@web-ts-toolkit/access-router 0.37.0 → 0.39.0

package/index.js

@@ -104,12 +104,42 @@ var findElementById = (collection, id) => {
   return findElement(collection, { _id: id });
 };
 
+// src/helpers/concurrency.ts
+var mapWithConcurrencyLimit = async (items, limit, iteratee) => {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const workerCount = Math.min(Math.max(limit, 1), items.length || 1);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (cursor < items.length) {
+        const current = cursor;
+        cursor += 1;
+        results[current] = await iteratee(items[current], current);
+      }
+    })
+  );
+  return results;
+};
+var RequestConcurrencyScheduler = class {
+  constructor(limit) {
+    this.limit = Math.max(1, limit);
+  }
+  async map(items, iteratee) {
+    return mapWithConcurrencyLimit(items, this.limit, (item, index) => iteratee(item, index, true));
+  }
+  async run(iteratee) {
+    const [result] = await this.map([void 0], () => iteratee(true));
+    return result;
+  }
+};
+
 // src/helpers/document.ts
 var import_mongoose = require("mongoose");
 var import_utils3 = require("@web-ts-toolkit/utils");
 
 // src/helpers/query.ts
 var import_utils2 = require("@web-ts-toolkit/utils");
+var DEFAULT_LIST_HARD_LIMIT = 1e3;
 var normalizeSafeInteger = (value, min) => {
   if ((0, import_utils2.isNil)(value)) return null;
   const parsed = Number(value);
@@ -122,9 +152,10 @@ function genPagination({
   page,
   pageSize
 }, hardLimit) {
+  const resolvedHardLimit = normalizeSafeInteger(hardLimit, 1) ?? DEFAULT_LIST_HARD_LIMIT;
   let _skip = 0;
-  let _limit = normalizeSafeInteger(limit ?? pageSize, 1) ?? hardLimit;
-  if (!Number.isSafeInteger(_limit) || _limit > hardLimit) _limit = hardLimit;
+  let _limit = normalizeSafeInteger(limit ?? pageSize, 1) ?? resolvedHardLimit;
+  if (!Number.isSafeInteger(_limit) || _limit > resolvedHardLimit) _limit = resolvedHardLimit;
   const normalizedSkip = normalizeSafeInteger(skip, 0);
   const normalizedPage = normalizeSafeInteger(page, 0);
   if (normalizedSkip !== null) {
@@ -141,14 +172,6 @@ function genPagination({
   }
   return { skip: _skip, limit: _limit };
 }
-function parseSortString(sortString) {
-  if (!sortString) return { sortKey: "", sortOrder: "asc" };
-  if (sortString.startsWith("-")) {
-    return { sortKey: sortString.substring(1), sortOrder: "desc" };
-  } else {
-    return { sortKey: sortString, sortOrder: "asc" };
-  }
-}
 function normalizeSelect(select) {
   if (Array.isArray(select)) return (0, import_utils2.flattenDeep)(select.map(normalizeSelect));
   if ((0, import_utils2.isPlainObject)(select)) {
@@ -278,6 +301,61 @@ function handleResultError(result) {
   }
 }
 
+// src/helpers/sort-policy.ts
+var validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
+var fieldPathPattern = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)*$/;
+var sortDirection = (order) => order === -1 || order === "desc" || order === "descending" ? "desc" : "asc";
+var sortError = (detail) => ({ detail, pointer: "#/sort" });
+function isValidFieldPath(field) {
+  return typeof field === "string" && fieldPathPattern.test(field);
+}
+function isFieldAllowed(field, allowedFields) {
+  return new Set(allowedFields.concat(["id", "_id"])).has(field);
+}
+function normalizeSort(sort) {
+  if (sort === null || sort === void 0 || sort === "") return { fields: [], errors: [] };
+  if (typeof sort === "string") {
+    const fields2 = sort.trim().split(/\s+/).filter(Boolean).map((raw) => {
+      const desc = raw.startsWith("-");
+      return { raw, field: desc ? raw.slice(1) : raw, direction: desc ? "desc" : "asc" };
+    });
+    const errors2 = fields2.filter(({ field }) => !isValidFieldPath(field)).map(({ raw }) => sortError(`Invalid sort field: ${raw}`));
+    return { fields: errors2.length > 0 ? [] : fields2.map(({ field, direction }) => ({ field, direction })), errors: errors2 };
+  }
+  const entries = sort instanceof Map ? Array.from(sort.entries()) : Array.isArray(sort) ? sort : Object.entries(sort);
+  const errors = [];
+  const fields = [];
+  for (const entry of entries) {
+    if (!Array.isArray(entry) || entry.length !== 2) {
+      errors.push(sortError("Invalid sort entry: expected [field, order]"));
+      continue;
+    }
+    const [field, order] = entry;
+    if (!isValidFieldPath(field)) {
+      errors.push(sortError(`Invalid sort field: ${String(field)}`));
+      continue;
+    }
+    if (!validSortOrders.includes(order)) {
+      errors.push(sortError(`Invalid sort order for field: ${field}`));
+      continue;
+    }
+    fields.push({ field, direction: sortDirection(order) });
+  }
+  return { fields: errors.length > 0 ? [] : fields, errors };
+}
+function validateSortFields(sort, allowedFields) {
+  const { fields, errors } = normalizeSort(sort);
+  if (errors.length > 0) return errors;
+  return fields.filter(({ field }) => !isFieldAllowed(field, allowedFields)).map(({ field }) => sortError(`Sort field is not allowed: ${field}`));
+}
+function normalizeSortForOrderBy(sort) {
+  const normalized = normalizeSort(sort);
+  return {
+    fields: normalized.fields.map(({ field }) => field),
+    orders: normalized.fields.map(({ direction }) => direction)
+  };
+}
+
 // src/helpers/index.ts
 var import_utils6 = require("@web-ts-toolkit/utils");
 
@@ -339,26 +417,33 @@ function buildSubPaths(schema) {
   });
   return subPaths;
 }
-async function iterateQuery(query, handler) {
+async function iterateQuery(query, handler, scheduler, scheduled = false) {
   if (!(0, import_utils6.isPlainObject)(query)) return query;
   if (!handler) return query;
   const queryObject = query;
-  return (0, import_utils6.mapValuesAsync)(queryObject, async (val, key) => {
+  const entries = Object.entries(queryObject);
+  const mapEntry = async ([key, val]) => {
     if ((0, import_utils6.isPlainObject)(val)) {
       const plainValue = val;
       if (plainValue.$$sq) {
-        return handler(0 /* SubQuery */, plainValue.$$sq, key);
+        return scheduled || !scheduler ? handler(0 /* SubQuery */, plainValue.$$sq, key) : scheduler.run(() => Promise.resolve(handler(0 /* SubQuery */, plainValue.$$sq, key)));
       } else if (plainValue.$$date) {
         return handler(1 /* Date */, plainValue.$$date, key);
       } else {
-        return iterateQuery(val, handler);
+        return iterateQuery(val, handler, scheduler, scheduled);
       }
     }
     if ((0, import_utils6.isArray)(val)) {
-      return Promise.all(val.map((v) => iterateQuery(v, handler)));
+      const items = val;
+      if (scheduler && !scheduled) {
+        return scheduler.map(items, (v) => iterateQuery(v, handler, scheduler, true));
+      }
+      return Promise.all(items.map((v) => iterateQuery(v, handler, scheduler, scheduled)));
     }
     return val;
-  });
+  };
+  const values = scheduler && !scheduled ? await scheduler.map(entries, mapEntry) : await Promise.all(entries.map(mapEntry));
+  return Object.fromEntries(entries.map(([key], index) => [key, values[index]]));
 }
 var createValidator = (fn) => {
   const stringHandler = (key) => key.trim().split(" ").every((v) => fn(v));
@@ -724,6 +809,42 @@ var defaultLogger = (0, import_winston.createLogger)({
 
 // src/options/manager.ts
 var import_utils9 = require("@web-ts-toolkit/utils");
+var toPath = (key) => {
+  if (Array.isArray(key)) return key;
+  return typeof key === "string" ? key.split(".") : [key];
+};
+var cloneConfigValue = (value) => {
+  if (Array.isArray(value)) {
+    return value.map((item) => cloneConfigValue(item));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Object.getPrototypeOf(value) !== Object.prototype) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([entryKey, entryValue]) => [
+      entryKey,
+      cloneConfigValue(entryValue)
+    ])
+  );
+};
+var freezeConfigValue = (value) => {
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Object.isFrozen(value)) {
+    return value;
+  }
+  if (Array.isArray(value) || Object.getPrototypeOf(value) === Object.prototype) {
+    for (const nestedValue of Object.values(value)) {
+      freezeConfigValue(nestedValue);
+    }
+    return Object.freeze(value);
+  }
+  return value;
+};
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -741,8 +862,9 @@ var getNestedOption = (manager, key, defaultValue) => {
   return option;
 };
 var OptionsManager = class {
-  constructor(defaultOptions) {
+  constructor(defaultOptions, options = {}) {
     this.defaultOptions = defaultOptions;
+    this.preserveKeys = new Set(options.preserveKeys ?? []);
     this.listeners = {};
     const _this = this;
     this.currentOptions = new Proxy({}, {
@@ -763,13 +885,34 @@ var OptionsManager = class {
     return (0, import_utils9.get)(this.currentOptions, key, defaultValue);
   }
   set(key, value) {
-    (0, import_utils9.set)(this.currentOptions, key, value);
+    const path = toPath(key);
+    if (path.length <= 1) {
+      (0, import_utils9.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneConfigValue(value));
+      return;
+    }
+    const [rootKey, ...nestedPath] = path;
+    const currentRoot = (0, import_utils9.get)(this.currentOptions, [rootKey], void 0);
+    const nextRoot = cloneConfigValue(currentRoot ?? {});
+    (0, import_utils9.set)(nextRoot, nestedPath, cloneConfigValue(value));
+    (0, import_utils9.set)(this.currentOptions, [rootKey], nextRoot);
   }
   fetch() {
-    return { ...this.currentOptions };
+    const cloned = cloneConfigValue(this.currentOptions);
+    for (const key of this.preserveKeys) {
+      if (key in this.currentOptions) {
+        cloned[key] = this.currentOptions[key];
+      }
+    }
+    return freezeConfigValue(cloned);
   }
   assign(options) {
-    (0, import_utils9.assign)(this.currentOptions, options);
+    const cloned = cloneConfigValue(options);
+    for (const key of this.preserveKeys) {
+      if (key in options) {
+        cloned[key] = options[key];
+      }
+    }
+    (0, import_utils9.assign)(this.currentOptions, cloned);
   }
   onchange(key, func) {
     (0, import_utils9.set)(this.listeners, key, func);
@@ -787,7 +930,8 @@ var defaultRequestComplexity = {
   maxBulkItems: 100,
   maxIncludeCount: 10,
   maxSubQueryCount: 10,
-  maxBulkConcurrency: 10
+  maxBulkConcurrency: 10,
+  maxHookConcurrency: 10
 };
 var normalizePositiveInteger = (value, fallback) => {
   return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
@@ -803,6 +947,10 @@ var resolveRequestComplexity = (options) => ({
   maxBulkConcurrency: normalizePositiveInteger(
     options?.maxBulkConcurrency,
     defaultRequestComplexity.maxBulkConcurrency
+  ),
+  maxHookConcurrency: normalizePositiveInteger(
+    options?.maxHookConcurrency,
+    defaultRequestComplexity.maxHookConcurrency
   )
 });
 function validateRequestComplexity(value, options, scope = "request") {
@@ -896,7 +1044,8 @@ var defaultModelOptions = {
 var defaultDataOptions = {
   basePath: null,
   parentPath: "/",
-  queryRouteSegment: "__query"
+  queryRouteSegment: "__query",
+  listHardLimit: DEFAULT_LIST_HARD_LIMIT
 };
 var normalizeBasePath = (name, value) => {
   if ((0, import_utils11.isNil)(value)) {
@@ -953,17 +1102,30 @@ var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
     modelPermissionKeys
   };
 };
+var refreshPermissionMetadata = (target) => {
+  const permissionSchema = target.permissionSchema ?? {};
+  const { schemaKeys, globalPermissionKeys, modelPermissionKeys } = classifyPermissionSchema(
+    permissionSchema,
+    target.modelPermissionPrefix ?? ""
+  );
+  target._permissionSchemaKeys = schemaKeys;
+  target._globalPermissionKeys = globalPermissionKeys;
+  target._modelPermissionKeys = modelPermissionKeys;
+};
 var AccessRuntime = class {
-  constructor() {
-    this.globalOptions = new OptionsManager({
-      requestPermissionField: "_permissions",
-      globalPermissions: () => ({}),
-      requireRegisteredPopulateModels: true,
-      logger: defaultLogger,
-      requestComplexity: defaultRequestComplexity
-    }).build();
+  constructor(options = {}) {
+    this.globalOptions = new OptionsManager(
+      {
+        requestPermissionField: "_permissions",
+        globalPermissions: () => ({}),
+        requireRegisteredPopulateModels: true,
+        logger: defaultLogger,
+        requestComplexity: defaultRequestComplexity
+      },
+      { preserveKeys: ["logger"] }
+    ).build();
     this.defaultModelOptions = new OptionsManager({
-      listHardLimit: 1e3,
+      listHardLimit: DEFAULT_LIST_HARD_LIMIT,
       documentPermissionField: "_permissions",
       idParam: "id",
       idField: "_id",
@@ -981,6 +1143,7 @@ var AccessRuntime = class {
     this.modelAtts = {};
     this.modelInstances = {};
     this.openApiRegistry = new OpenApiRegistry();
+    this.allowGlobalModelLookup = options.allowGlobalModelLookup ?? false;
     ensureMongooseJsonSchemaInitialized();
   }
   registerModelInstance(modelName, model) {
@@ -996,13 +1159,16 @@ var AccessRuntime = class {
     this.modelInstances[modelName] = model;
   }
   hasModelInstance(modelName) {
-    return modelName in this.modelInstances;
+    return modelName in this.modelInstances || this.allowGlobalModelLookup && modelName in import_mongoose3.default.models;
   }
   getModelInstance(modelName) {
     const registered = this.modelInstances[modelName];
     if (registered) return registered;
+    if (!this.allowGlobalModelLookup) return null;
     const global = import_mongoose3.default.models[modelName];
-    return global ?? null;
+    if (!global) return null;
+    this.registerModelInstance(modelName, global);
+    return global;
   }
   registerOpenApiRoute(route) {
     this.openApiRegistry.register(route);
@@ -1051,20 +1217,20 @@ var AccessRuntime = class {
     return this.defaultModelOptions.get(key, defaultValue);
   }
   createModelOptions(modelName) {
-    const model = this.getModelInstance(modelName) ?? import_mongoose3.default.model(modelName);
+    const model = this.getModelInstance(modelName);
+    if (!model) {
+      throw new Error(
+        `Runtime model registry missing model "${modelName}". Pass a mongoose.Model instance to createRouter() or register it with registerModelInstance() before using this isolated runtime.`
+      );
+    }
     const manager = new OptionsManager({
       ...defaultModelOptions,
       modelName
     });
-    manager.onchange("permissionSchema", function(newval, key, target) {
-      const permissionSchema = newval ?? {};
-      const { schemaKeys, globalPermissionKeys, modelPermissionKeys } = classifyPermissionSchema(
-        permissionSchema,
-        target.modelPermissionPrefix ?? ""
-      );
-      target._permissionSchemaKeys = schemaKeys;
-      target._globalPermissionKeys = globalPermissionKeys;
-      target._modelPermissionKeys = modelPermissionKeys;
+    manager.onchange("permissionSchema", function(_newval, _key, target) {
+      refreshPermissionMetadata(target);
+    }).onchange("modelPermissionPrefix", function(_newval, _key, target) {
+      refreshPermissionMetadata(target);
     }).onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         modelName,
@@ -1193,7 +1359,7 @@ var AccessRuntime = class {
     return (0, import_utils11.get)(this.modelAtts, modelName, []);
   }
 };
-var defaultRuntime = new AccessRuntime();
+var defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
 
 // src/runtime-context.ts
 var import_node_async_hooks = require("async_hooks");
@@ -1345,8 +1511,8 @@ var Base = class {
   genIDFilter(id) {
     return this.req.macl.genIDFilter(this.modelName, id);
   }
-  genPopulate(access, populate) {
-    return this.req.macl.genPopulate(this.modelName, access, populate);
+  genPopulate(access, populate, subPaths) {
+    return this.req.macl.genPopulate(this.modelName, access, populate, subPaths);
   }
   genSelect(access, targetFields, skipChecks, subPaths) {
     return this.req.macl.genSelect(this.modelName, access, targetFields, skipChecks, subPaths);
@@ -1443,6 +1609,55 @@ var Base = class {
       includePaths
     };
   }
+  getForeignKeyValues(value) {
+    return (0, import_utils12.flatten)((0, import_utils12.castArray)(value));
+  }
+  getForeignKey(value) {
+    return String(value);
+  }
+  buildForeignKeyIndex(rows, foreignField) {
+    const index = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      for (const value of this.getForeignKeyValues((0, import_utils12.get)(row, foreignField))) {
+        const key = this.getForeignKey(value);
+        const values = index.get(key);
+        if (values) values.push(row);
+        else index.set(key, [row]);
+      }
+    }
+    return index;
+  }
+  getIndexedMatches(index, localValue) {
+    const seen = /* @__PURE__ */ new Set();
+    const matches = [];
+    for (const value of this.getForeignKeyValues(localValue)) {
+      for (const row of index.get(this.getForeignKey(value)) ?? []) {
+        if (seen.has(row)) continue;
+        seen.add(row);
+        matches.push(row);
+      }
+    }
+    return matches;
+  }
+  getIndexedCount(index, localValue) {
+    const ids = /* @__PURE__ */ new Set();
+    for (const value of this.getForeignKeyValues(localValue)) {
+      for (const id of index.get(this.getForeignKey(value)) ?? []) {
+        ids.add(id);
+      }
+    }
+    return ids.size;
+  }
+  sanitizeIncludeArgs(args) {
+    if (!(0, import_utils12.isPlainObject)(args)) return {};
+    const { overrides: _clientOverrides, ...trustedArgs } = args;
+    return trustedArgs;
+  }
+  assertIncludeForeignField(include) {
+    if (!isValidFieldPath(include.foreignField)) {
+      this.throwClientRequestError("bad_request" /* BadRequest */, `Invalid include foreignField: ${include.foreignField}`);
+    }
+  }
   async includeDocs(docs, include) {
     if (!include) return docs;
     const includes = (0, import_utils12.compact)((0, import_utils12.castArray)(include));
@@ -1451,25 +1666,52 @@ var Base = class {
     let docList = isSingle ? [docs] : docs;
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
-      if (include2.op === "count") {
-        docList = await this.includeDocsCount(docList, include2);
-      } else {
-        docList = await this.includeDocsList(docList, include2);
+      this.assertIncludeForeignField(include2);
+      switch (include2.op) {
+        case "count":
+          docList = await this.includeDocsCount(docList, include2);
+          break;
+        case "read":
+          docList = await this.includeDocsRead(docList, include2);
+          break;
+        case "list":
+          docList = await this.includeDocsList(docList, include2);
+          break;
       }
     }
     return isSingle ? docList[0] : docList;
   }
+  async includeDocsRead(docs, include) {
+    const { model, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
+    const svc = await this.getAuthorizedTargetService(model, "read");
+    for (let y = 0; y < docs.length; y++) {
+      const doc = docs[y];
+      const localValue = (0, import_utils12.get)(doc, localField);
+      const filter2 = { ..._filters ?? {}, [foreignField]: { $in: this.getForeignKeyValues(localValue) } };
+      const trustedOptions = {
+        ...options,
+        access: "read",
+        lean: true,
+        includePermissions: false
+      };
+      const result = await svc.findOne(filter2, this.sanitizeIncludeArgs(args), trustedOptions);
+      if (result.success) {
+        setDocValue(doc, path, result.data);
+      }
+    }
+    return docs;
+  }
   async includeDocsList(docs, include) {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
     const svc = await this.getAuthorizedTargetService(model, op);
     const includeLocalValues = [];
-    (0, import_utils12.forEach)(docs, (doc, i) => {
-      includeLocalValues.push((0, import_utils12.get)(doc, localField));
+    (0, import_utils12.forEach)(docs, (doc) => {
+      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils12.get)(doc, localField)));
     });
     const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils12.flatten)(includeLocalValues) } };
     const authorizedFilter = await svc.genFilter(op, filter2);
     const trustedArgs = {
-      ...args,
+      ...this.sanitizeIncludeArgs(args),
       overrides: {
         filter: authorizedFilter
       }
@@ -1482,58 +1724,42 @@ var Base = class {
     };
     const trustedResult = await svc.find(filter2, trustedArgs, trustedOptions);
     if (!trustedResult.success) return docs;
+    const index = this.buildForeignKeyIndex(trustedResult.data, foreignField);
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils12.get)(doc, localField);
-      const filterFn = (row) => (0, import_utils12.intersectionBy)((0, import_utils12.castArray)(localValue), (0, import_utils12.castArray)((0, import_utils12.get)(row, foreignField)), String).length > 0;
-      const matches = trustedResult.data.filter(filterFn);
+      const matches = this.getIndexedMatches(index, (0, import_utils12.get)(doc, localField));
       setDocValue(doc, path, op === "list" ? matches : matches[0]);
     }
     return docs;
   }
   async includeDocsCount(docs, include) {
-    const { model, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
+    const { model, path, localField, foreignField, filter: _filters } = include;
     const svc = await this.getAuthorizedTargetService(model, "count");
-    const includeLocalValues = [];
-    (0, import_utils12.forEach)(docs, (doc) => {
-      includeLocalValues.push((0, import_utils12.get)(doc, localField));
-    });
-    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils12.flatten)(includeLocalValues) } };
-    const authorizedFilter = await svc.genFilter("list", filter2);
-    const trustedArgs = {
-      ...args,
-      select: [foreignField],
-      overrides: {
-        filter: authorizedFilter
-      }
-    };
-    const trustedOptions = {
-      ...options,
-      lean: true,
-      includePermissions: false,
-      includeCount: false
-    };
-    const result = await svc.find(filter2, trustedArgs, trustedOptions);
+    const localValues = docs.flatMap((doc) => this.getForeignKeyValues((0, import_utils12.get)(doc, localField)));
+    const result = await svc.countByFieldValues(foreignField, localValues, _filters ?? {}, "count");
     if (!result.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils12.get)(doc, localField);
-      const filterFn = (row) => (0, import_utils12.intersectionBy)((0, import_utils12.castArray)(localValue), (0, import_utils12.castArray)((0, import_utils12.get)(row, foreignField)), String).length > 0;
-      setDocValue(doc, path, result.data.filter(filterFn).length);
+      setDocValue(doc, path, this.getIndexedCount(result.data, (0, import_utils12.get)(doc, localField)));
     }
     return docs;
   }
-  async parseClientData(filter2) {
-    const result = await iterateQuery(filter2, async (fo, val, key) => {
-      switch (fo) {
-        case 0 /* SubQuery */:
-          return this.handleSubQuery(val, key);
-        case 1 /* Date */:
-          return this.handleDate(val, key);
-        default:
-          return null;
-      }
-    });
+  async parseClientData(filter2, scheduler = new RequestConcurrencyScheduler(this.getRequestComplexity().maxBulkConcurrency), scheduled = false) {
+    const result = await iterateQuery(
+      filter2,
+      async (fo, val, key) => {
+        switch (fo) {
+          case 0 /* SubQuery */:
+            return this.handleSubQuery(val, key);
+          case 1 /* Date */:
+            return this.handleDate(val, key);
+          default:
+            return null;
+        }
+      },
+      scheduler,
+      scheduled
+    );
     return result;
   }
   async handleSubQuery(sq, key) {
@@ -1579,7 +1805,67 @@ var import_utils14 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 
 // src/model.ts
-var import_mongoose4 = __toESM(require("mongoose"));
+var Model = class {
+  constructor(modelName, runtime) {
+    this.modelName = modelName;
+    this.runtime = runtime ?? null;
+    const resolvedRuntime = runtime ?? getActiveRuntime() ?? defaultRuntime;
+    const registered = resolvedRuntime.getModelInstance(modelName);
+    if (!registered) {
+      throw new Error(
+        `Runtime model registry missing model "${modelName}". Pass a mongoose.Model instance to createRouter() or register it with registerModelInstance() before using this runtime.`
+      );
+    }
+    this.mongooseModel = registered;
+    if (!this.mongooseModel) return;
+  }
+  new() {
+    const doc = new this.mongooseModel();
+    return doc;
+  }
+  create(data) {
+    return this.mongooseModel.create(data);
+  }
+  find({ filter: filter2, select, sort, populate, limit, hardLimit, skip, lean }) {
+    const builder = this.mongooseModel.find(filter2);
+    if (select) builder.select(select);
+    if (skip) builder.skip(Number(skip));
+    const normalizedLimit = Number(limit);
+    if (Number.isSafeInteger(normalizedLimit) && normalizedLimit > 0) {
+      builder.limit(normalizedLimit);
+    } else if (Number.isSafeInteger(hardLimit) && Number(hardLimit) > 0) {
+      builder.limit(Number(hardLimit));
+    }
+    if (sort) builder.sort(sort);
+    if (populate) builder.populate(populate);
+    if (lean) builder.lean();
+    return builder;
+  }
+  findOne({ filter: filter2, select, sort, populate, lean }) {
+    const builder = this.mongooseModel.findOne(filter2);
+    if (select) builder.select(select);
+    if (sort) builder.sort(sort);
+    if (populate) builder.populate(populate);
+    if (lean) builder.lean();
+    return builder;
+  }
+  exists(filter2) {
+    if (!filter2) return null;
+    return this.findOne({ filter: filter2 }).select("_id").lean();
+  }
+  // see https://mongoosejs.com/docs/api.html#query_Query-countDocuments
+  countDocuments(filter2 = {}) {
+    return this.mongooseModel.countDocuments(filter2);
+  }
+  // see https://mongoosejs.com/docs/api.html#model_Model.distinct
+  distinct(field, conditions = {}) {
+    return this.mongooseModel.distinct(field, conditions);
+  }
+  aggregate(pipeline) {
+    return this.mongooseModel.aggregate(pipeline);
+  }
+};
+var model_default = Model;
 
 // src/logger-helpers.ts
 var SENSITIVE_FILTER_KEYS = /* @__PURE__ */ new Set([
@@ -1758,136 +2044,6 @@ var error = (error2) => {
   safeApply(fn, target ?? defaultLogger, [error2]);
 };
 
-// src/model.ts
-var safeSortLogError = (msg, ...args) => {
-  const message = args.length > 0 ? `${msg} ${safeStringify(args.length === 1 ? args[0] : args)}` : msg;
-  error(message);
-};
-var Model = class {
-  constructor(modelName, runtime) {
-    this.modelName = modelName;
-    this.runtime = runtime ?? null;
-    const resolvedRuntime = runtime ?? getActiveRuntime();
-    const registered = resolvedRuntime?.getModelInstance(modelName) ?? null;
-    const global = import_mongoose4.default.models[modelName];
-    this.model = registered ?? global ?? import_mongoose4.default.model(modelName);
-    if (!this.model) return;
-  }
-  new() {
-    const doc = new this.model();
-    return doc;
-  }
-  create(data) {
-    return this.model.create(data);
-  }
-  find({ filter: filter2, select, sort, populate, limit, hardLimit, skip, lean }) {
-    if (!this.validateSort(sort)) {
-      sort = null;
-    }
-    const builder = this.model.find(filter2);
-    if (select) builder.select(select);
-    if (skip) builder.skip(Number(skip));
-    const normalizedLimit = Number(limit);
-    if (Number.isSafeInteger(normalizedLimit) && normalizedLimit > 0) {
-      builder.limit(normalizedLimit);
-    } else if (Number.isSafeInteger(hardLimit) && Number(hardLimit) > 0) {
-      builder.limit(Number(hardLimit));
-    }
-    if (sort) builder.sort(sort);
-    if (populate) builder.populate(populate);
-    if (lean) builder.lean();
-    return builder;
-  }
-  validateSort(sort, logError = safeSortLogError) {
-    const validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
-    const fieldPathPattern = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
-    const isValidFieldPath = (field) => fieldPathPattern.test(field);
-    if (sort === null || sort === void 0) return true;
-    if (typeof sort === "string") {
-      const fields = sort.trim().split(/\s+/).filter(Boolean);
-      const isValid = fields.every((field) => isValidFieldPath(field.startsWith("-") ? field.slice(1) : field));
-      if (!isValid) {
-        logError("Invalid sort string:", sort);
-        return false;
-      }
-      return true;
-    }
-    if (Array.isArray(sort)) {
-      const isValid = sort.every((pair) => {
-        if (!Array.isArray(pair) || pair.length !== 2) {
-          logError("Invalid sort array element: must be [key, order]", pair);
-          return false;
-        }
-        const [key, order] = pair;
-        if (typeof key !== "string" || !isValidFieldPath(key)) {
-          logError("Invalid sort array key: must be a field path string", key);
-          return false;
-        }
-        if (!validSortOrders.includes(order)) {
-          logError('Invalid sort array order: must be 1, -1, "asc", or "desc"', order);
-          return false;
-        }
-        return true;
-      });
-      return isValid;
-    }
-    if (typeof sort === "object" && !(sort instanceof Map)) {
-      const isValid = Object.entries(sort).every(([key, order]) => {
-        if (!isValidFieldPath(key)) {
-          logError("Invalid sort object key: must be a field path string", key);
-          return false;
-        }
-        if (!validSortOrders.includes(order)) {
-          logError('Invalid sort object value: must be 1, -1, "asc", or "desc"', order);
-          return false;
-        }
-        return true;
-      });
-      return isValid;
-    }
-    if (sort instanceof Map) {
-      const isValid = Array.from(sort.entries()).every(([key, order]) => {
-        if (!isValidFieldPath(key)) {
-          logError("Invalid sort Map key: must be a field path string", key);
-          return false;
-        }
-        if (!validSortOrders.includes(order)) {
-          logError('Invalid sort Map value: must be 1, -1, "asc", or "desc"', order);
-          return false;
-        }
-        return true;
-      });
-      return isValid;
-    }
-    logError("Invalid sort type: must be string, array, object, or Map", sort);
-    return false;
-  }
-  findOne({ filter: filter2, select, sort, populate, lean }) {
-    if (!this.validateSort(sort)) {
-      sort = null;
-    }
-    const builder = this.model.findOne(filter2);
-    if (select) builder.select(select);
-    if (sort) builder.sort(sort);
-    if (populate) builder.populate(populate);
-    if (lean) builder.lean();
-    return builder;
-  }
-  exists(filter2) {
-    if (!filter2) return null;
-    return this.findOne({ filter: filter2 }).select("_id").lean();
-  }
-  // see https://mongoosejs.com/docs/api.html#query_Query-countDocuments
-  countDocuments(filter2 = {}) {
-    return this.model.countDocuments(filter2);
-  }
-  // see https://mongoosejs.com/docs/api.html#model_Model.distinct
-  distinct(field, conditions = {}) {
-    return this.model.distinct(field, conditions);
-  }
-};
-var model_default = Model;
-
 // src/services/model-subdocument-service.ts
 var import_utils13 = require("@web-ts-toolkit/utils");
 async function listSub(service, id, sub, options) {
@@ -2014,7 +2170,8 @@ async function getParentDoc(service, id, sub, args, options) {
   const { access = "read", lean = false } = options ?? {};
   const parentFilter = await service.genFilter(access, await service.genIDFilter(id));
   if (parentFilter === false) return null;
-  return service.findRawParentDoc({ filter: parentFilter, select: sub, populate: genSubPopulate(sub, populate), lean });
+  const subPopulate = await service.genPopulate("read", genSubPopulate(sub, populate), [sub, "sub"]);
+  return service.findRawParentDoc({ filter: parentFilter, select: sub, populate: subPopulate, lean });
 }
 
 // src/services/model-service-defaults.ts
@@ -2140,21 +2297,6 @@ var assertModelDocument = (value, modelName, hookName) => {
   }
   throw new Error(`${hookName} hook for model=${modelName} must return a Mongoose document instance`);
 };
-var mapWithConcurrencyLimit = async (items, limit, iteratee) => {
-  const results = new Array(items.length);
-  let cursor = 0;
-  const workerCount = Math.min(Math.max(limit, 1), items.length || 1);
-  await Promise.all(
-    Array.from({ length: workerCount }, async () => {
-      while (cursor < items.length) {
-        const current = cursor;
-        cursor += 1;
-        results[current] = await iteratee(items[current], current);
-      }
-    })
-  );
-  return results;
-};
 var Service = class extends Base {
   findRawParentDoc(args) {
     return this.model.findOne({
@@ -2163,6 +2305,12 @@ var Service = class extends Base {
       populate: args.populate
     });
   }
+  createModelAdapter(modelName) {
+    return new model_default(modelName);
+  }
+  getModelRouterOptions(modelName) {
+    return getModelOptions(modelName);
+  }
   asServiceHookContext(context) {
     return context;
   }
@@ -2189,8 +2337,8 @@ var Service = class extends Base {
   }
   constructor(req, modelName) {
     super(req, modelName);
-    this.model = new model_default(modelName);
-    this.options = getModelOptions(modelName);
+    this.model = this.createModelAdapter(modelName);
+    this.options = this.getModelRouterOptions(modelName);
     this.defaults = this.options.defaults || {};
     this.baseFields = ["_id"];
     this.baseFieldsExt = this.baseFields.concat(this.options.documentPermissionField);
@@ -2209,10 +2357,11 @@ var Service = class extends Base {
       if (result) return result;
       throw error2;
     }
-    let [_filter, _select, _populate] = await Promise.all([
+    let [_filter, _select, _populate, allowedSortFields] = await Promise.all([
       overrideFilter || this.genFilter(access, parsedFilter),
       overrideSelect || this.genQuerySelect(access, select),
-      overridePopulate || this.genPopulate(populateAccess || access, populate)
+      overridePopulate || this.genPopulate(populateAccess || access, populate),
+      this.genAllowedFields({}, access, this.baseFieldsExt)
     ]);
     const { includes, includeLocalFields, includePaths } = this.processInclude(include);
     const finalSelect = normalizeSelect(_select).concat(includeLocalFields);
@@ -2231,13 +2380,18 @@ var Service = class extends Base {
       this.completeOp("findOne", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
+    const sortErrors = validateSortFields(sort, allowedSortFields);
+    if (sortErrors.length > 0) {
+      this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    }
     let doc = await this.model.findOne({ ...query, lean });
     if (!doc) {
       this.completeOp("findOne", startedAt, "not_found" /* NotFound */, _filter);
       return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     }
     const context = {
-      mongooseModel: this.model.model,
+      mongooseModel: this.model.mongooseModel,
       modelName: this.modelName,
       operation: access,
       originalDocumentSnapshot: toObject(doc),
@@ -2301,11 +2455,12 @@ var Service = class extends Base {
       if (result) return result;
       throw error2;
     }
-    const [_filter, _select, _populate, pagination] = await Promise.all([
+    const [_filter, _select, _populate, pagination, allowedSortFields] = await Promise.all([
       overrideFilter || this.genFilter("list", parsedFilter),
       overrideSelect || this.genQuerySelect("list", select),
       overridePopulate || this.genPopulate(populateAccess, populate),
-      genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
+      genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit),
+      this.genAllowedFields({}, "list", this.baseFieldsExt)
     ]);
     const finalSelect = normalizeSelect(_select);
     const filteredPopulate = (0, import_utils14.isArray)(finalSelect) && (0, import_utils14.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
@@ -2328,13 +2483,18 @@ var Service = class extends Base {
       this.completeOp("find", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
+    const sortErrors = validateSortFields(sort, allowedSortFields);
+    if (sortErrors.length > 0) {
+      this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    }
     let docs = await this.model.find({
       ...query,
       hardLimit: this.options.listHardLimit,
       lean
     });
     const contexts = docs.map((doc) => ({
-      mongooseModel: this.model.model,
+      mongooseModel: this.model.mongooseModel,
       modelName: this.modelName,
       operation: "list",
       originalDocumentSnapshot: toObject(doc),
@@ -2397,8 +2557,33 @@ var Service = class extends Base {
         errors: [{ detail: `Bulk create exceeds maximum item count of ${maxBulkItems}` }]
       };
     }
+    const parseErrors = [];
+    const parseScheduler = new RequestConcurrencyScheduler(maxBulkConcurrency);
     try {
-      dataArr = await Promise.all(dataArr.map((d) => this.parseClientData(d)));
+      const parsedData = await parseScheduler.map(dataArr, async (d, index) => {
+        try {
+          return await this.parseClientData(d, parseScheduler, true);
+        } catch (error2) {
+          const result = this.getClientRequestErrorResult(error2);
+          if (!result) throw error2;
+          parseErrors.push({
+            index,
+            code: result.code,
+            errors: (result.errors ?? []).map((issue) => this.formatBulkValidationIssue(issue, isArr ? index : null))
+          });
+          return void 0;
+        }
+      });
+      if (parseErrors.length > 0) {
+        const sortedErrors = parseErrors.slice().sort((a, b) => a.index - b.index);
+        return {
+          success: false,
+          kind: "error",
+          code: sortedErrors[0]?.code ?? "bad_request" /* BadRequest */,
+          errors: sortedErrors.flatMap((entry) => entry.errors)
+        };
+      }
+      dataArr = parsedData;
     } catch (error2) {
       const result = this.getClientRequestErrorResult(error2);
       if (result) return result;
@@ -2409,7 +2594,7 @@ var Service = class extends Base {
     const validationErrors = [];
     const validationItems = await mapWithConcurrencyLimit(dataArr, maxBulkConcurrency, async (item, index) => {
       const context = {
-        mongooseModel: this.model.model,
+        mongooseModel: this.model.mongooseModel,
         modelName: this.modelName,
         operation: "create",
         originalData: item,
@@ -2552,7 +2737,7 @@ var Service = class extends Base {
       return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     }
     const context = {
-      mongooseModel: this.model.model,
+      mongooseModel: this.model.mongooseModel,
       modelName: this.modelName,
       operation: "update",
       resolvedQuery: query
@@ -2698,7 +2883,7 @@ var Service = class extends Base {
       return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     }
     const context = {
-      mongooseModel: this.model.model,
+      mongooseModel: this.model.mongooseModel,
       modelName: this.modelName,
       operation: "delete",
       originalDocumentSnapshot: toObject(doc),
@@ -2727,22 +2912,11 @@ var Service = class extends Base {
     };
   }
   isValidDistinctFieldName(field) {
-    if (typeof field !== "string" || field.length === 0) return false;
-    if (field.includes("$")) return false;
-    if (field.includes("..")) return false;
-    if (field.startsWith(".") || field.endsWith(".")) return false;
-    if (/\s/.test(field)) return false;
-    return true;
+    return isValidFieldPath(field);
   }
   async authorizeDistinctField(field) {
     const allowedFields = await this.genAllowedFields(null, "read");
-    const isAllowed = allowedFields.some((allowed) => {
-      if (allowed === field) return true;
-      if (allowed.startsWith(`${field}.`)) return true;
-      if (field.startsWith(`${allowed}.`)) return true;
-      return false;
-    });
-    if (!isAllowed) {
+    if (!isFieldAllowed(field, allowedFields)) {
       return {
         success: false,
         kind: "error",
@@ -2780,6 +2954,44 @@ var Service = class extends Base {
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     return { success: true, kind: "single", code: "success" /* Success */, data: await this.model.countDocuments(filter2), query };
   }
+  async countByFieldValues(foreignField, values, filter2 = {}, access = "list") {
+    if (!isValidFieldPath(foreignField)) {
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: [{ detail: `Invalid include foreignField: ${foreignField}` }]
+      };
+    }
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const uniqueValues = (0, import_utils14.uniqBy)(values, (value) => String(value));
+    filter2 = await this.genFilter(access, {
+      ...filter2,
+      [foreignField]: { $in: uniqueValues }
+    });
+    const query = { filter: filter2 };
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    const matchFilter = filter2;
+    const rows = await this.model.aggregate([
+      { $match: matchFilter },
+      {
+        $project: {
+          foreignValues: {
+            $cond: [{ $isArray: `$${foreignField}` }, `$${foreignField}`, [`$${foreignField}`]]
+          }
+        }
+      },
+      { $unwind: "$foreignValues" },
+      { $match: { foreignValues: { $in: uniqueValues } } },
+      { $group: { _id: "$foreignValues", documentIds: { $addToSet: "$_id" } } }
+    ]);
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      counts.set(String(row._id), new Set(row.documentIds.map((id) => String(id))));
+    }
+    return { success: true, kind: "single", code: "success" /* Success */, data: counts, query };
+  }
   getDocPermissions(doc) {
     return getDocPermissions(this.modelName, doc);
   }
@@ -2891,7 +3103,7 @@ var PublicService = class extends Service {
       return result;
     }
     const docs = await this.decorateAll(result.data, "list", {
-      mongooseModel: this.model.model,
+      mongooseModel: this.model.mongooseModel,
       modelName: this.modelName,
       operation: "list",
       resolvedQuery: result.query
@@ -2940,12 +3152,17 @@ var PublicService = class extends Service {
       { skim, includePermissions, access, populateAccess, lean }
     );
     if (tryList && (!result.success || !result.data)) {
+      const listAllowed = await this.req.macl.isAllowed(this.modelName, "list");
+      if (!listAllowed) {
+        return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
+      }
       access = "list";
       result = await this.findById(
         id,
         {
           select,
           populate,
+          include,
           overrides: { idFilter }
         },
         { skim, includePermissions, access, populateAccess, lean }
@@ -2975,6 +3192,10 @@ var PublicService = class extends Service {
       { skim, includePermissions, access, populateAccess, lean }
     );
     if (tryList && (!result.success || !result.data)) {
+      const listAllowed = await this.req.macl.isAllowed(this.modelName, "list");
+      if (!listAllowed) {
+        return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
+      }
       access = "list";
       result = await this.findOne(
         filter2,
@@ -2982,6 +3203,7 @@ var PublicService = class extends Service {
           select,
           sort,
           populate,
+          include,
           overrides: {}
         },
         { skim, includePermissions, access, populateAccess, lean }
@@ -3171,6 +3393,7 @@ var DataService = class {
     const filterErrors = validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, sort, skip, limit, page, pageSize } = args ?? {};
+    const hasExplicitLimit = limit != null || pageSize != null;
     const [_filter, _select, pagination] = await Promise.all([
       this.genFilter("list", filter2),
       this.genQuerySelect("list", select),
@@ -3183,26 +3406,26 @@ var DataService = class {
       ...pagination
     };
     if (_filter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
-    if (sort) {
-      const sortFieldErrors = await this.validateSortFields(sort, "list");
-      if (sortFieldErrors.length > 0) {
-        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortFieldErrors, query };
-      }
+    const sortFieldErrors = validateSortFields(sort, await this.genAllowedFields({}, "list"));
+    if (sortFieldErrors.length > 0) {
+      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortFieldErrors, query };
     }
     let docs = await filterCollection(this.data, _filter);
     const totalCount = docs.length;
     if (sort) {
-      const { sortKey, sortOrder } = parseSortString(sort);
-      docs = (0, import_utils16.orderBy)(docs, [sortKey], [sortOrder]);
+      const normalizedSort = normalizeSortForOrderBy(sort);
+      docs = (0, import_utils16.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
     }
     const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
-    const trimmed = await Promise.all(
-      pagedDocs.map(async (doc) => {
-        doc = await this.trimOutputFields(doc, "list");
-        if (_select.length > 0) doc = (0, import_utils16.pick)(doc, _select);
-        return doc;
-      })
-    );
+    const { maxHookConcurrency } = this.getRequestComplexity();
+    const trimmed = await mapWithConcurrencyLimit(pagedDocs, maxHookConcurrency, async (doc) => {
+      doc = await this.trimOutputFields(doc, "list");
+      if (_select.length > 0) doc = (0, import_utils16.pick)(doc, _select);
+      return doc;
+    });
+    if (!hasExplicitLimit && trimmed.length === totalCount) {
+      query.limit = trimmed.length;
+    }
     return {
       success: true,
       kind: "list",
@@ -3219,6 +3442,9 @@ var DataService = class {
   decorateAll(docs, access, context) {
     return this.req.dacl.decorateAll(this.dataName, docs, access, context);
   }
+  getRequestComplexity() {
+    return resolveRequestComplexity(getGlobalOption("requestComplexity"));
+  }
   genAllowedFields(doc, access, baseFields) {
     return this.req.dacl.genAllowedFields(this.dataName, doc, access, baseFields);
   }
@@ -3240,26 +3466,6 @@ var DataService = class {
   trimOutputFields(doc, access, baseFields) {
     return this.pickAllowedFields(doc, access, baseFields);
   }
-  async validateSortFields(sort, access) {
-    const fieldPathPattern = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)*$/;
-    const fields = sort.trim().split(/\s+/).filter(Boolean).map((field) => ({
-      raw: field,
-      name: field.startsWith("-") ? field.slice(1) : field
-    }));
-    const errors = [];
-    for (const { raw, name } of fields) {
-      if (!fieldPathPattern.test(name)) {
-        errors.push({ detail: `Invalid sort field: ${raw}`, pointer: `#/sort` });
-        continue;
-      }
-      if (name === "id" || name === "_id") continue;
-      const allowed = await this.genAllowedFields({}, access);
-      if (!allowed.includes(name)) {
-        errors.push({ detail: `Sort field is not allowed: ${name}`, pointer: `#/sort` });
-      }
-    }
-    return errors;
-  }
 };
 
 // src/processors.ts
@@ -3845,7 +4051,7 @@ var Core = class {
       alwaysSelectFields
     });
   }
-  async genPopulate(modelName, access = "read", _populate = null) {
+  async genPopulate(modelName, access = "read", _populate = null, subPaths = []) {
     if (!_populate) return [];
     let populate = Array.isArray(_populate) ? _populate : [_populate];
     populate = (0, import_utils21.compact)(
@@ -3856,12 +4062,14 @@ var Core = class {
             path: p.path,
             select: normalizeSelect(p.select)
           };
-          const parentPath = ret.path.includes(".") ? ret.path.split(".")[0] : ret.path;
+          const pathForSourcePermission = subPaths.length > 0 && ret.path.startsWith(`${subPaths[0]}.`) ? ret.path.slice(subPaths[0].length + 1) : ret.path;
+          const parentPath = pathForSourcePermission.includes(".") ? pathForSourcePermission.split(".")[0] : pathForSourcePermission;
           const allowedParentPaths = await this.genSelect(
             modelName,
             populateAccess,
             [parentPath],
-            false
+            false,
+            subPaths
           );
           if (!allowedParentPaths.includes(parentPath)) return null;
           const refModelName = getModelRef(modelName, ret.path);
@@ -4351,7 +4559,7 @@ var includeItemSchema = import_zod2.z.object({
   filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
   localField: import_zod2.z.string().min(1),
   foreignField: import_zod2.z.string().min(1),
-  args: import_zod2.z.unknown().optional(),
+  args: import_zod2.z.unknown().optional().describe("Forwarded to list/read includes. Count includes ignore pagination fields so counts remain exact."),
   options: import_zod2.z.unknown().optional()
 }).passthrough();
 var includeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
@@ -4888,7 +5096,7 @@ var import_zod4 = require("zod");
 var dataListBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
-  sort: import_zod4.z.string().optional(),
+  sort: sortSchema.optional(),
   skip: import_zod4.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
   limit: import_zod4.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   page: import_zod4.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
@@ -4980,7 +5188,7 @@ var rootModelSubReadArgsSchema = import_zod5.z.object({
 var rootModelCountOptionsSchema = import_zod5.z.object({}).strict().optional();
 var rootDataListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
-  sort: import_zod5.z.string().optional(),
+  sort: sortSchema.optional(),
   skip: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
   limit: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   page: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
@@ -6220,7 +6428,12 @@ async function decorateDataListResult(svc, result, context = {}) {
     operation: "list",
     resolvedQuery: result.query
   };
-  const decoratedDocs = await Promise.all(result.data.map((doc) => svc.decorate(doc, "list", decorateContext)));
+  const { maxHookConcurrency } = svc.getRequestComplexity();
+  const decoratedDocs = await mapWithConcurrencyLimit(
+    result.data,
+    maxHookConcurrency,
+    (doc) => svc.decorate(doc, "list", decorateContext)
+  );
   const data = await svc.decorateAll(decoratedDocs, "list", decorateContext);
   return {
     ...result,
@@ -6588,7 +6801,7 @@ var DataRouter = class {
       const svc = this.getService(req);
       const result = await svc.find(
         filter2 ?? {},
-        { select, sort: typeof sort === "string" ? sort : void 0, skip, limit, page, pageSize },
+        { select, sort, skip, limit, page, pageSize },
         { includeCount }
       );
       handleResultError(result);