@flusys/nestjs-entity-builder 9.1.1 → 9.2.0

package/fesm/870.js

@@ -383,6 +383,7 @@ _ts_decorate([
 /** Form values arrive as text: `true` / `false` become booleans, anything else is left for the validator to refuse. */ const FormBoolean = ()=>(0,class_transformer__rspack_import_1.Transform)(({ value })=>value === 'true' ? true : value === 'false' ? false : value);
 /** The form fields sent with the bundle file to plan-import / apply-import. */ class ImportBundleOptionsDto {
     deprecateMissingFields;
+    deactivateMissingFlows;
     confirm;
     expectedChecksum;
     expectedPlanChecksum;
@@ -397,6 +398,16 @@ _ts_decorate([
     (0,class_validator__rspack_import_2.IsBoolean)(),
     _ts_metadata("design:type", Boolean)
 ], ImportBundleOptionsDto.prototype, "deprecateMissingFields", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Switch off (and publish) the live flows this environment has and the bundle does not (they are kept, not deleted)',
+        default: false
+    }),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    FormBoolean(),
+    (0,class_validator__rspack_import_2.IsBoolean)(),
+    _ts_metadata("design:type", Boolean)
+], ImportBundleOptionsDto.prototype, "deactivateMissingFlows", void 0);
 _ts_decorate([
     (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
         description: 'apply-import: acknowledge steps that lose (or may lose) data',
@@ -461,9 +472,17 @@ __webpack_require__.d(__webpack_exports__, {
 3801(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(9216);
 /* import */ var node_crypto__rspack_import_1 = __webpack_require__(2561);
-/* import */ var _config_message_keys_js__rspack_import_2 = __webpack_require__(5732);
-/* import */ var _enums_entity_status_enum_js__rspack_import_3 = __webpack_require__(1313);
-/* import */ var _enums_field_type_enum_js__rspack_import_4 = __webpack_require__(9614);
+/* import */ var _config_message_keys_js__rspack_import_6 = __webpack_require__(5732);
+/* import */ var _enums_entity_status_enum_js__rspack_import_7 = __webpack_require__(1313);
+/* import */ var _enums_field_type_enum_js__rspack_import_8 = __webpack_require__(9614);
+/* import */ var _flow_engine_flow_types_js__rspack_import_2 = __webpack_require__(6256);
+/* import */ var _rule_engine_rule_permission_js__rspack_import_3 = __webpack_require__(5191);
+/* import */ var _rule_engine_rule_interface_js__rspack_import_4 = __webpack_require__(2354);
+/* import */ var _flow_definition_service_js__rspack_import_5 = __webpack_require__(5229);
+
+
+
+
 
 
 
@@ -543,6 +562,84 @@ const escapeRegExp = (text)=>text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         ].toSorted(byCode)
     };
 }
+const UUID_PATTERN = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
+/**
+ * The record, user, company and email configuration ids written into a flow's step settings (step ids
+ * are never UUIDs). Such an id belongs to the environment it was typed in: each needs a `${var:NAME}`.
+ */ function fixedIds(nodes) {
+    const ids = new Set();
+    mapConfigStrings(nodes, (text)=>{
+        for (const [id] of text.matchAll(UUID_PATTERN))ids.add(id.toLowerCase());
+        return text;
+    });
+    return [
+        ...ids
+    ].toSorted(byCode);
+}
+/** The fixed codes of a HAS_PERMISSION / HAS_ANY_PERMISSION / HAS_ALL_PERMISSIONS call; more than a check may name is refused when the flow is validated. */ function literalPermissionCodes(value) {
+    try {
+        return (0,_rule_engine_rule_permission_js__rspack_import_3/* .parsePermissionCodes */.PS)(value);
+    } catch  {
+        return [];
+    }
+}
+/**
+ * Every permission code a flow checks: the rule of each `permission` URL (the execute permission when
+ * it has none), its Permission check steps, and the codes its permission functions name as literals.
+ */ function permissionCodes(flow) {
+    const codes = new Set();
+    const add = (list)=>list.forEach((code)=>codes.add(code));
+    for (const endpoint of (0,_flow_engine_flow_types_js__rspack_import_2/* .flowEndpoints */.Xr)(flow))if (endpoint.authMode === 'permission') add((0,_flusys_nestjs_shared_utils__rspack_import_0.permissionLogicCodes)((0,_flow_definition_service_js__rspack_import_5/* .flowPermissions */.j4)(endpoint, flow.slug)));
+    const walk = (value)=>{
+        if (Array.isArray(value)) return value.forEach(walk);
+        if (!value || typeof value !== 'object') return;
+        const call = value;
+        if (call.type === 'function' && (0,_rule_engine_rule_interface_js__rspack_import_4/* .isPermissionFunction */.A8)(call.name) && call.args?.[0]?.type === 'literal') add(literalPermissionCodes(call.args[0].value));
+        Object.values(value).forEach(walk);
+    };
+    for (const node of flow.nodes){
+        if (node?.type === 'permission_check' && node.config?.['permissions']) add((0,_flusys_nestjs_shared_utils__rspack_import_0.permissionLogicCodes)(node.config['permissions']));
+        walk(node?.config);
+    }
+    return [
+        ...codes
+    ].toSorted(byCode);
+}
+const SECRET_NAME = /authorization|token|secret|api[-_]?key|password|passwd|cookie|signature|credential/i;
+const AUTH_SCHEME = /^\s*(bearer|basic|token|digest)\s+/i;
+/** Shorter written text is a scheme, a separator or a placeholder's leftovers, not a credential. */ const MIN_SECRET_LENGTH = 8;
+/** The text an expression writes itself: a literal, a template or concat parts without their `{{ ... }}` and `${var:NAME}`. */ function writtenText(expression) {
+    if (typeof expression === 'string') return expression;
+    if (!expression || typeof expression !== 'object') return '';
+    const e = expression;
+    if (e.type === 'literal') return typeof e.value === 'string' ? e.value : '';
+    if (e.type === 'template') return typeof e.template === 'string' ? e.template.replace(/\{\{[^}]*\}\}/g, '') : '';
+    if (e.type === 'concat' && Array.isArray(e.parts)) return e.parts.map(writtenText).join('');
+    return '';
+}
+const isWrittenSecret = (text)=>text.replace(VARIABLE_PATTERN, '').replace(AUTH_SCHEME, '').trim().length >= MIN_SECRET_LENGTH;
+/**
+ * HTTP steps that send a credential written into the step (a header such as `Authorization` or a query
+ * parameter such as `api_key`): an export puts it in git as plain text unless it is a `${var:NAME}`.
+ */ function writtenSecrets(nodes) {
+    const found = [];
+    for (const node of nodes.filter((n)=>n?.type === 'http_request')){
+        const config = node.config ?? {};
+        for (const [name, value] of Object.entries(config.headers ?? {})){
+            if (SECRET_NAME.test(name) && isWrittenSecret(writtenText(value))) found.push({
+                step: node.name || node.id,
+                name
+            });
+        }
+        for (const [, name, value] of writtenText(config.url).matchAll(/[?&]([^=&#]+)=([^&#]*)/g)){
+            if (SECRET_NAME.test(name) && isWrittenSecret(value)) found.push({
+                step: node.name || node.id,
+                name
+            });
+        }
+    }
+    return found;
+}
 /** Slugs the Call flow steps of a flow run. */ function calledFlowSlugs(nodes) {
     return nodes.filter((node)=>node?.type === 'call_flow' && typeof node.config?.['flowSlug'] === 'string').map((node)=>node.config['flowSlug']);
 }
@@ -613,17 +710,17 @@ function changedValues(from, to, keys) {
     const problems = [];
     const codes = new Set();
     for (const entity of entities){
-        if (codes.has(entity.code)) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.DUPLICATE_ENTITY */.iX.DUPLICATE_ENTITY, {
+        if (codes.has(entity.code)) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.DUPLICATE_ENTITY */.iX.DUPLICATE_ENTITY, {
             entity: entity.code
         }));
-        if (entity.status === _enums_entity_status_enum_js__rspack_import_3/* .EntityStatus.DRAFT */.c.DRAFT) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.ENTITY_DRAFT_IN_BUNDLE */.iX.ENTITY_DRAFT_IN_BUNDLE, {
+        if (entity.status === _enums_entity_status_enum_js__rspack_import_7/* .EntityStatus.DRAFT */.c.DRAFT) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.ENTITY_DRAFT_IN_BUNDLE */.iX.ENTITY_DRAFT_IN_BUNDLE, {
             entity: entity.code
         }));
         codes.add(entity.code);
         const fieldCodes = new Set();
         const fieldIds = new Set();
         for (const field of entity.fields){
-            if (fieldCodes.has(field.code) || fieldIds.has(field.id)) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.DUPLICATE_FIELD */.iX.DUPLICATE_FIELD, {
+            if (fieldCodes.has(field.code) || fieldIds.has(field.id)) problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.DUPLICATE_FIELD */.iX.DUPLICATE_FIELD, {
                 entity: entity.code,
                 field: field.code
             }));
@@ -636,9 +733,9 @@ function changedValues(from, to, keys) {
         ...current.map((e)=>e.code)
     ]);
     for (const entity of entities){
-        for (const field of entity.fields.filter((f)=>f.fieldType === _enums_field_type_enum_js__rspack_import_4/* .FieldType.RELATION */.P.RELATION && !f.deprecated)){
+        for (const field of entity.fields.filter((f)=>f.fieldType === _enums_field_type_enum_js__rspack_import_8/* .FieldType.RELATION */.P.RELATION && !f.deprecated)){
             if (!field.relationTarget || !known.has(field.relationTarget)) {
-                problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.RELATION_TARGET_UNKNOWN */.iX.RELATION_TARGET_UNKNOWN, {
+                problems.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.RELATION_TARGET_UNKNOWN */.iX.RELATION_TARGET_UNKNOWN, {
                     entity: entity.code,
                     field: field.code,
                     target: field.relationTarget ?? ''
@@ -696,7 +793,7 @@ function changedValues(from, to, keys) {
         const first = pending[0];
         const temporary = temporaryCode(first.targetFieldId, taken);
         ordered.push(step(first, first.from, temporary, first.restored || first.waited, [
-            (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.RENAME_VIA_TEMPORARY */.iX.RENAME_VIA_TEMPORARY, {
+            (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.RENAME_VIA_TEMPORARY */.iX.RENAME_VIA_TEMPORARY, {
                 field: first.from,
                 temporary,
                 to: first.to
@@ -740,7 +837,7 @@ function changedValues(from, to, keys) {
     for (const entity of sorted){
         const target = pairs.get(entity);
         if (target && target.code !== entity.code) {
-            result.blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.ENTITY_CODE_CHANGED */.iX.ENTITY_CODE_CHANGED, {
+            result.blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.ENTITY_CODE_CHANGED */.iX.ENTITY_CODE_CHANGED, {
                 entity: entity.code,
                 current: target.code
             }));
@@ -752,15 +849,15 @@ function changedValues(from, to, keys) {
                 kind: 'create_entity',
                 entityCode: entity.code,
                 details: {
-                    fields: live.filter((f)=>f.fieldType !== _enums_field_type_enum_js__rspack_import_4/* .FieldType.RELATION */.P.RELATION).map((f)=>f.code)
+                    fields: live.filter((f)=>f.fieldType !== _enums_field_type_enum_js__rspack_import_8/* .FieldType.RELATION */.P.RELATION).map((f)=>f.code)
                 },
                 dependsOnEarlierStep: false,
                 entity: {
                     ...entity,
-                    fields: live.filter((f)=>f.fieldType !== _enums_field_type_enum_js__rspack_import_4/* .FieldType.RELATION */.P.RELATION)
+                    fields: live.filter((f)=>f.fieldType !== _enums_field_type_enum_js__rspack_import_8/* .FieldType.RELATION */.P.RELATION)
                 }
             });
-            for (const field of live.filter((f)=>f.fieldType === _enums_field_type_enum_js__rspack_import_4/* .FieldType.RELATION */.P.RELATION)){
+            for (const field of live.filter((f)=>f.fieldType === _enums_field_type_enum_js__rspack_import_8/* .FieldType.RELATION */.P.RELATION)){
                 relationAdds.push({
                     kind: 'add_field',
                     entityCode: entity.code,
@@ -773,7 +870,7 @@ function changedValues(from, to, keys) {
                     field
                 });
             }
-            if (entity.status === _enums_entity_status_enum_js__rspack_import_3/* .EntityStatus.DEPRECATED */.c.DEPRECATED) {
+            if (entity.status === _enums_entity_status_enum_js__rspack_import_7/* .EntityStatus.DEPRECATED */.c.DEPRECATED) {
                 entityUpdatesLast.push({
                     kind: 'update_entity',
                     entityCode: entity.code,
@@ -784,20 +881,20 @@ function changedValues(from, to, keys) {
                     },
                     dependsOnEarlierStep: true,
                     changes: {
-                        status: _enums_entity_status_enum_js__rspack_import_3/* .EntityStatus.DEPRECATED */.c.DEPRECATED
+                        status: _enums_entity_status_enum_js__rspack_import_7/* .EntityStatus.DEPRECATED */.c.DEPRECATED
                     }
                 });
             }
             continue;
         }
-        if (target.status === _enums_entity_status_enum_js__rspack_import_3/* .EntityStatus.DRAFT */.c.DRAFT) {
-            result.blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_2/* .BUNDLE_MESSAGES.ENTITY_DRAFT_HERE */.iX.ENTITY_DRAFT_HERE, {
+        if (target.status === _enums_entity_status_enum_js__rspack_import_7/* .EntityStatus.DRAFT */.c.DRAFT) {
+            result.blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_6/* .BUNDLE_MESSAGES.ENTITY_DRAFT_HERE */.iX.ENTITY_DRAFT_HERE, {
                 entity: entity.code
             }));
             continue;
         }
         const entityChanges = changedValues(target, entity, ENTITY_COMPARED_KEYS);
-        const deprecating = entityChanges['status'] === _enums_entity_status_enum_js__rspack_import_3/* .EntityStatus.DEPRECATED */.c.DEPRECATED;
+        const deprecating = entityChanges['status'] === _enums_entity_status_enum_js__rspack_import_7/* .EntityStatus.DEPRECATED */.c.DEPRECATED;
         if (Object.keys(entityChanges).length) {
             (deprecating ? entityUpdatesLast : entityUpdatesFirst).push({
                 kind: 'update_entity',
@@ -934,9 +1031,12 @@ function changedValues(from, to, keys) {
 __webpack_require__.d(__webpack_exports__, {
   Og: () => (matchDefinitions),
   Q5: () => (calledFlowSlugs),
+  QJ: () => (permissionCodes),
   dX: () => (stripApiKeys),
   dj: () => (canonicalJson),
+  f7: () => (fixedIds),
   gT: () => (applyVariables),
+  l6: () => (writtenSecrets),
   lj: () => (extractVariables),
   qG: () => (orderFlows),
   zb: () => (diffEntities)
@@ -1018,26 +1118,30 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 7463(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(9216);
-/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
-/* import */ var node_crypto__rspack_import_2 = __webpack_require__(2561);
-/* import */ var typeorm__rspack_import_3 = __webpack_require__(7158);
-/* import */ var _config_message_keys_js__rspack_import_17 = __webpack_require__(5732);
-/* import */ var _dtos_schema_change_dto_js__rspack_import_4 = __webpack_require__(4945);
-/* import */ var _entities_entity_definition_entity_js__rspack_import_5 = __webpack_require__(3189);
-/* import */ var _enums_entity_status_enum_js__rspack_import_16 = __webpack_require__(1313);
-/* import */ var _entities_field_definition_entity_js__rspack_import_6 = __webpack_require__(2206);
-/* import */ var _entities_flow_definition_entity_js__rspack_import_7 = __webpack_require__(3770);
-/* import */ var _flow_engine_flow_errors_js__rspack_import_8 = __webpack_require__(8542);
-/* import */ var _flow_engine_flow_types_js__rspack_import_9 = __webpack_require__(6256);
-/* import */ var _interfaces_definition_bundle_interface_js__rspack_import_18 = __webpack_require__(8835);
-/* import */ var _interfaces_flow_definition_interface_js__rspack_import_19 = __webpack_require__(9609);
-/* import */ var _definition_bundle_diff_js__rspack_import_10 = __webpack_require__(3801);
-/* import */ var _entity_builder_config_service_js__rspack_import_11 = __webpack_require__(4281);
-/* import */ var _entity_builder_datasource_provider_js__rspack_import_12 = __webpack_require__(424);
-/* import */ var _flow_definition_service_js__rspack_import_13 = __webpack_require__(5229);
-/* import */ var _schema_evolution_service_js__rspack_import_14 = __webpack_require__(3606);
-/* import */ var _schema_sync_service_js__rspack_import_15 = __webpack_require__(3474);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_0 = __webpack_require__(5103);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_1 = __webpack_require__(9216);
+/* import */ var _nestjs_common__rspack_import_2 = __webpack_require__(6157);
+/* import */ var node_crypto__rspack_import_3 = __webpack_require__(2561);
+/* import */ var typeorm__rspack_import_4 = __webpack_require__(7158);
+/* import */ var _config_message_keys_js__rspack_import_20 = __webpack_require__(5732);
+/* import */ var _dtos_schema_change_dto_js__rspack_import_5 = __webpack_require__(4945);
+/* import */ var _entities_entity_definition_entity_js__rspack_import_6 = __webpack_require__(3189);
+/* import */ var _enums_entity_status_enum_js__rspack_import_19 = __webpack_require__(1313);
+/* import */ var _enums_field_type_enum_js__rspack_import_22 = __webpack_require__(9614);
+/* import */ var _entities_field_definition_entity_js__rspack_import_7 = __webpack_require__(2206);
+/* import */ var _entities_flow_definition_entity_js__rspack_import_8 = __webpack_require__(3770);
+/* import */ var _flow_engine_flow_errors_js__rspack_import_9 = __webpack_require__(8542);
+/* import */ var _flow_engine_flow_types_js__rspack_import_10 = __webpack_require__(6256);
+/* import */ var _interfaces_definition_bundle_interface_js__rspack_import_21 = __webpack_require__(8835);
+/* import */ var _interfaces_flow_definition_interface_js__rspack_import_23 = __webpack_require__(9609);
+/* import */ var _definition_bundle_diff_js__rspack_import_11 = __webpack_require__(3801);
+/* import */ var _entity_builder_config_service_js__rspack_import_12 = __webpack_require__(4281);
+/* import */ var _entity_builder_datasource_provider_js__rspack_import_13 = __webpack_require__(424);
+/* import */ var _entity_permission_service_js__rspack_import_14 = __webpack_require__(1462);
+/* import */ var _flow_definition_service_js__rspack_import_15 = __webpack_require__(5229);
+/* import */ var _schema_dialect_adapter_service_js__rspack_import_16 = __webpack_require__(7259);
+/* import */ var _schema_evolution_service_js__rspack_import_17 = __webpack_require__(3606);
+/* import */ var _schema_sync_service_js__rspack_import_18 = __webpack_require__(3474);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1077,16 +1181,20 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
+
+
 
 
 
 
 /** The reasons a failed step gives besides its message: a change's blockers, a flow's validation errors. */ function failureDetails(error) {
-    if (!(error instanceof _nestjs_common__rspack_import_1.HttpException)) return [];
+    if (!(error instanceof _nestjs_common__rspack_import_2.HttpException)) return [];
     const response = error.getResponse();
     if (typeof response !== 'object') return [];
     const details = response.blockers ?? response.errors ?? [];
-    return details.filter((d)=>typeof d?.messageKey === 'string').map((d)=>(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(d.messageKey, d.messageVariables));
+    return details.filter((d)=>typeof d?.messageKey === 'string').map((d)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(d.messageKey, d.messageVariables));
 }
 /** Structural changes that, unpreviewed, may turn out to lose data (a type conversion, a column made required or unique, audit or soft delete switched off). */ const LOSSY_FIELD_CHANGES = [
     'fieldType',
@@ -1105,21 +1213,21 @@ function mayLoseData(step) {
 /**
  * What was reviewed: the bundle, the options and every step (kind, subject, changes, and whether its
  * preview loses data). Not the SQL or row counts, which change with every write and would refuse each apply.
- */ function planChecksum(bundle, deprecateMissingFields, steps) {
+ */ function planChecksum(bundle, options, steps) {
     const reviewed = steps.map((step)=>({
             kind: step.kind,
-            subject: (0,_definition_bundle_diff_js__rspack_import_10/* .bundleSubject */.bs)(step),
+            subject: (0,_definition_bundle_diff_js__rspack_import_11/* .bundleSubject */.bs)(step),
             details: step.details,
             destructive: step.preview?.destructive ?? null
         }));
-    return (0,node_crypto__rspack_import_2.createHash)('sha256').update((0,_definition_bundle_diff_js__rspack_import_10/* .canonicalJson */.dj)({
+    return (0,node_crypto__rspack_import_3.createHash)('sha256').update((0,_definition_bundle_diff_js__rspack_import_11/* .canonicalJson */.dj)({
         bundle,
-        deprecateMissingFields,
+        ...options,
         steps: reviewed
     })).digest('hex');
 }
-const newApiKey = ()=>`fk_${(0,node_crypto__rspack_import_2.randomBytes)(4).toString('hex')}_${(0,node_crypto__rspack_import_2.randomBytes)(16).toString('hex')}`;
-const triggerPath = (node)=>typeof node.config?.['path'] === 'string' && node.config['path'] ? node.config['path'] : null;
+/** One import at a time per database: two would plan against the same state and race each other's steps. */ const IMPORT_LOCK = 'eb_bundle_import';
+const newApiKey = ()=>`fk_${(0,node_crypto__rspack_import_3.randomBytes)(4).toString('hex')}_${(0,node_crypto__rspack_import_3.randomBytes)(16).toString('hex')}`;
 const needsApiKey = (node)=>node?.type === 'trigger' && node.config?.['authMode'] === 'api_key';
 /** The stored API keys of a flow's Request steps (published and draft), by step id. */ function storedApiKeys(flow) {
     const keys = new Map();
@@ -1127,7 +1235,7 @@ const needsApiKey = (node)=>node?.type === 'trigger' && node.config?.['authMode'
         ...flow?.nodes ?? [],
         ...flow?.draft?.nodes ?? []
     ]){
-        if (node?.type === 'trigger' && (0,_flow_engine_flow_types_js__rspack_import_9/* .isStoredApiKey */.xA)(node.config?.['apiKey']) && !keys.has(node.id)) keys.set(node.id, node.config['apiKey']);
+        if (node?.type === 'trigger' && (0,_flow_engine_flow_types_js__rspack_import_10/* .isStoredApiKey */.xA)(node.config?.['apiKey']) && !keys.has(node.id)) keys.set(node.id, node.config['apiKey']);
     }
     return keys;
 }
@@ -1137,12 +1245,16 @@ class DefinitionBundleService {
     schemaSync;
     evolution;
     flows;
-    constructor(provider, config, schemaSync, evolution, flows){
+    dialect;
+    actionRegistry;
+    constructor(provider, config, schemaSync, evolution, flows, dialect, actionRegistry){
         this.provider = provider;
         this.config = config;
         this.schemaSync = schemaSync;
         this.evolution = evolution;
         this.flows = flows;
+        this.dialect = dialect;
+        this.actionRegistry = actionRegistry;
     }
     variables() {
         return this.config.getBundleVariables();
@@ -1152,51 +1264,78 @@ class DefinitionBundleService {
         const current = await this.loadEntities();
         const selected = dto.entityCodes ? current.filter((e)=>dto.entityCodes.includes(e.code)) : current;
         // A DRAFT entity has no table where it is designed, so there is nothing to promote yet.
-        const drafts = selected.filter((e)=>e.status === _enums_entity_status_enum_js__rspack_import_16/* .EntityStatus.DRAFT */.c.DRAFT).toSorted((a, b)=>(0,_definition_bundle_diff_js__rspack_import_10/* .byCode */.VU)(a.code, b.code));
-        const entities = selected.filter((e)=>e.status !== _enums_entity_status_enum_js__rspack_import_16/* .EntityStatus.DRAFT */.c.DRAFT).toSorted((a, b)=>(0,_definition_bundle_diff_js__rspack_import_10/* .byCode */.VU)(a.code, b.code)).map((entity)=>({
+        const drafts = selected.filter((e)=>e.status === _enums_entity_status_enum_js__rspack_import_19/* .EntityStatus.DRAFT */.c.DRAFT).toSorted((a, b)=>(0,_definition_bundle_diff_js__rspack_import_11/* .byCode */.VU)(a.code, b.code));
+        const entities = selected.filter((e)=>e.status !== _enums_entity_status_enum_js__rspack_import_19/* .EntityStatus.DRAFT */.c.DRAFT).toSorted((a, b)=>(0,_definition_bundle_diff_js__rspack_import_11/* .byCode */.VU)(a.code, b.code)).map((entity)=>({
                 ...entity,
-                fields: entity.fields.toSorted((a, b)=>a.order - b.order || (0,_definition_bundle_diff_js__rspack_import_10/* .byCode */.VU)(a.code, b.code))
+                fields: entity.fields.toSorted((a, b)=>a.order - b.order || (0,_definition_bundle_diff_js__rspack_import_11/* .byCode */.VU)(a.code, b.code))
             }));
-        const flowRepo = await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G);
+        const flowRepo = await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_8/* .FlowDefinition */.G);
         const rows = (await flowRepo.find({
             where: dto.flowSlugs ? {
-                slug: (0,typeorm__rspack_import_3.In)(dto.flowSlugs)
+                slug: (0,typeorm__rspack_import_4.In)(dto.flowSlugs)
             } : {}
-        })).toSorted((a, b)=>(0,_definition_bundle_diff_js__rspack_import_10/* .byCode */.VU)(a.slug, b.slug));
+        })).toSorted((a, b)=>(0,_definition_bundle_diff_js__rspack_import_11/* .byCode */.VU)(a.slug, b.slug));
         const warnings = [
-            ...drafts.map((entity)=>(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.ENTITY_DRAFT_SKIPPED */.iX.ENTITY_DRAFT_SKIPPED, {
+            ...drafts.map((entity)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.ENTITY_DRAFT_SKIPPED */.iX.ENTITY_DRAFT_SKIPPED, {
                     entity: entity.code
                 })),
-            ...rows.filter((flow)=>!(0,_flow_definition_service_js__rspack_import_13/* .isPublished */.HF)(flow)).map((flow)=>(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.FLOW_UNPUBLISHED_SKIPPED */.iX.FLOW_UNPUBLISHED_SKIPPED, {
+            ...rows.filter((flow)=>!(0,_flow_definition_service_js__rspack_import_15/* .isPublished */.HF)(flow)).map((flow)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_UNPUBLISHED_SKIPPED */.iX.FLOW_UNPUBLISHED_SKIPPED, {
                     flow: flow.slug
                 }))
         ];
         const variables = this.variables();
-        const flows = rows.filter(_flow_definition_service_js__rspack_import_13/* .isPublished */.HF).map((flow)=>{
-            const snapshot = (0,_flow_definition_service_js__rspack_import_13/* .snapshotOf */.eY)(flow);
+        const flows = rows.filter(_flow_definition_service_js__rspack_import_15/* .isPublished */.HF).map((flow)=>{
+            const snapshot = (0,_flow_definition_service_js__rspack_import_15/* .snapshotOf */.eY)(flow);
             return {
                 ...snapshot,
                 description: snapshot.description ?? null,
-                nodes: (0,_definition_bundle_diff_js__rspack_import_10/* .extractVariables */.lj)((0,_definition_bundle_diff_js__rspack_import_10/* .stripApiKeys */.dX)(snapshot.nodes ?? []), variables),
+                nodes: (0,_definition_bundle_diff_js__rspack_import_11/* .extractVariables */.lj)((0,_definition_bundle_diff_js__rspack_import_11/* .stripApiKeys */.dX)(snapshot.nodes ?? []), variables),
                 edges: snapshot.edges ?? []
             };
         });
+        warnings.push(...this.leftBehind(entities, flows));
+        for (const flow of flows){
+            for (const { step, name } of (0,_definition_bundle_diff_js__rspack_import_11/* .writtenSecrets */.l6)(flow.nodes))warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_SECRET_WRITTEN */.iX.FLOW_SECRET_WRITTEN, {
+                flow: flow.slug,
+                step,
+                name
+            }));
+        }
         // Keys sorted at every level: PostgreSQL and MySQL hand JSON columns back in different key orders.
-        const bundle = JSON.parse((0,_definition_bundle_diff_js__rspack_import_10/* .canonicalJson */.dj)({
-            format: _interfaces_definition_bundle_interface_js__rspack_import_18/* .DEFINITION_BUNDLE_FORMAT */.D,
+        const bundle = JSON.parse((0,_definition_bundle_diff_js__rspack_import_11/* .canonicalJson */.dj)({
+            format: _interfaces_definition_bundle_interface_js__rspack_import_21/* .DEFINITION_BUNDLE_FORMAT */.D,
             version: (/* inlined export .DEFINITION_BUNDLE_VERSION */1),
             entities,
             flows
         }));
         return {
             bundle,
-            checksum: (0,_definition_bundle_diff_js__rspack_import_10/* .bundleChecksum */.i9)(bundle),
+            checksum: (0,_definition_bundle_diff_js__rspack_import_11/* .bundleChecksum */.i9)(bundle),
             warnings
         };
     }
+    /** Relations and Call flow steps that reach outside the bundle: the environment importing it must already have their targets. */ leftBehind(entities, flows) {
+        const entityCodes = new Set(entities.map((e)=>e.code));
+        const slugs = new Set(flows.map((f)=>f.slug));
+        const relations = entities.flatMap((entity)=>entity.fields.filter((f)=>f.fieldType === _enums_field_type_enum_js__rspack_import_22/* .FieldType.RELATION */.P.RELATION && !f.deprecated && f.relationTarget && !entityCodes.has(f.relationTarget)).map((f)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.EXPORT_RELATION_LEFT_OUT */.iX.EXPORT_RELATION_LEFT_OUT, {
+                    entity: entity.code,
+                    field: f.code,
+                    target: f.relationTarget
+                })));
+        const calls = flows.flatMap((flow)=>[
+                ...new Set((0,_definition_bundle_diff_js__rspack_import_11/* .calledFlowSlugs */.Q5)(flow.nodes))
+            ].filter((slug)=>!slugs.has(slug)).toSorted(_definition_bundle_diff_js__rspack_import_11/* .byCode */.VU).map((called)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.EXPORT_CALLED_FLOW_LEFT_OUT */.iX.EXPORT_CALLED_FLOW_LEFT_OUT, {
+                    flow: flow.slug,
+                    called
+                })));
+        return [
+            ...relations,
+            ...calls
+        ];
+    }
     /** Every entity of this environment with its fields, relations named by target code. */ async loadEntities() {
-        const definitions = await (await this.provider.getRepository(_entities_entity_definition_entity_js__rspack_import_5/* .EntityDefinition */.f)).find();
-        const fields = await (await this.provider.getRepository(_entities_field_definition_entity_js__rspack_import_6/* .FieldDefinition */.c)).find();
+        const definitions = await (await this.provider.getRepository(_entities_entity_definition_entity_js__rspack_import_6/* .EntityDefinition */.f)).find();
+        const fields = await (await this.provider.getRepository(_entities_field_definition_entity_js__rspack_import_7/* .FieldDefinition */.c)).find();
         const codeOf = new Map(definitions.map((d)=>[
                 d.id,
                 d.code
@@ -1237,10 +1376,12 @@ class DefinitionBundleService {
     /** The plan, with what apply-import runs: the entity operations and the flows, in order. */ async buildPlan(dto, user) {
         const bundle = dto.bundle;
         const current = await this.loadEntities();
-        const entityDiff = (0,_definition_bundle_diff_js__rspack_import_10/* .diffEntities */.zb)(bundle.entities, current, {
+        const entityDiff = (0,_definition_bundle_diff_js__rspack_import_11/* .diffEntities */.zb)(bundle.entities, current, {
             deprecateMissingFields: dto.deprecateMissingFields === true
         });
-        const flowDiff = await this.diffFlows(bundle.flows);
+        const flowDiff = await this.diffFlows(bundle.flows, {
+            deactivateMissingFlows: dto.deactivateMissingFlows === true
+        });
         const existingCodes = new Set(current.map((e)=>e.code));
         const steps = [];
         for (const operation of entityDiff.operations){
@@ -1256,7 +1397,7 @@ class DefinitionBundleService {
                 warnings: [
                     ...operation.warnings ?? [],
                     ...dependent ? [
-                        (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.STEP_AFTER_EARLIER */.iX.STEP_AFTER_EARLIER)
+                        (0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.STEP_AFTER_EARLIER */.iX.STEP_AFTER_EARLIER)
                     ] : []
                 ],
                 blockers: []
@@ -1266,13 +1407,15 @@ class DefinitionBundleService {
                     step.preview = await this.previewEntityStep(operation, current, user);
                     step.blockers.push(...step.preview.blockers);
                 } catch (error) {
-                    step.blockers.push((0,_flow_engine_flow_errors_js__rspack_import_8/* .errorRef */.O$)(error));
+                    step.blockers.push((0,_flow_engine_flow_errors_js__rspack_import_9/* .errorRef */.O$)(error));
                 }
             }
             steps.push(step);
         }
         const schemaChanges = entityDiff.operations.length > 0;
-        const importedSlugs = new Set(flowDiff.planned.map((p)=>p.flow.slug));
+        // Flows switched off run last, callers first: each is still running when the flows that call it are checked.
+        const importedSlugs = new Set(flowDiff.planned.filter((p)=>p.kind !== 'deactivate_flow').map((p)=>p.flow.slug));
+        const savedFlows = [];
         for (const planned of flowDiff.planned){
             const step = {
                 kind: planned.kind,
@@ -1286,22 +1429,30 @@ class DefinitionBundleService {
                     ...planned.blockers
                 ]
             };
-            // A flow with a code step needs that permission from whoever imports it, as from whoever saves it.
-            await this.flows.assertMayAuthor((0,_flow_definition_service_js__rspack_import_13/* .toFlowSettings */.RK)(planned.flow), user).catch((error)=>step.blockers.push((0,_flow_engine_flow_errors_js__rspack_import_8/* .errorRef */.O$)(error)));
-            const dependsOnImport = schemaChanges || (0,_definition_bundle_diff_js__rspack_import_10/* .calledFlowSlugs */.Q5)(planned.flow.nodes).some((slug)=>importedSlugs.has(slug));
+            if (planned.kind !== 'deactivate_flow') savedFlows.push([
+                step,
+                planned.flow
+            ]);
+            // Switching a flow off saves it too: a flow with a code step needs that permission from whoever imports it, as from whoever saves it.
+            await this.flows.assertMayAuthor((0,_flow_definition_service_js__rspack_import_15/* .toFlowSettings */.RK)(planned.flow), user).catch((error)=>step.blockers.push((0,_flow_engine_flow_errors_js__rspack_import_9/* .errorRef */.O$)(error)));
+            const dependsOnImport = schemaChanges || (0,_definition_bundle_diff_js__rspack_import_11/* .calledFlowSlugs */.Q5)(planned.flow.nodes).some((slug)=>importedSlugs.has(slug));
             if (dependsOnImport) {
-                step.warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.FLOWS_CHECKED_ON_APPLY */.iX.FLOWS_CHECKED_ON_APPLY));
+                step.warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOWS_CHECKED_ON_APPLY */.iX.FLOWS_CHECKED_ON_APPLY));
             } else if (!step.blockers.length) {
-                const { errors, warnings } = await this.flows.validate((0,_flow_definition_service_js__rspack_import_13/* .toFlowSettings */.RK)(planned.flow));
+                const { errors, warnings } = await this.flows.validate((0,_flow_definition_service_js__rspack_import_15/* .toFlowSettings */.RK)(planned.flow));
                 step.blockers.push(...errors);
                 step.warnings.push(...warnings);
             }
             steps.push(step);
         }
-        const checksum = (0,_definition_bundle_diff_js__rspack_import_10/* .bundleChecksum */.i9)(bundle);
+        await this.addPermissionWarnings(steps, savedFlows);
+        const checksum = (0,_definition_bundle_diff_js__rspack_import_11/* .bundleChecksum */.i9)(bundle);
         const plan = {
             checksum,
-            planChecksum: planChecksum(checksum, dto.deprecateMissingFields === true, steps),
+            planChecksum: planChecksum(checksum, {
+                deprecateMissingFields: dto.deprecateMissingFields === true,
+                deactivateMissingFlows: dto.deactivateMissingFlows === true
+            }, steps),
             steps,
             unchanged: {
                 entities: entityDiff.unchangedEntities,
@@ -1325,6 +1476,44 @@ class DefinitionBundleService {
             flows: flowDiff.planned
         };
     }
+    /**
+   * Permissions are IAM data, never promoted: an import only creates the codes of new entities and of
+   * flows that ask for their execute permission, and no role has those here yet. A flow that checks a
+   * code this environment does not have (and the import does not create) refuses every caller there.
+   */ async addPermissionWarnings(steps, savedFlows) {
+        if (!this.actionRegistry?.findMissingCodes) return;
+        const createdBy = new Map();
+        for (const step of steps.filter((s)=>s.kind === 'create_entity'))for (const code of (0,_entity_permission_service_js__rspack_import_14/* .entityPermissionCodes */.Z)(step.entityCode))createdBy.set(code, step);
+        for (const [step, flow] of savedFlows)if ((0,_flow_engine_flow_types_js__rspack_import_10/* .flowEndpoints */.Xr)(flow).some(_flow_definition_service_js__rspack_import_15/* .asksExecutePermission */.b$)) createdBy.set((0,_flow_definition_service_js__rspack_import_15/* .defaultFlowPermissionCode */.Er)(flow.slug), step);
+        const checked = savedFlows.map(([step, flow])=>[
+                step,
+                (0,_definition_bundle_diff_js__rspack_import_11/* .permissionCodes */.QJ)(flow).filter((code)=>!code.includes('*'))
+            ]);
+        const asked = [
+            ...new Set([
+                ...createdBy.keys(),
+                ...checked.flatMap(([, codes])=>codes)
+            ])
+        ];
+        if (!asked.length) return;
+        const missing = new Set(await this.actionRegistry.findMissingCodes(asked));
+        const ungranted = new Map();
+        for (const [code, step] of createdBy)if (missing.has(code)) ungranted.set(step, [
+            ...ungranted.get(step) ?? [],
+            code
+        ]);
+        for (const [step, codes] of ungranted)step.warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.PERMISSIONS_TO_GRANT */.iX.PERMISSIONS_TO_GRANT, {
+            subject: (0,_definition_bundle_diff_js__rspack_import_11/* .bundleSubject */.bs)(step),
+            codes: codes.join(', ')
+        }));
+        for (const [step, codes] of checked){
+            const unknown = codes.filter((code)=>missing.has(code) && !createdBy.has(code));
+            if (unknown.length) step.warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_PERMISSION_UNKNOWN */.iX.FLOW_PERMISSION_UNKNOWN, {
+                flow: step.flowSlug,
+                codes: unknown.join(', ')
+            }));
+        }
+    }
     /** A relation to an entity this import creates: its id is only known once the entity exists. */ relationNotYetCreated(operation, existingCodes) {
         const target = operation.field?.relationTarget ?? operation.changes?.['relationTarget'];
         return !!target && !existingCodes.has(target);
@@ -1333,8 +1522,8 @@ class DefinitionBundleService {
         if (operation.kind === 'create_entity') return this.schemaSync.planCreateEntity(this.createRequest(operation.entity), user);
         return this.evolution.plan(this.changeRequest(operation, current), user);
     }
-    async diffFlows(bundleFlows) {
-        const repo = await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_7/* .FlowDefinition */.G);
+    async diffFlows(bundleFlows, options) {
+        const repo = await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_8/* .FlowDefinition */.G);
         const existing = await repo.find();
         const bySlug = new Map(existing.map((flow)=>[
                 flow.slug,
@@ -1347,7 +1536,7 @@ class DefinitionBundleService {
                 slug: true
             },
             where: {
-                slug: (0,typeorm__rspack_import_3.In)(slugs)
+                slug: (0,typeorm__rspack_import_4.In)(slugs)
             },
             withDeleted: true
         })).filter((f)=>!bySlug.has(f.slug)).map((f)=>f.slug)) : new Set();
@@ -1360,31 +1549,37 @@ class DefinitionBundleService {
         };
         const seen = new Set();
         for (const slug of slugs){
-            if (seen.has(slug)) result.blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.DUPLICATE_FLOW */.iX.DUPLICATE_FLOW, {
+            if (seen.has(slug)) result.blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.DUPLICATE_FLOW */.iX.DUPLICATE_FLOW, {
                 flow: slug
             }));
             seen.add(slug);
         }
-        for (const bundleFlow of (0,_definition_bundle_diff_js__rspack_import_10/* .orderFlows */.qG)(bundleFlows)){
-            const { nodes, missing } = (0,_definition_bundle_diff_js__rspack_import_10/* .applyVariables */.gT)(bundleFlow.nodes ?? [], variables);
+        for (const bundleFlow of (0,_definition_bundle_diff_js__rspack_import_11/* .orderFlows */.qG)(bundleFlows)){
+            const { nodes, missing } = (0,_definition_bundle_diff_js__rspack_import_11/* .applyVariables */.gT)(bundleFlow.nodes ?? [], variables);
             const flow = {
                 ...bundleFlow,
                 nodes,
                 edges: bundleFlow.edges ?? []
             };
-            const blockers = missing.map((name)=>(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.VARIABLE_MISSING */.iX.VARIABLE_MISSING, {
+            const blockers = missing.map((name)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.VARIABLE_MISSING */.iX.VARIABLE_MISSING, {
                     name,
                     flow: flow.slug
                 }));
             const target = bySlug.get(flow.slug);
-            if (!target && deleted.has(flow.slug)) blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.FLOW_SLUG_DELETED */.iX.FLOW_SLUG_DELETED, {
+            if (!target && deleted.has(flow.slug)) blockers.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_SLUG_DELETED */.iX.FLOW_SLUG_DELETED, {
                 flow: flow.slug
             }));
             const keys = storedApiKeys(target);
-            const warnings = flow.nodes.filter((node)=>needsApiKey(node) && !keys.has(node.id)).map((node)=>(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.FLOW_API_KEY_GENERATED */.iX.FLOW_API_KEY_GENERATED, {
+            const warnings = flow.nodes.filter((node)=>needsApiKey(node) && !keys.has(node.id)).map((node)=>(0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_API_KEY_GENERATED */.iX.FLOW_API_KEY_GENERATED, {
                     flow: flow.slug,
-                    path: triggerPath(node) ?? ''
+                    path: (0,_flow_engine_flow_types_js__rspack_import_10/* .triggerPath */.um)(node) ?? ''
                 }));
+            // Read before the variables are filled in: an id this environment provides through `${var:NAME}` is not fixed.
+            const ids = (0,_definition_bundle_diff_js__rspack_import_11/* .fixedIds */.f7)(bundleFlow.nodes ?? []);
+            if (ids.length) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_FIXED_IDS */.iX.FLOW_FIXED_IDS, {
+                flow: flow.slug,
+                ids: ids.join(', ')
+            }));
             if (!target) {
                 result.planned.push({
                     kind: 'create_flow',
@@ -1396,13 +1591,13 @@ class DefinitionBundleService {
                 });
                 continue;
             }
-            const live = (0,_flow_definition_service_js__rspack_import_13/* .snapshotOf */.eY)(target);
-            const changed = _interfaces_flow_definition_interface_js__rspack_import_19/* .FLOW_VERSIONED_FIELDS.filter */.v.filter((key)=>key === 'nodes' ? (0,_definition_bundle_diff_js__rspack_import_10/* .canonicalJson */.dj)((0,_definition_bundle_diff_js__rspack_import_10/* .stripApiKeys */.dX)(live.nodes ?? [])) !== (0,_definition_bundle_diff_js__rspack_import_10/* .canonicalJson */.dj)((0,_definition_bundle_diff_js__rspack_import_10/* .stripApiKeys */.dX)(flow.nodes)) : (0,_definition_bundle_diff_js__rspack_import_10/* .canonicalJson */.dj)(live[key] ?? null) !== (0,_definition_bundle_diff_js__rspack_import_10/* .canonicalJson */.dj)(flow[key] ?? null));
-            if (!changed.length && (0,_flow_definition_service_js__rspack_import_13/* .isPublished */.HF)(target) && !blockers.length) {
+            const live = (0,_flow_definition_service_js__rspack_import_15/* .snapshotOf */.eY)(target);
+            const changed = _interfaces_flow_definition_interface_js__rspack_import_23/* .FLOW_VERSIONED_FIELDS.filter */.v.filter((key)=>key === 'nodes' ? (0,_definition_bundle_diff_js__rspack_import_11/* .canonicalJson */.dj)((0,_definition_bundle_diff_js__rspack_import_11/* .stripApiKeys */.dX)(live.nodes ?? [])) !== (0,_definition_bundle_diff_js__rspack_import_11/* .canonicalJson */.dj)((0,_definition_bundle_diff_js__rspack_import_11/* .stripApiKeys */.dX)(flow.nodes)) : (0,_definition_bundle_diff_js__rspack_import_11/* .canonicalJson */.dj)(live[key] ?? null) !== (0,_definition_bundle_diff_js__rspack_import_11/* .canonicalJson */.dj)(flow[key] ?? null));
+            if (!changed.length && (0,_flow_definition_service_js__rspack_import_15/* .isPublished */.HF)(target) && !blockers.length) {
                 result.unchanged++;
                 continue;
             }
-            if (target.draft) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.FLOW_DRAFT_REPLACED */.iX.FLOW_DRAFT_REPLACED, {
+            if (target.draft) warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_DRAFT_REPLACED */.iX.FLOW_DRAFT_REPLACED, {
                 flow: flow.slug
             }));
             result.planned.push({
@@ -1416,10 +1611,38 @@ class DefinitionBundleService {
                 blockers
             });
         }
-        for (const extra of existing.filter((flow)=>!seen.has(flow.slug)))result.extras.push({
+        const missing = existing.filter((flow)=>!seen.has(flow.slug));
+        const deactivated = options.deactivateMissingFlows ? missing.filter((flow)=>flow.isActive && (0,_flow_definition_service_js__rspack_import_15/* .isPublished */.HF)(flow)) : [];
+        for (const extra of missing.filter((flow)=>!deactivated.includes(flow)))result.extras.push({
             kind: 'flow',
             flowSlug: extra.slug
         });
+        // Callers first: a flow is switched off only once the live flows that call it are.
+        for (const live of (0,_definition_bundle_diff_js__rspack_import_11/* .orderFlows */.qG)(deactivated.map((flow)=>(0,_flow_definition_service_js__rspack_import_15/* .snapshotOf */.eY)(flow))).toReversed()){
+            const target = bySlug.get(live.slug);
+            const callers = bundleFlows.filter((flow)=>flow.isActive && (0,_definition_bundle_diff_js__rspack_import_11/* .calledFlowSlugs */.Q5)(flow.nodes ?? []).includes(live.slug)).map((flow)=>flow.slug);
+            result.planned.push({
+                kind: 'deactivate_flow',
+                flow: live,
+                existingId: target.id,
+                details: {
+                    changes: [
+                        'isActive'
+                    ]
+                },
+                warnings: target.draft ? [
+                    (0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_DRAFT_REPLACED */.iX.FLOW_DRAFT_REPLACED, {
+                        flow: live.slug
+                    })
+                ] : [],
+                blockers: callers.length ? [
+                    (0,_flusys_nestjs_shared_utils__rspack_import_1.messageRef)(_config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.FLOW_DEACTIVATE_CALLED */.iX.FLOW_DEACTIVATE_CALLED, {
+                        flow: live.slug,
+                        callers: callers.toSorted(_definition_bundle_diff_js__rspack_import_11/* .byCode */.VU).join(', ')
+                    })
+                ] : []
+            });
+        }
         return result;
     }
     // ── requests for the designer's services ────────────────────────────────────────────
@@ -1459,7 +1682,7 @@ class DefinitionBundleService {
         switch(operation.kind){
             case 'add_field':
                 return {
-                    action: _dtos_schema_change_dto_js__rspack_import_4/* .SchemaChangeAction.ADD_FIELD */.M3.ADD_FIELD,
+                    action: _dtos_schema_change_dto_js__rspack_import_5/* .SchemaChangeAction.ADD_FIELD */.M3.ADD_FIELD,
                     entityDefinitionId: entity?.id,
                     field: this.fieldSpec(operation.field, idOf(operation.field.relationTarget))
                 };
@@ -1471,24 +1694,24 @@ class DefinitionBundleService {
                         relationTargetEntityId: idOf(relationTarget) ?? null
                     });
                     return {
-                        action: _dtos_schema_change_dto_js__rspack_import_4/* .SchemaChangeAction.UPDATE_FIELD */.M3.UPDATE_FIELD,
+                        action: _dtos_schema_change_dto_js__rspack_import_5/* .SchemaChangeAction.UPDATE_FIELD */.M3.UPDATE_FIELD,
                         fieldDefinitionId: operation.targetFieldId,
                         changes
                     };
                 }
             case 'deprecate_field':
                 return {
-                    action: _dtos_schema_change_dto_js__rspack_import_4/* .SchemaChangeAction.DEPRECATE_FIELD */.M3.DEPRECATE_FIELD,
+                    action: _dtos_schema_change_dto_js__rspack_import_5/* .SchemaChangeAction.DEPRECATE_FIELD */.M3.DEPRECATE_FIELD,
                     fieldDefinitionId: operation.targetFieldId
                 };
             case 'restore_field':
                 return {
-                    action: _dtos_schema_change_dto_js__rspack_import_4/* .SchemaChangeAction.RESTORE_FIELD */.M3.RESTORE_FIELD,
+                    action: _dtos_schema_change_dto_js__rspack_import_5/* .SchemaChangeAction.RESTORE_FIELD */.M3.RESTORE_FIELD,
                     fieldDefinitionId: operation.targetFieldId
                 };
             default:
                 return {
-                    action: _dtos_schema_change_dto_js__rspack_import_4/* .SchemaChangeAction.UPDATE_ENTITY */.M3.UPDATE_ENTITY,
+                    action: _dtos_schema_change_dto_js__rspack_import_5/* .SchemaChangeAction.UPDATE_ENTITY */.M3.UPDATE_ENTITY,
                     entityDefinitionId: entity?.id,
                     changes: operation.changes
                 };
@@ -1496,21 +1719,44 @@ class DefinitionBundleService {
     }
     // ── apply ───────────────────────────────────────────────────────────────────────────
     async applyImport(dto, user) {
-        const checksum = (0,_definition_bundle_diff_js__rspack_import_10/* .bundleChecksum */.i9)(dto.bundle);
+        const checksum = (0,_definition_bundle_diff_js__rspack_import_11/* .bundleChecksum */.i9)(dto.bundle);
         if (dto.expectedChecksum && dto.expectedChecksum !== checksum) {
-            throw new _nestjs_common__rspack_import_1.ConflictException({
+            throw new _nestjs_common__rspack_import_2.ConflictException({
                 message: 'The bundle is not the one that was reviewed. Plan the import again.',
-                messageKey: _config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.CHECKSUM_MISMATCH */.iX.CHECKSUM_MISMATCH,
+                messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.CHECKSUM_MISMATCH */.iX.CHECKSUM_MISMATCH,
                 messageVariables: {
                     checksum
                 }
             });
         }
+        return this.withImportLock(()=>this.runImport(dto, user));
+    }
+    /** Held on a connection of its own for the whole import (plan and every step), released before that connection goes back to the pool. */ async withImportLock(fn) {
+        const driver = await this.provider.getDriver();
+        const qr = await this.provider.getQueryRunner();
+        try {
+            await qr.connect();
+            if (!await this.dialect.tryAcquireSessionLock(qr, IMPORT_LOCK, driver)) {
+                throw new _nestjs_common__rspack_import_2.ConflictException({
+                    message: 'Another import is running in this environment. Try again when it has finished.',
+                    messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.IMPORT_IN_PROGRESS */.iX.IMPORT_IN_PROGRESS
+                });
+            }
+            try {
+                return await fn();
+            } finally{
+                await this.dialect.releaseSessionLock(qr, IMPORT_LOCK, driver).catch(()=>undefined);
+            }
+        } finally{
+            await qr.release().catch(()=>undefined);
+        }
+    }
+    async runImport(dto, user) {
         const { plan, operations, flows } = await this.buildPlan(dto, user);
         if (dto.expectedPlanChecksum && dto.expectedPlanChecksum !== plan.planChecksum) {
-            throw new _nestjs_common__rspack_import_1.ConflictException({
+            throw new _nestjs_common__rspack_import_2.ConflictException({
                 message: 'The plan changed since it was reviewed. Plan the import again.',
-                messageKey: _config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.PLAN_CHANGED */.iX.PLAN_CHANGED,
+                messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.PLAN_CHANGED */.iX.PLAN_CHANGED,
                 messageVariables: {
                     planChecksum: plan.planChecksum
                 }
@@ -1523,33 +1769,33 @@ class DefinitionBundleService {
                     ...b
                 })),
             ...plan.steps.flatMap((s)=>s.blockers.map((b)=>({
-                        field: (0,_definition_bundle_diff_js__rspack_import_10/* .bundleSubject */.bs)(s),
+                        field: (0,_definition_bundle_diff_js__rspack_import_11/* .bundleSubject */.bs)(s),
                         ...b
                     })))
         ];
         if (blockers.length) {
-            throw new _nestjs_common__rspack_import_1.ConflictException({
+            throw new _nestjs_common__rspack_import_2.ConflictException({
                 message: 'The import is blocked. Plan it again to see why.',
-                messageKey: _config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.APPLY_BLOCKED */.iX.APPLY_BLOCKED,
+                messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.APPLY_BLOCKED */.iX.APPLY_BLOCKED,
                 errors: blockers
             });
         }
         if (plan.mayLoseData && dto.confirm !== true) {
             const lossy = plan.steps.filter((s)=>s.preview?.destructive || !s.preview && mayLoseData(s)).map((s)=>({
-                    field: (0,_definition_bundle_diff_js__rspack_import_10/* .bundleSubject */.bs)(s),
-                    messageKey: _config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.CONFIRM_REQUIRED */.iX.CONFIRM_REQUIRED
+                    field: (0,_definition_bundle_diff_js__rspack_import_11/* .bundleSubject */.bs)(s),
+                    messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.CONFIRM_REQUIRED */.iX.CONFIRM_REQUIRED
                 }));
-            throw new _nestjs_common__rspack_import_1.BadRequestException({
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
                 message: 'The import loses data or information. Review the plan and resend with confirm: true.',
-                messageKey: _config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.CONFIRM_REQUIRED */.iX.CONFIRM_REQUIRED,
+                messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.CONFIRM_REQUIRED */.iX.CONFIRM_REQUIRED,
                 errors: lossy
             });
         }
         // A confirmation covers the steps that were reviewed, never ones the environment has grown since.
         if (plan.mayLoseData && !dto.expectedPlanChecksum) {
-            throw new _nestjs_common__rspack_import_1.BadRequestException({
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
                 message: 'Send the planChecksum of the reviewed plan as expectedPlanChecksum to confirm it.',
-                messageKey: _config_message_keys_js__rspack_import_17/* .BUNDLE_MESSAGES.PLAN_CHECKSUM_REQUIRED */.iX.PLAN_CHECKSUM_REQUIRED
+                messageKey: _config_message_keys_js__rspack_import_20/* .BUNDLE_MESSAGES.PLAN_CHECKSUM_REQUIRED */.iX.PLAN_CHECKSUM_REQUIRED
             });
         }
         const result = {
@@ -1577,7 +1823,7 @@ class DefinitionBundleService {
                 result.steps.push({
                     ...step,
                     status: 'failed',
-                    error: (0,_flow_engine_flow_errors_js__rspack_import_8/* .errorRef */.O$)(error),
+                    error: (0,_flow_engine_flow_errors_js__rspack_import_9/* .errorRef */.O$)(error),
                     ...reasons.length ? {
                         blockers: reasons
                     } : {}
@@ -1608,7 +1854,7 @@ class DefinitionBundleService {
         if (operation.kind === 'create_entity') {
             const entity = operation.entity;
             await this.schemaSync.createEntity(this.createRequest(entity), user, {
-                entityId: await this.idIsFree(_entities_entity_definition_entity_js__rspack_import_5/* .EntityDefinition */.f, entity.id) ? entity.id : undefined,
+                entityId: await this.idIsFree(_entities_entity_definition_entity_js__rspack_import_6/* .EntityDefinition */.f, entity.id) ? entity.id : undefined,
                 fieldIds: Object.fromEntries(await this.freeFieldIds(entity.fields))
             });
             return;
@@ -1617,7 +1863,7 @@ class DefinitionBundleService {
             ...this.changeRequest(operation, current),
             confirm
         };
-        const fieldId = operation.kind === 'add_field' && await this.idIsFree(_entities_field_definition_entity_js__rspack_import_6/* .FieldDefinition */.c, operation.field.id) ? operation.field.id : undefined;
+        const fieldId = operation.kind === 'add_field' && await this.idIsFree(_entities_field_definition_entity_js__rspack_import_7/* .FieldDefinition */.c, operation.field.id) ? operation.field.id : undefined;
         await this.evolution.apply(request, user, {
             fieldId
         });
@@ -1632,12 +1878,12 @@ class DefinitionBundleService {
     }
     async freeFieldIds(fields) {
         if (!fields.length) return [];
-        const taken = new Set((await (await this.provider.getRepository(_entities_field_definition_entity_js__rspack_import_6/* .FieldDefinition */.c)).find({
+        const taken = new Set((await (await this.provider.getRepository(_entities_field_definition_entity_js__rspack_import_7/* .FieldDefinition */.c)).find({
             select: {
                 id: true
             },
             where: {
-                id: (0,typeorm__rspack_import_3.In)(fields.map((f)=>f.id))
+                id: (0,typeorm__rspack_import_4.In)(fields.map((f)=>f.id))
             },
             withDeleted: true
         })).map((f)=>f.id));
@@ -1647,6 +1893,7 @@ class DefinitionBundleService {
             ]);
     }
     /** Saves the flow (a Request step keeps this environment's API key, or gets a new one shown once) and publishes it. */ async applyFlowStep(planned, note, apiKeys, user) {
+        if (planned.kind === 'deactivate_flow') return this.deactivateFlow(planned.existingId, note, user);
         const existing = planned.existingId ? await this.flows.findOrFail(planned.existingId) : undefined;
         const keys = storedApiKeys(existing);
         const generated = [];
@@ -1664,7 +1911,7 @@ class DefinitionBundleService {
             generated.push({
                 flowSlug: planned.flow.slug,
                 nodeId: node.id,
-                path: triggerPath(node),
+                path: (0,_flow_engine_flow_types_js__rspack_import_10/* .triggerPath */.um)(node),
                 key
             });
             return {
@@ -1688,23 +1935,38 @@ class DefinitionBundleService {
         apiKeys.push(...generated);
         await this.flows.publish(id, note, user);
     }
+    /** Publishes the live flow switched off; an unpublished draft is replaced, never published along with it. */ async deactivateFlow(id, note, user) {
+        const live = (0,_flow_definition_service_js__rspack_import_15/* .snapshotOf */.eY)(await this.flows.findOrFail(id));
+        await this.flows.update({
+            ...live,
+            description: live.description ?? undefined,
+            isActive: false,
+            id
+        }, user);
+        await this.flows.publish(id, note, user);
+    }
 }
 DefinitionBundleService = _ts_decorate([
-    (0,_nestjs_common__rspack_import_1.Injectable)({
-        scope: _nestjs_common__rspack_import_1.Scope.REQUEST
+    (0,_nestjs_common__rspack_import_2.Injectable)({
+        scope: _nestjs_common__rspack_import_2.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_1.Inject)(_entity_builder_datasource_provider_js__rspack_import_12/* .EntityBuilderDataSourceProvider */.D)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_1.Inject)(_entity_builder_config_service_js__rspack_import_11/* .EntityBuilderConfigService */.E)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_1.Inject)(_schema_sync_service_js__rspack_import_15/* .SchemaSyncService */.W)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_1.Inject)(_schema_evolution_service_js__rspack_import_14/* .SchemaEvolutionService */._)),
-    _ts_param(4, (0,_nestjs_common__rspack_import_1.Inject)(_flow_definition_service_js__rspack_import_13/* .FlowDefinitionService */.Tk)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_2.Inject)(_entity_builder_datasource_provider_js__rspack_import_13/* .EntityBuilderDataSourceProvider */.D)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_2.Inject)(_entity_builder_config_service_js__rspack_import_12/* .EntityBuilderConfigService */.E)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_2.Inject)(_schema_sync_service_js__rspack_import_18/* .SchemaSyncService */.W)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_2.Inject)(_schema_evolution_service_js__rspack_import_17/* .SchemaEvolutionService */._)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_2.Inject)(_flow_definition_service_js__rspack_import_15/* .FlowDefinitionService */.Tk)),
+    _ts_param(5, (0,_nestjs_common__rspack_import_2.Inject)(_schema_dialect_adapter_service_js__rspack_import_16/* .SchemaDialectAdapterService */.I)),
+    _ts_param(6, (0,_nestjs_common__rspack_import_2.Optional)()),
+    _ts_param(6, (0,_nestjs_common__rspack_import_2.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_0.PERMISSION_ACTION_REGISTRY)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _entity_builder_datasource_provider_js__rspack_import_12/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_12/* .EntityBuilderDataSourceProvider */.D,
-        typeof _entity_builder_config_service_js__rspack_import_11/* .EntityBuilderConfigService */.E === "undefined" ? Object : _entity_builder_config_service_js__rspack_import_11/* .EntityBuilderConfigService */.E,
-        typeof _schema_sync_service_js__rspack_import_15/* .SchemaSyncService */.W === "undefined" ? Object : _schema_sync_service_js__rspack_import_15/* .SchemaSyncService */.W,
-        typeof _schema_evolution_service_js__rspack_import_14/* .SchemaEvolutionService */._ === "undefined" ? Object : _schema_evolution_service_js__rspack_import_14/* .SchemaEvolutionService */._,
-        typeof _flow_definition_service_js__rspack_import_13/* .FlowDefinitionService */.Tk === "undefined" ? Object : _flow_definition_service_js__rspack_import_13/* .FlowDefinitionService */.Tk
+        typeof _entity_builder_datasource_provider_js__rspack_import_13/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_13/* .EntityBuilderDataSourceProvider */.D,
+        typeof _entity_builder_config_service_js__rspack_import_12/* .EntityBuilderConfigService */.E === "undefined" ? Object : _entity_builder_config_service_js__rspack_import_12/* .EntityBuilderConfigService */.E,
+        typeof _schema_sync_service_js__rspack_import_18/* .SchemaSyncService */.W === "undefined" ? Object : _schema_sync_service_js__rspack_import_18/* .SchemaSyncService */.W,
+        typeof _schema_evolution_service_js__rspack_import_17/* .SchemaEvolutionService */._ === "undefined" ? Object : _schema_evolution_service_js__rspack_import_17/* .SchemaEvolutionService */._,
+        typeof _flow_definition_service_js__rspack_import_15/* .FlowDefinitionService */.Tk === "undefined" ? Object : _flow_definition_service_js__rspack_import_15/* .FlowDefinitionService */.Tk,
+        typeof _schema_dialect_adapter_service_js__rspack_import_16/* .SchemaDialectAdapterService */.I === "undefined" ? Object : _schema_dialect_adapter_service_js__rspack_import_16/* .SchemaDialectAdapterService */.I,
+        typeof IPermissionActionRegistry === "undefined" ? Object : IPermissionActionRegistry
     ])
 ], DefinitionBundleService);
 
@@ -1746,7 +2008,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
-/** Every cached definition list/get. Schema changes write these rows inside a transaction, past the cached services. */ const CACHED_DEFINITIONS = [
+/** Every cached definition list/get. Schema changes write these rows inside a transaction, past the cached services, so they are bumped after it commits. */ const CACHED_DEFINITIONS = [
     _config_event_actions_js__rspack_import_3/* .ENTITY_BUILDER_EVENT_ENTITIES.ENTITY_DEFINITION */.P.ENTITY_DEFINITION,
     _config_event_actions_js__rspack_import_3/* .ENTITY_BUILDER_EVENT_ENTITIES.FIELD_DEFINITION */.P.FIELD_DEFINITION,
     _config_event_actions_js__rspack_import_3/* .ENTITY_BUILDER_EVENT_ENTITIES.FLOW_DEFINITION */.P.FLOW_DEFINITION
@@ -1759,7 +2021,7 @@ class DefinitionCacheService {
         this.utilsService = utilsService;
     }
     /** `tenantId` is the tenant whose definitions changed (see `cacheTenantId`); caches are keyed per tenant. */ async clearAll(tenantId) {
-        await Promise.all(CACHED_DEFINITIONS.map((name)=>this.utilsService.clearCache(name, this.cacheManager, undefined, tenantId)));
+        await Promise.all(CACHED_DEFINITIONS.map((name)=>this.utilsService.clearCache(name, this.cacheManager, tenantId)));
     }
 }
 DefinitionCacheService = _ts_decorate([
@@ -1885,11 +2147,10 @@ const DEFAULT_ENDPOINT_NAME = {
     delete: 'Delete'
 };
 const DEFAULT_INPUT_LABEL = {
-    id: 'Id',
-    ids: 'Ids',
-    search: 'Search'
+    id: 'Id'
 };
 const DEFAULT_NO_MATCH_MESSAGE = 'No record matches the filter.';
+const DEFAULT_DELETE_ONLY_MESSAGE = 'Only delete is supported: a flow cannot restore or permanently delete a record.';
 const MAX_NAME_LENGTH = 255;
 /** A supplied text when it has content, the English default otherwise. */ const textOr = (value, fallback)=>value?.trim() || fallback;
 const INPUT_TYPE = {
@@ -1908,6 +2169,18 @@ const INPUT_TYPE = {
     [_enums_field_type_enum_js__rspack_import_2/* .FieldType.FILE */.P.FILE]: 'uuid'
 };
 const LIST_LIMIT = 50;
+/** The API controller endpoint each endpoint's Request step stands in for. */ const ENDPOINT_CONTRACTS = {
+    insert: 'insert',
+    insertMany: 'insert_many',
+    getById: 'get_by_id',
+    getByIds: 'get_by_ids',
+    getAll: 'get_all',
+    getByFilter: 'get_by_filter',
+    update: 'update',
+    updateMany: 'update_many',
+    bulkUpsert: 'bulk_upsert',
+    delete: 'delete'
+};
 const READ_ENDPOINTS = new Set([
     'getById',
     'getByIds',
@@ -1967,10 +2240,6 @@ const ref = (path)=>({
         type: 'field_ref',
         ref: path
     });
-const lit = (value)=>({
-        type: 'literal',
-        value
-    });
 /** `customer_ticket` -> `customer-ticket`: an entity code always fits a flow URL name. */ const entityFlowSlug = (entityCode)=>entityCode.replace(/_/g, '-');
 function optionValues(options) {
     return (options ?? []).map((o)=>o && typeof o === 'object' && 'value' in o ? String(o.value) : String(o));
@@ -2041,38 +2310,38 @@ const optionalFieldInputs = (fields)=>fields.map((f)=>fieldInput(f, false));
 const idInput = (t)=>({
         name: 'id',
         label: t.inputLabels.id,
-        type: 'uuid',
-        required: true
+        type: 'uuid'
     });
-const idsInput = (t)=>({
-        name: 'ids',
-        label: t.inputLabels.ids,
-        type: 'array',
-        itemType: 'uuid',
-        required: true
-    });
-const respond = (id, column, statusCode, body, row)=>({
+/** An API controller envelope answer: `<entity>.<action>.success` (or the given key), like the generic controller's. */ const respond = (id, column, statusCode, format, message, messageKey, rest = {}, row)=>({
         id,
         type: 'respond',
         column,
         row,
-        config: 'type' in body ? {
-            statusCode,
-            bodyExpression: body
-        } : {
+        config: {
             statusCode,
-            body
+            format,
+            message,
+            messageKey,
+            ...rest
         }
     });
 /**
- * The steps of one endpoint. Its step ids are `<endpoint>_<step>` (`id()`), so the endpoints of one
- * flow never share a step. A bulk body is the list itself (`itemSchema` checks each item), written by
- * one step that walks it (`target: many`, each item read as `loop.item`), all or nothing, and
- * answered with the saved records in order.
+ * The steps of one endpoint, answering the generic API controller's envelope and message keys. Its step
+ * ids are `<endpoint>_<step>` (`id()`), so the endpoints of one flow never share a step. A bulk body is
+ * the list itself (the declared fields check each item), written by one step that walks it (`target:
+ * many`, each item read as `loop.item`), all or nothing, and answered with the saved records in order.
+ * getAll reads the request's filter, sort, paging, select, withDeleted and `?q=` search, getById and
+ * getByIds their select (getByIds answers one page of every match, like the controller); delete takes a list of ids and refuses restore / permanent, which no flow step does.
  */ function endpointGraph(entity, endpoint, texts) {
     const id = (step)=>`${endpoint}_${step}`;
-    const entityCode = entity.code;
-    const single = (inputSchema, step, statusCode = 200)=>({
+    const { code: entityCode, label } = entity;
+    const key = (action)=>`${entityCode}.${action}.success`;
+    const count = (step)=>({
+            messageVariables: {
+                count: ref(`context.${id(step)}.count`)
+            }
+        });
+    const single = (inputSchema, step, message, action, statusCode = 200)=>({
             inputSchema,
             steps: [
                 {
@@ -2080,7 +2349,9 @@ const respond = (id, column, statusCode, body, row)=>({
                     id: id('record'),
                     column: 1
                 },
-                respond(id('respond'), 2, statusCode, ref(`context.${id('record')}`))
+                respond(id('respond'), 2, statusCode, 'single', message, key(action), {
+                    bodyExpression: ref(`context.${id('record')}`)
+                })
             ],
             edges: [
                 [
@@ -2090,8 +2361,7 @@ const respond = (id, column, statusCode, body, row)=>({
                 ]
             ]
         });
-    const bulk = (itemSchema, step, statusCode)=>({
-            bodyType: 'list',
+    const bulk = (itemSchema, step, message, action, statusCode)=>({
             inputSchema: itemSchema,
             steps: [
                 {
@@ -2104,7 +2374,39 @@ const respond = (id, column, statusCode, body, row)=>({
                         items: ref('input')
                     }
                 },
-                respond(id('respond'), 2, statusCode, ref(`context.${id('records')}.items`))
+                respond(id('respond'), 2, statusCode, 'bulk', message, key(action), {
+                    bodyExpression: ref(`context.${id('records')}.items`),
+                    ...count('records')
+                })
+            ],
+            edges: [
+                [
+                    id('records'),
+                    'out',
+                    id('respond')
+                ]
+            ]
+        });
+    const list = (query, message, action, paged = true)=>({
+            inputSchema: [],
+            steps: [
+                {
+                    id: id('records'),
+                    type: 'entity_query',
+                    column: 1,
+                    config: {
+                        entityCode,
+                        ...query
+                    }
+                },
+                respond(id('respond'), 2, 200, 'list', message, key(action), {
+                    bodyExpression: ref(`context.${id('records')}.items`),
+                    ...paged ? {
+                        total: ref(`context.${id('records')}.total`),
+                        page: ref(`context.${id('records')}.page`),
+                        pageSize: ref(`context.${id('records')}.pageSize`)
+                    } : {}
+                })
             ],
             edges: [
                 [
@@ -2124,7 +2426,7 @@ const respond = (id, column, statusCode, body, row)=>({
                     entityCode,
                     fields: fieldMap(entity.fields, 'input')
                 }
-            }, 201);
+            }, `${label} created successfully`, 'create', 201);
         case 'insertMany':
             return bulk(insertInputs, {
                 type: 'entity_insert',
@@ -2132,57 +2434,36 @@ const respond = (id, column, statusCode, body, row)=>({
                     entityCode,
                     fields: fieldMap(entity.fields, 'loop.item')
                 }
-            }, 201);
+            }, `${label} records created successfully`, 'create.many', 201);
         case 'getById':
-            return single([
-                idInput(texts)
-            ], {
+            return single([], {
                 type: 'entity_get',
                 config: {
                     entityCode,
-                    id: ref('input.id')
+                    id: ref('input.id'),
+                    fromRequest: true
                 }
-            });
+            }, `${label} retrieved successfully`, 'get');
         case 'getByIds':
-            return single([
-                idsInput(texts)
-            ], {
-                type: 'entity_query',
-                config: {
-                    entityCode,
-                    filter: {
-                        id: {
-                            op: 'in',
-                            value: ref('input.ids')
-                        }
-                    },
-                    limit: _flow_engine_flow_types_js__rspack_import_1/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT
-                }
-            });
-        case 'getAll':
-            return single([
-                {
-                    name: 'search',
-                    label: texts.inputLabels.search,
-                    type: 'string'
+            return list({
+                filter: {
+                    id: {
+                        op: 'in',
+                        value: ref('input.ids')
+                    }
                 },
-                ...filterInputs(filterFields)
-            ], {
-                type: 'entity_query',
-                config: {
-                    entityCode,
-                    search: ref('input.search'),
-                    filter: fieldMap(filterFields, 'input'),
-                    limit: LIST_LIMIT
-                }
-            });
+                fromRequest: true,
+                limit: _flow_engine_flow_types_js__rspack_import_1/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT
+            }, `${label} records retrieved successfully`, 'get.by.ids', false);
+        case 'getAll':
+            return list({
+                fromRequest: true,
+                limit: LIST_LIMIT
+            }, `${label} records retrieved successfully`, 'get.all');
         case 'getByFilter':
             return {
                 inputSchema: [
-                    {
-                        ...idInput(texts),
-                        required: false
-                    },
+                    idInput(texts),
                     ...filterInputs(filterFields)
                 ],
                 steps: [
@@ -2215,12 +2496,10 @@ const respond = (id, column, statusCode, body, row)=>({
                             }
                         }
                     },
-                    respond(id('respond'), 3, 200, ref(`context.${id('records')}.items.0`)),
-                    respond(id('not_found'), 3, 404, {
-                        success: lit(false),
-                        message: lit(texts.noMatchMessage),
-                        messageKey: lit(_config_message_keys_js__rspack_import_4/* .GENERIC_RECORD_MESSAGES.NO_MATCH */.j4.NO_MATCH)
-                    }, 1)
+                    respond(id('respond'), 3, 200, 'single', `${label} retrieved successfully`, key('get.by.filter'), {
+                        bodyExpression: ref(`context.${id('records')}.items.0`)
+                    }),
+                    respond(id('not_found'), 3, 404, 'message', texts.noMatchMessage, _config_message_keys_js__rspack_import_4/* .GENERIC_RECORD_MESSAGES.NO_MATCH */.j4.NO_MATCH, {}, 1)
                 ],
                 edges: [
                     [
@@ -2241,34 +2520,25 @@ const respond = (id, column, statusCode, body, row)=>({
                 ]
             };
         case 'update':
-            return single([
-                idInput(texts),
-                ...optionalFieldInputs(entity.fields)
-            ], {
+            return single(optionalFieldInputs(entity.fields), {
                 type: 'entity_update',
                 config: {
                     entityCode,
                     id: ref('input.id'),
                     fields: fieldMap(entity.fields, 'input')
                 }
-            });
+            }, `${label} updated successfully`, 'update');
         case 'updateMany':
-            return bulk([
-                idInput(texts),
-                ...optionalFieldInputs(entity.fields)
-            ], {
+            return bulk(optionalFieldInputs(entity.fields), {
                 type: 'entity_update',
                 config: {
                     entityCode,
                     fields: fieldMap(entity.fields, 'loop.item')
                 }
-            }, 200);
+            }, `${label} records updated successfully`, 'update.many', 200);
         case 'bulkUpsert':
             return bulk([
-                {
-                    ...idInput(texts),
-                    required: false
-                },
+                idInput(texts),
                 ...optionalFieldInputs(entity.fields)
             ], {
                 type: 'entity_update',
@@ -2277,17 +2547,60 @@ const respond = (id, column, statusCode, body, row)=>({
                     fields: fieldMap(entity.fields, 'loop.item'),
                     onNotFound: 'insert'
                 }
-            }, 200);
+            }, `${label} records upserted successfully`, 'upsert.many', 200);
         case 'delete':
-            return single([
-                idInput(texts)
-            ], {
-                type: 'entity_delete',
-                config: {
-                    entityCode,
-                    id: ref('input.id')
-                }
-            });
+            return {
+                inputSchema: [],
+                steps: [
+                    {
+                        id: id('type'),
+                        type: 'validate',
+                        column: 1,
+                        config: {
+                            checks: [
+                                {
+                                    id: 'type',
+                                    field: 'type',
+                                    message: texts.deleteOnlyMessage,
+                                    rule: {
+                                        operator: 'AND',
+                                        conditions: [
+                                            {
+                                                field: 'input.type',
+                                                comparison: 'equals',
+                                                value: 'delete'
+                                            }
+                                        ]
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    {
+                        id: id('records'),
+                        type: 'entity_delete',
+                        column: 2,
+                        config: {
+                            entityCode,
+                            target: 'many',
+                            items: ref('input.id')
+                        }
+                    },
+                    respond(id('respond'), 3, 200, 'message', `${label} records deleted successfully`, key('delete'), count('records'))
+                ],
+                edges: [
+                    [
+                        id('type'),
+                        'out',
+                        id('records')
+                    ],
+                    [
+                        id('records'),
+                        'out',
+                        id('respond')
+                    ]
+                ]
+            };
     }
 }
 /**
@@ -2302,11 +2615,10 @@ const respond = (id, column, statusCode, body, row)=>({
  */ function buildEntityFlow(entity, endpoints, texts = {}) {
     const resolved = {
         inputLabels: {
-            id: textOr(texts.inputLabels?.id, DEFAULT_INPUT_LABEL.id),
-            ids: textOr(texts.inputLabels?.ids, DEFAULT_INPUT_LABEL.ids),
-            search: textOr(texts.inputLabels?.search, DEFAULT_INPUT_LABEL.search)
+            id: textOr(texts.inputLabels?.id, DEFAULT_INPUT_LABEL.id)
         },
-        noMatchMessage: textOr(texts.noMatchMessage, DEFAULT_NO_MATCH_MESSAGE)
+        noMatchMessage: textOr(texts.noMatchMessage, DEFAULT_NO_MATCH_MESSAGE),
+        deleteOnlyMessage: textOr(texts.deleteOnlyMessage, DEFAULT_DELETE_ONLY_MESSAGE)
     };
     const nodes = [];
     const edges = [];
@@ -2319,8 +2631,10 @@ const respond = (id, column, statusCode, body, row)=>({
             });
         const config = {
             path: ENTITY_FLOW_PATHS[endpoint],
-            bodyType: graph.bodyType ?? 'object',
-            inputSchema: graph.inputSchema,
+            contract: ENDPOINT_CONTRACTS[endpoint],
+            ...graph.inputSchema.length ? {
+                inputSchema: graph.inputSchema
+            } : {},
             authMode: 'permission',
             permissions: endpointPermissions(entity.code, endpoint),
             ...READ_ENDPOINTS.has(endpoint) ? {} : {
@@ -2405,6 +2719,7 @@ const CRUD_ACTIONS = [
     'update',
     'delete'
 ];
+/** The create / read / update / delete permission codes of a dynamic entity. */ const entityPermissionCodes = (entityCode)=>CRUD_ACTIONS.map((op)=>(0,_flusys_nestjs_shared__rspack_import_0.dynamicEntityPermission)(entityCode, op));
 class EntityPermissionService {
     actionRegistry;
     constructor(actionRegistry){
@@ -2424,7 +2739,7 @@ class EntityPermissionService {
         if (!this.actionRegistry) return;
         await this.actionRegistry.removeActionsByCodes([
             (0,_flusys_nestjs_shared__rspack_import_0.dynamicEntityPermissionParent)(definition.code),
-            ...CRUD_ACTIONS.map((op)=>(0,_flusys_nestjs_shared__rspack_import_0.dynamicEntityPermission)(definition.code, op))
+            ...entityPermissionCodes(definition.code)
         ]);
     }
 }
@@ -2440,6 +2755,8 @@ EntityPermissionService = _ts_decorate([
 
 __webpack_require__.d(__webpack_exports__, {
   u: () => (EntityPermissionService)
+}, {
+  Z: entityPermissionCodes
 });
 
 
@@ -3094,8 +3411,13 @@ class SchemaChangeExecutor {
         ].toSorted().map((code)=>`eb_entity:${code}`);
         const heldLocks = [];
         const qr = await this.dataSourceProvider.getQueryRunner();
-        await qr.connect();
-        await qr.startTransaction();
+        try {
+            await qr.connect();
+            await qr.startTransaction();
+        } catch (error) {
+            await qr.release().catch(()=>undefined);
+            throw (0,_database_error_mapper_js__rspack_import_6/* .mapSchemaError */.i)(error);
+        }
         const state = this.newState(target, options.impact ?? []);
         let committed = false;
         try {
@@ -3139,9 +3461,7 @@ class SchemaChangeExecutor {
             }));
             await qr.commitTransaction();
             committed = true;
-            const entityId = outcome.entityDefinitionId ?? target.entityDefinitionId;
-            if (entityId) this.schemaRegistry.invalidate(entityId);
-            await this.definitionCache.clearAll((0,_flusys_nestjs_shared_utils__rspack_import_0.cacheTenantId)(this.dataSourceProvider));
+            await this.invalidateDefinitions(target, outcome.entityDefinitionId ?? target.entityDefinitionId, state.warnings);
             try {
                 await outcome.afterCommit?.();
             } catch (postCommitError) {
@@ -3158,6 +3478,8 @@ class SchemaChangeExecutor {
         } catch (error) {
             if (!committed) await qr.rollbackTransaction().catch(()=>undefined);
             const undo = !committed && driver === 'mysql' && state.undo.length > 0 ? await this.compensate(qr, target, state) : null;
+            // MySQL commits implicitly at each DDL statement, so metadata written before one may have stayed.
+            if (undo) await this.invalidateDefinitions(target, target.entityDefinitionId, []);
             await this.logFailure(target, error, state.steps, undo);
             throw this.withUndo((0,_database_error_mapper_js__rspack_import_6/* .mapSchemaError */.i)(error), undo);
         } finally{
@@ -3165,6 +3487,17 @@ class SchemaChangeExecutor {
             await qr.release();
         }
     }
+    /** Runs only once the change's transaction has ended: a bump inside it would let a concurrent reader re-cache the old definitions. */ async invalidateDefinitions(target, entityId, warnings) {
+        try {
+            if (entityId) this.schemaRegistry.invalidate(entityId);
+            await this.definitionCache.clearAll((0,_flusys_nestjs_shared_utils__rspack_import_0.cacheTenantId)(this.dataSourceProvider));
+        } catch (cacheError) {
+            this.logger.error(`Clearing the definition cache failed after '${target.action}' on '${target.entityCode}': ${cacheError.message}`);
+            warnings.push((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_11/* .SCHEMA_WARNING_MESSAGES.FOLLOW_UP_FAILED */.Uu.FOLLOW_UP_FAILED, {
+                detail: (0,_flow_engine_flow_errors_js__rspack_import_3/* .errorRef */.O$)(cacheError)
+            }));
+        }
+    }
     /**
    * MySQL only: runs the reverse of every DDL statement that had run, newest first, still under
    * the entity lock. Stops at the first undo statement that fails - running later ones against an
@@ -3575,8 +3908,8 @@ class SchemaEvolutionService {
         const { definition, fields } = await this.loadEntity(entityDefinitionId);
         const driver = await this.dataSourceProvider.getDriver();
         const qr = await this.dataSourceProvider.getQueryRunner();
-        await qr.connect();
         try {
+            await qr.connect();
             const table = await qr.getTable(definition.tableName);
             const findings = this.diff(definition, fields, table ?? undefined, driver);
             let rowCount = null;