@rpcbase/server 0.531.0 → 0.533.0

package/dist/{queryExecutor-DYVlCvns.js → queryExecutor-JadZcQSQ.js}

@@ -253,9 +253,13 @@ var resolveRtsQueryDependencyModelNames = async ({ tenantId, ability, modelName,
 	return Array.from(dependencyModelNames);
 };
 var runRtsQuery = async ({ tenantId, ability, modelName, query, options, allowInternalModels = false }) => {
-	if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) throw new Error("Model not allowed");
-	if (!ability.can("read", modelName)) throw new Error("forbidden");
-	const model = await getTenantModel(tenantId, modelName, ability);
+	const { model, finalQuery } = await prepareRtsExecution({
+		tenantId,
+		ability,
+		modelName,
+		query,
+		allowInternalModels
+	});
 	const projection = options.projection ?? void 0;
 	const sort = options.sort;
 	const limit = normalizeLimit(options.limit);
@@ -270,7 +274,6 @@ var runRtsQuery = async ({ tenantId, ability, modelName, query, options, allowIn
 		modelCache,
 		dependencyModelNames: /* @__PURE__ */ new Set()
 	});
-	const finalQuery = { $and: [query, getAccessibleByQuery(ability, "read", modelName)] };
 	if (options.pagination) {
 		const paginatedQuery = model.find(finalQuery, projection);
 		if (populate !== void 0) paginatedQuery.populate(populate);
@@ -289,7 +292,27 @@ var runRtsQuery = async ({ tenantId, ability, modelName, query, options, allowIn
 	const data = await queryPromise;
 	return { data: Array.isArray(data) ? data : [] };
 };
+var prepareRtsExecution = async ({ tenantId, ability, modelName, query, allowInternalModels = false }) => {
+	if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) throw new Error("Model not allowed");
+	if (!ability.can("read", modelName)) throw new Error("forbidden");
+	return {
+		model: await getTenantModel(tenantId, modelName, ability),
+		finalQuery: { $and: [query, getAccessibleByQuery(ability, "read", modelName)] }
+	};
+};
+var runRtsCount = async ({ tenantId, ability, modelName, query, allowInternalModels = false }) => {
+	const { model, finalQuery } = await prepareRtsExecution({
+		tenantId,
+		ability,
+		modelName,
+		query,
+		allowInternalModels
+	});
+	const count = await model.countDocuments(finalQuery);
+	if (typeof count !== "number" || !Number.isFinite(count) || count < 0) return 0;
+	return Math.floor(count);
+};
 //#endregion
-export { normalizeRtsQueryOptions as a, runRtsQuery as c, isRtsRequestAuthorized as i, getDerivedKey as l, RTS_USER_ID_HEADER as n, resolveRtsQueryDependencyModelNames as o, buildRtsAbilityFromRequest as r, resolveRtsRequestTenantId as s, RTS_TENANT_ID_QUERY_PARAM as t };
+export { normalizeRtsQueryOptions as a, runRtsCount as c, isRtsRequestAuthorized as i, runRtsQuery as l, RTS_USER_ID_HEADER as n, resolveRtsQueryDependencyModelNames as o, buildRtsAbilityFromRequest as r, resolveRtsRequestTenantId as s, RTS_TENANT_ID_QUERY_PARAM as t, getDerivedKey as u };
 
-//# sourceMappingURL=queryExecutor-DYVlCvns.js.map
+//# sourceMappingURL=queryExecutor-JadZcQSQ.js.map

package/dist/queryExecutor-JadZcQSQ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryExecutor-JadZcQSQ.js","names":["assert","hkdfSync","getDerivedKey","masterKey","info","length","salt","Buffer","from","toString","Request","PaginationPageInfo","PaginationSpec","models","LoadModelCtx","buildAbility","buildAbilityFromSession","getAccessibleByQuery","getTenantRolesFromSessionUser","AclSubjectType","AppAbility","Model","getDerivedKey","JsonObject","Record","SessionUser","id","currentTenantId","signedInTenants","HeaderUserDoc","tenants","tenantRoles","RtsPopulateObject","path","model","select","match","options","sort","limit","populate","RtsPopulateOption","Array","RtsQueryOptions","projection","pagination","RtsQueryResult","data","pageInfo","totalCount","PreparedRtsExecution","finalQuery","RTS_TENANT_ID_QUERY_PARAM","RTS_USER_ID_HEADER","QUERY_MAX_LIMIT","INTERNAL_MODEL_NAMES","Set","paginationCursorSigningSecret","getPaginationCursorSigningSecret","masterKey","process","env","MASTER_KEY","trim","Error","normalizeTenantId","value","normalized","normalizeSignedInTenants","isArray","map","tenantId","String","filter","Boolean","getTenantIdFromRequest","req","rawQuery","query","queryTenantId","normalizedFromQuery","session","user","resolveRtsRequestTenantId","resolveRtsRequestUserId","sessionUserId","headerValue","headers","headerUserId","isRtsRequestAuthorized","sessionUser","length","includes","buildRtsAbilityFromRequest","Promise","ability","userId","headerUserIdRaw","rbCtx","User","getGlobal","findById","lean","tenantsRaw","tenant","roles","getTenantModel","modelName","ctx","get","normalizeLimit","Number","isFinite","Math","min","abs","normalizeString","normalizeObject","undefined","normalizePagination","normalizePopulateSelect","normalizePopulateOptions","raw","max","floor","normalizePopulateObject","nestedPopulate","normalizeRtsPopulateOption","entry","normalizeModelName","resolvePopulateRefModelName","explicitModelName","schema","schemaPath","directRef","ref","arrayRef","caster","virtualPath","virtualpath","virtualRef","mergePopulateMatchWithAcl","populateMatch","aclMatch","Object","keys","$and","PreparedPopulateObject","PreparedPopulateOption","resolvePopulateSpecForModel","allowInternalModels","modelCache","dependencyModelNames","Map","getModelCached","targetModelName","cached","loaded","set","resolveOne","parentModel","refModelName","has","can","add","Exclude","nestedModel","normalizedEntry","resolved","all","filtered","normalizeRtsQueryOptions","resolveRtsQueryDependencyModelNames","from","runRtsQuery","prepareRtsExecution","paginatedQuery","find","paginatedResult","paginate","cursor","signingSecret","nodes","queryPromise","accessQuery","runRtsCount","count","countDocuments"],"sources":["../src/getDerivedKey.ts","../src/rts/queryExecutor.ts"],"sourcesContent":["import assert from \"assert\"\nimport { hkdfSync } from \"crypto\"\n\n\nexport const getDerivedKey = (\n  masterKey: string,\n  info: string,\n  length: number = 32, // Default to 256-bit keys\n  salt: string = \"\",\n): string => {\n  assert(masterKey?.length >= 32, \"MASTER_KEY must be 32 chars or longer.\")\n\n  return Buffer.from(hkdfSync(\n    \"sha256\",\n    masterKey,\n    Buffer.from(salt),\n    Buffer.from(info),\n    length,\n  )).toString(\"hex\")\n}\n","import type { Request } from \"express\"\nimport type { PaginationPageInfo, PaginationSpec } from \"@rpcbase/api\"\nimport { models, type LoadModelCtx } from \"@rpcbase/db\"\nimport { buildAbility, buildAbilityFromSession, getAccessibleByQuery, getTenantRolesFromSessionUser, type AclSubjectType, type AppAbility } from \"@rpcbase/db/acl\"\nimport type { Model } from \"mongoose\"\n\nimport { getDerivedKey } from \"../getDerivedKey\"\n\n\ntype JsonObject = Record<string, unknown>\n\ntype SessionUser = {\n  id?: unknown\n  currentTenantId?: unknown\n  signedInTenants?: unknown\n}\n\ntype HeaderUserDoc = {\n  tenants?: unknown\n  tenantRoles?: unknown\n}\n\nexport type RtsPopulateObject = {\n  path: string\n  model?: string\n  select?: string | JsonObject\n  match?: JsonObject\n  options?: {\n    sort?: Record<string, 1 | -1>\n    limit?: number\n  }\n  populate?: RtsPopulateOption\n}\n\nexport type RtsPopulateOption =\n  | string\n  | RtsPopulateObject\n  | Array<string | RtsPopulateObject>\n\nexport type RtsQueryOptions = {\n  projection?: JsonObject\n  sort?: Record<string, 1 | -1>\n  limit?: number\n  populate?: RtsPopulateOption\n  pagination?: PaginationSpec\n}\n\nexport type RtsQueryResult = {\n  data: unknown[]\n  pageInfo?: PaginationPageInfo\n  totalCount?: number\n}\n\ntype PreparedRtsExecution = {\n  model: Model<any>\n  finalQuery: JsonObject\n}\n\nexport const RTS_TENANT_ID_QUERY_PARAM = \"rb-tenant-id\"\nexport const RTS_USER_ID_HEADER = \"rb-user-id\"\n\nconst QUERY_MAX_LIMIT = 4096\nconst INTERNAL_MODEL_NAMES = new Set([\"RBRtsChange\", \"RBRtsCounter\"])\nlet paginationCursorSigningSecret: string | null = null\n\nconst getPaginationCursorSigningSecret = (): string => {\n  if (paginationCursorSigningSecret) return paginationCursorSigningSecret\n  const masterKey = process.env.MASTER_KEY?.trim()\n  if (!masterKey) {\n    throw new Error(\"MASTER_KEY must be defined to derive pagination cursor signing secret\")\n  }\n  paginationCursorSigningSecret = getDerivedKey(masterKey, \"pagination_cursor_signing\")\n  return paginationCursorSigningSecret\n}\n\nconst normalizeTenantId = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized ? normalized : null\n}\n\nconst normalizeSignedInTenants = (value: unknown): string[] => {\n  if (!Array.isArray(value)) return []\n  return value\n    .map((tenantId) => normalizeTenantId(String(tenantId)))\n    .filter((tenantId): tenantId is string => Boolean(tenantId))\n}\n\nconst getTenantIdFromRequest = (req: Request): string | null => {\n  const rawQuery = req.query?.[RTS_TENANT_ID_QUERY_PARAM]\n  const queryTenantId = Array.isArray(rawQuery) ? rawQuery[0] : rawQuery\n  const normalizedFromQuery = normalizeTenantId(queryTenantId)\n  if (normalizedFromQuery) return normalizedFromQuery\n\n  return normalizeTenantId((req.session?.user as SessionUser | undefined)?.currentTenantId)\n}\n\nexport const resolveRtsRequestTenantId = (req: Request): string | null => {\n  return getTenantIdFromRequest(req)\n}\n\nexport const resolveRtsRequestUserId = (req: Request): string | null => {\n  const sessionUserId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.id)\n  if (sessionUserId) return sessionUserId\n\n  const headerValue = req.headers[RTS_USER_ID_HEADER]\n  const headerUserId = Array.isArray(headerValue) ? headerValue[0] : headerValue\n  return normalizeTenantId(headerUserId)\n}\n\nexport const isRtsRequestAuthorized = (req: Request, tenantId: string): boolean => {\n  const sessionUser = req.session?.user as SessionUser | undefined\n  if (!sessionUser) return false\n\n  const signedInTenants = normalizeSignedInTenants(sessionUser.signedInTenants)\n  if (signedInTenants.length > 0) {\n    return signedInTenants.includes(tenantId)\n  }\n\n  const currentTenantId = normalizeTenantId(sessionUser.currentTenantId)\n  if (!currentTenantId) return false\n  return currentTenantId === tenantId\n}\n\nexport const buildRtsAbilityFromRequest = async (\n  req: Request,\n  tenantId: string,\n): Promise<{ ability: AppAbility; userId: string | null }> => {\n  const sessionUserId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.id)\n  if (sessionUserId) {\n    const ability = buildAbilityFromSession({ tenantId, session: req.session })\n    return { ability, userId: sessionUserId }\n  }\n\n  const headerValue = req.headers[RTS_USER_ID_HEADER]\n  const headerUserIdRaw = Array.isArray(headerValue) ? headerValue[0] : headerValue\n  const headerUserId = normalizeTenantId(headerUserIdRaw)\n  if (!headerUserId) {\n    const ability = buildAbilityFromSession({ tenantId, session: req.session })\n    return { ability, userId: null }\n  }\n\n  const rbCtx: LoadModelCtx = { req: { session: null } }\n  const User = await models.getGlobal(\"RBUser\", rbCtx)\n  const user = await User.findById(headerUserId, { tenants: 1, tenantRoles: 1 }).lean() as HeaderUserDoc | null\n\n  const tenantsRaw = user?.tenants\n  const tenants = Array.isArray(tenantsRaw) ? tenantsRaw.map((tenant) => String(tenant)) : []\n  if (!tenants.includes(tenantId)) {\n    throw new Error(\"Tenant not authorized for this session\")\n  }\n\n  const roles = getTenantRolesFromSessionUser(user, tenantId)\n  return {\n    ability: buildAbility({ tenantId, userId: headerUserId, roles: roles.length ? roles : [\"owner\"] }),\n    userId: headerUserId,\n  }\n}\n\nconst getTenantModel = async (tenantId: string, modelName: string, ability: AppAbility): Promise<Model<any>> => {\n  const ctx: LoadModelCtx = {\n    req: {\n      session: {\n        user: {\n          currentTenantId: tenantId,\n        },\n      },\n    },\n    ability,\n  }\n\n  return models.get(modelName, ctx)\n}\n\nconst normalizeLimit = (limit?: number): number => {\n  if (typeof limit !== \"number\") return QUERY_MAX_LIMIT\n  if (!Number.isFinite(limit)) return QUERY_MAX_LIMIT\n  return Math.min(QUERY_MAX_LIMIT, Math.abs(limit))\n}\n\nconst normalizeString = (value: unknown): string => {\n  return typeof value === \"string\" ? value.trim() : \"\"\n}\n\nconst normalizeObject = (value: unknown): JsonObject | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  return value as JsonObject\n}\n\nconst normalizePagination = (value: unknown): PaginationSpec | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  return value as PaginationSpec\n}\n\nconst normalizePopulateSelect = (value: unknown): string | JsonObject | undefined => {\n  if (typeof value === \"string\") {\n    const normalized = value.trim()\n    return normalized || undefined\n  }\n  return normalizeObject(value)\n}\n\nconst normalizePopulateOptions = (value: unknown): RtsPopulateObject[\"options\"] | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  const raw = value as { sort?: unknown; limit?: unknown }\n  const normalized: RtsPopulateObject[\"options\"] = {}\n\n  if (raw.sort && typeof raw.sort === \"object\" && !Array.isArray(raw.sort)) {\n    normalized.sort = raw.sort as Record<string, 1 | -1>\n  }\n\n  if (typeof raw.limit === \"number\" && Number.isFinite(raw.limit)) {\n    normalized.limit = Math.max(0, Math.floor(Math.abs(raw.limit)))\n  }\n\n  if (!normalized.sort && normalized.limit === undefined) return undefined\n  return normalized\n}\n\nconst normalizePopulateObject = (value: unknown): RtsPopulateObject | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  const raw = value as Record<string, unknown>\n  const path = normalizeString(raw.path)\n  if (!path) return undefined\n\n  const normalized: RtsPopulateObject = { path }\n\n  const model = normalizeString(raw.model)\n  if (model) normalized.model = model\n\n  const select = normalizePopulateSelect(raw.select)\n  if (select !== undefined) normalized.select = select\n\n  const match = normalizeObject(raw.match)\n  if (match) normalized.match = match\n\n  const nestedPopulate = normalizeRtsPopulateOption(raw.populate)\n  if (nestedPopulate !== undefined) normalized.populate = nestedPopulate\n\n  const options = normalizePopulateOptions(raw.options)\n  if (options) normalized.options = options\n\n  return normalized\n}\n\nconst normalizeRtsPopulateOption = (value: unknown): RtsPopulateOption | undefined => {\n  if (typeof value === \"string\") {\n    const normalized = value.trim()\n    return normalized || undefined\n  }\n\n  if (Array.isArray(value)) {\n    const normalized = value\n      .map((entry) => {\n        if (typeof entry === \"string\") {\n          const path = entry.trim()\n          return path || null\n        }\n        return normalizePopulateObject(entry) ?? null\n      })\n      .filter((entry): entry is string | RtsPopulateObject => entry !== null)\n\n    return normalized.length > 0 ? normalized : undefined\n  }\n\n  return normalizePopulateObject(value)\n}\n\nconst normalizeModelName = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized || null\n}\n\nconst resolvePopulateRefModelName = (\n  model: Model<any>,\n  path: string,\n  explicitModelName: string | null,\n): string | null => {\n  if (explicitModelName) return explicitModelName\n\n  const schema = model.schema as any\n  const schemaPath = typeof schema.path === \"function\" ? schema.path(path) : null\n  const directRef = normalizeModelName(schemaPath?.options?.ref)\n  if (directRef) return directRef\n\n  const arrayRef = normalizeModelName(schemaPath?.caster?.options?.ref)\n  if (arrayRef) return arrayRef\n\n  const virtualPath = typeof schema.virtualpath === \"function\" ? schema.virtualpath(path) : null\n  const virtualRef = normalizeModelName(virtualPath?.options?.ref)\n  if (virtualRef) return virtualRef\n\n  return null\n}\n\nconst mergePopulateMatchWithAcl = (\n  populateMatch: JsonObject | undefined,\n  aclMatch: JsonObject,\n): JsonObject => {\n  if (!populateMatch || Object.keys(populateMatch).length === 0) return aclMatch\n  return { $and: [populateMatch, aclMatch] }\n}\n\ntype PreparedPopulateObject = {\n  path: string\n  model?: string\n  select?: string | JsonObject\n  match?: JsonObject\n  options?: {\n    sort?: Record<string, 1 | -1>\n    limit?: number\n  }\n  populate?: PreparedPopulateOption\n}\n\ntype PreparedPopulateOption =\n  | string\n  | PreparedPopulateObject\n  | Array<string | PreparedPopulateObject>\n\nconst resolvePopulateSpecForModel = async ({\n  tenantId,\n  model,\n  ability,\n  populate,\n  allowInternalModels,\n  modelCache,\n  dependencyModelNames,\n}: {\n  tenantId: string\n  model: Model<any>\n  ability: AppAbility\n  populate: RtsPopulateOption | undefined\n  allowInternalModels: boolean\n  modelCache: Map<string, Model<any>>\n  dependencyModelNames: Set<string>\n}): Promise<PreparedPopulateOption | undefined> => {\n  if (!populate) return undefined\n\n  const getModelCached = async (targetModelName: string): Promise<Model<any>> => {\n    const cached = modelCache.get(targetModelName)\n    if (cached) return cached\n    const loaded = await getTenantModel(tenantId, targetModelName, ability)\n    modelCache.set(targetModelName, loaded)\n    return loaded\n  }\n\n  const resolveOne = async (\n    entry: string | RtsPopulateObject,\n    parentModel: Model<any>,\n  ): Promise<string | PreparedPopulateObject | null> => {\n    if (typeof entry === \"string\") {\n      const path = entry.trim()\n      if (!path) return null\n\n      const refModelName = resolvePopulateRefModelName(parentModel, path, null)\n      if (!refModelName) return path\n      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {\n        throw new Error(\"Model not allowed\")\n      }\n      if (!ability.can(\"read\", refModelName as AclSubjectType)) {\n        throw new Error(\"forbidden\")\n      }\n\n      dependencyModelNames.add(refModelName)\n\n      const aclMatch = getAccessibleByQuery(\n        ability,\n        \"read\",\n        refModelName as Exclude<AclSubjectType, \"all\">,\n      )\n      return {\n        path,\n        match: aclMatch as JsonObject,\n      }\n    }\n\n    const path = entry.path.trim()\n    if (!path) return null\n\n    const explicitModelName = normalizeModelName(entry.model)\n    const refModelName = resolvePopulateRefModelName(parentModel, path, explicitModelName)\n    let nestedModel = parentModel\n\n    const normalizedEntry: PreparedPopulateObject = {\n      path,\n    }\n\n    if (entry.select !== undefined) normalizedEntry.select = entry.select\n    if (entry.options !== undefined) normalizedEntry.options = entry.options\n    if (explicitModelName) normalizedEntry.model = explicitModelName\n    if (entry.match !== undefined) normalizedEntry.match = entry.match\n\n    if (refModelName) {\n      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {\n        throw new Error(\"Model not allowed\")\n      }\n      if (!ability.can(\"read\", refModelName as AclSubjectType)) {\n        throw new Error(\"forbidden\")\n      }\n\n      dependencyModelNames.add(refModelName)\n      nestedModel = await getModelCached(refModelName)\n\n      const aclMatch = getAccessibleByQuery(\n        ability,\n        \"read\",\n        refModelName as Exclude<AclSubjectType, \"all\">,\n      ) as JsonObject\n      normalizedEntry.match = mergePopulateMatchWithAcl(\n        normalizedEntry.match,\n        aclMatch,\n      )\n    } else if (entry.populate !== undefined) {\n      throw new Error(\"Populate path must reference a model when nested populate is used\")\n    }\n\n    const nestedPopulate = await resolvePopulateSpecForModel({\n      tenantId,\n      model: nestedModel,\n      ability,\n      populate: entry.populate,\n      allowInternalModels,\n      modelCache,\n      dependencyModelNames,\n    })\n    if (nestedPopulate !== undefined) normalizedEntry.populate = nestedPopulate\n\n    return normalizedEntry\n  }\n\n  if (Array.isArray(populate)) {\n    const resolved = await Promise.all(populate.map((entry) => resolveOne(entry, model)))\n    const filtered = resolved.filter((entry): entry is string | PreparedPopulateObject => entry !== null)\n    return filtered.length > 0 ? filtered : undefined\n  }\n\n  const resolved = await resolveOne(populate, model)\n  return resolved ?? undefined\n}\n\nexport const normalizeRtsQueryOptions = (options: RtsQueryOptions | undefined): RtsQueryOptions => {\n  if (!options || typeof options !== \"object\") return {}\n  const normalized: RtsQueryOptions = {}\n\n  if (options.projection && typeof options.projection === \"object\" && !Array.isArray(options.projection)) {\n    normalized.projection = options.projection\n  }\n\n  if (options.sort && typeof options.sort === \"object\" && !Array.isArray(options.sort)) {\n    normalized.sort = options.sort\n  }\n\n  normalized.limit = normalizeLimit(options.limit)\n  normalized.populate = normalizeRtsPopulateOption(options.populate)\n  normalized.pagination = normalizePagination(options.pagination)\n\n  return normalized\n}\n\nexport const resolveRtsQueryDependencyModelNames = async ({\n  tenantId,\n  ability,\n  modelName,\n  options,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  options: RtsQueryOptions\n  allowInternalModels?: boolean\n}): Promise<string[]> => {\n  const model = await getTenantModel(tenantId, modelName, ability)\n  const modelCache = new Map<string, Model<any>>()\n  modelCache.set(modelName, model)\n\n  const dependencyModelNames = new Set<string>()\n  await resolvePopulateSpecForModel({\n    tenantId,\n    model,\n    ability,\n    populate: options.populate,\n    allowInternalModels,\n    modelCache,\n    dependencyModelNames,\n  })\n\n  return Array.from(dependencyModelNames)\n}\n\nexport const runRtsQuery = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  options,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  options: RtsQueryOptions\n  allowInternalModels?: boolean\n}): Promise<RtsQueryResult> => {\n  const { model, finalQuery } = await prepareRtsExecution({\n    tenantId,\n    ability,\n    modelName,\n    query,\n    allowInternalModels,\n  })\n  const projection = options.projection ?? undefined\n  const sort = options.sort\n  const limit = normalizeLimit(options.limit)\n  const modelCache = new Map<string, Model<any>>()\n  modelCache.set(modelName, model)\n\n  const populate = await resolvePopulateSpecForModel({\n    tenantId,\n    model,\n    ability,\n    populate: options.populate,\n    allowInternalModels,\n    modelCache,\n    dependencyModelNames: new Set<string>(),\n  })\n\n  if (options.pagination) {\n    const paginatedQuery = model.find(finalQuery, projection)\n    if (populate !== undefined) {\n      paginatedQuery.populate(populate as any)\n    }\n\n    const paginatedResult = await paginatedQuery.paginate(options.pagination, {\n      cursor: {\n        signingSecret: getPaginationCursorSigningSecret(),\n      },\n    })\n    const totalCount = typeof paginatedResult.totalCount === \"number\"\n      && Number.isFinite(paginatedResult.totalCount)\n      && paginatedResult.totalCount >= 0\n      ? Math.floor(paginatedResult.totalCount)\n      : undefined\n\n    return {\n      data: Array.isArray(paginatedResult.nodes) ? paginatedResult.nodes : [],\n      pageInfo: paginatedResult.pageInfo,\n      ...(totalCount !== undefined ? { totalCount } : {}),\n    }\n  }\n\n  const queryPromise = model.find(finalQuery, projection)\n  if (populate !== undefined) {\n    queryPromise.populate(populate as any)\n  }\n  if (sort && Object.keys(sort).length) {\n    queryPromise.sort(sort)\n  }\n  queryPromise.limit(limit)\n\n  const data = await queryPromise\n  return { data: Array.isArray(data) ? data : [] }\n}\n\nconst prepareRtsExecution = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  allowInternalModels?: boolean\n}): Promise<PreparedRtsExecution> => {\n  if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) {\n    throw new Error(\"Model not allowed\")\n  }\n\n  if (!ability.can(\"read\", modelName as AclSubjectType)) {\n    throw new Error(\"forbidden\")\n  }\n\n  const model = await getTenantModel(tenantId, modelName, ability)\n  const accessQuery = getAccessibleByQuery(ability, \"read\", modelName as Exclude<AclSubjectType, \"all\">)\n  const finalQuery: JsonObject = { $and: [query, accessQuery] }\n\n  return { model, finalQuery }\n}\n\nexport const runRtsCount = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  allowInternalModels?: boolean\n}): Promise<number> => {\n  const { model, finalQuery } = await prepareRtsExecution({\n    tenantId,\n    ability,\n    modelName,\n    query,\n    allowInternalModels,\n  })\n\n  const count = await model.countDocuments(finalQuery)\n  if (typeof count !== \"number\" || !Number.isFinite(count) || count < 0) {\n    return 0\n  }\n\n  return Math.floor(count)\n}\n"],"mappings":";;;;;AAIA,IAAaE,iBACXC,WACAC,MACAC,SAAiB,IACjBC,OAAe,OACJ;AACXN,QAAOG,WAAWE,UAAU,IAAI,yCAAyC;AAEzE,QAAOE,OAAOC,KAAKP,SACjB,UACAE,WACAI,OAAOC,KAAKF,KAAK,EACjBC,OAAOC,KAAKJ,KAAK,EACjBC,OACD,CAAC,CAACI,SAAS,MAAM;;;;ACwCpB,IAAa2C,4BAA4B;AACzC,IAAaC,qBAAqB;AAElC,IAAMC,kBAAkB;AACxB,IAAMC,uBAAuB,IAAIC,IAAI,CAAC,eAAe,eAAe,CAAC;AACrE,IAAIC,gCAA+C;AAEnD,IAAMC,yCAAiD;AACrD,KAAID,8BAA+B,QAAOA;CAC1C,MAAME,YAAYC,QAAQC,IAAIC,YAAYC,MAAM;AAChD,KAAI,CAACJ,UACH,OAAM,IAAIK,MAAM,wEAAwE;AAE1FP,iCAAgCnC,cAAcqC,WAAW,4BAA4B;AACrF,QAAOF;;AAGT,IAAMQ,qBAAqBC,UAAkC;AAC3D,KAAI,OAAOA,UAAU,SAAU,QAAO;CACtC,MAAMC,aAAaD,MAAMH,MAAM;AAC/B,QAAOI,aAAaA,aAAa;;AAGnC,IAAMC,4BAA4BF,UAA6B;AAC7D,KAAI,CAACxB,MAAM2B,QAAQH,MAAM,CAAE,QAAO,EAAE;AACpC,QAAOA,MACJI,KAAKC,aAAaN,kBAAkBO,OAAOD,SAAS,CAAC,CAAC,CACtDE,QAAQF,aAAiCG,QAAQH,SAAS,CAAC;;AAGhE,IAAMI,0BAA0BC,QAAgC;CAC9D,MAAMC,WAAWD,IAAIE,QAAQ1B;CAE7B,MAAM4B,sBAAsBf,kBADNvB,MAAM2B,QAAQQ,SAAS,GAAGA,SAAS,KAAKA,SACF;AAC5D,KAAIG,oBAAqB,QAAOA;AAEhC,QAAOf,mBAAmBW,IAAIK,SAASC,OAAkCvD,gBAAgB;;AAG3F,IAAawD,6BAA6BP,QAAgC;AACxE,QAAOD,uBAAuBC,IAAI;;AAYpC,IAAaa,0BAA0Bb,KAAcL,aAA8B;CACjF,MAAMmB,cAAcd,IAAIK,SAASC;AACjC,KAAI,CAACQ,YAAa,QAAO;CAEzB,MAAM9D,kBAAkBwC,yBAAyBsB,YAAY9D,gBAAgB;AAC7E,KAAIA,gBAAgB+D,SAAS,EAC3B,QAAO/D,gBAAgBgE,SAASrB,SAAS;CAG3C,MAAM5C,kBAAkBsC,kBAAkByB,YAAY/D,gBAAgB;AACtE,KAAI,CAACA,gBAAiB,QAAO;AAC7B,QAAOA,oBAAoB4C;;AAG7B,IAAasB,6BAA6B,OACxCjB,KACAL,aAC4D;CAC5D,MAAMc,gBAAgBpB,mBAAmBW,IAAIK,SAASC,OAAkCxD,GAAG;AAC3F,KAAI2D,cAEF,QAAO;EAAEU,SADO/E,wBAAwB;GAAEuD;GAAUU,SAASL,IAAIK;GAAS,CAAC;EACzDe,QAAQX;EAAe;CAG3C,MAAMC,cAAcV,IAAIW,QAAQlC;CAEhC,MAAMmC,eAAevB,kBADGvB,MAAM2B,QAAQiB,YAAY,GAAGA,YAAY,KAAKA,YACf;AACvD,KAAI,CAACE,aAEH,QAAO;EAAEO,SADO/E,wBAAwB;GAAEuD;GAAUU,SAASL,IAAIK;GAAS,CAAC;EACzDe,QAAQ;EAAM;CAKlC,MAAMd,OAAO,OADA,MAAMrE,OAAOuF,UAAU,UADR,EAAExB,KAAK,EAAEK,SAAS,MAAK,EAAG,CACF,EAC5BoB,SAASb,cAAc;EAAE1D,SAAS;EAAGC,aAAa;EAAG,CAAC,CAACuE,MAAM;CAErF,MAAMC,aAAarB,MAAMpD;AAEzB,KAAI,EADYY,MAAM2B,QAAQkC,WAAW,GAAGA,WAAWjC,KAAKkC,WAAWhC,OAAOgC,OAAO,CAAC,GAAG,EAAE,EAC9EZ,SAASrB,SAAS,CAC7B,OAAM,IAAIP,MAAM,yCAAyC;CAG3D,MAAMyC,QAAQvF,8BAA8BgE,MAAMX,SAAS;AAC3D,QAAO;EACLwB,SAAShF,aAAa;GAAEwD;GAAUyB,QAAQR;GAAciB,OAAOA,MAAMd,SAASc,QAAQ,CAAC,QAAO;GAAG,CAAC;EAClGT,QAAQR;EACT;;AAGH,IAAMkB,iBAAiB,OAAOnC,UAAkBoC,WAAmBZ,YAA6C;CAC9G,MAAMa,MAAoB;EACxBhC,KAAK,EACHK,SAAS,EACPC,MAAM,EACJvD,iBAAiB4C,UACnB,EACF,EACD;EACDwB;EACD;AAED,QAAOlF,OAAOgG,IAAIF,WAAWC,IAAI;;AAGnC,IAAME,kBAAkBvE,UAA2B;AACjD,KAAI,OAAOA,UAAU,SAAU,QAAOe;AACtC,KAAI,CAACyD,OAAOC,SAASzE,MAAM,CAAE,QAAOe;AACpC,QAAO2D,KAAKC,IAAI5D,iBAAiB2D,KAAKE,IAAI5E,MAAM,CAAC;;AAGnD,IAAM6E,mBAAmBlD,UAA2B;AAClD,QAAO,OAAOA,UAAU,WAAWA,MAAMH,MAAM,GAAG;;AAGpD,IAAMsD,mBAAmBnD,UAA2C;AAClE,KAAI,CAACA,SAAS,OAAOA,UAAU,YAAYxB,MAAM2B,QAAQH,MAAM,CAAE,QAAOoD,KAAAA;AACxE,QAAOpD;;AAGT,IAAMqD,uBAAuBrD,UAA+C;AAC1E,KAAI,CAACA,SAAS,OAAOA,UAAU,YAAYxB,MAAM2B,QAAQH,MAAM,CAAE,QAAOoD,KAAAA;AACxE,QAAOpD;;AAGT,IAAMsD,2BAA2BtD,UAAoD;AACnF,KAAI,OAAOA,UAAU,SAEnB,QADmBA,MAAMH,MAAM,IACVuD,KAAAA;AAEvB,QAAOD,gBAAgBnD,MAAM;;AAG/B,IAAMuD,4BAA4BvD,UAA6D;AAC7F,KAAI,CAACA,SAAS,OAAOA,UAAU,YAAYxB,MAAM2B,QAAQH,MAAM,CAAE,QAAOoD,KAAAA;CACxE,MAAMI,MAAMxD;CACZ,MAAMC,aAA2C,EAAE;AAEnD,KAAIuD,IAAIpF,QAAQ,OAAOoF,IAAIpF,SAAS,YAAY,CAACI,MAAM2B,QAAQqD,IAAIpF,KAAK,CACtE6B,YAAW7B,OAAOoF,IAAIpF;AAGxB,KAAI,OAAOoF,IAAInF,UAAU,YAAYwE,OAAOC,SAASU,IAAInF,MAAM,CAC7D4B,YAAW5B,QAAQ0E,KAAKU,IAAI,GAAGV,KAAKW,MAAMX,KAAKE,IAAIO,IAAInF,MAAM,CAAC,CAAC;AAGjE,KAAI,CAAC4B,WAAW7B,QAAQ6B,WAAW5B,UAAU+E,KAAAA,EAAW,QAAOA,KAAAA;AAC/D,QAAOnD;;AAGT,IAAM0D,2BAA2B3D,UAAkD;AACjF,KAAI,CAACA,SAAS,OAAOA,UAAU,YAAYxB,MAAM2B,QAAQH,MAAM,CAAE,QAAOoD,KAAAA;CACxE,MAAMI,MAAMxD;CACZ,MAAMjC,OAAOmF,gBAAgBM,IAAIzF,KAAK;AACtC,KAAI,CAACA,KAAM,QAAOqF,KAAAA;CAElB,MAAMnD,aAAgC,EAAElC,MAAM;CAE9C,MAAMC,QAAQkF,gBAAgBM,IAAIxF,MAAM;AACxC,KAAIA,MAAOiC,YAAWjC,QAAQA;CAE9B,MAAMC,SAASqF,wBAAwBE,IAAIvF,OAAO;AAClD,KAAIA,WAAWmF,KAAAA,EAAWnD,YAAWhC,SAASA;CAE9C,MAAMC,QAAQiF,gBAAgBK,IAAItF,MAAM;AACxC,KAAIA,MAAO+B,YAAW/B,QAAQA;CAE9B,MAAM0F,iBAAiBC,2BAA2BL,IAAIlF,SAAS;AAC/D,KAAIsF,mBAAmBR,KAAAA,EAAWnD,YAAW3B,WAAWsF;CAExD,MAAMzF,UAAUoF,yBAAyBC,IAAIrF,QAAQ;AACrD,KAAIA,QAAS8B,YAAW9B,UAAUA;AAElC,QAAO8B;;AAGT,IAAM4D,8BAA8B7D,UAAkD;AACpF,KAAI,OAAOA,UAAU,SAEnB,QADmBA,MAAMH,MAAM,IACVuD,KAAAA;AAGvB,KAAI5E,MAAM2B,QAAQH,MAAM,EAAE;EACxB,MAAMC,aAAaD,MAChBI,KAAK0D,UAAU;AACd,OAAI,OAAOA,UAAU,SAEnB,QADaA,MAAMjE,MAAM,IACV;AAEjB,UAAO8D,wBAAwBG,MAAM,IAAI;IACzC,CACDvD,QAAQuD,UAA+CA,UAAU,KAAK;AAEzE,SAAO7D,WAAWwB,SAAS,IAAIxB,aAAamD,KAAAA;;AAG9C,QAAOO,wBAAwB3D,MAAM;;AAGvC,IAAM+D,sBAAsB/D,UAAkC;AAC5D,KAAI,OAAOA,UAAU,SAAU,QAAO;AAEtC,QADmBA,MAAMH,MAAM,IACV;;AAGvB,IAAMmE,+BACJhG,OACAD,MACAkG,sBACkB;AAClB,KAAIA,kBAAmB,QAAOA;CAE9B,MAAMC,SAASlG,MAAMkG;CACrB,MAAMC,aAAa,OAAOD,OAAOnG,SAAS,aAAamG,OAAOnG,KAAKA,KAAK,GAAG;CAC3E,MAAMqG,YAAYL,mBAAmBI,YAAYhG,SAASkG,IAAI;AAC9D,KAAID,UAAW,QAAOA;CAEtB,MAAME,WAAWP,mBAAmBI,YAAYI,QAAQpG,SAASkG,IAAI;AACrE,KAAIC,SAAU,QAAOA;CAGrB,MAAMI,aAAaX,oBADC,OAAOG,OAAOO,gBAAgB,aAAaP,OAAOO,YAAY1G,KAAK,GAAG,OACvCI,SAASkG,IAAI;AAChE,KAAIK,WAAY,QAAOA;AAEvB,QAAO;;AAGT,IAAMC,6BACJC,eACAC,aACe;AACf,KAAI,CAACD,iBAAiBE,OAAOC,KAAKH,cAAc,CAACnD,WAAW,EAAG,QAAOoD;AACtE,QAAO,EAAEG,MAAM,CAACJ,eAAeC,SAAQ,EAAG;;AAoB5C,IAAMM,8BAA8B,OAAO,EACzC9E,UACArC,OACA6D,SACAvD,UACA8G,qBACAC,YACAC,2BASiD;AACjD,KAAI,CAAChH,SAAU,QAAO8E,KAAAA;CAEtB,MAAMoC,iBAAiB,OAAOC,oBAAiD;EAC7E,MAAMC,SAASL,WAAW1C,IAAI8C,gBAAgB;AAC9C,MAAIC,OAAQ,QAAOA;EACnB,MAAMC,SAAS,MAAMnD,eAAenC,UAAUoF,iBAAiB5D,QAAQ;AACvEwD,aAAWO,IAAIH,iBAAiBE,OAAO;AACvC,SAAOA;;CAGT,MAAME,aAAa,OACjB/B,OACAgC,gBACoD;AACpD,MAAI,OAAOhC,UAAU,UAAU;GAC7B,MAAM/F,OAAO+F,MAAMjE,MAAM;AACzB,OAAI,CAAC9B,KAAM,QAAO;GAElB,MAAMgI,eAAe/B,4BAA4B8B,aAAa/H,MAAM,KAAK;AACzE,OAAI,CAACgI,aAAc,QAAOhI;AAC1B,OAAI,CAACqH,uBAAuB/F,qBAAqB2G,IAAID,aAAa,CAChE,OAAM,IAAIjG,MAAM,oBAAoB;AAEtC,OAAI,CAAC+B,QAAQoE,IAAI,QAAQF,aAA+B,CACtD,OAAM,IAAIjG,MAAM,YAAY;AAG9BwF,wBAAqBY,IAAIH,aAAa;AAOtC,UAAO;IACLhI;IACAG,OAPenB,qBACf8E,SACA,QACAkE,aACD;IAIA;;EAGH,MAAMhI,OAAO+F,MAAM/F,KAAK8B,MAAM;AAC9B,MAAI,CAAC9B,KAAM,QAAO;EAElB,MAAMkG,oBAAoBF,mBAAmBD,MAAM9F,MAAM;EACzD,MAAM+H,eAAe/B,4BAA4B8B,aAAa/H,MAAMkG,kBAAkB;EACtF,IAAImC,cAAcN;EAElB,MAAMO,kBAA0C,EAC9CtI,MACD;AAED,MAAI+F,MAAM7F,WAAWmF,KAAAA,EAAWiD,iBAAgBpI,SAAS6F,MAAM7F;AAC/D,MAAI6F,MAAM3F,YAAYiF,KAAAA,EAAWiD,iBAAgBlI,UAAU2F,MAAM3F;AACjE,MAAI8F,kBAAmBoC,iBAAgBrI,QAAQiG;AAC/C,MAAIH,MAAM5F,UAAUkF,KAAAA,EAAWiD,iBAAgBnI,QAAQ4F,MAAM5F;AAE7D,MAAI6H,cAAc;AAChB,OAAI,CAACX,uBAAuB/F,qBAAqB2G,IAAID,aAAa,CAChE,OAAM,IAAIjG,MAAM,oBAAoB;AAEtC,OAAI,CAAC+B,QAAQoE,IAAI,QAAQF,aAA+B,CACtD,OAAM,IAAIjG,MAAM,YAAY;AAG9BwF,wBAAqBY,IAAIH,aAAa;AACtCK,iBAAc,MAAMZ,eAAeO,aAAa;GAEhD,MAAMlB,WAAW9H,qBACf8E,SACA,QACAkE,aACD;AACDM,mBAAgBnI,QAAQyG,0BACtB0B,gBAAgBnI,OAChB2G,SACD;aACQf,MAAMxF,aAAa8E,KAAAA,EAC5B,OAAM,IAAItD,MAAM,oEAAoE;EAGtF,MAAM8D,iBAAiB,MAAMuB,4BAA4B;GACvD9E;GACArC,OAAOoI;GACPvE;GACAvD,UAAUwF,MAAMxF;GAChB8G;GACAC;GACAC;GACD,CAAC;AACF,MAAI1B,mBAAmBR,KAAAA,EAAWiD,iBAAgB/H,WAAWsF;AAE7D,SAAOyC;;AAGT,KAAI7H,MAAM2B,QAAQ7B,SAAS,EAAE;EAE3B,MAAMkI,YADW,MAAM5E,QAAQ2E,IAAIjI,SAAS8B,KAAK0D,UAAU+B,WAAW/B,OAAO9F,MAAM,CAAC,CAAC,EAC3DuC,QAAQuD,UAAoDA,UAAU,KAAK;AACrG,SAAO0C,SAAS/E,SAAS,IAAI+E,WAAWpD,KAAAA;;AAI1C,QADiB,MAAMyC,WAAWvH,UAAUN,MAAM,IAC/BoF,KAAAA;;AAGrB,IAAaqD,4BAA4BtI,YAA0D;AACjG,KAAI,CAACA,WAAW,OAAOA,YAAY,SAAU,QAAO,EAAE;CACtD,MAAM8B,aAA8B,EAAE;AAEtC,KAAI9B,QAAQO,cAAc,OAAOP,QAAQO,eAAe,YAAY,CAACF,MAAM2B,QAAQhC,QAAQO,WAAW,CACpGuB,YAAWvB,aAAaP,QAAQO;AAGlC,KAAIP,QAAQC,QAAQ,OAAOD,QAAQC,SAAS,YAAY,CAACI,MAAM2B,QAAQhC,QAAQC,KAAK,CAClF6B,YAAW7B,OAAOD,QAAQC;AAG5B6B,YAAW5B,QAAQuE,eAAezE,QAAQE,MAAM;AAChD4B,YAAW3B,WAAWuF,2BAA2B1F,QAAQG,SAAS;AAClE2B,YAAWtB,aAAa0E,oBAAoBlF,QAAQQ,WAAW;AAE/D,QAAOsB;;AAGT,IAAayG,sCAAsC,OAAO,EACxDrG,UACAwB,SACAY,WACAtE,SACAiH,sBAAsB,YAOC;CACvB,MAAMpH,QAAQ,MAAMwE,eAAenC,UAAUoC,WAAWZ,QAAQ;CAChE,MAAMwD,6BAAa,IAAIE,KAAyB;AAChDF,YAAWO,IAAInD,WAAWzE,MAAM;CAEhC,MAAMsH,uCAAuB,IAAIhG,KAAa;AAC9C,OAAM6F,4BAA4B;EAChC9E;EACArC;EACA6D;EACAvD,UAAUH,QAAQG;EAClB8G;EACAC;EACAC;EACD,CAAC;AAEF,QAAO9G,MAAMmI,KAAKrB,qBAAqB;;AAGzC,IAAasB,cAAc,OAAO,EAChCvG,UACAwB,SACAY,WACA7B,OACAzC,SACAiH,sBAAsB,YAQO;CAC7B,MAAM,EAAEpH,OAAOiB,eAAe,MAAM4H,oBAAoB;EACtDxG;EACAwB;EACAY;EACA7B;EACAwE;EACD,CAAC;CACF,MAAM1G,aAAaP,QAAQO,cAAc0E,KAAAA;CACzC,MAAMhF,OAAOD,QAAQC;CACrB,MAAMC,QAAQuE,eAAezE,QAAQE,MAAM;CAC3C,MAAMgH,6BAAa,IAAIE,KAAyB;AAChDF,YAAWO,IAAInD,WAAWzE,MAAM;CAEhC,MAAMM,WAAW,MAAM6G,4BAA4B;EACjD9E;EACArC;EACA6D;EACAvD,UAAUH,QAAQG;EAClB8G;EACAC;EACAC,sCAAsB,IAAIhG,KAAY;EACvC,CAAC;AAEF,KAAInB,QAAQQ,YAAY;EACtB,MAAMmI,iBAAiB9I,MAAM+I,KAAK9H,YAAYP,WAAW;AACzD,MAAIJ,aAAa8E,KAAAA,EACf0D,gBAAexI,SAASA,SAAgB;EAG1C,MAAM0I,kBAAkB,MAAMF,eAAeG,SAAS9I,QAAQQ,YAAY,EACxEuI,QAAQ,EACNC,eAAe3H,kCAAiC,EAClD,EACD,CAAC;EACF,MAAMT,aAAa,OAAOiI,gBAAgBjI,eAAe,YACpD8D,OAAOC,SAASkE,gBAAgBjI,WAAW,IAC3CiI,gBAAgBjI,cAAc,IAC/BgE,KAAKW,MAAMsD,gBAAgBjI,WAAW,GACtCqE,KAAAA;AAEJ,SAAO;GACLvE,MAAML,MAAM2B,QAAQ6G,gBAAgBI,MAAM,GAAGJ,gBAAgBI,QAAQ,EAAE;GACvEtI,UAAUkI,gBAAgBlI;GAC1B,GAAIC,eAAeqE,KAAAA,IAAY,EAAErE,YAAY,GAAG,EAAE;GACnD;;CAGH,MAAMsI,eAAerJ,MAAM+I,KAAK9H,YAAYP,WAAW;AACvD,KAAIJ,aAAa8E,KAAAA,EACfiE,cAAa/I,SAASA,SAAgB;AAExC,KAAIF,QAAQ0G,OAAOC,KAAK3G,KAAK,CAACqD,OAC5B4F,cAAajJ,KAAKA,KAAK;AAEzBiJ,cAAahJ,MAAMA,MAAM;CAEzB,MAAMQ,OAAO,MAAMwI;AACnB,QAAO,EAAExI,MAAML,MAAM2B,QAAQtB,KAAK,GAAGA,OAAO,EAAA,EAAI;;AAGlD,IAAMgI,sBAAsB,OAAO,EACjCxG,UACAwB,SACAY,WACA7B,OACAwE,sBAAsB,YAOa;AACnC,KAAI,CAACA,uBAAuB/F,qBAAqB2G,IAAIvD,UAAU,CAC7D,OAAM,IAAI3C,MAAM,oBAAoB;AAGtC,KAAI,CAAC+B,QAAQoE,IAAI,QAAQxD,UAA4B,CACnD,OAAM,IAAI3C,MAAM,YAAY;AAO9B,QAAO;EAAE9B,OAJK,MAAMwE,eAAenC,UAAUoC,WAAWZ,QAAQ;EAIhD5C,YAFe,EAAE+F,MAAM,CAACpE,OADpB7D,qBAAqB8E,SAAS,QAAQY,UAA4C,CAC5C,EAAG;EAEjC;;AAG9B,IAAa8E,cAAc,OAAO,EAChClH,UACAwB,SACAY,WACA7B,OACAwE,sBAAsB,YAOD;CACrB,MAAM,EAAEpH,OAAOiB,eAAe,MAAM4H,oBAAoB;EACtDxG;EACAwB;EACAY;EACA7B;EACAwE;EACD,CAAC;CAEF,MAAMoC,QAAQ,MAAMxJ,MAAMyJ,eAAexI,WAAW;AACpD,KAAI,OAAOuI,UAAU,YAAY,CAAC3E,OAAOC,SAAS0E,MAAM,IAAIA,QAAQ,EAClE,QAAO;AAGT,QAAOzE,KAAKW,MAAM8D,MAAM"}

package/dist/rts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rts/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG7C,OAAO,EAA6F,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAG5I,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,IAAI,CAAA;AAwClE,KAAK,UAAU,GAAG;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,UAAU,CAAA;CACpB,CAAA;AA0BD,KAAK,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;AA6B3D,cAAM,SAAS;IACb,SAAgB,EAAE,EAAE,MAAM,CAAA;IAC1B,SAAgB,QAAQ,EAAE,MAAM,CAAA;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqD;gBAE3D,EACjB,EAAE,EACF,EAAE,EACF,IAAI,GACL,EAAE;QACD,EAAE,EAAE,MAAM,CAAA;QACV,EAAE,EAAE,SAAS,CAAA;QACb,IAAI,EAAE,UAAU,CAAA;KACjB;IAOM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAOlE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAO7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAI5C,KAAK,IAAI,IAAI;IAQb,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;CAOvD;AA4lBD,eAAO,MAAM,OAAO,GAAI,4NAQrB;IACD,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,KAAG,IAyHH,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,KAAG,IAEvD,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,IAE3E,CAAA;AAED,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rts/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG7C,OAAO,EAA6F,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAG5I,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,IAAI,CAAA;AA+DlE,KAAK,UAAU,GAAG;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,UAAU,CAAA;CACpB,CAAA;AA+BD,KAAK,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;AA+B3D,cAAM,SAAS;IACb,SAAgB,EAAE,EAAE,MAAM,CAAA;IAC1B,SAAgB,QAAQ,EAAE,MAAM,CAAA;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqD;gBAE3D,EACjB,EAAE,EACF,EAAE,EACF,IAAI,GACL,EAAE;QACD,EAAE,EAAE,MAAM,CAAA;QACV,EAAE,EAAE,SAAS,CAAA;QACb,IAAI,EAAE,UAAU,CAAA;KACjB;IAOM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAOlE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAO7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAI5C,KAAK,IAAI,IAAI;IAQb,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;CAOvD;AAq4BD,eAAO,MAAM,OAAO,GAAI,4NAQrB;IACD,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,KAAG,IA4HH,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,KAAG,IAEvD,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,IAE3E,CAAA;AAED,cAAc,UAAU,CAAA"}

package/dist/rts/index.js

@@ -1,4 +1,4 @@
-import { a as normalizeRtsQueryOptions, c as runRtsQuery, n as RTS_USER_ID_HEADER, o as resolveRtsQueryDependencyModelNames, t as RTS_TENANT_ID_QUERY_PARAM } from "../queryExecutor-DYVlCvns.js";
+import { a as normalizeRtsQueryOptions, c as runRtsCount, l as runRtsQuery, n as RTS_USER_ID_HEADER, o as resolveRtsQueryDependencyModelNames, t as RTS_TENANT_ID_QUERY_PARAM } from "../queryExecutor-JadZcQSQ.js";
 import { models } from "@rpcbase/db";
 import { buildAbility, buildAbilityFromSession, getTenantRolesFromSessionUser } from "@rpcbase/db/acl";
 import { randomUUID } from "node:crypto";
@@ -22,7 +22,9 @@ var socketMeta = /* @__PURE__ */ new Map();
 var socketWrappers = /* @__PURE__ */ new Map();
 var socketCleanup = /* @__PURE__ */ new Map();
 var socketSubscriptions = /* @__PURE__ */ new Map();
+var socketCountSubscriptions = /* @__PURE__ */ new Map();
 var subscriptions = /* @__PURE__ */ new Map();
+var countSubscriptions = /* @__PURE__ */ new Map();
 var changeStreams = /* @__PURE__ */ new Map();
 var dispatchTimers = /* @__PURE__ */ new Map();
 var upgradeMeta = /* @__PURE__ */ new WeakMap();
@@ -206,7 +208,7 @@ var scheduleDispatchSubscriptionsForModel = (tenantId, modelName) => {
 	const delay = Math.max(0, Math.min(1e3, Math.floor(dispatchDebounceMs)));
 	dispatchTimers.set(key, setTimeout(() => {
 		dispatchTimers.delete(key);
-		dispatchSubscriptionsForModel(tenantId, modelName);
+		Promise.all([dispatchSubscriptionsForModel(tenantId, modelName), dispatchCountSubscriptionsForModel(tenantId, modelName)]).catch(() => {});
 	}, delay));
 };
 var runAndSendQuery = async ({ tenantId, targetSocketIds, ability, modelName, queryKey, query, options }) => {
@@ -232,6 +234,25 @@ var runAndSendQuery = async ({ tenantId, targetSocketIds, ability, modelName, qu
 		sendWs(ws, payload);
 	}
 };
+var runAndSendCount = async ({ tenantId, targetSocketIds, ability, modelName, queryKey, query }) => {
+	const payload = {
+		type: "count-payload",
+		modelName,
+		queryKey,
+		count: await runRtsCount({
+			tenantId,
+			ability,
+			modelName,
+			query,
+			allowInternalModels
+		})
+	};
+	for (const socketId of targetSocketIds) {
+		const ws = sockets.get(socketId);
+		if (!ws) continue;
+		sendWs(ws, payload);
+	}
+};
 var subscriptionDependsOnModel = (changedModelName, ownerModelName, subscription) => {
 	if (ownerModelName === changedModelName) return true;
 	return subscription.dependencyModelNames.includes(changedModelName);
@@ -242,6 +263,12 @@ var hasAnySubscriptionsDependingOnModel = (tenantId, modelName) => {
 	for (const userSubs of tenantSubs.values()) for (const [ownerModelName, modelSubs] of userSubs.entries()) for (const subscription of modelSubs.values()) if (subscriptionDependsOnModel(modelName, ownerModelName, subscription)) return true;
 	return false;
 };
+var hasAnyCountSubscriptionsForModel = (tenantId, modelName) => {
+	const tenantSubs = countSubscriptions.get(tenantId);
+	if (!tenantSubs) return false;
+	for (const userSubs of tenantSubs.values()) if (userSubs.get(modelName)?.size) return true;
+	return false;
+};
 var dispatchSubscriptionsForModel = async (tenantId, modelName) => {
 	const tenantSubs = subscriptions.get(tenantId);
 	if (!tenantSubs || !tenantSubs.size) return;
@@ -277,6 +304,43 @@ var dispatchSubscriptionsForModel = async (tenantId, modelName) => {
 		}
 	}
 };
+var dispatchCountSubscriptionsForModel = async (tenantId, modelName) => {
+	const tenantSubs = countSubscriptions.get(tenantId);
+	if (!tenantSubs || !tenantSubs.size) return;
+	for (const userSubs of tenantSubs.values()) {
+		const modelSubs = userSubs.get(modelName);
+		if (!modelSubs) continue;
+		for (const [queryKey, sub] of modelSubs.entries()) {
+			const targetSocketIds = Array.from(sub.socketIds);
+			if (!targetSocketIds.length) continue;
+			const socketId = targetSocketIds[0];
+			const ability = socketMeta.get(socketId)?.ability;
+			if (!ability) continue;
+			try {
+				await runAndSendCount({
+					tenantId,
+					targetSocketIds,
+					ability,
+					modelName,
+					queryKey,
+					query: sub.query
+				});
+			} catch (err) {
+				const payload = {
+					type: "count-payload",
+					modelName,
+					queryKey,
+					error: redactErrorMessage(err)
+				};
+				for (const targetSocketId of targetSocketIds) {
+					const ws = sockets.get(targetSocketId);
+					if (!ws) continue;
+					sendWs(ws, payload);
+				}
+			}
+		}
+	}
+};
 var ensureChangeStream = async (tenantId, modelName) => {
 	const tenantStreams = changeStreams.get(tenantId) ?? /* @__PURE__ */ new Map();
 	changeStreams.set(tenantId, tenantStreams);
@@ -322,6 +386,25 @@ var addSocketSubscription = ({ socketId, tenantId, userId, modelName, queryKey,
 	byModel.set(modelName, querySet);
 	querySet.add(queryKey);
 };
+var addSocketCountSubscription = ({ socketId, tenantId, userId, modelName, queryKey, query }) => {
+	const tenantSubs = countSubscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
+	countSubscriptions.set(tenantId, tenantSubs);
+	const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
+	tenantSubs.set(userId, userSubs);
+	const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
+	userSubs.set(modelName, modelSubs);
+	const existing = modelSubs.get(queryKey);
+	if (existing) existing.socketIds.add(socketId);
+	else modelSubs.set(queryKey, {
+		query,
+		socketIds: new Set([socketId])
+	});
+	const byModel = socketCountSubscriptions.get(socketId) ?? /* @__PURE__ */ new Map();
+	socketCountSubscriptions.set(socketId, byModel);
+	const querySet = byModel.get(modelName) ?? /* @__PURE__ */ new Set();
+	byModel.set(modelName, querySet);
+	querySet.add(queryKey);
+};
 var removeSocketSubscription = ({ socketId, tenantId, userId, modelName, queryKey }) => {
 	const tenantSubs = subscriptions.get(tenantId);
 	const userSubs = tenantSubs?.get(userId);
@@ -341,7 +424,7 @@ var removeSocketSubscription = ({ socketId, tenantId, userId, modelName, queryKe
 	if (modelSubs && modelSubs.size === 0) userSubs?.delete(modelName);
 	if (userSubs && userSubs.size === 0) tenantSubs?.delete(userId);
 	for (const affectedModelName of affectedModelNames) {
-		if (hasAnySubscriptionsDependingOnModel(tenantId, affectedModelName)) continue;
+		if (hasAnySubscriptionsDependingOnModel(tenantId, affectedModelName) || hasAnyCountSubscriptionsForModel(tenantId, affectedModelName)) continue;
 		const tenantStreams = changeStreams.get(tenantId);
 		const stream = tenantStreams?.get(affectedModelName);
 		if (stream) {
@@ -356,6 +439,46 @@ var removeSocketSubscription = ({ socketId, tenantId, userId, modelName, queryKe
 	if (tenantSubs && tenantSubs.size === 0) subscriptions.delete(tenantId);
 	if (byModel && byModel.size === 0) socketSubscriptions.delete(socketId);
 };
+var removeSocketCountSubscription = ({ socketId, tenantId, userId, modelName, queryKey }) => {
+	const tenantSubs = countSubscriptions.get(tenantId);
+	const userSubs = tenantSubs?.get(userId);
+	const modelSubs = userSubs?.get(modelName);
+	const sub = modelSubs?.get(queryKey);
+	if (sub) {
+		sub.socketIds.delete(socketId);
+		if (!sub.socketIds.size) modelSubs?.delete(queryKey);
+	}
+	const byModel = socketCountSubscriptions.get(socketId);
+	const set = byModel?.get(modelName);
+	if (set) {
+		set.delete(queryKey);
+		if (!set.size) byModel?.delete(modelName);
+	}
+	if (modelSubs && modelSubs.size === 0) userSubs?.delete(modelName);
+	if (userSubs && userSubs.size === 0) tenantSubs?.delete(userId);
+	if (!hasAnySubscriptionsDependingOnModel(tenantId, modelName) && !hasAnyCountSubscriptionsForModel(tenantId, modelName)) {
+		const tenantStreams = changeStreams.get(tenantId);
+		const stream = tenantStreams?.get(modelName);
+		if (stream) {
+			try {
+				stream.close();
+			} catch {}
+			clearDispatchTimer(tenantId, modelName);
+			tenantStreams?.delete(modelName);
+			if (tenantStreams && tenantStreams.size === 0) changeStreams.delete(tenantId);
+		}
+	}
+	if (tenantSubs && tenantSubs.size === 0) countSubscriptions.delete(tenantId);
+	if (byModel && byModel.size === 0) socketCountSubscriptions.delete(socketId);
+};
+var getSocketSubscriptionCount = (socketId) => {
+	let count = 0;
+	const querySubscriptionsByModel = socketSubscriptions.get(socketId);
+	if (querySubscriptionsByModel) for (const set of querySubscriptionsByModel.values()) count += set.size;
+	const countSubscriptionsByModel = socketCountSubscriptions.get(socketId);
+	if (countSubscriptionsByModel) for (const set of countSubscriptionsByModel.values()) count += set.size;
+	return count;
+};
 var cleanupSocket = (socketId) => {
 	const meta = socketMeta.get(socketId);
 	if (meta) {
@@ -367,8 +490,17 @@ var cleanupSocket = (socketId) => {
 			modelName,
 			queryKey
 		});
+		const countByModel = socketCountSubscriptions.get(socketId);
+		if (countByModel) for (const [modelName, keys] of countByModel.entries()) for (const queryKey of keys.values()) removeSocketCountSubscription({
+			socketId,
+			tenantId: meta.tenantId,
+			userId: meta.userId,
+			modelName,
+			queryKey
+		});
 	}
 	socketSubscriptions.delete(socketId);
+	socketCountSubscriptions.delete(socketId);
 	const cleanupFns = socketCleanup.get(socketId) ?? [];
 	socketCleanup.delete(socketId);
 	for (const fn of cleanupFns) try {
@@ -385,14 +517,27 @@ var handleClientMessage = async ({ socketId, meta, message }) => {
 		socketWrappers.get(socketId)?.dispatch(message.event, message.payload);
 		return;
 	}
-	if (!message.modelName || typeof message.modelName !== "string") return;
-	if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(message.modelName)) {
+	const isCountMessage = message.type === "run-count" || message.type === "register-count" || message.type === "remove-count";
+	const sendAccessError = (error) => {
+		if (isCountMessage) {
+			sendWs(ws, {
+				type: "count-payload",
+				modelName: message.modelName ?? "",
+				queryKey: message.queryKey ?? "",
+				error
+			});
+			return;
+		}
 		sendWs(ws, {
 			type: "query-payload",
-			modelName: message.modelName,
+			modelName: message.modelName ?? "",
 			queryKey: message.queryKey ?? "",
-			error: "Model not allowed"
+			error
 		});
+	};
+	if (!message.modelName || typeof message.modelName !== "string") return;
+	if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(message.modelName)) {
+		sendAccessError("Model not allowed");
 		return;
 	}
 	if (!message.queryKey || typeof message.queryKey !== "string") return;
@@ -407,24 +552,26 @@ var handleClientMessage = async ({ socketId, meta, message }) => {
 		});
 		return;
 	}
+	if (message.type === "remove-count") {
+		removeSocketCountSubscription({
+			socketId,
+			tenantId: meta.tenantId,
+			userId: meta.userId,
+			modelName: message.modelName,
+			queryKey: message.queryKey
+		});
+		return;
+	}
 	if (!message.query || typeof message.query !== "object") return;
-	const options = normalizeRtsQueryOptions(message.options);
 	const ability = meta.ability;
 	if (!ability.can("read", message.modelName)) {
-		sendWs(ws, {
-			type: "query-payload",
-			modelName: message.modelName,
-			queryKey: message.queryKey,
-			error: "forbidden"
-		});
+		sendAccessError("forbidden");
 		return;
 	}
-	if (message.type === "register-query") {
-		if (!(socketSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false)) {
-			let count = 0;
-			const byModel = socketSubscriptions.get(socketId);
-			if (byModel) for (const set of byModel.values()) count += set.size;
-			if (count >= maxSubscriptionsPerSocket) {
+	if (message.type === "register-query" || message.type === "run-query") {
+		const options = normalizeRtsQueryOptions(message.options);
+		if (message.type === "register-query") {
+			if (!(socketSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false) && getSocketSubscriptionCount(socketId) >= maxSubscriptionsPerSocket) {
 				sendWs(ws, {
 					type: "query-payload",
 					modelName: message.modelName,
@@ -433,15 +580,59 @@ var handleClientMessage = async ({ socketId, meta, message }) => {
 				});
 				return;
 			}
+			let dependencyModelNames = [];
+			if (options.populate !== void 0) try {
+				dependencyModelNames = await resolveRtsQueryDependencyModelNames({
+					tenantId: meta.tenantId,
+					ability,
+					modelName: message.modelName,
+					options,
+					allowInternalModels
+				});
+			} catch (err) {
+				const error = redactErrorMessage(err);
+				sendWs(ws, {
+					type: "query-payload",
+					modelName: message.modelName,
+					queryKey: message.queryKey,
+					error
+				});
+				return;
+			}
+			addSocketSubscription({
+				socketId,
+				tenantId: meta.tenantId,
+				userId: meta.userId,
+				modelName: message.modelName,
+				queryKey: message.queryKey,
+				query: message.query,
+				options,
+				dependencyModelNames
+			});
+			try {
+				const modelNamesToWatch = new Set([message.modelName, ...dependencyModelNames]);
+				for (const modelName of modelNamesToWatch) await ensureChangeStream(meta.tenantId, modelName);
+			} catch (err) {
+				const error = redactErrorMessage(err);
+				sendWs(ws, {
+					type: "query-payload",
+					modelName: message.modelName,
+					queryKey: message.queryKey,
+					error
+				});
+				return;
+			}
+			if (message.runInitialQuery === false) return;
 		}
-		let dependencyModelNames = [];
-		if (options.populate !== void 0) try {
-			dependencyModelNames = await resolveRtsQueryDependencyModelNames({
+		try {
+			await runAndSendQuery({
 				tenantId: meta.tenantId,
+				targetSocketIds: [socketId],
 				ability,
 				modelName: message.modelName,
-				options,
-				allowInternalModels
+				queryKey: message.queryKey,
+				query: message.query,
+				options
 			});
 		} catch (err) {
 			const error = redactErrorMessage(err);
@@ -451,51 +642,60 @@ var handleClientMessage = async ({ socketId, meta, message }) => {
 				queryKey: message.queryKey,
 				error
 			});
-			return;
 		}
-		addSocketSubscription({
-			socketId,
-			tenantId: meta.tenantId,
-			userId: meta.userId,
-			modelName: message.modelName,
-			queryKey: message.queryKey,
-			query: message.query,
-			options,
-			dependencyModelNames
-		});
+		return;
+	}
+	if (message.type === "register-count" || message.type === "run-count") {
+		if (message.type === "register-count") {
+			if (!(socketCountSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false) && getSocketSubscriptionCount(socketId) >= maxSubscriptionsPerSocket) {
+				sendWs(ws, {
+					type: "count-payload",
+					modelName: message.modelName,
+					queryKey: message.queryKey,
+					error: "Too many subscriptions"
+				});
+				return;
+			}
+			addSocketCountSubscription({
+				socketId,
+				tenantId: meta.tenantId,
+				userId: meta.userId,
+				modelName: message.modelName,
+				queryKey: message.queryKey,
+				query: message.query
+			});
+			try {
+				await ensureChangeStream(meta.tenantId, message.modelName);
+			} catch (err) {
+				const error = redactErrorMessage(err);
+				sendWs(ws, {
+					type: "count-payload",
+					modelName: message.modelName,
+					queryKey: message.queryKey,
+					error
+				});
+				return;
+			}
+			if (message.runInitialQuery === false) return;
+		}
 		try {
-			const modelNamesToWatch = new Set([message.modelName, ...dependencyModelNames]);
-			for (const modelName of modelNamesToWatch) await ensureChangeStream(meta.tenantId, modelName);
+			await runAndSendCount({
+				tenantId: meta.tenantId,
+				targetSocketIds: [socketId],
+				ability,
+				modelName: message.modelName,
+				queryKey: message.queryKey,
+				query: message.query
+			});
 		} catch (err) {
 			const error = redactErrorMessage(err);
 			sendWs(ws, {
-				type: "query-payload",
+				type: "count-payload",
 				modelName: message.modelName,
 				queryKey: message.queryKey,
 				error
 			});
-			return;
 		}
-		if (message.runInitialQuery === false) return;
-	}
-	try {
-		await runAndSendQuery({
-			tenantId: meta.tenantId,
-			targetSocketIds: [socketId],
-			ability,
-			modelName: message.modelName,
-			queryKey: message.queryKey,
-			query: message.query,
-			options
-		});
-	} catch (err) {
-		const error = redactErrorMessage(err);
-		sendWs(ws, {
-			type: "query-payload",
-			modelName: message.modelName,
-			queryKey: message.queryKey,
-			error
-		});
 	}
 };
 var initRts = ({ server, path = "/rts", sessionMiddleware, maxPayloadBytes: maxPayloadBytesArg, maxSubscriptionsPerSocket: maxSubscriptionsPerSocketArg, dispatchDebounceMs: dispatchDebounceMsArg, allowInternalModels: allowInternalModelsArg }) => {
@@ -581,7 +781,7 @@ var initRts = ({ server, path = "/rts", sessionMiddleware, maxPayloadBytes: maxP
 			}
 			if (!parsed || typeof parsed !== "object") return;
 			const message = parsed;
-			if (message.type !== "event" && message.type !== "run-query" && message.type !== "register-query" && message.type !== "remove-query") return;
+			if (message.type !== "event" && message.type !== "run-query" && message.type !== "register-query" && message.type !== "remove-query" && message.type !== "run-count" && message.type !== "register-count" && message.type !== "remove-count") return;
 			handleClientMessage({
 				socketId,
 				meta,