@flusys/nestjs-entity-builder 9.1.2 → 9.2.0

package/fesm/677.js

@@ -725,6 +725,128 @@ function writeOptions(state) {
         publishEvents: false
     } : {};
 }
+/** A get_all request's own query: what a `fromRequest` query reads. A list body has none. */ function requestQuery(state) {
+    return Array.isArray(state.input) ? {} : state.input;
+}
+/** A request's filter the way the API controller reads it: a value matches as equal, a list as one of its items - never an operator the caller sent. */ function requestFilter(filter) {
+    return Object.fromEntries(Object.entries(filter ?? {}).map(([key, value])=>[
+            key,
+            {
+                op: Array.isArray(value) ? 'in' : 'eq',
+                value
+            }
+        ]));
+}
+/** Only the fields a request's `select` names, `id` always kept; every field when it names none. */ function selectFields(rows, select) {
+    if (!select?.length) return rows;
+    const kept = new Set([
+        'id',
+        ...select
+    ]);
+    return rows.map((row)=>Object.fromEntries(Object.entries(row).filter(([key])=>kept.has(key))));
+}
+async function runQuery(node, cfg, env, state) {
+    const ctx = evaluationContext(state, env);
+    const service = await env.entityService(cfg.entityCode, state.qr);
+    const request = cfg.fromRequest ? requestQuery(state) : {};
+    const filter = {
+        ...requestFilter(request.filter),
+        ...await mapFilter(node, cfg.filter, env, state, 'skip')
+    };
+    const searched = cfg.search ? await env.ruleEngine.resolveExpression(cfg.search, ctx) : cfg.fromRequest ? state.request['query']?.['q'] : undefined;
+    const search = typeof searched === 'string' && searched ? searched : undefined;
+    const sort = cfg.sort ? {
+        [cfg.sort.field]: cfg.sort.direction === 'DESC' ? 'DESC' : 'ASC'
+    } : request.sort;
+    const page = request.pagination?.currentPage ?? 0;
+    const pageSize = Math.min(request.pagination?.pageSize ?? cfg.limit ?? 50, flow_types/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT);
+    const withDeleted = request.withDeleted === true ? {
+        withDeleted: true
+    } : {};
+    const { data, total } = await service.getAll(search, {
+        filter,
+        sort,
+        pagination: {
+            currentPage: page,
+            pageSize
+        },
+        ...withDeleted
+    }, readOptions(state));
+    return {
+        output: {
+            items: selectFields(data, request.select),
+            total,
+            page,
+            pageSize
+        }
+    };
+}
+/** A Respond step's body: as built (raw), or the API controller envelope around it. */ async function respondBody(node, cfg, env, state) {
+    const ctx = evaluationContext(state, env);
+    const format = cfg.format ?? 'raw';
+    const built = async ()=>cfg.bodyExpression ? env.ruleEngine.resolveExpression(cfg.bodyExpression, ctx) : mapValues(cfg.body, env, state);
+    if (format === 'raw') return built();
+    const variables = await mapValues(cfg.messageVariables, env, state);
+    const envelope = {
+        success: cfg.statusCode < 400,
+        message: cfg.message ?? '',
+        messageKey: cfg.messageKey ?? '',
+        ...Object.keys(variables).length ? {
+            messageVariables: variables
+        } : {}
+    };
+    if (format === 'message') return envelope;
+    if (format === 'single') return {
+        ...envelope,
+        data: await built()
+    };
+    const value = await built();
+    if (value !== null && value !== undefined && !Array.isArray(value)) throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.RESPOND_DATA_NOT_LIST */.zr.RESPOND_DATA_NOT_LIST, {
+        node: (0,flow_types/* .nodeLabel */.dA)(node)
+    });
+    const data = value ?? [];
+    const count = async (name, fallback)=>{
+        const expression = cfg[name];
+        if (expression === undefined) return fallback;
+        const resolved = await env.ruleEngine.resolveExpression(expression, ctx);
+        if (resolved === null || resolved === undefined || resolved === '') return fallback;
+        const n = Number(resolved);
+        if (!Number.isInteger(n) || n < 0) throw new flow_errors/* .FlowKeyedError */.Hp(message_keys/* .FLOW_ERROR_MESSAGES.RESPOND_META_INVALID */.zr.RESPOND_META_INVALID, {
+            node: (0,flow_types/* .nodeLabel */.dA)(node),
+            name
+        });
+        return n;
+    };
+    if (format === 'bulk') {
+        const total = await count('total', Array.isArray(state.input) ? state.input.length : data.length);
+        return {
+            ...envelope,
+            data,
+            meta: {
+                count: data.length,
+                total,
+                failed: Math.max(total - data.length, 0)
+            }
+        };
+    }
+    const pagination = requestQuery(state).pagination;
+    const total = await count('total', data.length);
+    const page = await count('page', pagination?.currentPage ?? 0);
+    const pageSize = await count('pageSize', pagination?.pageSize ?? data.length);
+    const totalPages = pageSize > 0 ? Math.ceil(total / pageSize) : 1;
+    return {
+        ...envelope,
+        data,
+        meta: {
+            total,
+            page,
+            pageSize,
+            count: data.length,
+            hasMore: page < totalPages - 1,
+            totalPages
+        }
+    };
+}
 function readOptions(state) {
     return {
         queryRunner: state.qr
@@ -1407,8 +1529,11 @@ const nobody = (extra = {})=>({
                 const id = asId(await env.ruleEngine.resolveExpression(cfg.id, ctx));
                 const service = await env.entityService(cfg.entityCode, state.qr);
                 try {
+                    const record = await service.findById(id, readOptions(state));
                     return {
-                        output: await service.findById(id, readOptions(state))
+                        output: cfg.fromRequest ? selectFields([
+                            record
+                        ], requestQuery(state).select)[0] : record
                     };
                 } catch (error) {
                     if (error instanceof common_.NotFoundException && cfg.onNotFound === 'null') return {
@@ -1418,29 +1543,7 @@ const nobody = (extra = {})=>({
                 }
             }
         case 'entity_query':
-            {
-                const cfg = c;
-                const service = await env.entityService(cfg.entityCode, state.qr);
-                const filter = await mapFilter(node, cfg.filter, env, state, 'skip');
-                const search = cfg.search ? await env.ruleEngine.resolveExpression(cfg.search, ctx) : undefined;
-                const limit = Math.min(cfg.limit ?? 50, flow_types/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT);
-                const { data, total } = await service.getAll(typeof search === 'string' && search ? search : undefined, {
-                    filter,
-                    sort: cfg.sort ? {
-                        [cfg.sort.field]: cfg.sort.direction === 'DESC' ? 'DESC' : 'ASC'
-                    } : undefined,
-                    pagination: {
-                        currentPage: 0,
-                        pageSize: limit
-                    }
-                }, readOptions(state));
-                return {
-                    output: {
-                        items: data,
-                        total
-                    }
-                };
-            }
+            return runQuery(node, c, env, state);
         case 'commit':
             {
                 const reasonKey = state.mode === 'dry_run' ? message_keys/* .FLOW_SKIP_MESSAGES.COMMIT_DRY_RUN */.CB.COMMIT_DRY_RUN : !state.qr ? message_keys/* .FLOW_SKIP_MESSAGES.COMMIT_NO_TRANSACTION */.CB.COMMIT_NO_TRANSACTION : !state.ownsTransaction ? message_keys/* .FLOW_SKIP_MESSAGES.COMMIT_JOINED */.CB.COMMIT_JOINED : null;
@@ -1542,7 +1645,7 @@ const nobody = (extra = {})=>({
         case 'respond':
             {
                 const cfg = c;
-                const body = cfg.bodyExpression ? await env.ruleEngine.resolveExpression(cfg.bodyExpression, ctx) : await mapValues(cfg.body, env, state);
+                const body = await respondBody(node, cfg, env, state);
                 return {
                     output: body,
                     respond: {
@@ -2203,19 +2306,29 @@ function conditionProblem(node, options) {
     const warnings = [];
     const err = (message)=>errors.push(message);
     if (!_flow_types_js__rspack_import_5/* .FLOW_SLUG_PATTERN.test */.YD.test(flow.slug ?? '')) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.SLUG_INVALID */.qj.SLUG_INVALID));
-    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
-    const edges = Array.isArray(flow.edges) ? flow.edges : [];
-    if (!nodes.length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NO_NODES */.qj.NO_NODES));
-    if (nodes.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_NODES */.qj.TOO_MANY_NODES, {
+    const allNodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+    const allEdges = Array.isArray(flow.edges) ? flow.edges : [];
+    if (!allNodes.length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NO_NODES */.qj.NO_NODES));
+    if (allNodes.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_NODES */.qj.TOO_MANY_NODES, {
         max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES
     }));
-    if (edges.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_EDGES */.qj.TOO_MANY_EDGES, {
+    if (allEdges.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TOO_MANY_EDGES */.qj.TOO_MANY_EDGES, {
         max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES
     }));
-    if (errors.length && (!nodes.length || nodes.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES || edges.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES)) return {
+    if (errors.length && (!allNodes.length || allNodes.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_NODES */.Or.MAX_NODES || allEdges.length > _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_EDGES */.Or.MAX_EDGES)) return {
         errors,
         warnings
     };
+    const isEntry = (item)=>!!item && typeof item === 'object';
+    const nodes = allNodes.filter(isEntry);
+    const edges = allEdges.filter(isEntry);
+    if (nodes.length < allNodes.length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_ID_INVALID */.qj.NODE_ID_INVALID, {
+        id: undefined
+    }));
+    if (edges.length < allEdges.length) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.EDGE_DANGLING */.qj.EDGE_DANGLING, {
+        from: undefined,
+        to: undefined
+    }));
     const byId = new Map();
     for (const node of nodes){
         if (!_flow_types_js__rspack_import_5/* .FLOW_NODE_ID_PATTERN.test */.z6.test(node?.id ?? '')) {
@@ -2313,7 +2426,7 @@ function conditionProblem(node, options) {
 }
 /** The entities a step reads or writes: its own, its child inserts' and those its lookups read. */ function entitiesOf(node) {
     const codes = collectLookupEntities(node.config);
-    if (node.type.startsWith('entity_') && typeof node.config?.['entityCode'] === 'string') codes.add(node.config['entityCode']);
+    if (String(node.type).startsWith('entity_') && typeof node.config?.['entityCode'] === 'string') codes.add(node.config['entityCode']);
     const children = node.type === 'entity_insert' && Array.isArray(node.config?.['children']) ? node.config['children'] : [];
     for (const child of children)if (typeof child?.entityCode === 'string') codes.add(child.entityCode);
     return [
@@ -2343,6 +2456,17 @@ function conditionProblem(node, options) {
             }));
         }
         if (endpoint.authMode === 'public' && steps.some((n)=>(0,_flow_types_js__rspack_import_5/* .isMessageNode */.SE)(n.type))) warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.PUBLIC_MESSAGE */.qj.PUBLIC_MESSAGE));
+        for (const n of steps){
+            if (n.config?.['fromRequest'] !== true) continue;
+            if (n.type === 'entity_query' && endpoint.contract !== 'get_all' && endpoint.contract !== 'get_by_ids') warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_QUERY_NOT_GET_ALL */.qj.NODE_QUERY_NOT_GET_ALL, {
+                node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(n),
+                endpoint: label
+            }));
+            if (n.type === 'entity_get' && endpoint.contract !== 'get_by_id') warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_GET_NOT_GET_BY_ID */.qj.NODE_GET_NOT_GET_BY_ID, {
+                node: (0,_flow_types_js__rspack_import_5/* .nodeLabel */.dA)(n),
+                endpoint: label
+            }));
+        }
         // A URL callers reach without signing in has no user: user checks deny them, and its record steps are open to anyone who can call it.
         if (!_flow_types_js__rspack_import_5/* .KEYLESS_AUTH_MODES.has */.d7.has(endpoint.authMode)) continue;
         if (steps.some((n)=>(n.type === 'permission_check' || n.type === 'company_branch_check') && n.config?.['subject'] !== 'user' || usesPermissionFunction(n.config))) warnOnce((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.PERMISSION_WITHOUT_USER */.qj.PERMISSION_WITHOUT_USER));
@@ -2624,6 +2748,10 @@ function validateNodeConfig(node, flow, context, err, warn) {
         template: {
             list: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.TEMPLATE_VALUES */.bc.TEMPLATE_VALUES,
             item: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.TEMPLATE_VALUE */.bc.TEMPLATE_VALUE
+        },
+        messageVariable: {
+            list: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.MESSAGE_VARIABLES */.bc.MESSAGE_VARIABLES,
+            item: _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.MESSAGE_VARIABLE */.bc.MESSAGE_VARIABLE
         }
     };
     const optionalExpr = (value, what)=>{
@@ -2665,10 +2793,24 @@ function validateNodeConfig(node, flow, context, err, warn) {
                 else if (c.apiKey !== undefined && !(0,_flow_api_key_js__rspack_import_6/* .looksLikeApiKey */.Jb)(c.apiKey) && !(0,_flow_types_js__rspack_import_5/* .isStoredApiKey */.xA)(c.apiKey)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_API_KEY_INVALID */.qj.TRIGGER_API_KEY_INVALID, at));
                 // Field errors are named after the URL (`<path>: <field>`) once a flow has several.
                 const path = (0,_flow_types_js__rspack_import_5/* .triggerPath */.um)(node);
+                const prefix = path ? `${path}: ` : '';
                 if (c.bodyType !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_BODY_TYPES.includes */.Y3.includes(c.bodyType)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.BODY_TYPE_UNKNOWN */.qj.BODY_TYPE_UNKNOWN, {
                     type: String(c.bodyType)
                 }));
-                validateInputFields(Array.isArray(c.inputSchema) ? c.inputSchema : [], path ? `${path}: ` : '', 1, err);
+                const declared = Array.isArray(c.inputSchema) ? c.inputSchema : [];
+                if (c.contract !== undefined && !_flow_types_js__rspack_import_5/* .FLOW_REQUEST_CONTRACTS.includes */.j_.includes(c.contract)) {
+                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.TRIGGER_CONTRACT_INVALID */.qj.TRIGGER_CONTRACT_INVALID, {
+                        ...at,
+                        contract: String(c.contract)
+                    }));
+                } else {
+                    // A declared field may not take the name of one the request type already brings.
+                    const reserved = new Set((0,_flow_types_js__rspack_import_5/* .contractFields */._h)(c.contract ?? 'custom').map((f)=>f.name));
+                    for (const field of declared)if (reserved.has(field?.name)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.INPUT_NAME_RESERVED */.qj.INPUT_NAME_RESERVED, {
+                        name: `${prefix}${field.name}`
+                    }));
+                }
+                validateInputFields(declared, prefix, 1, err);
                 break;
             }
         case 'validate':
@@ -2809,6 +2951,7 @@ function validateNodeConfig(node, flow, context, err, warn) {
         case 'entity_get':
             entity(c.entityCode);
             expr(c.id, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_RECORD_ID */.bc.THE_RECORD_ID));
+            if (c.fromRequest !== undefined && typeof c.fromRequest !== 'boolean') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_QUERY_FROM_REQUEST_INVALID */.qj.NODE_QUERY_FROM_REQUEST_INVALID, at));
             break;
         case 'entity_query':
             entity(c.entityCode);
@@ -2824,6 +2967,7 @@ function validateNodeConfig(node, flow, context, err, warn) {
                     max: _flow_types_js__rspack_import_5/* .FLOW_LIMITS.MAX_QUERY_LIMIT */.Or.MAX_QUERY_LIMIT
                 }));
             }
+            if (c.fromRequest !== undefined && typeof c.fromRequest !== 'boolean') err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_QUERY_FROM_REQUEST_INVALID */.qj.NODE_QUERY_FROM_REQUEST_INVALID, at));
             break;
         case 'call_flow':
             if (typeof c.flowSlug !== 'string' || !_flow_types_js__rspack_import_5/* .FLOW_SLUG_PATTERN.test */.YD.test(c.flowSlug)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_CHOOSE_FLOW */.qj.NODE_CHOOSE_FLOW, at));
@@ -2909,8 +3053,28 @@ function validateNodeConfig(node, flow, context, err, warn) {
             {
                 const status = c.statusCode;
                 if (!(Number.isInteger(status) && status >= 200 && status <= 599)) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_STATUS_2XX_5XX */.qj.NODE_STATUS_2XX_5XX, at));
-                exprMap(c.body, KIND.response);
-                if (c.bodyExpression !== undefined) expr(c.bodyExpression, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_RESPONSE */.bc.THE_RESPONSE));
+                const format = c.format ?? 'raw';
+                if (!_flow_types_js__rspack_import_5/* .FLOW_RESPONSE_FORMATS.includes */.A4.includes(format)) {
+                    err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_RESPOND_FORMAT_INVALID */.qj.NODE_RESPOND_FORMAT_INVALID, {
+                        ...at,
+                        format: String(format)
+                    }));
+                    break;
+                }
+                const what = (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(format === 'raw' ? _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_RESPONSE */.bc.THE_RESPONSE : _config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_DATA */.bc.THE_DATA);
+                if (format !== 'message') {
+                    exprMap(c.body, KIND.response);
+                    if (c.bodyExpression !== undefined) expr(c.bodyExpression, what);
+                }
+                if (format === 'raw') break;
+                if (typeof c.message !== 'string' || !c.message.trim() || typeof c.messageKey !== 'string' || !c.messageKey.trim()) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_RESPOND_MESSAGE_REQUIRED */.qj.NODE_RESPOND_MESSAGE_REQUIRED, at));
+                exprMap(c.messageVariables, KIND.messageVariable);
+                if ((format === 'list' || format === 'bulk') && c.bodyExpression === undefined) err((0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_VALIDATION_MESSAGES.NODE_RESPOND_LIST_VALUE_REQUIRED */.qj.NODE_RESPOND_LIST_VALUE_REQUIRED, at));
+                if (format === 'list' || format === 'bulk') optionalExpr(c.total, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_TOTAL */.bc.THE_TOTAL));
+                if (format === 'list') {
+                    optionalExpr(c.page, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_PAGE */.bc.THE_PAGE));
+                    optionalExpr(c.pageSize, (0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_7/* .FLOW_SUBJECT_MESSAGES.THE_PAGE_SIZE */.bc.THE_PAGE_SIZE));
+                }
                 break;
             }
         case 'commit':
@@ -3369,26 +3533,28 @@ __webpack_require__.d(__webpack_exports__, {
 },
 6390(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(9216);
-/* import */ var _config_message_keys_js__rspack_import_3 = __webpack_require__(5732);
-/* import */ var _enums_field_type_enum_js__rspack_import_2 = __webpack_require__(9614);
+/* import */ var _config_message_keys_js__rspack_import_4 = __webpack_require__(5732);
+/* import */ var _enums_field_type_enum_js__rspack_import_3 = __webpack_require__(9614);
 /* import */ var _services_field_value_validator_js__rspack_import_1 = __webpack_require__(3525);
+/* import */ var _flow_types_js__rspack_import_2 = __webpack_require__(6256);
+
 
 
 
 
 const TYPE_MAP = {
-    string: _enums_field_type_enum_js__rspack_import_2/* .FieldType.TEXT */.P.TEXT,
-    text: _enums_field_type_enum_js__rspack_import_2/* .FieldType.LONG_TEXT */.P.LONG_TEXT,
-    number: _enums_field_type_enum_js__rspack_import_2/* .FieldType.DECIMAL */.P.DECIMAL,
-    integer: _enums_field_type_enum_js__rspack_import_2/* .FieldType.INTEGER */.P.INTEGER,
-    boolean: _enums_field_type_enum_js__rspack_import_2/* .FieldType.BOOLEAN */.P.BOOLEAN,
-    date: _enums_field_type_enum_js__rspack_import_2/* .FieldType.DATE */.P.DATE,
-    datetime: _enums_field_type_enum_js__rspack_import_2/* .FieldType.DATETIME */.P.DATETIME,
-    email: _enums_field_type_enum_js__rspack_import_2/* .FieldType.EMAIL */.P.EMAIL,
-    uuid: _enums_field_type_enum_js__rspack_import_2/* .FieldType.RELATION */.P.RELATION,
-    object: _enums_field_type_enum_js__rspack_import_2/* .FieldType.JSON */.P.JSON,
-    array: _enums_field_type_enum_js__rspack_import_2/* .FieldType.JSON */.P.JSON,
-    choice: _enums_field_type_enum_js__rspack_import_2/* .FieldType.SINGLE_SELECT */.P.SINGLE_SELECT
+    string: _enums_field_type_enum_js__rspack_import_3/* .FieldType.TEXT */.P.TEXT,
+    text: _enums_field_type_enum_js__rspack_import_3/* .FieldType.LONG_TEXT */.P.LONG_TEXT,
+    number: _enums_field_type_enum_js__rspack_import_3/* .FieldType.DECIMAL */.P.DECIMAL,
+    integer: _enums_field_type_enum_js__rspack_import_3/* .FieldType.INTEGER */.P.INTEGER,
+    boolean: _enums_field_type_enum_js__rspack_import_3/* .FieldType.BOOLEAN */.P.BOOLEAN,
+    date: _enums_field_type_enum_js__rspack_import_3/* .FieldType.DATE */.P.DATE,
+    datetime: _enums_field_type_enum_js__rspack_import_3/* .FieldType.DATETIME */.P.DATETIME,
+    email: _enums_field_type_enum_js__rspack_import_3/* .FieldType.EMAIL */.P.EMAIL,
+    uuid: _enums_field_type_enum_js__rspack_import_3/* .FieldType.RELATION */.P.RELATION,
+    object: _enums_field_type_enum_js__rspack_import_3/* .FieldType.JSON */.P.JSON,
+    array: _enums_field_type_enum_js__rspack_import_3/* .FieldType.JSON */.P.JSON,
+    choice: _enums_field_type_enum_js__rspack_import_3/* .FieldType.SINGLE_SELECT */.P.SINGLE_SELECT
 };
 const isPlainObject = (v)=>typeof v === 'object' && v !== null && !Array.isArray(v);
 /**
@@ -3407,13 +3573,89 @@ const isPlainObject = (v)=>typeof v === 'object' && v !== null && !Array.isArray
     };
     return checkFields(schema, source, '');
 }
+const FIELD_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+const OPEN_CONTRACTS = new Set([
+    'update',
+    'update_many'
+]);
+const QUERY_CONTRACTS = new Set([
+    'get_all',
+    'get_by_id',
+    'get_by_ids'
+]);
+/**
+ * Checks a request body against a Request step, the way its API controller endpoint's DTO would: a
+ * delete `id` sent as one id is read as a list and a get_by_ids `select` may be comma-separated; `sort`
+ * values must be ASC / DESC and `select` names plain field names. An update / update_many with no
+ * declared fields keeps the rest of the body, with only its `id` checked.
+ */ function validateEndpointInput(endpoint, body) {
+    const { contract } = endpoint;
+    const source = normalizeBody(contract, body);
+    const result = validateFlowInput(endpoint.inputSchema, source, endpoint.bodyType);
+    if (OPEN_CONTRACTS.has(contract) && endpoint.inputSchema.length === (0,_flow_types_js__rspack_import_2/* .contractFields */._h)(contract).length) result.values = keepRest(source, result.values);
+    if (QUERY_CONTRACTS.has(contract) && !Array.isArray(result.values)) result.errors.push(...contractErrors(result.values));
+    return result;
+}
+function normalizeBody(contract, body) {
+    if (!isPlainObject(body)) return body;
+    const source = body;
+    if (contract === 'delete' && typeof source['id'] === 'string') return {
+        ...source,
+        id: [
+            source['id']
+        ]
+    };
+    if (contract === 'get_by_ids' && typeof source['select'] === 'string') {
+        return {
+            ...source,
+            select: source['select'].split(',').map((name)=>name.trim()).filter(Boolean)
+        };
+    }
+    return body;
+}
+function keepRest(source, values) {
+    if (Array.isArray(values)) return values.map((item, i)=>isPlainObject(item) && Array.isArray(source) && isPlainObject(source[i]) ? {
+            ...source[i],
+            ...item
+        } : item);
+    return isPlainObject(source) ? {
+        ...source,
+        ...values
+    } : values;
+}
+function contractErrors(values) {
+    const errors = [];
+    const sort = values['sort'];
+    if (isPlainObject(sort)) {
+        for (const [field, direction] of Object.entries(sort)){
+            if (!FIELD_NAME.test(field) || direction !== 'ASC' && direction !== 'DESC') errors.push({
+                field: `sort.${field}`,
+                ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_4/* .FLOW_MESSAGES.INPUT_SORT_INVALID */.wu.INPUT_SORT_INVALID, {
+                    field
+                })
+            });
+        }
+    }
+    const select = values['select'];
+    if (Array.isArray(select)) {
+        select.forEach((field, i)=>{
+            if (typeof field !== 'string' || !FIELD_NAME.test(field)) errors.push({
+                field: `select[${i}]`,
+                ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_4/* .FLOW_MESSAGES.INPUT_SELECT_INVALID */.wu.INPUT_SELECT_INVALID, {
+                    field: String(field)
+                })
+            });
+        });
+    }
+    return errors;
+}
 function checkList(schema, body) {
     if (!Array.isArray(body)) return {
         values: [],
         errors: [
             {
                 field: 'body',
-                ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_3/* .FLOW_MESSAGES.INPUT_BODY_NOT_LIST */.wu.INPUT_BODY_NOT_LIST)
+                ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_4/* .FLOW_MESSAGES.INPUT_BODY_NOT_LIST */.wu.INPUT_BODY_NOT_LIST)
             }
         ]
     };
@@ -3428,7 +3670,7 @@ function checkList(schema, body) {
             values.push(item);
             errors.push({
                 field: `[${i}]`,
-                ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_3/* .FLOW_MESSAGES.INPUT_BODY_ITEM_NOT_OBJECT */.wu.INPUT_BODY_ITEM_NOT_OBJECT, {
+                ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_4/* .FLOW_MESSAGES.INPUT_BODY_ITEM_NOT_OBJECT */.wu.INPUT_BODY_ITEM_NOT_OBJECT, {
                     index: i + 1
                 })
             });
@@ -3448,7 +3690,7 @@ function toValidatable(field, code, label) {
     return {
         code,
         label,
-        fieldType: TYPE_MAP[field.type] ?? _enums_field_type_enum_js__rspack_import_2/* .FieldType.TEXT */.P.TEXT,
+        fieldType: TYPE_MAP[field.type] ?? _enums_field_type_enum_js__rspack_import_3/* .FieldType.TEXT */.P.TEXT,
         nullable: !field.required,
         defaultValue: field.default ?? null,
         selectOptions: field.type === 'choice' ? field.options ?? [] : null,
@@ -3503,7 +3745,7 @@ function checkValue(field, supplied, raw, path, label) {
             errors: [
                 {
                     field: path,
-                    ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_3/* .FIELD_VALIDATION_MESSAGES.MUST_BE_OBJECT */.KE.MUST_BE_OBJECT, {
+                    ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_4/* .FIELD_VALIDATION_MESSAGES.MUST_BE_OBJECT */.KE.MUST_BE_OBJECT, {
                         label
                     })
                 }
@@ -3528,7 +3770,7 @@ function checkValue(field, supplied, raw, path, label) {
             errors: [
                 {
                     field: path,
-                    ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_3/* .FIELD_VALIDATION_MESSAGES.MUST_BE_LIST */.KE.MUST_BE_LIST, {
+                    ...(0,_flusys_nestjs_shared_utils__rspack_import_0.messageRef)(_config_message_keys_js__rspack_import_4/* .FIELD_VALIDATION_MESSAGES.MUST_BE_LIST */.KE.MUST_BE_LIST, {
                         label
                     })
                 }
@@ -3561,7 +3803,7 @@ function checkValue(field, supplied, raw, path, label) {
 }
 
 __webpack_require__.d(__webpack_exports__, {
-  v: () => (validateFlowInput)
+  G: () => (validateEndpointInput)
 });
 
 
@@ -4070,7 +4312,12 @@ class EntityBuilderDataSourceProvider extends _flusys_nestjs_shared_modules__rsp
             // buildMetadatas() is `protected` in TypeORM's public .d.ts (a compile-time-only
             // restriction, not enforced by the JS runtime) but is the only way to rebuild
             // entityMetadatas from options.entities after DataSource.initialize() has run.
-            await dataSource.buildMetadatas();
+            try {
+                await dataSource.buildMetadatas();
+            } catch (error) {
+                if (perDsMap.get(schema.options.name) === schema) perDsMap.delete(schema.options.name);
+                throw error;
+            }
         });
         this.statics.rebuildLocks.set(dataSource, next.catch(()=>undefined));
         await next;
@@ -4414,6 +4661,7 @@ function _ts_param(paramIndex, decorator) {
 
 const defaultFlowPermissionCode = (slug)=>`entity_builder.flow.${slug}.execute`;
 /** The rule a `permission` URL asks callers to pass: its own, or the flow's execute permission. */ const flowPermissions = (endpoint, slug)=>endpoint.permissions ?? (0,_flow_engine_flow_permission_logic_js__rspack_import_13/* .permissionAction */.s)(defaultFlowPermissionCode(slug));
+/** A `permission` URL without a rule of its own: it asks for the flow's execute permission, which publishing registers. */ const asksExecutePermission = (endpoint)=>endpoint.authMode === 'permission' && !endpoint.permissions;
 const flowNotFound = ()=>new _nestjs_common__rspack_import_4.NotFoundException({
         message: 'Flow not found.',
         messageKey: _config_message_keys_js__rspack_import_14/* .FLOW_MESSAGES.NOT_FOUND */.wu.NOT_FOUND
@@ -4722,7 +4970,7 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
         } finally{
             await qr.release().catch(()=>undefined);
         }
-        await this.clearCaches(existing);
+        await this.invalidateCache();
         await this.provisionPermissions([
             existing
         ]);
@@ -4788,18 +5036,9 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
             draft: flow.draft,
             updatedById: user?.id ?? null
         });
-        await this.clearCaches(flow);
+        await this.invalidateCache();
         return flow;
     }
-    async clearCaches(flow) {
-        if (!this.isCacheable) return;
-        await Promise.all([
-            this.clearCacheForAll(),
-            this.clearCacheForId([
-                flow
-            ])
-        ]);
-    }
     async beforeDeleteOperation(dto, user, _qr) {
         const ids = Array.isArray(dto.id) ? dto.id : [
             dto.id
@@ -4819,7 +5058,7 @@ class FlowDefinitionService extends _flusys_nestjs_shared_classes__rspack_import
         const actions = new Map();
         for (const flow of flows){
             for (const endpoint of (0,_flow_engine_flow_types_js__rspack_import_11/* .flowEndpoints */.Xr)(flow)){
-                if (endpoint.authMode !== 'permission' || endpoint.permissions) continue;
+                if (!asksExecutePermission(endpoint)) continue;
                 const code = defaultFlowPermissionCode(flow.slug);
                 if (!actions.has(code)) actions.set(code, endpoint.path ? `Run ${flow.name} (${endpoint.path})` : `Run ${flow.name}`);
             }
@@ -4891,6 +5130,7 @@ __webpack_require__.d(__webpack_exports__, {
   Er: defaultFlowPermissionCode,
   HF: isPublished,
   YW: flowNotFound,
+  b$: asksExecutePermission,
   j4: flowPermissions,
   lw: workingCopy
 });
@@ -5187,7 +5427,7 @@ class FlowUrlError extends flow_errors/* .FlowKeyedError */.Hp {
     }
     if (url.protocol !== 'http:' && url.protocol !== 'https:') throw new FlowUrlError(message_keys/* .FLOW_ERROR_MESSAGES.URL_PROTOCOL */.zr.URL_PROTOCOL);
     if (url.username || url.password) throw new FlowUrlError(message_keys/* .FLOW_ERROR_MESSAGES.URL_CREDENTIALS */.zr.URL_CREDENTIALS);
-    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const host = url.hostname.replace(/^\[|\]$/g, '').replace(/\.+$/, '');
     if (!allowPrivate) {
         if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.internal') || host.endsWith('.local')) {
             throw new FlowUrlError(message_keys/* .FLOW_ERROR_MESSAGES.URL_PRIVATE */.zr.URL_PRIVATE);
@@ -5560,7 +5800,7 @@ class FlowExecutorService {
             }, `Flow '${slug}' has no URL '${endpoint ?? ''}'.`);
         }
         await this.assertMayCall(flow, start, parent, env);
-        const checked = (0,flow_input_validator/* .validateFlowInput */.v)(start.inputSchema, input, start.bodyType);
+        const checked = (0,flow_input_validator/* .validateEndpointInput */.G)(start, input);
         if (checked.errors.length) {
             throw new flow_errors/* .FlowHttpError */.hk(400, 'Validation failed', checked.errors, {
                 messageKey: message_keys/* .FLOW_MESSAGES.INPUT_INVALID */.wu.INPUT_INVALID,
@@ -5802,16 +6042,17 @@ FlowExecutorService = _ts_decorate([
 
 },
 2300(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
-/* import */ var typeorm__rspack_import_1 = __webpack_require__(7158);
-/* import */ var _config_message_keys_js__rspack_import_9 = __webpack_require__(5732);
-/* import */ var _entities_flow_definition_entity_js__rspack_import_2 = __webpack_require__(3770);
-/* import */ var _flow_engine_flow_input_validator_js__rspack_import_3 = __webpack_require__(6390);
-/* import */ var _flow_engine_flow_types_js__rspack_import_4 = __webpack_require__(6256);
-/* import */ var _entity_builder_datasource_provider_js__rspack_import_5 = __webpack_require__(424);
-/* import */ var _flow_definition_service_js__rspack_import_6 = __webpack_require__(5229);
-/* import */ var _flow_execution_service_js__rspack_import_7 = __webpack_require__(7810);
-/* import */ var _flow_executor_service_js__rspack_import_8 = __webpack_require__(3908);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(9216);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_2 = __webpack_require__(7158);
+/* import */ var _config_message_keys_js__rspack_import_10 = __webpack_require__(5732);
+/* import */ var _entities_flow_definition_entity_js__rspack_import_3 = __webpack_require__(3770);
+/* import */ var _flow_engine_flow_input_validator_js__rspack_import_4 = __webpack_require__(6390);
+/* import */ var _flow_engine_flow_types_js__rspack_import_5 = __webpack_require__(6256);
+/* import */ var _entity_builder_datasource_provider_js__rspack_import_6 = __webpack_require__(424);
+/* import */ var _flow_definition_service_js__rspack_import_7 = __webpack_require__(5229);
+/* import */ var _flow_execution_service_js__rspack_import_8 = __webpack_require__(7810);
+/* import */ var _flow_executor_service_js__rspack_import_9 = __webpack_require__(3908);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -5845,6 +6086,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 const HIDDEN_HEADERS = new Set([
     'authorization',
     'cookie',
@@ -5908,7 +6150,7 @@ const inputRejected = (errors)=>({
         body: {
             success: false,
             message: 'Validation failed',
-            messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.INPUT_INVALID */.wu.INPUT_INVALID,
+            messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.INPUT_INVALID */.wu.INPUT_INVALID,
             errors
         },
         trace: [],
@@ -5926,24 +6168,27 @@ class FlowRuntimeService {
         this.definitions = definitions;
     }
     /** A flow never published is not live yet: it looks the same as an unknown one. */ async findActive(slug) {
-        return (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_2/* .FlowDefinition */.G)).findOne({
+        return (await this.provider.getRepository(_entities_flow_definition_entity_js__rspack_import_3/* .FlowDefinition */.G)).findOne({
             where: {
                 slug,
                 isActive: true,
-                deletedAt: (0,typeorm__rspack_import_1.IsNull)(),
-                version: (0,typeorm__rspack_import_1.MoreThan)(0)
+                deletedAt: (0,typeorm__rspack_import_2.IsNull)(),
+                version: (0,typeorm__rspack_import_2.MoreThan)(0)
             }
         });
     }
+    /** The tenant of this request ('' for a single database): tenant databases cloned from one template share flow ids. */ tenantScope() {
+        return (0,_flusys_nestjs_shared_utils__rspack_import_0.cacheTenantId)(this.provider) ?? '';
+    }
     /** The public entry: a caller hit `POST api-flows/:slug` or `POST api-flows/:slug/:endpoint`. */ async handle(flow, endpoint, body, caller, user) {
         const startedAt = new Date();
-        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(endpoint.inputSchema, body, endpoint.bodyType);
+        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_4/* .validateEndpointInput */.G)(endpoint, body);
         if (checked.errors.length) {
             const result = inputRejected(checked.errors);
             await this.logWebhook(flow, endpoint, body, result, startedAt, user, caller);
             return result;
         }
-        const result = await this.executor.run((0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(flow), {
+        const result = await this.executor.run((0,_flow_definition_service_js__rspack_import_7/* .toFlowSettings */.RK)(flow), {
             mode: 'live',
             user,
             input: checked.values,
@@ -5963,17 +6208,17 @@ class FlowRuntimeService {
         }
         if (dto.definition) {
             // The designer's current draft, even for a saved flow: `flow` above is kept only to attribute the run.
-            settings = (0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(dto.definition);
+            settings = (0,_flow_definition_service_js__rspack_import_7/* .toFlowSettings */.RK)(dto.definition);
         } else if (flow) {
-            settings = (0,_flow_definition_service_js__rspack_import_6/* .toFlowSettings */.RK)(flow);
+            settings = (0,_flow_definition_service_js__rspack_import_7/* .toFlowSettings */.RK)(flow);
         } else {
-            throw new _nestjs_common__rspack_import_0.BadRequestException({
+            throw new _nestjs_common__rspack_import_1.BadRequestException({
                 message: 'Send a flowId or a definition to test.',
-                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.NOTHING_TO_TEST */.wu.NOTHING_TO_TEST
+                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.NOTHING_TO_TEST */.wu.NOTHING_TO_TEST
             });
         }
         const mode = dto.mode ?? 'dry_run';
-        const endpoint = (0,_flow_engine_flow_types_js__rspack_import_4/* .findEndpoint */.vS)(settings, dto.endpoint);
+        const endpoint = (0,_flow_engine_flow_types_js__rspack_import_5/* .findEndpoint */.vS)(settings, dto.endpoint);
         // Checked before anything runs.
         await this.definitions.assertMayTest(settings, endpoint, user, {
             mode,
@@ -5981,9 +6226,9 @@ class FlowRuntimeService {
             saved: !!flow
         });
         if (!endpoint) {
-            throw new _nestjs_common__rspack_import_0.BadRequestException({
+            throw new _nestjs_common__rspack_import_1.BadRequestException({
                 message: `This flow has no URL '${dto.endpoint ?? ''}'.`,
-                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.ENDPOINT_NOT_FOUND */.wu.ENDPOINT_NOT_FOUND,
+                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.ENDPOINT_NOT_FOUND */.wu.ENDPOINT_NOT_FOUND,
                 messageVariables: {
                     endpoint: dto.endpoint ?? ''
                 }
@@ -5991,9 +6236,9 @@ class FlowRuntimeService {
         }
         const validation = await this.definitions.validate(settings);
         if (validation.errors.length) {
-            throw new _nestjs_common__rspack_import_0.BadRequestException({
+            throw new _nestjs_common__rspack_import_1.BadRequestException({
                 message: 'The flow has problems.',
-                messageKey: _config_message_keys_js__rspack_import_9/* .FLOW_MESSAGES.INVALID */.wu.INVALID,
+                messageKey: _config_message_keys_js__rspack_import_10/* .FLOW_MESSAGES.INVALID */.wu.INVALID,
                 errors: validation.errors.map((error)=>({
                         field: 'flow',
                         ...error
@@ -6003,7 +6248,7 @@ class FlowRuntimeService {
         const startedAt = new Date();
         const simulated = simulatedCaller(caller, dto.request);
         const body = dto.input ?? (endpoint.bodyType === 'list' ? [] : {});
-        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_3/* .validateFlowInput */.v)(endpoint.inputSchema, body, endpoint.bodyType);
+        const checked = (0,_flow_engine_flow_input_validator_js__rspack_import_4/* .validateEndpointInput */.G)(endpoint, body);
         const result = checked.errors.length ? inputRejected(checked.errors) : await this.executor.run(settings, {
             mode,
             user,
@@ -6050,19 +6295,19 @@ class FlowRuntimeService {
     }
 }
 FlowRuntimeService = _ts_decorate([
-    (0,_nestjs_common__rspack_import_0.Injectable)({
-        scope: _nestjs_common__rspack_import_0.Scope.REQUEST
+    (0,_nestjs_common__rspack_import_1.Injectable)({
+        scope: _nestjs_common__rspack_import_1.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_entity_builder_datasource_provider_js__rspack_import_5/* .EntityBuilderDataSourceProvider */.D)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_flow_executor_service_js__rspack_import_8/* .FlowExecutorService */.F)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_0.Inject)(_flow_execution_service_js__rspack_import_7/* .FlowExecutionService */.A)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_0.Inject)(_flow_definition_service_js__rspack_import_6/* .FlowDefinitionService */.Tk)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_1.Inject)(_entity_builder_datasource_provider_js__rspack_import_6/* .EntityBuilderDataSourceProvider */.D)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_1.Inject)(_flow_executor_service_js__rspack_import_9/* .FlowExecutorService */.F)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_1.Inject)(_flow_execution_service_js__rspack_import_8/* .FlowExecutionService */.A)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_1.Inject)(_flow_definition_service_js__rspack_import_7/* .FlowDefinitionService */.Tk)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _entity_builder_datasource_provider_js__rspack_import_5/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_5/* .EntityBuilderDataSourceProvider */.D,
-        typeof _flow_executor_service_js__rspack_import_8/* .FlowExecutorService */.F === "undefined" ? Object : _flow_executor_service_js__rspack_import_8/* .FlowExecutorService */.F,
-        typeof _flow_execution_service_js__rspack_import_7/* .FlowExecutionService */.A === "undefined" ? Object : _flow_execution_service_js__rspack_import_7/* .FlowExecutionService */.A,
-        typeof _flow_definition_service_js__rspack_import_6/* .FlowDefinitionService */.Tk === "undefined" ? Object : _flow_definition_service_js__rspack_import_6/* .FlowDefinitionService */.Tk
+        typeof _entity_builder_datasource_provider_js__rspack_import_6/* .EntityBuilderDataSourceProvider */.D === "undefined" ? Object : _entity_builder_datasource_provider_js__rspack_import_6/* .EntityBuilderDataSourceProvider */.D,
+        typeof _flow_executor_service_js__rspack_import_9/* .FlowExecutorService */.F === "undefined" ? Object : _flow_executor_service_js__rspack_import_9/* .FlowExecutorService */.F,
+        typeof _flow_execution_service_js__rspack_import_8/* .FlowExecutionService */.A === "undefined" ? Object : _flow_execution_service_js__rspack_import_8/* .FlowExecutionService */.A,
+        typeof _flow_definition_service_js__rspack_import_7/* .FlowDefinitionService */.Tk === "undefined" ? Object : _flow_definition_service_js__rspack_import_7/* .FlowDefinitionService */.Tk
     ])
 ], FlowRuntimeService);
 
@@ -6508,6 +6753,7 @@ const TEXT_FIELD_TYPES = new Set([
     async getAll(search, query, options = {}) {
         const repository = await this.repositoryFor(options.queryRunner);
         let builder = repository.createQueryBuilder(this.entityCode);
+        if (query.withDeleted) builder.withDeleted();
         if (query.filter) {
             builder = this.applyFilter(builder, query.filter);
         }
@@ -6950,6 +7196,23 @@ class SchemaDialectAdapterService {
             });
         }
     }
+    /** Takes `lockKey` for the connection's session (it outlives any transaction) without waiting: false when another session holds it. */ async tryAcquireSessionLock(queryRunner, lockKey, driver) {
+        const rows = driver === 'postgres' ? await queryRunner.query('SELECT pg_try_advisory_lock(hashtext($1)) AS acquired', [
+            lockKey
+        ]) : await queryRunner.query('SELECT GET_LOCK(?, 0) AS acquired', [
+            this.lockName(lockKey)
+        ]);
+        const acquired = rows?.[0]?.acquired;
+        return acquired === true || Number(acquired) === 1;
+    }
+    /** Must run before the connection goes back to the pool, or the lock stays with it. */ async releaseSessionLock(queryRunner, lockKey, driver) {
+        if (driver === 'postgres') await queryRunner.query('SELECT pg_advisory_unlock(hashtext($1))', [
+            lockKey
+        ]);
+        else await queryRunner.query('SELECT RELEASE_LOCK(?)', [
+            this.lockName(lockKey)
+        ]);
+    }
     async releaseEntityLock(queryRunner, lockKey, driver) {
         if (driver === 'postgres') {
             // pg_advisory_xact_lock is transaction-scoped - released automatically on commit/rollback.
@@ -7030,7 +7293,10 @@ class SchemaRegistryService {
                 id: entityDefinitionId
             }
         });
+        const cacheKey = this.cacheKey(entityDefinitionId);
         if (!definition) {
+            // Dropped, possibly on another instance: its schema is never asked for again.
+            SchemaRegistryService.cache.delete(cacheKey);
             throw new _nestjs_common__rspack_import_1.NotFoundException({
                 message: `Entity definition '${entityDefinitionId}' not found.`,
                 messageKey: _config_message_keys_js__rspack_import_8/* .ENTITY_DEFINITION_MESSAGES.NOT_FOUND */.pL.NOT_FOUND,
@@ -7039,7 +7305,6 @@ class SchemaRegistryService {
                 }
             });
         }
-        const cacheKey = this.cacheKey(entityDefinitionId);
         const cached = SchemaRegistryService.cache.get(cacheKey);
         if (cached && cached.version === definition.schemaVersion) {
             return cached.schema;