@web-ts-toolkit/access-router 0.54.0 → 0.56.0

package/llms.txt

@@ -35,6 +35,9 @@
 - [Includes/count cardinality](README.md#include-cardinality) · [Bounded numeric Map counts and Set-to-number migration](README.md#numeric-grouped-count-service-api-breaking-migration) · [Source/attachment provenance](README.md#safe-include-output-paths)
 - [Correlated includes and literal escapes](README.md#correlated-includes) · [Nested writes and trusted hooks](README.md#nested-updates-and-trusted-hooks)
 - [Virtuals, literal-filter preservation and output compatibility](README.md#virtuals-computed-fields) · [Request/runtime reentrant hook chains](README.md#hook-admission-and-reentrant-service-calls) · [Separate persistence limits](README.md#persistence-concurrency-and-resource-limits)
+- [Private populated dependencies](README.md#private-populated-dependencies) · [Runnable example](README.md#runnable-private-dependency-example): server virtual `dependsOnPopulate: [{ path, select? }]`, automatically retained scope-local static ObjectId ref/1D array, eagerly registered same-runtime/same-connection target. Explicit `ModelVirtualDescriptor<Source, Value, { ref: Target }>` types only optional getter argument four (`populated = {}`); argument one/local dependsOn and persisted/write/public types stay unchanged. Root/advanced types: ModelVirtualPopulateDependency, ModelVirtualPopulateInputs. No client/query authority or new entrypoint.
+- [Runtime private-read mode](README.md#runtime-private-read-mode): `api.setGlobalOptions({ requireReadOperationAccessForPopulateDependencies: false })` opts out of private target operationAccess.read only; default true, only literal false bypasses, malformed JS/undefined stays conservative true. Typed GlobalOptions/exact setters/getters; server/runtime-only, isolated and captured with source/target/query intent before awaits, including nested output. Not requireRegisteredPopulateModels: eager private registration/static declarations remain. Source/target input-field permissions are already bypassed; virtual output authorization and request baseFilter.read/overrideFilter.read/retained IDs still govern. False + virtual-only selection adds no operation check solely to fetch.
+- [Private target/read/selection rules](README.md#target-authority-selection-and-reconstruction) · [Release compatibility](README.md#release-compatibility-dependency-reference-omission): BOTH modes apply an independent captured caller target BASE-read visibility gate to active selected/applicable dependency refs. Source unselected/denied -> omit; target read denied/failed -> omit entire ref INCLUDING ID, outranking list/custom populate access and public related-operation grants. Read allowed + ordinary population -> original authorized mask; read allowed + no population -> exact original refs/arrays/nulls/misses/order/duplicates/presence. This intentionally supersedes prior D1 denied-ID fallback even in default mode; no active plan/no feature keeps ordinary behavior. Private availability/getter outcomes never grant reference output. Compatible positive fetch unions retain separate masks/private request row scope, independent of public match/access/related grants. Each getter gets only its declared fourth-argument mask; no implicit DTO/handle/metadata/hook/task transport, only its authorized deliberate return. No recursive private target virtuals or successful-write retries. See README for selection/errors/inheritance/native isolation/hydration caveats and measured compatible-group batching.
 
 ## Additional examples
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/access-router",
   "description": "ACL-aware Express routers and in-memory data services for Mongoose-backed APIs",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/access-router",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "sideEffects": [
     "./**/index.js",
     "./**/index.mjs",
@@ -57,8 +57,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-json-router": "0.54.0",
-    "@web-ts-toolkit/utils": "0.54.0",
+    "@web-ts-toolkit/express-json-router": "0.56.0",
+    "@web-ts-toolkit/utils": "0.56.0",
     "just-diff": "^6.0.2",
     "mongoose-schema-jsonschema": "^4.0.1",
     "sift": "^17.1.3",