./v4/locales/*"}},"repository":{"type":"git","url":"git+https://github.com/colinhacks/zod.git"},"bugs":{"url":"https://github.com/colinhacks/zod/issues"},"support":{"backing":{"npm-funding":true}},"scripts":{"clean":"git clean -xdf . -e node_modules","build":"zshy --project tsconfig.build.json","postbuild":"tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .","test:watch":"pnpm vitest","test":"pnpm vitest run","prepublishOnly":"tsx ../../scripts/check-versions.ts"},"_lastModified":"2026-08-10T06:31:33.007Z"}

package/dist/server/plugin.d.ts

@@ -16,10 +16,12 @@ export declare class PluginFlowEngineServer extends PluginUISchemaStorageServer
     getDatabaseByDataSourceKey(dataSourceKey?: string): import("@nocobase/database").default;
     runSQLByDataSourceKey(dataSourceKey: string | undefined, sql: string, options?: Record<string, unknown>): Promise<any>;
     resolveFlowModelVariablesTemplate(ctx: ResourcerContext, options: {
+        contractRd?: string | number;
         contextParams?: Record<string, unknown>;
         rd?: string | number;
         template: JSONValue;
     }): Promise<any>;
+    isLegacyVariableTemplateSafe(template: JSONValue): boolean;
     load(): Promise<void>;
     install(): Promise<void>;
     afterEnable(): Promise<void>;

package/dist/server/plugin.js

@@ -80,6 +80,9 @@ class PluginFlowEngineServer extends import_server.default {
     this.ensureRecordSlotResolvers(ctx.app);
     return await (0, import_resolve.resolveFlowModelVariablesTemplate)(ctx, options);
   }
+  isLegacyVariableTemplateSafe(template) {
+    return (0, import_resolve.isLegacyVariableTemplateSafe)(template);
+  }
   async load() {
     await super.load();
     this.registerRecordSlotResolvers();
@@ -107,6 +110,7 @@ class PluginFlowEngineServer extends import_server.default {
             for (const [index, item] of batchItems.entries()) {
               const template2 = (item == null ? void 0 : item.template) ?? {};
               const authorization2 = await (0, import_allow_list.authorizeVariablesResolve)(ctx, {
+                contractRd: item == null ? void 0 : item.contractRd,
                 contextParams: (item == null ? void 0 : item.contextParams) || {},
                 rd: item == null ? void 0 : item.rd,
                 template: template2
@@ -158,6 +162,7 @@ class PluginFlowEngineServer extends import_server.default {
           const template = values.template;
           const contextParams = (values == null ? void 0 : values.contextParams) || {};
           const authorization = await (0, import_allow_list.authorizeVariablesResolve)(ctx, {
+            contractRd: values == null ? void 0 : values.contractRd,
             contextParams,
             rd: values == null ? void 0 : values.rd,
             template

package/dist/server/repository.d.ts

@@ -140,6 +140,10 @@ export declare class FlowModelRepository extends Repository {
     upsertModel(model: any, options?: Transactionable): Promise<string>;
     findModelById(uid: string, options?: GetJsonSchemaOptions): Promise<any>;
     findModelNodeSnapshotById(uid: string, options?: Transactionable): Promise<FlowModelNodeSnapshot | null>;
+    private findModelUidByParentId;
+    findModelNodeSnapshotByParentId(parentUid: string, options?: Transactionable & {
+        subKey?: string;
+    }): Promise<FlowModelNodeSnapshot | null>;
     findModelByParentId(parentUid: string, options?: GetJsonSchemaOptions & {
         subKey?: string;
     }): Promise<any>;

package/dist/server/repository.js

@@ -1440,7 +1440,7 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
       async: !!nodePath.get("async")
     };
   }
-  async findModelByParentId(parentUid, options) {
+  async findModelUidByParentId(parentUid, options) {
     const r = this.database.getRepository("flowModelTreePath");
     const treePaths = await r.model.findAll({
       where: {
@@ -1462,10 +1462,18 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
       transaction: options == null ? void 0 : options.transaction
     });
     if (treePath == null ? void 0 : treePath["descendant"]) {
-      return this.findModelById(treePath["descendant"], options);
+      return treePath["descendant"];
     }
     return null;
   }
+  async findModelNodeSnapshotByParentId(parentUid, options) {
+    const uid2 = await this.findModelUidByParentId(parentUid, options);
+    return uid2 ? this.findModelNodeSnapshotById(uid2, options) : null;
+  }
+  async findModelByParentId(parentUid, options) {
+    const uid2 = await this.findModelUidByParentId(parentUid, options);
+    return uid2 ? this.findModelById(uid2, options) : null;
+  }
   async attach(uid2, attachOptions, options) {
     const { transaction: transaction2 } = options || {};
     const modelUid = String(uid2 || "").trim();

package/dist/server/variables/allow-list.d.ts

@@ -41,6 +41,7 @@ export declare function hasRecordContextParams(value: unknown): boolean;
 export declare function sanitizeContextParams(value?: Record<string, unknown>): Record<string, unknown>;
 export declare function resolveFlowModelNodeFromRequestRd(ctx: ResourcerContext, rd?: string | number): Promise<FlowModelNodeSnapshot>;
 export declare function authorizeVariablesResolve(ctx: ResourcerContext, options: {
+    contractRd?: string | number;
     contextParams?: Record<string, unknown>;
     rd?: string | number;
     template: JSONValue;

package/dist/server/variables/allow-list.js

@@ -56,6 +56,53 @@ function clearVariableAllowListCache(app) {
 function isObject(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
+function readFormAssignRulesVariableSource(node) {
+  const stepParams = isObject(node.options.stepParams) ? node.options.stepParams : null;
+  const formModelSettings = stepParams && isObject(stepParams.formModelSettings) ? stepParams.formModelSettings : null;
+  return formModelSettings && Object.prototype.hasOwnProperty.call(formModelSettings, "assignRules") ? formModelSettings.assignRules : void 0;
+}
+function hasFlowModelUse(node) {
+  const use = node.options.use;
+  return typeof use === "string" && !!use.trim();
+}
+function matchesVariableContractType(node, type) {
+  const marker = node.options.variableContractType;
+  if (typeof marker === "undefined") return void 0;
+  return isObject(marker) && marker.type === type && marker.use === node.options.use;
+}
+function isFormGridNode(node) {
+  const use = node.options.use;
+  const markerMatches = matchesVariableContractType(node, "formGrid");
+  return node.subKey === "grid" && hasFlowModelUse(node) && (markerMatches === true || typeof markerMatches === "undefined" && typeof use === "string" && use.endsWith("GridModel"));
+}
+function getReferenceFormUseTemplate(node) {
+  const stepParams = isObject(node.options.stepParams) ? node.options.stepParams : null;
+  const referenceSettings = stepParams && isObject(stepParams.referenceSettings) ? stepParams.referenceSettings : null;
+  return referenceSettings && isObject(referenceSettings.useTemplate) ? referenceSettings.useTemplate : null;
+}
+function isReferenceFormGridNode(node) {
+  const use = node.options.use;
+  return isFormGridNode(node) && typeof use === "string" && use.endsWith("ReferenceFormGridModel");
+}
+function getReferenceFormGridTargetUid(node) {
+  const useTemplate = getReferenceFormUseTemplate(node);
+  const templateUid = useTemplate && typeof useTemplate.templateUid === "string" ? useTemplate.templateUid.trim() : "";
+  if (!useTemplate || !templateUid) return "";
+  const targetPath = typeof useTemplate.targetPath === "string" ? useTemplate.targetPath.trim() : "";
+  if (targetPath && targetPath !== "subModels.grid") return "";
+  return typeof useTemplate.targetUid === "string" ? useTemplate.targetUid.trim() : "";
+}
+function isFormAssignRulesOwnerNode(node) {
+  const use = node.options.use;
+  const markerMatches = matchesVariableContractType(node, "form");
+  return hasFlowModelUse(node) && (markerMatches === true || typeof markerMatches === "undefined" && typeof use === "string" && (use.endsWith("FormModel") || use.endsWith("FormBlockModel")));
+}
+function isFormAssignRulesContractPair(formNode, gridNode) {
+  return isFormAssignRulesOwnerNode(formNode) && isFormGridNode(gridNode) && gridNode.parentId === formNode.uid;
+}
+function isFormAssignRulesRunJsValuePath(pathTail) {
+  return pathTail.length === 3 && pathTail[0] === "value" && /^\d+$/.test(pathTail[1]) && pathTail[2] === "value";
+}
 function isRecordParams(value) {
   return isObject(value) && typeof value.collection === "string" && Object.prototype.hasOwnProperty.call(value, "filterByTk") && (typeof value.dataSourceKey === "undefined" || typeof value.dataSourceKey === "string") && (typeof value.associationName === "undefined" || typeof value.associationName === "string") && (typeof value.fields === "undefined" || Array.isArray(value.fields) && value.fields.every((field) => typeof field === "string")) && (typeof value.appends === "undefined" || Array.isArray(value.appends) && value.appends.every((append) => typeof append === "string"));
 }
@@ -110,6 +157,19 @@ async function getFlowModelNode(ctx, flowModelUid) {
   cache.set(flowModelUid, model);
   return model;
 }
+async function getFlowModelChildNode(ctx, parentUid, subKey) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveFlowModelChildCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  const childCacheKey = JSON.stringify([parentUid, subKey]);
+  if (cache.has(childCacheKey)) return await cache.get(childCacheKey) || null;
+  const load = getFlowModelRepository(ctx).findModelNodeSnapshotByParentId(parentUid, { subKey });
+  cache.set(childCacheKey, load);
+  const child = await load;
+  cache.set(childCacheKey, child);
+  return child;
+}
 async function loadFlowModelAncestors(ctx, currentNode) {
   const ancestors = [];
   const seen = /* @__PURE__ */ new Set([currentNode.uid]);
@@ -126,6 +186,20 @@ async function loadFlowModelAncestors(ctx, currentNode) {
   }
   return Object.freeze(ancestors);
 }
+async function loadFlowModelAncestorUids(ctx, currentNode) {
+  try {
+    return new Set((await loadFlowModelAncestors(ctx, currentNode)).map((ancestor) => ancestor.uid));
+  } catch {
+    return null;
+  }
+}
+async function resolveFormAssignRulesVariableSource(ctx, contractNode) {
+  const fromGrid = readFormAssignRulesVariableSource(contractNode);
+  if (typeof fromGrid !== "undefined") return fromGrid;
+  if (!contractNode.parentId) return void 0;
+  const formNode = await getFlowModelNode(ctx, contractNode.parentId);
+  return formNode && isFormAssignRulesContractPair(formNode, contractNode) ? readFormAssignRulesVariableSource(formNode) : void 0;
+}
 function createRecordSlotCompilerOptions(ctx, currentNode) {
   let ancestors;
   return {
@@ -142,26 +216,29 @@ function createRecordSlotCompilerOptions(ctx, currentNode) {
     } : void 0
   };
 }
-async function getFlowModelVariableContract(ctx, flowModelUid) {
+async function getFlowModelVariableContract(ctx, contractNode, runtimeNode, source) {
   const state = getRequestState(ctx);
   const cacheKey = "__variableResolveContractCache";
   const cache = state[cacheKey] || /* @__PURE__ */ new Map();
   state[cacheKey] = cache;
-  if (cache.has(flowModelUid)) return await cache.get(flowModelUid) || null;
-  const load = createFlowModelVariableContractFromNode(ctx, flowModelUid);
-  cache.set(flowModelUid, load);
+  const contractCacheKey = JSON.stringify([source, contractNode.uid, runtimeNode.uid]);
+  if (cache.has(contractCacheKey)) return await cache.get(contractCacheKey) || null;
+  const load = createFlowModelVariableContractFromNode(ctx, contractNode, runtimeNode, source);
+  cache.set(contractCacheKey, load);
   const contract = await load;
-  cache.set(flowModelUid, contract);
+  cache.set(contractCacheKey, contract);
   return contract;
 }
-async function createFlowModelVariableContractFromNode(ctx, flowModelUid) {
-  const node = await getFlowModelNode(ctx, flowModelUid);
-  if (!node) return null;
-  const prepared = (0, import_runjs_variable_dependencies.prepareFlowModelVariableSource)(node.options);
+async function createFlowModelVariableContractFromNode(ctx, contractNode, runtimeNode, source) {
+  const variableSource = source === "formAssignRules" ? await resolveFormAssignRulesVariableSource(ctx, contractNode) ?? {} : contractNode.options;
+  const prepared = (0, import_runjs_variable_dependencies.prepareFlowModelVariableSource)(
+    variableSource,
+    source === "formAssignRules" ? { isRunJsValuePath: isFormAssignRulesRunJsValuePath } : void 0
+  );
   const contractSource = prepared.ok ? prepared.runJsTemplates.length ? [prepared.templateSource, ...prepared.runJsTemplates] : prepared.templateSource : {};
   const result = analyzeVariableTemplateSafely(contractSource, { mode: "flow-model" });
   const analysis = result.ok ? result.analysis : (0, import_variable_expression.analyzeVariableTemplate)({}, { mode: "flow-model" });
-  return await (0, import_record_slot_policy.createFlowModelVariableContract)(analysis, createRecordSlotCompilerOptions(ctx, node));
+  return await (0, import_record_slot_policy.createFlowModelVariableContract)(analysis, createRecordSlotCompilerOptions(ctx, runtimeNode));
 }
 function getCurrentRoleNames(ctx) {
   const state = ctx.state;
@@ -237,6 +314,36 @@ async function resolveFlowModelNodeFromRequestRd(ctx, rd) {
   const flowModelUid = resolveFlowModelUidFromRequestRd(ctx, rd);
   return flowModelUid ? getFlowModelNode(ctx, flowModelUid) : null;
 }
+async function resolveFormAssignRulesContractNode(ctx, runtimeNode, contractModelUid) {
+  const contractNode = await getFlowModelNode(ctx, contractModelUid);
+  if (!contractNode || !contractNode.parentId || !isFormGridNode(contractNode)) return null;
+  const formNode = await getFlowModelNode(ctx, contractNode.parentId);
+  if (!formNode || !isFormAssignRulesContractPair(formNode, contractNode)) return null;
+  if (isReferenceFormGridNode(contractNode)) {
+    const targetUid = getReferenceFormGridTargetUid(contractNode);
+    if (!targetUid) return null;
+    const targetFormNode = await getFlowModelNode(ctx, targetUid);
+    if (!targetFormNode) return null;
+    const targetGridNode = await getFlowModelChildNode(ctx, targetFormNode.uid, "grid");
+    if (!targetGridNode || !isFormAssignRulesContractPair(targetFormNode, targetGridNode) || isReferenceFormGridNode(targetGridNode)) {
+      return null;
+    }
+    const targetVariableSource = await resolveFormAssignRulesVariableSource(ctx, targetGridNode);
+    let contractSourceNode = targetGridNode;
+    if (typeof targetVariableSource === "undefined") {
+      if (typeof readFormAssignRulesVariableSource(formNode) === "undefined") return null;
+      contractSourceNode = formNode;
+    }
+    const directlyRelated = runtimeNode.uid === contractNode.uid || runtimeNode.uid === formNode.uid || runtimeNode.uid === targetGridNode.uid || runtimeNode.uid === targetFormNode.uid;
+    if (directlyRelated) return contractSourceNode;
+    const ancestorUids2 = await loadFlowModelAncestorUids(ctx, runtimeNode);
+    return (ancestorUids2 == null ? void 0 : ancestorUids2.has(contractNode.uid)) === true || (ancestorUids2 == null ? void 0 : ancestorUids2.has(targetGridNode.uid)) === true ? contractSourceNode : null;
+  }
+  if (typeof await resolveFormAssignRulesVariableSource(ctx, contractNode) === "undefined") return null;
+  if (runtimeNode.uid === contractNode.uid || runtimeNode.uid === formNode.uid) return contractNode;
+  const ancestorUids = await loadFlowModelAncestorUids(ctx, runtimeNode);
+  return (ancestorUids == null ? void 0 : ancestorUids.has(contractNode.uid)) === true ? contractNode : null;
+}
 function createPolicy(allowAll = false, allowedPaths = /* @__PURE__ */ new Set(), unrestrictedVariables = /* @__PURE__ */ new Set()) {
   return { allowAll, allowedPaths, unrestrictedVariables };
 }
@@ -253,6 +360,8 @@ async function authorizeVariablesResolve(ctx, options) {
   var _a;
   let contextParams = sanitizeContextParams(options.contextParams || {});
   const flowModelUid = resolveFlowModelUidFromRequestRd(ctx, options.rd);
+  const hasContractRd = typeof options.contractRd !== "undefined";
+  const contractModelUid = hasContractRd ? resolveFlowModelUidFromRequestRd(ctx, options.contractRd) : flowModelUid;
   const unrestrictedVariables = /* @__PURE__ */ new Set();
   let policy = createPolicy(false, /* @__PURE__ */ new Set(), unrestrictedVariables);
   let recordSlotPolicies = /* @__PURE__ */ new Map();
@@ -326,7 +435,16 @@ async function authorizeVariablesResolve(ctx, options) {
   if (flowModelRequiredVars.size > 0 && !flowModelUid) {
     return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies);
   }
-  const contract = flowModelUid ? await getFlowModelVariableContract(ctx, flowModelUid) : null;
+  let contractNode = currentNode;
+  let contractSource = "node";
+  if (hasContractRd) {
+    contractNode = currentNode && contractModelUid ? await resolveFormAssignRulesContractNode(ctx, currentNode, contractModelUid) : null;
+    contractSource = "formAssignRules";
+    if (!contractNode) {
+      return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+    }
+  }
+  const contract = contractNode && currentNode ? await getFlowModelVariableContract(ctx, contractNode, currentNode, contractSource) : null;
   const allowedPaths = (contract == null ? void 0 : contract.allowedPaths) || null;
   recordSlotPolicies = (contract == null ? void 0 : contract.recordSlots) || /* @__PURE__ */ new Map();
   policy = createPolicy(false, allowedPaths || /* @__PURE__ */ new Set(), unrestrictedVariables);

package/dist/server/variables/records.d.ts

@@ -7,9 +7,10 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import type { Collection, RelationRepository, Repository } from '@nocobase/database';
+import type { IRepository } from '@nocobase/data-source-manager';
 import type { ResourcerContext } from '@nocobase/resourcer';
 type FilterTargetKey = string | string[] | undefined;
-type RecordRepository = Repository | RelationRepository;
+type RecordRepository = IRepository | Repository | RelationRepository;
 export type RecordParams = {
     associationName?: string;
     collection: string;
@@ -80,5 +81,5 @@ export declare function fetchRecordOrRecordsJson(repo: RecordRepository, params:
     filterTargetKey?: FilterTargetKey;
     pkAttr?: string;
     pkIsValid?: boolean;
-}): Promise<unknown>;
+}, context: ResourcerContext): Promise<unknown>;
 export {};

package/dist/server/variables/records.js

@@ -149,9 +149,10 @@ function isRecordParams(value) {
   return !!value && typeof value === "object" && typeof value.collection === "string" && Object.prototype.hasOwnProperty.call(value, "filterByTk");
 }
 function resolveRecordTarget(koaCtx, params) {
-  var _a, _b;
+  var _a, _b, _c, _d, _e, _f;
   const dataSourceKey = params.dataSourceKey || "main";
   const usesAssociation = !!(params.associationName && typeof params.sourceId !== "undefined");
+  const associationSourceCollection = usesAssociation ? (_a = params.associationName) == null ? void 0 : _a.split(".")[0] : void 0;
   const context = koaCtx;
   if (!context.state) context.state = {};
   const targets = context.state.__varResolveRecordTargets ??= /* @__PURE__ */ new Map();
@@ -164,26 +165,31 @@ function resolveRecordTarget(koaCtx, params) {
   if (targets.has(requestKey)) return targets.get(requestKey);
   const ds = koaCtx.app.dataSourceManager.get(dataSourceKey);
   const cm = ds.collectionManager;
-  if (!(cm == null ? void 0 : cm.db)) {
-    targets.set(requestKey, void 0);
-    return void 0;
+  let repository;
+  if (typeof cm.getRepository === "function") {
+    repository = usesAssociation ? cm.getRepository(params.associationName, params.sourceId) : cm.getRepository(params.collection);
+  } else if (typeof ((_b = cm.db) == null ? void 0 : _b.getRepository) === "function") {
+    repository = usesAssociation ? cm.db.getRepository(params.associationName, params.sourceId) : cm.db.getRepository(params.collection);
   }
-  const repository = usesAssociation ? cm.db.getRepository(params.associationName, params.sourceId) : cm.db.getRepository(params.collection);
   if (!repository) {
     targets.set(requestKey, void 0);
     return void 0;
   }
-  const collection = "targetCollection" in repository && repository.targetCollection || repository.collection || cm.db.getCollection(params.associationName || params.collection);
+  const repositoryMetadata = repository;
+  let collection = repositoryMetadata.targetCollection || repositoryMetadata.collection;
+  if (!usesAssociation && !collection) {
+    collection = (typeof cm.getCollection === "function" ? cm.getCollection(params.collection) : (_d = (_c = cm.db) == null ? void 0 : _c.getCollection) == null ? void 0 : _d.call(_c, params.collection)) || { name: params.collection };
+  }
   if (!collection) {
     targets.set(requestKey, void 0);
     return void 0;
   }
-  if (usesAssociation && collection.name !== params.collection) {
+  if (usesAssociation && (!collection.name || collection.name !== params.collection && associationSourceCollection !== params.collection)) {
     targets.set(requestKey, void 0);
     return void 0;
   }
-  const rawAttributes = (_a = collection.model) == null ? void 0 : _a.rawAttributes;
-  const pkAttr = (_b = collection.model) == null ? void 0 : _b.primaryKeyAttribute;
+  const rawAttributes = (_e = collection.model) == null ? void 0 : _e.rawAttributes;
+  const pkAttr = (_f = collection.model) == null ? void 0 : _f.primaryKeyAttribute;
   const pkIsValid = !!(pkAttr && rawAttributes && Object.prototype.hasOwnProperty.call(rawAttributes, pkAttr));
   const collectionName = collection.name || params.associationName || params.collection;
   const target = {
@@ -283,7 +289,7 @@ async function fetchRecordWithRequestCache(koaCtx, params, fields, appends, stri
     const cache = getRecordRequestCache(koaCtx);
     const cached = findRecordRequestCacheValue(cache, query);
     if (cached.hit) return cached.value;
-    const value = await fetchRecordOrRecordsJson(query.repository, query);
+    const value = await fetchRecordOrRecordsJson(query.repository, query, koaCtx);
     setRecordRequestCache(cache, query, value);
     return value;
   } catch (error) {
@@ -316,11 +322,9 @@ function getExtraKeyFieldsForSelect(filterByTk, options) {
   }
   if (Array.isArray(filterByTk) && filterByTk.length > 0) {
     const tkKeys = typeof options.filterTargetKey === "string" ? [options.filterTargetKey] : Array.isArray(options.filterTargetKey) ? options.filterTargetKey : [];
-    if (options.rawAttributes) {
-      for (const k of tkKeys) {
-        if (k && Object.prototype.hasOwnProperty.call(options.rawAttributes, k)) {
-          extra.push(k);
-        }
+    for (const k of tkKeys) {
+      if (k && (!options.rawAttributes || Object.prototype.hasOwnProperty.call(options.rawAttributes, k))) {
+        extra.push(k);
       }
     }
   }
@@ -339,6 +343,20 @@ function toJsonArray(rows) {
   if (!Array.isArray(rows)) return [];
   return rows.map(toJsonRecord);
 }
+function createRecordRepositoryContext(context, params) {
+  var _a;
+  if (!((_a = context.action) == null ? void 0 : _a.params)) return context;
+  const repositoryContext = Object.create(context);
+  const repositoryAction = Object.create(context.action);
+  repositoryAction.params = {
+    ...context.action.params,
+    filterByTk: params.filterByTk,
+    fields: params.fields,
+    appends: params.appends
+  };
+  repositoryContext.action = repositoryAction;
+  return repositoryContext;
+}
 function reorderRecordsByFilterByTk(records, filterByTk, options) {
   if (!Array.isArray(filterByTk) || filterByTk.length === 0) return records;
   if (!isPrimitiveTkArray(filterByTk)) return records;
@@ -369,19 +387,18 @@ function reorderRecordsByFilterByTk(records, filterByTk, options) {
   }
   return ordered;
 }
-async function fetchRecordOrRecordsJson(repo, params) {
+async function fetchRecordOrRecordsJson(repo, params, context) {
   const { filterByTk, preferFullRecord, fields, appends } = params;
+  if (Array.isArray(filterByTk) && filterByTk.length === 0) return [];
+  const query = preferFullRecord ? { filterByTk } : { filterByTk, fields, appends };
+  const repositoryContext = createRecordRepositoryContext(context, query);
+  const repositoryOptions = { ...query, context: repositoryContext };
   if (Array.isArray(filterByTk)) {
-    if (filterByTk.length === 0) return [];
-    const rows = await repo.find(
-      preferFullRecord ? { filterByTk } : { filterByTk, fields, appends }
-    );
+    const rows = await repo.find(repositoryOptions);
     const jsonArr = toJsonArray(rows);
     return reorderRecordsByFilterByTk(jsonArr, filterByTk, params);
   }
-  const rec = await repo.findOne(
-    preferFullRecord ? { filterByTk } : { filterByTk, fields, appends }
-  );
+  const rec = await repo.findOne(repositoryOptions);
   return rec ? toJsonRecord(rec) : void 0;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/server/variables/resolve.d.ts

@@ -21,7 +21,9 @@ export type AnalyzedResolveBatchItem = ResolveBatchItem & {
     policy: ResolvePathPolicy;
 };
 export declare function resolveVariablesTemplate(ctx: ResourcerContext, template: JSONValue, contextParams?: Record<string, unknown>): Promise<any>;
+export declare function isLegacyVariableTemplateSafe(template: JSONValue): boolean;
 export declare function resolveFlowModelVariablesTemplate(ctx: ResourcerContext, options: {
+    contractRd?: string | number;
     contextParams?: Record<string, unknown>;
     rd?: string | number;
     template: JSONValue;

package/dist/server/variables/resolve.js

@@ -26,6 +26,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var resolve_exports = {};
 __export(resolve_exports, {
+  isLegacyVariableTemplateSafe: () => isLegacyVariableTemplateSafe,
   resolveAnalyzedVariablesBatch: () => resolveAnalyzedVariablesBatch,
   resolveAnalyzedVariablesTemplate: () => resolveAnalyzedVariablesTemplate,
   resolveFlowModelVariablesTemplate: () => resolveFlowModelVariablesTemplate,
@@ -60,6 +61,10 @@ async function resolveVariablesTemplate(ctx, template, contextParams = {}) {
   const bindingPlan = await createRequestBoundRecordBindingPlan(ctx, result.analysis, contextParams);
   return resolveAnalyzedVariablesTemplate(ctx, result.analysis, REQUEST_BOUND_RESOLVE_POLICY, bindingPlan);
 }
+function isLegacyVariableTemplateSafe(template) {
+  const result = (0, import_allow_list.analyzeVariableTemplateSafely)(template, { mode: "untrusted-request" });
+  return result.ok && result.analysis.supported && result.analysis.paths.length === 0;
+}
 async function resolveFlowModelVariablesTemplate(ctx, options) {
   if (!await (0, import_allow_list.resolveFlowModelNodeFromRequestRd)(ctx, options.rd)) return;
   const authorization = await (0, import_allow_list.authorizeVariablesResolve)(ctx, options);
@@ -71,7 +76,7 @@ async function resolveFlowModelVariablesTemplate(ctx, options) {
     authorization.bindingPlan
   );
   const remaining = (0, import_allow_list.analyzeVariableTemplateSafely)(resolved, { mode: "untrusted-request" });
-  if (!remaining.ok || remaining.analysis.paths.length) return;
+  if (!remaining.ok || !remaining.analysis.supported || remaining.analysis.paths.length) return;
   return resolved;
 }
 async function createRequestBoundRecordBindingPlan(ctx, analysis, contextParams) {
@@ -137,6 +142,7 @@ async function resolveAnalyzedVariablesBatch(ctx, items) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  isLegacyVariableTemplateSafe,
   resolveAnalyzedVariablesBatch,
   resolveAnalyzedVariablesTemplate,
   resolveFlowModelVariablesTemplate,

package/dist/server/variables/runjs-variable-dependencies.d.ts

@@ -17,5 +17,7 @@ export declare const MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH = 128;
 export declare const MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES = 10000;
 export declare const MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH: number;
 export declare const MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH: number;
-export declare function prepareFlowModelVariableSource(value: unknown): PreparedFlowModelVariableSource;
+export declare function prepareFlowModelVariableSource(value: unknown, options?: Readonly<{
+    isRunJsValuePath?: (pathTail: readonly string[]) => boolean;
+}>): PreparedFlowModelVariableSource;
 export declare function collectPersistedRunJsVariableTemplates(value: unknown): string[];

package/dist/server/variables/runjs-variable-dependencies.js

@@ -45,6 +45,8 @@ var import_variable_expression = require("../template/variable-expression");
 const RUNJS_VALUE_KEYS = /* @__PURE__ */ new Set(["code", "version"]);
 const RUNJS_PATH_SUFFIXES = /* @__PURE__ */ new Set(["stepParams.jsSettings.runJs", "stepParams.clickSettings.runJs"]);
 const MUTATING_CTX_METHODS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__"]);
+const GLOBAL_OBJECT_NAMES = /* @__PURE__ */ new Set(["globalThis"]);
+const DYNAMIC_CODE_EXECUTION_NAMES = /* @__PURE__ */ new Set(["eval", "Function"]);
 const MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH = 128;
 const MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES = 1e4;
 const MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH = 256 * 1024;
@@ -71,7 +73,7 @@ function readPersistedRunJsValue(entries) {
   return { code, version };
 }
 function isPersistedRunJsPath(pathTail) {
-  return RUNJS_PATH_SUFFIXES.has(pathTail.join("."));
+  return RUNJS_PATH_SUFFIXES.has(pathTail.slice(-3).join("."));
 }
 function createTraversalContainer(input, descriptors) {
   var _a;
@@ -107,9 +109,10 @@ function functionBindsCtxParameter(node, cache) {
 function hasCtxParameterInFunctionAncestors(ancestors, cache) {
   return ancestors.some((ancestor) => functionBindsCtxParameter(ancestor, cache));
 }
-function isDirectCtxGetVarMember(node, identifierBindings) {
+function getDirectCtxMethodName(node, identifierBindings) {
   const member = (0, import_bindings.unwrapAstChainExpression)(node);
-  return (member == null ? void 0 : member.type) === "MemberExpression" && (0, import_static_values.isUnshadowedCtxIdentifier)(member.object, identifierBindings) && (0, import_static_values.getAstStaticPropertyName)(member) === "getVar";
+  if ((member == null ? void 0 : member.type) !== "MemberExpression" || !(0, import_static_values.isUnshadowedCtxIdentifier)(member.object, identifierBindings)) return;
+  return (0, import_static_values.getAstStaticPropertyName)(member);
 }
 function isCtxRootedMember(node, identifierBindings) {
   const member = (0, import_bindings.unwrapAstChainExpression)(node);
@@ -145,16 +148,34 @@ function isNonReferenceIdentifier(node, parent) {
   }
   return (parent.type === "LabeledStatement" || parent.type === "BreakStatement" || parent.type === "ContinueStatement") && parent.value === node;
 }
+function thisUsesTopLevelBinding(ancestors) {
+  for (let index = 0; index < ancestors.length; index += 1) {
+    const ancestor = ancestors[index];
+    if ((0, import_bindings.isAstFunctionLike)(ancestor) && ancestor.type !== "ArrowFunctionExpression") return false;
+    if (ancestor.type === "StaticBlock") return false;
+    if (ancestor.type === "PropertyDefinition" && (0, import_bindings.unwrapAstChainExpression)(ancestor.value) === ancestors[index + 1]) {
+      return false;
+    }
+  }
+  return true;
+}
 function hasUnsafeCtxUsage(ast, identifierBindings) {
   let unsafe = false;
   (0, import_walk.walkAstAncestor)(ast, {
     Identifier(node, ancestors) {
-      if (!(0, import_static_values.isUnshadowedCtxIdentifier)(node, identifierBindings)) return;
       const parent = ancestors[ancestors.length - 2];
       if (isNonReferenceIdentifier(node, parent)) return;
+      if (node.name && (GLOBAL_OBJECT_NAMES.has(node.name) || DYNAMIC_CODE_EXECUTION_NAMES.has(node.name)) && !(0, import_static_values.hasAstActiveBinding)(node.name, node.start || 0, identifierBindings)) {
+        unsafe = true;
+        return;
+      }
+      if (!(0, import_static_values.isUnshadowedCtxIdentifier)(node, identifierBindings)) return;
       if ((parent == null ? void 0 : parent.type) === "MemberExpression" && (0, import_bindings.unwrapAstChainExpression)(parent.object) === node) return;
       unsafe = true;
     },
+    ThisExpression(_node, ancestors) {
+      if (thisUsesTopLevelBinding(ancestors)) unsafe = true;
+    },
     WithStatement() {
       unsafe = true;
     }
@@ -205,7 +226,73 @@ function createValidatedGetVarTemplate(value, code) {
   }
   return `{{ ${path} }}`;
 }
-function extractStaticGetVarTemplates(code) {
+function resolveStaticJsonValue(node, code) {
+  var _a;
+  const valueNode = (0, import_bindings.unwrapAstChainExpression)(node);
+  if (!valueNode) return { ok: false };
+  if (valueNode.type === "Literal") {
+    const literalValue = valueNode.value;
+    if (literalValue === null) return { ok: true, value: null };
+    if (typeof literalValue === "string") return { ok: true, value: literalValue };
+    if (typeof literalValue === "boolean") return { ok: true, value: literalValue };
+    if (typeof literalValue === "number" && Number.isFinite(literalValue)) return { ok: true, value: literalValue };
+    return { ok: false };
+  }
+  if (valueNode.type === "TemplateLiteral" && !((_a = valueNode.expressions) == null ? void 0 : _a.length)) {
+    const value2 = (0, import_static_values.resolveAstStaticStringValue)(valueNode, code);
+    return typeof value2 === "string" ? { ok: true, value: value2 } : { ok: false };
+  }
+  if (valueNode.type === "UnaryExpression" && valueNode.operator === "-") {
+    const argument = (0, import_bindings.unwrapAstChainExpression)(valueNode.argument);
+    return (argument == null ? void 0 : argument.type) === "Literal" && typeof argument.value === "number" && Number.isFinite(argument.value) ? { ok: true, value: -argument.value } : { ok: false };
+  }
+  if (valueNode.type === "ArrayExpression") {
+    const value2 = [];
+    for (const element of valueNode.elements || []) {
+      if (!element || element.type === "SpreadElement") return { ok: false };
+      const resolved = resolveStaticJsonValue(element, code);
+      if (!resolved.ok) return resolved;
+      value2.push(resolved.value);
+    }
+    return { ok: true, value: value2 };
+  }
+  if (valueNode.type !== "ObjectExpression") return { ok: false };
+  const value = /* @__PURE__ */ Object.create(null);
+  for (const propertyValue of valueNode.properties || []) {
+    const property = propertyValue;
+    if ((property == null ? void 0 : property.type) !== "Property" || property.computed || property.kind !== "init" || property.method || property.shorthand) {
+      return { ok: false };
+    }
+    const keyNode = (0, import_bindings.unwrapAstChainExpression)(property.key);
+    const key = (keyNode == null ? void 0 : keyNode.type) === "Identifier" ? keyNode.name : (keyNode == null ? void 0 : keyNode.type) === "Literal" && (typeof keyNode.value === "string" || typeof keyNode.value === "number") ? String(keyNode.value) : void 0;
+    if (typeof key !== "string" || key === "__proto__" || Object.prototype.hasOwnProperty.call(value, key)) {
+      return { ok: false };
+    }
+    const resolved = resolveStaticJsonValue(property.value, code);
+    if (!resolved.ok) return resolved;
+    value[key] = resolved.value;
+  }
+  return { ok: true, value };
+}
+function collectValidatedResolveJsonTemplates(value) {
+  const analysis = (0, import_variable_expression.analyzeVariableTemplate)(value, { mode: "untrusted-request" });
+  if (!analysis.supported || analysis.errors.length) return [];
+  const templates = /* @__PURE__ */ new Set();
+  const visit = (current) => {
+    if (typeof current === "string") {
+      if ((0, import_variable_expression.analyzeVariableTemplate)(current, { mode: "untrusted-request" }).paths.length) templates.add(current);
+      return;
+    }
+    if (Array.isArray(current)) {
+      current.forEach(visit);
+      return;
+    }
+    if (current && typeof current === "object") Object.values(current).forEach(visit);
+  };
+  visit(value);
+  return Array.from(templates);
+}
+function extractStaticVariableTemplates(code) {
   const parsed = (0, import_parser.parseRunJsAuthoringAst)(code);
   if (!parsed.ast) return [];
   const identifierBindings = (0, import_static_bindings.collectAstIdentifierBindingsFromAst)(parsed.ast, code);
@@ -216,18 +303,23 @@ function extractStaticGetVarTemplates(code) {
   const templates = /* @__PURE__ */ new Set();
   (0, import_walk.walkAstAncestor)(parsed.ast, {
     CallExpression(node, ancestors) {
-      var _a;
-      const callee = (0, import_bindings.unwrapAstChainExpression)(node.callee);
-      if ((callee == null ? void 0 : callee.type) !== "MemberExpression" || !(0, import_static_values.isUnshadowedCtxIdentifier)(callee.object, identifierBindings) || (0, import_static_values.getAstStaticPropertyName)(callee) !== "getVar" || hasCtxParameterInFunctionAncestors(ancestors, functionCtxParameterCache)) {
+      var _a, _b;
+      const methodName = getDirectCtxMethodName(node.callee, identifierBindings);
+      if (hasCtxParameterInFunctionAncestors(ancestors, functionCtxParameterCache)) return;
+      if (methodName === "getVar") {
+        const template = createValidatedGetVarTemplate((_a = node.arguments) == null ? void 0 : _a[0], code);
+        if (template) templates.add(template);
         return;
       }
-      const template = createValidatedGetVarTemplate((_a = node.arguments) == null ? void 0 : _a[0], code);
-      if (template) templates.add(template);
+      if (methodName !== "resolveJsonTemplate" || ((_b = node.arguments) == null ? void 0 : _b.length) !== 1) return;
+      const resolved = resolveStaticJsonValue(node.arguments[0], code);
+      if (!resolved.ok) return;
+      collectValidatedResolveJsonTemplates(resolved.value).forEach((template) => templates.add(template));
     }
   });
   return Array.from(templates);
 }
-function prepareFlowModelVariableSource(value) {
+function prepareFlowModelVariableSource(value, options = {}) {
   var _a;
   try {
     const templates = /* @__PURE__ */ new Set();
@@ -261,7 +353,8 @@ function prepareFlowModelVariableSource(value) {
           return { ok: false };
         }
       }
-      const runJs = !Array.isArray(input) && isPersistedRunJsPath(pathTail) ? readPersistedRunJsValue(entries) : void 0;
+      const runJsPath = options.isRunJsValuePath ? options.isRunJsValuePath(pathTail) : isPersistedRunJsPath(pathTail);
+      const runJs = !Array.isArray(input) && runJsPath ? readPersistedRunJsValue(entries) : void 0;
       const output = createTraversalContainer(input, descriptors);
       defineTraversalValue(parent, key, output);
       if (runJs) {
@@ -276,7 +369,7 @@ function prepareFlowModelVariableSource(value) {
           const preparedEntryValue = entryKey === "code" ? runJs.version === "v2" ? "" : (0, import_source.maskJavaScriptComments)(runJs.code) : entryValue;
           defineTraversalValue(output, entryKey, preparedEntryValue);
         }
-        extractStaticGetVarTemplates(runJs.code).forEach((template) => templates.add(template));
+        extractStaticVariableTemplates(runJs.code).forEach((template) => templates.add(template));
         continue;
       }
       if (entries.length && depth >= MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH) return { ok: false };
@@ -284,12 +377,13 @@ function prepareFlowModelVariableSource(value) {
       if (scheduledNodes > MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES) return { ok: false };
       for (let index = entries.length - 1; index >= 0; index -= 1) {
         const [entryKey, entryValue] = entries[index];
+        const nextPath = [...pathTail, entryKey];
         stack.push({
           depth: depth + 1,
           input: entryValue,
           key: entryKey,
           parent: output,
-          pathTail: [...pathTail, entryKey].slice(-3)
+          pathTail: options.isRunJsValuePath ? nextPath : nextPath.slice(-3)
         });
       }
     }

package/dist/server/variables/selects.js

@@ -30,12 +30,15 @@ __export(selects_exports, {
 });
 module.exports = __toCommonJS(selects_exports);
 function adjustSelectsForCollection(koaCtx, dataSourceKey, collection, fields, appends) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c, _d, _e;
   const ds = koaCtx.app.dataSourceManager.get(dataSourceKey || "main");
   const cm = ds.collectionManager;
   const coll = (_b = (_a = cm == null ? void 0 : cm.db) == null ? void 0 : _a.getCollection) == null ? void 0 : _b.call(_a, collection);
-  const assocKeys = Object.keys(((_c = coll == null ? void 0 : coll.model) == null ? void 0 : _c.associations) || {});
-  const rawAttrs = ((_d = coll == null ? void 0 : coll.model) == null ? void 0 : _d.rawAttributes) || {};
+  if (!((_c = coll == null ? void 0 : coll.model) == null ? void 0 : _c.rawAttributes)) {
+    return { fields, appends };
+  }
+  const assocKeys = Object.keys(((_d = coll == null ? void 0 : coll.model) == null ? void 0 : _d.associations) || {});
+  const rawAttrs = ((_e = coll == null ? void 0 : coll.model) == null ? void 0 : _e.rawAttributes) || {};
   const toCamel = (s) => s.replace(/_([a-zA-Z0-9])/g, (_m, c) => String(c).toUpperCase());
   const toSnake = (s) => s.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "");
   const assocMap = /* @__PURE__ */ new Map();

package/dist/server/variables/utils.js

@@ -81,7 +81,7 @@ async function prefetchRecordsForResolve(koaCtx, bindings) {
           group.preferFullRecord
         );
         if ((0, import_records.findRecordRequestCacheValue)(cache, query).hit) continue;
-        (0, import_records.setRecordRequestCache)(cache, query, await (0, import_records.fetchRecordOrRecordsJson)(query.repository, query));
+        (0, import_records.setRecordRequestCache)(cache, query, await (0, import_records.fetchRecordOrRecordsJson)(query.repository, query, koaCtx));
       } catch (error) {
         log == null ? void 0 : log.debug("[variables.resolve] prefetch query error", {
           ...group.target.cacheIdentity,

package/package.json

@@ -4,7 +4,7 @@
   "displayName.zh-CN": "前端流引擎",
   "description": "",
   "description.zh-CN": "",
-  "version": "3.0.0-alpha.7",
+  "version": "3.0.0-alpha.8",
   "main": "./dist/server/index.js",
   "license": "Apache-2.0",
   "devDependencies": {
@@ -26,5 +26,5 @@
     "@nocobase/test": "2.x",
     "@nocobase/utils": "2.x"
   },
-  "gitHead": "19cd28c710f3b3c614ebe2fd7d5a415d527ee559"
+  "gitHead": "ce017f3deb8b2414c6b13818042c4187270d1d8a"
 }