@flusys/nestjs-entity-builder 9.0.1 → 9.1.0

package/fesm/{913.js → 606.js}

@@ -1,15 +1,16 @@
 import { lastValueFrom } from "rxjs";
 import * as __rspack_external__flusys_nestjs_shared_guards_3f79ddd1 from "@flusys/nestjs-shared/guards";
 import * as __rspack_external__flusys_nestjs_shared_decorators_c129b601 from "@flusys/nestjs-shared/decorators";
-export const __rspack_esm_id = 913;
-export const __rspack_esm_ids = [913];
+export const __rspack_esm_id = 606;
+export const __rspack_esm_ids = [606];
 export const __webpack_modules__ = {
-6384(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+2517(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
   hv: () => (/* reexport */ EntityDefinitionController),
   GX: () => (/* reexport */ FieldDefinitionController),
+  Sv: () => (/* reexport */ FlowApiKeyController),
   W8: () => (/* reexport */ FlowDefinitionController),
   VU: () => (/* reexport */ FlowExecutionController),
   bw: () => (/* reexport */ FlowRuntimeController)
@@ -448,7 +449,15 @@ class CreateFlowDefinitionDto {
     slug;
     description;
     isActive;
+    authMode;
+    permissionCode;
+    runAs;
+    isTransactional;
+    timeoutMs;
+    rateLimitPerMinute;
     retainExecutions;
+    bodyType;
+    inputSchema;
     nodes;
     edges;
 }
@@ -487,6 +496,62 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsOptional)(),
     flow_dto_ts_metadata("design:type", Boolean)
 ], CreateFlowDefinitionDto.prototype, "isActive", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        enum: flow_types/* .FLOW_AUTH_MODES */.fO,
+        default: 'jwt'
+    }),
+    (0,external_class_validator_.IsEnum)(flow_types/* .FLOW_AUTH_MODES */.fO),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", typeof FlowAuthMode === "undefined" ? Object : FlowAuthMode)
+], CreateFlowDefinitionDto.prototype, "authMode", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        description: "authMode 'permission': defaults to entity_builder.flow.<slug>.execute"
+    }),
+    (0,external_class_validator_.IsString)(),
+    (0,external_class_validator_.IsOptional)(),
+    (0,external_class_validator_.MaxLength)(255),
+    flow_dto_ts_metadata("design:type", String)
+], CreateFlowDefinitionDto.prototype, "permissionCode", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        enum: flow_types/* .FLOW_RUN_AS */.gl,
+        default: 'caller'
+    }),
+    (0,external_class_validator_.IsEnum)(flow_types/* .FLOW_RUN_AS */.gl),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", typeof FlowRunAs === "undefined" ? Object : FlowRunAs)
+], CreateFlowDefinitionDto.prototype, "runAs", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        default: false
+    }),
+    (0,external_class_validator_.IsBoolean)(),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", Boolean)
+], CreateFlowDefinitionDto.prototype, "isTransactional", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        default: flow_types/* .FLOW_LIMITS.DEFAULT_TIMEOUT_MS */.Or.DEFAULT_TIMEOUT_MS
+    }),
+    (0,external_class_validator_.IsInt)(),
+    (0,external_class_validator_.Min)(flow_types/* .FLOW_LIMITS.MIN_TIMEOUT_MS */.Or.MIN_TIMEOUT_MS),
+    (0,external_class_validator_.Max)(flow_types/* .FLOW_LIMITS.MAX_TIMEOUT_MS */.Or.MAX_TIMEOUT_MS),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", Number)
+], CreateFlowDefinitionDto.prototype, "timeoutMs", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        description: 'Per caller IP per minute; 0 = unlimited',
+        default: 60
+    }),
+    (0,external_class_validator_.IsInt)(),
+    (0,external_class_validator_.Min)(0),
+    (0,external_class_validator_.Max)(100000),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", Number)
+], CreateFlowDefinitionDto.prototype, "rateLimitPerMinute", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiPropertyOptional)({
         default: 200
@@ -497,12 +562,31 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsOptional)(),
     flow_dto_ts_metadata("design:type", Number)
 ], CreateFlowDefinitionDto.prototype, "retainExecutions", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        enum: flow_types/* .FLOW_BODY_TYPES */.Y3,
+        default: 'object',
+        description: 'object: the body is one object; list: the body is a list and inputSchema describes each item'
+    }),
+    (0,external_class_validator_.IsIn)(flow_types/* .FLOW_BODY_TYPES */.Y3),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", typeof FlowBodyType === "undefined" ? Object : FlowBodyType)
+], CreateFlowDefinitionDto.prototype, "bodyType", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        type: [
+            Object
+        ]
+    }),
+    (0,external_class_validator_.IsArray)(),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", Array)
+], CreateFlowDefinitionDto.prototype, "inputSchema", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiProperty)({
         type: [
             Object
-        ],
-        description: 'Steps; each Request step (trigger) carries its own path, body (bodyType, inputSchema), access (authMode: signed-in by default, permissionCode), runAs (caller by default), isTransactional, timeoutMs and rateLimitPerMinute'
+        ]
     }),
     (0,external_class_validator_.IsArray)(),
     flow_dto_ts_metadata("design:type", Array)
@@ -527,7 +611,7 @@ flow_dto_ts_decorate([
 ], UpdateFlowDefinitionDto.prototype, "id", void 0);
 /**
  * A flow as the designer holds it, for a test run or a check: every setting is validated like a
- * saved flow's (the graph, with each Request step's access, run-as and limits, by `validateFlow`),
+ * saved flow's (run-as, auth mode, time-out and limits are bounded, the graph by `validateFlow`),
  * the name may still be empty, and the server-owned fields of a loaded flow are ignored.
  */ class FlowDraftDto extends (0,swagger_.OmitType)(CreateFlowDefinitionDto, [
     'name'
@@ -535,7 +619,6 @@ flow_dto_ts_decorate([
     name;
     id;
     version;
-    draft;
     createdAt;
     updatedAt;
     deletedAt;
@@ -560,10 +643,6 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.Allow)(),
     flow_dto_ts_metadata("design:type", Object)
 ], FlowDraftDto.prototype, "version", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_validator_.Allow)(),
-    flow_dto_ts_metadata("design:type", Object)
-], FlowDraftDto.prototype, "draft", void 0);
 flow_dto_ts_decorate([
     (0,external_class_validator_.Allow)(),
     flow_dto_ts_metadata("design:type", Object)
@@ -706,37 +785,27 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsNotEmpty)(),
     flow_dto_ts_metadata("design:type", String)
 ], FlowIdDto.prototype, "flowId", void 0);
-class PublishFlowDto {
-    id;
-    note;
+class CreateFlowApiKeyDto extends FlowIdDto {
+    name;
+    expiresAt;
 }
 flow_dto_ts_decorate([
-    (0,swagger_.ApiProperty)(),
-    (0,external_class_validator_.IsUUID)(),
+    (0,swagger_.ApiProperty)({
+        example: 'Shop backend'
+    }),
+    (0,external_class_validator_.IsString)(),
     (0,external_class_validator_.IsNotEmpty)(),
+    (0,external_class_validator_.MaxLength)(100),
     flow_dto_ts_metadata("design:type", String)
-], PublishFlowDto.prototype, "id", void 0);
+], CreateFlowApiKeyDto.prototype, "name", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiPropertyOptional)({
-        description: 'What changed in this version',
-        example: 'Checks the branch before saving'
+        description: 'ISO date-time after which the key stops working'
     }),
-    (0,external_class_validator_.IsString)(),
+    (0,external_class_validator_.IsISO8601)(),
     (0,external_class_validator_.IsOptional)(),
-    (0,external_class_validator_.MaxLength)(500),
     flow_dto_ts_metadata("design:type", String)
-], PublishFlowDto.prototype, "note", void 0);
-class FlowVersionRefDto extends FlowIdDto {
-    version;
-}
-flow_dto_ts_decorate([
-    (0,swagger_.ApiProperty)({
-        example: 3
-    }),
-    (0,external_class_validator_.IsInt)(),
-    (0,external_class_validator_.Min)(1),
-    flow_dto_ts_metadata("design:type", Number)
-], FlowVersionRefDto.prototype, "version", void 0);
+], CreateFlowApiKeyDto.prototype, "expiresAt", void 0);
 /** The id of a flow API key or a flow execution. */ class IdBodyDto {
     id;
 }
@@ -798,11 +867,18 @@ class FlowDefinitionResponseDto extends dtos_.IdentityResponseDto {
     slug;
     description;
     isActive;
+    authMode;
+    permissionCode;
+    runAs;
+    isTransactional;
+    timeoutMs;
+    rateLimitPerMinute;
     retainExecutions;
+    bodyType;
+    inputSchema;
     nodes;
     edges;
     version;
-    draft;
 }
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
@@ -824,11 +900,53 @@ flow_dto_ts_decorate([
     (0,swagger_.ApiProperty)(),
     flow_dto_ts_metadata("design:type", Boolean)
 ], FlowDefinitionResponseDto.prototype, "isActive", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", typeof FlowAuthMode === "undefined" ? Object : FlowAuthMode)
+], FlowDefinitionResponseDto.prototype, "authMode", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", Object)
+], FlowDefinitionResponseDto.prototype, "permissionCode", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", typeof FlowRunAs === "undefined" ? Object : FlowRunAs)
+], FlowDefinitionResponseDto.prototype, "runAs", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", Boolean)
+], FlowDefinitionResponseDto.prototype, "isTransactional", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", Number)
+], FlowDefinitionResponseDto.prototype, "timeoutMs", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", Number)
+], FlowDefinitionResponseDto.prototype, "rateLimitPerMinute", void 0);
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
     (0,swagger_.ApiProperty)(),
     flow_dto_ts_metadata("design:type", Number)
 ], FlowDefinitionResponseDto.prototype, "retainExecutions", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)({
+        enum: flow_types/* .FLOW_BODY_TYPES */.Y3
+    }),
+    flow_dto_ts_metadata("design:type", typeof FlowBodyType === "undefined" ? Object : FlowBodyType)
+], FlowDefinitionResponseDto.prototype, "bodyType", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)(),
+    flow_dto_ts_metadata("design:type", Array)
+], FlowDefinitionResponseDto.prototype, "inputSchema", void 0);
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
     (0,swagger_.ApiProperty)(),
@@ -841,22 +959,12 @@ flow_dto_ts_decorate([
 ], FlowDefinitionResponseDto.prototype, "edges", void 0);
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)({
-        description: 'The published version; 0 until the flow is first published'
-    }),
+    (0,swagger_.ApiProperty)(),
     flow_dto_ts_metadata("design:type", Number)
 ], FlowDefinitionResponseDto.prototype, "version", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)({
-        description: 'Saved changes not yet published',
-        nullable: true
-    }),
-    flow_dto_ts_metadata("design:type", Object)
-], FlowDefinitionResponseDto.prototype, "draft", void 0);
 
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts + 1 modules
-var flow_definition_service = __webpack_require__(4921);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts
+var flow_definition_service = __webpack_require__(5229);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-runtime.service.ts
 var flow_runtime_service = __webpack_require__(2300);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/flow-definition.controller.ts
@@ -963,55 +1071,6 @@ class FlowDefinitionController extends (0,nestjs_shared_.createApiController)(Cr
             data: result
         };
     }
-    async publish(dto, user) {
-        const flow = await this.flowDefinitionService.publish(dto.id, dto.note, user);
-        return {
-            success: true,
-            message: `Version ${flow.version} published`,
-            messageKey: message_keys/* .FLOW_MESSAGES.PUBLISH_SUCCESS */.wu.PUBLISH_SUCCESS,
-            messageVariables: {
-                version: flow.version
-            },
-            data: flow
-        };
-    }
-    async versions(dto) {
-        return {
-            success: true,
-            message: 'Versions loaded',
-            messageKey: message_keys/* .FLOW_MESSAGES.VERSIONS_SUCCESS */.wu.VERSIONS_SUCCESS,
-            data: await this.flowDefinitionService.listVersions(dto.flowId)
-        };
-    }
-    async version(dto) {
-        return {
-            success: true,
-            message: 'Version loaded',
-            messageKey: message_keys/* .FLOW_MESSAGES.VERSION_SUCCESS */.wu.VERSION_SUCCESS,
-            data: await this.flowDefinitionService.getVersion(dto.flowId, dto.version)
-        };
-    }
-    async restoreVersion(dto, user) {
-        const flow = await this.flowDefinitionService.restoreVersion(dto.flowId, dto.version, user);
-        return {
-            success: true,
-            message: `Version ${dto.version} restored to the draft`,
-            messageKey: message_keys/* .FLOW_MESSAGES.VERSION_RESTORED */.wu.VERSION_RESTORED,
-            messageVariables: {
-                version: dto.version
-            },
-            data: flow
-        };
-    }
-    async discardDraft(dto, user) {
-        const flow = await this.flowDefinitionService.discardDraft(dto.flowId, user);
-        return {
-            success: true,
-            message: 'Unpublished changes discarded',
-            messageKey: message_keys/* .FLOW_MESSAGES.DRAFT_DISCARDED */.wu.DRAFT_DISCARDED,
-            data: flow
-        };
-    }
     async testRun(dto, user, req) {
         const { result, warnings } = await this.runtime.testRun(dto, user, {
             ip: req.ip ?? null,
@@ -1047,109 +1106,6 @@ flow_definition_controller_ts_decorate([
     ]),
     flow_definition_controller_ts_metadata("design:returntype", Promise)
 ], FlowDefinitionController.prototype, "validate", null);
-flow_definition_controller_ts_decorate([
-    (0,common_.Post)('publish'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.UPDATE),
-    (0,swagger_.ApiBearerAuth)(),
-    (0,swagger_.ApiOperation)({
-        summary: 'Make the saved changes live as the next version',
-        description: 'Checked like a save, plus that no other flow calls a URL name or path this version drops.'
-    }),
-    (0,swagger_.ApiBody)({
-        type: PublishFlowDto
-    }),
-    flow_definition_controller_ts_param(0, (0,common_.Body)()),
-    flow_definition_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
-    flow_definition_controller_ts_metadata("design:type", Function),
-    flow_definition_controller_ts_metadata("design:paramtypes", [
-        typeof PublishFlowDto === "undefined" ? Object : PublishFlowDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    flow_definition_controller_ts_metadata("design:returntype", Promise)
-], FlowDefinitionController.prototype, "publish", null);
-flow_definition_controller_ts_decorate([
-    (0,common_.Post)('versions'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.READ),
-    (0,swagger_.ApiBearerAuth)(),
-    (0,swagger_.ApiOperation)({
-        summary: 'Published versions of a flow, newest first'
-    }),
-    (0,swagger_.ApiBody)({
-        type: FlowIdDto
-    }),
-    flow_definition_controller_ts_param(0, (0,common_.Body)()),
-    flow_definition_controller_ts_metadata("design:type", Function),
-    flow_definition_controller_ts_metadata("design:paramtypes", [
-        typeof FlowIdDto === "undefined" ? Object : FlowIdDto
-    ]),
-    flow_definition_controller_ts_metadata("design:returntype", Promise)
-], FlowDefinitionController.prototype, "versions", null);
-flow_definition_controller_ts_decorate([
-    (0,common_.Post)('version'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.READ),
-    (0,swagger_.ApiBearerAuth)(),
-    (0,swagger_.ApiOperation)({
-        summary: 'One published version in full'
-    }),
-    (0,swagger_.ApiBody)({
-        type: FlowVersionRefDto
-    }),
-    flow_definition_controller_ts_param(0, (0,common_.Body)()),
-    flow_definition_controller_ts_metadata("design:type", Function),
-    flow_definition_controller_ts_metadata("design:paramtypes", [
-        typeof FlowVersionRefDto === "undefined" ? Object : FlowVersionRefDto
-    ]),
-    flow_definition_controller_ts_metadata("design:returntype", Promise)
-], FlowDefinitionController.prototype, "version", null);
-flow_definition_controller_ts_decorate([
-    (0,common_.Post)('restore-version'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.UPDATE),
-    (0,swagger_.ApiBearerAuth)(),
-    (0,swagger_.ApiOperation)({
-        summary: 'Put an old version back into the draft',
-        description: 'Callers keep running the published flow until the draft is published.'
-    }),
-    (0,swagger_.ApiBody)({
-        type: FlowVersionRefDto
-    }),
-    flow_definition_controller_ts_param(0, (0,common_.Body)()),
-    flow_definition_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
-    flow_definition_controller_ts_metadata("design:type", Function),
-    flow_definition_controller_ts_metadata("design:paramtypes", [
-        typeof FlowVersionRefDto === "undefined" ? Object : FlowVersionRefDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    flow_definition_controller_ts_metadata("design:returntype", Promise)
-], FlowDefinitionController.prototype, "restoreVersion", null);
-flow_definition_controller_ts_decorate([
-    (0,common_.Post)('discard-draft'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.UPDATE),
-    (0,swagger_.ApiBearerAuth)(),
-    (0,swagger_.ApiOperation)({
-        summary: 'Drop the unpublished changes: the flow goes back to what is published'
-    }),
-    (0,swagger_.ApiBody)({
-        type: FlowIdDto
-    }),
-    flow_definition_controller_ts_param(0, (0,common_.Body)()),
-    flow_definition_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
-    flow_definition_controller_ts_metadata("design:type", Function),
-    flow_definition_controller_ts_metadata("design:paramtypes", [
-        typeof FlowIdDto === "undefined" ? Object : FlowIdDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    flow_definition_controller_ts_metadata("design:returntype", Promise)
-], FlowDefinitionController.prototype, "discardDraft", null);
 flow_definition_controller_ts_decorate([
     (0,common_.Post)('test-run'),
     (0,common_.HttpCode)(common_.HttpStatus.OK),
@@ -1186,6 +1142,128 @@ FlowDefinitionController = flow_definition_controller_ts_decorate([
     ])
 ], FlowDefinitionController);
 
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-api-key.service.ts + 1 modules
+var flow_api_key_service = __webpack_require__(8888);
+;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/flow-api-key.controller.ts
+function flow_api_key_controller_ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function flow_api_key_controller_ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function flow_api_key_controller_ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+const flow_api_key_controller_P = nestjs_shared_.FLOW_DEFINITION_PERMISSIONS;
+const ok = (data, message, messageKey)=>({
+        success: true,
+        message,
+        messageKey,
+        data
+    });
+class FlowApiKeyController {
+    keys;
+    constructor(keys){
+        this.keys = keys;
+    }
+    async create(dto, user) {
+        return ok(await this.keys.create(dto.flowId, dto.name, dto.expiresAt, user), 'API key created', message_keys/* .FLOW_MESSAGES.API_KEY_CREATE_SUCCESS */.wu.API_KEY_CREATE_SUCCESS);
+    }
+    async list(dto) {
+        return ok(await this.keys.list(dto.flowId), 'API keys loaded', message_keys/* .FLOW_MESSAGES.API_KEY_LIST_SUCCESS */.wu.API_KEY_LIST_SUCCESS);
+    }
+    async revoke(dto) {
+        await this.keys.revoke(dto.id);
+        return ok(null, 'API key revoked', message_keys/* .FLOW_MESSAGES.API_KEY_REVOKE_SUCCESS */.wu.API_KEY_REVOKE_SUCCESS);
+    }
+    async remove(dto) {
+        await this.keys.remove(dto.id);
+        return ok(null, 'API key deleted', message_keys/* .FLOW_MESSAGES.API_KEY_DELETE_SUCCESS */.wu.API_KEY_DELETE_SUCCESS);
+    }
+}
+flow_api_key_controller_ts_decorate([
+    (0,common_.Post)('create'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.UPDATE),
+    (0,swagger_.ApiOperation)({
+        summary: 'Create an API key. The key is in the response once and cannot be shown again.'
+    }),
+    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
+    flow_api_key_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
+    flow_api_key_controller_ts_metadata("design:type", Function),
+    flow_api_key_controller_ts_metadata("design:paramtypes", [
+        typeof CreateFlowApiKeyDto === "undefined" ? Object : CreateFlowApiKeyDto,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    flow_api_key_controller_ts_metadata("design:returntype", Promise)
+], FlowApiKeyController.prototype, "create", null);
+flow_api_key_controller_ts_decorate([
+    (0,common_.Post)('list'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.READ),
+    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
+    flow_api_key_controller_ts_metadata("design:type", Function),
+    flow_api_key_controller_ts_metadata("design:paramtypes", [
+        typeof FlowIdDto === "undefined" ? Object : FlowIdDto
+    ]),
+    flow_api_key_controller_ts_metadata("design:returntype", Promise)
+], FlowApiKeyController.prototype, "list", null);
+flow_api_key_controller_ts_decorate([
+    (0,common_.Post)('revoke'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.UPDATE),
+    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
+    flow_api_key_controller_ts_metadata("design:type", Function),
+    flow_api_key_controller_ts_metadata("design:paramtypes", [
+        typeof IdBodyDto === "undefined" ? Object : IdBodyDto
+    ]),
+    flow_api_key_controller_ts_metadata("design:returntype", Promise)
+], FlowApiKeyController.prototype, "revoke", null);
+flow_api_key_controller_ts_decorate([
+    (0,common_.Post)('delete'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.UPDATE),
+    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
+    flow_api_key_controller_ts_metadata("design:type", Function),
+    flow_api_key_controller_ts_metadata("design:paramtypes", [
+        typeof IdBodyDto === "undefined" ? Object : IdBodyDto
+    ]),
+    flow_api_key_controller_ts_metadata("design:returntype", Promise)
+], FlowApiKeyController.prototype, "remove", null);
+FlowApiKeyController = flow_api_key_controller_ts_decorate([
+    (0,swagger_.ApiTags)('Entity Builder - Flow API keys'),
+    (0,common_.Controller)('entity-builder/flow-api-keys'),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,swagger_.ApiBearerAuth)(),
+    flow_api_key_controller_ts_param(0, (0,common_.Inject)(flow_api_key_service/* .FlowApiKeyService */.T)),
+    flow_api_key_controller_ts_metadata("design:type", Function),
+    flow_api_key_controller_ts_metadata("design:paramtypes", [
+        typeof flow_api_key_service/* .FlowApiKeyService */.T === "undefined" ? Object : flow_api_key_service/* .FlowApiKeyService */.T
+    ])
+], FlowApiKeyController);
+
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-execution.service.ts
 var flow_execution_service = __webpack_require__(7810);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/flow-execution.controller.ts
@@ -1420,6 +1498,7 @@ FlowRuntimeController = flow_runtime_controller_ts_decorate([
 
 
 
+
 },
 4196(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
@@ -1442,8 +1521,10 @@ var core_ = __webpack_require__(3075);
 
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/config/message-keys.ts
 var message_keys = __webpack_require__(5732);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts + 1 modules
-var flow_definition_service = __webpack_require__(4921);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts
+var flow_definition_service = __webpack_require__(5229);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-api-key.service.ts + 1 modules
+var flow_api_key_service = __webpack_require__(8888);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-runtime.service.ts
 var flow_runtime_service = __webpack_require__(2300);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-rate-limiter.ts
@@ -1487,8 +1568,6 @@ const DEFAULT_MAX_KEYS = 10_000;
     }
 }
 
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-api-key.ts
-var flow_api_key = __webpack_require__(4816);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow.types.ts
 var flow_types = __webpack_require__(6256);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/guards/flow-access.guard.ts
@@ -1545,27 +1624,34 @@ class FlowAccessGuard {
         });
         const flow = slug ? await runtime.findActive(slug) : null;
         const endpoint = flow ? (0,flow_types/* .findEndpoint */.vS)(flow, request.params?.endpoint) : undefined;
-        // A Request step for other flows only has no URL: it looks the same as an unknown one.
-        if (!flow || !endpoint || endpoint.authMode === 'internal') throw new common_.NotFoundException({
+        if (!flow || !endpoint) throw new common_.NotFoundException({
             message: 'Not found',
             messageKey: message_keys/* .FLOW_MESSAGES.NOT_FOUND */.wu.NOT_FOUND
         });
         request.flowDefinition = flow;
         request.flowEndpoint = endpoint;
         const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';
-        if (!limiter.hit(`${flow.id}|${endpoint.nodeId}|${ip}`, endpoint.rateLimitPerMinute)) {
+        if (!limiter.hit(`${flow.id}|${ip}`, flow.rateLimitPerMinute)) {
             throw new common_.HttpException({
                 message: 'Too many requests. Try again in a minute.',
                 messageKey: message_keys/* .FLOW_MESSAGES.RATE_LIMITED */.wu.RATE_LIMITED
             }, common_.HttpStatus.TOO_MANY_REQUESTS);
         }
-        switch(endpoint.authMode){
+        switch(flow.authMode){
             case 'public':
                 return true;
             case 'api_key':
                 {
+                    const keys = await this.moduleRef.resolve(flow_api_key_service/* .FlowApiKeyService */.T, contextId, {
+                        strict: false
+                    });
                     const header = request.headers?.['x-api-key'];
-                    if (!(0,flow_api_key/* .apiKeyOpens */.NT)(endpoint.apiKey, Array.isArray(header) ? header[0] : header)) {
+                    const check = await keys.verify(flow.id, Array.isArray(header) ? header[0] : header);
+                    if (check === 'expired') throw new common_.UnauthorizedException({
+                        message: 'This API key has expired.',
+                        messageKey: message_keys/* .FLOW_MESSAGES.API_KEY_EXPIRED */.wu.API_KEY_EXPIRED
+                    });
+                    if (check !== 'valid') {
                         throw new common_.UnauthorizedException({
                             message: 'A valid API key is required (x-api-key header).',
                             messageKey: message_keys/* .FLOW_MESSAGES.API_KEY_INVALID */.wu.API_KEY_INVALID
@@ -1579,7 +1665,7 @@ class FlowAccessGuard {
             case 'permission':
                 {
                     if (!await this.authenticate(context)) return false;
-                    await this.permissionCache.assertPermission(request.user, endpoint.permissionCode || (0,flow_definition_service/* .defaultFlowPermissionCode */.Er)(flow.slug));
+                    await this.permissionCache.assertPermission(request.user, flow.permissionCode || (0,flow_definition_service/* .defaultFlowPermissionCode */.Er)(flow.slug));
                     return true;
                 }
             default: