@flusys/nestjs-entity-builder 9.1.0 → 9.1.1

package/fesm/{606.js → 946.js}

@@ -1,16 +1,17 @@
 import { lastValueFrom } from "rxjs";
 import * as __rspack_external__flusys_nestjs_shared_guards_3f79ddd1 from "@flusys/nestjs-shared/guards";
 import * as __rspack_external__flusys_nestjs_shared_decorators_c129b601 from "@flusys/nestjs-shared/decorators";
-export const __rspack_esm_id = 606;
-export const __rspack_esm_ids = [606];
+import * as __rspack_external__nestjs_platform_express_cb7ac6b9 from "@nestjs/platform-express";
+export const __rspack_esm_id = 946;
+export const __rspack_esm_ids = [946];
 export const __webpack_modules__ = {
-2517(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+729(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
+  AP: () => (/* reexport */ DefinitionBundleController),
   hv: () => (/* reexport */ EntityDefinitionController),
   GX: () => (/* reexport */ FieldDefinitionController),
-  Sv: () => (/* reexport */ FlowApiKeyController),
   W8: () => (/* reexport */ FlowDefinitionController),
   VU: () => (/* reexport */ FlowExecutionController),
   bw: () => (/* reexport */ FlowRuntimeController)
@@ -30,6 +31,8 @@ var guards_ = __webpack_require__(3513);
 var modules_ = __webpack_require__(1236);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/config/message-keys.ts
 var message_keys = __webpack_require__(5732);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/guards/designer-writable.interceptor.ts
+var designer_writable_interceptor = __webpack_require__(417);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/dtos/entity-definition.dto.ts
 var entity_definition_dto = __webpack_require__(680);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/dtos/schema-change.dto.ts
@@ -76,6 +79,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class EntityDefinitionController extends (0,nestjs_shared_.createApiController)(entity_definition_dto/* .CreateDynamicEntityDto */.Ot, entity_definition_dto/* .UpdateEntityDefinitionDto */.hL, entity_definition_dto/* .EntityDefinitionResponseDto */.d_, {
     entityName: 'entity_builder.entity_definition',
     enabledEndpoints: [
@@ -316,6 +320,8 @@ _ts_decorate([
 EntityDefinitionController = _ts_decorate([
     (0,swagger_.ApiTags)('Entity Builder - Entity Definitions'),
     (0,common_.Controller)('entity-builder/entity-definitions'),
+    (0,common_.UseInterceptors)(designer_writable_interceptor/* .DesignerWritableInterceptor */.X),
+    (0,designer_writable_interceptor/* .DesignerWrites */.W)('createEntity', 'applyChange', 'applyDestructiveChange'),
     _ts_param(0, (0,common_.Inject)(entity_definition_service/* .EntityDefinitionService */.o)),
     _ts_param(1, (0,common_.Inject)(schema_sync_service/* .SchemaSyncService */.W)),
     _ts_param(2, (0,common_.Inject)(schema_evolution_service/* .SchemaEvolutionService */._)),
@@ -449,15 +455,7 @@ class CreateFlowDefinitionDto {
     slug;
     description;
     isActive;
-    authMode;
-    permissionCode;
-    runAs;
-    isTransactional;
-    timeoutMs;
-    rateLimitPerMinute;
     retainExecutions;
-    bodyType;
-    inputSchema;
     nodes;
     edges;
 }
@@ -496,62 +494,6 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsOptional)(),
     flow_dto_ts_metadata("design:type", Boolean)
 ], CreateFlowDefinitionDto.prototype, "isActive", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        enum: flow_types/* .FLOW_AUTH_MODES */.fO,
-        default: 'jwt'
-    }),
-    (0,external_class_validator_.IsEnum)(flow_types/* .FLOW_AUTH_MODES */.fO),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", typeof FlowAuthMode === "undefined" ? Object : FlowAuthMode)
-], CreateFlowDefinitionDto.prototype, "authMode", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        description: "authMode 'permission': defaults to entity_builder.flow.<slug>.execute"
-    }),
-    (0,external_class_validator_.IsString)(),
-    (0,external_class_validator_.IsOptional)(),
-    (0,external_class_validator_.MaxLength)(255),
-    flow_dto_ts_metadata("design:type", String)
-], CreateFlowDefinitionDto.prototype, "permissionCode", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        enum: flow_types/* .FLOW_RUN_AS */.gl,
-        default: 'caller'
-    }),
-    (0,external_class_validator_.IsEnum)(flow_types/* .FLOW_RUN_AS */.gl),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", typeof FlowRunAs === "undefined" ? Object : FlowRunAs)
-], CreateFlowDefinitionDto.prototype, "runAs", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        default: false
-    }),
-    (0,external_class_validator_.IsBoolean)(),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", Boolean)
-], CreateFlowDefinitionDto.prototype, "isTransactional", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        default: flow_types/* .FLOW_LIMITS.DEFAULT_TIMEOUT_MS */.Or.DEFAULT_TIMEOUT_MS
-    }),
-    (0,external_class_validator_.IsInt)(),
-    (0,external_class_validator_.Min)(flow_types/* .FLOW_LIMITS.MIN_TIMEOUT_MS */.Or.MIN_TIMEOUT_MS),
-    (0,external_class_validator_.Max)(flow_types/* .FLOW_LIMITS.MAX_TIMEOUT_MS */.Or.MAX_TIMEOUT_MS),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", Number)
-], CreateFlowDefinitionDto.prototype, "timeoutMs", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        description: 'Per caller IP per minute; 0 = unlimited',
-        default: 60
-    }),
-    (0,external_class_validator_.IsInt)(),
-    (0,external_class_validator_.Min)(0),
-    (0,external_class_validator_.Max)(100000),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", Number)
-], CreateFlowDefinitionDto.prototype, "rateLimitPerMinute", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiPropertyOptional)({
         default: 200
@@ -562,31 +504,12 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsOptional)(),
     flow_dto_ts_metadata("design:type", Number)
 ], CreateFlowDefinitionDto.prototype, "retainExecutions", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        enum: flow_types/* .FLOW_BODY_TYPES */.Y3,
-        default: 'object',
-        description: 'object: the body is one object; list: the body is a list and inputSchema describes each item'
-    }),
-    (0,external_class_validator_.IsIn)(flow_types/* .FLOW_BODY_TYPES */.Y3),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", typeof FlowBodyType === "undefined" ? Object : FlowBodyType)
-], CreateFlowDefinitionDto.prototype, "bodyType", void 0);
-flow_dto_ts_decorate([
-    (0,swagger_.ApiPropertyOptional)({
-        type: [
-            Object
-        ]
-    }),
-    (0,external_class_validator_.IsArray)(),
-    (0,external_class_validator_.IsOptional)(),
-    flow_dto_ts_metadata("design:type", Array)
-], CreateFlowDefinitionDto.prototype, "inputSchema", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiProperty)({
         type: [
             Object
-        ]
+        ],
+        description: 'Steps; each Request step (trigger) carries its own path, body (bodyType, inputSchema), access (authMode: signed-in by default, permissions: an AND / OR rule of permission codes), isTransactional, timeoutMs and rateLimitPerMinute'
     }),
     (0,external_class_validator_.IsArray)(),
     flow_dto_ts_metadata("design:type", Array)
@@ -611,7 +534,7 @@ flow_dto_ts_decorate([
 ], UpdateFlowDefinitionDto.prototype, "id", void 0);
 /**
  * A flow as the designer holds it, for a test run or a check: every setting is validated like a
- * saved flow's (run-as, auth mode, time-out and limits are bounded, the graph by `validateFlow`),
+ * saved flow's (the graph, with each Request step's access and limits, by `validateFlow`),
  * the name may still be empty, and the server-owned fields of a loaded flow are ignored.
  */ class FlowDraftDto extends (0,swagger_.OmitType)(CreateFlowDefinitionDto, [
     'name'
@@ -619,6 +542,7 @@ flow_dto_ts_decorate([
     name;
     id;
     version;
+    draft;
     createdAt;
     updatedAt;
     deletedAt;
@@ -643,6 +567,10 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.Allow)(),
     flow_dto_ts_metadata("design:type", Object)
 ], FlowDraftDto.prototype, "version", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_validator_.Allow)(),
+    flow_dto_ts_metadata("design:type", Object)
+], FlowDraftDto.prototype, "draft", void 0);
 flow_dto_ts_decorate([
     (0,external_class_validator_.Allow)(),
     flow_dto_ts_metadata("design:type", Object)
@@ -785,27 +713,37 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsNotEmpty)(),
     flow_dto_ts_metadata("design:type", String)
 ], FlowIdDto.prototype, "flowId", void 0);
-class CreateFlowApiKeyDto extends FlowIdDto {
-    name;
-    expiresAt;
+class PublishFlowDto {
+    id;
+    note;
 }
 flow_dto_ts_decorate([
-    (0,swagger_.ApiProperty)({
-        example: 'Shop backend'
-    }),
-    (0,external_class_validator_.IsString)(),
+    (0,swagger_.ApiProperty)(),
+    (0,external_class_validator_.IsUUID)(),
     (0,external_class_validator_.IsNotEmpty)(),
-    (0,external_class_validator_.MaxLength)(100),
     flow_dto_ts_metadata("design:type", String)
-], CreateFlowApiKeyDto.prototype, "name", void 0);
+], PublishFlowDto.prototype, "id", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiPropertyOptional)({
-        description: 'ISO date-time after which the key stops working'
+        description: 'What changed in this version',
+        example: 'Checks the branch before saving'
     }),
-    (0,external_class_validator_.IsISO8601)(),
+    (0,external_class_validator_.IsString)(),
     (0,external_class_validator_.IsOptional)(),
+    (0,external_class_validator_.MaxLength)(500),
     flow_dto_ts_metadata("design:type", String)
-], CreateFlowApiKeyDto.prototype, "expiresAt", void 0);
+], PublishFlowDto.prototype, "note", void 0);
+class FlowVersionRefDto extends FlowIdDto {
+    version;
+}
+flow_dto_ts_decorate([
+    (0,swagger_.ApiProperty)({
+        example: 3
+    }),
+    (0,external_class_validator_.IsInt)(),
+    (0,external_class_validator_.Min)(1),
+    flow_dto_ts_metadata("design:type", Number)
+], FlowVersionRefDto.prototype, "version", void 0);
 /** The id of a flow API key or a flow execution. */ class IdBodyDto {
     id;
 }
@@ -818,6 +756,8 @@ flow_dto_ts_decorate([
 class ListFlowExecutionsDto {
     flowId;
     status;
+    trigger;
+    endpointNodeId;
     page;
     pageSize;
 }
@@ -843,6 +783,28 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.IsOptional)(),
     flow_dto_ts_metadata("design:type", String)
 ], ListFlowExecutionsDto.prototype, "status", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        enum: [
+            'webhook',
+            'test'
+        ]
+    }),
+    (0,external_class_validator_.IsIn)([
+        'webhook',
+        'test'
+    ]),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", String)
+], ListFlowExecutionsDto.prototype, "trigger", void 0);
+flow_dto_ts_decorate([
+    (0,swagger_.ApiPropertyOptional)({
+        description: 'Only runs that came in through this Request step'
+    }),
+    (0,external_class_validator_.Matches)(flow_types/* .FLOW_NODE_ID_PATTERN */.z6),
+    (0,external_class_validator_.IsOptional)(),
+    flow_dto_ts_metadata("design:type", String)
+], ListFlowExecutionsDto.prototype, "endpointNodeId", void 0);
 flow_dto_ts_decorate([
     (0,swagger_.ApiPropertyOptional)({
         default: 0
@@ -867,18 +829,11 @@ class FlowDefinitionResponseDto extends dtos_.IdentityResponseDto {
     slug;
     description;
     isActive;
-    authMode;
-    permissionCode;
-    runAs;
-    isTransactional;
-    timeoutMs;
-    rateLimitPerMinute;
     retainExecutions;
-    bodyType;
-    inputSchema;
     nodes;
     edges;
     version;
+    draft;
 }
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
@@ -900,53 +855,11 @@ flow_dto_ts_decorate([
     (0,swagger_.ApiProperty)(),
     flow_dto_ts_metadata("design:type", Boolean)
 ], FlowDefinitionResponseDto.prototype, "isActive", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", typeof FlowAuthMode === "undefined" ? Object : FlowAuthMode)
-], FlowDefinitionResponseDto.prototype, "authMode", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", Object)
-], FlowDefinitionResponseDto.prototype, "permissionCode", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", typeof FlowRunAs === "undefined" ? Object : FlowRunAs)
-], FlowDefinitionResponseDto.prototype, "runAs", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", Boolean)
-], FlowDefinitionResponseDto.prototype, "isTransactional", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", Number)
-], FlowDefinitionResponseDto.prototype, "timeoutMs", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", Number)
-], FlowDefinitionResponseDto.prototype, "rateLimitPerMinute", void 0);
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
     (0,swagger_.ApiProperty)(),
     flow_dto_ts_metadata("design:type", Number)
 ], FlowDefinitionResponseDto.prototype, "retainExecutions", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)({
-        enum: flow_types/* .FLOW_BODY_TYPES */.Y3
-    }),
-    flow_dto_ts_metadata("design:type", typeof FlowBodyType === "undefined" ? Object : FlowBodyType)
-], FlowDefinitionResponseDto.prototype, "bodyType", void 0);
-flow_dto_ts_decorate([
-    (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
-    flow_dto_ts_metadata("design:type", Array)
-], FlowDefinitionResponseDto.prototype, "inputSchema", void 0);
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
     (0,swagger_.ApiProperty)(),
@@ -959,9 +872,19 @@ flow_dto_ts_decorate([
 ], FlowDefinitionResponseDto.prototype, "edges", void 0);
 flow_dto_ts_decorate([
     (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
+    (0,swagger_.ApiProperty)({
+        description: 'The published version; 0 until the flow is first published'
+    }),
     flow_dto_ts_metadata("design:type", Number)
 ], FlowDefinitionResponseDto.prototype, "version", void 0);
+flow_dto_ts_decorate([
+    (0,external_class_transformer_.Expose)(),
+    (0,swagger_.ApiProperty)({
+        description: 'Saved changes not yet published',
+        nullable: true
+    }),
+    flow_dto_ts_metadata("design:type", Object)
+], FlowDefinitionResponseDto.prototype, "draft", void 0);
 
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts
 var flow_definition_service = __webpack_require__(5229);
@@ -1000,6 +923,7 @@ function flow_definition_controller_ts_param(paramIndex, decorator) {
 
 
 
+
 const P = nestjs_shared_.FLOW_DEFINITION_PERMISSIONS;
 class FlowDefinitionController extends (0,nestjs_shared_.createApiController)(CreateFlowDefinitionDto, UpdateFlowDefinitionDto, FlowDefinitionResponseDto, {
     entityName: 'entity_builder.flow_definition',
@@ -1071,6 +995,55 @@ class FlowDefinitionController extends (0,nestjs_shared_.createApiController)(Cr
             data: result
         };
     }
+    async publish(dto, user) {
+        const flow = await this.flowDefinitionService.publish(dto.id, dto.note, user);
+        return {
+            success: true,
+            message: `Version ${flow.version} published`,
+            messageKey: message_keys/* .FLOW_MESSAGES.PUBLISH_SUCCESS */.wu.PUBLISH_SUCCESS,
+            messageVariables: {
+                version: flow.version
+            },
+            data: flow
+        };
+    }
+    async versions(dto) {
+        return {
+            success: true,
+            message: 'Versions loaded',
+            messageKey: message_keys/* .FLOW_MESSAGES.VERSIONS_SUCCESS */.wu.VERSIONS_SUCCESS,
+            data: await this.flowDefinitionService.listVersions(dto.flowId)
+        };
+    }
+    async version(dto) {
+        return {
+            success: true,
+            message: 'Version loaded',
+            messageKey: message_keys/* .FLOW_MESSAGES.VERSION_SUCCESS */.wu.VERSION_SUCCESS,
+            data: await this.flowDefinitionService.getVersion(dto.flowId, dto.version)
+        };
+    }
+    async restoreVersion(dto, user) {
+        const flow = await this.flowDefinitionService.restoreVersion(dto.flowId, dto.version, user);
+        return {
+            success: true,
+            message: `Version ${dto.version} restored to the draft`,
+            messageKey: message_keys/* .FLOW_MESSAGES.VERSION_RESTORED */.wu.VERSION_RESTORED,
+            messageVariables: {
+                version: dto.version
+            },
+            data: flow
+        };
+    }
+    async discardDraft(dto, user) {
+        const flow = await this.flowDefinitionService.discardDraft(dto.flowId, user);
+        return {
+            success: true,
+            message: 'Unpublished changes discarded',
+            messageKey: message_keys/* .FLOW_MESSAGES.DRAFT_DISCARDED */.wu.DRAFT_DISCARDED,
+            data: flow
+        };
+    }
     async testRun(dto, user, req) {
         const { result, warnings } = await this.runtime.testRun(dto, user, {
             ip: req.ip ?? null,
@@ -1106,6 +1079,109 @@ flow_definition_controller_ts_decorate([
     ]),
     flow_definition_controller_ts_metadata("design:returntype", Promise)
 ], FlowDefinitionController.prototype, "validate", null);
+flow_definition_controller_ts_decorate([
+    (0,common_.Post)('publish'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.UPDATE),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Make the saved changes live as the next version',
+        description: 'Checked like a save, plus that no other flow calls a URL name or path this version drops.'
+    }),
+    (0,swagger_.ApiBody)({
+        type: PublishFlowDto
+    }),
+    flow_definition_controller_ts_param(0, (0,common_.Body)()),
+    flow_definition_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
+    flow_definition_controller_ts_metadata("design:type", Function),
+    flow_definition_controller_ts_metadata("design:paramtypes", [
+        typeof PublishFlowDto === "undefined" ? Object : PublishFlowDto,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    flow_definition_controller_ts_metadata("design:returntype", Promise)
+], FlowDefinitionController.prototype, "publish", null);
+flow_definition_controller_ts_decorate([
+    (0,common_.Post)('versions'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.READ),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Published versions of a flow, newest first'
+    }),
+    (0,swagger_.ApiBody)({
+        type: FlowIdDto
+    }),
+    flow_definition_controller_ts_param(0, (0,common_.Body)()),
+    flow_definition_controller_ts_metadata("design:type", Function),
+    flow_definition_controller_ts_metadata("design:paramtypes", [
+        typeof FlowIdDto === "undefined" ? Object : FlowIdDto
+    ]),
+    flow_definition_controller_ts_metadata("design:returntype", Promise)
+], FlowDefinitionController.prototype, "versions", null);
+flow_definition_controller_ts_decorate([
+    (0,common_.Post)('version'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.READ),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'One published version in full'
+    }),
+    (0,swagger_.ApiBody)({
+        type: FlowVersionRefDto
+    }),
+    flow_definition_controller_ts_param(0, (0,common_.Body)()),
+    flow_definition_controller_ts_metadata("design:type", Function),
+    flow_definition_controller_ts_metadata("design:paramtypes", [
+        typeof FlowVersionRefDto === "undefined" ? Object : FlowVersionRefDto
+    ]),
+    flow_definition_controller_ts_metadata("design:returntype", Promise)
+], FlowDefinitionController.prototype, "version", null);
+flow_definition_controller_ts_decorate([
+    (0,common_.Post)('restore-version'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.UPDATE),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Put an old version back into the draft',
+        description: 'Callers keep running the published flow until the draft is published.'
+    }),
+    (0,swagger_.ApiBody)({
+        type: FlowVersionRefDto
+    }),
+    flow_definition_controller_ts_param(0, (0,common_.Body)()),
+    flow_definition_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
+    flow_definition_controller_ts_metadata("design:type", Function),
+    flow_definition_controller_ts_metadata("design:paramtypes", [
+        typeof FlowVersionRefDto === "undefined" ? Object : FlowVersionRefDto,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    flow_definition_controller_ts_metadata("design:returntype", Promise)
+], FlowDefinitionController.prototype, "restoreVersion", null);
+flow_definition_controller_ts_decorate([
+    (0,common_.Post)('discard-draft'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.UPDATE),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Drop the unpublished changes: the flow goes back to what is published'
+    }),
+    (0,swagger_.ApiBody)({
+        type: FlowIdDto
+    }),
+    flow_definition_controller_ts_param(0, (0,common_.Body)()),
+    flow_definition_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
+    flow_definition_controller_ts_metadata("design:type", Function),
+    flow_definition_controller_ts_metadata("design:paramtypes", [
+        typeof FlowIdDto === "undefined" ? Object : FlowIdDto,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    flow_definition_controller_ts_metadata("design:returntype", Promise)
+], FlowDefinitionController.prototype, "discardDraft", null);
 flow_definition_controller_ts_decorate([
     (0,common_.Post)('test-run'),
     (0,common_.HttpCode)(common_.HttpStatus.OK),
@@ -1133,6 +1209,8 @@ flow_definition_controller_ts_decorate([
 FlowDefinitionController = flow_definition_controller_ts_decorate([
     (0,swagger_.ApiTags)('Entity Builder - Flows'),
     (0,common_.Controller)('entity-builder/flows'),
+    (0,common_.UseInterceptors)(designer_writable_interceptor/* .DesignerWritableInterceptor */.X),
+    (0,designer_writable_interceptor/* .DesignerWrites */.W)('insert', 'update', 'delete', 'publish', 'restoreVersion', 'discardDraft'),
     flow_definition_controller_ts_param(0, (0,common_.Inject)(flow_definition_service/* .FlowDefinitionService */.Tk)),
     flow_definition_controller_ts_param(1, (0,common_.Inject)(flow_runtime_service/* .FlowRuntimeService */.a)),
     flow_definition_controller_ts_metadata("design:type", Function),
@@ -1142,128 +1220,6 @@ FlowDefinitionController = flow_definition_controller_ts_decorate([
     ])
 ], FlowDefinitionController);
 
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-api-key.service.ts + 1 modules
-var flow_api_key_service = __webpack_require__(8888);
-;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/flow-api-key.controller.ts
-function flow_api_key_controller_ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-        r = Reflect.decorate(decorators, target, key, desc);
-    } else {
-        for(var i = decorators.length - 1; i >= 0; i--){
-            if (d = decorators[i]) {
-                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-            }
-        }
-    }
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function flow_api_key_controller_ts_metadata(metadataKey, metadataValue) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-        return Reflect.metadata(metadataKey, metadataValue);
-    }
-}
-function flow_api_key_controller_ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-
-
-
-
-
-
-
-
-const flow_api_key_controller_P = nestjs_shared_.FLOW_DEFINITION_PERMISSIONS;
-const ok = (data, message, messageKey)=>({
-        success: true,
-        message,
-        messageKey,
-        data
-    });
-class FlowApiKeyController {
-    keys;
-    constructor(keys){
-        this.keys = keys;
-    }
-    async create(dto, user) {
-        return ok(await this.keys.create(dto.flowId, dto.name, dto.expiresAt, user), 'API key created', message_keys/* .FLOW_MESSAGES.API_KEY_CREATE_SUCCESS */.wu.API_KEY_CREATE_SUCCESS);
-    }
-    async list(dto) {
-        return ok(await this.keys.list(dto.flowId), 'API keys loaded', message_keys/* .FLOW_MESSAGES.API_KEY_LIST_SUCCESS */.wu.API_KEY_LIST_SUCCESS);
-    }
-    async revoke(dto) {
-        await this.keys.revoke(dto.id);
-        return ok(null, 'API key revoked', message_keys/* .FLOW_MESSAGES.API_KEY_REVOKE_SUCCESS */.wu.API_KEY_REVOKE_SUCCESS);
-    }
-    async remove(dto) {
-        await this.keys.remove(dto.id);
-        return ok(null, 'API key deleted', message_keys/* .FLOW_MESSAGES.API_KEY_DELETE_SUCCESS */.wu.API_KEY_DELETE_SUCCESS);
-    }
-}
-flow_api_key_controller_ts_decorate([
-    (0,common_.Post)('create'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.UPDATE),
-    (0,swagger_.ApiOperation)({
-        summary: 'Create an API key. The key is in the response once and cannot be shown again.'
-    }),
-    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
-    flow_api_key_controller_ts_param(1, (0,nestjs_shared_.CurrentUser)()),
-    flow_api_key_controller_ts_metadata("design:type", Function),
-    flow_api_key_controller_ts_metadata("design:paramtypes", [
-        typeof CreateFlowApiKeyDto === "undefined" ? Object : CreateFlowApiKeyDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    flow_api_key_controller_ts_metadata("design:returntype", Promise)
-], FlowApiKeyController.prototype, "create", null);
-flow_api_key_controller_ts_decorate([
-    (0,common_.Post)('list'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.READ),
-    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
-    flow_api_key_controller_ts_metadata("design:type", Function),
-    flow_api_key_controller_ts_metadata("design:paramtypes", [
-        typeof FlowIdDto === "undefined" ? Object : FlowIdDto
-    ]),
-    flow_api_key_controller_ts_metadata("design:returntype", Promise)
-], FlowApiKeyController.prototype, "list", null);
-flow_api_key_controller_ts_decorate([
-    (0,common_.Post)('revoke'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.UPDATE),
-    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
-    flow_api_key_controller_ts_metadata("design:type", Function),
-    flow_api_key_controller_ts_metadata("design:paramtypes", [
-        typeof IdBodyDto === "undefined" ? Object : IdBodyDto
-    ]),
-    flow_api_key_controller_ts_metadata("design:returntype", Promise)
-], FlowApiKeyController.prototype, "revoke", null);
-flow_api_key_controller_ts_decorate([
-    (0,common_.Post)('delete'),
-    (0,common_.HttpCode)(common_.HttpStatus.OK),
-    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(flow_api_key_controller_P.UPDATE),
-    flow_api_key_controller_ts_param(0, (0,common_.Body)()),
-    flow_api_key_controller_ts_metadata("design:type", Function),
-    flow_api_key_controller_ts_metadata("design:paramtypes", [
-        typeof IdBodyDto === "undefined" ? Object : IdBodyDto
-    ]),
-    flow_api_key_controller_ts_metadata("design:returntype", Promise)
-], FlowApiKeyController.prototype, "remove", null);
-FlowApiKeyController = flow_api_key_controller_ts_decorate([
-    (0,swagger_.ApiTags)('Entity Builder - Flow API keys'),
-    (0,common_.Controller)('entity-builder/flow-api-keys'),
-    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
-    (0,swagger_.ApiBearerAuth)(),
-    flow_api_key_controller_ts_param(0, (0,common_.Inject)(flow_api_key_service/* .FlowApiKeyService */.T)),
-    flow_api_key_controller_ts_metadata("design:type", Function),
-    flow_api_key_controller_ts_metadata("design:paramtypes", [
-        typeof flow_api_key_service/* .FlowApiKeyService */.T === "undefined" ? Object : flow_api_key_service/* .FlowApiKeyService */.T
-    ])
-], FlowApiKeyController);
-
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-execution.service.ts
 var flow_execution_service = __webpack_require__(7810);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/flow-execution.controller.ts
@@ -1309,6 +1265,8 @@ class FlowExecutionController {
         const { rows, total } = await this.executions.list({
             flowId: dto.flowId,
             status: dto.status,
+            trigger: dto.trigger,
+            endpointNodeId: dto.endpointNodeId,
             page,
             pageSize
         });
@@ -1490,6 +1448,251 @@ FlowRuntimeController = flow_runtime_controller_ts_decorate([
     ])
 ], FlowRuntimeController);
 
+;// CONCATENATED MODULE: external "@nestjs/platform-express"
+
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/config/entity-builder.constants.ts
+var entity_builder_constants = __webpack_require__(6576);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/dtos/definition-bundle.dto.ts
+var definition_bundle_dto = __webpack_require__(6691);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/definition-bundle.diff.ts
+var definition_bundle_diff = __webpack_require__(3801);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/definition-bundle.file.ts
+var definition_bundle_file = __webpack_require__(6412);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/definition-bundle.service.ts
+var definition_bundle_service = __webpack_require__(7463);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/entity-builder-config.service.ts
+var entity_builder_config_service = __webpack_require__(4281);
+;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/definition-bundle.controller.ts
+function definition_bundle_controller_ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function definition_bundle_controller_ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function definition_bundle_controller_ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+/** The bundle is uploaded as a file (not JSON): the app's JSON body limit never applies, only this package's own. */ const BundleUpload = ()=>(0,common_.UseInterceptors)((0,__rspack_external__nestjs_platform_express_cb7ac6b9.FileInterceptor)('bundle', {
+        limits: {
+            fileSize: entity_builder_constants/* .ENTITY_BUNDLE_MAX_BYTES */.EA,
+            files: 1,
+            fields: 10
+        }
+    }));
+const IMPORT_BODY = {
+    schema: {
+        type: 'object',
+        required: [
+            'bundle'
+        ],
+        properties: {
+            bundle: {
+                type: 'string',
+                format: 'binary',
+                description: `The bundle file an export wrote (JSON, at most ${entity_builder_constants/* .ENTITY_BUNDLE_MAX_BYTES */.EA / 1024 / 1024} MB)`
+            },
+            deprecateMissingFields: {
+                type: 'boolean',
+                description: 'Deprecate fields this environment has and the bundle does not (their columns and data stay)'
+            },
+            confirm: {
+                type: 'boolean',
+                description: 'apply-import: acknowledge steps that lose (or may lose) data'
+            },
+            expectedChecksum: {
+                type: 'string',
+                description: 'apply-import: the checksum of the bundle that was reviewed'
+            },
+            expectedPlanChecksum: {
+                type: 'string',
+                description: 'apply-import: the planChecksum of the plan that was reviewed (required with confirm)'
+            }
+        }
+    }
+};
+const IMPORT_PERMISSIONS = [
+    nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.CREATE,
+    nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.UPDATE,
+    nestjs_shared_.FLOW_DEFINITION_PERMISSIONS.CREATE,
+    nestjs_shared_.FLOW_DEFINITION_PERMISSIONS.UPDATE
+];
+class DefinitionBundleController {
+    bundles;
+    config;
+    constructor(bundles, config){
+        this.bundles = bundles;
+        this.config = config;
+    }
+    settings() {
+        const data = {
+            readOnly: this.config.isDesignerReadOnly(),
+            variables: Object.keys(this.config.getBundleVariables()).toSorted(definition_bundle_diff/* .byCode */.VU)
+        };
+        return {
+            success: true,
+            message: 'Settings loaded',
+            messageKey: message_keys/* .BUNDLE_MESSAGES.SETTINGS_SUCCESS */.iX.SETTINGS_SUCCESS,
+            data
+        };
+    }
+    async export(dto) {
+        return {
+            success: true,
+            message: 'Bundle exported',
+            messageKey: message_keys/* .BUNDLE_MESSAGES.EXPORT_SUCCESS */.iX.EXPORT_SUCCESS,
+            data: await this.bundles.export(dto)
+        };
+    }
+    async planImport(file, options, user) {
+        const data = await this.bundles.planImport({
+            ...options,
+            bundle: (0,definition_bundle_file/* .readBundleFile */.z)(file)
+        }, user);
+        return {
+            success: true,
+            message: 'Import planned',
+            messageKey: message_keys/* .BUNDLE_MESSAGES.PLAN_SUCCESS */.iX.PLAN_SUCCESS,
+            data
+        };
+    }
+    async applyImport(file, options, user) {
+        const data = await this.bundles.applyImport({
+            ...options,
+            bundle: (0,definition_bundle_file/* .readBundleFile */.z)(file)
+        }, user);
+        return data.completed ? {
+            success: true,
+            message: 'Bundle imported',
+            messageKey: message_keys/* .BUNDLE_MESSAGES.APPLY_SUCCESS */.iX.APPLY_SUCCESS,
+            data
+        } : {
+            success: false,
+            message: 'The import stopped at a step that failed. The steps before it were applied.',
+            messageKey: message_keys/* .BUNDLE_MESSAGES.APPLY_PARTIAL */.iX.APPLY_PARTIAL,
+            data
+        };
+    }
+}
+definition_bundle_controller_ts_decorate([
+    (0,common_.Post)('settings'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequireAnyPermission)(nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.READ, nestjs_shared_.FLOW_DEFINITION_PERMISSIONS.READ),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Whether the designer is read-only here, and the names of the variables this environment defines'
+    }),
+    definition_bundle_controller_ts_metadata("design:type", Function),
+    definition_bundle_controller_ts_metadata("design:paramtypes", []),
+    definition_bundle_controller_ts_metadata("design:returntype", typeof nestjs_shared_.SingleResponseDto === "undefined" ? Object : nestjs_shared_.SingleResponseDto)
+], DefinitionBundleController.prototype, "settings", null);
+definition_bundle_controller_ts_decorate([
+    (0,common_.Post)('export'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.READ, nestjs_shared_.FLOW_DEFINITION_PERMISSIONS.READ),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Export entities and published flows as a bundle',
+        description: 'Keyed by entity code, field id/code and flow slug; API keys left out and this environment\'s variable values replaced by `${var:NAME}`. Commit it to git and import it into the next environment.'
+    }),
+    (0,swagger_.ApiBody)({
+        type: definition_bundle_dto/* .ExportBundleDto */.QJ
+    }),
+    definition_bundle_controller_ts_param(0, (0,common_.Body)()),
+    definition_bundle_controller_ts_metadata("design:type", Function),
+    definition_bundle_controller_ts_metadata("design:paramtypes", [
+        typeof definition_bundle_dto/* .ExportBundleDto */.QJ === "undefined" ? Object : definition_bundle_dto/* .ExportBundleDto */.QJ
+    ]),
+    definition_bundle_controller_ts_metadata("design:returntype", Promise)
+], DefinitionBundleController.prototype, "export", null);
+definition_bundle_controller_ts_decorate([
+    (0,common_.Post)('plan-import'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(...IMPORT_PERMISSIONS),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Preview importing a bundle: nothing changes',
+        description: 'Every step the import would run, in order, with the real SQL and data checks of each step that can be previewed on its own, the definitions this environment has and the bundle does not (never removed), and the blockers.'
+    }),
+    (0,swagger_.ApiConsumes)('multipart/form-data'),
+    (0,swagger_.ApiBody)(IMPORT_BODY),
+    BundleUpload(),
+    definition_bundle_controller_ts_param(0, (0,common_.UploadedFile)()),
+    definition_bundle_controller_ts_param(1, (0,common_.Body)()),
+    definition_bundle_controller_ts_param(2, (0,nestjs_shared_.CurrentUser)()),
+    definition_bundle_controller_ts_metadata("design:type", Function),
+    definition_bundle_controller_ts_metadata("design:paramtypes", [
+        Object,
+        typeof definition_bundle_dto/* .ImportBundleOptionsDto */.vS === "undefined" ? Object : definition_bundle_dto/* .ImportBundleOptionsDto */.vS,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    definition_bundle_controller_ts_metadata("design:returntype", Promise)
+], DefinitionBundleController.prototype, "planImport", null);
+definition_bundle_controller_ts_decorate([
+    (0,common_.Post)('apply-import'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(...IMPORT_PERMISSIONS),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'Import a bundle',
+        description: 'Refused while the plan has blockers, when it no longer matches expectedPlanChecksum, or when it loses data without confirm: true and expectedPlanChecksum. Steps run in order and the first that fails stops the import (the earlier ones stay); importing the same bundle again continues from there. Works while the designer is read-only. New API keys are answered once.'
+    }),
+    (0,swagger_.ApiConsumes)('multipart/form-data'),
+    (0,swagger_.ApiBody)(IMPORT_BODY),
+    BundleUpload(),
+    definition_bundle_controller_ts_param(0, (0,common_.UploadedFile)()),
+    definition_bundle_controller_ts_param(1, (0,common_.Body)()),
+    definition_bundle_controller_ts_param(2, (0,nestjs_shared_.CurrentUser)()),
+    definition_bundle_controller_ts_metadata("design:type", Function),
+    definition_bundle_controller_ts_metadata("design:paramtypes", [
+        Object,
+        typeof definition_bundle_dto/* .ImportBundleOptionsDto */.vS === "undefined" ? Object : definition_bundle_dto/* .ImportBundleOptionsDto */.vS,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    definition_bundle_controller_ts_metadata("design:returntype", Promise)
+], DefinitionBundleController.prototype, "applyImport", null);
+DefinitionBundleController = definition_bundle_controller_ts_decorate([
+    (0,swagger_.ApiTags)('Entity Builder - Bundles'),
+    (0,common_.Controller)('entity-builder/bundles'),
+    definition_bundle_controller_ts_param(0, (0,common_.Inject)(definition_bundle_service/* .DefinitionBundleService */.P)),
+    definition_bundle_controller_ts_param(1, (0,common_.Inject)(entity_builder_config_service/* .EntityBuilderConfigService */.E)),
+    definition_bundle_controller_ts_metadata("design:type", Function),
+    definition_bundle_controller_ts_metadata("design:paramtypes", [
+        typeof definition_bundle_service/* .DefinitionBundleService */.P === "undefined" ? Object : definition_bundle_service/* .DefinitionBundleService */.P,
+        typeof entity_builder_config_service/* .EntityBuilderConfigService */.E === "undefined" ? Object : entity_builder_config_service/* .EntityBuilderConfigService */.E
+    ])
+], DefinitionBundleController);
+
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/controllers/index.ts
 
 
@@ -1499,6 +1702,84 @@ FlowRuntimeController = flow_runtime_controller_ts_decorate([
 
 
 
+},
+417(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _nestjs_core__rspack_import_1 = __webpack_require__(3075);
+/* import */ var _config_message_keys_js__rspack_import_4 = __webpack_require__(5732);
+/* import */ var _dtos_schema_change_dto_js__rspack_import_2 = __webpack_require__(4945);
+/* import */ var _services_entity_builder_config_service_js__rspack_import_3 = __webpack_require__(4281);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+const DESIGNER_WRITE_HANDLERS = 'entity_builder:designer_write_handlers';
+/** The handlers of a controller (inherited ones included) that change definitions by hand. */ const DesignerWrites = (...handlers)=>(0,_nestjs_common__rspack_import_0.SetMetadata)(DESIGNER_WRITE_HANDLERS, handlers);
+class DesignerWritableInterceptor {
+    reflector;
+    config;
+    constructor(reflector, config){
+        this.reflector = reflector;
+        this.config = config;
+    }
+    intercept(context, next) {
+        if (this.isLocked(context)) {
+            throw new _nestjs_common__rspack_import_0.HttpException({
+                message: 'Definitions are read-only in this environment. Change them where they are designed and import the bundle here.',
+                messageKey: _config_message_keys_js__rspack_import_4/* .BUNDLE_MESSAGES.DESIGNER_READ_ONLY */.iX.DESIGNER_READ_ONLY
+            }, _nestjs_common__rspack_import_0.HttpStatus.LOCKED);
+        }
+        return next.handle();
+    }
+    isLocked(context) {
+        if (!this.config.isDesignerReadOnly()) return false;
+        const handlers = this.reflector.get(DESIGNER_WRITE_HANDLERS, context.getClass()) ?? [];
+        if (!handlers.includes(context.getHandler().name)) return false;
+        return context.switchToHttp().getRequest().body?.action !== _dtos_schema_change_dto_js__rspack_import_2/* .SchemaChangeAction.REPAIR */.M3.REPAIR;
+    }
+}
+DesignerWritableInterceptor = _ts_decorate([
+    (0,_nestjs_common__rspack_import_0.Injectable)(),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_nestjs_core__rspack_import_1.Reflector)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_services_entity_builder_config_service_js__rspack_import_3/* .EntityBuilderConfigService */.E)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _nestjs_core__rspack_import_1.Reflector === "undefined" ? Object : _nestjs_core__rspack_import_1.Reflector,
+        typeof _services_entity_builder_config_service_js__rspack_import_3/* .EntityBuilderConfigService */.E === "undefined" ? Object : _services_entity_builder_config_service_js__rspack_import_3/* .EntityBuilderConfigService */.E
+    ])
+], DesignerWritableInterceptor);
+
+__webpack_require__.d(__webpack_exports__, {
+  X: () => (DesignerWritableInterceptor)
+}, {
+  W: DesignerWrites
+});
+
+
 },
 4196(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
@@ -1523,8 +1804,6 @@ var core_ = __webpack_require__(3075);
 var message_keys = __webpack_require__(5732);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts
 var flow_definition_service = __webpack_require__(5229);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-api-key.service.ts + 1 modules
-var flow_api_key_service = __webpack_require__(8888);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-runtime.service.ts
 var flow_runtime_service = __webpack_require__(2300);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-rate-limiter.ts
@@ -1568,6 +1847,8 @@ const DEFAULT_MAX_KEYS = 10_000;
     }
 }
 
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-api-key.ts
+var flow_api_key = __webpack_require__(4816);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow.types.ts
 var flow_types = __webpack_require__(6256);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/guards/flow-access.guard.ts
@@ -1624,34 +1905,27 @@ class FlowAccessGuard {
         });
         const flow = slug ? await runtime.findActive(slug) : null;
         const endpoint = flow ? (0,flow_types/* .findEndpoint */.vS)(flow, request.params?.endpoint) : undefined;
-        if (!flow || !endpoint) throw new common_.NotFoundException({
+        // A Request step for other flows only has no URL: it looks the same as an unknown one.
+        if (!flow || !endpoint || endpoint.authMode === 'internal') throw new common_.NotFoundException({
             message: 'Not found',
             messageKey: message_keys/* .FLOW_MESSAGES.NOT_FOUND */.wu.NOT_FOUND
         });
         request.flowDefinition = flow;
         request.flowEndpoint = endpoint;
         const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';
-        if (!limiter.hit(`${flow.id}|${ip}`, flow.rateLimitPerMinute)) {
+        if (!limiter.hit(`${flow.id}|${endpoint.nodeId}|${ip}`, endpoint.rateLimitPerMinute)) {
             throw new common_.HttpException({
                 message: 'Too many requests. Try again in a minute.',
                 messageKey: message_keys/* .FLOW_MESSAGES.RATE_LIMITED */.wu.RATE_LIMITED
             }, common_.HttpStatus.TOO_MANY_REQUESTS);
         }
-        switch(flow.authMode){
+        switch(endpoint.authMode){
             case 'public':
                 return true;
             case 'api_key':
                 {
-                    const keys = await this.moduleRef.resolve(flow_api_key_service/* .FlowApiKeyService */.T, contextId, {
-                        strict: false
-                    });
                     const header = request.headers?.['x-api-key'];
-                    const check = await keys.verify(flow.id, Array.isArray(header) ? header[0] : header);
-                    if (check === 'expired') throw new common_.UnauthorizedException({
-                        message: 'This API key has expired.',
-                        messageKey: message_keys/* .FLOW_MESSAGES.API_KEY_EXPIRED */.wu.API_KEY_EXPIRED
-                    });
-                    if (check !== 'valid') {
+                    if (!(0,flow_api_key/* .apiKeyOpens */.NT)(endpoint.apiKey, Array.isArray(header) ? header[0] : header)) {
                         throw new common_.UnauthorizedException({
                             message: 'A valid API key is required (x-api-key header).',
                             messageKey: message_keys/* .FLOW_MESSAGES.API_KEY_INVALID */.wu.API_KEY_INVALID
@@ -1665,7 +1939,7 @@ class FlowAccessGuard {
             case 'permission':
                 {
                     if (!await this.authenticate(context)) return false;
-                    await this.permissionCache.assertPermission(request.user, flow.permissionCode || (0,flow_definition_service/* .defaultFlowPermissionCode */.Er)(flow.slug));
+                    await this.permissionCache.assertPermissionLogic(request.user, (0,flow_definition_service/* .flowPermissions */.j4)(endpoint, flow.slug));
                     return true;
                 }
             default: