@flusys/nestjs-entity-builder 9.1.0-rc.1 → 9.1.0

package/fesm/996.js

@@ -1034,7 +1034,7 @@ async function insertChildren(node, child, parentId, env, state) {
                 const cfg = c;
                 const input = cfg.inputList !== undefined ? await env.ruleEngine.resolveExpression(cfg.inputList, evaluationContext(state, env)) : await mapValues(cfg.input, env, state);
                 return {
-                    output: await env.callFlow(cfg.flowSlug, input, state)
+                    output: await env.callFlow(cfg.flowSlug, input, state, cfg.endpoint || undefined)
                 };
             }
         case 'http_request':
@@ -1128,7 +1128,8 @@ async function insertChildren(node, child, parentId, env, state) {
 
 const errorMessage = (error)=>error instanceof Error ? error.message : String(error);
 /**
- * Walks a flow graph from its trigger: runs a node, follows the output port it chose, repeats.
+ * Walks a flow graph from the Request step the call came in on (`state.startAt`; left out, the one
+ * on the flow's own URL): runs a node, follows the output port it chose, repeats.
  * `foreach` runs its `each` branch once per item and then continues on `done`; inside a nested
  * loop the outer loop's scope stays reachable as `loop.parent`. A `respond` node
  * ends the whole run. Limits (steps, time) are checked before every node.
@@ -1147,7 +1148,7 @@ const errorMessage = (error)=>error instanceof Error ? error.message : String(er
     /** Runs to completion or throws (FlowNodeError wraps whatever a node threw). */ async walk(state) {
         const trigger = [
             ...this.nodes.values()
-        ].find((n)=>n.type === 'trigger');
+        ].find((n)=>n.type === 'trigger' && (state.startAt ? n.id === state.startAt : !(0,flow_types/* .triggerPath */.um)(n)));
         if (!trigger) throw new flow_errors/* .FlowLimitError */.IM(message_keys/* .FLOW_ERROR_MESSAGES.NO_TRIGGER */.zr.NO_TRIGGER);
         await this.run(trigger.id, state);
     }
@@ -1741,7 +1742,7 @@ function conditionProblem(node, options) {
     return null;
 }
 /**
- * Save-time check of a whole flow: structure (one trigger, valid ids/ports, no cycles),
+ * Save-time check of a whole flow: structure (Request steps with distinct URLs, valid ids/ports, no cycles),
  * every node's configuration, every reference to another node, and the combination of
  * settings (run-as / auth / transaction). Pure: no I/O, so the same result is what the
  * designer shows and what the server enforces.
@@ -1791,9 +1792,7 @@ function conditionProblem(node, options) {
         }));
     }
     const triggers = nodes.filter((n)=>n.type === 'trigger');
-    if (triggers.length !== 1) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_COUNT */.qj.TRIGGER_COUNT, {
-        count: triggers.length
-    }));
+    checkTriggers(triggers, err);
     for (const node of nodes){
         if (byId.get(node.id) === node) validateNodeConfig(node, flow, context, err, warnings);
     }
@@ -1841,7 +1840,9 @@ function conditionProblem(node, options) {
     }
     const cyclic = hasCycle(nodes, outgoing);
     if (cyclic) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.CYCLE */.qj.CYCLE));
-    const reachable = triggers.length === 1 ? reach(triggers[0].id, outgoing) : null;
+    const reachable = triggers.length ? new Set(triggers.flatMap((trigger)=>[
+            ...reach(trigger.id, outgoing)
+        ])) : null;
     for (const node of nodes){
         if (reachable && !reachable.has(node.id)) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_UNREACHABLE */.qj.NODE_UNREACHABLE, {
             node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node)
@@ -1865,11 +1866,27 @@ function conditionProblem(node, options) {
         warnings
     };
 }
+/** At least one Request step; at most one on the flow's own URL, the others on distinct paths. */ function checkTriggers(triggers, err) {
+    if (!triggers.length) return err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_MISSING */.qj.TRIGGER_MISSING));
+    const main = triggers.filter((trigger)=>!(0,_flow_types_js__rspack_import_6/* .triggerPath */.um)(trigger));
+    if (main.length > 1) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_MAIN_DUPLICATE */.qj.TRIGGER_MAIN_DUPLICATE, {
+        count: main.length
+    }));
+    const paths = new Set();
+    for (const trigger of triggers){
+        const path = (0,_flow_types_js__rspack_import_6/* .triggerPath */.um)(trigger);
+        if (!path) continue;
+        if (paths.has(path)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_DUPLICATE */.qj.TRIGGER_PATH_DUPLICATE, {
+            path
+        }));
+        paths.add(path);
+    }
+}
 /**
  * What the runtime would always refuse, caught on save: an API-key flow called by a flow running
  * as the caller, a required input left out, a chain that comes back to this flow or nests deeper
  * than the limit. An inactive flow and an input the called flow does not declare are warnings.
- */ function checkCalledFlow(slug, input, inputList, flow, known, at, err, warn) {
+ */ function checkCalledFlow(slug, endpoint, input, inputList, flow, known, at, err, warn) {
     const target = known.get(slug);
     const vars = {
         ...at,
@@ -1881,12 +1898,19 @@ function conditionProblem(node, options) {
         if (flow.authMode === 'internal') warn.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_API_KEY */.qj.NODE_FLOW_API_KEY, vars));
         else if (flow.runAs === 'caller') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_API_KEY */.qj.NODE_FLOW_API_KEY, vars));
     }
-    if (target.bodyType === 'list') {
+    const path = typeof endpoint === 'string' && endpoint ? endpoint : null;
+    const entry = target.endpoints.find((e)=>e.path === path);
+    if (!entry) {
+        err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(path ? _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_ENDPOINT_UNKNOWN */.qj.NODE_FLOW_ENDPOINT_UNKNOWN : _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_ENDPOINT_REQUIRED */.qj.NODE_FLOW_ENDPOINT_REQUIRED, {
+            ...vars,
+            endpoint: path ?? ''
+        }));
+    } else if (entry.bodyType === 'list') {
         if (inputList === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_INPUT_LIST_REQUIRED */.qj.NODE_FLOW_INPUT_LIST_REQUIRED, vars));
     } else if (inputList !== undefined) {
         err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_INPUT_LIST_UNEXPECTED */.qj.NODE_FLOW_INPUT_LIST_UNEXPECTED, vars));
     } else {
-        checkCalledInputs(input, target, vars, err, warn);
+        checkCalledInputs(input, entry.inputSchema, vars, err, warn);
     }
     const loop = callPathTo(slug, flow.slug, known, new Set());
     if (loop) return err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_LOOP */.qj.NODE_FLOW_LOOP, {
@@ -1901,9 +1925,8 @@ function conditionProblem(node, options) {
         max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH
     }));
 }
-/** The named inputs sent to a flow whose body is an object: every required one given, the rest declared. */ function checkCalledInputs(input, target, vars, err, warn) {
+/** The named inputs sent to a flow whose body is an object: every required one given, the rest declared. */ function checkCalledInputs(input, schema, vars, err, warn) {
     const given = input && typeof input === 'object' && !Array.isArray(input) ? Object.keys(input) : [];
-    const schema = target.inputSchema ?? [];
     if (schema.length) {
         const declared = new Set(schema.map((field)=>field.name));
         for (const name of given)if (!declared.has(name)) warn.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_INPUT_UNDECLARED */.qj.NODE_FLOW_INPUT_UNDECLARED, {
@@ -2081,7 +2104,16 @@ function validateNodeConfig(node, flow, context, err, warn) {
     };
     switch(node.type){
         case 'trigger':
-            break;
+            {
+                if (c.path !== undefined && c.path !== '' && (typeof c.path !== 'string' || !_flow_types_js__rspack_import_6/* .FLOW_ENDPOINT_PATH_PATTERN.test */.YO.test(c.path))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_INVALID */.qj.TRIGGER_PATH_INVALID, at));
+                const path = (0,_flow_types_js__rspack_import_6/* .triggerPath */.um)(node);
+                if (!path) break;
+                if (c.bodyType !== undefined && !_flow_types_js__rspack_import_6/* .FLOW_BODY_TYPES.includes */.Y3.includes(c.bodyType)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.BODY_TYPE_UNKNOWN */.qj.BODY_TYPE_UNKNOWN, {
+                    type: String(c.bodyType)
+                }));
+                validateInputFields(Array.isArray(c.inputSchema) ? c.inputSchema : [], `${path}: `, 1, err);
+                break;
+            }
         case 'validate':
             validateChecks(c, at, rule, err);
             if (c.mode !== undefined && c.mode !== 'all' && c.mode !== 'first') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_MODE_INVALID */.qj.NODE_MODE_INVALID, at));
@@ -2216,7 +2248,8 @@ function validateNodeConfig(node, flow, context, err, warn) {
                 ...at,
                 flow: c.flowSlug
             }));
-            else if (context.knownFlows) checkCalledFlow(c.flowSlug, c.input, c.inputList, flow, context.knownFlows, at, err, warn);
+            else if (context.knownFlows) checkCalledFlow(c.flowSlug, c.endpoint, c.input, c.inputList, flow, context.knownFlows, at, err, warn);
+            if (c.endpoint !== undefined && c.endpoint !== '' && (typeof c.endpoint !== 'string' || !_flow_types_js__rspack_import_6/* .FLOW_ENDPOINT_PATH_PATTERN.test */.YO.test(c.endpoint))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_INVALID */.qj.TRIGGER_PATH_INVALID, at));
             exprMap(c.input, KIND.input);
             if (c.inputList !== undefined) expr(c.inputList, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_INPUT_LIST */.bc.THE_INPUT_LIST));
             break;
@@ -2427,8 +2460,11 @@ function validateChecks(c, at, rule, err) {
         }));
     }
 }
-/** Every `context.<node>` must name a node of this flow; `input.<name>` should be a declared input. */ function checkNodeReferences(nodes, byId, flow, err, warnings) {
-    const declaredInputs = new Set((flow.inputSchema ?? []).map((f)=>f.name));
+/** Every `context.<node>` must name a node of this flow; `input.<name>` should be an input some Request step declares. */ function checkNodeReferences(nodes, byId, flow, err, warnings) {
+    const endpoints = (0,_flow_types_js__rspack_import_6/* .flowEndpoints */.Xr)(flow);
+    const declaredInputs = new Set(endpoints.flatMap((endpoint)=>endpoint.inputSchema.map((f)=>f.name)));
+    // A list body is read by index, and an object body without fields takes anything: neither has names to check.
+    const namesKnown = endpoints.length > 0 && endpoints.every((endpoint)=>endpoint.bodyType !== 'list' && endpoint.inputSchema.length > 0);
     for (const node of nodes){
         let refs;
         try {
@@ -2452,7 +2488,7 @@ function validateChecks(c, at, rule, err) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.REF_SELF */.qj.REF_SELF, {
                     node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node)
                 }));
-            } else if (scope === 'input' && second && flow.bodyType !== 'list' && declaredInputs.size > 0 && !declaredInputs.has(second)) {
+            } else if (scope === 'input' && second && namesKnown && !declaredInputs.has(second)) {
                 warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.REF_INPUT_UNDECLARED */.qj.REF_INPUT_UNDECLARED, {
                     node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node),
                     input: second
@@ -2662,8 +2698,7 @@ function reach(start, outgoing) {
         nesting.set(id, max);
         return max;
     };
-    const start = nodes.find((n)=>n.type === 'trigger');
-    if (start && nestingFrom(start.id) > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.LOOP_TOO_DEEP */.qj.LOOP_TOO_DEEP, {
+    if (nodes.some((n)=>n.type === 'trigger' && nestingFrom(n.id) > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.LOOP_TOO_DEEP */.qj.LOOP_TOO_DEEP, {
         max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH
     }));
 }
@@ -3055,6 +3090,33 @@ const FLOW_LIMITS = {
 const FLOW_NODE_ID_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
 const FLOW_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,62}$/;
 const FLOW_INPUT_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,59}$/;
+const FLOW_ENDPOINT_PATH_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+/** A Request step's path, or null when it answers on the flow's own URL. */ function triggerPath(node) {
+    const path = node.config?.path;
+    return typeof path === 'string' && path.trim() ? path.trim() : null;
+}
+/** Every Request step of a flow as a URL. */ function flowEndpoints(flow) {
+    return (flow.nodes ?? []).filter((node)=>node?.type === 'trigger').map((node)=>{
+        const path = triggerPath(node);
+        if (!path) return {
+            nodeId: node.id,
+            path,
+            bodyType: flow.bodyType ?? 'object',
+            inputSchema: flow.inputSchema ?? []
+        };
+        const config = node.config;
+        return {
+            nodeId: node.id,
+            path,
+            bodyType: config.bodyType ?? 'object',
+            inputSchema: Array.isArray(config.inputSchema) ? config.inputSchema : []
+        };
+    });
+}
+/** The URL a call came in on: `path` of a Request step, or null / empty for the flow's own URL. */ function findEndpoint(flow, path) {
+    const wanted = path?.trim() || null;
+    return flowEndpoints(flow).find((endpoint)=>endpoint.path === wanted);
+}
 /** Output ports a node of this type can have (a `respond` node ends the flow: none). */ function portsOf(node) {
     switch(node.type){
         case 'condition':
@@ -3097,7 +3159,10 @@ const FLOW_INPUT_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,59}$/;
 }
 
 __webpack_require__.d(__webpack_exports__, {
-  a5: () => (portsOf)
+  Xr: () => (flowEndpoints),
+  a5: () => (portsOf),
+  um: () => (triggerPath),
+  vS: () => (findEndpoint)
 }, {
   At: NON_CONTINUABLE_NODE_TYPES,
   Dn: RECORD_WRITE_TARGETS,
@@ -3105,6 +3170,7 @@ __webpack_require__.d(__webpack_exports__, {
   Q7: FLOW_INPUT_TYPES,
   Y3: FLOW_BODY_TYPES,
   YD: FLOW_SLUG_PATTERN,
+  YO: FLOW_ENDPOINT_PATH_PATTERN,
   dA: nodeLabel,
   fO: FLOW_AUTH_MODES,
   fZ: FLOW_INPUT_NAME_PATTERN,
@@ -4100,8 +4166,7 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
                     {
                         isActive: flow.isActive,
                         authMode: flow.authMode,
-                        bodyType: flow.bodyType,
-                        inputSchema: flow.inputSchema ?? [],
+                        endpoints: (0,_flow_engine_flow_types_js__rspack_import_8/* .flowEndpoints */.Xr)(flow),
                         calls: calledSlugs(flow.nodes)
                     }
                 ]))
@@ -4129,6 +4194,31 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
             }
         });
     }
+    /** A URL other flows' Call flow steps start at cannot be removed or renamed from under them. */ async assertEndpointsNotCalled(before, after) {
+        const kept = new Set((0,_flow_engine_flow_types_js__rspack_import_8/* .flowEndpoints */.Xr)(after).map((e)=>e.path));
+        const removed = (0,_flow_engine_flow_types_js__rspack_import_8/* .flowEndpoints */.Xr)(before).map((e)=>e.path).filter((path)=>!kept.has(path));
+        if (!removed.length) return;
+        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).find({
+            select: {
+                id: true,
+                name: true,
+                nodes: true
+            }
+        });
+        for (const path of removed){
+            const callers = flows.filter((flow)=>flow.id !== before.id && calledTargets(flow.nodes).some((t)=>t.slug === before.slug && t.endpoint === path)).map((flow)=>flow.name);
+            if (!callers.length) continue;
+            const url = `api-flows/${before.slug}${path ? `/${path}` : ''}`;
+            throw new _nestjs_common__rspack_import_3.ConflictException({
+                message: `The URL ${url} is called by: ${callers.join(', ')}. Change those flows first.`,
+                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.ENDPOINT_CALLED_BY_OTHER_FLOWS */.wu.ENDPOINT_CALLED_BY_OTHER_FLOWS,
+                messageVariables: {
+                    url,
+                    flows: callers.join(', ')
+                }
+            });
+        }
+    }
     async assertSaveable(settings, user, selfId) {
         const { errors, warnings } = await this.validate(settings);
         if (errors.length) {
@@ -4204,6 +4294,7 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
             if (merged.slug !== existing.slug) await this.assertNotCalled(existing.slug, [
                 existing.id
             ]);
+            else await this.assertEndpointsNotCalled(existing, merged);
             d.version = existing.version + 1;
         }
     }
@@ -4256,8 +4347,17 @@ FlowDefinitionService = _ts_decorate([
         typeof IPermissionActionRegistry === "undefined" ? Object : IPermissionActionRegistry
     ])
 ], FlowDefinitionService);
+/** What the `call_flow` nodes of a flow run: a slug, and the path of the Request step they start at (null: the flow's own URL). */ function calledTargets(nodes) {
+    return (nodes ?? []).filter((node)=>node?.type === 'call_flow' && typeof node.config?.flowSlug === 'string').map((node)=>{
+        const config = node.config;
+        return {
+            slug: config.flowSlug,
+            endpoint: typeof config.endpoint === 'string' && config.endpoint ? config.endpoint : null
+        };
+    });
+}
 /** Slugs the `call_flow` nodes of a flow run. */ function calledSlugs(nodes) {
-    return (nodes ?? []).filter((node)=>node?.type === 'call_flow').map((node)=>node.config?.flowSlug).filter((slug)=>typeof slug === 'string');
+    return calledTargets(nodes).map((target)=>target.slug);
 }
 function stripUndefined(value) {
     return Object.fromEntries(Object.entries(value).filter(([, v])=>v !== undefined));
@@ -4775,6 +4875,7 @@ class FlowExecutorService {
             timeoutMs: flowTimeout(definition.timeoutMs)
         };
         const state = {
+            startAt: options.startAt,
             input: options.input,
             vars: {},
             context: {},
@@ -4898,10 +4999,10 @@ class FlowExecutorService {
     }
     /**
    * `call_flow`: runs another active flow as part of this run - same caller,
-   * transaction, test mode and step/HTTP/time budget. Returns what it answered: its `respond`
+   * transaction, test mode and step/HTTP/time budget, from the Request step at `endpoint` (left out, its own URL). Returns what it answered: its `respond`
    * body, or the output of its last step. A 4xx/5xx answer or a rejection is passed on as the
    * caller's own; any other failure fails the calling node.
-   */ async callFlow(slug, input, parent, env) {
+   */ async callFlow(slug, input, parent, env, endpoint) {
         if (parent.callStack.includes(slug)) {
             throw new flow_errors/* .FlowLimitError */.IM(message_keys/* .FLOW_ERROR_MESSAGES.CALLED_FLOW_RECURSION */.zr.CALLED_FLOW_RECURSION, {
                 flow: slug,
@@ -4916,7 +5017,15 @@ class FlowExecutorService {
         });
         const flow = await this.findCallable(slug, parent.qr);
         await this.assertMayCall(flow, parent, env);
-        const checked = (0,flow_input_validator/* .validateFlowInput */.v)(flow.inputSchema ?? [], input, flow.bodyType);
+        const settings = (0,flow_definition_service/* .toFlowSettings */.RK)(flow);
+        const start = (0,flow_types/* .findEndpoint */.vS)(settings, endpoint);
+        if (!start) {
+            throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.CALLED_FLOW_ENDPOINT_NOT_FOUND */.zr.CALLED_FLOW_ENDPOINT_NOT_FOUND, {
+                flow: slug,
+                endpoint: endpoint ?? ''
+            }, `Flow '${slug}' has no URL '${endpoint ?? ''}'.`);
+        }
+        const checked = (0,flow_input_validator/* .validateFlowInput */.v)(start.inputSchema, input, start.bodyType);
         if (checked.errors.length) {
             throw new flow_errors/* .FlowHttpError */.hk(400, 'Validation failed', checked.errors, {
                 messageKey: message_keys/* .FLOW_MESSAGES.INPUT_INVALID */.wu.INPUT_INVALID,
@@ -4925,8 +5034,8 @@ class FlowExecutorService {
                 }
             });
         }
-        const settings = (0,flow_definition_service/* .toFlowSettings */.RK)(flow);
         const child = {
+            startAt: start.nodeId,
             input: checked.values,
             vars: {},
             context: {},
@@ -5022,7 +5131,7 @@ class FlowExecutorService {
                 }
                 return entityServices.get(entityCode);
             },
-            callFlow: (slug, input, state)=>this.callFlow(slug, input, state, env),
+            callFlow: (slug, input, state, endpoint)=>this.callFlow(slug, input, state, env, endpoint),
             atomic: (state, work)=>this.atomic(state, work),
             commit: (state)=>this.commitProgress(state),
             http: flowHttpRequest,
@@ -5122,13 +5231,14 @@ FlowExecutorService = _ts_decorate([
 2300(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
 /* import */ var typeorm__rspack_import_1 = __webpack_require__(7158);
-/* import */ var _config_message_keys_js__rspack_import_8 = __webpack_require__(5732);
+/* import */ var _config_message_keys_js__rspack_import_9 = __webpack_require__(5732);
 /* import */ var _entities_flow_definition_entity_js__rspack_import_2 = __webpack_require__(3770);
 /* import */ var _flow_engine_flow_input_validator_js__rspack_import_3 = __webpack_require__(6390);
-/* import */ var _entity_builder_datasource_provider_js__rspack_import_4 = __webpack_require__(424);
-/* import */ var _flow_definition_service_js__rspack_import_5 = __webpack_require__(5229);
-/* import */ var _flow_execution_service_js__rspack_import_6 = __webpack_require__(7810);
-/* import */ var _flow_executor_service_js__rspack_import_7 = __webpack_require__(4698);
+/* import */ var _flow_engine_flow_types_js__rspack_import_4 = __webpack_require__(6256);
+/* import */ var _entity_builder_datasource_provider_js__rspack_import_5 = __webpack_require__(424);
+/* import */ var _flow_definition_service_js__rspack_import_6 = __webpack_require__(5229);
+/* import */ var _flow_execution_service_js__rspack_import_7 = __webpack_require__(7810);
+/* import */ var _flow_executor_service_js__rspack_import_8 = __webpack_require__(4698);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -5161,6 +5271,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 const HIDDEN_HEADERS = new Set([
     'authorization',
     'cookie',
@@ -5219,7 +5330,7 @@ const inputRejected = (errors)=>({
         body: {
             success: false,
             message: 'Validation failed',
-            messageKey: _config_message_keys_js__rspack_import_8/* .FLOW_MESSAGES.INPUT_INVALID */.wu.INPUT_INVALID,
+            messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.INPUT_INVALID */.wu.INPUT_INVALID,
             errors
         },
         trace: [],
@@ -5246,19 +5357,20 @@ class FlowRuntimeService {
             }
         });
     }
-    /** The public entry: a caller hit `POST api-flows/:slug`. */ async handle(flow, body, caller, user) {
+    /** The public entry: a caller hit `POST api-flows/:slug` or `POST api-flows/:slug/:endpoint`. */ async handle(flow, endpoint, body, caller, user) {
         const startedAt = new Date();
-        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(flow.inputSchema ?? [], body, flow.bodyType);
+        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(endpoint.inputSchema, body, endpoint.bodyType);
         if (checked.errors.length) {
             const result = inputRejected(checked.errors);
             await this.logWebhook(flow, body, result, startedAt, user, caller);
             return result;
         }
         // A saved flow: saving it as `runAs: system` needed the system permission.
-        const result = await this.executor.run((0,_flow_definition_service_js__rspack_import_5/* .toFlowSettings */.RK)(flow), {
+        const result = await this.executor.run((0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(flow), {
             mode: 'live',
             user,
             input: checked.values,
+            startAt: endpoint.nodeId,
             request: requestInfo(caller),
             exposeDetails: false,
             systemAuthorized: true
@@ -5275,15 +5387,15 @@ class FlowRuntimeService {
         }
         if (dto.definition) {
             // The designer's current draft, even for a saved flow: `flow` above is kept only to attribute the run.
-            settings = (0,_flow_definition_service_js__rspack_import_5/* .toFlowSettings */.RK)(dto.definition);
+            settings = (0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(dto.definition);
             permissionCode = dto.definition.permissionCode;
         } else if (flow) {
-            settings = (0,_flow_definition_service_js__rspack_import_5/* .toFlowSettings */.RK)(flow);
+            settings = (0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(flow);
             permissionCode = flow.permissionCode;
         } else {
             throw new _nestjs_common__rspack_import_0.BadRequestException({
                 message: 'Send a flowId or a definition to test.',
-                messageKey: _config_message_keys_js__rspack_import_8/* .FLOW_MESSAGES.NOTHING_TO_TEST */.wu.NOTHING_TO_TEST
+                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.NOTHING_TO_TEST */.wu.NOTHING_TO_TEST
             });
         }
         const mode = dto.mode ?? 'dry_run';
@@ -5300,21 +5412,32 @@ class FlowRuntimeService {
         if (validation.errors.length) {
             throw new _nestjs_common__rspack_import_0.BadRequestException({
                 message: 'The flow has problems.',
-                messageKey: _config_message_keys_js__rspack_import_8/* .FLOW_MESSAGES.INVALID */.wu.INVALID,
+                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.INVALID */.wu.INVALID,
                 errors: validation.errors.map((error)=>({
                         field: 'flow',
                         ...error
                     }))
             });
         }
+        const endpoint = (0,_flow_engine_flow_types_js__rspack_import_4/* .findEndpoint */.vS)(settings, dto.endpoint);
+        if (!endpoint) {
+            throw new _nestjs_common__rspack_import_0.BadRequestException({
+                message: `This flow has no URL '${dto.endpoint ?? ''}'.`,
+                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.ENDPOINT_NOT_FOUND */.wu.ENDPOINT_NOT_FOUND,
+                messageVariables: {
+                    endpoint: dto.endpoint ?? ''
+                }
+            });
+        }
         const startedAt = new Date();
         const simulated = simulatedCaller(caller, dto.request);
-        const body = dto.input ?? (settings.bodyType === 'list' ? [] : {});
-        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(settings.inputSchema, body, settings.bodyType);
+        const body = dto.input ?? (endpoint.bodyType === 'list' ? [] : {});
+        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(endpoint.inputSchema, body, endpoint.bodyType);
         const result = checked.errors.length ? inputRejected(checked.errors) : await this.executor.run(settings, {
             mode,
             user,
             input: checked.values,
+            startAt: endpoint.nodeId,
             request: requestInfo(simulated),
             exposeDetails: true,
             systemAuthorized: true
@@ -5355,16 +5478,16 @@ FlowRuntimeService = _ts_decorate([
     (0,_nestjs_common__rspack_import_0.Injectable)({
         scope: _nestjs_common__rspack_import_0.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_entity_builder_datasource_provider_js__rspack_import_4/* .EntityBuilderDataSourceProvider */.D)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_flow_executor_service_js__rspack_import_7/* .FlowExecutorService */.F)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_0.Inject)(_flow_execution_service_js__rspack_import_6/* .FlowExecutionService */.A)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_0.Inject)(_flow_definition_service_js__rspack_import_5/* .FlowDefinitionService */.Tk)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_entity_builder_datasource_provider_js__rspack_import_5/* .EntityBuilderDataSourceProvider */.D)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_flow_executor_service_js__rspack_import_8/* .FlowExecutorService */.F)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_0.Inject)(_flow_execution_service_js__rspack_import_7/* .FlowExecutionService */.A)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_0.Inject)(_flow_definition_service_js__rspack_import_6/* .FlowDefinitionService */.Tk)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _entity_builder_datasource_provider_js__rspack_import_4/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_4/* .EntityBuilderDataSourceProvider */.D,
-        typeof _flow_executor_service_js__rspack_import_7/* .FlowExecutorService */.F === "undefined" ? Object : _flow_executor_service_js__rspack_import_7/* .FlowExecutorService */.F,
-        typeof _flow_execution_service_js__rspack_import_6/* .FlowExecutionService */.A === "undefined" ? Object : _flow_execution_service_js__rspack_import_6/* .FlowExecutionService */.A,
-        typeof _flow_definition_service_js__rspack_import_5/* .FlowDefinitionService */.Tk === "undefined" ? Object : _flow_definition_service_js__rspack_import_5/* .FlowDefinitionService */.Tk
+        typeof _entity_builder_datasource_provider_js__rspack_import_5/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_5/* .EntityBuilderDataSourceProvider */.D,
+        typeof _flow_executor_service_js__rspack_import_8/* .FlowExecutorService */.F === "undefined" ? Object : _flow_executor_service_js__rspack_import_8/* .FlowExecutorService */.F,
+        typeof _flow_execution_service_js__rspack_import_7/* .FlowExecutionService */.A === "undefined" ? Object : _flow_execution_service_js__rspack_import_7/* .FlowExecutionService */.A,
+        typeof _flow_definition_service_js__rspack_import_6/* .FlowDefinitionService */.Tk === "undefined" ? Object : _flow_definition_service_js__rspack_import_6/* .FlowDefinitionService */.Tk
     ])
 ], FlowRuntimeService);
 

package/fesm/guards/index.js

@@ -71,6 +71,8 @@ const DEFAULT_MAX_KEYS = 10_000;
     }
 }
 
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow.types.ts
+var flow_types = __webpack_require__(6256);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/guards/flow-access.guard.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -106,6 +108,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 const limiter = new FlowRateLimiter();
 class FlowAccessGuard {
     moduleRef;
@@ -123,11 +126,13 @@ class FlowAccessGuard {
             strict: false
         });
         const flow = slug ? await runtime.findActive(slug) : null;
-        if (!flow) throw new common_.NotFoundException({
+        const endpoint = flow ? (0,flow_types/* .findEndpoint */.vS)(flow, request.params?.endpoint) : undefined;
+        if (!flow || !endpoint) throw new common_.NotFoundException({
             message: 'Not found',
             messageKey: message_keys/* .FLOW_MESSAGES.NOT_FOUND */.wu.NOT_FOUND
         });
         request.flowDefinition = flow;
+        request.flowEndpoint = endpoint;
         const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';
         if (!limiter.hit(`${flow.id}|${ip}`, flow.rateLimitPerMinute)) {
             throw new common_.HttpException({