@flusys/nestjs-entity-builder 9.1.0 → 9.1.2

package/fesm/{996.js → 677.js}

@@ -7,41 +7,11 @@ import * as __rspack_external_node_os_4f3c9d58 from "node:os";
 import * as __rspack_external_node_path_806ed179 from "node:path";
 import * as __rspack_external_node_url_3991086a from "node:url";
 import * as __rspack_external_node_worker_threads_28ca7740 from "node:worker_threads";
+import * as __rspack_external__flusys_nestjs_shared_exceptions_3edf22e9 from "@flusys/nestjs-shared/exceptions";
 import * as __rspack_external_node_dns_c6249ebb from "node:dns";
-export const __rspack_esm_id = 996;
-export const __rspack_esm_ids = [996];
+export const __rspack_esm_id = 677;
+export const __rspack_esm_ids = [677];
 export const __webpack_modules__ = {
-6576(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-const ENTITY_BUILDER_MODULE_OPTIONS = 'ENTITY_BUILDER_MODULE_OPTIONS';
-/**
- * Identifier whitelist enforced on every EntityDefinition/FieldDefinition `code`.
- * Also the exact contract SchemaSyncService's DDL engine validates against
- * before generating a table/column name.
- */ const ENTITY_CODE_PATTERN = /^[a-z][a-z0-9_]{2,59}$/;
-/** Matches the `code` column length on both EntityDefinition and FieldDefinition. */ const ENTITY_CODE_MAX_LENGTH = 63;
-/** Defense-in-depth prefix applied to every dynamically created table name. */ const ENTITY_TABLE_PREFIX = 'eb_';
-/** The generic API controller's record endpoints - each can be created as a ready-made flow with the entity. */ const ENTITY_FLOW_ENDPOINTS = [
-    'insert',
-    'insertMany',
-    'getById',
-    'getByIds',
-    'getAll',
-    'getByFilter',
-    'update',
-    'updateMany',
-    'bulkUpsert',
-    'delete'
-];
-
-__webpack_require__.d(__webpack_exports__, {
-}, {
-  CP: ENTITY_BUILDER_MODULE_OPTIONS,
-  WT: ENTITY_FLOW_ENDPOINTS,
-  vs: ENTITY_CODE_PATTERN
-});
-
-
-},
 982(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /** Every entity the entity builder module publishes under */ const ENTITY_BUILDER_EVENT_ENTITIES = {
     ENTITY_DEFINITION: 'entity_definition',
@@ -59,6 +29,60 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+4816(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var node_crypto__rspack_import_0 = __webpack_require__(2561);
+/* import */ var _flow_types_js__rspack_import_1 = __webpack_require__(6256);
+
+
+const API_KEY_PREFIX_LENGTH = 11; // "fk_" + 8 hex
+const hashApiKey = (key)=>(0,node_crypto__rspack_import_0.createHash)('sha256').update(key).digest('hex');
+const apiKeyPrefix = (key)=>key.slice(0, API_KEY_PREFIX_LENGTH);
+/** A key as the designer makes it: `fk_<8 hex>_<32 hex>`. */ function looksLikeApiKey(key) {
+    return typeof key === 'string' && /^fk_[0-9a-f]{8}_[0-9a-f]{32}$/.test(key);
+}
+/** Constant-time comparison of a presented key against a stored hash. */ function apiKeyMatches(presented, storedHash) {
+    const a = Buffer.from(hashApiKey(presented), 'hex');
+    const b = Buffer.from(storedHash, 'hex');
+    return a.length === b.length && (0,node_crypto__rspack_import_0.timingSafeEqual)(a, b);
+}
+/** Whether `presented` is the key a Request step stores. */ const apiKeyOpens = (stored, presented)=>!!stored && looksLikeApiKey(presented) && apiKeyMatches(presented, stored.hash);
+/**
+ * What is saved of the Request steps' API keys: a plain key the designer made becomes its prefix and
+ * hash, so the key itself is never stored; a step without `api_key` access keeps no key at all.
+ */ function sealApiKeys(nodes) {
+    return nodes.map((node)=>{
+        if (node.type !== 'trigger' || node.config?.['apiKey'] === undefined) return node;
+        const { apiKey, ...config } = node.config;
+        if (config['authMode'] !== 'api_key') return {
+            ...node,
+            config
+        };
+        if (looksLikeApiKey(apiKey)) return {
+            ...node,
+            config: {
+                ...config,
+                apiKey: {
+                    prefix: apiKeyPrefix(apiKey),
+                    hash: hashApiKey(apiKey)
+                }
+            }
+        };
+        return (0,_flow_types_js__rspack_import_1/* .isStoredApiKey */.xA)(apiKey) ? node : {
+            ...node,
+            config
+        };
+    });
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  Jb: () => (looksLikeApiKey),
+  ue: () => (sealApiKeys)
+}, {
+  NT: apiKeyOpens
+});
+
+
 },
 8333(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
@@ -80,10 +104,6 @@ var message_keys = __webpack_require__(5732);
 var flow_errors = __webpack_require__(8542);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow.types.ts
 var flow_types = __webpack_require__(6256);
-// EXTERNAL MODULE: external "@flusys/nestjs-shared/constants"
-var constants_ = __webpack_require__(9140);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/interfaces/generic-record.interface.ts
-var generic_record_interface = __webpack_require__(3372);
 ;// CONCATENATED MODULE: external "node:os"
 
 ;// CONCATENATED MODULE: external "node:path"
@@ -302,7 +322,7 @@ const timeoutError = (job)=>new flow_errors/* .FlowCodeError */.yL(message_keys/
 const unavailableError = (node, detail)=>new flow_errors/* .FlowCodeError */.yL(message_keys/* .FLOW_ERROR_MESSAGES.CODE_UNAVAILABLE */.zr.CODE_UNAVAILABLE, {
         node
     }, `The code sandbox could not run the code: ${detail}`);
-let CodeSandboxPool = class CodeSandboxPool {
+let flow_code_sandbox_CodeSandboxPool = class CodeSandboxPool {
     idle = [];
     running = new Map();
     queue = [];
@@ -432,14 +452,12 @@ let pool;
             detail: error.message
         }, error.message);
     }
-    pool ??= new CodeSandboxPool();
+    pool ??= new flow_code_sandbox_CodeSandboxPool();
     return pool.run(code, input, timeoutMs, node);
 }
 
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-graph.validator.ts
 var flow_graph_validator = __webpack_require__(3186);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-permission.ts
-var rule_permission = __webpack_require__(5191);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-values.ts
 var rule_values = __webpack_require__(6622);
 ;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-node-handlers.ts
@@ -451,16 +469,7 @@ var rule_values = __webpack_require__(6622);
 
 
 
-
-
-
-const PERMISSION_ACTION = {
-    insert: 'create',
-    update: 'update',
-    delete: 'delete',
-    read: 'read'
-};
-/** With `env`, `lookup` expressions read through the flow (permission check, transaction). */ function evaluationContext(state, env) {
+/** With `env`, `lookup` expressions read through the flow (its transaction). */ function evaluationContext(state, env) {
     const base = {
         input: state.input,
         vars: state.vars,
@@ -478,7 +487,6 @@ const PERMISSION_ACTION = {
 function lookupResolver(env, state) {
     return {
         find: async (entityCode, query)=>{
-            await authorize(env, state, entityCode, 'read');
             const service = await env.entityService(entityCode, state.qr);
             const { data, total } = await service.getAll(undefined, {
                 filter: query.filter,
@@ -522,24 +530,9 @@ async function mapValues(map, env, state) {
         });
     };
     for (const [key, item] of Object.entries(map ?? {})){
-        if ((0,generic_record_interface/* .isRecordFilterCondition */.t1)(item)) {
-            if (item.op === 'is_null' || item.op === 'not_null') {
-                out[key] = {
-                    op: item.op
-                };
-                continue;
-            }
-            const value = item.value === undefined ? undefined : await env.ruleEngine.resolveExpression(item.value, ctx);
-            if (value === undefined) absent(key);
-            else out[key] = {
-                op: item.op,
-                value
-            };
-        } else {
-            const value = await env.ruleEngine.resolveExpression(item, ctx);
-            if (value === undefined) absent(key);
-            else out[key] = (0,rule_values/* .equalsOperand */.$b)(value);
-        }
+        const entry = await (0,rule_values/* .resolveFilterEntry */.vY)(item, (expression)=>env.ruleEngine.resolveExpression(expression, ctx));
+        if ((0,rule_values/* .isFilterValueMissing */.kp)(entry)) absent(key);
+        else out[key] = entry;
     }
     return out;
 }
@@ -556,7 +549,7 @@ async function runValidate(cfg, env, state) {
             passed: true
         }
     };
-    const status = cfg.statusCode ?? (failed.every((check)=>(0,flow_graph_validator/* .usesPermissionFunction */.u)(check.rule)) ? 403 : 400);
+    const status = cfg.statusCode ?? (failed.every((check)=>(0,flow_graph_validator/* .usesPermissionFunction */.u9)(check.rule)) ? 403 : 400);
     const errors = failed.map((check)=>({
             field: check.field || check.id,
             message: check.message
@@ -569,21 +562,44 @@ async function runValidate(cfg, env, state) {
         }
     });
 }
-/** `{ allowed, missing }` - `missing` lists the codes the caller does not hold. */ async function runPermissionCheck(cfg, env, state) {
-    const codes = (0,rule_permission/* .parsePermissionCodes */.PS)(cfg.codes);
-    let branch;
-    if (cfg.branch === null) branch = null;
-    else if (cfg.branch !== undefined) branch = (0,rule_permission/* .toBranchArgument */.lH)([
-        await env.ruleEngine.resolveExpression(cfg.branch, evaluationContext(state, env))
-    ], 0);
-    const permissions = state.permissions ?? env.ruleEngine.createPermissionResolver(state.user);
-    const granted = state.user ? await permissions.granted(branch) : [];
-    const missing = codes.filter((code)=>!(0,utils_.matchesPermission)(granted, code));
-    const allowed = codes.length > 0 && (cfg.match === 'all' ? missing.length === 0 : missing.length < codes.length);
-    const output = {
+/** `{ allowed, missing }` - whether the user passes the AND / OR rule; `missing` lists the codes it names that the user does not hold. */ async function runPermissionCheck(cfg, env, state) {
+    const granted = await permissionCodes(cfg, env, state);
+    const missing = (0,utils_.permissionLogicCodes)(cfg.permissions).filter((code)=>!(0,utils_.matchesPermission)(granted, code));
+    const allowed = (0,utils_.evaluatePermissionLogic)(cfg.permissions, granted).passed;
+    return deniedResult(cfg, {
         allowed,
         missing
-    };
+    }, allowed);
+}
+/** The codes the check's user holds in its company / branch; none without a user, for a set company that resolves to nothing, or outside the user's granted companies and branches. */ async function permissionCodes(cfg, env, state) {
+    const caller = state.user;
+    const asCaller = cfg.subject !== 'user';
+    const ctx = evaluationContext(state, env);
+    const resolveId = async (expression)=>expression === undefined ? null : oneId(await env.ruleEngine.resolveExpression(expression, ctx));
+    const userId = asCaller ? caller?.id ?? null : await resolveId(cfg.userId);
+    if (!userId) return [];
+    const currentCompanyId = caller?.companyId ?? null;
+    const companyId = cfg.companyId === undefined ? currentCompanyId : await resolveId(cfg.companyId);
+    if (cfg.companyId !== undefined && !companyId) return [];
+    const branchId = await resolveId(cfg.branchId);
+    if (asCaller && companyId === currentCompanyId) {
+        const permissions = state.permissions ?? env.ruleEngine.createPermissionResolver(caller);
+        if (cfg.branchId === undefined) return permissions.granted(undefined);
+        if (branchId === null || branchId === caller?.branchId) return permissions.granted(branchId);
+    }
+    if (companyId && !await isGrantedScope(userId, companyId, branchId, env)) return [];
+    return env.ruleEngine.permissionCodes({
+        userId,
+        companyId,
+        branchId
+    });
+}
+async function isGrantedScope(userId, companyId, branchId, env) {
+    const { companies, branches } = await env.companyAccess(userId);
+    if (!companies.some((company)=>company.id === companyId)) return false;
+    return branchId === null || branches.some((branch)=>branch.id === branchId && branch.companyId === companyId);
+}
+/** A denied check: `onDenied: branch` follows the `denied` port, otherwise the run is answered `statusCode` (403). */ function deniedResult(cfg, output, allowed) {
     if (cfg.onDenied === 'branch') return {
         output,
         port: allowed ? 'allowed' : 'denied'
@@ -599,6 +615,68 @@ async function runValidate(cfg, env, state) {
         output
     };
 }
+/** One id, a list of ids, or nothing (undefined / null / empty text), each id once. */ function idList(value) {
+    const items = Array.isArray(value) ? value : [
+        value
+    ];
+    return [
+        ...new Set(items.filter((item)=>item !== undefined && item !== null && item !== '').map(String))
+    ];
+}
+/** One id from an expression's value; anything but non-empty text is none. */ function oneId(value) {
+    return typeof value === 'string' && value ? value : null;
+}
+/**
+ * `{ userId, currentCompanyId, currentBranchId, companies, branches }` - what the user (the signed-in
+ * caller, or the one `userId` names) may work in; none without a user or the company feature. With
+ * `companyIds` / `branchIds` it also answers `allowed` and `missing`: every id asked for must be within
+ * reach (`branchMatch`, among the branches of `branchCompany`), and a target that resolves to nothing
+ * is a denial, never a pass.
+ */ async function runCompanyBranchCheck(cfg, env, state) {
+    const ctx = evaluationContext(state, env);
+    const resolve = async (expression)=>expression === undefined ? undefined : env.ruleEngine.resolveExpression(expression, ctx);
+    const asCaller = cfg.subject !== 'user';
+    const userId = asCaller ? state.user?.id ?? null : oneId(await resolve(cfg.userId));
+    const { companies, branches } = userId ? await env.companyAccess(userId) : {
+        companies: [],
+        branches: []
+    };
+    const currentCompanyId = asCaller ? state.user?.companyId ?? null : null;
+    const currentBranchId = asCaller ? state.user?.branchId ?? null : null;
+    const output = {
+        userId,
+        currentCompanyId,
+        currentBranchId,
+        companies,
+        branches
+    };
+    if (cfg.companyIds === undefined && cfg.branchIds === undefined) return {
+        output
+    };
+    const wanted = async (expression)=>expression === undefined ? null : idList(await resolve(expression));
+    const wantedCompanies = await wanted(cfg.companyIds);
+    const wantedBranches = await wanted(cfg.branchIds);
+    const granted = branches.filter((branch)=>cfg.branchCompany !== 'current' || branch.companyId === currentCompanyId).map((branch)=>branch.id);
+    const reachable = await reachableBranches(cfg.branchMatch ?? 'direct', granted, wantedBranches, env);
+    const missing = {
+        companyIds: (wantedCompanies ?? []).filter((id)=>!companies.some((company)=>company.id === id)),
+        branchIds: (wantedBranches ?? []).filter((id)=>!reachable.has(id))
+    };
+    const nothingToCheck = wantedCompanies?.length === 0 || wantedBranches?.length === 0;
+    const allowed = !nothingToCheck && !missing.companyIds.length && !missing.branchIds.length;
+    return deniedResult(cfg, {
+        ...output,
+        allowed,
+        missing
+    }, allowed);
+}
+/** The branches a check passes: the granted ones (direct), and with `within` every branch under them too. */ async function reachableBranches(match, granted, wanted, env) {
+    if (match !== 'within' || !wanted?.length || !granted.length || !env.branchTree || wanted.every((id)=>granted.includes(id))) return new Set(granted);
+    return new Set([
+        ...granted,
+        ...await env.branchTree(granted)
+    ]);
+}
 const USES_PERMISSIONS = /\b(permissions|hasPermission|hasAnyPermission|hasAllPermissions)\b/;
 /** The caller as a code step sees it; permission codes (current branch) are fetched only for code that reads them. */ async function codeUser(code, state) {
     const user = state.user;
@@ -641,16 +719,6 @@ function asId(value) {
     });
     return value;
 }
-/** Fails closed: the caller needs the entity permission; the system only when that was granted for this run; anything else is refused. */ async function authorize(env, state, entityCode, action) {
-    if (state.runAs === 'caller') return env.assertPermission((0,constants_.dynamicEntityPermission)(entityCode, PERMISSION_ACTION[action]), state.user);
-    if (state.runAs === 'system' && state.systemAuthorized === true) return;
-    throw new flow_errors/* .FlowHttpError */.hk(403, 'This flow is not allowed to read or write records as the system.', undefined, {
-        messageKey: message_keys/* .FLOW_ERROR_MESSAGES.RUN_AS_NOT_ALLOWED */.zr.RUN_AS_NOT_ALLOWED,
-        messageVariables: {
-            runAs: String(state.runAs)
-        }
-    });
-}
 function writeOptions(state) {
     return state.qr ? {
         queryRunner: state.qr,
@@ -727,15 +795,16 @@ async function updateRecord(entityCode, service, values, state) {
 }
 /** @returns false when the record does not exist and `skip` allows that. */ async function deleteRecord(entityCode, service, id, skipMissing, state) {
     countWrite(state);
+    let action;
     try {
-        await service.delete(id, state.user, writeOptions(state));
+        action = await service.delete(id, state.user, writeOptions(state));
     } catch (error) {
         if (skipMissing && error instanceof common_.NotFoundException) return false;
         throw error;
     }
     if (state.qr) state.pendingEvents.push({
         entityCode,
-        action: 'deleted',
+        action,
         row: {
             id
         }
@@ -780,8 +849,6 @@ async function insertChildren(node, child, parentId, env, state) {
  * A write of several records (many, or any children) is all-or-nothing.
  */ async function runInsert(node, cfg, env, state) {
     const children = cfg.children ?? [];
-    await authorize(env, state, cfg.entityCode, 'insert');
-    for (const child of children)await authorize(env, state, child.entityCode, 'insert');
     const service = await env.entityService(cfg.entityCode, state.qr);
     const insertOne = async ()=>{
         const saved = await insertRecord(cfg.entityCode, service, await mapFieldValues(cfg.fields, env, state), state);
@@ -835,8 +902,6 @@ async function insertChildren(node, child, parentId, env, state) {
 }
 /** one: the saved record (null when skipped). many / filter: `{ items, count, updated, created, skipped }`, all-or-nothing. */ async function runUpdate(node, cfg, env, state) {
     const target = writeTarget(cfg);
-    await authorize(env, state, cfg.entityCode, 'update');
-    if (target !== 'filter' && cfg.onNotFound === 'insert') await authorize(env, state, cfg.entityCode, 'insert');
     const service = await env.entityService(cfg.entityCode, state.qr);
     if (target === 'one') return {
         output: (await updateOrCreate(cfg, service, undefined, env, state)).row
@@ -867,7 +932,6 @@ async function insertChildren(node, child, parentId, env, state) {
 /** one: `{ id, deleted }`. many / filter: `{ ids, count, skipped }`, all-or-nothing; an id listed twice is deleted once. */ async function runDelete(node, cfg, env, state) {
     const target = writeTarget(cfg);
     const skipMissing = cfg.onNotFound === 'skip';
-    await authorize(env, state, cfg.entityCode, 'delete');
     const service = await env.entityService(cfg.entityCode, state.qr);
     const idOf = async (item)=>asId(cfg.id === undefined ? itemId(item) : await env.ruleEngine.resolveExpression(cfg.id, evaluationContext(state, env)));
     if (target === 'one') {
@@ -897,6 +961,377 @@ async function insertChildren(node, child, parentId, env, state) {
         })
     };
 }
+/** As strict as the email module's own check, and without the characters that would break an address header. */ const EMAIL_PATTERN = /^[^\s@,;<>"]+@[^\s@,;<>"]+\.[^\s@,;<>"]+$/;
+const MAX_EMAIL_LENGTH = 254;
+const shown = (value)=>String(typeof value === 'object' && value !== null ? JSON.stringify(value) : value).slice(0, 100);
+/** A value as message text: nothing for null / undefined, JSON for an object. */ function asText(value) {
+    if (value === null || value === undefined) return '';
+    return typeof value === 'object' ? JSON.stringify(value) : String(value);
+}
+/** Reserves `count` sends of the run's budget before any goes out, so a step never sends only some of its messages because of the limit. */ function countMessages(state, count) {
+    if (state.messages + count > flow_types/* .FLOW_LIMITS.MAX_MESSAGES_PER_RUN */.Or.MAX_MESSAGES_PER_RUN) throw new flow_errors/* .FlowLimitError */.IM(message_keys/* .FLOW_ERROR_MESSAGES.TOO_MANY_MESSAGES */.zr.TOO_MANY_MESSAGES, {
+        max: flow_types/* .FLOW_LIMITS.MAX_MESSAGES_PER_RUN */.Or.MAX_MESSAGES_PER_RUN
+    });
+    state.messages += count;
+}
+function assertRecipientCount(node, count, max) {
+    if (count > max) throw new flow_errors/* .FlowLimitError */.IM(message_keys/* .FLOW_ERROR_MESSAGES.TOO_MANY_RECIPIENTS */.zr.TOO_MANY_RECIPIENTS, {
+        node: (0,flow_types/* .nodeLabel */.dA)(node),
+        count,
+        max
+    });
+}
+/** Whatever the module threw, or its `success: false`, fails the step with the reason (a limit stays a limit). */ function sendFailure(key, node, error) {
+    if (error instanceof flow_errors/* .FlowKeyedError */.Hp || error instanceof flow_errors/* .FlowHttpError */.hk) return error;
+    const detail = error instanceof Error ? error.message : String(error);
+    return new flow_errors/* .FlowKeyedError */.Hp(key, {
+        node: (0,flow_types/* .nodeLabel */.dA)(node),
+        detail
+    }, `"${(0,flow_types/* .nodeLabel */.dA)(node)}" could not send: ${detail}`);
+}
+/** Inside a transaction the message waits for the commit, so a run that rolls back sends nothing. */ async function deliver(node, state, send) {
+    if (state.qr) {
+        state.pendingEvents.push({
+            delivery: (0,flow_types/* .nodeLabel */.dA)(node),
+            send
+        });
+        return 'queued';
+    }
+    await send();
+    return 'sent';
+}
+/** One id or a list of them, each once; null / undefined / empty text is none. Anything but an id rejects with `key`. */ function idsOf(node, value, key, text) {
+    const items = (Array.isArray(value) ? value : [
+        value
+    ]).filter((item)=>item !== undefined && item !== null && item !== '');
+    for (const item of items){
+        if (typeof item !== 'string' || !flow_types/* .FLOW_ID_PATTERN.test */.E2.test(item)) {
+            throw new flow_errors/* .FlowHttpError */.hk(400, text(shown(item)), undefined, {
+                messageKey: key,
+                messageVariables: {
+                    node: (0,flow_types/* .nodeLabel */.dA)(node),
+                    value: shown(item)
+                }
+            });
+        }
+    }
+    return [
+        ...new Set(items)
+    ];
+}
+const notificationRecipients = (node, value)=>idsOf(node, value, message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_RECIPIENT_INVALID */.zr.NOTIFICATION_RECIPIENT_INVALID, (shownValue)=>`"${(0,flow_types/* .nodeLabel */.dA)(node)}" cannot notify "${shownValue}": it is not a user id.`);
+/** Addresses: one, a list, or comma / semicolon separated text; each once (case aside), in the order given. */ function emailAddresses(node, value) {
+    const items = (Array.isArray(value) ? value : [
+        value
+    ]).filter((item)=>item !== undefined && item !== null);
+    const seen = new Map();
+    for (const item of items){
+        const parts = typeof item === 'string' ? item.split(/[,;]/) : [
+            item
+        ];
+        for (const part of parts){
+            const address = typeof part === 'string' ? part.trim() : part;
+            if (address === '') continue;
+            if (typeof address !== 'string' || address.length > MAX_EMAIL_LENGTH || !EMAIL_PATTERN.test(address)) {
+                throw new flow_errors/* .FlowHttpError */.hk(400, `"${shown(address)}" is not a valid email address.`, undefined, {
+                    messageKey: message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_ADDRESS_INVALID */.zr.EMAIL_ADDRESS_INVALID,
+                    messageVariables: {
+                        node: (0,flow_types/* .nodeLabel */.dA)(node),
+                        address: shown(address)
+                    }
+                });
+            }
+            if (!seen.has(address.toLowerCase())) seen.set(address.toLowerCase(), address);
+        }
+    }
+    return [
+        ...seen.values()
+    ];
+}
+/** The company a notification shows under: the one given, else the caller's current one. */ function notificationCompany(node, value, given, state) {
+    if (!given) return state.user?.companyId ?? null;
+    if (value === undefined || value === null || value === '') return null;
+    if (typeof value === 'string' && flow_types/* .FLOW_ID_PATTERN.test */.E2.test(value)) return value;
+    throw new flow_errors/* .FlowHttpError */.hk(400, `"${(0,flow_types/* .nodeLabel */.dA)(node)}": "${shown(value)}" is not a company id.`, undefined, {
+        messageKey: message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_COMPANY_INVALID */.zr.NOTIFICATION_COMPANY_INVALID,
+        messageVariables: {
+            node: (0,flow_types/* .nodeLabel */.dA)(node),
+            value: shown(value)
+        }
+    });
+}
+/** Sends `batches` (each already checked) as one step: the run's budget is taken for all of them first; a test run sends nothing. */ async function sendAll(node, state, batches, skipKey, recipients, send) {
+    countMessages(state, batches.length);
+    if (state.mode === 'dry_run') return {
+        output: {
+            skipped: true,
+            reasonKey: skipKey,
+            count: batches.length,
+            recipients
+        },
+        skipped: true
+    };
+    let status = 'sent';
+    for (const batch of batches)status = await deliver(node, state, ()=>send(batch));
+    return status;
+}
+const nobody = (extra = {})=>({
+        output: {
+            skipped: true,
+            reasonKey: message_keys/* .FLOW_SKIP_MESSAGES.NO_RECIPIENTS */.CB.NO_RECIPIENTS,
+            recipients: 0,
+            ...extra
+        },
+        skipped: true
+    });
+/** Title, message, type, data and push of a notification, read in the current scope (the item's, in many mode). */ async function notificationContent(node, cfg, env, state) {
+    const ctx = evaluationContext(state, env);
+    const title = asText(await env.ruleEngine.resolveExpression(cfg.title, ctx)).trim().slice(0, flow_types/* .FLOW_LIMITS.MAX_NOTIFICATION_TITLE_LENGTH */.Or.MAX_NOTIFICATION_TITLE_LENGTH);
+    if (!title) throw new flow_errors/* .FlowHttpError */.hk(400, `The title of "${(0,flow_types/* .nodeLabel */.dA)(node)}" is empty.`, undefined, {
+        messageKey: message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_TITLE_EMPTY */.zr.NOTIFICATION_TITLE_EMPTY,
+        messageVariables: {
+            node: (0,flow_types/* .nodeLabel */.dA)(node)
+        }
+    });
+    const message = cfg.message === undefined ? '' : asText(await env.ruleEngine.resolveExpression(cfg.message, ctx));
+    const data = cfg.data && Object.keys(cfg.data).length ? await mapValues(cfg.data, env, state) : null;
+    return {
+        title,
+        message: message || null,
+        type: cfg.type ?? 'info',
+        data,
+        realtime: cfg.realtime !== false
+    };
+}
+/** One notification to the users `userIds` names, or null when that is nobody. */ async function userNotification(node, cfg, env, state) {
+    const ctx = evaluationContext(state, env);
+    const userIds = notificationRecipients(node, cfg.userIds === undefined ? undefined : await env.ruleEngine.resolveExpression(cfg.userIds, ctx));
+    if (!userIds.length) return null;
+    assertRecipientCount(node, userIds.length, flow_types/* .FLOW_LIMITS.MAX_NOTIFICATION_RECIPIENTS */.Or.MAX_NOTIFICATION_RECIPIENTS);
+    const content = await notificationContent(node, cfg, env, state);
+    const companyId = notificationCompany(node, cfg.companyId === undefined ? undefined : await env.ruleEngine.resolveExpression(cfg.companyId, ctx), cfg.companyId !== undefined, state);
+    return {
+        ...content,
+        userIds,
+        companyId
+    };
+}
+/** One notification per company that has members, each shown under its own company. */ async function companyNotifications(node, cfg, env, state) {
+    const companyMembers = env.companyMembers;
+    if (!companyMembers) {
+        throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_COMPANY_UNAVAILABLE */.zr.NOTIFICATION_COMPANY_UNAVAILABLE, {
+            node: (0,flow_types/* .nodeLabel */.dA)(node)
+        }, `"${(0,flow_types/* .nodeLabel */.dA)(node)}" notifies companies, which needs the company feature.`);
+    }
+    const ctx = evaluationContext(state, env);
+    const resolve = async (expression)=>expression === undefined ? undefined : env.ruleEngine.resolveExpression(expression, ctx);
+    const companyIds = idsOf(node, await resolve(cfg.companyIds), message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_COMPANY_INVALID */.zr.NOTIFICATION_COMPANY_INVALID, (value)=>`"${(0,flow_types/* .nodeLabel */.dA)(node)}": "${value}" is not a company id.`);
+    const branchIds = idsOf(node, await resolve(cfg.branchIds), message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_BRANCH_INVALID */.zr.NOTIFICATION_BRANCH_INVALID, (value)=>`"${(0,flow_types/* .nodeLabel */.dA)(node)}": "${value}" is not a branch id.`);
+    if (!companyIds.length) return [];
+    const content = await notificationContent(node, cfg, env, state);
+    const batches = [];
+    let total = 0;
+    for (const companyId of companyIds){
+        const userIds = await companyMembers(companyId, branchIds.length ? branchIds : undefined);
+        total += userIds.length;
+        assertRecipientCount(node, total, flow_types/* .FLOW_LIMITS.MAX_COMPANY_NOTIFICATION_RECIPIENTS */.Or.MAX_COMPANY_NOTIFICATION_RECIPIENTS);
+        if (userIds.length) batches.push({
+            ...content,
+            userIds,
+            companyId
+        });
+    }
+    return batches;
+}
+/**
+ * one: `{ status, recipients }`. many / company: `{ status, count, recipients }` (+ `skipped` items
+ * with nobody to notify, in many mode). `status` is `sent`, or `queued` inside a transaction (sent once
+ * it commits). Every message is checked before the first goes out; nobody at all skips the step, and
+ * a test run checks everything but sends nothing.
+ */ async function runSendNotification(node, cfg, env, state) {
+    const notifications = env.notifications;
+    if (!notifications) throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_UNAVAILABLE */.zr.NOTIFICATION_UNAVAILABLE, {
+        node: (0,flow_types/* .nodeLabel */.dA)(node)
+    }, `"${(0,flow_types/* .nodeLabel */.dA)(node)}" needs the notification module, which this app does not run.`);
+    const target = cfg.target ?? 'one';
+    let batches;
+    let skippedItems = 0;
+    if (target === 'company') {
+        batches = await companyNotifications(node, cfg, env, state);
+    } else if (target === 'many') {
+        const items = await resolveList(node, cfg.items, flow_types/* .FLOW_LIMITS.MAX_MESSAGES_PER_RUN */.Or.MAX_MESSAGES_PER_RUN, env, state);
+        const prepared = await eachItem(state, items, ()=>userNotification(node, cfg, env, state));
+        batches = prepared.filter((batch)=>batch !== null);
+        skippedItems = prepared.length - batches.length;
+    } else {
+        batches = [
+            await userNotification(node, cfg, env, state)
+        ].filter((batch)=>batch !== null);
+    }
+    const counts = target === 'one' ? {} : {
+        count: batches.length,
+        ...target === 'many' ? {
+            skipped: skippedItems
+        } : {}
+    };
+    if (!batches.length) return nobody(counts);
+    const recipients = batches.reduce((sum, batch)=>sum + batch.userIds.length, 0);
+    const sent = await sendAll(node, state, batches, message_keys/* .FLOW_SKIP_MESSAGES.NOTIFICATION */.CB.NOTIFICATION, recipients, async (batch)=>{
+        try {
+            await notifications.sendToMany(batch);
+        } catch (error) {
+            throw sendFailure(message_keys/* .FLOW_ERROR_MESSAGES.NOTIFICATION_FAILED */.zr.NOTIFICATION_FAILED, node, error);
+        }
+    });
+    if (typeof sent !== 'string') return sent;
+    return {
+        output: {
+            status: sent,
+            recipients,
+            ...counts
+        }
+    };
+}
+/** One email, read in the current scope (the item's, in many mode), or null when `to` has no address. */ async function prepareEmail(node, cfg, email, env, state) {
+    const ctx = evaluationContext(state, env);
+    const addresses = async (expression)=>expression === undefined ? [] : emailAddresses(node, await env.ruleEngine.resolveExpression(expression, ctx));
+    const to = await addresses(cfg.to);
+    if (!to.length) return null;
+    // Someone already on `to` gets the email once.
+    const listed = new Set(to.map((address)=>address.toLowerCase()));
+    const notListed = (list)=>{
+        const kept = list.filter((address)=>!listed.has(address.toLowerCase()));
+        kept.forEach((address)=>listed.add(address.toLowerCase()));
+        return kept;
+    };
+    const cc = notListed(await addresses(cfg.cc));
+    const bcc = notListed(await addresses(cfg.bcc));
+    const recipients = to.length + cc.length + bcc.length;
+    assertRecipientCount(node, recipients, flow_types/* .FLOW_LIMITS.MAX_EMAIL_RECIPIENTS */.Or.MAX_EMAIL_RECIPIENTS);
+    const replyTo = await addresses(cfg.replyTo);
+    if (replyTo.length > 1) {
+        throw new flow_errors/* .FlowHttpError */.hk(400, `"${replyTo.join(', ')}" is not a single email address.`, undefined, {
+            messageKey: message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_ADDRESS_INVALID */.zr.EMAIL_ADDRESS_INVALID,
+            messageVariables: {
+                node: (0,flow_types/* .nodeLabel */.dA)(node),
+                address: shown(replyTo.join(', '))
+            }
+        });
+    }
+    const base = {
+        to,
+        ...cc.length ? {
+            cc
+        } : {},
+        ...bcc.length ? {
+            bcc
+        } : {},
+        ...replyTo.length ? {
+            replyTo: replyTo[0]
+        } : {},
+        ...cfg.emailConfigId ? {
+            emailConfigId: cfg.emailConfigId
+        } : {}
+    };
+    const user = state.user;
+    if (cfg.mode === 'template') {
+        const variables = await mapValues(cfg.variables, env, state);
+        const templateSlug = (cfg.templateSlug ?? '').trim();
+        return {
+            recipients,
+            send: ()=>email.sendTemplate({
+                    ...base,
+                    templateSlug,
+                    variables
+                }, user)
+        };
+    }
+    // A line break in a subject would start a new mail header.
+    const subject = asText(cfg.subject === undefined ? '' : await env.ruleEngine.resolveExpression(cfg.subject, ctx)).replace(/[\r\n]+/g, ' ').trim().slice(0, flow_types/* .FLOW_LIMITS.MAX_EMAIL_SUBJECT_LENGTH */.Or.MAX_EMAIL_SUBJECT_LENGTH);
+    if (!subject) throw new flow_errors/* .FlowHttpError */.hk(400, `The subject of "${(0,flow_types/* .nodeLabel */.dA)(node)}" is empty.`, undefined, {
+        messageKey: message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_SUBJECT_EMPTY */.zr.EMAIL_SUBJECT_EMPTY,
+        messageVariables: {
+            node: (0,flow_types/* .nodeLabel */.dA)(node)
+        }
+    });
+    const html = cfg.format === 'html';
+    const body = cfg.body === undefined ? '' : asText(html ? await env.ruleEngine.resolveHtml(cfg.body, ctx) : await env.ruleEngine.resolveExpression(cfg.body, ctx));
+    if (!body.trim()) throw new flow_errors/* .FlowHttpError */.hk(400, `The message of "${(0,flow_types/* .nodeLabel */.dA)(node)}" is empty.`, undefined, {
+        messageKey: message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_BODY_EMPTY */.zr.EMAIL_BODY_EMPTY,
+        messageVariables: {
+            node: (0,flow_types/* .nodeLabel */.dA)(node)
+        }
+    });
+    return {
+        recipients,
+        send: ()=>email.send({
+                ...base,
+                subject,
+                ...html ? {
+                    html: body
+                } : {
+                    text: body
+                }
+            }, user)
+    };
+}
+/**
+ * one: `{ status, recipients, messageId }`. many: `{ status, count, recipients, skipped, messageIds }`
+ * (one id per email sent, in order). `status` is `sent`, or `queued` inside a transaction (sent once it
+ * commits, no ids yet). Every email is checked before the first goes out; no address at all skips the
+ * step, and a test run checks everything but sends nothing.
+ */ async function runSendEmail(node, cfg, env, state) {
+    const email = env.email;
+    if (!email) throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_UNAVAILABLE */.zr.EMAIL_UNAVAILABLE, {
+        node: (0,flow_types/* .nodeLabel */.dA)(node)
+    }, `"${(0,flow_types/* .nodeLabel */.dA)(node)}" needs the email module, which this app does not run.`);
+    const many = cfg.target === 'many';
+    let emails;
+    let skippedItems = 0;
+    if (many) {
+        const items = await resolveList(node, cfg.items, flow_types/* .FLOW_LIMITS.MAX_MESSAGES_PER_RUN */.Or.MAX_MESSAGES_PER_RUN, env, state);
+        const prepared = await eachItem(state, items, ()=>prepareEmail(node, cfg, email, env, state));
+        emails = prepared.filter((item)=>item !== null);
+        skippedItems = prepared.length - emails.length;
+    } else {
+        emails = [
+            await prepareEmail(node, cfg, email, env, state)
+        ].filter((prepared)=>prepared !== null);
+    }
+    if (!emails.length) return nobody(many ? {
+        count: 0,
+        skipped: skippedItems
+    } : {});
+    const recipients = emails.reduce((sum, prepared)=>sum + prepared.recipients, 0);
+    const messageIds = [];
+    const sent = await sendAll(node, state, emails, message_keys/* .FLOW_SKIP_MESSAGES.EMAIL */.CB.EMAIL, recipients, async (prepared)=>{
+        let result;
+        try {
+            result = await prepared.send();
+        } catch (error) {
+            throw sendFailure(message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_FAILED */.zr.EMAIL_FAILED, node, error);
+        }
+        if (!result?.success) throw sendFailure(message_keys/* .FLOW_ERROR_MESSAGES.EMAIL_FAILED */.zr.EMAIL_FAILED, node, result?.error || 'The email was not accepted.');
+        messageIds.push(result.messageId ?? null);
+    });
+    if (typeof sent !== 'string') return sent;
+    if (!many) return {
+        output: {
+            status: sent,
+            recipients,
+            messageId: messageIds[0] ?? null
+        }
+    };
+    return {
+        output: {
+            status: sent,
+            count: emails.length,
+            recipients,
+            skipped: skippedItems,
+            messageIds
+        }
+    };
+}
 /** Runs one node. Ports/branching/looping are the executor's job; this only does the node's own work. */ async function runNode(node, env, state) {
     const ctx = evaluationContext(state, env);
     const c = node.config;
@@ -911,6 +1346,8 @@ async function insertChildren(node, child, parentId, env, state) {
             return runCode(node, c, state);
         case 'permission_check':
             return runPermissionCheck(c, env, state);
+        case 'company_branch_check':
+            return runCompanyBranchCheck(c, env, state);
         case 'set':
             {
                 const cfg = c;
@@ -967,7 +1404,6 @@ async function insertChildren(node, child, parentId, env, state) {
         case 'entity_get':
             {
                 const cfg = c;
-                await authorize(env, state, cfg.entityCode, 'read');
                 const id = asId(await env.ruleEngine.resolveExpression(cfg.id, ctx));
                 const service = await env.entityService(cfg.entityCode, state.qr);
                 try {
@@ -984,7 +1420,6 @@ async function insertChildren(node, child, parentId, env, state) {
         case 'entity_query':
             {
                 const cfg = c;
-                await authorize(env, state, cfg.entityCode, 'read');
                 const service = await env.entityService(cfg.entityCode, state.qr);
                 const filter = await mapFilter(node, cfg.filter, env, state, 'skip');
                 const search = cfg.search ? await env.ruleEngine.resolveExpression(cfg.search, ctx) : undefined;
@@ -1061,6 +1496,7 @@ async function insertChildren(node, child, parentId, env, state) {
                         k,
                         String(v ?? '')
                     ]));
+                if (cfg.forwardAuth === true && state.authorization && !Object.keys(headers).some((name)=>name.toLowerCase() === 'authorization')) headers['authorization'] = state.authorization;
                 const body = cfg.body && Object.keys(cfg.body).length ? await mapValues(cfg.body, env, state) : undefined;
                 const remaining = state.deadline - Date.now();
                 if (remaining <= 0) throw new flow_errors/* .FlowLimitError */.IM(message_keys/* .FLOW_ERROR_MESSAGES.OUT_OF_TIME */.zr.OUT_OF_TIME);
@@ -1099,6 +1535,10 @@ async function insertChildren(node, child, parentId, env, state) {
                     }
                 };
             }
+        case 'send_notification':
+            return runSendNotification(node, c, env, state);
+        case 'send_email':
+            return runSendEmail(node, c, env, state);
         case 'respond':
             {
                 const cfg = c;
@@ -1382,11 +1822,11 @@ function successResult(state, startedAt) {
 /* import */ var _config_entity_builder_constants_js__rspack_import_8 = __webpack_require__(6576);
 /* import */ var _config_message_keys_js__rspack_import_7 = __webpack_require__(5732);
 /* import */ var _interfaces_generic_record_interface_js__rspack_import_1 = __webpack_require__(3372);
-/* import */ var _rule_engine_index_js__rspack_import_2 = __webpack_require__(5920);
+/* import */ var _rule_engine_index_js__rspack_import_2 = __webpack_require__(8552);
 /* import */ var _rule_engine_rule_ip_js__rspack_import_3 = __webpack_require__(809);
 /* import */ var _rule_engine_rule_permission_js__rspack_import_4 = __webpack_require__(5191);
-/* import */ var _rule_engine_rule_regex_js__rspack_import_5 = __webpack_require__(6308);
-/* import */ var _flow_types_js__rspack_import_6 = __webpack_require__(6256);
+/* import */ var _flow_types_js__rspack_import_5 = __webpack_require__(6256);
+/* import */ var _flow_api_key_js__rspack_import_6 = __webpack_require__(4816);
 
 
 
@@ -1530,7 +1970,14 @@ const DURATION_ARG = {
         case 'lookup':
             for (const item of Object.values(expression.filter ?? {})){
                 const value = (0,_interfaces_generic_record_interface_js__rspack_import_1/* .isRecordFilterCondition */.t1)(item) ? item.value : item;
-                if (isExpression(value)) collectExpressionRefs(value, out);
+                for (const operand of (0,_interfaces_generic_record_interface_js__rspack_import_1/* .isFilterRange */.iA)(value) ? [
+                    value.from,
+                    value.to
+                ] : [
+                    value
+                ]){
+                    if (isExpression(operand)) collectExpressionRefs(operand, out);
+                }
             }
             break;
     }
@@ -1651,7 +2098,7 @@ function functionProblem(value, depth, options) {
     return null;
 }
 function patternProblem(pattern) {
-    switch((0,_rule_engine_rule_regex_js__rspack_import_5/* .rulePatternProblem */._V)(pattern)){
+    switch((0,_flusys_nestjs_shared_utils__rspack_import_0.safeRegexProblem)(pattern)){
         case 'too_long':
             return (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SHAPE_MESSAGES.REGEX_TOO_LONG */.IP.REGEX_TOO_LONG, {
                 max: _rule_engine_index_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_REGEX_PATTERN_LENGTH */.bw.MAX_REGEX_PATTERN_LENGTH
@@ -1694,11 +2141,16 @@ function lookupProblem(value, depth, options) {
         });
         return expressionProblem(item, depth + 1, options);
     }
-    if (item.op === 'is_null' || item.op === 'not_null') return null;
+    const kind = _interfaces_generic_record_interface_js__rspack_import_1/* .FILTER_OP_VALUE_KIND */.w9[item.op];
+    if (kind === 'none') return null;
     if (item.value === undefined) return (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SHAPE_MESSAGES.FILTER_VALUE_REQUIRED */.IP.FILTER_VALUE_REQUIRED, {
         op: item.op
     });
-    return expressionProblem(item.value, depth + 1, options);
+    if (kind !== 'range') return expressionProblem(item.value, depth + 1, options);
+    if (!(0,_interfaces_generic_record_interface_js__rspack_import_1/* .isFilterRange */.iA)(item.value)) return (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SHAPE_MESSAGES.FILTER_RANGE_INVALID */.IP.FILTER_RANGE_INVALID, {
+        op: item.op
+    });
+    return expressionProblem(item.value.from, depth + 1, options) ?? expressionProblem(item.value.to, depth + 1, options);
 }
 function firstProblem(items, depth, options) {
     for (const item of items){
@@ -1744,39 +2196,29 @@ function conditionProblem(node, options) {
 /**
  * Save-time check of a whole flow: structure (Request steps with distinct URLs, valid ids/ports, no cycles),
  * every node's configuration, every reference to another node, and the combination of
- * settings (run-as / auth / transaction). Pure: no I/O, so the same result is what the
+ * settings (auth / transaction). Pure: no I/O, so the same result is what the
  * designer shows and what the server enforces.
  */ function validateFlow(flow, context = {}) {
     const errors = [];
     const warnings = [];
     const err = (message)=>errors.push(message);
-    if (!_flow_types_js__rspack_import_6/* .FLOW_SLUG_PATTERN.test */.YD.test(flow.slug ?? '')) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.SLUG_INVALID */.qj.SLUG_INVALID));
-    if (!_flow_types_js__rspack_import_6/* .FLOW_RUN_AS.includes */.gl.includes(flow.runAs)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.RUN_AS_INVALID */.qj.RUN_AS_INVALID, {
-        runAs: String(flow.runAs)
-    }));
-    if (!_flow_types_js__rspack_import_6/* .FLOW_AUTH_MODES.includes */.fO.includes(flow.authMode)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.AUTH_MODE_INVALID */.qj.AUTH_MODE_INVALID, {
-        authMode: String(flow.authMode)
-    }));
-    if (flow.runAs === 'caller' && flow.authMode !== 'jwt' && flow.authMode !== 'permission' && flow.authMode !== 'internal') {
-        err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.RUN_AS_CALLER_NEEDS_AUTH */.qj.RUN_AS_CALLER_NEEDS_AUTH));
-    }
-    validateInputSchema(flow, err);
+    if (!_flow_types_js__rspack_import_5/* .FLOW_SLUG_PATTERN.test */.YD.test(flow.slug ?? '')) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.SLUG_INVALID */.qj.SLUG_INVALID));
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
     const edges = Array.isArray(flow.edges) ? flow.edges : [];
     if (!nodes.length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NO_NODES */.qj.NO_NODES));
-    if (nodes.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_NODES */.qj.TOO_MANY_NODES, {
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES
+    if (nodes.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_NODES */.qj.TOO_MANY_NODES, {
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES
     }));
-    if (edges.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_EDGES */.qj.TOO_MANY_EDGES, {
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES
+    if (edges.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_EDGES */.qj.TOO_MANY_EDGES, {
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES
     }));
-    if (errors.length && (!nodes.length || nodes.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES || edges.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES)) return {
+    if (errors.length && (!nodes.length || nodes.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES || edges.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES)) return {
         errors,
         warnings
     };
     const byId = new Map();
     for (const node of nodes){
-        if (!_flow_types_js__rspack_import_6/* .FLOW_NODE_ID_PATTERN.test */.z6.test(node?.id ?? '')) {
+        if (!_flow_types_js__rspack_import_5/* .FLOW_NODE_ID_PATTERN.test */.z6.test(node?.id ?? '')) {
             err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_ID_INVALID */.qj.NODE_ID_INVALID, {
                 id: node?.id
             }));
@@ -1786,7 +2228,7 @@ function conditionProblem(node, options) {
             id: node.id
         }));
         byId.set(node.id, node);
-        if (!_flow_types_js__rspack_import_6/* .FLOW_NODE_TYPES.includes */.q2.includes(node.type)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_TYPE_UNKNOWN */.qj.NODE_TYPE_UNKNOWN, {
+        if (!_flow_types_js__rspack_import_5/* .FLOW_NODE_TYPES.includes */.q2.includes(node.type)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_TYPE_UNKNOWN */.qj.NODE_TYPE_UNKNOWN, {
             id: node.id,
             type: node.type
         }));
@@ -1816,7 +2258,7 @@ function conditionProblem(node, options) {
             id: edge.from
         }));
         if (to.type === 'trigger') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.EDGE_INTO_TRIGGER */.qj.EDGE_INTO_TRIGGER));
-        if (!(0,_flow_types_js__rspack_import_6/* .portsOf */.a5)(from).includes(edge.port)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.EDGE_NO_PORT */.qj.EDGE_NO_PORT, {
+        if (!(0,_flow_types_js__rspack_import_5/* .portsOf */.a5)(from).includes(edge.port)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.EDGE_NO_PORT */.qj.EDGE_NO_PORT, {
             id: from.id,
             port: edge.port
         }));
@@ -1845,36 +2287,86 @@ function conditionProblem(node, options) {
         ])) : null;
     for (const node of nodes){
         if (reachable && !reachable.has(node.id)) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_UNREACHABLE */.qj.NODE_UNREACHABLE, {
-            node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node)
+            node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node)
         }));
     }
     checkNodeReferences(nodes, byId, flow, err, warnings);
     if (!cyclic && reachable) checkReferenceTiming(nodes, edges, byId, reachable, warnings);
     if (!cyclic) checkLoopDepth(nodes, outgoing, err);
-    if (flow.isTransactional && nodes.some((n)=>n.type === 'http_request')) {
-        warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRANSACTIONAL_HTTP */.qj.TRANSACTIONAL_HTTP));
-    }
-    checkTransactionUse(flow, nodes, outgoing, reachable, context, warnings);
-    if (flow.runAs === 'system' && flow.authMode === 'public' && nodes.some((n)=>n.type.startsWith('entity_') || collectLookupEntities(n.config).size > 0)) {
-        warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.PUBLIC_SYSTEM_ENTITY */.qj.PUBLIC_SYSTEM_ENTITY));
-    }
-    if ((flow.authMode === 'public' || flow.authMode === 'api_key') && nodes.some((n)=>n.type === 'permission_check' || usesPermissionFunction(n.config))) {
-        warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.PERMISSION_WITHOUT_USER */.qj.PERMISSION_WITHOUT_USER));
-    }
+    // Transaction and access are a Request step's own: each is checked against the steps its runs reach.
+    const runs = (0,_flow_types_js__rspack_import_5/* .flowEndpoints */.Xr)(flow).map((endpoint)=>({
+            endpoint,
+            label: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(byId.get(endpoint.nodeId) ?? {
+                id: endpoint.nodeId,
+                name: ''
+            }),
+            steps: [
+                ...reach(endpoint.nodeId, outgoing)
+            ].map((id)=>byId.get(id)).filter((node)=>!!node)
+        }));
+    checkEndpointRuns(runs, warnings);
+    checkTransactionUse(flow, runs, outgoing, context, warnings);
     return {
         errors,
         warnings
     };
 }
+/** The entities a step reads or writes: its own, its child inserts' and those its lookups read. */ function entitiesOf(node) {
+    const codes = collectLookupEntities(node.config);
+    if (node.type.startsWith('entity_') && typeof node.config?.['entityCode'] === 'string') codes.add(node.config['entityCode']);
+    const children = node.type === 'entity_insert' && Array.isArray(node.config?.['children']) ? node.config['children'] : [];
+    for (const child of children)if (typeof child?.entityCode === 'string') codes.add(child.entityCode);
+    return [
+        ...codes
+    ];
+}
+/** What depends on a Request step's access and transaction, for the steps its runs reach. A finding shared by several Request steps is reported once. */ function checkEndpointRuns(runs, warnings) {
+    const reported = new Set();
+    const warnOnce = (message)=>{
+        const key = JSON.stringify(message);
+        if (reported.has(key)) return;
+        reported.add(key);
+        warnings.push(message);
+    };
+    const keyless = {
+        endpoints: [],
+        entities: new Set()
+    };
+    for (const { endpoint, label, steps } of runs){
+        if (endpoint.isTransactional) {
+            if (steps.some((n)=>n.type === 'http_request')) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRANSACTIONAL_HTTP */.qj.TRANSACTIONAL_HTTP, {
+                node: label
+            }));
+            // Inside the run's transaction a message is only sent once it commits: a failed send is logged, it cannot take the error path.
+            for (const n of steps)if ((0,_flow_types_js__rspack_import_5/* .isMessageNode */.SE)(n.type) && n.onError === 'continue') warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.MESSAGE_AFTER_COMMIT */.qj.MESSAGE_AFTER_COMMIT, {
+                node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(n)
+            }));
+        }
+        if (endpoint.authMode === 'public' && steps.some((n)=>(0,_flow_types_js__rspack_import_5/* .isMessageNode */.SE)(n.type))) warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.PUBLIC_MESSAGE */.qj.PUBLIC_MESSAGE));
+        // A URL callers reach without signing in has no user: user checks deny them, and its record steps are open to anyone who can call it.
+        if (!_flow_types_js__rspack_import_5/* .KEYLESS_AUTH_MODES.has */.d7.has(endpoint.authMode)) continue;
+        if (steps.some((n)=>(n.type === 'permission_check' || n.type === 'company_branch_check') && n.config?.['subject'] !== 'user' || usesPermissionFunction(n.config))) warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.PERMISSION_WITHOUT_USER */.qj.PERMISSION_WITHOUT_USER));
+        const entities = steps.flatMap(entitiesOf);
+        if (!entities.length) continue;
+        keyless.endpoints.push(endpoint.path ? `/${endpoint.path}` : '/');
+        for (const code of entities)keyless.entities.add(code);
+    }
+    if (keyless.endpoints.length) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.KEYLESS_ENTITY */.qj.KEYLESS_ENTITY, {
+        endpoints: keyless.endpoints.join(', '),
+        entities: [
+            ...keyless.entities
+        ].join(', ')
+    }));
+}
 /** At least one Request step; at most one on the flow's own URL, the others on distinct paths. */ function checkTriggers(triggers, err) {
     if (!triggers.length) return err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_MISSING */.qj.TRIGGER_MISSING));
-    const main = triggers.filter((trigger)=>!(0,_flow_types_js__rspack_import_6/* .triggerPath */.um)(trigger));
+    const main = triggers.filter((trigger)=>!(0,_flow_types_js__rspack_import_5/* .triggerPath */.um)(trigger));
     if (main.length > 1) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_MAIN_DUPLICATE */.qj.TRIGGER_MAIN_DUPLICATE, {
         count: main.length
     }));
     const paths = new Set();
     for (const trigger of triggers){
-        const path = (0,_flow_types_js__rspack_import_6/* .triggerPath */.um)(trigger);
+        const path = (0,_flow_types_js__rspack_import_5/* .triggerPath */.um)(trigger);
         if (!path) continue;
         if (paths.has(path)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_DUPLICATE */.qj.TRIGGER_PATH_DUPLICATE, {
             path
@@ -1883,23 +2375,24 @@ function conditionProblem(node, options) {
     }
 }
 /**
- * What the runtime would always refuse, caught on save: an API-key flow called by a flow running
- * as the caller, a required input left out, a chain that comes back to this flow or nests deeper
+ * What the runtime would always refuse, caught on save: an API-key URL (a flow has no key to send),
+ * a required input left out, a chain that comes back to this flow or nests deeper
  * than the limit. An inactive flow and an input the called flow does not declare are warnings.
- */ function checkCalledFlow(slug, endpoint, input, inputList, flow, known, at, err, warn) {
+ */ function checkCalledFlow(node, flow, known, err, warn) {
+    const { flowSlug: slug, endpoint, input, inputList } = node.config;
+    const at = {
+        node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node)
+    };
     const target = known.get(slug);
     const vars = {
         ...at,
         flow: slug
     };
     if (!target.isActive) warn.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_INACTIVE */.qj.NODE_FLOW_INACTIVE, vars));
-    if (target.authMode === 'api_key') {
-        // A function runs as whoever calls it, so it fails only when a flow running as the caller does.
-        if (flow.authMode === 'internal') warn.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_API_KEY */.qj.NODE_FLOW_API_KEY, vars));
-        else if (flow.runAs === 'caller') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_API_KEY */.qj.NODE_FLOW_API_KEY, vars));
-    }
     const path = typeof endpoint === 'string' && endpoint ? endpoint : null;
     const entry = target.endpoints.find((e)=>e.path === path);
+    // A flow has no key to send, so an API-key URL is never callable from one.
+    if (entry?.authMode === 'api_key') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_API_KEY */.qj.NODE_FLOW_API_KEY, vars));
     if (!entry) {
         err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(path ? _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_ENDPOINT_UNKNOWN */.qj.NODE_FLOW_ENDPOINT_UNKNOWN : _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_ENDPOINT_REQUIRED */.qj.NODE_FLOW_ENDPOINT_REQUIRED, {
             ...vars,
@@ -1920,11 +2413,40 @@ function conditionProblem(node, options) {
             ...loop
         ].join(' > ')
     }));
-    if (1 + callDepth(slug, known, new Set()) > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_TOO_DEEP */.qj.NODE_FLOW_TOO_DEEP, {
+    if (1 + callDepth(slug, known, new Set()) > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_TOO_DEEP */.qj.NODE_FLOW_TOO_DEEP, {
         ...at,
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH
     }));
 }
+/**
+ * What the Call flow steps of `caller` whose call chain reaches `slug` (that flow itself, or one
+ * that calls it, however deep) would hit against the flows in `known`: the save errors of those
+ * steps, and the flow they run being off (a warning on save, a failure at run).
+ */ function callProblems(caller, slug, known) {
+    const problems = [];
+    for (const node of Array.isArray(caller.nodes) ? caller.nodes : []){
+        const c = node?.config ?? {};
+        if (node?.type !== 'call_flow' || typeof c.flowSlug !== 'string') continue;
+        if (c.flowSlug !== slug && !callPathTo(c.flowSlug, slug, known, new Set())) continue;
+        const at = {
+            node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node)
+        };
+        const target = known.get(c.flowSlug);
+        if (!target) {
+            problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_UNKNOWN */.qj.NODE_FLOW_UNKNOWN, {
+                ...at,
+                flow: c.flowSlug
+            }));
+            continue;
+        }
+        if (!target.isActive) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_INACTIVE */.qj.NODE_FLOW_INACTIVE, {
+            ...at,
+            flow: c.flowSlug
+        }));
+        checkCalledFlow(node, caller, known, (m)=>problems.push(m), []);
+    }
+    return problems;
+}
 /** The named inputs sent to a flow whose body is an object: every required one given, the rest declared. */ function checkCalledInputs(input, schema, vars, err, warn) {
     const given = input && typeof input === 'object' && !Array.isArray(input) ? Object.keys(input) : [];
     if (schema.length) {
@@ -1959,39 +2481,33 @@ function conditionProblem(node, options) {
     return null;
 }
 /** How many calls deep the longest chain starting inside `slug` goes, counted only as far as the limit; a chain that loops is cut where it repeats. */ function callDepth(slug, known, running) {
-    if (running.has(slug) || running.size > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH) return 0;
+    if (running.has(slug) || running.size > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH) return 0;
     running.add(slug);
     let deepest = 0;
     for (const next of new Set(known.get(slug)?.calls ?? []))deepest = Math.max(deepest, 1 + callDepth(next, known, running));
     running.delete(slug);
     return deepest;
 }
-function validateInputSchema(flow, err) {
-    if (flow.bodyType !== undefined && !_flow_types_js__rspack_import_6/* .FLOW_BODY_TYPES.includes */.Y3.includes(flow.bodyType)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.BODY_TYPE_UNKNOWN */.qj.BODY_TYPE_UNKNOWN, {
-        type: String(flow.bodyType)
-    }));
-    validateInputFields(flow.inputSchema ?? [], '', 1, err);
-}
 /** One level of the request body: the top-level fields, or the fields of an object / list item at `prefix`. */ function validateInputFields(fields, prefix, depth, err) {
-    if (fields.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_INPUT_FIELDS */.Or.MAX_INPUT_FIELDS) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_TOO_MANY */.qj.INPUT_TOO_MANY, {
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_INPUT_FIELDS */.Or.MAX_INPUT_FIELDS
+    if (fields.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_INPUT_FIELDS */.Or.MAX_INPUT_FIELDS) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_TOO_MANY */.qj.INPUT_TOO_MANY, {
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_INPUT_FIELDS */.Or.MAX_INPUT_FIELDS
     }));
     const seen = new Set();
     for (const field of fields){
         const name = `${prefix}${field?.name ?? ''}`;
-        if (!_flow_types_js__rspack_import_6/* .FLOW_INPUT_NAME_PATTERN.test */.fZ.test(field?.name ?? '')) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_NAME_INVALID */.qj.INPUT_NAME_INVALID, {
+        if (!_flow_types_js__rspack_import_5/* .FLOW_INPUT_NAME_PATTERN.test */.fZ.test(field?.name ?? '')) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_NAME_INVALID */.qj.INPUT_NAME_INVALID, {
             name
         }));
         else if (seen.has(field.name)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_NAME_DUPLICATE */.qj.INPUT_NAME_DUPLICATE, {
             name
         }));
         seen.add(field?.name);
-        if (!_flow_types_js__rspack_import_6/* .FLOW_INPUT_TYPES.includes */.Q7.includes(field?.type)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_TYPE_UNKNOWN */.qj.INPUT_TYPE_UNKNOWN, {
+        if (!_flow_types_js__rspack_import_5/* .FLOW_INPUT_TYPES.includes */.Q7.includes(field?.type)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_TYPE_UNKNOWN */.qj.INPUT_TYPE_UNKNOWN, {
             name,
             type: field?.type
         }));
         const itemType = field?.type === 'array' ? field.itemType : undefined;
-        if (itemType !== undefined && (itemType === 'array' || !_flow_types_js__rspack_import_6/* .FLOW_INPUT_TYPES.includes */.Q7.includes(itemType))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_ITEM_TYPE_UNKNOWN */.qj.INPUT_ITEM_TYPE_UNKNOWN, {
+        if (itemType !== undefined && (itemType === 'array' || !_flow_types_js__rspack_import_5/* .FLOW_INPUT_TYPES.includes */.Q7.includes(itemType))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_ITEM_TYPE_UNKNOWN */.qj.INPUT_ITEM_TYPE_UNKNOWN, {
             name,
             type: itemType
         }));
@@ -2000,10 +2516,10 @@ function validateInputSchema(flow, err) {
         }));
         const holdsFields = field?.type === 'object' || itemType === 'object';
         if (!holdsFields || !Array.isArray(field.fields) || !field.fields.length) continue;
-        if (depth >= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_INPUT_DEPTH */.Or.MAX_INPUT_DEPTH) {
+        if (depth >= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_INPUT_DEPTH */.Or.MAX_INPUT_DEPTH) {
             err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_TOO_DEEP */.qj.INPUT_TOO_DEEP, {
                 name,
-                max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_INPUT_DEPTH */.Or.MAX_INPUT_DEPTH
+                max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_INPUT_DEPTH */.Or.MAX_INPUT_DEPTH
             }));
             continue;
         }
@@ -2012,7 +2528,7 @@ function validateInputSchema(flow, err) {
 }
 function validateNodeConfig(node, flow, context, err, warn) {
     const at = {
-        node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node)
+        node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node)
     };
     const c = node.config ?? {};
     const shape = {
@@ -2100,18 +2616,59 @@ function validateNodeConfig(node, flow, context, err, warn) {
         response: {
             list: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.RESPONSE_VALUES */.bc.RESPONSE_VALUES,
             item: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.RESPONSE_VALUE */.bc.RESPONSE_VALUE
+        },
+        data: {
+            list: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.DATA_VALUES */.bc.DATA_VALUES,
+            item: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.DATA_VALUE */.bc.DATA_VALUE
+        },
+        template: {
+            list: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.TEMPLATE_VALUES */.bc.TEMPLATE_VALUES,
+            item: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.TEMPLATE_VALUE */.bc.TEMPLATE_VALUE
         }
     };
+    const optionalExpr = (value, what)=>{
+        if (value !== undefined) expr(value, what);
+    };
+    /** An AND / OR rule of permission codes: one that names none needs a permission, a malformed one is `invalid`. */ const permissionRule = (value, invalid)=>{
+        const problem = (0,_flusys_nestjs_shared_utils__rspack_import_0.permissionLogicProblem)(value);
+        if (problem === 'empty') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_REQUIRED */.qj.NODE_PERMISSION_REQUIRED, at));
+        else if (problem === 'too_many') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .RULE_ENGINE_MESSAGES.TOO_MANY_PERMISSION_CODES */.x3.TOO_MANY_PERMISSION_CODES, {
+            max: _rule_engine_index_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_PERMISSION_CODES */.bw.MAX_PERMISSION_CODES
+        }));
+        else if (problem) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(invalid, at));
+    };
+    const serviceRunning = (service, unavailable)=>{
+        if (context.messageServices && !context.messageServices[service]) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(unavailable, at));
+    };
     switch(node.type){
         case 'trigger':
             {
-                if (c.path !== undefined && c.path !== '' && (typeof c.path !== 'string' || !_flow_types_js__rspack_import_6/* .FLOW_ENDPOINT_PATH_PATTERN.test */.YO.test(c.path))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_INVALID */.qj.TRIGGER_PATH_INVALID, at));
-                const path = (0,_flow_types_js__rspack_import_6/* .triggerPath */.um)(node);
-                if (!path) break;
-                if (c.bodyType !== undefined && !_flow_types_js__rspack_import_6/* .FLOW_BODY_TYPES.includes */.Y3.includes(c.bodyType)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.BODY_TYPE_UNKNOWN */.qj.BODY_TYPE_UNKNOWN, {
+                if (c.path !== undefined && c.path !== '' && (typeof c.path !== 'string' || !_flow_types_js__rspack_import_5/* .FLOW_ENDPOINT_PATH_PATTERN.test */.YO.test(c.path))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_INVALID */.qj.TRIGGER_PATH_INVALID, at));
+                if (c.authMode !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_AUTH_MODES.includes */.fO.includes(c.authMode)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_AUTH_INVALID */.qj.TRIGGER_AUTH_INVALID, at));
+                if (c.permissions !== undefined) permissionRule(c.permissions, _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_AUTH_INVALID */.qj.TRIGGER_AUTH_INVALID);
+                if (c.isTransactional !== undefined && typeof c.isTransactional !== 'boolean') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_TRANSACTION_INVALID */.qj.TRIGGER_TRANSACTION_INVALID, at));
+                if (c.timeoutMs !== undefined && !(Number.isInteger(c.timeoutMs) && c.timeoutMs >= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MIN_TIMEOUT_MS */.Or.MIN_TIMEOUT_MS && c.timeoutMs <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_TIMEOUT_MS */.Or.MAX_TIMEOUT_MS)) {
+                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_TIMEOUT_RANGE */.qj.TRIGGER_TIMEOUT_RANGE, {
+                        ...at,
+                        min: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MIN_TIMEOUT_MS */.Or.MIN_TIMEOUT_MS / 1000,
+                        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_TIMEOUT_MS */.Or.MAX_TIMEOUT_MS / 1000
+                    }));
+                }
+                if (c.rateLimitPerMinute !== undefined && !(Number.isInteger(c.rateLimitPerMinute) && c.rateLimitPerMinute >= 0 && c.rateLimitPerMinute <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_RATE_LIMIT_PER_MINUTE */.Or.MAX_RATE_LIMIT_PER_MINUTE)) {
+                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_RATE_LIMIT_RANGE */.qj.TRIGGER_RATE_LIMIT_RANGE, {
+                        ...at,
+                        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_RATE_LIMIT_PER_MINUTE */.Or.MAX_RATE_LIMIT_PER_MINUTE
+                    }));
+                }
+                // Without a key an API-key URL could never be called; any other access keeps none.
+                if (c.authMode === 'api_key' && c.apiKey === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_API_KEY_REQUIRED */.qj.TRIGGER_API_KEY_REQUIRED, at));
+                else if (c.apiKey !== undefined && !(0,_flow_api_key_js__rspack_import_6/* .looksLikeApiKey */.Jb)(c.apiKey) && !(0,_flow_types_js__rspack_import_5/* .isStoredApiKey */.xA)(c.apiKey)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_API_KEY_INVALID */.qj.TRIGGER_API_KEY_INVALID, at));
+                // Field errors are named after the URL (`<path>: <field>`) once a flow has several.
+                const path = (0,_flow_types_js__rspack_import_5/* .triggerPath */.um)(node);
+                if (c.bodyType !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_BODY_TYPES.includes */.Y3.includes(c.bodyType)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.BODY_TYPE_UNKNOWN */.qj.BODY_TYPE_UNKNOWN, {
                     type: String(c.bodyType)
                 }));
-                validateInputFields(Array.isArray(c.inputSchema) ? c.inputSchema : [], `${path}: `, 1, err);
+                validateInputFields(Array.isArray(c.inputSchema) ? c.inputSchema : [], path ? `${path}: ` : '', 1, err);
                 break;
             }
         case 'validate':
@@ -2123,16 +2680,39 @@ function validateNodeConfig(node, flow, context, err, warn) {
             break;
         case 'permission_check':
             {
-                try {
-                    if (!(0,_rule_engine_rule_permission_js__rspack_import_4/* .parsePermissionCodes */.PS)(c.codes).length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_REQUIRED */.qj.NODE_PERMISSION_REQUIRED, at));
-                } catch  {
-                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .RULE_ENGINE_MESSAGES.TOO_MANY_PERMISSION_CODES */.x3.TOO_MANY_PERMISSION_CODES, {
-                        max: _rule_engine_index_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_PERMISSION_CODES */.bw.MAX_PERMISSION_CODES
-                    }));
+                if (c.permissions === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_REQUIRED */.qj.NODE_PERMISSION_REQUIRED, at));
+                else permissionRule(c.permissions, _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID);
+                if (c.subject !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_ACCESS_SUBJECTS.includes */.iM.includes(c.subject)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
+                if (c.subject === 'user') {
+                    if (c.userId === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_ACCESS_USER_REQUIRED */.qj.NODE_ACCESS_USER_REQUIRED, at));
+                    else expr(c.userId, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_USER */.bc.THE_USER));
+                }
+                if (c.companyId !== undefined) expr(c.companyId, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_COMPANY */.bc.THE_COMPANY));
+                if (c.branchId !== undefined) expr(c.branchId, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_BRANCH */.bc.THE_BRANCH));
+                if (c.onDenied !== undefined && c.onDenied !== 'reject' && c.onDenied !== 'branch') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
+                if (c.message !== undefined && typeof c.message !== 'string') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
+                if (c.statusCode !== undefined && !(Number.isInteger(c.statusCode) && c.statusCode >= 400 && c.statusCode <= 499)) {
+                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_STATUS_4XX */.qj.NODE_STATUS_4XX, at));
+                }
+                break;
+            }
+        case 'company_branch_check':
+            {
+                if (c.subject !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_ACCESS_SUBJECTS.includes */.iM.includes(c.subject)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
+                if (c.branchMatch !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_BRANCH_MATCHES.includes */.Et.includes(c.branchMatch)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
+                if (c.subject === 'user') {
+                    if (c.userId === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_ACCESS_USER_REQUIRED */.qj.NODE_ACCESS_USER_REQUIRED, at));
+                    else expr(c.userId, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_USER */.bc.THE_USER));
+                }
+                // Another user has no current company.
+                if (c.branchCompany !== undefined && (!_flow_types_js__rspack_import_5/* .FLOW_BRANCH_COMPANIES.includes */.sk.includes(c.branchCompany) || c.branchCompany === 'current' && c.subject === 'user')) {
+                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
                 }
-                if (c.match !== undefined && c.match !== 'any' && c.match !== 'all') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
+                if (c.companyIds !== undefined) expr(c.companyIds, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_VALUE */.bc.THE_VALUE));
+                if (c.branchIds !== undefined) expr(c.branchIds, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_VALUE */.bc.THE_VALUE));
                 if (c.onDenied !== undefined && c.onDenied !== 'reject' && c.onDenied !== 'branch') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
-                if (c.branch !== undefined && c.branch !== null) expr(c.branch, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_VALUE */.bc.THE_VALUE));
+                // Without an id to check there is nothing to allow or deny.
+                if (c.onDenied === 'branch' && c.companyIds === undefined && c.branchIds === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_ACCESS_TARGET_REQUIRED */.qj.NODE_ACCESS_TARGET_REQUIRED, at));
                 if (c.message !== undefined && typeof c.message !== 'string') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_PERMISSION_OPTION_INVALID */.qj.NODE_PERMISSION_OPTION_INVALID, at));
                 if (c.statusCode !== undefined && !(Number.isInteger(c.statusCode) && c.statusCode >= 400 && c.statusCode <= 499)) {
                     err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_STATUS_4XX */.qj.NODE_STATUS_4XX, at));
@@ -2143,7 +2723,7 @@ function validateNodeConfig(node, flow, context, err, warn) {
             exprMap(c.values, KIND.variable);
             if (!c.values || !Object.keys(c.values).length) warn.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_SETS_NOTHING */.qj.NODE_SETS_NOTHING, at));
             for (const key of Object.keys(c.values ?? {})){
-                if (!_flow_types_js__rspack_import_6/* .FLOW_INPUT_NAME_PATTERN.test */.fZ.test(key)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_VARIABLE_INVALID */.qj.NODE_VARIABLE_INVALID, {
+                if (!_flow_types_js__rspack_import_5/* .FLOW_INPUT_NAME_PATTERN.test */.fZ.test(key)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_VARIABLE_INVALID */.qj.NODE_VARIABLE_INVALID, {
                     ...at,
                     name: key
                 }));
@@ -2174,10 +2754,10 @@ function validateNodeConfig(node, flow, context, err, warn) {
         case 'foreach':
             expr(c.items, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_LIST */.bc.THE_LIST));
             if (c.collect !== undefined) expr(c.collect, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_COLLECTED_VALUE */.bc.THE_COLLECTED_VALUE));
-            if (c.maxItems !== undefined && !(Number.isInteger(c.maxItems) && c.maxItems >= 1 && c.maxItems <= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_FOREACH_ITEMS */.Or.MAX_FOREACH_ITEMS)) {
+            if (c.maxItems !== undefined && !(Number.isInteger(c.maxItems) && c.maxItems >= 1 && c.maxItems <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_FOREACH_ITEMS */.Or.MAX_FOREACH_ITEMS)) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_MAX_ITEMS_RANGE */.qj.NODE_MAX_ITEMS_RANGE, {
                     ...at,
-                    max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_FOREACH_ITEMS */.Or.MAX_FOREACH_ITEMS
+                    max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_FOREACH_ITEMS */.Or.MAX_FOREACH_ITEMS
                 }));
             }
             break;
@@ -2202,7 +2782,7 @@ function validateNodeConfig(node, flow, context, err, warn) {
             break;
         case 'entity_update':
             entity(c.entityCode);
-            writeTargetConfig(c, _flow_types_js__rspack_import_6/* .RECORD_WRITE_TARGETS */.Dn, [
+            writeTargetConfig(c, _flow_types_js__rspack_import_5/* .RECORD_WRITE_TARGETS */.Dn, [
                 'error',
                 'skip',
                 'insert'
@@ -2216,7 +2796,7 @@ function validateNodeConfig(node, flow, context, err, warn) {
             break;
         case 'entity_delete':
             entity(c.entityCode);
-            writeTargetConfig(c, _flow_types_js__rspack_import_6/* .RECORD_WRITE_TARGETS */.Dn, [
+            writeTargetConfig(c, _flow_types_js__rspack_import_5/* .RECORD_WRITE_TARGETS */.Dn, [
                 'error',
                 'skip'
             ], {
@@ -2234,22 +2814,26 @@ function validateNodeConfig(node, flow, context, err, warn) {
             entity(c.entityCode);
             filterMap(c.filter, KIND.filter);
             if (c.search !== undefined) expr(c.search, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_SEARCH_TEXT */.bc.THE_SEARCH_TEXT));
-            if (c.limit !== undefined && !(Number.isInteger(c.limit) && c.limit >= 1 && c.limit <= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT)) {
+            if (c.sort !== undefined) {
+                const sort = c.sort;
+                if (typeof sort?.field !== 'string' || !COLUMN_CODE.test(sort.field) || sort.direction !== undefined && sort.direction !== 'ASC' && sort.direction !== 'DESC') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_SORT_INVALID */.qj.NODE_SORT_INVALID, at));
+            }
+            if (c.limit !== undefined && !(Number.isInteger(c.limit) && c.limit >= 1 && c.limit <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT)) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_LIMIT_RANGE */.qj.NODE_LIMIT_RANGE, {
                     ...at,
-                    max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT
+                    max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT
                 }));
             }
             break;
         case 'call_flow':
-            if (typeof c.flowSlug !== 'string' || !_flow_types_js__rspack_import_6/* .FLOW_SLUG_PATTERN.test */.YD.test(c.flowSlug)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHOOSE_FLOW */.qj.NODE_CHOOSE_FLOW, at));
+            if (typeof c.flowSlug !== 'string' || !_flow_types_js__rspack_import_5/* .FLOW_SLUG_PATTERN.test */.YD.test(c.flowSlug)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHOOSE_FLOW */.qj.NODE_CHOOSE_FLOW, at));
             else if (c.flowSlug === flow.slug) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CALLS_ITSELF */.qj.NODE_CALLS_ITSELF, at));
             else if (context.knownFlows && !context.knownFlows.has(c.flowSlug)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FLOW_UNKNOWN */.qj.NODE_FLOW_UNKNOWN, {
                 ...at,
                 flow: c.flowSlug
             }));
-            else if (context.knownFlows) checkCalledFlow(c.flowSlug, c.endpoint, c.input, c.inputList, flow, context.knownFlows, at, err, warn);
-            if (c.endpoint !== undefined && c.endpoint !== '' && (typeof c.endpoint !== 'string' || !_flow_types_js__rspack_import_6/* .FLOW_ENDPOINT_PATH_PATTERN.test */.YO.test(c.endpoint))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_INVALID */.qj.TRIGGER_PATH_INVALID, at));
+            else if (context.knownFlows) checkCalledFlow(node, flow, context.knownFlows, err, warn);
+            if (c.endpoint !== undefined && c.endpoint !== '' && (typeof c.endpoint !== 'string' || !_flow_types_js__rspack_import_5/* .FLOW_ENDPOINT_PATH_PATTERN.test */.YO.test(c.endpoint))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_PATH_INVALID */.qj.TRIGGER_PATH_INVALID, at));
             exprMap(c.input, KIND.input);
             if (c.inputList !== undefined) expr(c.inputList, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_INPUT_LIST */.bc.THE_INPUT_LIST));
             break;
@@ -2265,10 +2849,11 @@ function validateNodeConfig(node, flow, context, err, warn) {
                 expr(c.url, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_URL */.bc.THE_URL));
                 exprMap(c.headers, KIND.header);
                 exprMap(c.body, KIND.body);
-                if (c.timeoutMs !== undefined && !(Number.isInteger(c.timeoutMs) && c.timeoutMs >= 100 && c.timeoutMs <= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_HTTP_TIMEOUT_MS */.Or.MAX_HTTP_TIMEOUT_MS)) {
+                if (c.forwardAuth === true) warn.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FORWARDS_TOKEN */.qj.NODE_FORWARDS_TOKEN, at));
+                if (c.timeoutMs !== undefined && !(Number.isInteger(c.timeoutMs) && c.timeoutMs >= 100 && c.timeoutMs <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_HTTP_TIMEOUT_MS */.Or.MAX_HTTP_TIMEOUT_MS)) {
                     err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_TIMEOUT_RANGE */.qj.NODE_TIMEOUT_RANGE, {
                         ...at,
-                        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_HTTP_TIMEOUT_MS */.Or.MAX_HTTP_TIMEOUT_MS
+                        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_HTTP_TIMEOUT_MS */.Or.MAX_HTTP_TIMEOUT_MS
                     }));
                 }
                 break;
@@ -2277,7 +2862,50 @@ function validateNodeConfig(node, flow, context, err, warn) {
             if (typeof c.eventName !== 'string' || !/^[a-z][a-z0-9_.-]{1,59}$/.test(c.eventName)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_EVENT_NAME_INVALID */.qj.NODE_EVENT_NAME_INVALID, at));
             exprMap(c.payload, KIND.payload);
             break;
-        case 'respond':
+        case 'send_notification':
+            {
+                serviceRunning('notification', _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_NOTIFICATION_UNAVAILABLE */.qj.NODE_NOTIFICATION_UNAVAILABLE);
+                const target = c.target ?? 'one';
+                if (!_flow_types_js__rspack_import_5/* .FLOW_NOTIFICATION_TARGETS.includes */.as.includes(target)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_MESSAGE_TARGET_INVALID */.qj.NODE_MESSAGE_TARGET_INVALID, at));
+                if (target === 'many') expr(c.items, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_LIST */.bc.THE_LIST));
+                if (target === 'company') {
+                    if (context.companyMembers === false) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_NOTIFICATION_COMPANY_UNAVAILABLE */.qj.NODE_NOTIFICATION_COMPANY_UNAVAILABLE, at));
+                    expr(c.companyIds, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_COMPANIES */.bc.THE_COMPANIES));
+                    optionalExpr(c.branchIds, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_BRANCHES */.bc.THE_BRANCHES));
+                } else {
+                    expr(c.userIds, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_RECIPIENTS */.bc.THE_RECIPIENTS));
+                    optionalExpr(c.companyId, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_COMPANY */.bc.THE_COMPANY));
+                }
+                expr(c.title, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_TITLE */.bc.THE_TITLE));
+                optionalExpr(c.message, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_MESSAGE */.bc.THE_MESSAGE));
+                exprMap(c.data, KIND.data);
+                if (c.type !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_NOTIFICATION_TYPES.includes */.LG.includes(c.type)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_NOTIFICATION_OPTION_INVALID */.qj.NODE_NOTIFICATION_OPTION_INVALID, at));
+                if (c.realtime !== undefined && typeof c.realtime !== 'boolean') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_NOTIFICATION_OPTION_INVALID */.qj.NODE_NOTIFICATION_OPTION_INVALID, at));
+                break;
+            }
+        case 'send_email':
+            {
+                serviceRunning('email', _config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_EMAIL_UNAVAILABLE */.qj.NODE_EMAIL_UNAVAILABLE);
+                if (!_flow_types_js__rspack_import_5/* .FLOW_EMAIL_TARGETS.includes */.B9.includes(c.target ?? 'one')) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_MESSAGE_TARGET_INVALID */.qj.NODE_MESSAGE_TARGET_INVALID, at));
+                if (c.target === 'many') expr(c.items, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_LIST */.bc.THE_LIST));
+                expr(c.to, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_RECIPIENTS */.bc.THE_RECIPIENTS));
+                optionalExpr(c.cc, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_CC */.bc.THE_CC));
+                optionalExpr(c.bcc, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_BCC */.bc.THE_BCC));
+                optionalExpr(c.replyTo, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_REPLY_TO */.bc.THE_REPLY_TO));
+                if (c.mode !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_EMAIL_MODES.includes */.v1.includes(c.mode)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_EMAIL_OPTION_INVALID */.qj.NODE_EMAIL_OPTION_INVALID, at));
+                if (c.format !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_EMAIL_FORMATS.includes */.FU.includes(c.format)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_EMAIL_OPTION_INVALID */.qj.NODE_EMAIL_OPTION_INVALID, at));
+                if (c.emailConfigId !== undefined && c.emailConfigId !== '' && (typeof c.emailConfigId !== 'string' || !_flow_types_js__rspack_import_5/* .FLOW_ID_PATTERN.test */.E2.test(c.emailConfigId))) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_EMAIL_OPTION_INVALID */.qj.NODE_EMAIL_OPTION_INVALID, at));
+                if (c.mode === 'template') {
+                    const slug = typeof c.templateSlug === 'string' ? c.templateSlug.trim() : '';
+                    if (!slug || slug.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EMAIL_TEMPLATE_SLUG_LENGTH */.Or.MAX_EMAIL_TEMPLATE_SLUG_LENGTH) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_EMAIL_TEMPLATE_REQUIRED */.qj.NODE_EMAIL_TEMPLATE_REQUIRED, at));
+                    exprMap(c.variables, KIND.template);
+                } else {
+                    expr(c.subject, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_SUBJECT */.bc.THE_SUBJECT));
+                    expr(c.body, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_BODY */.bc.THE_BODY));
+                }
+                break;
+            }
+        case 'respond':
             {
                 const status = c.statusCode;
                 if (!(Number.isInteger(status) && status >= 200 && status <= 599)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_STATUS_2XX_5XX */.qj.NODE_STATUS_2XX_5XX, at));
@@ -2290,15 +2918,15 @@ function validateNodeConfig(node, flow, context, err, warn) {
             break;
         case 'code':
             if (typeof c.code !== 'string' || !c.code.trim()) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CODE_REQUIRED */.qj.NODE_CODE_REQUIRED, at));
-            else if (c.code.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CODE_LENGTH */.Or.MAX_CODE_LENGTH) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CODE_TOO_LONG */.qj.NODE_CODE_TOO_LONG, {
+            else if (c.code.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CODE_LENGTH */.Or.MAX_CODE_LENGTH) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CODE_TOO_LONG */.qj.NODE_CODE_TOO_LONG, {
                 ...at,
-                max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CODE_LENGTH */.Or.MAX_CODE_LENGTH
+                max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CODE_LENGTH */.Or.MAX_CODE_LENGTH
             }));
-            if (c.timeoutMs !== undefined && !(Number.isInteger(c.timeoutMs) && c.timeoutMs >= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MIN_CODE_TIMEOUT_MS */.Or.MIN_CODE_TIMEOUT_MS && c.timeoutMs <= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CODE_TIMEOUT_MS */.Or.MAX_CODE_TIMEOUT_MS)) {
+            if (c.timeoutMs !== undefined && !(Number.isInteger(c.timeoutMs) && c.timeoutMs >= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MIN_CODE_TIMEOUT_MS */.Or.MIN_CODE_TIMEOUT_MS && c.timeoutMs <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CODE_TIMEOUT_MS */.Or.MAX_CODE_TIMEOUT_MS)) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CODE_TIMEOUT_RANGE */.qj.NODE_CODE_TIMEOUT_RANGE, {
                     ...at,
-                    min: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MIN_CODE_TIMEOUT_MS */.Or.MIN_CODE_TIMEOUT_MS,
-                    max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CODE_TIMEOUT_MS */.Or.MAX_CODE_TIMEOUT_MS
+                    min: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MIN_CODE_TIMEOUT_MS */.Or.MIN_CODE_TIMEOUT_MS,
+                    max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CODE_TIMEOUT_MS */.Or.MAX_CODE_TIMEOUT_MS
                 }));
             }
             break;
@@ -2317,10 +2945,10 @@ function validateNodeConfig(node, flow, context, err, warn) {
     if (target === 'filter') {
         filterMap(c.filter);
         if (!c.filter || typeof c.filter !== 'object' || !Object.keys(c.filter).length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_FILTER_REQUIRED */.qj.NODE_FILTER_REQUIRED, at));
-        if (c.limit !== undefined && !(Number.isInteger(c.limit) && c.limit >= 1 && c.limit <= _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_WRITE_ITEMS */.Or.MAX_WRITE_ITEMS)) {
+        if (c.limit !== undefined && !(Number.isInteger(c.limit) && c.limit >= 1 && c.limit <= _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_WRITE_ITEMS */.Or.MAX_WRITE_ITEMS)) {
             err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_LIMIT_RANGE */.qj.NODE_LIMIT_RANGE, {
                 ...at,
-                max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_WRITE_ITEMS */.Or.MAX_WRITE_ITEMS
+                max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_WRITE_ITEMS */.Or.MAX_WRITE_ITEMS
             }));
         }
     }
@@ -2328,9 +2956,9 @@ function validateNodeConfig(node, flow, context, err, warn) {
 function childInserts(value, { at, entity, expr, err }) {
     if (value === undefined) return;
     if (!Array.isArray(value)) return err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHILDREN_INVALID */.qj.NODE_CHILDREN_INVALID, at));
-    if (value.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CHILD_INSERTS */.Or.MAX_CHILD_INSERTS) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHILDREN_TOO_MANY */.qj.NODE_CHILDREN_TOO_MANY, {
+    if (value.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CHILD_INSERTS */.Or.MAX_CHILD_INSERTS) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHILDREN_TOO_MANY */.qj.NODE_CHILDREN_TOO_MANY, {
         ...at,
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_CHILD_INSERTS */.Or.MAX_CHILD_INSERTS
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_CHILD_INSERTS */.Or.MAX_CHILD_INSERTS
     }));
     const names = new Set();
     for (const child of value){
@@ -2339,7 +2967,7 @@ function childInserts(value, { at, entity, expr, err }) {
             continue;
         }
         const name = String(child.as ?? '');
-        if (!_flow_types_js__rspack_import_6/* .FLOW_INPUT_NAME_PATTERN.test */.fZ.test(name)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHILD_NAME_INVALID */.qj.NODE_CHILD_NAME_INVALID, {
+        if (!_flow_types_js__rspack_import_5/* .FLOW_INPUT_NAME_PATTERN.test */.fZ.test(name)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHILD_NAME_INVALID */.qj.NODE_CHILD_NAME_INVALID, {
             ...at,
             name
         }));
@@ -2373,7 +3001,8 @@ function childInserts(value, { at, entity, expr, err }) {
 /**
  * How many loop levels each part of a node's config runs inside, beyond the loops around the node:
  * a foreach's `collect` runs in its own loop; a many / filter write's per-record expressions in one
- * of the node's own; child records one deeper than their parent record.
+ * of the node's own; child records one deeper than their parent record; a many message step's values
+ * (all but its list) one per item.
  */ function configScopes(node) {
     const config = node.config ?? {};
     if (node.type === 'foreach') {
@@ -2391,6 +3020,21 @@ function childInserts(value, { at, entity, expr, err }) {
             }
         ];
     }
+    if ((0,_flow_types_js__rspack_import_5/* .isMessageNode */.SE)(node.type) && config['target'] === 'many') {
+        const { items, ...perItem } = config;
+        return [
+            {
+                value: items,
+                extra: 0,
+                ownLoop: false
+            },
+            {
+                value: perItem,
+                extra: 1,
+                ownLoop: false
+            }
+        ];
+    }
     if (!WRITE_NODE_TYPES.has(node.type)) return [
         {
             value: config,
@@ -2430,9 +3074,9 @@ function childInserts(value, { at, entity, expr, err }) {
 }
 function validateChecks(c, at, rule, err) {
     if (!Array.isArray(c.checks) || !c.checks.length) return err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHECK_REQUIRED */.qj.NODE_CHECK_REQUIRED, at));
-    if (c.checks.length > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_VALIDATE_CHECKS */.Or.MAX_VALIDATE_CHECKS) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_TOO_MANY_CHECKS */.qj.NODE_TOO_MANY_CHECKS, {
+    if (c.checks.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_VALIDATE_CHECKS */.Or.MAX_VALIDATE_CHECKS) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_TOO_MANY_CHECKS */.qj.NODE_TOO_MANY_CHECKS, {
         ...at,
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_VALIDATE_CHECKS */.Or.MAX_VALIDATE_CHECKS
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_VALIDATE_CHECKS */.Or.MAX_VALIDATE_CHECKS
     }));
     const ids = new Set();
     for (const check of c.checks){
@@ -2461,7 +3105,7 @@ function validateChecks(c, at, rule, err) {
     }
 }
 /** Every `context.<node>` must name a node of this flow; `input.<name>` should be an input some Request step declares. */ function checkNodeReferences(nodes, byId, flow, err, warnings) {
-    const endpoints = (0,_flow_types_js__rspack_import_6/* .flowEndpoints */.Xr)(flow);
+    const endpoints = (0,_flow_types_js__rspack_import_5/* .flowEndpoints */.Xr)(flow);
     const declaredInputs = new Set(endpoints.flatMap((endpoint)=>endpoint.inputSchema.map((f)=>f.name)));
     // A list body is read by index, and an object body without fields takes anything: neither has names to check.
     const namesKnown = endpoints.length > 0 && endpoints.every((endpoint)=>endpoint.bodyType !== 'list' && endpoint.inputSchema.length > 0);
@@ -2476,21 +3120,21 @@ function validateChecks(c, at, rule, err) {
             const [scope, second] = ref.split('.');
             if (!REF_SCOPES.has(scope)) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.REF_BAD_SCOPE */.qj.REF_BAD_SCOPE, {
-                    node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node),
+                    node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node),
                     ref
                 }));
             } else if (scope === 'context' && second && !byId.has(second)) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.REF_NODE_MISSING */.qj.REF_NODE_MISSING, {
-                    node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node),
+                    node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node),
                     target: second
                 }));
             } else if (scope === 'context' && second === node.id) {
                 err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.REF_SELF */.qj.REF_SELF, {
-                    node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node)
+                    node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node)
                 }));
             } else if (scope === 'input' && second && namesKnown && !declaredInputs.has(second)) {
                 warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.REF_INPUT_UNDECLARED */.qj.REF_INPUT_UNDECLARED, {
-                    node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(node),
+                    node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(node),
                     input: second
                 }));
             }
@@ -2505,15 +3149,28 @@ function refsOf(value, refs = [], depth = 0) {
     return refs;
 }
 /**
- * Writes that do not share a transaction, and Save progress steps that would not commit: in a flow
- * without the transaction setting, inside a loop (once per item), or in a flow other flows call
- * (inside its caller's transaction it is skipped).
- */ function checkTransactionUse(flow, nodes, outgoing, reachable, context, warnings) {
-    const live = nodes.filter((n)=>!reachable || reachable.has(n.id));
-    const writes = live.filter((n)=>WRITE_NODE_TYPES.has(n.type)).length;
-    if (!flow.isTransactional && writes >= 2) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.WRITES_NOT_TRANSACTIONAL */.qj.WRITES_NOT_TRANSACTIONAL, {
-        count: writes
-    }));
+ * Writes that do not share a transaction, and Save progress steps that would not commit: reached
+ * from a Request step without the transaction setting, inside a loop (once per item), or in a flow
+ * other flows call (inside its caller's transaction it is skipped).
+ */ function checkTransactionUse(flow, runs, outgoing, context, warnings) {
+    for (const { endpoint, label, steps } of runs){
+        if (endpoint.isTransactional) continue;
+        const writes = steps.filter((n)=>WRITE_NODE_TYPES.has(n.type)).length;
+        if (writes >= 2) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.WRITES_NOT_TRANSACTIONAL */.qj.WRITES_NOT_TRANSACTIONAL, {
+            count: writes,
+            node: label
+        }));
+        for (const commit of steps)if (commit.type === 'commit') warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.COMMIT_NOT_TRANSACTIONAL */.qj.COMMIT_NOT_TRANSACTIONAL, {
+            node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(commit),
+            endpoint: label
+        }));
+    }
+    const live = [
+        ...new Map(runs.flatMap((run)=>run.steps).map((n)=>[
+                n.id,
+                n
+            ])).values()
+    ];
     const commits = live.filter((n)=>n.type === 'commit');
     if (!commits.length) return;
     const loops = live.filter((n)=>n.type === 'foreach').map((n)=>({
@@ -2525,13 +3182,12 @@ function refsOf(value, refs = [], depth = 0) {
     ].some((f)=>f.calls.includes(flow.slug));
     for (const commit of commits){
         const at = {
-            node: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(commit)
+            node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(commit)
         };
-        if (!flow.isTransactional) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.COMMIT_NOT_TRANSACTIONAL */.qj.COMMIT_NOT_TRANSACTIONAL, at));
         const loop = loops.find((l)=>l.body.has(commit.id));
         if (loop) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.COMMIT_IN_LOOP */.qj.COMMIT_IN_LOOP, {
             ...at,
-            loop: (0,_flow_types_js__rspack_import_6/* .nodeLabel */.dA)(loop.node)
+            loop: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(loop.node)
         }));
         if (called) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.COMMIT_IN_CALLED_FLOW */.qj.COMMIT_IN_CALLED_FLOW, at));
     }
@@ -2698,14 +3354,15 @@ function reach(start, outgoing) {
         nesting.set(id, max);
         return max;
     };
-    if (nodes.some((n)=>n.type === 'trigger' && nestingFrom(n.id) > _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.LOOP_TOO_DEEP */.qj.LOOP_TOO_DEEP, {
-        max: _flow_types_js__rspack_import_6/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH
+    if (nodes.some((n)=>n.type === 'trigger' && nestingFrom(n.id) > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.LOOP_TOO_DEEP */.qj.LOOP_TOO_DEEP, {
+        max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_LOOP_DEPTH */.Or.MAX_LOOP_DEPTH
     }));
 }
 
 __webpack_require__.d(__webpack_exports__, {
-  n: () => (validateFlow),
-  u: () => (usesPermissionFunction)
+  nC: () => (validateFlow),
+  r7: () => (callProblems),
+  u9: () => (usesPermissionFunction)
 });
 
 
@@ -2908,6 +3565,19 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+8220(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const permissionAction = (code)=>({
+        type: 'action',
+        actionId: code
+    });
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  s: permissionAction
+});
+
+
 },
 8542(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
@@ -2989,203 +3659,14 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
-},
-6256(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-const FLOW_NODE_TYPES = [
-    'trigger',
-    'validate',
-    'permission_check',
-    'set',
-    'condition',
-    'switch',
-    'foreach',
-    'entity_insert',
-    'entity_update',
-    'entity_delete',
-    'entity_get',
-    'entity_query',
-    'commit',
-    'call_flow',
-    'http_request',
-    'publish_event',
-    'respond',
-    'code'
-];
-/** A failure of these always ends the run: checks can never be carried past, and Save progress cannot run in a savepoint. */ const NON_CONTINUABLE_NODE_TYPES = new Set([
-    'validate',
-    'permission_check',
-    'commit'
-]);
-const FLOW_AUTH_MODES = [
-    'public',
-    'api_key',
-    'jwt',
-    'permission',
-    'internal'
-];
-const FLOW_RUN_AS = [
-    'caller',
-    'system'
-];
-/** object: the body is one object and the fields are its keys (`input.<name>`). list: the body is a list and the fields describe each item (`input.0.<name>`). */ const FLOW_BODY_TYPES = [
-    'object',
-    'list'
-];
-const FLOW_INPUT_TYPES = [
-    'string',
-    'text',
-    'number',
-    'integer',
-    'boolean',
-    'date',
-    'datetime',
-    'email',
-    'uuid',
-    'object',
-    'array',
-    'choice'
-];
-/** How a step is named in messages: its name, or its id when it was left unnamed. */ const nodeLabel = (node)=>node.name || node.id;
-/**
- * Which records a write node touches. one (default): a single record. many: one per item of `items`,
- * whose per-record expressions read the item as `loop.item` (a loop around the node becomes
- * `loop.parent`). filter: every record matching `filter`, read as `loop.item`.
- */ const RECORD_WRITE_TARGETS = [
-    'one',
-    'many',
-    'filter'
-];
-const FLOW_LIMITS = {
-    MAX_NODES: 100,
-    MAX_EDGES: 300,
-    /** Room for a full foreach (MAX_FOREACH_ITEMS) with a few steps per item. */ MAX_STEPS_PER_RUN: 5000,
-    MAX_FOREACH_ITEMS: 1000,
-    MAX_LOOP_DEPTH: 3,
-    MAX_CALL_DEPTH: 5,
-    MAX_HTTP_CALLS: 10,
-    MAX_HTTP_TIMEOUT_MS: 15_000,
-    MAX_HTTP_RESPONSE_BYTES: 1_000_000,
-    MAX_QUERY_LIMIT: 200,
-    MAX_WRITE_ITEMS: 1000,
-    DEFAULT_WRITE_FILTER_LIMIT: 100,
-    MAX_CHILD_INSERTS: 10,
-    MAX_WRITES_PER_RUN: 5000,
-    DEFAULT_TIMEOUT_MS: 30_000,
-    MIN_TIMEOUT_MS: 1000,
-    MAX_TIMEOUT_MS: 120_000,
-    TRACE_PREVIEW_CHARS: 2000,
-    MAX_INPUT_FIELDS: 50,
-    /** How deep object/list-of-object fields may nest inside the request body. */ MAX_INPUT_DEPTH: 4,
-    MAX_VALIDATE_CHECKS: 50,
-    MAX_CODE_LENGTH: 20_000,
-    DEFAULT_CODE_TIMEOUT_MS: 1000,
-    MIN_CODE_TIMEOUT_MS: 10,
-    MAX_CODE_TIMEOUT_MS: 5000,
-    CODE_MEMORY_LIMIT_BYTES: 32 * 1024 * 1024,
-    CODE_STACK_SIZE_BYTES: 512 * 1024,
-    MAX_CODE_OUTPUT_BYTES: 1_000_000,
-    MAX_CODE_LOG_LINES: 50,
-    MAX_CODE_LOG_LINE_CHARS: 500
-};
-const FLOW_NODE_ID_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
-const FLOW_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,62}$/;
-const FLOW_INPUT_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,59}$/;
-const FLOW_ENDPOINT_PATH_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
-/** A Request step's path, or null when it answers on the flow's own URL. */ function triggerPath(node) {
-    const path = node.config?.path;
-    return typeof path === 'string' && path.trim() ? path.trim() : null;
-}
-/** Every Request step of a flow as a URL. */ function flowEndpoints(flow) {
-    return (flow.nodes ?? []).filter((node)=>node?.type === 'trigger').map((node)=>{
-        const path = triggerPath(node);
-        if (!path) return {
-            nodeId: node.id,
-            path,
-            bodyType: flow.bodyType ?? 'object',
-            inputSchema: flow.inputSchema ?? []
-        };
-        const config = node.config;
-        return {
-            nodeId: node.id,
-            path,
-            bodyType: config.bodyType ?? 'object',
-            inputSchema: Array.isArray(config.inputSchema) ? config.inputSchema : []
-        };
-    });
-}
-/** The URL a call came in on: `path` of a Request step, or null / empty for the flow's own URL. */ function findEndpoint(flow, path) {
-    const wanted = path?.trim() || null;
-    return flowEndpoints(flow).find((endpoint)=>endpoint.path === wanted);
-}
-/** Output ports a node of this type can have (a `respond` node ends the flow: none). */ function portsOf(node) {
-    switch(node.type){
-        case 'condition':
-            return [
-                'true',
-                'false'
-            ];
-        case 'switch':
-            return [
-                ...(node.config.cases ?? []).map((c)=>c.id),
-                'default'
-            ];
-        case 'foreach':
-            return [
-                'each',
-                'done'
-            ];
-        case 'permission_check':
-            return node.config.onDenied === 'branch' ? [
-                'allowed',
-                'denied'
-            ] : [
-                'out'
-            ];
-        case 'respond':
-            return [];
-        case 'trigger':
-        case 'validate':
-        case 'set':
-        case 'commit':
-            return [
-                'out'
-            ];
-        default:
-            return [
-                'out',
-                'error'
-            ];
-    }
-}
-
-__webpack_require__.d(__webpack_exports__, {
-  Xr: () => (flowEndpoints),
-  a5: () => (portsOf),
-  um: () => (triggerPath),
-  vS: () => (findEndpoint)
-}, {
-  At: NON_CONTINUABLE_NODE_TYPES,
-  Dn: RECORD_WRITE_TARGETS,
-  Or: FLOW_LIMITS,
-  Q7: FLOW_INPUT_TYPES,
-  Y3: FLOW_BODY_TYPES,
-  YD: FLOW_SLUG_PATTERN,
-  YO: FLOW_ENDPOINT_PATH_PATTERN,
-  dA: nodeLabel,
-  fO: FLOW_AUTH_MODES,
-  fZ: FLOW_INPUT_NAME_PATTERN,
-  gl: FLOW_RUN_AS,
-  q2: FLOW_NODE_TYPES,
-  z6: FLOW_NODE_ID_PATTERN
-});
-
-
 },
 2678(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 const SENSITIVE_KEY = /pass(word)?|secret|token|authorization|api[-_]?key|cookie|credential|private[-_]?key/i;
 /** Copy of `value` with the content of sensitive-looking keys replaced, safe to store in a log. */ function redactSensitive(value, depth = 0) {
     if (depth > 8) return '[deep]';
     if (Array.isArray(value)) return value.slice(0, 100).map((v)=>redactSensitive(v, depth + 1));
+    // Dates (and anything else with its own JSON form) have no own keys: walked as objects they would log as `{}`.
+    if (value && typeof value.toJSON === 'function') return redactSensitive(value.toJSON(), depth + 1);
     if (value && typeof value === 'object') {
         const out = {};
         for (const [key, item] of Object.entries(value)){
@@ -3214,6 +3695,24 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+9609(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/** What a version holds and a draft edits: everything about a flow but its identity. */ const FLOW_VERSIONED_FIELDS = [
+    'name',
+    'slug',
+    'description',
+    'isActive',
+    'retainExecutions',
+    'nodes',
+    'edges'
+];
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  v: FLOW_VERSIONED_FIELDS
+});
+
+
 },
 8323(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
@@ -3415,6 +3914,7 @@ function _ts_param(paramIndex, decorator) {
 }
 
 
+const VARIABLE_ENV_PREFIX = 'ENTITY_BUILDER_VAR_';
 class EntityBuilderConfigService {
     options;
     constructor(options){
@@ -3435,6 +3935,20 @@ class EntityBuilderConfigService {
     getConfig() {
         return this.options.config;
     }
+    /** `designer.readOnly`, else the `ENTITY_BUILDER_READ_ONLY=true` env variable (production). */ isDesignerReadOnly() {
+        return this.getConfig()?.designer?.readOnly ?? process.env['ENTITY_BUILDER_READ_ONLY'] === 'true';
+    }
+    /** The values behind `${var:NAME}` in promoted flows: every non-empty `ENTITY_BUILDER_VAR_<NAME>` env variable, overridden by `bundles.variables`; names a placeholder cannot carry are left out. */ getBundleVariables() {
+        const fromEnv = Object.entries(process.env).filter((entry)=>entry[0].startsWith(VARIABLE_ENV_PREFIX) && !!entry[1]).map(([key, value])=>[
+                key.slice(VARIABLE_ENV_PREFIX.length),
+                value
+            ]);
+        const variables = {
+            ...Object.fromEntries(fromEnv),
+            ...this.getConfig()?.bundles?.variables
+        };
+        return Object.fromEntries(Object.entries(variables).filter((entry)=>_config_entity_builder_constants_js__rspack_import_1/* .BUNDLE_VARIABLE_NAME_PATTERN.test */.JI.test(entry[0]) && typeof entry[1] === 'string'));
+    }
 }
 EntityBuilderConfigService = _ts_decorate([
     (0,_nestjs_common__rspack_import_0.Injectable)(),
@@ -3840,54 +4354,24 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-8888(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-
-// EXPORTS
-__webpack_require__.d(__webpack_exports__, {
-  T: () => (/* binding */ FlowApiKeyService)
-});
-
-// EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(6157);
-// EXTERNAL MODULE: external "typeorm"
-var external_typeorm_ = __webpack_require__(7158);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/config/message-keys.ts
-var message_keys = __webpack_require__(5732);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/entities/flow-api-key.entity.ts
-var flow_api_key_entity = __webpack_require__(201);
-// EXTERNAL MODULE: external "node:crypto"
-var external_node_crypto_ = __webpack_require__(2561);
-;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/flow-engine/flow-api-key.ts
-
-const API_KEY_PREFIX_LENGTH = 11; // "fk_" + 8 hex
-/** A new key: `fk_<8 hex>_<32 hex>`. Shown once; only its hash is stored. */ function generateApiKey() {
-    const key = `fk_${(0,external_node_crypto_.randomBytes)(4).toString('hex')}_${(0,external_node_crypto_.randomBytes)(16).toString('hex')}`;
-    return {
-        key,
-        prefix: apiKeyPrefix(key),
-        hash: hashApiKey(key)
-    };
-}
-const hashApiKey = (key)=>(0,external_node_crypto_.createHash)('sha256').update(key).digest('hex');
-const apiKeyPrefix = (key)=>key.slice(0, API_KEY_PREFIX_LENGTH);
-function looksLikeApiKey(key) {
-    return typeof key === 'string' && /^fk_[0-9a-f]{8}_[0-9a-f]{32}$/.test(key);
-}
-/** Constant-time comparison of a presented key against a stored hash. */ function apiKeyMatches(presented, storedHash) {
-    const a = Buffer.from(hashApiKey(presented), 'hex');
-    const b = Buffer.from(storedHash, 'hex');
-    return a.length === b.length && (0,external_node_crypto_.timingSafeEqual)(a, b);
-}
-
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/entities/flow-definition.entity.ts
-var flow_definition_entity = __webpack_require__(3770);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-values.ts
-var rule_values = __webpack_require__(6622);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/entity-builder-datasource.provider.ts
-var entity_builder_datasource_provider = __webpack_require__(424);
-// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/flow-definition.service.ts
-var flow_definition_service = __webpack_require__(5229);
-;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/services/flow-api-key.service.ts
+5229(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(5103);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_3 = __webpack_require__(1236);
+/* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_5 = __webpack_require__(7158);
+/* import */ var _config_event_actions_js__rspack_import_16 = __webpack_require__(982);
+/* import */ var _config_message_keys_js__rspack_import_14 = __webpack_require__(5732);
+/* import */ var _entities_entity_definition_entity_js__rspack_import_6 = __webpack_require__(3189);
+/* import */ var _entities_flow_definition_entity_js__rspack_import_7 = __webpack_require__(3770);
+/* import */ var _entities_flow_version_entity_js__rspack_import_8 = __webpack_require__(2399);
+/* import */ var _flow_engine_flow_api_key_js__rspack_import_9 = __webpack_require__(4816);
+/* import */ var _flow_engine_flow_permission_logic_js__rspack_import_13 = __webpack_require__(8220);
+/* import */ var _flow_engine_flow_graph_validator_js__rspack_import_10 = __webpack_require__(3186);
+/* import */ var _flow_engine_flow_types_js__rspack_import_11 = __webpack_require__(6256);
+/* import */ var _interfaces_flow_definition_interface_js__rspack_import_15 = __webpack_require__(9609);
+/* import */ var _entity_builder_datasource_provider_js__rspack_import_12 = __webpack_require__(424);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -3920,194 +4404,6 @@ function _ts_param(paramIndex, decorator) {
 
 
 
-const TOUCH_INTERVAL_MS = 60_000;
-class FlowApiKeyService {
-    provider;
-    constructor(provider){
-        this.provider = provider;
-    }
-    async repo() {
-        return this.provider.getRepository(flow_api_key_entity/* .FlowApiKey */.S);
-    }
-    async assertFlowExists(flowId) {
-        const flow = await (await this.provider.getRepository(flow_definition_entity/* .FlowDefinition */.G)).findOne({
-            where: {
-                id: flowId
-            },
-            select: {
-                id: true
-            }
-        });
-        if (!flow) throw (0,flow_definition_service/* .flowNotFound */.YW)();
-    }
-    async findKey(id) {
-        const key = await (await this.repo()).findOne({
-            where: {
-                id
-            }
-        });
-        if (!key) throw new common_.NotFoundException({
-            message: 'API key not found.',
-            messageKey: message_keys/* .FLOW_MESSAGES.API_KEY_NOT_FOUND */.wu.API_KEY_NOT_FOUND
-        });
-        await this.assertFlowExists(key.flowId);
-        return key;
-    }
-    /** The plain key is returned here and never again. */ async create(flowId, name, expiresAt, user) {
-        const expiry = expiresAt ? (0,rule_values/* .parseDateText */.hz)(expiresAt) : null;
-        if (expiry !== null && !(expiry > Date.now())) {
-            throw new common_.BadRequestException({
-                message: 'The expiry date of an API key must be in the future.',
-                messageKey: message_keys/* .FLOW_MESSAGES.API_KEY_EXPIRY_IN_PAST */.wu.API_KEY_EXPIRY_IN_PAST
-            });
-        }
-        await this.assertFlowExists(flowId);
-        const { key, prefix, hash } = generateApiKey();
-        const repo = await this.repo();
-        const saved = await repo.save(repo.create({
-            flowId,
-            name,
-            keyPrefix: prefix,
-            keyHash: hash,
-            isActive: true,
-            expiresAt: expiry === null ? null : new Date(expiry),
-            lastUsedAt: null,
-            createdById: user?.id ?? null
-        }));
-        return {
-            key,
-            info: this.info(saved)
-        };
-    }
-    async list(flowId) {
-        await this.assertFlowExists(flowId);
-        const rows = await (await this.repo()).find({
-            where: {
-                flowId
-            },
-            order: {
-                createdAt: 'DESC'
-            }
-        });
-        return rows.map((r)=>this.info(r));
-    }
-    async revoke(id) {
-        const key = await this.findKey(id);
-        await (await this.repo()).update({
-            id: key.id
-        }, {
-            isActive: false
-        });
-    }
-    async remove(id) {
-        const key = await this.findKey(id);
-        await (await this.repo()).softDelete({
-            id: key.id
-        });
-    }
-    /**
-   * Checks `presented` against the unrevoked keys of this flow. Only the flow access guard calls
-   * this, and only while the flow's authMode is `api_key`; revoking works in any authMode.
-   */ async verify(flowId, presented) {
-        if (!looksLikeApiKey(presented)) return 'invalid';
-        const repo = await this.repo();
-        const candidates = await repo.find({
-            where: {
-                flowId,
-                keyPrefix: apiKeyPrefix(presented),
-                isActive: true,
-                deletedAt: (0,external_typeorm_.IsNull)()
-            },
-            select: {
-                id: true,
-                keyHash: true,
-                expiresAt: true,
-                lastUsedAt: true
-            }
-        });
-        const match = candidates.find((c)=>apiKeyMatches(presented, c.keyHash));
-        if (!match) return 'invalid';
-        if (isExpired(match.expiresAt)) return 'expired';
-        if (!match.lastUsedAt || Date.now() - match.lastUsedAt.getTime() > TOUCH_INTERVAL_MS) {
-            await repo.update({
-                id: match.id
-            }, {
-                lastUsedAt: new Date()
-            });
-        }
-        return 'valid';
-    }
-    info(row) {
-        const status = !row.isActive ? 'revoked' : isExpired(row.expiresAt) ? 'expired' : 'active';
-        return {
-            id: row.id,
-            flowId: row.flowId,
-            name: row.name,
-            keyPrefix: row.keyPrefix,
-            isActive: row.isActive,
-            status,
-            expiresAt: row.expiresAt,
-            lastUsedAt: row.lastUsedAt,
-            createdAt: row.createdAt
-        };
-    }
-}
-FlowApiKeyService = _ts_decorate([
-    (0,common_.Injectable)({
-        scope: common_.Scope.REQUEST
-    }),
-    _ts_param(0, (0,common_.Inject)(entity_builder_datasource_provider/* .EntityBuilderDataSourceProvider */.D)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof entity_builder_datasource_provider/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : entity_builder_datasource_provider/* .EntityBuilderDataSourceProvider */.D
-    ])
-], FlowApiKeyService);
-function isExpired(expiresAt) {
-    return !!expiresAt && expiresAt.getTime() <= Date.now();
-}
-
-
-},
-5229(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
-/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
-/* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(1236);
-/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
-/* import */ var typeorm__rspack_import_4 = __webpack_require__(7158);
-/* import */ var _config_event_actions_js__rspack_import_11 = __webpack_require__(982);
-/* import */ var _config_message_keys_js__rspack_import_10 = __webpack_require__(5732);
-/* import */ var _entities_entity_definition_entity_js__rspack_import_5 = __webpack_require__(3189);
-/* import */ var _entities_flow_definition_entity_js__rspack_import_6 = __webpack_require__(3770);
-/* import */ var _flow_engine_flow_graph_validator_js__rspack_import_7 = __webpack_require__(3186);
-/* import */ var _flow_engine_flow_types_js__rspack_import_8 = __webpack_require__(6256);
-/* import */ var _entity_builder_datasource_provider_js__rspack_import_9 = __webpack_require__(424);
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-        r = Reflect.decorate(decorators, target, key, desc);
-    } else {
-        for(var i = decorators.length - 1; i >= 0; i--){
-            if (d = decorators[i]) {
-                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-            }
-        }
-    }
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(metadataKey, metadataValue) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-        return Reflect.metadata(metadataKey, metadataValue);
-    }
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-
-
-
-
 
 
 
@@ -4117,21 +4413,28 @@ function _ts_param(paramIndex, decorator) {
 
 
 const defaultFlowPermissionCode = (slug)=>`entity_builder.flow.${slug}.execute`;
-const flowNotFound = ()=>new _nestjs_common__rspack_import_3.NotFoundException({
+/** The rule a `permission` URL asks callers to pass: its own, or the flow's execute permission. */ const flowPermissions = (endpoint, slug)=>endpoint.permissions ?? (0,_flow_engine_flow_permission_logic_js__rspack_import_13/* .permissionAction */.s)(defaultFlowPermissionCode(slug));
+const flowNotFound = ()=>new _nestjs_common__rspack_import_4.NotFoundException({
         message: 'Flow not found.',
-        messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.NOT_FOUND */.wu.NOT_FOUND
+        messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.NOT_FOUND */.wu.NOT_FOUND
+    });
+/** A flow that has been published at least once: its columns are what callers run. */ const isPublished = (flow)=>flow.version > 0;
+/** The versioned part of a flow (or of a draft), in a fixed key order so two snapshots compare as text. */ function snapshotOf(source) {
+    return Object.fromEntries(_interfaces_flow_definition_interface_js__rspack_import_15/* .FLOW_VERSIONED_FIELDS.filter */.v.filter((key)=>source[key] !== undefined).map((key)=>[
+            key,
+            source[key]
+        ]));
+}
+const sameSnapshot = (a, b)=>JSON.stringify(a) === JSON.stringify(b);
+/** What the designer edits: the saved draft, or the published flow when there is none. */ const workingCopy = (flow)=>({
+        ...snapshotOf(flow),
+        ...flow.draft
     });
-/** Fills the defaults a flow definition gets when a field is left out. */ function toFlowSettings(dto) {
+/** What running a flow needs; everything about a run is on its Request steps. */ function toFlowSettings(dto) {
     return {
         slug: dto.slug,
-        authMode: dto.authMode ?? 'jwt',
-        runAs: dto.runAs ?? 'caller',
-        isTransactional: dto.isTransactional ?? false,
-        bodyType: dto.bodyType ?? 'object',
-        inputSchema: dto.inputSchema ?? [],
         nodes: dto.nodes ?? [],
-        edges: dto.edges ?? [],
-        timeoutMs: dto.timeoutMs ?? _flow_engine_flow_types_js__rspack_import_8/* .FLOW_LIMITS.DEFAULT_TIMEOUT_MS */.Or.DEFAULT_TIMEOUT_MS
+        edges: dto.edges ?? []
     };
 }
 class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiService {
@@ -4140,11 +4443,14 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
     provider;
     permissionCache;
     actionRegistry;
-    constructor(cacheManager, utilsService, provider, permissionCache, actionRegistry){
-        super(_config_event_actions_js__rspack_import_11/* .ENTITY_BUILDER_EVENT_ENTITIES.FLOW_DEFINITION */.P.FLOW_DEFINITION, cacheManager, utilsService, FlowDefinitionService.name, true, _config_event_actions_js__rspack_import_11/* .ENTITY_BUILDER_EVENT_MODULE */.S, provider, _entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G), this.cacheManager = cacheManager, this.utilsService = utilsService, this.provider = provider, this.permissionCache = permissionCache, this.actionRegistry = actionRegistry;
+    notifications;
+    email;
+    companyAccess;
+    constructor(cacheManager, utilsService, provider, permissionCache, actionRegistry, notifications, email, companyAccess){
+        super(_config_event_actions_js__rspack_import_16/* .ENTITY_BUILDER_EVENT_ENTITIES.FLOW_DEFINITION */.P.FLOW_DEFINITION, cacheManager, utilsService, FlowDefinitionService.name, true, _config_event_actions_js__rspack_import_16/* .ENTITY_BUILDER_EVENT_MODULE */.S, provider, _entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G), this.cacheManager = cacheManager, this.utilsService = utilsService, this.provider = provider, this.permissionCache = permissionCache, this.actionRegistry = actionRegistry, this.notifications = notifications, this.email = email, this.companyAccess = companyAccess;
     }
     async findOrFail(id) {
-        const flow = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).findOne({
+        const flow = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).findOne({
             where: {
                 id
             }
@@ -4152,28 +4458,28 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
         if (!flow) throw flowNotFound();
         return flow;
     }
-    /** Validation with the real entity and flow lists. Returns errors and warnings without throwing. */ async validate(settings) {
-        const entities = await (await this.provider.getRepository(_entities_entity_definition_entity_js__rspack_import_5/* .EntityDefinition */.f)).find({
+    /** Validation with the real entity and flow lists and the modules this app runs. Returns errors and warnings without throwing. */ async validate(settings) {
+        const entities = await (await this.provider.getRepository(_entities_entity_definition_entity_js__rspack_import_6/* .EntityDefinition */.f)).find({
             select: {
                 code: true
             }
         });
-        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).find();
-        return (0,_flow_engine_flow_graph_validator_js__rspack_import_7/* .validateFlow */.n)(settings, {
+        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).find();
+        return (0,_flow_engine_flow_graph_validator_js__rspack_import_10/* .validateFlow */.nC)(settings, {
             knownEntityCodes: new Set(entities.map((e)=>e.code)),
             knownFlows: new Map(flows.map((flow)=>[
                     flow.slug,
-                    {
-                        isActive: flow.isActive,
-                        authMode: flow.authMode,
-                        endpoints: (0,_flow_engine_flow_types_js__rspack_import_8/* .flowEndpoints */.Xr)(flow),
-                        calls: calledSlugs(flow.nodes)
-                    }
-                ]))
+                    callableOf(flow)
+                ])),
+            messageServices: {
+                notification: !!this.notifications,
+                email: !!this.email
+            },
+            companyMembers: !!this.companyAccess
         });
     }
     /** Names of the other flows whose `call_flow` nodes run `slug`. */ async callersOf(slug, excludeIds) {
-        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).find({
+        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).find({
             select: {
                 id: true,
                 name: true,
@@ -4185,20 +4491,83 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
     async assertNotCalled(slug, excludeIds) {
         const callers = await this.callersOf(slug, excludeIds);
         if (!callers.length) return;
-        throw new _nestjs_common__rspack_import_3.ConflictException({
+        throw new _nestjs_common__rspack_import_4.ConflictException({
             message: `The flow '${slug}' is called by: ${callers.join(', ')}. Change those flows first.`,
-            messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.CALLED_BY_OTHER_FLOWS */.wu.CALLED_BY_OTHER_FLOWS,
+            messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.CALLED_BY_OTHER_FLOWS */.wu.CALLED_BY_OTHER_FLOWS,
             messageVariables: {
                 slug,
                 flows: callers.join(', ')
             }
         });
     }
+    /**
+   * Other flows' Call flow steps keep working: the URL name they call is not renamed, the paths they
+   * start at are not dropped, and nothing else they rely on changes under them - access, body,
+   * required inputs, the flow staying on, the call chain staying loop-free and within depth.
+   */ async assertCallersKept(before, after, live) {
+        if (after.slug !== before.slug) return this.assertNotCalled(before.slug, [
+            before.id
+        ]);
+        await this.assertEndpointsNotCalled(before, after);
+        await this.assertCallsStillValid(before, {
+            ...after,
+            ...live
+        });
+    }
+    /**
+   * Checks each running flow that calls this one, directly or through other flows, against the flows
+   * as they are and as this change leaves them, and refuses the change when it adds a problem. A
+   * caller already broken for another reason does not block it; only what this change breaks does.
+   */ async assertCallsStillValid(before, after) {
+        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).find();
+        const running = flows.filter((flow)=>flow.id !== before.id && flow.isActive && isPublished(flow) && calledSlugs(flow.nodes).length);
+        if (!running.length) return;
+        const now = new Map(flows.map((flow)=>[
+                flow.slug,
+                callableOf(flow)
+            ]));
+        const next = new Map(now).set(before.slug, callableOf(after));
+        const broken = [];
+        for (const caller of running){
+            const settings = toFlowSettings(caller);
+            // Counted, not a set: two steps with the same label can share a problem, and only the new one is added.
+            const existing = new Map();
+            for (const problem of (0,_flow_engine_flow_graph_validator_js__rspack_import_10/* .callProblems */.r7)(settings, before.slug, now)){
+                const key = JSON.stringify(problem);
+                existing.set(key, (existing.get(key) ?? 0) + 1);
+            }
+            const added = (0,_flow_engine_flow_graph_validator_js__rspack_import_10/* .callProblems */.r7)(settings, before.slug, next).filter((problem)=>{
+                const key = JSON.stringify(problem);
+                const left = existing.get(key) ?? 0;
+                existing.set(key, left - 1);
+                return left <= 0;
+            });
+            if (added.length) broken.push({
+                flow: caller.name,
+                problems: added
+            });
+        }
+        if (!broken.length) return;
+        const names = broken.map((b)=>b.flow).join(', ');
+        throw new _nestjs_common__rspack_import_4.ConflictException({
+            message: `This change breaks flows that call '${before.slug}': ${names}. Change those flows first.`,
+            messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.CALLERS_BROKEN */.wu.CALLERS_BROKEN,
+            messageVariables: {
+                slug: before.slug,
+                flows: names
+            },
+            errors: broken.flatMap((b)=>b.problems.map((problem)=>({
+                        field: 'flow',
+                        flow: b.flow,
+                        ...problem
+                    })))
+        });
+    }
     /** A URL other flows' Call flow steps start at cannot be removed or renamed from under them. */ async assertEndpointsNotCalled(before, after) {
-        const kept = new Set((0,_flow_engine_flow_types_js__rspack_import_8/* .flowEndpoints */.Xr)(after).map((e)=>e.path));
-        const removed = (0,_flow_engine_flow_types_js__rspack_import_8/* .flowEndpoints */.Xr)(before).map((e)=>e.path).filter((path)=>!kept.has(path));
+        const kept = new Set((0,_flow_engine_flow_types_js__rspack_import_11/* .flowEndpoints */.Xr)(after).map((e)=>e.path));
+        const removed = (0,_flow_engine_flow_types_js__rspack_import_11/* .flowEndpoints */.Xr)(before).map((e)=>e.path).filter((path)=>!kept.has(path));
         if (!removed.length) return;
-        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).find({
+        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).find({
             select: {
                 id: true,
                 name: true,
@@ -4209,9 +4578,9 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
             const callers = flows.filter((flow)=>flow.id !== before.id && calledTargets(flow.nodes).some((t)=>t.slug === before.slug && t.endpoint === path)).map((flow)=>flow.name);
             if (!callers.length) continue;
             const url = `api-flows/${before.slug}${path ? `/${path}` : ''}`;
-            throw new _nestjs_common__rspack_import_3.ConflictException({
+            throw new _nestjs_common__rspack_import_4.ConflictException({
                 message: `The URL ${url} is called by: ${callers.join(', ')}. Change those flows first.`,
-                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.ENDPOINT_CALLED_BY_OTHER_FLOWS */.wu.ENDPOINT_CALLED_BY_OTHER_FLOWS,
+                messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.ENDPOINT_CALLED_BY_OTHER_FLOWS */.wu.ENDPOINT_CALLED_BY_OTHER_FLOWS,
                 messageVariables: {
                     url,
                     flows: callers.join(', ')
@@ -4222,9 +4591,9 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
     async assertSaveable(settings, user, selfId) {
         const { errors, warnings } = await this.validate(settings);
         if (errors.length) {
-            throw new _nestjs_common__rspack_import_3.BadRequestException({
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'The flow has problems.',
-                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.INVALID */.wu.INVALID,
+                messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.INVALID */.wu.INVALID,
                 errors: errors.map((error)=>({
                         field: 'flow',
                         ...error
@@ -4232,16 +4601,16 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
                 warnings
             });
         }
-        const clash = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).findOne({
+        const clash = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).findOne({
             where: {
                 slug: settings.slug
             },
             withDeleted: true
         });
         if (clash && clash.id !== selfId) {
-            throw new _nestjs_common__rspack_import_3.ConflictException({
+            throw new _nestjs_common__rspack_import_4.ConflictException({
                 message: `The URL name '${settings.slug}' is already used by another flow.`,
-                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.SLUG_TAKEN */.wu.SLUG_TAKEN,
+                messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.SLUG_TAKEN */.wu.SLUG_TAKEN,
                 messageVariables: {
                     slug: settings.slug
                 }
@@ -4250,7 +4619,6 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
         await this.assertMayAuthor(settings, user);
     }
     /** The extra permissions a flow needs from whoever writes it: saving it, or test-running it as an unsaved draft. */ async assertMayAuthor(settings, user) {
-        if (settings.runAs === 'system') await this.assertHasPermission(user, _flusys_nestjs_shared__rspack_import_0.FLOW_DEFINITION_PERMISSIONS.SYSTEM);
         if (settings.nodes.some((node)=>node?.type === 'code')) await this.assertHasPermission(user, _flusys_nestjs_shared__rspack_import_0.FLOW_DEFINITION_PERMISSIONS.CODE);
     }
     async assertMayCreate(user) {
@@ -4258,13 +4626,13 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
     }
     /**
    * A test run needs what running the flow for real would: the author permissions for its
-   * run-as and code nodes (a saved flow as much as a draft). A live run also needs what makes it
-   * real - a draft the permission to save it, a permission flow its own execute permission.
-   */ async assertMayTest(settings, user, run) {
+   * code nodes (a saved flow as much as a draft). A live run also needs what makes it
+   * real - a draft the permission to save it, a permission URL its own execute permission.
+   */ async assertMayTest(settings, endpoint, user, run) {
         await this.assertMayAuthor(settings, user);
         if (run.mode !== 'live') return;
         if (run.draft) await this.assertHasPermission(user, run.saved ? _flusys_nestjs_shared__rspack_import_0.FLOW_DEFINITION_PERMISSIONS.UPDATE : _flusys_nestjs_shared__rspack_import_0.FLOW_DEFINITION_PERMISSIONS.CREATE);
-        if (settings.authMode === 'permission') await this.assertHasPermission(user, settings.permissionCode || defaultFlowPermissionCode(settings.slug));
+        if (endpoint?.authMode === 'permission') await this.permissionCache.assertPermissionLogic(user, flowPermissions(endpoint, settings.slug));
     }
     assertHasPermission(user, permission) {
         return this.permissionCache.assertPermission(user, permission);
@@ -4274,37 +4642,171 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
             dto
         ]){
             await this.assertSaveable(toFlowSettings(d), user);
-            // JSON columns have no database default, so leaving the optional settings out must not mean NULL.
-            d.inputSchema ??= [];
-            d.bodyType ??= 'object';
-            d.authMode ??= 'jwt';
-            d.runAs ??= 'caller';
+            d.nodes = (0,_flow_engine_flow_api_key_js__rspack_import_9/* .sealApiKeys */.ue)(d.nodes);
+            d.version = 0;
         }
     }
-    async beforeUpdateOperation(dto, user, _qr) {
+    /**
+   * Checked against what the save produces: the draft of a published flow, the flow itself before its
+   * first publish. An unpublished flow changes in place, so its callers are protected now, not at publish.
+   */ async beforeUpdateOperation(dto, user, _qr) {
         for (const d of Array.isArray(dto) ? dto : [
             dto
         ]){
             const existing = await this.findOrFail(d.id);
-            const merged = toFlowSettings({
-                ...existing,
+            const settings = toFlowSettings({
+                ...workingCopy(existing),
                 ...stripUndefined(d)
             });
-            await this.assertSaveable(merged, user, existing.id);
-            if (merged.slug !== existing.slug) await this.assertNotCalled(existing.slug, [
-                existing.id
-            ]);
-            else await this.assertEndpointsNotCalled(existing, merged);
-            d.version = existing.version + 1;
+            await this.assertSaveable(settings, user, existing.id);
+            if (!isPublished(existing)) await this.assertCallersKept(existing, settings, {
+                isActive: d.isActive ?? existing.isActive,
+                version: existing.version
+            });
+            if (d.nodes) d.nodes = (0,_flow_engine_flow_api_key_js__rspack_import_9/* .sealApiKeys */.ue)(d.nodes);
+        }
+    }
+    /** A published flow keeps running as published: the edits go to its draft (none when they match what is live). */ async convertSingleDtoToEntity(dto, user) {
+        const id = dto.id;
+        if (!id) return super.convertSingleDtoToEntity(dto, user);
+        const existing = await this.findOrFail(id);
+        if (!isPublished(existing)) return super.convertSingleDtoToEntity(dto, user);
+        const draft = snapshotOf({
+            ...workingCopy(existing),
+            ...stripUndefined(dto)
+        });
+        existing.draft = sameSnapshot(draft, snapshotOf(existing)) ? null : draft;
+        return existing;
+    }
+    /**
+   * Makes the draft (or, before the first publish, the flow as saved) what callers run, as the next
+   * version. It is checked like a save, plus what only going live can break: other flows calling
+   * this one by a URL name or path it no longer has.
+   */ async publish(id, note, user) {
+        const existing = await this.findOrFail(id);
+        const published = isPublished(existing);
+        if (published && !existing.draft) throw new _nestjs_common__rspack_import_4.BadRequestException({
+            message: 'There are no changes to publish.',
+            messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.NOTHING_TO_PUBLISH */.wu.NOTHING_TO_PUBLISH
+        });
+        const next = workingCopy(existing);
+        const settings = toFlowSettings(next);
+        await this.assertSaveable(settings, user, existing.id);
+        await this.assertCallersKept(existing, settings, {
+            isActive: next.isActive ?? existing.isActive,
+            version: existing.version + 1
+        });
+        const qr = await this.provider.getQueryRunner();
+        try {
+            await qr.connect();
+            await qr.startTransaction();
+            const versions = qr.manager.getRepository(_entities_flow_version_entity_js__rspack_import_8/* .FlowVersion */.p);
+            Object.assign(existing, next, {
+                draft: null,
+                version: existing.version + 1,
+                updatedById: user?.id ?? null
+            });
+            await qr.manager.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G).save(existing);
+            await versions.save(versions.create({
+                flowId: existing.id,
+                version: existing.version,
+                definition: next,
+                note: note?.trim() || null,
+                publishedAt: new Date(),
+                publishedById: user?.id ?? null
+            }));
+            await qr.commitTransaction();
+        } catch (error) {
+            await qr.rollbackTransaction().catch(()=>undefined);
+            throw error;
+        } finally{
+            await qr.release().catch(()=>undefined);
         }
+        await this.clearCaches(existing);
+        await this.provisionPermissions([
+            existing
+        ]);
+        return existing;
+    }
+    /** Newest first, without the definitions (`getVersion` returns one in full). */ async listVersions(flowId) {
+        await this.findOrFail(flowId);
+        return (await this.provider.getRepository(_entities_flow_version_entity_js__rspack_import_8/* .FlowVersion */.p)).find({
+            where: {
+                flowId
+            },
+            order: {
+                version: 'DESC'
+            },
+            select: {
+                id: true,
+                flowId: true,
+                version: true,
+                note: true,
+                publishedAt: true,
+                publishedById: true
+            }
+        });
+    }
+    async getVersion(flowId, version) {
+        const row = await (await this.provider.getRepository(_entities_flow_version_entity_js__rspack_import_8/* .FlowVersion */.p)).findOne({
+            where: {
+                flowId,
+                version
+            }
+        });
+        if (!row) throw new _nestjs_common__rspack_import_4.NotFoundException({
+            message: `Version ${version} of this flow was not found.`,
+            messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.VERSION_NOT_FOUND */.wu.VERSION_NOT_FOUND,
+            messageVariables: {
+                version
+            }
+        });
+        return row;
+    }
+    /**
+   * Puts an old version back into the draft; callers keep the published flow until it is published
+   * again. Not checked like a save (the entities it names may have changed since), but the author
+   * still needs the permissions its code steps call for.
+   */ async restoreVersion(flowId, version, user) {
+        const flow = await this.findOrFail(flowId);
+        const snapshot = snapshotOf((await this.getVersion(flowId, version)).definition);
+        await this.assertMayAuthor(toFlowSettings(snapshot), user);
+        flow.draft = sameSnapshot(snapshot, snapshotOf(flow)) ? null : snapshot;
+        return this.saveDraft(flow, user);
+    }
+    async discardDraft(flowId, user) {
+        const flow = await this.findOrFail(flowId);
+        if (!flow.draft) throw new _nestjs_common__rspack_import_4.BadRequestException({
+            message: 'This flow has no unpublished changes.',
+            messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.NO_DRAFT */.wu.NO_DRAFT
+        });
+        flow.draft = null;
+        return this.saveDraft(flow, user);
+    }
+    async saveDraft(flow, user) {
+        await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).update(flow.id, {
+            draft: flow.draft,
+            updatedById: user?.id ?? null
+        });
+        await this.clearCaches(flow);
+        return flow;
+    }
+    async clearCaches(flow) {
+        if (!this.isCacheable) return;
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                flow
+            ])
+        ]);
     }
     async beforeDeleteOperation(dto, user, _qr) {
         const ids = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
-        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_6/* .FlowDefinition */.G)).find({
+        const flows = await (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G)).find({
             where: {
-                id: (0,typeorm__rspack_import_4.In)(ids)
+                id: (0,typeorm__rspack_import_5.In)(ids)
             },
             withDeleted: true
         });
@@ -4312,39 +4814,50 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
         if (dto.type === 'restore') return;
         for (const flow of flows)await this.assertNotCalled(flow.slug, ids);
     }
-    async afterInsertOperation(entities) {
-        await this.provisionPermissions(entities);
-    }
-    async afterUpdateOperation(entities) {
-        await this.provisionPermissions(entities);
-    }
-    async provisionPermissions(flows) {
-        const needing = flows.filter((f)=>f.authMode === 'permission');
-        if (!needing.length) return;
+    /** The flow's execute permission, registered so it can be granted, when a published URL asks for it (a URL with its own rule names existing permissions). */ async provisionPermissions(flows) {
         if (!this.actionRegistry) return;
-        await this.actionRegistry.registerActions(needing.map((f)=>({
-                code: f.permissionCode || defaultFlowPermissionCode(f.slug),
-                name: `Run ${f.name}`
+        const actions = new Map();
+        for (const flow of flows){
+            for (const endpoint of (0,_flow_engine_flow_types_js__rspack_import_11/* .flowEndpoints */.Xr)(flow)){
+                if (endpoint.authMode !== 'permission' || endpoint.permissions) continue;
+                const code = defaultFlowPermissionCode(flow.slug);
+                if (!actions.has(code)) actions.set(code, endpoint.path ? `Run ${flow.name} (${endpoint.path})` : `Run ${flow.name}`);
+            }
+        }
+        if (actions.size) await this.actionRegistry.registerActions([
+            ...actions
+        ].map(([code, name])=>({
+                code,
+                name
             })));
     }
 }
 FlowDefinitionService = _ts_decorate([
-    (0,_nestjs_common__rspack_import_3.Injectable)({
-        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    (0,_nestjs_common__rspack_import_4.Injectable)({
+        scope: _nestjs_common__rspack_import_4.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_entity_builder_datasource_provider_js__rspack_import_9/* .EntityBuilderDataSourceProvider */.D)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.SharedPermissionCacheService)),
-    _ts_param(4, (0,_nestjs_common__rspack_import_3.Optional)()),
-    _ts_param(4, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared__rspack_import_0.PERMISSION_ACTION_REGISTRY)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_entity_builder_datasource_provider_js__rspack_import_12/* .EntityBuilderDataSourceProvider */.D)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared__rspack_import_0.PERMISSION_ACTION_REGISTRY)),
+    _ts_param(5, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(5, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.NOTIFICATION_ADAPTER)),
+    _ts_param(6, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(6, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.EMAIL_ADAPTER)),
+    _ts_param(7, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(7, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.COMPANY_ACCESS_RESOLVER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache,
-        typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
-        typeof _entity_builder_datasource_provider_js__rspack_import_9/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_9/* .EntityBuilderDataSourceProvider */.D,
-        typeof _flusys_nestjs_shared_modules__rspack_import_2.SharedPermissionCacheService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.SharedPermissionCacheService,
-        typeof IPermissionActionRegistry === "undefined" ? Object : IPermissionActionRegistry
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.UtilsService,
+        typeof _entity_builder_datasource_provider_js__rspack_import_12/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_12/* .EntityBuilderDataSourceProvider */.D,
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService,
+        typeof IPermissionActionRegistry === "undefined" ? Object : IPermissionActionRegistry,
+        typeof INotificationAdapter === "undefined" ? Object : INotificationAdapter,
+        typeof IEmailAdapter === "undefined" ? Object : IEmailAdapter,
+        typeof ICompanyAccessResolver === "undefined" ? Object : ICompanyAccessResolver
     ])
 ], FlowDefinitionService);
 /** What the `call_flow` nodes of a flow run: a slug, and the path of the Request step they start at (null: the flow's own URL). */ function calledTargets(nodes) {
@@ -4356,6 +4869,13 @@ FlowDefinitionService = _ts_decorate([
         };
     });
 }
+/** What a Call flow step checks about a flow: it runs only once published and switched on. */ function callableOf(flow) {
+    return {
+        isActive: flow.isActive && isPublished(flow),
+        endpoints: (0,_flow_engine_flow_types_js__rspack_import_11/* .flowEndpoints */.Xr)(flow),
+        calls: calledSlugs(flow.nodes)
+    };
+}
 /** Slugs the `call_flow` nodes of a flow run. */ function calledSlugs(nodes) {
     return calledTargets(nodes).map((target)=>target.slug);
 }
@@ -4365,10 +4885,14 @@ function stripUndefined(value) {
 
 __webpack_require__.d(__webpack_exports__, {
   RK: () => (toFlowSettings),
-  Tk: () => (FlowDefinitionService)
+  Tk: () => (FlowDefinitionService),
+  eY: () => (snapshotOf)
 }, {
   Er: defaultFlowPermissionCode,
-  YW: flowNotFound
+  HF: isPublished,
+  YW: flowNotFound,
+  j4: flowPermissions,
+  lw: workingCopy
 });
 
 
@@ -4428,8 +4952,11 @@ class FlowExecutionService {
             await repo.save(repo.create({
                 flowId: entry.flowId,
                 flowSlug: entry.flowSlug,
+                flowVersion: entry.flowVersion,
                 status: entry.result.status,
                 trigger: entry.trigger,
+                endpointNodeId: entry.endpoint?.nodeId ?? null,
+                endpointPath: entry.endpoint?.path ?? null,
                 mode: entry.mode,
                 statusCode: entry.result.statusCode,
                 input: inputText.length > INPUT_LIMIT_CHARS ? {
@@ -4480,6 +5007,8 @@ class FlowExecutionService {
         const where = {};
         if (query.flowId) where.flowId = query.flowId;
         if (query.status) where.status = query.status;
+        if (query.trigger) where.trigger = query.trigger;
+        if (query.endpointNodeId) where.endpointNodeId = query.endpointNodeId;
         const [rows, total] = await repo.findAndCount({
             where,
             order: {
@@ -4492,8 +5021,11 @@ class FlowExecutionService {
                 id: true,
                 flowId: true,
                 flowSlug: true,
+                flowVersion: true,
                 status: true,
                 trigger: true,
+                endpointNodeId: true,
+                endpointPath: true,
                 mode: true,
                 statusCode: true,
                 durationMs: true,
@@ -4538,7 +5070,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-4698(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+3908(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -4548,10 +5080,14 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/classes"
 var classes_ = __webpack_require__(6937);
-// EXTERNAL MODULE: external "@flusys/nestjs-shared/exceptions"
-var exceptions_ = __webpack_require__(2417);
+;// CONCATENATED MODULE: external "@flusys/nestjs-shared/exceptions"
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/interfaces"
+var interfaces_ = __webpack_require__(5103);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
 var modules_ = __webpack_require__(1236);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(9216);
 // EXTERNAL MODULE: external "@nestjs/common"
 var common_ = __webpack_require__(6157);
 // EXTERNAL MODULE: external "@nestjs/core"
@@ -4790,7 +5326,7 @@ const BLOCKED_REQUEST_HEADERS = new Set([
 }
 
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/index.ts + 2 modules
-var rule_engine = __webpack_require__(5920);
+var rule_engine = __webpack_require__(8552);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/entity-builder-config.service.ts
 var entity_builder_config_service = __webpack_require__(4281);
 // EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/services/entity-builder-datasource.provider.ts
@@ -4843,6 +5379,8 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
 
 
 
@@ -4853,27 +5391,32 @@ const publishFlowEvent = (eventName, payload, user)=>(0,classes_.publishDomainEv
         metadata: payload,
         user
     });
-/** The run's time budget, whatever a definition asks for. */ const flowTimeout = (timeoutMs)=>typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) ? Math.min(Math.max(timeoutMs, flow_types/* .FLOW_LIMITS.MIN_TIMEOUT_MS */.Or.MIN_TIMEOUT_MS), flow_types/* .FLOW_LIMITS.MAX_TIMEOUT_MS */.Or.MAX_TIMEOUT_MS) : flow_types/* .FLOW_LIMITS.DEFAULT_TIMEOUT_MS */.Or.DEFAULT_TIMEOUT_MS;
+/** The run's time budget, whatever a Request step asks for. */ const flowTimeout = (timeoutMs)=>typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) ? Math.min(Math.max(timeoutMs, flow_types/* .FLOW_LIMITS.MIN_TIMEOUT_MS */.Or.MIN_TIMEOUT_MS), flow_types/* .FLOW_LIMITS.MAX_TIMEOUT_MS */.Or.MAX_TIMEOUT_MS) : flow_types/* .FLOW_LIMITS.DEFAULT_TIMEOUT_MS */.Or.DEFAULT_TIMEOUT_MS;
 class FlowExecutorService {
     provider;
     ruleEngine;
     moduleRef;
     permissionCache;
     config;
+    companyAccess;
+    notifications;
+    email;
+    branchHierarchy;
     logger = new common_.Logger(FlowExecutorService.name);
-    constructor(provider, ruleEngine, moduleRef, permissionCache, config){
+    constructor(provider, ruleEngine, moduleRef, permissionCache, config, companyAccess, notifications, email, branchHierarchy){
         this.provider = provider;
         this.ruleEngine = ruleEngine;
         this.moduleRef = moduleRef;
         this.permissionCache = permissionCache;
         this.config = config;
+        this.companyAccess = companyAccess;
+        this.notifications = notifications;
+        this.email = email;
+        this.branchHierarchy = branchHierarchy;
     }
-    async run(definition, options) {
+    async run(flow, options) {
         const startedAt = Date.now();
-        const flow = {
-            ...definition,
-            timeoutMs: flowTimeout(definition.timeoutMs)
-        };
+        const start = (0,flow_types/* .startEndpoint */.IE)(flow, options.startAt);
         const state = {
             startAt: options.startAt,
             input: options.input,
@@ -4881,14 +5424,14 @@ class FlowExecutorService {
             context: {},
             request: options.request,
             user: options.user,
+            authorization: options.authorization,
             permissions: this.ruleEngine.createPermissionResolver(options.user),
             mode: options.mode,
-            runAs: flow.runAs,
-            systemAuthorized: flow.runAs === 'system' && options.systemAuthorized === true,
             steps: 0,
             httpCalls: 0,
+            messages: 0,
             writes: 0,
-            deadline: startedAt + flow.timeoutMs,
+            deadline: startedAt + flowTimeout(start?.timeoutMs),
             callStack: [
                 flow.slug
             ],
@@ -4896,15 +5439,7 @@ class FlowExecutorService {
             trace: []
         };
         try {
-            if (!flow_types/* .FLOW_RUN_AS.includes */.gl.includes(flow.runAs)) {
-                throw new flow_errors/* .FlowHttpError */.hk(403, 'This flow is not allowed to run.', undefined, {
-                    messageKey: message_keys/* .FLOW_ERROR_MESSAGES.RUN_AS_NOT_ALLOWED */.zr.RUN_AS_NOT_ALLOWED,
-                    messageVariables: {
-                        runAs: String(flow.runAs)
-                    }
-                });
-            }
-            await this.execute(flow, state, this.createEnv());
+            await this.execute(flow, start?.isTransactional === true, state, this.createEnv());
             return {
                 ...(0,flow_engine/* .successResult */.JK)(state, startedAt),
                 ...state.savedUpTo ? {
@@ -4934,10 +5469,10 @@ class FlowExecutorService {
         }
     }
     /**
-   * Walks `flow`. A flow called from inside a transaction joins it; otherwise a transactional
-   * flow (or any test run) gets its own, and its held-back events are published after the commit.
-   */ async execute(flow, state, env) {
-        if (state.qr || !(flow.isTransactional || state.mode === 'dry_run')) {
+   * Walks `flow`. A flow called from inside a transaction joins it; otherwise a run whose Request step
+   * is transactional (or any test run) gets its own, and its held-back events are published after the commit.
+   */ async execute(flow, transactional, state, env) {
+        if (state.qr || !(transactional || state.mode === 'dry_run')) {
             await new flow_engine/* .FlowEngine */.$I(flow, env).walk(state);
             return;
         }
@@ -5016,7 +5551,6 @@ class FlowExecutorService {
             max: flow_types/* .FLOW_LIMITS.MAX_CALL_DEPTH */.Or.MAX_CALL_DEPTH
         });
         const flow = await this.findCallable(slug, parent.qr);
-        await this.assertMayCall(flow, parent, env);
         const settings = (0,flow_definition_service/* .toFlowSettings */.RK)(flow);
         const start = (0,flow_types/* .findEndpoint */.vS)(settings, endpoint);
         if (!start) {
@@ -5025,6 +5559,7 @@ class FlowExecutorService {
                 endpoint: endpoint ?? ''
             }, `Flow '${slug}' has no URL '${endpoint ?? ''}'.`);
         }
+        await this.assertMayCall(flow, start, parent, env);
         const checked = (0,flow_input_validator/* .validateFlowInput */.v)(start.inputSchema, input, start.bodyType);
         if (checked.errors.length) {
             throw new flow_errors/* .FlowHttpError */.hk(400, 'Validation failed', checked.errors, {
@@ -5041,15 +5576,14 @@ class FlowExecutorService {
             context: {},
             request: parent.request,
             user: parent.user,
+            authorization: parent.authorization,
             permissions: parent.permissions,
             mode: parent.mode,
-            runAs: flow.authMode === 'internal' ? parent.runAs : settings.runAs,
-            // A function inherits the caller's grant; any other called flow is a saved flow whose own run-as was checked when it was saved.
-            systemAuthorized: flow.authMode === 'internal' ? parent.systemAuthorized === true : settings.runAs === 'system',
             steps: parent.steps,
             httpCalls: parent.httpCalls,
+            messages: parent.messages,
             writes: parent.writes,
-            deadline: Math.min(parent.deadline, Date.now() + flowTimeout(settings.timeoutMs)),
+            deadline: Math.min(parent.deadline, Date.now() + flowTimeout(start.timeoutMs)),
             qr: parent.qr,
             callStack: [
                 ...parent.callStack,
@@ -5064,13 +5598,14 @@ class FlowExecutorService {
             if (child.pendingEvents === parent.pendingEvents) parent.pendingEvents.length = queued;
         };
         try {
-            await this.execute(settings, child, env);
+            await this.execute(settings, start.isTransactional, child, env);
         } catch (error) {
             dropQueued();
             throw calledFlowFailure(flow, error);
         } finally{
             parent.steps = child.steps;
             parent.httpCalls = child.httpCalls;
+            parent.messages = child.messages;
             parent.writes = child.writes;
         }
         if (child.response) {
@@ -5089,7 +5624,8 @@ class FlowExecutorService {
             where: {
                 slug,
                 isActive: true,
-                deletedAt: (0,external_typeorm_.IsNull)()
+                deletedAt: (0,external_typeorm_.IsNull)(),
+                version: (0,external_typeorm_.MoreThan)(0)
             }
         });
         if (!flow) throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.CALLED_FLOW_NOT_FOUND */.zr.CALLED_FLOW_NOT_FOUND, {
@@ -5098,21 +5634,23 @@ class FlowExecutorService {
         return flow;
     }
     /**
-   * Any flow may call a function, and a flow running as the system may call any flow. One running
-   * as the caller may call only what that caller could call directly: public and signed-in flows,
-   * and permission flows when the caller holds the permission - never an API-key flow.
-   */ async assertMayCall(flow, parent, env) {
-        if (parent.runAs === 'system' && parent.systemAuthorized === true || flow.authMode === 'public' || flow.authMode === 'internal') return;
-        if (flow.authMode === 'api_key' || !parent.user) {
+   * The called URL's own access, checked against the run's user: any flow may call a function or a
+   * public URL; a signed-in one needs a user, a permission one the user holding it. An API-key URL
+   * is never called from a flow, which has no key to send.
+   */ async assertMayCall(flow, endpoint, parent, env) {
+        const mode = endpoint.authMode;
+        if (mode === 'public' || mode === 'internal') return;
+        if (mode === 'api_key' || !parent.user) {
             throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.CALLED_FLOW_NOT_ALLOWED */.zr.CALLED_FLOW_NOT_ALLOWED, {
                 flow: flow.slug,
-                authMode: flow.authMode
-            }, `Flow '${flow.slug}' (${flow.authMode}) cannot be called by this caller.`);
+                authMode: mode
+            }, `Flow '${flow.slug}' (${mode}) cannot be called by this caller.`);
         }
-        if (flow.authMode === 'permission') await env.assertPermission(flow.permissionCode || (0,flow_definition_service/* .defaultFlowPermissionCode */.Er)(flow.slug), parent.user);
+        if (mode === 'permission') await env.assertPermissions((0,flow_definition_service/* .flowPermissions */.j4)(endpoint, flow.slug), parent.user);
     }
     createEnv() {
         const entityServices = new Map();
+        /** One lookup per user for the whole run, however many steps ask. */ const access = new Map();
         let permissions;
         const env = {
             ruleEngine: this.ruleEngine,
@@ -5135,29 +5673,48 @@ class FlowExecutorService {
             atomic: (state, work)=>this.atomic(state, work),
             commit: (state)=>this.commitProgress(state),
             http: flowHttpRequest,
+            notifications: this.notifications,
+            email: this.email,
+            ...this.companyAccess ? {
+                companyMembers: (companyId, branchIds)=>this.companyAccess.getCompanyMembers(companyId, branchIds)
+            } : {},
+            ...this.branchHierarchy ? {
+                branchTree: (branchIds)=>this.branchHierarchy.getDescendantIds(branchIds, {
+                        includeSelf: true
+                    })
+            } : {},
+            companyAccess: (userId)=>{
+                if (!access.has(userId)) access.set(userId, this.companyAccess ? this.companyAccess.getUserAccess(userId) : Promise.resolve({
+                    companies: [],
+                    branches: []
+                }));
+                return access.get(userId);
+            },
             publish: (eventName, payload, user)=>publishFlowEvent(eventName, payload, user),
-            assertPermission: async (code, user)=>{
+            assertPermissions: async (logic, user)=>{
                 if (!user) throw new common_.UnauthorizedException({
                     message: 'Authentication required',
                     messageKey: constants_.ERROR_MESSAGES.UNAUTHORIZED
                 });
-                if (!this.permissionCache.isCacheConfigured()) throw new exceptions_.PermissionSystemUnavailableException();
+                if (!this.permissionCache.isCacheConfigured()) throw new __rspack_external__flusys_nestjs_shared_exceptions_3edf22e9.PermissionSystemUnavailableException();
                 permissions ??= this.permissionCache.getPermissions({
                     userId: user.id,
                     companyId: user.companyId,
                     branchId: user.branchId
                 });
-                const granted = await permissions;
-                if (!this.permissionCache.matchPermission(granted, code)) throw new exceptions_.InsufficientPermissionsException([
-                    code
-                ], 'AND');
+                const result = (0,utils_.evaluatePermissionLogic)(logic, await permissions);
+                if (!result.passed) throw new __rspack_external__flusys_nestjs_shared_exceptions_3edf22e9.InsufficientPermissionsException(result.missingPermissions, result.operator);
             }
         };
         return env;
     }
-    /** After commit, so listeners see committed data. A failing publish never turns a completed run into an error. */ async publishPendingEvents(events, user) {
+    /** After commit, so listeners see committed data and messages go out only for what was saved. A failing publish or send never turns a completed run into an error. */ async publishPendingEvents(events, user) {
         for (const event of events){
             try {
+                if ('delivery' in event) {
+                    await event.send();
+                    continue;
+                }
                 if ('eventName' in event) {
                     await publishFlowEvent(event.eventName, event.payload, user);
                     continue;
@@ -5176,6 +5733,10 @@ class FlowExecutorService {
                     user
                 });
             } catch (error) {
+                if ('delivery' in event) {
+                    this.logger.error(`Could not send the message of "${event.delivery}" after the commit: ${error.message}`);
+                    continue;
+                }
                 const name = 'eventName' in event ? event.eventName : `${event.entityCode}.${event.action}`;
                 this.logger.error(`Could not publish ${name}: ${error.message}`);
             }
@@ -5189,13 +5750,25 @@ FlowExecutorService = _ts_decorate([
     _ts_param(2, (0,common_.Inject)(core_.ModuleRef)),
     _ts_param(3, (0,common_.Inject)(modules_.SharedPermissionCacheService)),
     _ts_param(4, (0,common_.Inject)(entity_builder_config_service/* .EntityBuilderConfigService */.E)),
+    _ts_param(5, (0,common_.Optional)()),
+    _ts_param(5, (0,common_.Inject)(interfaces_.COMPANY_ACCESS_RESOLVER)),
+    _ts_param(6, (0,common_.Optional)()),
+    _ts_param(6, (0,common_.Inject)(interfaces_.NOTIFICATION_ADAPTER)),
+    _ts_param(7, (0,common_.Optional)()),
+    _ts_param(7, (0,common_.Inject)(interfaces_.EMAIL_ADAPTER)),
+    _ts_param(8, (0,common_.Optional)()),
+    _ts_param(8, (0,common_.Inject)(interfaces_.BRANCH_HIERARCHY_RESOLVER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof entity_builder_datasource_provider/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : entity_builder_datasource_provider/* .EntityBuilderDataSourceProvider */.D,
         typeof rule_engine/* .RuleEngineService */.iI === "undefined" ? Object : rule_engine/* .RuleEngineService */.iI,
         typeof core_.ModuleRef === "undefined" ? Object : core_.ModuleRef,
         typeof modules_.SharedPermissionCacheService === "undefined" ? Object : modules_.SharedPermissionCacheService,
-        typeof entity_builder_config_service/* .EntityBuilderConfigService */.E === "undefined" ? Object : entity_builder_config_service/* .EntityBuilderConfigService */.E
+        typeof entity_builder_config_service/* .EntityBuilderConfigService */.E === "undefined" ? Object : entity_builder_config_service/* .EntityBuilderConfigService */.E,
+        typeof ICompanyAccessResolver === "undefined" ? Object : ICompanyAccessResolver,
+        typeof INotificationAdapter === "undefined" ? Object : INotificationAdapter,
+        typeof IEmailAdapter === "undefined" ? Object : IEmailAdapter,
+        typeof IBranchHierarchyResolver === "undefined" ? Object : IBranchHierarchyResolver
     ])
 ], FlowExecutorService);
 /** A rejection or a limit inside the called flow is passed on as it is; anything else fails the calling node with the reason. */ function calledFlowFailure(flow, error) {
@@ -5238,7 +5811,7 @@ FlowExecutorService = _ts_decorate([
 /* import */ var _entity_builder_datasource_provider_js__rspack_import_5 = __webpack_require__(424);
 /* import */ var _flow_definition_service_js__rspack_import_6 = __webpack_require__(5229);
 /* import */ var _flow_execution_service_js__rspack_import_7 = __webpack_require__(7810);
-/* import */ var _flow_executor_service_js__rspack_import_8 = __webpack_require__(4698);
+/* import */ var _flow_executor_service_js__rspack_import_8 = __webpack_require__(3908);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -5308,6 +5881,11 @@ const MAX_QUERY_VALUE_LENGTH = 2000;
         receivedAt: new Date().toISOString()
     };
 }
+/** The caller's own `Authorization` header, kept for Request steps that forward it: only for a signed-in (verified) caller. */ function callerAuthorization(caller, user) {
+    if (!user) return undefined;
+    const value = Object.entries(caller.headers).find(([key])=>key.toLowerCase() === 'authorization')?.[1];
+    return typeof value === 'string' && value ? value : undefined;
+}
 /** A test run's request: the designer's own, with the headers / query / IP the author chose to simulate on top. */ function simulatedCaller(caller, simulated) {
     if (!simulated) return caller;
     const headers = {
@@ -5347,13 +5925,13 @@ class FlowRuntimeService {
         this.executions = executions;
         this.definitions = definitions;
     }
-    /** A function flow has no endpoint: it looks the same as an unknown one. */ async findActive(slug) {
+    /** A flow never published is not live yet: it looks the same as an unknown one. */ async findActive(slug) {
         return (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_2/* .FlowDefinition */.G)).findOne({
             where: {
                 slug,
                 isActive: true,
                 deletedAt: (0,typeorm__rspack_import_1.IsNull)(),
-                authMode: (0,typeorm__rspack_import_1.Not)('internal')
+                version: (0,typeorm__rspack_import_1.MoreThan)(0)
             }
         });
     }
@@ -5362,25 +5940,23 @@ class FlowRuntimeService {
         const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(endpoint.inputSchema, body, endpoint.bodyType);
         if (checked.errors.length) {
             const result = inputRejected(checked.errors);
-            await this.logWebhook(flow, body, result, startedAt, user, caller);
+            await this.logWebhook(flow, endpoint, body, result, startedAt, user, caller);
             return result;
         }
-        // A saved flow: saving it as `runAs: system` needed the system permission.
         const result = await this.executor.run((0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(flow), {
             mode: 'live',
             user,
             input: checked.values,
             startAt: endpoint.nodeId,
             request: requestInfo(caller),
-            exposeDetails: false,
-            systemAuthorized: true
+            authorization: callerAuthorization(caller, user),
+            exposeDetails: false
         });
-        await this.logWebhook(flow, checked.values, result, startedAt, user, caller);
+        await this.logWebhook(flow, endpoint, checked.values, result, startedAt, user, caller);
         return result;
     }
     /** The designer's "Test run": a saved flow or an unsaved draft. */ async testRun(dto, user, caller) {
         let settings;
-        let permissionCode;
         let flow = null;
         if (dto.flowId) {
             flow = await this.definitions.findOrFail(dto.flowId);
@@ -5388,10 +5964,8 @@ class FlowRuntimeService {
         if (dto.definition) {
             // The designer's current draft, even for a saved flow: `flow` above is kept only to attribute the run.
             settings = (0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(dto.definition);
-            permissionCode = dto.definition.permissionCode;
         } else if (flow) {
             settings = (0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(flow);
-            permissionCode = flow.permissionCode;
         } else {
             throw new _nestjs_common__rspack_import_0.BadRequestException({
                 message: 'Send a flowId or a definition to test.',
@@ -5399,15 +5973,22 @@ class FlowRuntimeService {
             });
         }
         const mode = dto.mode ?? 'dry_run';
-        // Checked before anything runs; passing it is what lets a `runAs: system` test touch entities.
-        await this.definitions.assertMayTest({
-            ...settings,
-            permissionCode
-        }, user, {
+        const endpoint = (0,_flow_engine_flow_types_js__rspack_import_4/* .findEndpoint */.vS)(settings, dto.endpoint);
+        // Checked before anything runs.
+        await this.definitions.assertMayTest(settings, endpoint, user, {
             mode,
             draft: !!dto.definition,
             saved: !!flow
         });
+        if (!endpoint) {
+            throw new _nestjs_common__rspack_import_0.BadRequestException({
+                message: `This flow has no URL '${dto.endpoint ?? ''}'.`,
+                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.ENDPOINT_NOT_FOUND */.wu.ENDPOINT_NOT_FOUND,
+                messageVariables: {
+                    endpoint: dto.endpoint ?? ''
+                }
+            });
+        }
         const validation = await this.definitions.validate(settings);
         if (validation.errors.length) {
             throw new _nestjs_common__rspack_import_0.BadRequestException({
@@ -5419,16 +6000,6 @@ class FlowRuntimeService {
                     }))
             });
         }
-        const endpoint = (0,_flow_engine_flow_types_js__rspack_import_4/* .findEndpoint */.vS)(settings, dto.endpoint);
-        if (!endpoint) {
-            throw new _nestjs_common__rspack_import_0.BadRequestException({
-                message: `This flow has no URL '${dto.endpoint ?? ''}'.`,
-                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.ENDPOINT_NOT_FOUND */.wu.ENDPOINT_NOT_FOUND,
-                messageVariables: {
-                    endpoint: dto.endpoint ?? ''
-                }
-            });
-        }
         const startedAt = new Date();
         const simulated = simulatedCaller(caller, dto.request);
         const body = dto.input ?? (endpoint.bodyType === 'list' ? [] : {});
@@ -5439,13 +6010,15 @@ class FlowRuntimeService {
             input: checked.values,
             startAt: endpoint.nodeId,
             request: requestInfo(simulated),
-            exposeDetails: true,
-            systemAuthorized: true
+            authorization: callerAuthorization(caller, user),
+            exposeDetails: true
         });
         await this.executions.record({
             flowId: flow?.id ?? null,
             flowSlug: settings.slug,
+            flowVersion: dto.definition ? null : flow?.version ?? null,
             trigger: 'test',
+            endpoint,
             mode,
             input: body,
             result,
@@ -5459,11 +6032,13 @@ class FlowRuntimeService {
             warnings: validation.warnings
         };
     }
-    async logWebhook(flow, input, result, startedAt, user, caller) {
+    async logWebhook(flow, endpoint, input, result, startedAt, user, caller) {
         await this.executions.record({
             flowId: flow.id,
             flowSlug: flow.slug,
+            flowVersion: flow.version,
             trigger: 'webhook',
+            endpoint,
             mode: 'live',
             input,
             result,
@@ -5607,9 +6182,9 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _flusys_nestjs_shared_utils__rspack_import_1 = __webpack_require__(9216);
 /* import */ var _nestjs_common__rspack_import_2 = __webpack_require__(6157);
 /* import */ var _config_event_actions_js__rspack_import_10 = __webpack_require__(982);
-/* import */ var _config_message_keys_js__rspack_import_7 = __webpack_require__(5732);
+/* import */ var _config_message_keys_js__rspack_import_8 = __webpack_require__(5732);
 /* import */ var _enums_entity_status_enum_js__rspack_import_9 = __webpack_require__(1313);
-/* import */ var _enums_field_type_enum_js__rspack_import_8 = __webpack_require__(9614);
+/* import */ var _enums_field_type_enum_js__rspack_import_7 = __webpack_require__(9614);
 /* import */ var _interfaces_generic_record_interface_js__rspack_import_3 = __webpack_require__(3372);
 /* import */ var _database_error_mapper_js__rspack_import_4 = __webpack_require__(8323);
 /* import */ var _field_value_validator_js__rspack_import_5 = __webpack_require__(3525);
@@ -5641,6 +6216,18 @@ const FILTER_COMPARISON_SQL = {
     lt: '<',
     lte: '<='
 };
+/** The LIKE pattern of each text-match operator, built from the already escaped text. */ const TEXT_PATTERN = {
+    contains: (t)=>`%${t}%`,
+    not_contains: (t)=>`%${t}%`,
+    starts_with: (t)=>`${t}%`,
+    ends_with: (t)=>`%${t}`
+};
+const TEXT_FIELD_TYPES = new Set([
+    _enums_field_type_enum_js__rspack_import_7/* .FieldType.TEXT */.P.TEXT,
+    _enums_field_type_enum_js__rspack_import_7/* .FieldType.LONG_TEXT */.P.LONG_TEXT,
+    _enums_field_type_enum_js__rspack_import_7/* .FieldType.EMAIL */.P.EMAIL,
+    _enums_field_type_enum_js__rspack_import_7/* .FieldType.SINGLE_SELECT */.P.SINGLE_SELECT
+]);
 /**
  * Generic CRUD for one dynamically-defined entity, mirroring ApiService's shape
  * (transactional writes, lifecycle event publishing) but
@@ -5692,7 +6279,7 @@ const FILTER_COMPARISON_SQL = {
         if (errors.length === 0) return;
         throw new _nestjs_common__rspack_import_2.BadRequestException({
             message: 'Validation failed',
-            messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.VALIDATION_FAILED */.j4.VALIDATION_FAILED,
+            messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.VALIDATION_FAILED */.j4.VALIDATION_FAILED,
             errors
         });
     }
@@ -5701,14 +6288,14 @@ const FILTER_COMPARISON_SQL = {
         const errors = [];
         for (const field of this.fields){
             const value = values[field.code];
-            if (field.fieldType !== _enums_field_type_enum_js__rspack_import_8/* .FieldType.RELATION */.P.RELATION || !field.relationTargetEntityId || typeof value !== 'string') continue;
+            if (field.fieldType !== _enums_field_type_enum_js__rspack_import_7/* .FieldType.RELATION */.P.RELATION || !field.relationTargetEntityId || typeof value !== 'string') continue;
             const related = await this.resolveRelated(field.relationTargetEntityId, queryRunner);
             const found = await related.exists(value, {
                 queryRunner
             });
             if (!found) errors.push({
                 field: field.code,
-                ...(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_7/* .FIELD_VALIDATION_MESSAGES.RELATED_NOT_FOUND */.KE.RELATED_NOT_FOUND, {
+                ...(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_8/* .FIELD_VALIDATION_MESSAGES.RELATED_NOT_FOUND */.KE.RELATED_NOT_FOUND, {
                     label: field.label
                 })
             });
@@ -5718,7 +6305,7 @@ const FILTER_COMPARISON_SQL = {
     notFound(id) {
         return new _nestjs_common__rspack_import_2.NotFoundException({
             message: `Record '${id}' not found on entity '${this.entityCode}'.`,
-            messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.NOT_FOUND */.j4.NOT_FOUND,
+            messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.NOT_FOUND */.j4.NOT_FOUND,
             messageVariables: {
                 id,
                 entity: this.entityCode
@@ -5746,7 +6333,7 @@ const FILTER_COMPARISON_SQL = {
         if (this.definition.status === _enums_entity_status_enum_js__rspack_import_9/* .EntityStatus.DEPRECATED */.c.DEPRECATED) {
             throw new _nestjs_common__rspack_import_2.ForbiddenException({
                 message: `Entity '${this.definition.code}' has been deprecated and no longer accepts writes.`,
-                messageKey: _config_message_keys_js__rspack_import_7/* .ENTITY_DEFINITION_MESSAGES.DEPRECATED */.pL.DEPRECATED,
+                messageKey: _config_message_keys_js__rspack_import_8/* .ENTITY_DEFINITION_MESSAGES.DEPRECATED */.pL.DEPRECATED,
                 messageVariables: {
                     code: this.definition.code
                 }
@@ -5774,7 +6361,7 @@ const FILTER_COMPARISON_SQL = {
             if (SYSTEM_COLUMNS.has(key)) {
                 throw new _nestjs_common__rspack_import_2.BadRequestException({
                     message: `'${key}' is a system column and cannot be set directly.`,
-                    messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.SYSTEM_COLUMN_READONLY */.j4.SYSTEM_COLUMN_READONLY,
+                    messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.SYSTEM_COLUMN_READONLY */.j4.SYSTEM_COLUMN_READONLY,
                     messageVariables: {
                         key
                     }
@@ -5783,7 +6370,7 @@ const FILTER_COMPARISON_SQL = {
             if (!this.activeFieldCodes.has(key)) {
                 throw new _nestjs_common__rspack_import_2.BadRequestException({
                     message: `'${key}' is not a field on entity '${this.entityCode}'.`,
-                    messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.UNKNOWN_FIELD */.j4.UNKNOWN_FIELD,
+                    messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.UNKNOWN_FIELD */.j4.UNKNOWN_FIELD,
                     messageVariables: {
                         key,
                         entity: this.entityCode
@@ -5856,7 +6443,7 @@ const FILTER_COMPARISON_SQL = {
         if (!dto.id) {
             throw new _nestjs_common__rspack_import_2.BadRequestException({
                 message: 'id is required to update a record.',
-                messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.ID_REQUIRED */.j4.ID_REQUIRED
+                messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.ID_REQUIRED */.j4.ID_REQUIRED
             });
         }
         const { id: _id, ...rest } = dto;
@@ -5865,6 +6452,7 @@ const FILTER_COMPARISON_SQL = {
     /** Soft-deletes the record, or deletes it for good when the entity has soft delete turned off. */ async delete(id, user, options = {}) {
         this.ensureActive();
         const repository = await this.ensureRepository();
+        const soft = this.definition.isSoftDeleteEnabled;
         await this.withTransaction(options, async (queryRunner)=>{
             const existing = await queryRunner.manager.findOne(repository.target, {
                 where: {
@@ -5872,7 +6460,6 @@ const FILTER_COMPARISON_SQL = {
                 }
             });
             if (!existing) throw this.notFound(id);
-            const soft = this.definition.isSoftDeleteEnabled;
             if (soft) {
                 await queryRunner.manager.softDelete(repository.target, [
                     id
@@ -5898,6 +6485,7 @@ const FILTER_COMPARISON_SQL = {
                 ]
             };
         }, user);
+        return soft ? 'deleted' : 'purged';
     }
     async findById(id, options = {}) {
         const repository = await this.repositoryFor(options.queryRunner);
@@ -5944,55 +6532,177 @@ const FILTER_COMPARISON_SQL = {
    * getFilterQuery/getSortQuery (raw client-supplied keys concatenated into SQL) is
    * structurally impossible here since an unknown key is rejected outright. Operators map
    * to a fixed SQL table and every value is a bound parameter. */ applyFilter(query, filter) {
+        const postgres = query.connection.options.type === 'postgres';
         Object.entries(filter).forEach(([key, value], index)=>{
             this.assertKnownColumn(key);
-            const column = `${this.entityCode}.${key}`;
-            const param = `filter_${index}`;
-            if (!(0,_interfaces_generic_record_interface_js__rspack_import_3/* .isRecordFilterCondition */.t1)(value)) {
-                if (value !== null && typeof value === 'object') {
-                    const op = value.op;
-                    if (typeof op === 'string' && !('type' in value) && !_interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_OPS.includes */.ox.includes(op)) throw this.unknownOperator(key, op);
-                    throw this.invalidFilterValue(key, 'eq');
-                }
-                query.andWhere(`${column} = :${param}`, {
-                    [param]: value
-                });
-                return;
+            if (!(0,_interfaces_generic_record_interface_js__rspack_import_3/* .isRecordFilterCondition */.t1)(value) && value !== null && typeof value === 'object') {
+                const op = value.op;
+                if (typeof op === 'string' && !('type' in value) && !_interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_OPS.includes */.ox.includes(op)) throw this.unknownOperator(key, op);
             }
-            const { op, value: operand } = value;
-            if (op === 'is_null' || op === 'not_null') {
-                query.andWhere(`${column} ${op === 'is_null' ? 'IS NULL' : 'IS NOT NULL'}`);
-                return;
-            }
-            if (op === 'in') {
-                if (!Array.isArray(operand) || !operand.every(isFilterScalar)) throw this.invalidFilterValue(key, op);
-                if (operand.length > _interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_LIMITS.MAX_IN_VALUES */.M5.MAX_IN_VALUES) {
-                    throw new _nestjs_common__rspack_import_2.BadRequestException({
-                        message: `The '${key}' filter lists more than ${_interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_LIMITS.MAX_IN_VALUES */.M5.MAX_IN_VALUES} values.`,
-                        messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.FILTER_TOO_MANY_VALUES */.j4.FILTER_TOO_MANY_VALUES,
-                        messageVariables: {
-                            key,
-                            max: _interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_LIMITS.MAX_IN_VALUES */.M5.MAX_IN_VALUES
+            const { op, value: operand } = (0,_interfaces_generic_record_interface_js__rspack_import_3/* .isRecordFilterCondition */.t1)(value) ? value : {
+                op: 'eq',
+                value
+            };
+            this.assertOperatorFits(key, op);
+            const [sql, params] = this.conditionSql(`${this.entityCode}.${key}`, key, op, operand, `filter_${index}`, postgres);
+            query.andWhere(sql, params);
+        });
+        return query;
+    }
+    /** One filter as SQL: the column is a checked field code and every value is a bound parameter. */ conditionSql(column, key, op, operand, param, postgres) {
+        const multiSelect = this.fieldTypeOf(key) === _enums_field_type_enum_js__rspack_import_7/* .FieldType.MULTI_SELECT */.P.MULTI_SELECT;
+        switch(_interfaces_generic_record_interface_js__rspack_import_3/* .FILTER_OP_VALUE_KIND */.w9[op]){
+            case 'none':
+                if (op === 'is_null') return [
+                    `${column} IS NULL`,
+                    {}
+                ];
+                if (op === 'not_null') return [
+                    `${column} IS NOT NULL`,
+                    {}
+                ];
+                if (!multiSelect) return [
+                    op === 'is_empty' ? `(${column} IS NULL OR ${column} = '')` : `(${column} IS NOT NULL AND ${column} <> '')`,
+                    {}
+                ];
+                if (postgres) return [
+                    op === 'is_empty' ? `(${column} IS NULL OR ${column} = '[]'::jsonb)` : `(${column} IS NOT NULL AND ${column} <> '[]'::jsonb)`,
+                    {}
+                ];
+                return [
+                    op === 'is_empty' ? `(${column} IS NULL OR JSON_LENGTH(${column}) = 0)` : `JSON_LENGTH(${column}) > 0`,
+                    {}
+                ];
+            case 'list':
+                {
+                    const values = this.listOperand(key, op, operand);
+                    if (op === 'in') return values.length ? [
+                        `${column} IN (:...${param})`,
+                        {
+                            [param]: values
                         }
-                    });
+                    ] : [
+                        '1 = 0',
+                        {}
+                    ];
+                    if (op === 'not_in') return values.length ? [
+                        `${column} NOT IN (:...${param})`,
+                        {
+                            [param]: values
+                        }
+                    ] : [
+                        '1 = 1',
+                        {}
+                    ];
+                    const holds = (list, name)=>[
+                            postgres ? `${column} @> CAST(:${name} AS jsonb)` : `JSON_CONTAINS(${column}, CAST(:${name} AS JSON))`,
+                            {
+                                [name]: JSON.stringify(list)
+                            }
+                        ];
+                    if (op === 'has_all') return values.length ? holds(values, param) : [
+                        '1 = 1',
+                        {}
+                    ];
+                    if (!values.length) return [
+                        op === 'has_any' ? '1 = 0' : '1 = 1',
+                        {}
+                    ];
+                    const each = values.map((v, i)=>holds([
+                            v
+                        ], `${param}_${i}`));
+                    const any = `(${each.map(([sql])=>sql).join(' OR ')})`;
+                    return [
+                        op === 'has_any' ? any : `NOT ${any}`,
+                        Object.assign({}, ...each.map(([, params])=>params))
+                    ];
+                }
+            case 'range':
+                {
+                    if (!Array.isArray(operand) || operand.length !== 2 || !operand.every(isFilterScalar)) throw this.invalidFilterValue(key, op);
+                    const [from, to] = [
+                        `${param}_from`,
+                        `${param}_to`
+                    ];
+                    return [
+                        `${column} ${op === 'between' ? 'BETWEEN' : 'NOT BETWEEN'} :${from} AND :${to}`,
+                        {
+                            [from]: operand[0],
+                            [to]: operand[1]
+                        }
+                    ];
+                }
+            case 'single':
+                {
+                    if (operand === null && (op === 'eq' || op === 'ne')) return [
+                        `${column} IS ${op === 'eq' ? '' : 'NOT '}NULL`,
+                        {}
+                    ];
+                    if (operand === null || operand === undefined || !isFilterScalar(operand)) throw this.invalidFilterValue(key, op);
+                    if (op === 'ieq') return [
+                        `LOWER(${column}) = LOWER(:${param})`,
+                        {
+                            [param]: String(operand)
+                        }
+                    ];
+                    const pattern = TEXT_PATTERN[op];
+                    if (!pattern) return [
+                        `${column} ${FILTER_COMPARISON_SQL[op]} :${param}`,
+                        {
+                            [param]: operand
+                        }
+                    ];
+                    const text = String(operand);
+                    if (!text.trim()) throw this.invalidFilterValue(key, op);
+                    const like = `${op === 'not_contains' ? 'NOT ' : ''}${postgres ? 'ILIKE' : 'LIKE'}`;
+                    return [
+                        `${column} ${like} :${param}`,
+                        {
+                            [param]: pattern(text.replace(/[\\%_]/g, '\\$&'))
+                        }
+                    ];
+                }
+        }
+    }
+    /** A list of scalars; one scalar (e.g. a single value read from input) counts as a one-item list. */ listOperand(key, op, operand) {
+        const list = isFilterScalar(operand) ? [
+            operand
+        ] : operand;
+        if (!Array.isArray(list) || !list.every(isFilterScalar)) throw this.invalidFilterValue(key, op);
+        if (list.length > _interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_LIMITS.MAX_IN_VALUES */.M5.MAX_IN_VALUES) {
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
+                message: `The '${key}' filter lists more than ${_interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_LIMITS.MAX_IN_VALUES */.M5.MAX_IN_VALUES} values.`,
+                messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.FILTER_TOO_MANY_VALUES */.j4.FILTER_TOO_MANY_VALUES,
+                messageVariables: {
+                    key,
+                    max: _interfaces_generic_record_interface_js__rspack_import_3/* .RECORD_FILTER_LIMITS.MAX_IN_VALUES */.M5.MAX_IN_VALUES
                 }
-                if (!operand.length) query.andWhere('1 = 0');
-                else query.andWhere(`${column} IN (:...${param})`, {
-                    [param]: operand
-                });
-                return;
-            }
-            if (operand === null || operand === undefined || !isFilterScalar(operand)) throw this.invalidFilterValue(key, op);
-            query.andWhere(`${column} ${FILTER_COMPARISON_SQL[op]} :${param}`, {
-                [param]: operand
             });
-        });
-        return query;
+        }
+        return list;
+    }
+    fieldTypeOf(key) {
+        return this.fields.find((f)=>f.code === key && !f.deprecatedAt && !f.isSystemField)?.fieldType;
+    }
+    /** Text operators need a text field, multi-select operators a multi-select one, and nothing but null / blank checks reads a list or JSON field. */ assertOperatorFits(key, op) {
+        const type = this.fieldTypeOf(key);
+        const textField = type !== undefined && TEXT_FIELD_TYPES.has(type);
+        const fits = _interfaces_generic_record_interface_js__rspack_import_3/* .TEXT_FILTER_OPS.includes */.wk.includes(op) ? textField : _interfaces_generic_record_interface_js__rspack_import_3/* .LIST_FIELD_FILTER_OPS.includes */.yV.includes(op) ? type === _enums_field_type_enum_js__rspack_import_7/* .FieldType.MULTI_SELECT */.P.MULTI_SELECT : _interfaces_generic_record_interface_js__rspack_import_3/* .EMPTY_FILTER_OPS.includes */.Oh.includes(op) ? textField || type === _enums_field_type_enum_js__rspack_import_7/* .FieldType.MULTI_SELECT */.P.MULTI_SELECT : op === 'is_null' || op === 'not_null' || type !== _enums_field_type_enum_js__rspack_import_7/* .FieldType.MULTI_SELECT */.P.MULTI_SELECT && type !== _enums_field_type_enum_js__rspack_import_7/* .FieldType.JSON */.P.JSON;
+        if (!fits) {
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
+                message: `The '${op}' filter cannot be used on '${key}'.`,
+                messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.FILTER_OPERATOR_NOT_FOR_FIELD */.j4.FILTER_OPERATOR_NOT_FOR_FIELD,
+                messageVariables: {
+                    key,
+                    op
+                }
+            });
+        }
     }
     unknownOperator(key, op) {
         return new _nestjs_common__rspack_import_2.BadRequestException({
             message: `'${op}' is not a filter operator.`,
-            messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.FILTER_OPERATOR_UNKNOWN */.j4.FILTER_OPERATOR_UNKNOWN,
+            messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.FILTER_OPERATOR_UNKNOWN */.j4.FILTER_OPERATOR_UNKNOWN,
             messageVariables: {
                 key,
                 op,
@@ -6002,8 +6712,8 @@ const FILTER_COMPARISON_SQL = {
     }
     invalidFilterValue(key, op) {
         return new _nestjs_common__rspack_import_2.BadRequestException({
-            message: op === 'in' ? `The '${key}' filter needs a list of values.` : `The '${key}' filter needs a single value.`,
-            messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.FILTER_VALUE_INVALID */.j4.FILTER_VALUE_INVALID,
+            message: `The '${key}' filter has an invalid value for '${op}'.`,
+            messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.FILTER_VALUE_INVALID */.j4.FILTER_VALUE_INVALID,
             messageVariables: {
                 key,
                 op
@@ -6032,7 +6742,7 @@ const FILTER_COMPARISON_SQL = {
         if (key !== 'id' && !this.presentSystemColumns.has(key) && !this.activeFieldCodes.has(key)) {
             throw new _nestjs_common__rspack_import_2.BadRequestException({
                 message: `'${key}' is not a field on entity '${this.entityCode}'.`,
-                messageKey: _config_message_keys_js__rspack_import_7/* .GENERIC_RECORD_MESSAGES.UNKNOWN_FIELD */.j4.UNKNOWN_FIELD,
+                messageKey: _config_message_keys_js__rspack_import_8/* .GENERIC_RECORD_MESSAGES.UNKNOWN_FIELD */.j4.UNKNOWN_FIELD,
                 messageVariables: {
                     key,
                     entity: this.entityCode
@@ -6100,181 +6810,6 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
-},
-5313(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var node_crypto__rspack_import_0 = __webpack_require__(2561);
-/* import */ var typeorm__rspack_import_1 = __webpack_require__(7158);
-/* import */ var _enums_field_type_enum_js__rspack_import_2 = __webpack_require__(9614);
-
-
-
-/** Columns every dynamic table may carry (the `Identity` contract). Everything else is a designed field. */ const SYSTEM_COLUMN_NAMES = [
-    'id',
-    'created_at',
-    'updated_at',
-    'deleted_at',
-    'created_by_id',
-    'updated_by_id',
-    'deleted_by_id'
-];
-/** Field types stored as unbounded text or JSON: an index or unique constraint on them fails (MySQL) or breaks on large values (PostgreSQL). */ const NON_INDEXABLE_FIELD_TYPES = [
-    _enums_field_type_enum_js__rspack_import_2/* .FieldType.LONG_TEXT */.P.LONG_TEXT,
-    _enums_field_type_enum_js__rspack_import_2/* .FieldType.JSON */.P.JSON,
-    _enums_field_type_enum_js__rspack_import_2/* .FieldType.MULTI_SELECT */.P.MULTI_SELECT
-];
-const isIndexableFieldType = (fieldType)=>!NON_INDEXABLE_FIELD_TYPES.includes(fieldType);
-const uuidColumn = (name, driver, options = {})=>new typeorm__rspack_import_1.TableColumn({
-        name,
-        ...driver === 'postgres' ? {
-            type: 'uuid'
-        } : {
-            type: 'char',
-            length: '36'
-        },
-        ...options
-    });
-function buildSystemColumns(flags, driver) {
-    const columns = [
-        uuidColumn('id', driver, {
-            isPrimary: true,
-            isGenerated: true,
-            generationStrategy: 'uuid'
-        }),
-        new typeorm__rspack_import_1.TableColumn({
-            name: 'created_at',
-            type: 'timestamp',
-            isNullable: false,
-            default: 'CURRENT_TIMESTAMP'
-        }),
-        new typeorm__rspack_import_1.TableColumn({
-            name: 'updated_at',
-            type: 'timestamp',
-            isNullable: false,
-            default: 'CURRENT_TIMESTAMP'
-        })
-    ];
-    if (flags.isSoftDeleteEnabled) columns.push(softDeleteColumn());
-    if (flags.isAuditEnabled) columns.push(...auditColumns(driver));
-    return columns;
-}
-const softDeleteColumn = ()=>new typeorm__rspack_import_1.TableColumn({
-        name: 'deleted_at',
-        type: 'timestamp',
-        isNullable: true
-    });
-const auditColumns = (driver)=>[
-        uuidColumn('created_by_id', driver, {
-            isNullable: true
-        }),
-        uuidColumn('updated_by_id', driver, {
-            isNullable: true
-        }),
-        uuidColumn('deleted_by_id', driver, {
-            isNullable: true
-        })
-    ];
-const sameColumns = (columnNames, expected)=>columnNames.length === expected.length && expected.every((c)=>columnNames.includes(c));
-const NAME_HASH_LENGTH = 8;
-/**
- * Deterministic index/constraint name within the driver's identifier limit. The hash of
- * `table.column` keeps names distinct when the readable part is cut short, and when two
- * table/column pairs would read the same (`eb_a_b` + `c` vs `eb_a` + `b_c`).
- */ function indexName(prefix, table, column, maxLength) {
-    const hash = (0,node_crypto__rspack_import_0.createHash)('sha256').update(`${table}.${column}`).digest('hex').slice(0, NAME_HASH_LENGTH);
-    const room = maxLength - prefix.length - hash.length - 2;
-    return `${prefix}_${`${table}_${column}`.slice(0, room)}_${hash}`;
-}
-const plainIndex = (table, column, driver, adapter)=>new typeorm__rspack_import_1.TableIndex({
-        name: indexName('idx', table, column, adapter.maxIdentifierLength(driver)),
-        columnNames: [
-            column
-        ]
-    });
-const tableUnique = (table, column, driver, adapter)=>new typeorm__rspack_import_1.TableUnique({
-        name: indexName('uq', table, column, adapter.maxIdentifierLength(driver)),
-        columnNames: [
-            column
-        ]
-    });
-/** MySQL has no unique constraints (TypeORM refuses them), only unique indexes. */ async function addUnique(qr, table, column, driver, adapter) {
-    const name = indexName('uq', table.name, column, adapter.maxIdentifierLength(driver));
-    if (driver === 'mysql') {
-        await qr.createIndex(table, new typeorm__rspack_import_1.TableIndex({
-            name,
-            columnNames: [
-                column
-            ],
-            isUnique: true
-        }));
-        return;
-    }
-    await qr.createUniqueConstraint(table, new typeorm__rspack_import_1.TableUnique({
-        name,
-        columnNames: [
-            column
-        ]
-    }));
-}
-/** The stored column type, with a `uuid` stored before MySQL support became char(36) resolved to what MySQL accepts. */ function columnType(field, driver, adapter) {
-    const type = field.dbType || adapter.mapFieldType(field.fieldType, driver);
-    return driver === 'mysql' && type === 'uuid' ? 'char' : type;
-}
-/**
- * Column for a field. `enforceNotNull` controls whether the DB column is NOT NULL: true when
- * the table is brand new (no rows can violate it); false when adding to a table that already
- * has rows (the NOT NULL is applied afterwards, once the column has been backfilled).
- */ function buildFieldColumn(field, driver, adapter, options) {
-    const sizing = adapter.getColumnSizing(field.fieldType, driver);
-    return new typeorm__rspack_import_1.TableColumn({
-        name: field.code,
-        type: columnType(field, driver, adapter),
-        length: sizing.length,
-        precision: sizing.precision ?? undefined,
-        scale: sizing.scale,
-        isNullable: options.enforceNotNull ? field.nullable : true,
-        isUnique: options.withUnique ? field.unique : false
-    });
-}
-/** The SQL type text for a field type on a driver, e.g. `varchar(255)`, `numeric(18,4)`, `char(36)`. */ function sqlTypeFor(fieldType, driver, adapter) {
-    const base = adapter.mapFieldType(fieldType, driver);
-    const sizing = adapter.getColumnSizing(fieldType, driver);
-    if (sizing.length) return `${base}(${sizing.length})`;
-    if (sizing.precision !== undefined) return `${base}(${sizing.precision},${sizing.scale ?? 0})`;
-    return base;
-}
-/** Coarse type family, so `character varying` (pg) and `varchar` (mysql) compare equal. */ function typeFamily(type) {
-    const t = type.toLowerCase();
-    if (t === 'uuid') return 'uuid';
-    if (t.includes('json')) return 'json';
-    if (t.includes('timestamp') || t === 'datetime') return 'timestamp';
-    if (t === 'date') return 'date';
-    if (t.includes('bool') || t === 'tinyint') return 'boolean';
-    if (t.includes('int') && !t.includes('point')) return 'integer';
-    if (t.includes('numeric') || t.includes('decimal')) return 'numeric';
-    if (t.includes('char') || t === 'varchar') return 'varchar';
-    if (t.includes('text')) return 'text';
-    return t;
-}
-
-__webpack_require__.d(__webpack_exports__, {
-  $6: () => (addUnique),
-  Rm: () => (buildSystemColumns),
-  cg: () => (sqlTypeFor),
-  fu: () => (buildFieldColumn),
-  jp: () => (typeFamily),
-  mo: () => (indexName)
-}, {
-  G7: sameColumns,
-  HK: auditColumns,
-  OG: softDeleteColumn,
-  d4: isIndexableFieldType,
-  gW: NON_INDEXABLE_FIELD_TYPES,
-  mq: SYSTEM_COLUMN_NAMES,
-  uy: tableUnique,
-  v7: plainIndex
-});
-
-
 },
 7259(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);