@flusys/nestjs-entity-builder 9.1.2 → 9.2.1

package/fesm/946.js

@@ -115,12 +115,11 @@ class EntityDefinitionController extends (0,nestjs_shared_.createApiController)(
         }
     }
 }) {
-    entityDefinitionService;
     schemaSyncService;
     evolution;
     permissionCache;
     constructor(entityDefinitionService, schemaSyncService, evolution, permissionCache){
-        super(entityDefinitionService), this.entityDefinitionService = entityDefinitionService, this.schemaSyncService = schemaSyncService, this.evolution = evolution, this.permissionCache = permissionCache;
+        super(entityDefinitionService), this.schemaSyncService = schemaSyncService, this.evolution = evolution, this.permissionCache = permissionCache;
     }
     async createEntity(dto, user) {
         const { definition, warnings } = await this.schemaSyncService.createEntity(dto, user);
@@ -133,7 +132,6 @@ class EntityDefinitionController extends (0,nestjs_shared_.createApiController)(
         return this.ok(await this.schemaSyncService.planCreateEntity(dto, user), 'Plan generated', message_keys/* .ENTITY_DEFINITION_MESSAGES.PLAN_SUCCESS */.pL.PLAN_SUCCESS);
     }
     async planChange(dto, user) {
-        // A plan counts records, so only someone who could apply the change may see it.
         await this.permissionCache.assertPermission(user, (0,schema_evolution_service/* .isDestructiveSchemaAction */.C)(dto.action) ? nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.DELETE : nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.UPDATE);
         return this.ok(await this.evolution.plan(dto, user), 'Plan generated', message_keys/* .ENTITY_DEFINITION_MESSAGES.PLAN_SUCCESS */.pL.PLAN_SUCCESS);
     }
@@ -242,6 +240,7 @@ _ts_decorate([
 ], EntityDefinitionController.prototype, "planChange", null);
 _ts_decorate([
     (0,common_.Post)('apply-change'),
+    (0,designer_writable_interceptor/* .DesignerAllowsRepair */.H6)(),
     (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
     (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.UPDATE),
     (0,swagger_.ApiBearerAuth)(),
@@ -320,8 +319,8 @@ _ts_decorate([
 EntityDefinitionController = _ts_decorate([
     (0,swagger_.ApiTags)('Entity Builder - Entity Definitions'),
     (0,common_.Controller)('entity-builder/entity-definitions'),
-    (0,common_.UseInterceptors)(designer_writable_interceptor/* .DesignerWritableInterceptor */.X),
-    (0,designer_writable_interceptor/* .DesignerWrites */.W)('createEntity', 'applyChange', 'applyDestructiveChange'),
+    (0,common_.UseInterceptors)(designer_writable_interceptor/* .DesignerWritableInterceptor */.Xg),
+    (0,designer_writable_interceptor/* .DesignerWrites */.Wq)('createEntity', 'applyChange', 'applyDestructiveChange'),
     _ts_param(0, (0,common_.Inject)(entity_definition_service/* .EntityDefinitionService */.o)),
     _ts_param(1, (0,common_.Inject)(schema_sync_service/* .SchemaSyncService */.W)),
     _ts_param(2, (0,common_.Inject)(schema_evolution_service/* .SchemaEvolutionService */._)),
@@ -403,9 +402,8 @@ class FieldDefinitionController extends (0,nestjs_shared_.createApiController)(f
         }
     }
 }) {
-    fieldDefinitionService;
     constructor(fieldDefinitionService){
-        super(fieldDefinitionService), this.fieldDefinitionService = fieldDefinitionService;
+        super(fieldDefinitionService);
     }
 }
 FieldDefinitionController = field_definition_controller_ts_decorate([
@@ -744,7 +742,7 @@ flow_dto_ts_decorate([
     (0,external_class_validator_.Min)(1),
     flow_dto_ts_metadata("design:type", Number)
 ], FlowVersionRefDto.prototype, "version", void 0);
-/** The id of a flow API key or a flow execution. */ class IdBodyDto {
+class IdBodyDto {
     id;
 }
 flow_dto_ts_decorate([
@@ -1007,6 +1005,14 @@ class FlowDefinitionController extends (0,nestjs_shared_.createApiController)(Cr
             data: flow
         };
     }
+    codePackages() {
+        return {
+            success: true,
+            message: 'Code packages loaded',
+            messageKey: message_keys/* .FLOW_MESSAGES.CODE_PACKAGES_SUCCESS */.wu.CODE_PACKAGES_SUCCESS,
+            data: this.flowDefinitionService.codePackages()
+        };
+    }
     async versions(dto) {
         return {
             success: true,
@@ -1101,6 +1107,19 @@ flow_definition_controller_ts_decorate([
     ]),
     flow_definition_controller_ts_metadata("design:returntype", Promise)
 ], FlowDefinitionController.prototype, "publish", null);
+flow_definition_controller_ts_decorate([
+    (0,common_.Post)('code-packages'),
+    (0,common_.HttpCode)(common_.HttpStatus.OK),
+    (0,common_.UseGuards)(guards_.JwtAuthGuard, guards_.PermissionGuard),
+    (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequirePermission)(P.READ),
+    (0,swagger_.ApiBearerAuth)(),
+    (0,swagger_.ApiOperation)({
+        summary: 'The package names a code step may require on this server'
+    }),
+    flow_definition_controller_ts_metadata("design:type", Function),
+    flow_definition_controller_ts_metadata("design:paramtypes", []),
+    flow_definition_controller_ts_metadata("design:returntype", typeof nestjs_shared_.SingleResponseDto === "undefined" ? Object : nestjs_shared_.SingleResponseDto)
+], FlowDefinitionController.prototype, "codePackages", null);
 flow_definition_controller_ts_decorate([
     (0,common_.Post)('versions'),
     (0,common_.HttpCode)(common_.HttpStatus.OK),
@@ -1209,8 +1228,8 @@ flow_definition_controller_ts_decorate([
 FlowDefinitionController = flow_definition_controller_ts_decorate([
     (0,swagger_.ApiTags)('Entity Builder - Flows'),
     (0,common_.Controller)('entity-builder/flows'),
-    (0,common_.UseInterceptors)(designer_writable_interceptor/* .DesignerWritableInterceptor */.X),
-    (0,designer_writable_interceptor/* .DesignerWrites */.W)('insert', 'update', 'delete', 'publish', 'restoreVersion', 'discardDraft'),
+    (0,common_.UseInterceptors)(designer_writable_interceptor/* .DesignerWritableInterceptor */.Xg),
+    (0,designer_writable_interceptor/* .DesignerWrites */.Wq)('insert', 'update', 'delete', 'publish', 'restoreVersion', 'discardDraft'),
     flow_definition_controller_ts_param(0, (0,common_.Inject)(flow_definition_service/* .FlowDefinitionService */.Tk)),
     flow_definition_controller_ts_param(1, (0,common_.Inject)(flow_runtime_service/* .FlowRuntimeService */.a)),
     flow_definition_controller_ts_metadata("design:type", Function),
@@ -1366,10 +1385,10 @@ class FlowRuntimeController {
     constructor(runtime){
         this.runtime = runtime;
     }
-    run(_slug, body, req, res) {
+    run(body, req, res) {
         return this.answer(body, req, res);
     }
-    runEndpoint(_slug, _endpoint, body, req, res) {
+    runEndpoint(body, req, res) {
         return this.answer(body, req, res);
     }
     async answer(body, req, res) {
@@ -1393,15 +1412,13 @@ flow_runtime_controller_ts_decorate([
     (0,swagger_.ApiParam)({
         name: 'slug'
     }),
-    flow_runtime_controller_ts_param(0, (0,common_.Param)('slug')),
-    flow_runtime_controller_ts_param(1, (0,common_.Body)()),
-    flow_runtime_controller_ts_param(2, (0,common_.Req)()),
-    flow_runtime_controller_ts_param(3, (0,common_.Res)({
+    flow_runtime_controller_ts_param(0, (0,common_.Body)()),
+    flow_runtime_controller_ts_param(1, (0,common_.Req)()),
+    flow_runtime_controller_ts_param(2, (0,common_.Res)({
         passthrough: true
     })),
     flow_runtime_controller_ts_metadata("design:type", Function),
     flow_runtime_controller_ts_metadata("design:paramtypes", [
-        String,
         Object,
         typeof FlowRequest === "undefined" ? Object : FlowRequest,
         Object
@@ -1421,17 +1438,13 @@ flow_runtime_controller_ts_decorate([
     (0,swagger_.ApiParam)({
         name: 'endpoint'
     }),
-    flow_runtime_controller_ts_param(0, (0,common_.Param)('slug')),
-    flow_runtime_controller_ts_param(1, (0,common_.Param)('endpoint')),
-    flow_runtime_controller_ts_param(2, (0,common_.Body)()),
-    flow_runtime_controller_ts_param(3, (0,common_.Req)()),
-    flow_runtime_controller_ts_param(4, (0,common_.Res)({
+    flow_runtime_controller_ts_param(0, (0,common_.Body)()),
+    flow_runtime_controller_ts_param(1, (0,common_.Req)()),
+    flow_runtime_controller_ts_param(2, (0,common_.Res)({
         passthrough: true
     })),
     flow_runtime_controller_ts_metadata("design:type", Function),
     flow_runtime_controller_ts_metadata("design:paramtypes", [
-        String,
-        String,
         Object,
         typeof FlowRequest === "undefined" ? Object : FlowRequest,
         Object
@@ -1499,10 +1512,13 @@ function definition_bundle_controller_ts_param(paramIndex, decorator) {
 
 
 
-/** The bundle is uploaded as a file (not JSON): the app's JSON body limit never applies, only this package's own. */ const BundleUpload = ()=>(0,common_.UseInterceptors)((0,__rspack_external__nestjs_platform_express_cb7ac6b9.FileInterceptor)('bundle', {
+/**
+ * The bundle is uploaded as files (not JSON): the app's JSON body limit never applies, only this package's own.
+ * One file holds a whole export, or several hold one entity or flow each (a split folder kept in git).
+ */ const BundleUpload = ()=>(0,common_.UseInterceptors)((0,__rspack_external__nestjs_platform_express_cb7ac6b9.FilesInterceptor)('bundle', (/* inlined export .ENTITY_BUNDLE_MAX_FILES */1000), {
         limits: {
             fileSize: entity_builder_constants/* .ENTITY_BUNDLE_MAX_BYTES */.EA,
-            files: 1,
+            files: (/* inlined export .ENTITY_BUNDLE_MAX_FILES */1000),
             fields: 10
         }
     }));
@@ -1514,14 +1530,21 @@ const IMPORT_BODY = {
         ],
         properties: {
             bundle: {
-                type: 'string',
-                format: 'binary',
-                description: `The bundle file an export wrote (JSON, at most ${entity_builder_constants/* .ENTITY_BUNDLE_MAX_BYTES */.EA / 1024 / 1024} MB)`
+                type: 'array',
+                items: {
+                    type: 'string',
+                    format: 'binary'
+                },
+                description: `One bundle file an export wrote, or the files of a split export (one per entity and flow, merged into one bundle). JSON, at most ${(/* inlined export .ENTITY_BUNDLE_MAX_FILES */1000)} files and ${entity_builder_constants/* .ENTITY_BUNDLE_MAX_BYTES */.EA / 1024 / 1024} MB together`
             },
             deprecateMissingFields: {
                 type: 'boolean',
                 description: 'Deprecate fields this environment has and the bundle does not (their columns and data stay)'
             },
+            deactivateMissingFlows: {
+                type: 'boolean',
+                description: 'Switch off (and publish) the live flows this environment has and the bundle does not (they are kept, not deleted)'
+            },
             confirm: {
                 type: 'boolean',
                 description: 'apply-import: acknowledge steps that lose (or may lose) data'
@@ -1553,7 +1576,9 @@ class DefinitionBundleController {
     settings() {
         const data = {
             readOnly: this.config.isDesignerReadOnly(),
-            variables: Object.keys(this.config.getBundleVariables()).toSorted(definition_bundle_diff/* .byCode */.VU)
+            variables: Object.keys(this.config.getBundleVariables()).toSorted(definition_bundle_diff/* .byCode */.VU),
+            maxFiles: (/* inlined export .ENTITY_BUNDLE_MAX_FILES */1000),
+            maxBytes: entity_builder_constants/* .ENTITY_BUNDLE_MAX_BYTES */.EA
         };
         return {
             success: true,
@@ -1570,10 +1595,10 @@ class DefinitionBundleController {
             data: await this.bundles.export(dto)
         };
     }
-    async planImport(file, options, user) {
+    async planImport(files, options, user) {
         const data = await this.bundles.planImport({
             ...options,
-            bundle: (0,definition_bundle_file/* .readBundleFile */.z)(file)
+            bundle: (0,definition_bundle_file/* .readBundleFiles */.K)(files)
         }, user);
         return {
             success: true,
@@ -1582,10 +1607,10 @@ class DefinitionBundleController {
             data
         };
     }
-    async applyImport(file, options, user) {
+    async applyImport(files, options, user) {
         const data = await this.bundles.applyImport({
             ...options,
-            bundle: (0,definition_bundle_file/* .readBundleFile */.z)(file)
+            bundle: (0,definition_bundle_file/* .readBundleFiles */.K)(files)
         }, user);
         return data.completed ? {
             success: true,
@@ -1607,7 +1632,7 @@ definition_bundle_controller_ts_decorate([
     (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.RequireAnyPermission)(nestjs_shared_.ENTITY_DEFINITION_PERMISSIONS.READ, nestjs_shared_.FLOW_DEFINITION_PERMISSIONS.READ),
     (0,swagger_.ApiBearerAuth)(),
     (0,swagger_.ApiOperation)({
-        summary: 'Whether the designer is read-only here, and the names of the variables this environment defines'
+        summary: 'Whether the designer is read-only here, the names of the variables this environment defines, and the bundle upload limits'
     }),
     definition_bundle_controller_ts_metadata("design:type", Function),
     definition_bundle_controller_ts_metadata("design:paramtypes", []),
@@ -1646,7 +1671,7 @@ definition_bundle_controller_ts_decorate([
     (0,swagger_.ApiConsumes)('multipart/form-data'),
     (0,swagger_.ApiBody)(IMPORT_BODY),
     BundleUpload(),
-    definition_bundle_controller_ts_param(0, (0,common_.UploadedFile)()),
+    definition_bundle_controller_ts_param(0, (0,common_.UploadedFiles)()),
     definition_bundle_controller_ts_param(1, (0,common_.Body)()),
     definition_bundle_controller_ts_param(2, (0,nestjs_shared_.CurrentUser)()),
     definition_bundle_controller_ts_metadata("design:type", Function),
@@ -1670,7 +1695,7 @@ definition_bundle_controller_ts_decorate([
     (0,swagger_.ApiConsumes)('multipart/form-data'),
     (0,swagger_.ApiBody)(IMPORT_BODY),
     BundleUpload(),
-    definition_bundle_controller_ts_param(0, (0,common_.UploadedFile)()),
+    definition_bundle_controller_ts_param(0, (0,common_.UploadedFiles)()),
     definition_bundle_controller_ts_param(1, (0,common_.Body)()),
     definition_bundle_controller_ts_param(2, (0,nestjs_shared_.CurrentUser)()),
     definition_bundle_controller_ts_metadata("design:type", Function),
@@ -1738,7 +1763,9 @@ function _ts_param(paramIndex, decorator) {
 
 
 const DESIGNER_WRITE_HANDLERS = 'entity_builder:designer_write_handlers';
+const DESIGNER_REPAIR_HANDLER = 'entity_builder:designer_repair_handler';
 /** The handlers of a controller (inherited ones included) that change definitions by hand. */ const DesignerWrites = (...handlers)=>(0,_nestjs_common__rspack_import_0.SetMetadata)(DESIGNER_WRITE_HANDLERS, handlers);
+/** The one handler whose `repair` action still runs while read-only; any other handler is refused whatever its body says. */ const DesignerAllowsRepair = ()=>(0,_nestjs_common__rspack_import_0.SetMetadata)(DESIGNER_REPAIR_HANDLER, true);
 class DesignerWritableInterceptor {
     reflector;
     config;
@@ -1758,7 +1785,9 @@ class DesignerWritableInterceptor {
     isLocked(context) {
         if (!this.config.isDesignerReadOnly()) return false;
         const handlers = this.reflector.get(DESIGNER_WRITE_HANDLERS, context.getClass()) ?? [];
-        if (!handlers.includes(context.getHandler().name)) return false;
+        const handler = context.getHandler();
+        if (!handlers.includes(handler.name)) return false;
+        if (!this.reflector.get(DESIGNER_REPAIR_HANDLER, handler)) return true;
         return context.switchToHttp().getRequest().body?.action !== _dtos_schema_change_dto_js__rspack_import_2/* .SchemaChangeAction.REPAIR */.M3.REPAIR;
     }
 }
@@ -1774,9 +1803,10 @@ DesignerWritableInterceptor = _ts_decorate([
 ], DesignerWritableInterceptor);
 
 __webpack_require__.d(__webpack_exports__, {
-  X: () => (DesignerWritableInterceptor)
+  Xg: () => (DesignerWritableInterceptor)
 }, {
-  W: DesignerWrites
+  H6: DesignerAllowsRepair,
+  Wq: DesignerWrites
 });
 
 
@@ -1913,7 +1943,7 @@ class FlowAccessGuard {
         request.flowDefinition = flow;
         request.flowEndpoint = endpoint;
         const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';
-        if (!limiter.hit(`${flow.id}|${endpoint.nodeId}|${ip}`, endpoint.rateLimitPerMinute)) {
+        if (!limiter.hit(`${runtime.tenantScope()}|${flow.id}|${endpoint.nodeId}|${ip}`, endpoint.rateLimitPerMinute)) {
             throw new common_.HttpException({
                 message: 'Too many requests. Try again in a minute.',
                 messageKey: message_keys/* .FLOW_MESSAGES.RATE_LIMITED */.wu.RATE_LIMITED
@@ -1934,8 +1964,7 @@ class FlowAccessGuard {
                     return true;
                 }
             case 'jwt':
-                if (!await this.authenticate(context)) return false;
-                return true;
+                return this.authenticate(context);
             case 'permission':
                 {
                     if (!await this.authenticate(context)) return false;

package/fesm/config/index.js

@@ -3,18 +3,12 @@ export const __rspack_esm_ids = [565];
 export const __webpack_modules__ = {
 6576(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 const ENTITY_BUILDER_MODULE_OPTIONS = 'ENTITY_BUILDER_MODULE_OPTIONS';
-/**
- * Largest bundle file plan-import / apply-import accept. The bundle is uploaded as a file, so the app's
- * JSON body limit (Express's 100kb default) never applies to it and the app needs no setup for it.
- */ const ENTITY_BUNDLE_MAX_BYTES = 20 * 1024 * 1024;
-/** A name `${var:NAME}` can carry; any other name could never be resolved on import. */ const BUNDLE_VARIABLE_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/**
- * Identifier whitelist enforced on every EntityDefinition/FieldDefinition `code`.
- * Also the exact contract SchemaSyncService's DDL engine validates against
- * before generating a table/column name.
- */ const ENTITY_CODE_PATTERN = /^[a-z][a-z0-9_]{2,59}$/;
-/** Matches the `code` column length on both EntityDefinition and FieldDefinition. */ const ENTITY_CODE_MAX_LENGTH = 63;
-/** Defense-in-depth prefix applied to every dynamically created table name. */ const ENTITY_TABLE_PREFIX = 'eb_';
+/** The bundle is uploaded as a file, so the app's JSON body limit (Express's 100kb default) never applies to it - this does. */ const ENTITY_BUNDLE_MAX_BYTES = 20 * 1024 * 1024;
+/** A split export writes one file per entity and per flow; together they stay under ENTITY_BUNDLE_MAX_BYTES. */ const ENTITY_BUNDLE_MAX_FILES = 1000;
+/** Any other `${var:NAME}` name could never be resolved on import. */ const BUNDLE_VARIABLE_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Every entity and field `code`; the DDL engine checks the same pattern before it names a table or column. */ const ENTITY_CODE_PATTERN = /^[a-z][a-z0-9_]{2,59}$/;
+const ENTITY_CODE_MAX_LENGTH = 63;
+const ENTITY_TABLE_PREFIX = 'eb_';
 /** The generic API controller's record endpoints - each can be created as a ready-made flow with the entity. */ const ENTITY_FLOW_ENDPOINTS = [
     'insert',
     'insertMany',
@@ -40,7 +34,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 982(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/** Every entity the entity builder module publishes under */ const ENTITY_BUILDER_EVENT_ENTITIES = {
+/** The entity names the module publishes events under; also reserved as entity codes. */ const ENTITY_BUILDER_EVENT_ENTITIES = {
     ENTITY_DEFINITION: 'entity_definition',
     FIELD_DEFINITION: 'field_definition',
     SCHEMA_CHANGE_LOG: 'schema_change_log',
@@ -89,6 +83,7 @@ __webpack_require__.d(__webpack_exports__, {
   j4: () => (/* reexport safe */ _message_keys_js__rspack_import_2.j4),
   oc: () => (/* reexport safe */ _message_keys_js__rspack_import_2.oc),
   pL: () => (/* reexport safe */ _message_keys_js__rspack_import_2.pL),
+  qX: () => (/* reexport safe */ (/* inlined export _entity_builder_constants_js__rspack_import_0 */1000)),
   qj: () => (/* reexport safe */ _message_keys_js__rspack_import_2.qj),
   vs: () => (/* reexport safe */ _entity_builder_constants_js__rspack_import_0.vs),
   wu: () => (/* reexport safe */ _message_keys_js__rspack_import_2.wu),
@@ -113,6 +108,7 @@ var __webpack_exports__ENTITY_BUILDER_EVENT_ENTITIES = __webpack_exports__.P1;
 var __webpack_exports__ENTITY_BUILDER_EVENT_MODULE = __webpack_exports__.SD;
 var __webpack_exports__ENTITY_BUILDER_MODULE_OPTIONS = __webpack_exports__.CP;
 var __webpack_exports__ENTITY_BUNDLE_MAX_BYTES = __webpack_exports__.EA;
+var __webpack_exports__ENTITY_BUNDLE_MAX_FILES = __webpack_exports__.qX;
 var __webpack_exports__ENTITY_CODE_MAX_LENGTH = __webpack_exports__.KA;
 var __webpack_exports__ENTITY_CODE_PATTERN = __webpack_exports__.vs;
 var __webpack_exports__ENTITY_DEFINITION_MESSAGES = __webpack_exports__.pL;
@@ -136,4 +132,4 @@ var __webpack_exports__SCHEMA_MESSAGES = __webpack_exports__.Hu;
 var __webpack_exports__SCHEMA_PRECHECK_MESSAGES = __webpack_exports__.NE;
 var __webpack_exports__SCHEMA_STEP_MESSAGES = __webpack_exports__.EQ;
 var __webpack_exports__SCHEMA_WARNING_MESSAGES = __webpack_exports__.Uu;
-export { __webpack_exports__BUNDLE_MESSAGES as BUNDLE_MESSAGES, __webpack_exports__BUNDLE_VARIABLE_NAME_PATTERN as BUNDLE_VARIABLE_NAME_PATTERN, __webpack_exports__ENTITY_BUILDER_EVENT_ENTITIES as ENTITY_BUILDER_EVENT_ENTITIES, __webpack_exports__ENTITY_BUILDER_EVENT_MODULE as ENTITY_BUILDER_EVENT_MODULE, __webpack_exports__ENTITY_BUILDER_MODULE_OPTIONS as ENTITY_BUILDER_MODULE_OPTIONS, __webpack_exports__ENTITY_BUNDLE_MAX_BYTES as ENTITY_BUNDLE_MAX_BYTES, __webpack_exports__ENTITY_CODE_MAX_LENGTH as ENTITY_CODE_MAX_LENGTH, __webpack_exports__ENTITY_CODE_PATTERN as ENTITY_CODE_PATTERN, __webpack_exports__ENTITY_DEFINITION_MESSAGES as ENTITY_DEFINITION_MESSAGES, __webpack_exports__ENTITY_FLOW_ENDPOINTS as ENTITY_FLOW_ENDPOINTS, __webpack_exports__ENTITY_TABLE_PREFIX as ENTITY_TABLE_PREFIX, __webpack_exports__FIELD_DEFINITION_MESSAGES as FIELD_DEFINITION_MESSAGES, __webpack_exports__FIELD_VALIDATION_MESSAGES as FIELD_VALIDATION_MESSAGES, __webpack_exports__FLOW_DEFINITION_MESSAGES as FLOW_DEFINITION_MESSAGES, __webpack_exports__FLOW_ERROR_MESSAGES as FLOW_ERROR_MESSAGES, __webpack_exports__FLOW_MESSAGES as FLOW_MESSAGES, __webpack_exports__FLOW_SHAPE_MESSAGES as FLOW_SHAPE_MESSAGES, __webpack_exports__FLOW_SKIP_MESSAGES as FLOW_SKIP_MESSAGES, __webpack_exports__FLOW_SUBJECT_MESSAGES as FLOW_SUBJECT_MESSAGES, __webpack_exports__FLOW_VALIDATION_MESSAGES as FLOW_VALIDATION_MESSAGES, __webpack_exports__GENERIC_RECORD_MESSAGES as GENERIC_RECORD_MESSAGES, __webpack_exports__RULE_ENGINE_MESSAGES as RULE_ENGINE_MESSAGES, __webpack_exports__SCHEMA_BLOCKER_MESSAGES as SCHEMA_BLOCKER_MESSAGES, __webpack_exports__SCHEMA_FINDING_MESSAGES as SCHEMA_FINDING_MESSAGES, __webpack_exports__SCHEMA_IMPACT_MESSAGES as SCHEMA_IMPACT_MESSAGES, __webpack_exports__SCHEMA_MESSAGES as SCHEMA_MESSAGES, __webpack_exports__SCHEMA_PRECHECK_MESSAGES as SCHEMA_PRECHECK_MESSAGES, __webpack_exports__SCHEMA_STEP_MESSAGES as SCHEMA_STEP_MESSAGES, __webpack_exports__SCHEMA_WARNING_MESSAGES as SCHEMA_WARNING_MESSAGES };
+export { __webpack_exports__BUNDLE_MESSAGES as BUNDLE_MESSAGES, __webpack_exports__BUNDLE_VARIABLE_NAME_PATTERN as BUNDLE_VARIABLE_NAME_PATTERN, __webpack_exports__ENTITY_BUILDER_EVENT_ENTITIES as ENTITY_BUILDER_EVENT_ENTITIES, __webpack_exports__ENTITY_BUILDER_EVENT_MODULE as ENTITY_BUILDER_EVENT_MODULE, __webpack_exports__ENTITY_BUILDER_MODULE_OPTIONS as ENTITY_BUILDER_MODULE_OPTIONS, __webpack_exports__ENTITY_BUNDLE_MAX_BYTES as ENTITY_BUNDLE_MAX_BYTES, __webpack_exports__ENTITY_BUNDLE_MAX_FILES as ENTITY_BUNDLE_MAX_FILES, __webpack_exports__ENTITY_CODE_MAX_LENGTH as ENTITY_CODE_MAX_LENGTH, __webpack_exports__ENTITY_CODE_PATTERN as ENTITY_CODE_PATTERN, __webpack_exports__ENTITY_DEFINITION_MESSAGES as ENTITY_DEFINITION_MESSAGES, __webpack_exports__ENTITY_FLOW_ENDPOINTS as ENTITY_FLOW_ENDPOINTS, __webpack_exports__ENTITY_TABLE_PREFIX as ENTITY_TABLE_PREFIX, __webpack_exports__FIELD_DEFINITION_MESSAGES as FIELD_DEFINITION_MESSAGES, __webpack_exports__FIELD_VALIDATION_MESSAGES as FIELD_VALIDATION_MESSAGES, __webpack_exports__FLOW_DEFINITION_MESSAGES as FLOW_DEFINITION_MESSAGES, __webpack_exports__FLOW_ERROR_MESSAGES as FLOW_ERROR_MESSAGES, __webpack_exports__FLOW_MESSAGES as FLOW_MESSAGES, __webpack_exports__FLOW_SHAPE_MESSAGES as FLOW_SHAPE_MESSAGES, __webpack_exports__FLOW_SKIP_MESSAGES as FLOW_SKIP_MESSAGES, __webpack_exports__FLOW_SUBJECT_MESSAGES as FLOW_SUBJECT_MESSAGES, __webpack_exports__FLOW_VALIDATION_MESSAGES as FLOW_VALIDATION_MESSAGES, __webpack_exports__GENERIC_RECORD_MESSAGES as GENERIC_RECORD_MESSAGES, __webpack_exports__RULE_ENGINE_MESSAGES as RULE_ENGINE_MESSAGES, __webpack_exports__SCHEMA_BLOCKER_MESSAGES as SCHEMA_BLOCKER_MESSAGES, __webpack_exports__SCHEMA_FINDING_MESSAGES as SCHEMA_FINDING_MESSAGES, __webpack_exports__SCHEMA_IMPACT_MESSAGES as SCHEMA_IMPACT_MESSAGES, __webpack_exports__SCHEMA_MESSAGES as SCHEMA_MESSAGES, __webpack_exports__SCHEMA_PRECHECK_MESSAGES as SCHEMA_PRECHECK_MESSAGES, __webpack_exports__SCHEMA_STEP_MESSAGES as SCHEMA_STEP_MESSAGES, __webpack_exports__SCHEMA_WARNING_MESSAGES as SCHEMA_WARNING_MESSAGES };

package/fesm/docs/index.js

@@ -50,7 +50,7 @@ to a company or branch, add fields such as \`company_id\` / \`branch_id\` and ma
 - \`/entity-builder/entity-definitions/*\` - Entities, schema changes, health and history
 - \`/entity-builder/field-definitions/*\` - Field metadata (read-only; changes go through schema changes)
 - \`/entity-builder/flows/*\`, \`/entity-builder/flow-executions/*\` - Flows
-- \`/api-flows/:slug\` - Call a flow
+- \`/api-flows/:slug[/:path]\` - Call a flow (each Request step with a path answers on its own URL)
 - \`/entity-builder/bundles/*\` - Promote entities and flows between environments: export a bundle, plan and apply its import
 
 ## Common Error Codes

package/fesm/dtos/index.js

@@ -383,6 +383,7 @@ _ts_decorate([
 /** Form values arrive as text: `true` / `false` become booleans, anything else is left for the validator to refuse. */ const FormBoolean = ()=>(0,class_transformer__rspack_import_1.Transform)(({ value })=>value === 'true' ? true : value === 'false' ? false : value);
 /** The form fields sent with the bundle file to plan-import / apply-import. */ class ImportBundleOptionsDto {
     deprecateMissingFields;
+    deactivateMissingFlows;
     confirm;
     expectedChecksum;
     expectedPlanChecksum;
@@ -397,6 +398,16 @@ _ts_decorate([
     (0,class_validator__rspack_import_2.IsBoolean)(),
     _ts_metadata("design:type", Boolean)
 ], ImportBundleOptionsDto.prototype, "deprecateMissingFields", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Switch off (and publish) the live flows this environment has and the bundle does not (they are kept, not deleted)',
+        default: false
+    }),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    FormBoolean(),
+    (0,class_validator__rspack_import_2.IsBoolean)(),
+    _ts_metadata("design:type", Boolean)
+], ImportBundleOptionsDto.prototype, "deactivateMissingFlows", void 0);
 _ts_decorate([
     (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
         description: 'apply-import: acknowledge steps that lose (or may lose) data',

package/fesm/guards/index.js

@@ -38,7 +38,9 @@ function _ts_param(paramIndex, decorator) {
 
 
 const DESIGNER_WRITE_HANDLERS = 'entity_builder:designer_write_handlers';
+const DESIGNER_REPAIR_HANDLER = 'entity_builder:designer_repair_handler';
 /** The handlers of a controller (inherited ones included) that change definitions by hand. */ const DesignerWrites = (...handlers)=>(0,_nestjs_common__rspack_import_0.SetMetadata)(DESIGNER_WRITE_HANDLERS, handlers);
+/** The one handler whose `repair` action still runs while read-only; any other handler is refused whatever its body says. */ const DesignerAllowsRepair = ()=>(0,_nestjs_common__rspack_import_0.SetMetadata)(DESIGNER_REPAIR_HANDLER, true);
 class DesignerWritableInterceptor {
     reflector;
     config;
@@ -58,7 +60,9 @@ class DesignerWritableInterceptor {
     isLocked(context) {
         if (!this.config.isDesignerReadOnly()) return false;
         const handlers = this.reflector.get(DESIGNER_WRITE_HANDLERS, context.getClass()) ?? [];
-        if (!handlers.includes(context.getHandler().name)) return false;
+        const handler = context.getHandler();
+        if (!handlers.includes(handler.name)) return false;
+        if (!this.reflector.get(DESIGNER_REPAIR_HANDLER, handler)) return true;
         return context.switchToHttp().getRequest().body?.action !== _dtos_schema_change_dto_js__rspack_import_2/* .SchemaChangeAction.REPAIR */.M3.REPAIR;
     }
 }
@@ -74,9 +78,10 @@ DesignerWritableInterceptor = _ts_decorate([
 ], DesignerWritableInterceptor);
 
 __webpack_require__.d(__webpack_exports__, {
-  X: () => (DesignerWritableInterceptor)
+  Xg: () => (DesignerWritableInterceptor)
 }, {
-  W: DesignerWrites
+  H6: DesignerAllowsRepair,
+  Wq: DesignerWrites
 });
 
 
@@ -213,7 +218,7 @@ class FlowAccessGuard {
         request.flowDefinition = flow;
         request.flowEndpoint = endpoint;
         const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';
-        if (!limiter.hit(`${flow.id}|${endpoint.nodeId}|${ip}`, endpoint.rateLimitPerMinute)) {
+        if (!limiter.hit(`${runtime.tenantScope()}|${flow.id}|${endpoint.nodeId}|${ip}`, endpoint.rateLimitPerMinute)) {
             throw new common_.HttpException({
                 message: 'Too many requests. Try again in a minute.',
                 messageKey: message_keys/* .FLOW_MESSAGES.RATE_LIMITED */.wu.RATE_LIMITED
@@ -234,8 +239,7 @@ class FlowAccessGuard {
                     return true;
                 }
             case 'jwt':
-                if (!await this.authenticate(context)) return false;
-                return true;
+                return this.authenticate(context);
             case 'permission':
                 {
                     if (!await this.authenticate(context)) return false;
@@ -278,8 +282,9 @@ FlowAccessGuard = _ts_decorate([
 
 __webpack_require__.d(__webpack_exports__, {
   CA: () => (/* reexport safe */ _flow_access_guard_js__rspack_import_0.C),
-  Wq: () => (/* reexport safe */ _designer_writable_interceptor_js__rspack_import_1.W),
-  Xg: () => (/* reexport safe */ _designer_writable_interceptor_js__rspack_import_1.X)
+  H6: () => (/* reexport safe */ _designer_writable_interceptor_js__rspack_import_1.H6),
+  Wq: () => (/* reexport safe */ _designer_writable_interceptor_js__rspack_import_1.Wq),
+  Xg: () => (/* reexport safe */ _designer_writable_interceptor_js__rspack_import_1.Xg)
 });
 
 
@@ -306,7 +311,8 @@ import * as __rspack_chunk_5 from '../677.js';
 __webpack_require__.C(__rspack_chunk_5);
 import * as __rspack_chunk_6 from './index.js';
 __webpack_require__.C(__rspack_chunk_6);
-var __webpack_exports__ = __webpack_exec__(5460);var __webpack_exports__DesignerWritableInterceptor = __webpack_exports__.Xg;
+var __webpack_exports__ = __webpack_exec__(5460);var __webpack_exports__DesignerAllowsRepair = __webpack_exports__.H6;
+var __webpack_exports__DesignerWritableInterceptor = __webpack_exports__.Xg;
 var __webpack_exports__DesignerWrites = __webpack_exports__.Wq;
 var __webpack_exports__FlowAccessGuard = __webpack_exports__.CA;
-export { __webpack_exports__DesignerWritableInterceptor as DesignerWritableInterceptor, __webpack_exports__DesignerWrites as DesignerWrites, __webpack_exports__FlowAccessGuard as FlowAccessGuard };
+export { __webpack_exports__DesignerAllowsRepair as DesignerAllowsRepair, __webpack_exports__DesignerWritableInterceptor as DesignerWritableInterceptor, __webpack_exports__DesignerWrites as DesignerWrites, __webpack_exports__FlowAccessGuard as FlowAccessGuard };