@web-ts-toolkit/access-router 0.55.0 → 0.57.0

package/index.js

@@ -2161,9 +2161,34 @@ var init_field_catalog = __esm({
   }
 });
 
+// src/acl/populate-target-configuration.ts
+function capturePopulateTargetConfiguration(runtime, modelName, source, proposedOptions) {
+  const label = `Populate target "${modelName}" for ${source}`;
+  if (!proposedOptions && !runtime.hasModel(modelName))
+    authorizationError(
+      `${label} must be configured first in this runtime; register its Mongoose model and setModelOptions with an object permissionSchema`
+    );
+  const model = runtime.getModelInstance(modelName);
+  if (!model) authorizationError(`${label} requires an actual registered Mongoose model in this runtime`);
+  const options = proposedOptions ?? runtime.getModelOptions(modelName);
+  const permissionSchema = options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema;
+  if (!(0, import_utils15.isPlainObject)(permissionSchema))
+    authorizationError(
+      `${label} requires an effective object permissionSchema; configure the model or runtime model defaults ({} explicitly closes business fields)`
+    );
+  return { model, options: { ...options, permissionSchema } };
+}
+var import_utils15;
+var init_populate_target_configuration = __esm({
+  "src/acl/populate-target-configuration.ts"() {
+    import_utils15 = require("@web-ts-toolkit/utils");
+    init_authorization_snapshot();
+  }
+});
+
 // src/acl/virtual-populate-dependencies.ts
 function record(value, label) {
-  if (!(0, import_utils15.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
+  if (!(0, import_utils16.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
   for (const key of Reflect.ownKeys(value)) {
     const property = Object.getOwnPropertyDescriptor(value, key);
     if (typeof key !== "string" || !property.enumerable || !("value" in property))
@@ -2251,7 +2276,9 @@ function normalizeSelection(select, catalog, label) {
     includeId: selection.includes("_id")
   };
 }
-function captureVirtualPopulateDependencies(runtime, modelName, options) {
+function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const requireOperationAccessForPopulateDependencies = globalOptions.requireOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateQueries = globalOptions.requireOperationAccessForPopulateQueries !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2291,15 +2318,23 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
                 label,
                 `target "${ref}" requires a registered same-connection non-discriminator ObjectId model bound to the source ref`
               );
-            const targetOptions = ref === modelName ? options : runtime.getModelOptions(ref);
+            const { options: targetOptions } = capturePopulateTargetConfiguration(
+              runtime,
+              ref,
+              `dependsOnPopulate virtual "${label}"`,
+              ref === modelName ? options : void 0
+            );
             const defaults = runtime.getDefaultModelOptions();
-            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils15.get)(targetOptions, path2, fallback), key, (0, import_utils15.get)(defaults, key));
+            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils16.get)(targetOptions, path2, fallback), key, (0, import_utils16.get)(defaults, key));
             const documentPermissionField = targetOptions.documentPermissionField ?? defaults.documentPermissionField;
             const catalog = captureAuthorizationFieldCatalog(targetModel.schema, void 0, documentPermissionField);
             const configuration = copyAuthorizationValue(
               {
                 catalog,
                 documentPermissionField,
+                requireOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateQueries,
+                permissionSchema: targetOptions.permissionSchema,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2348,13 +2383,13 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
         );
         continue;
       }
-      if (!(0, import_utils15.isPlainObject)(raw)) continue;
+      if (!(0, import_utils16.isPlainObject)(raw)) continue;
       const entry = raw;
       const label = join(sourcePrefix, name);
       captureList(entry.dependsOnPopulate, label);
       if (!("get" in entry))
         for (const access of accesses) {
-          if ((0, import_utils15.isPlainObject)(entry[access]))
+          if ((0, import_utils16.isPlainObject)(entry[access]))
             captureList(entry[access].dependsOnPopulate, `${label}.${access}`);
         }
       const byAccess = {};
@@ -2379,8 +2414,8 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
   visit(options.virtuals ?? {}, model?.schema, "", [], !!model && varyingModel(model));
   return Object.freeze({ scopes: Object.freeze(scopes) });
 }
-function captureVirtualPopulateSnapshot(runtime, modelName, options) {
-  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options);
+function captureVirtualPopulateSnapshot(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions);
   const token = () => {
   };
   snapshots.set(token, snapshot);
@@ -2404,15 +2439,16 @@ function resolveVirtualPopulateDependencies(configuration, scopePath, virtualNam
     )
   );
 }
-var import_utils15, elementType, join, within, accesses, fail, varyingSchema, varyingModel, snapshots;
+var import_utils16, elementType, join, within, accesses, fail, varyingSchema, varyingModel, snapshots;
 var init_virtual_populate_dependencies = __esm({
   "src/acl/virtual-populate-dependencies.ts"() {
-    import_utils15 = require("@web-ts-toolkit/utils");
+    import_utils16 = require("@web-ts-toolkit/utils");
     init_query();
     init_manager();
     init_authorization_snapshot();
     init_field_catalog();
     init_virtual_descriptor();
+    init_populate_target_configuration();
     elementType = (type) => type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster;
     join = (prefix, path) => prefix ? `${prefix}.${path}` : path;
     within = (path, parent) => path === parent || path.startsWith(`${parent}.`);
@@ -2427,14 +2463,14 @@ var init_virtual_populate_dependencies = __esm({
 });
 
 // src/runtime.ts
-var import_mongoose4, import_mongoose_schema_jsonschema, import_utils16, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue2, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, AccessRuntime, defaultRuntime;
+var import_mongoose4, import_mongoose_schema_jsonschema, import_utils17, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue2, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, AccessRuntime, defaultRuntime;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     import_mongoose4 = __toESM(require("mongoose"));
     init_public_admission();
     init_hydration();
     import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-    import_utils16 = require("@web-ts-toolkit/utils");
+    import_utils17 = require("@web-ts-toolkit/utils");
     init_helpers();
     init_registry();
     init_logger_default();
@@ -2463,44 +2499,44 @@ var init_runtime = __esm({
       listHardLimit: DEFAULT_LIST_HARD_LIMIT
     };
     normalizeBasePath = (name, value) => {
-      if ((0, import_utils16.isNil)(value)) {
+      if ((0, import_utils17.isNil)(value)) {
         return `/${pluralize(name)}`;
       }
-      return (0, import_utils16.isString)(value) ? (0, import_utils16.addLeadingSlash)(value) : "";
+      return (0, import_utils17.isString)(value) ? (0, import_utils17.addLeadingSlash)(value) : "";
     };
     hasModelPermission = (value, modelPermissionPrefix) => {
       if (!modelPermissionPrefix) {
         return true;
       }
-      if ((0, import_utils16.isString)(value)) {
+      if ((0, import_utils17.isString)(value)) {
         return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
       }
-      if ((0, import_utils16.isArray)(value)) {
+      if ((0, import_utils17.isArray)(value)) {
         return value.some((item) => {
-          if ((0, import_utils16.isString)(item) || (0, import_utils16.isArray)(item)) {
+          if ((0, import_utils17.isString)(item) || (0, import_utils17.isArray)(item)) {
             return hasModelPermission(item, modelPermissionPrefix);
           }
           return true;
         });
       }
-      return (0, import_utils16.isFunction)(value);
+      return (0, import_utils17.isFunction)(value);
     };
     classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       const schemaKeys = Object.keys(permissionSchema);
       const globalPermissionKeys = {};
       const modelPermissionKeys = {};
-      (0, import_utils16.forEach)(schemaKeys, (schemaKey) => {
+      (0, import_utils17.forEach)(schemaKeys, (schemaKey) => {
         const schemaRule = permissionSchema[schemaKey];
-        const ruleEntries = (0, import_utils16.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+        const ruleEntries = (0, import_utils17.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
         for (let x = 0; x < ruleEntries.length; x++) {
           const [accessKey, value] = ruleEntries[x];
-          if (!(0, import_utils16.isArray)(globalPermissionKeys[accessKey])) {
+          if (!(0, import_utils17.isArray)(globalPermissionKeys[accessKey])) {
             globalPermissionKeys[accessKey] = [];
           }
-          if (!(0, import_utils16.isArray)(modelPermissionKeys[accessKey])) {
+          if (!(0, import_utils17.isArray)(modelPermissionKeys[accessKey])) {
             modelPermissionKeys[accessKey] = [];
           }
-          if ((0, import_utils16.isBoolean)(value)) {
+          if ((0, import_utils17.isBoolean)(value)) {
             globalPermissionKeys[accessKey].push(schemaKey);
             continue;
           }
@@ -2532,13 +2568,13 @@ var init_runtime = __esm({
     VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
     VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
     VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-    isVirtualContainerValue2 = (value) => (0, import_utils16.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue2 = (value) => (0, import_utils17.isPlainObject)(value) && "sub" in value;
     virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
       try {
-        if ((0, import_utils16.get)((0, import_utils16.set)({}, virtualPath, true), permissionField) !== void 0) return true;
-        if ((0, import_utils16.get)((0, import_utils16.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+        if ((0, import_utils17.get)((0, import_utils17.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+        if ((0, import_utils17.get)((0, import_utils17.set)({}, permissionField, true), virtualPath) !== void 0) return true;
       } catch {
         return false;
       }
@@ -2599,12 +2635,12 @@ var init_runtime = __esm({
     };
     validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
       if (dependsOn === void 0) return [];
-      if (!(0, import_utils16.isArray)(dependsOn)) {
+      if (!(0, import_utils17.isArray)(dependsOn)) {
         throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
       }
       const list = dependsOn;
       for (const dep of list) {
-        if (!(0, import_utils16.isString)(dep) || dep.length === 0) {
+        if (!(0, import_utils17.isString)(dep) || dep.length === 0) {
           throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
         }
         if (dep.includes(".")) {
@@ -2626,12 +2662,12 @@ var init_runtime = __esm({
       return list;
     };
     validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
-      if ((0, import_utils16.isFunction)(value)) return;
-      if (!(0, import_utils16.isPlainObject)(value)) {
+      if ((0, import_utils17.isFunction)(value)) return;
+      if (!(0, import_utils17.isPlainObject)(value)) {
         throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
       }
       const record3 = value;
-      if (!(0, import_utils16.isFunction)(record3.get)) {
+      if (!(0, import_utils17.isFunction)(record3.get)) {
         throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
       }
       validateVirtualDependsOn(record3.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
@@ -2673,7 +2709,7 @@ var init_runtime = __esm({
               `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
             );
           }
-          if (!(0, import_utils16.isPlainObject)(record4.sub)) {
+          if (!(0, import_utils17.isPlainObject)(record4.sub)) {
             throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
           }
           continue;
@@ -2683,8 +2719,8 @@ var init_runtime = __esm({
             `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
           );
         }
-        if ((0, import_utils16.isFunction)(raw)) continue;
-        if (!(0, import_utils16.isPlainObject)(raw)) {
+        if ((0, import_utils17.isFunction)(raw)) continue;
+        if (!(0, import_utils17.isPlainObject)(raw)) {
           throw new Error(
             `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
           );
@@ -2738,7 +2774,7 @@ var init_runtime = __esm({
     };
     validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
       if (virtuals === void 0 || virtuals === null) return;
-      if (!(0, import_utils16.isPlainObject)(virtuals)) {
+      if (!(0, import_utils17.isPlainObject)(virtuals)) {
         throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
       }
       const rootSchema = model?.schema ?? null;
@@ -2790,7 +2826,8 @@ var init_runtime = __esm({
           {
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
-            requireRegisteredPopulateModels: true,
+            requireOperationAccessForPopulateQueries: true,
+            requireOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2845,7 +2882,7 @@ var init_runtime = __esm({
       }
       registerOpenApiRoute(route) {
         this.openApiRegistry.register(
-          this.openApiPathPrefix ? { ...route, path: (0, import_utils16.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+          this.openApiPathPrefix ? { ...route, path: (0, import_utils17.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
         );
       }
       /**
@@ -2856,7 +2893,7 @@ var init_runtime = __esm({
        */
       withOpenApiPathPrefix(prefix, build) {
         const previous = this.openApiPathPrefix;
-        this.openApiPathPrefix = (0, import_utils16.normalizeUrlPath)(`${previous}/${prefix}`);
+        this.openApiPathPrefix = (0, import_utils17.normalizeUrlPath)(`${previous}/${prefix}`);
         try {
           return build();
         } finally {
@@ -2963,9 +3000,18 @@ var init_runtime = __esm({
       }
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
-        this.globalOptions.assign(options);
+        const next = { ...options };
+        if ("requireOperationAccessForPopulateQueries" in next)
+          next.requireOperationAccessForPopulateQueries = next.requireOperationAccessForPopulateQueries !== false;
+        if ("requireOperationAccessForPopulateDependencies" in next)
+          next.requireOperationAccessForPopulateDependencies = next.requireOperationAccessForPopulateDependencies !== false;
+        this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
+        if (key === "requireOperationAccessForPopulateQueries" || key === "requireOperationAccessForPopulateDependencies") {
+          this.globalOptions.set(key, value !== false);
+          return;
+        }
         this.globalOptions.set(key, value);
       }
       getGlobalOptions() {
@@ -2992,7 +3038,7 @@ var init_runtime = __esm({
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils16.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils17.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
         this.defaultModelOptions.set(key, value);
@@ -3021,7 +3067,7 @@ var init_runtime = __esm({
         }).onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             modelName,
-            (0, import_utils16.isString)(newval) || (0, import_utils16.isNil)(newval) ? newval : void 0
+            (0, import_utils17.isString)(newval) || (0, import_utils17.isNil)(newval) ? newval : void 0
           );
         }).build();
         this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -3065,7 +3111,7 @@ var init_runtime = __esm({
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils16.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils17.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
         const manager = this.modelOptions[modelName];
@@ -3086,15 +3132,15 @@ var init_runtime = __esm({
               const segments = nestedPath.split(".");
               let cursor = cloned;
               for (let i = 0; i < segments.length - 1; i++) {
-                if (!(0, import_utils16.isPlainObject)(cursor)) break;
+                if (!(0, import_utils17.isPlainObject)(cursor)) break;
                 cursor = cursor[segments[i]];
               }
-              if ((0, import_utils16.isPlainObject)(cursor)) {
+              if ((0, import_utils17.isPlainObject)(cursor)) {
                 delete cursor[segments[segments.length - 1]];
               }
               proposedVirtuals = cloned;
             } else {
-              (0, import_utils16.set)(cloned, nestedPath, value);
+              (0, import_utils17.set)(cloned, nestedPath, value);
               proposedVirtuals = cloned;
             }
           }
@@ -3195,7 +3241,7 @@ var init_runtime = __esm({
         manager.onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             dataName,
-            (0, import_utils16.isString)(newval) || (0, import_utils16.isNil)(newval) ? newval : void 0
+            (0, import_utils17.isString)(newval) || (0, import_utils17.isNil)(newval) ? newval : void 0
           );
         }).build();
         return manager;
@@ -3255,20 +3301,20 @@ var init_runtime = __esm({
         const schema = model.schema;
         this.modelRefs[modelName] = buildRefs(schema.tree);
         this.modelSubs[modelName] = buildSubPaths(schema.tree);
-        this.modelAtts[modelName] = (0, import_utils16.keys)(schema.obj);
+        this.modelAtts[modelName] = (0, import_utils17.keys)(schema.obj);
       }
       getModelRef(modelName, refPath) {
         this.ensureModelMeta(modelName);
-        const value = (0, import_utils16.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-        return (0, import_utils16.isString)(value) ? value : null;
+        const value = (0, import_utils17.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+        return (0, import_utils17.isString)(value) ? value : null;
       }
       getModelSub(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils16.get)(this.modelSubs, modelName, []);
+        return (0, import_utils17.get)(this.modelSubs, modelName, []);
       }
       getModelAtt(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils16.get)(this.modelAtts, modelName, []);
+        return (0, import_utils17.get)(this.modelAtts, modelName, []);
       }
     };
     defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -3444,10 +3490,10 @@ var init_options = __esm({
 });
 
 // src/permission.ts
-var import_utils17, Permission, permission_default;
+var import_utils18, Permission, permission_default;
 var init_permission = __esm({
   "src/permission.ts"() {
-    import_utils17 = require("@web-ts-toolkit/utils");
+    import_utils18 = require("@web-ts-toolkit/utils");
     Permission = class {
       constructor(permissions) {
         this.permissions = { ...permissions };
@@ -3463,7 +3509,7 @@ var init_permission = __esm({
         return [permissionOrPermissions].concat(permissions);
       }
       hasKey(permission) {
-        return (0, import_utils17.hasOwn)(this.permissions, permission);
+        return (0, import_utils18.hasOwn)(this.permissions, permission);
       }
       has(permission) {
         return this.permissions[permission] === true;
@@ -3581,7 +3627,6 @@ function normalizePolicy(value, applicability, configuration, targets) {
       const matches = targets.filter((target2) => target2.path === path);
       if (matches.length !== 1) authorizationError(`unused or ambiguous related path: ${path}`);
       const target = matches[0];
-      if (target.kind === "passthrough") authorizationError(`related policy requires a registered target: ${path}`);
       const child = authorizationRecord(entry, `related.${path}`);
       assertAuthorizationKeys(
         child,
@@ -3950,7 +3995,7 @@ function attachIncludeOutput(doc, path, value) {
   const state = stateFor(doc);
   if (!state) throw new Error("Include attachment requires a prepared output row");
   state.attachments.push({ path, value });
-  (0, import_utils18.set)(doc, path, deepIsolateValue(value));
+  (0, import_utils19.set)(doc, path, deepIsolateValue(value));
 }
 function getIncludeSource(doc) {
   return stateFor(doc)?.source ?? doc;
@@ -3965,14 +4010,14 @@ function restoreIncludeOutput(doc, output) {
   for (const { path, value } of attachments) {
     const copy = deepIsolateValue(value);
     if (copy !== null && typeof copy === "object") origins.set(copy, value);
-    (0, import_utils18.set)(output, path, copy);
+    (0, import_utils19.set)(output, path, copy);
   }
   return origins;
 }
-var import_utils18, outputs2, stateFor;
+var import_utils19, outputs2, stateFor;
 var init_include_output = __esm({
   "src/output/include-output.ts"() {
-    import_utils18 = require("@web-ts-toolkit/utils");
+    import_utils19 = require("@web-ts-toolkit/utils");
     init_document_authorization();
     init_document();
     outputs2 = /* @__PURE__ */ new WeakMap();
@@ -4314,10 +4359,10 @@ function planVirtualProjection(args) {
     relatedPlans
   };
 }
-var import_utils20, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
+var import_utils21, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
 var init_virtual_projection = __esm({
   "src/acl/virtual-projection.ts"() {
-    import_utils20 = require("@web-ts-toolkit/utils");
+    import_utils21 = require("@web-ts-toolkit/utils");
     init_query();
     init_field_authorization();
     init_output_projection();
@@ -4325,20 +4370,20 @@ var init_virtual_projection = __esm({
     init_virtual_populate_dependencies();
     init_virtual_descriptor();
     getScopedPermissionSchema = (root, scopePath) => {
-      if (!root || !(0, import_utils20.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils21.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
-      const scoped = (0, import_utils20.get)(root, scopePath.join("."));
-      return (0, import_utils20.isPlainObject)(scoped) ? scoped : null;
+      const scoped = (0, import_utils21.get)(root, scopePath.join("."));
+      return (0, import_utils21.isPlainObject)(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
       if (!raw) return [];
-      if ((0, import_utils20.isArray)(raw)) return [...raw];
-      if ((0, import_utils20.isPlainObject)(raw)) {
+      if ((0, import_utils21.isArray)(raw)) return [...raw];
+      if ((0, import_utils21.isPlainObject)(raw)) {
         const record3 = raw;
         const exact = record3[access];
-        if ((0, import_utils20.isArray)(exact)) return [...exact];
+        if ((0, import_utils21.isArray)(exact)) return [...exact];
         const def = record3.default;
-        if ((0, import_utils20.isArray)(def)) return [...def];
+        if ((0, import_utils21.isArray)(def)) return [...def];
         return [];
       }
       return [];
@@ -4603,18 +4648,25 @@ var init_output_projection = __esm({
 
 // src/acl/model-output-planning.ts
 function getCapturedAuthorizationOption(configuration, key) {
-  const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils21.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
-  return resolveNestedOption((path, fallback) => (0, import_utils21.get)(configuration, path, fallback), key, defaultValue);
+  const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils22.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
+  return resolveNestedOption((path, fallback) => (0, import_utils22.get)(configuration, path, fallback), key, defaultValue);
 }
-function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName)) {
+function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName), globalOptions = runtime.getGlobalOptions()) {
   const model = runtime.getModelInstance(modelName);
   if (!model) return authorizationError(`unknown receiving model: ${modelName}`);
   const virtuals = options.virtuals;
   return copyAuthorizationValue(
     {
       catalog: captureAuthorizationFieldCatalog(model.schema, virtuals, options.documentPermissionField),
-      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(runtime, modelName, options),
-      permissionSchema: options.permissionSchema,
+      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(
+        runtime,
+        modelName,
+        options,
+        globalOptions
+      ),
+      requireOperationAccessForPopulateDependencies: globalOptions.requireOperationAccessForPopulateDependencies !== false,
+      requireOperationAccessForPopulateQueries: globalOptions.requireOperationAccessForPopulateQueries !== false,
+      permissionSchema: options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
       modelPermissionPrefix: options.modelPermissionPrefix,
@@ -4660,10 +4712,10 @@ function planModelOutputForHelper(args) {
     requestedSelect: args.select
   });
 }
-var import_utils21;
+var import_utils22;
 var init_model_output_planning = __esm({
   "src/acl/model-output-planning.ts"() {
-    import_utils21 = require("@web-ts-toolkit/utils");
+    import_utils22 = require("@web-ts-toolkit/utils");
     init_manager();
     init_field_catalog();
     init_authorization_snapshot();
@@ -4675,10 +4727,10 @@ var init_model_output_planning = __esm({
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils22.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils23.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils23.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils23.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4695,11 +4747,11 @@ function optimizeAndFilter(clausesInput) {
   const dedupeKey = (value) => {
     if (value instanceof RegExp) return `regexp:${JSON.stringify([value.source, value.flags])}`;
     if (value instanceof Date) return `date:${value.getTime()}`;
-    if ((0, import_utils22.isArray)(value)) {
+    if ((0, import_utils23.isArray)(value)) {
       const entries = Array.from(value, dedupeKey);
       return entries.every((entry) => entry !== void 0) ? `array:${JSON.stringify(entries)}` : void 0;
     }
-    if ((0, import_utils22.isPlainObject)(value)) {
+    if ((0, import_utils23.isPlainObject)(value)) {
       const entries = Object.keys(value).sort().map((key) => [key, dedupeKey(value[key])]);
       return entries.every(([, entry]) => entry !== void 0) ? `object:${JSON.stringify(entries)}` : void 0;
     }
@@ -4729,7 +4781,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if ((0, import_utils22.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
+      if ((0, import_utils23.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -4740,24 +4792,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils22.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils23.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils22.isPlainObject)(filter2) || (0, import_utils22.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils23.isPlainObject)(filter2) || (0, import_utils23.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils22.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils23.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils22.isString)(idField)) {
+  if ((0, import_utils23.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -4781,7 +4833,7 @@ async function resolveAccessFilterParts({
   }
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
   const baseFilterFn = rows2.mode === "request" ? getOption(`baseFilter.${access}`, null) : null;
-  if (nextFilter !== false && (0, import_utils22.isFunction)(overrideFilterFn)) {
+  if (nextFilter !== false && (0, import_utils23.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   if (nextFilter === false) return { transformed: false, scope: {}, filter: false };
@@ -4789,7 +4841,7 @@ async function resolveAccessFilterParts({
     const scope2 = rows2.mode === "scope" ? rows2.filter : {};
     return { transformed: nextFilter ?? {}, scope: scope2, filter: intersectFilters(nextFilter, scope2) };
   }
-  if (!(0, import_utils22.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
+  if (!(0, import_utils23.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
   const cached = cache.get(cacheKey);
   const reusable = cached?.resolver === baseFilterFn;
   const baseFilter = normalizeFilter(
@@ -4824,34 +4876,34 @@ async function setRequestPermissions(req) {
   if (owner === activeRuntime) return;
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  const permissions = (0, import_utils22.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
-  if ((0, import_utils22.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils22.isArray)(permissions)) req[requestPermissionField] = (0, import_utils22.arrayToRecord)(permissions);
-  else if ((0, import_utils22.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  const permissions = (0, import_utils23.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
+  if ((0, import_utils23.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils23.isArray)(permissions)) req[requestPermissionField] = (0, import_utils23.arrayToRecord)(permissions);
+  else if ((0, import_utils23.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
   else req[requestPermissionField] = {};
   owners.set(requestPermissionField, activeRuntime);
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils22.isBoolean)(routeGuard)) {
+  if ((0, import_utils23.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils22.isString)(routeGuard)) {
+  if ((0, import_utils23.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils22.isArray)(routeGuard)) {
+  if ((0, import_utils23.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils22.isFunction)(routeGuard)) {
+  if ((0, import_utils23.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils22.castArray)(hook);
+  const hooks = (0, import_utils23.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils22.isFunction)(hooks[x])) {
+    if ((0, import_utils23.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -4871,22 +4923,22 @@ async function collectSchemaFields({
   for (let x = 0; x < keys2.length; x++) {
     const key = keys2[x];
     const value = extractScopedOutputRule(permissionSchema, key, access);
-    if ((0, import_utils22.isBoolean)(value)) {
+    if ((0, import_utils23.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils22.isString)(value)) {
+    } else if ((0, import_utils23.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils22.isArray)(value)) {
+    } else if ((0, import_utils23.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils22.isFunction)(value)) {
+    } else if ((0, import_utils23.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
   return fields;
 }
-var import_utils22, import_node_util4, permissionFieldOwners;
+var import_utils23, import_node_util4, permissionFieldOwners;
 var init_core_shared = __esm({
   "src/core-shared.ts"() {
-    import_utils22 = require("@web-ts-toolkit/utils");
+    import_utils23 = require("@web-ts-toolkit/utils");
     import_node_util4 = require("util");
     init_helpers();
     init_options();
@@ -5255,8 +5307,8 @@ function equivalentVirtualPopulatePredicate(left, right) {
   }
   if (Array.isArray(left) || Array.isArray(right))
     return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((entry, index) => equivalentVirtualPopulatePredicate(entry, right[index]));
-  if ((0, import_utils26.isPlainObject)(left) || (0, import_utils26.isPlainObject)(right)) {
-    if (!(0, import_utils26.isPlainObject)(left) || !(0, import_utils26.isPlainObject)(right)) return false;
+  if ((0, import_utils27.isPlainObject)(left) || (0, import_utils27.isPlainObject)(right)) {
+    if (!(0, import_utils27.isPlainObject)(left) || !(0, import_utils27.isPlainObject)(right)) return false;
     const a = Object.keys(left), b = Object.keys(right);
     return a.length === b.length && a.every(
       (key, index) => key === b[index] && equivalentVirtualPopulatePredicate(
@@ -5273,7 +5325,8 @@ function createVirtualPopulateBatch(owner) {
     owner: { ...owner },
     rows: [],
     requests: [],
-    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache()
+    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache(),
+    readGuards: /* @__PURE__ */ new Map()
   });
   return batch;
 }
@@ -5322,7 +5375,12 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
       }
       const record3 = storage(value);
       if (!record3) return;
-      const occurrence = { address, plan: currentPlan, refs: /* @__PURE__ */ new Map(), dependencies: /* @__PURE__ */ new Map() };
+      const occurrence = {
+        address,
+        plan: currentPlan,
+        refs: /* @__PURE__ */ new Map(),
+        dependencies: /* @__PURE__ */ new Map()
+      };
       row.occurrences.set(addressKey(address), occurrence);
       for (const candidate of currentPlan.candidates) {
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
@@ -5388,6 +5446,27 @@ function referenceIds(original) {
   if (!original.present || original.value == null) return [];
   return (Array.isArray(original.value) ? original.value : [original.value]).filter((id) => id != null);
 }
+function targetReadAllowed(state, target) {
+  let pending = state.readGuards.get(target.identity);
+  if (!pending) {
+    const { owner } = state;
+    pending = getRequestWorkState(owner.request, owner.runtime).hookGate.run(
+      () => evaluateRouteGuard(
+        owner.request,
+        owner.permissions,
+        getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
+      )
+    ).then(
+      (allowed) => !!allowed,
+      () => {
+        warn("Virtual populated dependency unavailable", { modelName: target.modelName, category: "policy" });
+        return false;
+      }
+    );
+    state.readGuards.set(target.identity, pending);
+  }
+  return pending;
+}
 function executeVirtualPopulateBatch(batch) {
   const state = batches.get(batch);
   if (!state) throw new Error("Unknown private populate batch");
@@ -5404,14 +5483,8 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          const allowed = await work.hookGate.run(
-            () => evaluateRouteGuard(
-              owner.request,
-              owner.permissions,
-              getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
-            )
-          );
-          if (!allowed) return void 0;
+          if (target.configuration.requireOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+            return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
               req: owner.request,
@@ -5619,12 +5692,12 @@ async function loadVirtualPopulateOutputRows(owner, inputs, plan, publicPopulate
   }
   return output;
 }
-var import_mongoose7, import_node_util5, import_utils26, batches, rows, outputRows, fetchedPublicIdentities, publicViewIdentities, familyRawFetches, addressKey, storage, originalRef, copyOriginalValue, readPolicy, compatible, idKey, logUnavailable;
+var import_mongoose7, import_node_util5, import_utils27, batches, rows, outputRows, fetchedPublicIdentities, publicViewIdentities, familyRawFetches, addressKey, storage, originalRef, copyOriginalValue, readPolicy, compatible, idKey, logUnavailable;
 var init_virtual_populate_execution = __esm({
   "src/acl/virtual-populate-execution.ts"() {
     import_mongoose7 = require("mongoose");
     import_node_util5 = require("util");
-    import_utils26 = require("@web-ts-toolkit/utils");
+    import_utils27 = require("@web-ts-toolkit/utils");
     init_cache();
     init_core_shared();
     init_document();
@@ -5641,7 +5714,7 @@ var init_virtual_populate_execution = __esm({
     publicViewIdentities = /* @__PURE__ */ new WeakMap();
     familyRawFetches = /* @__PURE__ */ new WeakMap();
     addressKey = (address) => JSON.stringify(address);
-    storage = (value) => value instanceof import_mongoose7.Document ? value._doc : (0, import_utils26.isPlainObject)(value) ? value : void 0;
+    storage = (value) => value instanceof import_mongoose7.Document ? value._doc : (0, import_utils27.isPlainObject)(value) ? value : void 0;
     originalRef = (source, key) => {
       const record3 = storage(source);
       return {
@@ -5654,7 +5727,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireOperationAccessForPopulateDependencies === b.binding.configuration.requireOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -5681,7 +5754,7 @@ async function resolveOutputDocumentAuthorization(args) {
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
-      return (0, import_utils27.isPlainObject)(grants) ? grants : {};
+      return (0, import_utils28.isPlainObject)(grants) ? grants : {};
     } catch (error2) {
       warn("docPermissions hook failed; applying empty document permissions", {
         modelName: binding.modelName,
@@ -5796,7 +5869,7 @@ function copyOutputValue(value, plan, path) {
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
     if (input instanceof Map) return visit(Object.fromEntries(input), current);
-    if (!(0, import_utils27.isPlainObject)(input)) return deepIsolateValue(input);
+    if (!(0, import_utils28.isPlainObject)(input)) return deepIsolateValue(input);
     const output = {};
     for (const [key, entry] of Object.entries(input)) {
       const child = `${current}.${key}`;
@@ -5812,25 +5885,21 @@ function copyOutputValue(value, plan, path) {
 }
 function copyAuthorizedReference(value, plan, path) {
   if (Array.isArray(value)) return value.map((entry) => copyAuthorizedReference(entry, plan, path));
-  if (!(0, import_utils27.isPlainObject)(value)) return deepIsolateValue(value);
+  if (!(0, import_utils28.isPlainObject)(value)) return deepIsolateValue(value);
   const handle = getAssociatedDocumentAuthorization(value, plan.authorization);
   if (handle) {
     const copy = deepIsolateValue(value);
     transferDocumentAuthorizationGraph(value, copy);
     return copy;
   }
-  const { relatedTargets } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  if (relatedTargets.some((target) => target.path === path && target.kind === "passthrough")) {
-    return deepIsolateValue(value);
-  }
   return Object.prototype.hasOwnProperty.call(value, "_id") ? deepIsolateValue(value._id) : void 0;
 }
 function retainOutputMetadata(output, source, configuration, scope2) {
   if (scope2.length || configuration.stripPermissionsField) return;
   const parts = (configuration.documentPermissionField ?? "_permissions").split(".");
   let value = source;
-  for (const part of parts) value = (0, import_utils27.isPlainObject)(value) ? value[part] : void 0;
-  if (!(0, import_utils27.isPlainObject)(value)) return;
+  for (const part of parts) value = (0, import_utils28.isPlainObject)(value) ? value[part] : void 0;
+  if (!(0, import_utils28.isPlainObject)(value)) return;
   const keys2 = configuration.exposedDocPermissionKeys;
   const metadata = Object.fromEntries(
     Object.entries(value).filter(
@@ -5840,7 +5909,7 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   const copy = { ...output };
   let target = copy;
   for (const part of parts.slice(0, -1)) {
-    target[part] = (0, import_utils27.isPlainObject)(target[part]) ? { ...target[part] } : {};
+    target[part] = (0, import_utils28.isPlainObject)(target[part]) ? { ...target[part] } : {};
     target = target[part];
   }
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
@@ -5882,7 +5951,7 @@ async function filterExistingOutput(source, plan, handle, associated) {
           for (const entry of value2) values.push(await one(entry) ?? null);
           return values;
         }
-        if (!(0, import_utils27.isPlainObject)(value2)) return value2 === null ? null : void 0;
+        if (!(0, import_utils28.isPlainObject)(value2)) return value2 === null ? null : void 0;
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
@@ -5962,7 +6031,7 @@ async function filterModelOutputForHelper(args) {
   const plan = helperPlan(normalized.authorization, binding);
   if (args.doc == null) return { output: args.doc, fields: [] };
   const source = isolateDocForOutput(args.doc);
-  if (!(0, import_utils27.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
+  if (!(0, import_utils28.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
   const knownOutput = !!args.doc && typeof args.doc === "object" && isKnownAuthorizationOutput(args.doc);
   const handle = await resolveOutputDocumentAuthorization({
     authorization: normalized.authorization,
@@ -5973,10 +6042,10 @@ async function filterModelOutputForHelper(args) {
   });
   return filterExistingOutput(source, plan, handle, false);
 }
-var import_utils27, unresolvedDocuments, owningDocuments;
+var import_utils28, unresolvedDocuments, owningDocuments;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
-    import_utils27 = require("@web-ts-toolkit/utils");
+    import_utils28 = require("@web-ts-toolkit/utils");
     init_permissions_alias();
     init_document();
     init_request_work();
@@ -6073,8 +6142,8 @@ async function finalizeSingleDoc(args, input) {
   const privateRow = args.virtualPopulateRow ?? (original && typeof original === "object" ? getVirtualPopulateRow(original) : void 0);
   const privateAddress = args.virtualPopulateAddress ?? [];
   const isolated = isolateDocForOutput(input);
-  const output = (0, import_utils28.isPlainObject)(isolated) ? isolated : {};
-  if (captured && (0, import_utils28.isPlainObject)(input))
+  const output = (0, import_utils29.isPlainObject)(isolated) ? isolated : {};
+  if (captured && (0, import_utils29.isPlainObject)(input))
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
@@ -6129,7 +6198,7 @@ async function finalizeSingleDoc(args, input) {
       );
       continue;
     }
-    if (captured && !(0, import_utils28.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
+    if (captured && !(0, import_utils29.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
       delete output[containerName];
       continue;
     }
@@ -6153,7 +6222,7 @@ async function finalizeSingleDoc(args, input) {
     const finalizeOneChild = async (rawChild, address) => {
       if (captured && Array.isArray(rawChild))
         return mapWithConcurrencyLimit(rawChild, limit, (entry, index) => finalizeOneChild(entry, [...address, index]));
-      if (!(0, import_utils28.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
+      if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
       if (args.traversal?.finalizeEmbeddedChildren) {
         return args.traversal.finalizeEmbeddedChildren({
           containerName,
@@ -6179,7 +6248,7 @@ async function finalizeSingleDoc(args, input) {
         (entry, index) => finalizeOneChild(entry, [...privateAddress, containerName, index])
       );
       output[containerName] = finalized;
-    } else if ((0, import_utils28.isPlainObject)(rawContainer)) {
+    } else if ((0, import_utils29.isPlainObject)(rawContainer)) {
       output[containerName] = await finalizeOneChild(rawContainer, [
         ...privateAddress,
         containerName
@@ -6191,8 +6260,8 @@ async function finalizeSingleDoc(args, input) {
     let rawRelated;
     let originalRelated;
     try {
-      rawRelated = target.path.includes(".") ? (0, import_utils28.get)(output, target.path) : output[target.path];
-      originalRelated = (0, import_utils28.get)(original, target.path);
+      rawRelated = target.path.includes(".") ? (0, import_utils29.get)(output, target.path) : output[target.path];
+      originalRelated = (0, import_utils29.get)(original, target.path);
     } catch {
       continue;
     }
@@ -6223,7 +6292,7 @@ async function finalizeSingleDoc(args, input) {
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
     const finalizeOneRelated = async (rawChild, originalChild = rawChild) => {
-      if (!(0, import_utils28.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
+      if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
       const childOriginal = getIncludeOriginal(originalChild);
       const childRow = childOriginal && typeof childOriginal === "object" ? getVirtualPopulateRow(childOriginal) : void 0;
@@ -6244,13 +6313,13 @@ async function finalizeSingleDoc(args, input) {
         limit,
         (entry, index) => finalizeOneRelated(entry, Array.isArray(originalRelated) ? originalRelated[index] : void 0)
       );
-    } else if ((0, import_utils28.isPlainObject)(rawRelated)) {
+    } else if ((0, import_utils29.isPlainObject)(rawRelated)) {
       finalized = await finalizeOneRelated(rawRelated, originalRelated);
     } else {
       continue;
     }
     try {
-      if (target.path.includes(".")) (0, import_utils28.set)(output, target.path, finalized);
+      if (target.path.includes(".")) (0, import_utils29.set)(output, target.path, finalized);
       else output[target.path] = finalized;
     } catch {
     }
@@ -6430,10 +6499,10 @@ async function finalizeModelOutputs(args) {
     return finalizeSingleDoc(internal, input);
   });
 }
-var import_utils28, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
+var import_utils29, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
 var init_finalize_model_output = __esm({
   "src/output/finalize-model-output.ts"() {
-    import_utils28 = require("@web-ts-toolkit/utils");
+    import_utils29 = require("@web-ts-toolkit/utils");
     init_document();
     init_concurrency();
     init_request_work();
@@ -6446,20 +6515,20 @@ var init_finalize_model_output = __esm({
     init_field_catalog();
     init_virtual_populate_execution();
     init_include_output();
-    isVirtualContainerValue3 = (value) => (0, import_utils28.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue3 = (value) => (0, import_utils29.isPlainObject)(value) && "sub" in value;
     getScopeVirtualsObject2 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !(0, import_utils28.isPlainObject)(rootVirtuals)) return null;
+      if (!rootVirtuals || !(0, import_utils29.isPlainObject)(rootVirtuals)) return null;
       if (scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!(0, import_utils28.isPlainObject)(current)) return null;
+        if (!(0, import_utils29.isPlainObject)(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue3(container)) return null;
         current = container.sub;
-        if (!(0, import_utils28.isPlainObject)(current)) return null;
+        if (!(0, import_utils29.isPlainObject)(current)) return null;
       }
       return current;
     };
@@ -6472,11 +6541,11 @@ var init_finalize_model_output = __esm({
       return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue3(v)).map(([k]) => k);
     };
     getScopedPermissionSchema2 = (root, scopePath) => {
-      if (!root || !(0, import_utils28.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils29.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
       try {
-        const scoped = (0, import_utils28.get)(root, scopePath.join("."));
-        return (0, import_utils28.isPlainObject)(scoped) ? scoped : null;
+        const scoped = (0, import_utils29.get)(root, scopePath.join("."));
+        return (0, import_utils29.isPlainObject)(scoped) ? scoped : null;
       } catch {
         return null;
       }
@@ -6535,7 +6604,7 @@ var init_finalize_model_output = __esm({
           const grants = await args.sharedGate.run(
             () => hook.call(args.request, isolatedForHook, globalPerms, scopeContext)
           );
-          const normalized = (0, import_utils28.isPlainObject)(grants) ? grants : {};
+          const normalized = (0, import_utils29.isPlainObject)(grants) ? grants : {};
           scopeContext.docPermissions = normalized;
           return normalized;
         }
@@ -6607,40 +6676,20 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils46 = require("@web-ts-toolkit/utils");
+var import_utils47 = require("@web-ts-toolkit/utils");
 
 // src/middleware.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils39 = require("@web-ts-toolkit/utils");
+var import_utils40 = require("@web-ts-toolkit/utils");
 
 // src/core.ts
 init_public_admission();
-var import_utils38 = require("@web-ts-toolkit/utils");
+var import_utils39 = require("@web-ts-toolkit/utils");
 init_options();
-
-// src/meta.ts
-init_runtime();
-init_runtime_context();
-var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
-var getModelRef = (modelName, refPath) => {
-  const direct = getRuntime5().getModelRef(modelName, refPath);
-  if (direct) return direct;
-  if (!refPath.includes(".")) return null;
-  try {
-    const runtime = getRuntime5();
-    const instance = runtime.getModelInstance?.(
-      modelName
-    );
-    const schemaPath = instance?.schema?.path?.(refPath);
-    const ref = schemaPath?.options?.ref ?? schemaPath?.caster?.options?.ref ?? null;
-    return typeof ref === "string" && ref.length > 0 ? ref : null;
-  } catch {
-    return null;
-  }
-};
+init_permission();
 
 // src/services/base.ts
-var import_utils23 = require("@web-ts-toolkit/utils");
+var import_utils24 = require("@web-ts-toolkit/utils");
 init_options();
 init_helpers();
 init_document();
@@ -6766,7 +6815,7 @@ function requestFieldScope(options) {
 init_public_admission();
 
 // src/correlated-includes.ts
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_sort_policy();
 var PARENT_MARKER_KEY = "$parent";
@@ -6779,10 +6828,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return (0, import_utils19.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return (0, import_utils20.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return (0, import_utils19.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return (0, import_utils20.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -6801,12 +6850,12 @@ function containsParentMarkerShape(value) {
   const seen = /* @__PURE__ */ new Set();
   const visit = (current) => {
     if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
-    if ((0, import_utils19.isArray)(current)) {
+    if ((0, import_utils20.isArray)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       return current.some(visit);
     }
-    if ((0, import_utils19.isPlainObject)(current)) {
+    if ((0, import_utils20.isPlainObject)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -6836,7 +6885,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if ((0, import_utils19.isPlainObject)(value)) {
+  if ((0, import_utils20.isPlainObject)(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -6847,7 +6896,7 @@ function scanTemplateValueNode(value, path, issues) {
     scanTemplateObjectEntries(value, path, issues);
     return;
   }
-  if ((0, import_utils19.isArray)(value)) {
+  if ((0, import_utils20.isArray)(value)) {
     value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
   }
 }
@@ -6888,7 +6937,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils19.isArray)(child)) {
+      if (!(0, import_utils20.isArray)(child)) {
         scanTemplateValueNode(child, childPath, issues);
         continue;
       }
@@ -6901,7 +6950,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if ((0, import_utils19.isPlainObject)(clause)) {
+        if ((0, import_utils20.isPlainObject)(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -6912,7 +6961,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter2) {
   const issues = [];
-  if (!(0, import_utils19.isPlainObject)(filter2)) {
+  if (!(0, import_utils20.isPlainObject)(filter2)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -6955,13 +7004,13 @@ function collectFilterReferencePaths(filter2) {
       return;
     }
     if (isEscapedParentRef(value)) return;
-    if ((0, import_utils19.isArray)(value)) {
+    if ((0, import_utils20.isArray)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       value.forEach(visitValue);
       return;
     }
-    if ((0, import_utils19.isPlainObject)(value)) {
+    if ((0, import_utils20.isPlainObject)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       for (const [key, child] of Object.entries(value)) {
@@ -7007,7 +7056,7 @@ function getOwnPathValue(parent, path) {
   return current;
 }
 function cloneSubstitutedValue(value) {
-  if ((0, import_utils19.isPlainObject)(value) || (0, import_utils19.isArray)(value)) return (0, import_utils19.cloneDeep)(value);
+  if ((0, import_utils20.isPlainObject)(value) || (0, import_utils20.isArray)(value)) return (0, import_utils20.cloneDeep)(value);
   return value;
 }
 function literalParentRefObject(path) {
@@ -7048,7 +7097,7 @@ function resolveObjectEntries(obj, parent) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils19.isArray)(child)) {
+      if (!(0, import_utils20.isArray)(child)) {
         out[key] = resolveValueNode(child, parent, false);
         continue;
       }
@@ -7056,7 +7105,7 @@ function resolveObjectEntries(obj, parent) {
         if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
           throw new CorrelatedReferenceError(`Unsupported $parent reference as a direct ${key} clause`);
         }
-        if (!(0, import_utils19.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
+        if (!(0, import_utils20.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
         return resolveObjectEntries(clause, parent);
       });
       continue;
@@ -7085,10 +7134,10 @@ function resolveValueNode(template, parent, bare) {
     }
     const value = getOwnPathValue(parent, path);
     if (value === void 0 || value === null) throw UNRESOLVABLE;
-    if (bare && (0, import_utils19.isPlainObject)(value)) return { $eq: (0, import_utils19.cloneDeep)(value) };
+    if (bare && (0, import_utils20.isPlainObject)(value)) return { $eq: (0, import_utils20.cloneDeep)(value) };
     return cloneSubstitutedValue(value);
   }
-  if ((0, import_utils19.isPlainObject)(template)) {
+  if ((0, import_utils20.isPlainObject)(template)) {
     if (hasMarkerKey(template)) {
       throw new CorrelatedReferenceError(
         'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }'
@@ -7096,7 +7145,7 @@ function resolveValueNode(template, parent, bare) {
     }
     return resolveObjectEntries(template, parent);
   }
-  if ((0, import_utils19.isArray)(template)) {
+  if ((0, import_utils20.isArray)(template)) {
     return template.map((item) => resolveValueNode(item, parent, false));
   }
   return template;
@@ -7130,7 +7179,7 @@ function resolveCorrelatedIdTemplate(id, parent) {
 }
 function resolveCorrelatedFilterTemplate(filter2, parent) {
   try {
-    if (!(0, import_utils19.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
+    if (!(0, import_utils20.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
       throw new CorrelatedReferenceError("Correlated include filter must be an object");
     }
     return { status: "resolved", filter: resolveObjectEntries(filter2, parent) };
@@ -7145,7 +7194,7 @@ function validateExpandedCorrelatedOperands(expanded, limits) {
 var MAX_NESTED_INCLUDE_DEPTH = 10;
 function validateCorrelatedArgsShape(args, op, depth) {
   if (args === void 0) return [];
-  if (!(0, import_utils19.isPlainObject)(args)) return ["Correlated include args must be an object"];
+  if (!(0, import_utils20.isPlainObject)(args)) return ["Correlated include args must be an object"];
   const record3 = args;
   const allowed = op === "list" ? /* @__PURE__ */ new Set(["select", "sort", "skip", "limit", "page", "pageSize", "include"]) : /* @__PURE__ */ new Set(["select", "sort", "include"]);
   for (const key of Object.keys(record3)) {
@@ -7167,7 +7216,7 @@ function validateCorrelatedArgsShape(args, op, depth) {
   return [];
 }
 function validateCorrelatedIncludeShape(entry, depth = 0) {
-  if (!(0, import_utils19.isPlainObject)(entry)) return ["Correlated include must be an object"];
+  if (!(0, import_utils20.isPlainObject)(entry)) return ["Correlated include must be an object"];
   const record3 = entry;
   if (record3.mode !== "correlated") return ['Correlated include mode must be "correlated"'];
   if (typeof record3.model !== "string" || record3.model.length === 0)
@@ -7180,7 +7229,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   if ("localField" in record3 || "foreignField" in record3) {
     return ["Correlated includes must not carry localField or foreignField"];
   }
-  if (record3.options !== void 0 && !((0, import_utils19.isPlainObject)(record3.options) && Object.keys(record3.options).length === 0)) {
+  if (record3.options !== void 0 && !((0, import_utils20.isPlainObject)(record3.options) && Object.keys(record3.options).length === 0)) {
     return ["Correlated include options must be absent or empty"];
   }
   const hasId = record3.id !== void 0;
@@ -7202,7 +7251,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   return validateCorrelatedArgsShape(record3.args, record3.op, depth);
 }
 function isCorrelatedInclude(value) {
-  return (0, import_utils19.isPlainObject)(value) && value.mode === "correlated";
+  return (0, import_utils20.isPlainObject)(value) && value.mode === "correlated";
 }
 
 // src/services/base.ts
@@ -7269,6 +7318,11 @@ function modelServiceOptions(receiver, read) {
   if (call?.receiver !== receiver) return read();
   return call.options ??= read();
 }
+function modelServiceGlobalOptions(receiver, runtime) {
+  const call = dispatch.getStore();
+  if (call?.receiver !== receiver) return runtime.getGlobalOptions();
+  return call.globalOptions ??= runtime.getGlobalOptions();
+}
 
 // src/services/base.ts
 init_request_work();
@@ -7421,9 +7475,31 @@ function castCountGroups(input, values) {
 // src/services/base.ts
 init_service_authorization();
 
+// src/meta.ts
+init_runtime();
+init_runtime_context();
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
+var getModelRef = (modelName, refPath, runtime = getRuntime5()) => {
+  const direct = runtime.getModelRef(modelName, refPath);
+  if (direct) return direct;
+  if (!refPath.includes(".")) return null;
+  try {
+    const instance = runtime.getModelInstance?.(
+      modelName
+    );
+    const schemaPath = instance?.schema?.path?.(refPath);
+    const element = schemaPath?.$embeddedSchemaType ?? schemaPath?.embeddedSchemaType ?? schemaPath?.caster;
+    const ref = schemaPath?.options?.ref ?? element?.options?.ref ?? null;
+    return typeof ref === "string" && ref.length > 0 ? ref : null;
+  } catch {
+    return null;
+  }
+};
+
 // src/acl/related-execution.ts
 init_public_admission();
 init_model_output_planning();
+init_populate_target_configuration();
 init_authorization_snapshot();
 
 // src/acl/service-execution.ts
@@ -7709,7 +7785,7 @@ function staticObjectIdReference(runtime, source, path, target) {
   const scalar = type?.instance === "Array" ? type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster : type;
   return scalar?.instance === "ObjectId" && (type?.options?.ref ?? scalar.options?.ref) === target && type?.options?.refPath === void 0 && scalar.options?.refPath === void 0;
 }
-function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
+function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalOptions = runtime.getGlobalOptions()) {
   if (depth > 32) authorizationError("related descriptor depth exceeded");
   assertPublicAdmission(args.populate, "populate");
   assertPublicAdmission(args.include, "include");
@@ -7718,21 +7794,20 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
   for (const entry of entries(args.populate)) {
     const path = typeof entry === "string" ? entry : entry.path;
     if (typeof entry !== "string") assertPopulateAccess(entry.access);
-    const model = getModelRef(modelName, path);
-    if (model && runtime.hasModel(model))
+    const model = getModelRef(modelName, path, runtime);
+    if (model) {
+      const target = capturePopulateTargetConfiguration(runtime, model, `${modelName}.${path}`);
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, target.options, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !runtime.getGlobalOption("requireRegisteredPopulateModels", true)) {
-      targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
     if (!runtime.hasModel(entry.model)) authorizationError(`Model ${entry.model} not found`);
-    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model);
+    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model, void 0, globalOptions);
     const queryIntent = entry.op === "count" ? void 0 : captureModelServiceIntent(
       {
         defaults: configuration.defaults ?? {},
@@ -7758,7 +7833,13 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
       configuration,
       queryIntent,
       operationGuard: runtime.getModelOption(entry.model, `operationAccess.${entry.op}`),
-      relatedTargets: captureRelatedTargets(runtime, entry.model, queryIntent?.args ?? entry.args ?? {}, depth + 1)
+      relatedTargets: captureRelatedTargets(
+        runtime,
+        entry.model,
+        queryIntent?.args ?? entry.args ?? {},
+        depth + 1,
+        globalOptions
+      )
     });
   }
   if (new Set(targets.map((target) => target.path)).size !== targets.length)
@@ -7907,20 +7988,20 @@ var copyAuthorizedOutput = (value) => {
   transferDocumentAuthorizationGraph(value, copy);
   return copy;
 };
-var isVirtualContainerValueForGuard = (value) => (0, import_utils23.isPlainObject)(value) && "sub" in value;
+var isVirtualContainerValueForGuard = (value) => (0, import_utils24.isPlainObject)(value) && "sub" in value;
 var getScopeVirtualsForGuard = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !(0, import_utils23.isPlainObject)(rootVirtuals)) return null;
+  if (!rootVirtuals || !(0, import_utils24.isPlainObject)(rootVirtuals)) return null;
   if (scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!(0, import_utils23.isPlainObject)(current)) return null;
+    if (!(0, import_utils24.isPlainObject)(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValueForGuard(container)) return null;
     current = container.sub;
-    if (!(0, import_utils23.isPlainObject)(current)) return null;
+    if (!(0, import_utils24.isPlainObject)(current)) return null;
   }
   return current;
 };
@@ -7986,7 +8067,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
       for (const entry of value) stripScope(entry, currentScope);
       return;
     }
-    if (!(0, import_utils23.isPlainObject)(value)) return;
+    if (!(0, import_utils24.isPlainObject)(value)) return;
     const record3 = value;
     const leaves = getScopeVirtualLeafNames(snapshot, currentScope);
     for (const leaf of leaves) {
@@ -7999,7 +8080,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
     for (const key of Object.keys(record3)) {
       if (leaves.has(key) || containers.has(key)) continue;
       const child = record3[key];
-      if (Array.isArray(child) || (0, import_utils23.isPlainObject)(child)) {
+      if (Array.isArray(child) || (0, import_utils24.isPlainObject)(child)) {
         stripScope(child, currentScope);
       }
     }
@@ -8011,7 +8092,7 @@ var LOGICAL_FILTER_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
 var isOperatorKey = (key) => key.startsWith("$");
 var REMOVED_VIRTUAL_FILTER = /* @__PURE__ */ Symbol("removed virtual filter clause");
 var rewriteFilterObject = (value, visit) => {
-  if (!(0, import_utils23.isPlainObject)(value)) return value;
+  if (!(0, import_utils24.isPlainObject)(value)) return value;
   let changed = false;
   const entries = [];
   for (const [key, child] of Object.entries(value)) {
@@ -8042,7 +8123,7 @@ var resolveVirtualFilterField = (path, scope2) => {
     if (!Object.hasOwn(scope2, segment) || scope2[segment] === void 0) return null;
     const definition = scope2[segment];
     if (!isVirtualContainerValueForGuard(definition)) return REMOVED_VIRTUAL_FILTER;
-    scope2 = (0, import_utils23.isPlainObject)(definition.sub) ? definition.sub : null;
+    scope2 = (0, import_utils24.isPlainObject)(definition.sub) ? definition.sub : null;
     inContainer = true;
   }
   return scope2;
@@ -8054,7 +8135,7 @@ var stripVirtualFilterOperator = (key, value, scope2) => {
   }
   if (key === "$all") {
     return rewriteFilterClauses(value, (entry) => {
-      if (!(0, import_utils23.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
+      if (!(0, import_utils24.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
       return rewriteFilterObject(entry, (operator, operand) => stripVirtualFilterOperator(operator, operand, scope2));
     });
   }
@@ -8069,7 +8150,7 @@ var stripVirtualFilterQuery = (value, scope2, element = false) => {
     if (isOperatorKey(key)) return element ? stripVirtualFilterOperator(key, child, scope2) : child;
     const fieldScope = resolveVirtualFilterField(key, scope2);
     if (fieldScope === REMOVED_VIRTUAL_FILTER) return REMOVED_VIRTUAL_FILTER;
-    if (!fieldScope || !(0, import_utils23.isPlainObject)(child)) return child;
+    if (!fieldScope || !(0, import_utils24.isPlainObject)(child)) return child;
     if (Object.keys(child).some(isOperatorKey)) {
       return rewriteFilterObject(
         child,
@@ -8091,9 +8172,9 @@ var stripSubVirtualKeysFromFilter = (filter2, snapshot, sub) => {
 function getCorrelatedTemplateDepth(includes) {
   let max = 0;
   const visit = (entries, depth) => {
-    const list = (0, import_utils23.castArray)(entries).filter(Boolean);
+    const list = (0, import_utils24.castArray)(entries).filter(Boolean);
     for (const entry of list) {
-      if (!(0, import_utils23.isPlainObject)(entry)) continue;
+      if (!(0, import_utils24.isPlainObject)(entry)) continue;
       max = Math.max(max, depth);
       const nested = entry.args?.include;
       if (nested !== void 0) {
@@ -8118,11 +8199,11 @@ function validateClientFilter(filter2) {
   }
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils23.isArray)(value)) {
+    if ((0, import_utils24.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils23.isPlainObject)(value)) return;
+    if (!(0, import_utils24.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -8327,7 +8408,7 @@ var Base = class {
   }
   processInclude(include, authorization) {
     assertPublicAdmission(include, "include");
-    const items = (0, import_utils23.compact)((0, import_utils23.castArray)(include));
+    const items = (0, import_utils24.compact)((0, import_utils24.castArray)(include));
     const legacy = [];
     const correlated = [];
     const correlatedReferenceFields = [];
@@ -8363,23 +8444,23 @@ var Base = class {
     else this.assertIncludeOutputPaths([...legacy, ...correlated]);
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils23.forEach)(legacy, (inc) => {
+    (0, import_utils24.forEach)(legacy, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils23.uniq)((0, import_utils23.compact)(includeLocalFields));
-    includePaths = (0, import_utils23.uniq)((0, import_utils23.compact)(includePaths));
+    includeLocalFields = (0, import_utils24.uniq)((0, import_utils24.compact)(includeLocalFields));
+    includePaths = (0, import_utils24.uniq)((0, import_utils24.compact)(includePaths));
     return {
       includes: legacy,
       correlatedIncludes: correlated,
       includeLocalFields,
       includePaths,
-      correlatedReferenceFields: (0, import_utils23.uniq)((0, import_utils23.compact)(correlatedReferenceFields))
+      correlatedReferenceFields: (0, import_utils24.uniq)((0, import_utils24.compact)(correlatedReferenceFields))
     };
   }
   validateIncludeOutputPath(path, modelName, configuration) {
     const permissionField = configuration ? configuration.documentPermissionField ?? "_permissions" : getModelOption(modelName, "documentPermissionField");
-    if ((0, import_utils23.get)((0, import_utils23.set)({}, path, true), permissionField) !== void 0 || (0, import_utils23.get)((0, import_utils23.set)({}, permissionField, true), path) !== void 0) {
+    if ((0, import_utils24.get)((0, import_utils24.set)({}, path, true), permissionField) !== void 0 || (0, import_utils24.get)((0, import_utils24.set)({}, permissionField, true), path) !== void 0) {
       this.throwClientRequestError(
         "bad_request" /* BadRequest */,
         `Include output path ${path} overlaps document permission field ${permissionField} on model ${modelName}`
@@ -8404,9 +8485,9 @@ var Base = class {
       const walk = (node, prefix) => {
         for (const [key, value] of Object.entries(node)) {
           if (value === void 0) continue;
-          if ((0, import_utils23.isPlainObject)(value) && "sub" in value) {
+          if ((0, import_utils24.isPlainObject)(value) && "sub" in value) {
             const sub = value.sub;
-            if ((0, import_utils23.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
+            if ((0, import_utils24.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
             continue;
           }
           out.push(prefix ? `${prefix}.${key}` : key);
@@ -8459,7 +8540,7 @@ var Base = class {
         this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
       }
       for (const entry of entries) {
-        if (!(0, import_utils23.isPlainObject)(entry)) continue;
+        if (!(0, import_utils24.isPlainObject)(entry)) continue;
         const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
         if (models.has(modelName)) continue;
         models.add(modelName);
@@ -8472,7 +8553,7 @@ var Base = class {
           const target = targets?.find((target2) => target2.path === entry.path);
           if (nested)
             pending.push({
-              entries: (0, import_utils23.compact)((0, import_utils23.castArray)(nested)),
+              entries: (0, import_utils24.compact)((0, import_utils24.castArray)(nested)),
               modelName: entry.model,
               configuration: target?.configuration,
               targets: target?.relatedTargets
@@ -8482,7 +8563,7 @@ var Base = class {
     }
   }
   getForeignKeyValues(value) {
-    return (0, import_utils23.flatten)((0, import_utils23.castArray)(value));
+    return (0, import_utils24.flatten)((0, import_utils24.castArray)(value));
   }
   getForeignKey(value) {
     return String(value);
@@ -8490,7 +8571,7 @@ var Base = class {
   buildForeignKeyIndex(rows2, foreignField) {
     const index = /* @__PURE__ */ new Map();
     for (const row of rows2) {
-      for (const value of this.getForeignKeyValues((0, import_utils23.get)(row, foreignField))) {
+      for (const value of this.getForeignKeyValues((0, import_utils24.get)(row, foreignField))) {
         const key = this.getForeignKey(value);
         const values = index.get(key);
         if (values) values.push(row);
@@ -8526,9 +8607,9 @@ var Base = class {
   async includeDocs(docs, include, parentAuthorization) {
     assertPublicAdmission(include, "include");
     if (!include) return docs;
-    const includes = (0, import_utils23.compact)((0, import_utils23.castArray)(include));
+    const includes = (0, import_utils24.compact)((0, import_utils24.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils23.isArray)(docs);
+    const isSingle = !(0, import_utils24.isArray)(docs);
     let docList = (isSingle ? [docs] : docs).map(prepareIncludeOutput);
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
@@ -8558,7 +8639,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, "read", path, parentAuthorization);
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils23.get)(doc, localField);
+      const localValue = (0, import_utils24.get)(doc, localField);
       const execution = this.relatedExecution(svc, include, parentAuthorization);
       const prepared = await prepareModelQuery(
         svc,
@@ -8593,15 +8674,15 @@ var Base = class {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
     const svc = await this.getAuthorizedTargetService(model, op, path, parentAuthorization);
     const includeLocalValues = [];
-    (0, import_utils23.forEach)(docs, (doc) => {
-      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils23.get)(doc, localField)));
+    (0, import_utils24.forEach)(docs, (doc) => {
+      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils24.get)(doc, localField)));
     });
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
       execution,
       { kind: "client-read", filter: _filters ?? {} },
-      { [foreignField]: { $in: (0, import_utils23.flatten)(includeLocalValues) } },
+      { [foreignField]: { $in: (0, import_utils24.flatten)(includeLocalValues) } },
       true
     );
     const trustedArgs = this.sanitizeIncludeArgs(args, "list");
@@ -8644,7 +8725,7 @@ var Base = class {
     }
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const matches = this.getIndexedMatches(index, (0, import_utils23.get)(doc, localField));
+      const matches = this.getIndexedMatches(index, (0, import_utils24.get)(doc, localField));
       const isolated = matches.map((m) => copyAuthorizedOutput(m));
       attachIncludeOutput(doc, path, op === "list" ? isolated : isolated[0]);
     }
@@ -8653,7 +8734,7 @@ var Base = class {
   async includeDocsCount(docs, include, parentAuthorization) {
     const { model, path, localField, foreignField, filter: _filters } = include;
     const svc = await this.getAuthorizedTargetService(model, "count", path, parentAuthorization);
-    const groups = prepareCountGroups(docs, (doc) => (0, import_utils23.get)(doc, localField));
+    const groups = prepareCountGroups(docs, (doc) => (0, import_utils24.get)(doc, localField));
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
@@ -8707,7 +8788,7 @@ var Base = class {
     }
     const state = this.getCorrelatedExecState();
     docs = docs.map(prepareIncludeOutput);
-    const resolvedSnapshots = snapshots2 ?? docs.map((doc) => (0, import_utils23.cloneDeep)(toObject(getIncludeSource(doc))));
+    const resolvedSnapshots = snapshots2 ?? docs.map((doc) => (0, import_utils24.cloneDeep)(toObject(getIncludeSource(doc))));
     for (const include of correlatedIncludes) {
       switch (include.op) {
         case "read":
@@ -9056,10 +9137,10 @@ var Base = class {
     }
     let ret = result2.data;
     if (sqOptions.path) {
-      ret = (0, import_utils23.isArray)(ret) ? (0, import_utils23.flatten)(ret.map((v) => (0, import_utils23.get)(v, sqOptions.path))) : (0, import_utils23.get)(ret, sqOptions.path);
+      ret = (0, import_utils24.isArray)(ret) ? (0, import_utils24.flatten)(ret.map((v) => (0, import_utils24.get)(v, sqOptions.path))) : (0, import_utils24.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils23.compact)((0, import_utils23.castArray)(ret));
+      ret = (0, import_utils24.compact)((0, import_utils24.castArray)(ret));
     }
     return ret;
   }
@@ -9071,11 +9152,11 @@ var Base = class {
 };
 
 // src/services/service.ts
-var import_utils34 = require("@web-ts-toolkit/utils");
+var import_utils35 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 
 // src/model.ts
-var import_utils24 = require("@web-ts-toolkit/utils");
+var import_utils25 = require("@web-ts-toolkit/utils");
 init_runtime_context();
 init_runtime();
 function admitModelPersistence(adapter, scheduler) {
@@ -9151,7 +9232,7 @@ var Model = class {
   }
   /** Cast a copy using this model's query schema/setters, without executing query middleware or persistence. */
   castFilter(filter2) {
-    const query = this.mongooseModel.countDocuments((0, import_utils24.cloneDeep)(filter2));
+    const query = this.mongooseModel.countDocuments((0, import_utils25.cloneDeep)(filter2));
     return query.cast(this.mongooseModel);
   }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
@@ -9165,7 +9246,7 @@ var Model = class {
 var model_default = Model;
 
 // src/acl/distinct-field-authorization.ts
-var import_utils25 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 init_field_authorization();
 init_field_catalog();
 var schemaVariants = (schema) => Object.values(schema.discriminators ?? {});
@@ -9247,8 +9328,8 @@ function isDistinctFieldAuthorized(args) {
       if (path !== field && !path.startsWith(`${field}.`) && !field.startsWith(`${path}.`)) continue;
       if (path.startsWith(`${field}.`) && (!eligible(path) || !schemaShape(schema, path) || !granted(path)))
         return false;
-      if ((0, import_utils25.isPlainObject)(raw) && raw.sub !== void 0) {
-        if (!(0, import_utils25.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
+      if ((0, import_utils26.isPlainObject)(raw) && raw.sub !== void 0) {
+        if (!(0, import_utils26.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
       }
     }
     return true;
@@ -9330,7 +9411,9 @@ function prepareSubdocumentOutput(service, sub, operation, virtualAccess, output
     captureRelatedTargets(
       getServiceExecutors(service).binding().runtime,
       service.getServiceModelName(),
-      { populate }
+      { populate },
+      0,
+      configuration
     ),
     void 0,
     configuration,
@@ -9423,7 +9506,7 @@ init_document();
 init_populate_target();
 
 // src/helpers/apply-update.ts
-var import_utils29 = require("@web-ts-toolkit/utils");
+var import_utils30 = require("@web-ts-toolkit/utils");
 init_lib();
 function applyUpdate(target, data, allowedFields) {
   const wholeFields = /* @__PURE__ */ new Set();
@@ -9439,17 +9522,17 @@ function applyUpdate(target, data, allowedFields) {
     }
   };
   for (const field of allowedFields) {
-    collectBoundary((0, import_utils29.set)({}, field, true));
+    collectBoundary((0, import_utils30.set)({}, field, true));
   }
   const apply = (values, prefix = "") => {
     for (const [key, value] of Object.entries(values)) {
       const path = prefix ? `${prefix}.${key}` : key;
-      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils29.isPlainObject)(value) || Array.isArray(value))) {
+      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils30.isPlainObject)(value) || Array.isArray(value))) {
         apply(value, path);
       } else if (isDocument2(target)) {
         target.set(path, value);
       } else {
-        (0, import_utils29.set)(target, path, value);
+        (0, import_utils30.set)(target, path, value);
       }
     }
   };
@@ -9457,7 +9540,7 @@ function applyUpdate(target, data, allowedFields) {
 }
 
 // src/acl/model-input-admission.ts
-var import_utils31 = require("@web-ts-toolkit/utils");
+var import_utils32 = require("@web-ts-toolkit/utils");
 var import_mongoose8 = require("mongoose");
 init_document();
 init_request_work();
@@ -9465,7 +9548,7 @@ init_logger_helpers();
 init_request_complexity();
 
 // src/acl/select-resolution.ts
-var import_utils30 = require("@web-ts-toolkit/utils");
+var import_utils31 = require("@web-ts-toolkit/utils");
 init_core_shared();
 init_helpers();
 async function collectAllowedFieldsForRequest({
@@ -9539,15 +9622,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils30.difference)(fields, normalizedSelect);
+        fields = (0, import_utils31.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils30.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils31.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(strippedAlways);
   }
-  return (0, import_utils30.intersection)(normalizedSelect, fields);
+  return (0, import_utils31.intersection)(normalizedSelect, fields);
 }
 function stripVirtuals(fields, virtualNames) {
   const set13 = virtualNames instanceof Set ? virtualNames : new Set(virtualNames ?? []);
@@ -9578,7 +9661,7 @@ init_field_catalog();
 init_service_authorization();
 var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var inside = (path, root) => path === root || path.startsWith(`${root}.`);
-var record2 = (value) => (0, import_utils31.isPlainObject)(value);
+var record2 = (value) => (0, import_utils32.isPlainObject)(value);
 function inputValue(value) {
   if (typeof value === "function" || typeof value === "symbol") {
     authorizationError("input values must be persisted data, not functions or symbols");
@@ -9647,7 +9730,7 @@ function requestBoundaries(fields) {
       else visit(value, path);
     }
   };
-  for (const field of fields) visit((0, import_utils31.set)({}, field, true));
+  for (const field of fields) visit((0, import_utils32.set)({}, field, true));
   return [...new Set(result2)];
 }
 function ownValue(data, parts) {
@@ -9777,7 +9860,7 @@ function admitModelInput(args) {
     if (forbidden(catalog, path, requested)) continue;
     const supplied = ownValue(data, parts);
     if (!supplied) continue;
-    (0, import_utils31.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
+    (0, import_utils32.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
     selected.push(field);
   }
   return { allowedData, allowedFields };
@@ -9789,7 +9872,7 @@ async function requestInputFields(args) {
   const prefix = configuration.modelPermissionPrefix ?? "";
   return collectModelRequestFields({
     req: args.binding.request,
-    permissionSchema: args.scopePath ? (0, import_utils31.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
+    permissionSchema: args.scopePath ? (0, import_utils32.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
     access: args.access,
     permissions,
     grants,
@@ -9833,13 +9916,13 @@ init_logger_helpers();
 init_lib();
 
 // src/services/model-subdocument-service.ts
-var import_utils33 = require("@web-ts-toolkit/utils");
+var import_utils34 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_public_admission();
 
 // src/acl/subdocument-authorization.ts
-var import_utils32 = require("@web-ts-toolkit/utils");
+var import_utils33 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_core_shared();
@@ -10028,8 +10111,8 @@ async function subdocumentGateAllowed(service, gate) {
   let guard2;
   if (access.startsWith("subs.")) {
     const [, sub, op] = access.split(".");
-    guard2 = (0, import_utils32.get)(configuration, `operationAccess.${access}`);
-    if (guard2 === void 0) guard2 = (0, import_utils32.get)(configuration, `operationAccess.subs.${sub}`);
+    guard2 = (0, import_utils33.get)(configuration, `operationAccess.${access}`);
+    if (guard2 === void 0) guard2 = (0, import_utils33.get)(configuration, `operationAccess.subs.${sub}`);
     if (guard2 === void 0) guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${op}`);
   } else guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${access}`);
   return evaluateRouteGuard(
@@ -10160,7 +10243,7 @@ async function visibleMutationRows(service, call, parentId, rows2) {
     const read = await subdocumentRows(service, visibility.child, selected, selected, call.sub);
     const list = visibility.list ? await subdocumentRows(service, visibility.list, {}, {}, call.sub) : {};
     if (read === false || list === false) return [];
-    const visible = filterCollection((0, import_utils33.get)(parent, call.sub), intersectFilters(read, list));
+    const visible = filterCollection((0, import_utils34.get)(parent, call.sub), intersectFilters(read, list));
     return await finalizeSubdocumentRows(service, call.output, parent, visible);
   } catch {
     return [];
@@ -10185,7 +10268,7 @@ async function listSub(service, id, sub, options) {
       populate: []
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const rows2 = filterCollection((0, import_utils33.get)(parent, sub), childFilter);
+    const rows2 = filterCollection((0, import_utils34.get)(parent, sub), childFilter);
     const data = await finalizeSubdocumentRows(service, call.output, parent, rows2);
     return { success: true, kind: "list", code: "success" /* Success */, data, count: data.length };
   });
@@ -10209,7 +10292,7 @@ async function readSub(service, id, sub, subId, options) {
     });
     if (!parent) return denied2("not_found" /* NotFound */);
     const row = findElement(
-      (0, import_utils33.get)(capture ? parent : copySubdocumentParent(parent), sub),
+      (0, import_utils34.get)(capture ? parent : copySubdocumentParent(parent), sub),
       childFilter
     );
     if (!row) return denied2("not_found" /* NotFound */);
@@ -10230,7 +10313,7 @@ async function updateSub(service, persist, id, sub, subId, data, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils33.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils34.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     const original = isolateDocForOutput(row);
     const admit = await inputAdmission(service, call, parent);
@@ -10257,7 +10340,7 @@ async function bulkUpdateSub(service, persist, id, sub, data, options) {
     const selected = { _id: { $in: data.map((row) => row._id) } };
     const filter2 = await subdocumentRows(service, call.child, selected, selected, sub);
     if (filter2 === false) return denied2();
-    const rows2 = filterCollection((0, import_utils33.get)(parent, sub), filter2);
+    const rows2 = filterCollection((0, import_utils34.get)(parent, sub), filter2);
     const originals = rows2.map((row) => isolateDocForOutput(row));
     const admit = await inputAdmission(service, call, parent);
     for (const [index, row] of rows2.entries()) {
@@ -10286,7 +10369,7 @@ async function createSub(service, persist, id, sub, data, options) {
     const lookup = await mutationParent(service, id, call);
     if ("error" in lookup) return lookup.error;
     const { parent } = lookup;
-    const rows2 = (0, import_utils33.get)(parent, sub);
+    const rows2 = (0, import_utils34.get)(parent, sub);
     const admit = await inputAdmission(service, call, parent);
     const allowed = (Array.isArray(data) ? data : [data]).map((row) => admit(row).allowedData);
     if (addFirst) rows2.unshift(...allowed);
@@ -10307,7 +10390,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils33.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils34.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     await ("deleteOne" in row ? row.deleteOne?.() : row.remove?.());
     await persist(() => parent.save());
@@ -10369,10 +10452,12 @@ var Service = class extends Base {
         model: this.model.mongooseModel,
         modelName: this.modelName
       }),
-      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName, {
-        ...this.options,
-        defaults: this.defaults
-      }) : { catalog: { paths: [] }, ...this.options },
+      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(
+        this.requestRuntime,
+        this.modelName,
+        { ...this.options, defaults: this.defaults },
+        modelServiceGlobalOptions(this, this.requestRuntime)
+      ) : { catalog: { paths: [] }, ...this.options },
       permissions: () => this.requestCore.getPermissions?.() ?? new permission_default({}),
       parse: (filter2) => this.parseClientData(filter2, this.getCorrelatedExecState().scheduler),
       validate: (filter2, expanded) => {
@@ -10619,20 +10704,20 @@ var Service = class extends Base {
     const field = configuration.documentPermissionField ?? "_permissions";
     unsetDocPath(output, field);
     if (!configuration.stripPermissionsField) {
-      (0, import_utils34.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
+      (0, import_utils35.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
       if (args.includeFieldPermissions && !configuration.disableFieldPermissions) {
         const rowAccess = this.asServiceHookContext(context).fieldPermissionAccess ?? await this.getFieldPermissionAccess([snapshot._id]);
         const id = String(snapshot._id);
         const views = rowAccess.readIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "read") : [];
         const edits = rowAccess.updateIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "update") : [];
         const map2 = (paths) => paths.length ? Object.fromEntries(paths.map((path) => [path, true])) : { $: "_" };
-        (0, import_utils34.set)(output, `${field}._view`, map2(views));
-        (0, import_utils34.set)(output, `${field}._edit`, map2(edits));
-      } else if (!args.includePermissions) (0, import_utils34.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
+        (0, import_utils35.set)(output, `${field}._view`, map2(views));
+        (0, import_utils35.set)(output, `${field}._edit`, map2(edits));
+      } else if (!args.includePermissions) (0, import_utils35.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
       const exposed = configuration.exposedDocPermissionKeys;
       if (exposed) {
-        const metadata = (0, import_utils34.get)(output, field);
-        (0, import_utils34.set)(
+        const metadata = (0, import_utils35.get)(output, field);
+        (0, import_utils35.set)(
           output,
           field,
           Object.fromEntries(
@@ -10893,7 +10978,7 @@ var Service = class extends Base {
     return docs.map((doc) => {
       try {
         const plain = toObject(doc);
-        const val = (0, import_utils34.get)(plain, associationField);
+        const val = (0, import_utils35.get)(plain, associationField);
         return deepIsolateValue(val);
       } catch {
         return void 0;
@@ -10901,12 +10986,13 @@ var Service = class extends Base {
     });
   }
   captureRelated(args, defaults) {
+    const globalOptions = modelServiceGlobalOptions(this, this.requestRuntime);
     const effective = { populate: args?.populate ?? defaults?.populate, include: args?.include ?? defaults?.include };
     if (effective.include) {
       const processed = this.processInclude(effective.include);
       effective.include = [...processed.includes, ...processed.correlatedIncludes];
     }
-    return captureRelatedTargets(this.requestRuntime, this.modelName, effective);
+    return captureRelatedTargets(this.requestRuntime, this.modelName, effective, 0, globalOptions);
   }
   /** Canonical population uses the target's retained policy for both fetch and output. */
   async genExecutionPopulate(execution, access, populate) {
@@ -10928,14 +11014,9 @@ var Service = class extends Base {
         modelPermissionPrefix: captured.configuration.modelPermissionPrefix
       });
       if (sourceState === "denied") continue;
-      const modelName = getModelRef(this.modelName, descriptor.path);
+      const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
+      const modelName = target?.modelName;
       if (!modelName) continue;
-      if (!this.requestRuntime.hasModel(modelName)) {
-        if (captured.relatedTargets.some((target) => target.path === descriptor.path && target.kind === "passthrough")) {
-          result2.push({ path: descriptor.path, select: descriptor.select });
-        }
-        continue;
-      }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
       const svc = this.requestCore.getPublicService(modelName);
       const child = createRelatedExecution(
@@ -10954,7 +11035,7 @@ var Service = class extends Base {
       if (isExecutionRowDenied(svc, child)) continue;
       const childState = readServiceExecution(svc, child);
       const targetConfiguration = readServiceAuthorization(childState.authorization, childState.binding).configuration;
-      if (policy?.operation.mode !== "grant" && !await this.hookGate.run(
+      if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && policy?.operation.mode !== "grant" && !await this.hookGate.run(
         () => evaluateRouteGuard(
           this.req,
           getAuthorizationPermissions(childState.authorization, childState.binding),
@@ -10986,7 +11067,7 @@ var Service = class extends Base {
           schema: childState.binding.model.schema,
           configuration: targetConfiguration,
           requestRead: targetAccess === "read" && policy?.operation.mode !== "grant" && readServiceAuthorization(childState.authorization, childState.binding).authorization.rows.mode === "request",
-          staticObjectIdReference: captured.relatedTargets.find((target) => target.path === descriptor.path)?.staticObjectIdReference
+          staticObjectIdReference: captured.relatedTargets.find((target2) => target2.path === descriptor.path)?.staticObjectIdReference
         }
       });
       result2.push(ret);
@@ -11006,7 +11087,7 @@ var Service = class extends Base {
     if (this.isScalarPopulateValue(rawTarget)) return rawTarget;
     const isDoc = (() => {
       try {
-        if ((0, import_utils34.isPlainObject)(rawTarget)) return true;
+        if ((0, import_utils35.isPlainObject)(rawTarget)) return true;
         const maybe = rawTarget;
         if (maybe && typeof maybe === "object" && "_doc" in maybe) return true;
         if (maybe && typeof maybe.toObject === "function") return true;
@@ -11030,15 +11111,13 @@ var Service = class extends Base {
       transferDocumentAuthorizationGraph(source, copy2);
       return copy2;
     }
-    let targetMongooseModel;
-    try {
-      const inst = this.requestRuntime.getModelInstance?.(
-        meta.targetModelName
-      );
-      void inst;
-      targetMongooseModel = inst;
-    } catch {
-      targetMongooseModel = parentContext.mongooseModel;
+    let targetMongooseModel = meta.fetchBinding?.model;
+    if (!targetMongooseModel) {
+      try {
+        targetMongooseModel = this.requestRuntime.getModelInstance(meta.targetModelName);
+      } catch {
+        targetMongooseModel = parentContext.mongooseModel;
+      }
     }
     const targetContext = {
       mongooseModel: targetMongooseModel ?? parentContext.mongooseModel,
@@ -11096,7 +11175,7 @@ var Service = class extends Base {
       child = getDocValue(current, key);
       if (child === void 0) {
         try {
-          child = (0, import_utils34.get)(current, key);
+          child = (0, import_utils35.get)(current, key);
         } catch {
           return;
         }
@@ -11331,7 +11410,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    const correlatedSnapshots = [(0, import_utils34.cloneDeep)(toObject(doc))];
+    const correlatedSnapshots = [(0, import_utils35.cloneDeep)(toObject(doc))];
     try {
       doc = await this.includeDocs(doc, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -11513,7 +11592,7 @@ var Service = class extends Base {
     const findAssociationField = this.getAssociationFieldFromOptions(options);
     const withAssocSelect = findAssociationField && !finalSelect.includes(findAssociationField) ? [...finalSelect, findAssociationField] : finalSelect;
     const dbSelect = this.buildDbSelectForAssociation(withAssocSelect, findAssociationField);
-    const filteredPopulate = (0, import_utils34.isArray)(withAssocSelect) && (0, import_utils34.isArray)(_populate) ? _populate.filter(
+    const filteredPopulate = (0, import_utils35.isArray)(withAssocSelect) && (0, import_utils35.isArray)(_populate) ? _populate.filter(
       (p) => [
         ...virtualPlan.publicPersistedFetchSelection,
         ...findAssociationField ? [findAssociationField] : []
@@ -11573,7 +11652,7 @@ var Service = class extends Base {
         findAssociationField ? [findAssociationField] : []
       );
     const capturedAssociation = findAssociationField ? this.captureAssociationValues(docs, findAssociationField) : void 0;
-    const correlatedSnapshots = docs.map((doc) => (0, import_utils34.cloneDeep)(toObject(doc)));
+    const correlatedSnapshots = docs.map((doc) => (0, import_utils35.cloneDeep)(toObject(doc)));
     try {
       docs = await this.includeDocs(docs, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -11772,12 +11851,12 @@ var Service = class extends Base {
       context.allowedFields = allowedFields;
       context.allowedData = allowedData;
       const validated = await this.validate(allowedData, "create", context);
-      if ((0, import_utils34.isBoolean)(validated)) {
+      if ((0, import_utils35.isBoolean)(validated)) {
         if (!validated) {
           validationErrors.push({ index, errors: [] });
           return void 0;
         }
-      } else if ((0, import_utils34.isArray)(validated)) {
+      } else if ((0, import_utils35.isArray)(validated)) {
         if (validated.length > 0) {
           validationErrors.push({
             index,
@@ -11988,7 +12067,7 @@ var Service = class extends Base {
     }
     let doc = await this.model.findOne({
       filter: _filter,
-      select: (0, import_utils34.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
+      select: (0, import_utils35.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
         (path) => `+${path}`
       )
     });
@@ -12027,12 +12106,12 @@ var Service = class extends Base {
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils34.isBoolean)(validated)) {
+    if ((0, import_utils35.isBoolean)(validated)) {
       if (!validated) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
       }
-    } else if ((0, import_utils34.isArray)(validated)) {
+    } else if ((0, import_utils35.isArray)(validated)) {
       if (validated.length > 0) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
@@ -12052,10 +12131,10 @@ var Service = class extends Base {
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_just_diff.diff)(
-        (0, import_utils34.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils34.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils35.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils35.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils34.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
+      context.modifiedPaths = (0, import_utils35.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -12143,7 +12222,7 @@ var Service = class extends Base {
       const upsertOptions = this.resolveUpsertOptions(options);
       const updateIntent = captureModelServiceIntent(this, "updateOne", upsertArgs, upsertOptions);
       const createIntent = captureModelServiceIntent(this, "create", upsertArgs, upsertOptions);
-      const related = (0, import_utils34.uniqBy)(
+      const related = (0, import_utils35.uniqBy)(
         [...this.captureRelated(updateIntent.args), ...this.captureRelated(createIntent.args)],
         (target) => target.path
       );
@@ -12584,7 +12663,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils34.compact)((0, import_utils34.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
+    const uniqueIds = (0, import_utils35.compact)((0, import_utils35.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -12630,7 +12709,7 @@ var Service = class extends Base {
    * (direct/root-entry 200); count measures visible rows, not all updated rows.
    */
   async bulkUpdateSub(id, sub, data, options) {
-    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils34.castArray)(data), options);
+    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils35.castArray)(data), options);
   }
   /**
    * Append/prepend admitted rows, then return the visible full array (including when
@@ -12654,7 +12733,7 @@ var Service = class extends Base {
 };
 
 // src/services/public-service.ts
-var import_utils35 = require("@web-ts-toolkit/utils");
+var import_utils36 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_permissions_alias();
 init_document();
@@ -12780,7 +12859,7 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
         d = this.runTasks(d, tasks);
-        if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
         return d;
       }
     );
@@ -12999,8 +13078,8 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
         d = this.runTasks(d, tasks);
-        if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
-        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, returningKeys));
+        if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, returningKeys));
         return d;
       }
     );
@@ -13083,8 +13162,8 @@ var PublicService = class extends Service {
             let d = toObject(doc);
             d = await this.decorate(d, "update", context);
             d = this.runTasks(d, tasks2);
-            if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
-            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, returningKeys));
+            if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, returningKeys));
             return d;
           }
         );
@@ -13109,7 +13188,7 @@ var PublicService = class extends Service {
           d = await this.decorate(d, "create", context);
           d = this.runTasks(d, tasks);
           if (createSelect)
-            d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(createSelect), ...this.baseFieldsExt]));
+            d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(createSelect), ...this.baseFieldsExt]));
           return d;
         }
       );
@@ -13254,7 +13333,7 @@ var PublicService = class extends Service {
 init_options();
 init_data_values();
 init_helpers();
-var import_utils36 = require("@web-ts-toolkit/utils");
+var import_utils37 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_runtime_context();
 init_runtime();
@@ -13283,7 +13362,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils36.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils37.pick)(doc, _select);
     return {
       success: true,
       kind: "single",
@@ -13329,13 +13408,13 @@ var DataService = class {
     const totalCount = docs.length;
     if (sort) {
       const normalizedSort = normalizeSortForOrderBy(sort);
-      docs = (0, import_utils36.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
+      docs = (0, import_utils37.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
     }
     const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     const { maxHookConcurrency } = this.getRequestComplexity();
     const trimmed = await mapWithConcurrencyLimit(pagedDocs, maxHookConcurrency, async (doc) => {
       doc = await this.trimOutputFields(doc, "list");
-      if (_select.length > 0) doc = (0, import_utils36.pick)(doc, _select);
+      if (_select.length > 0) doc = (0, import_utils37.pick)(doc, _select);
       return copyDataValue(doc);
     });
     if (!hasExplicitLimit && trimmed.length === totalCount) {
@@ -13410,10 +13489,10 @@ var DataService = class {
 init_helpers();
 
 // src/processors.ts
-var import_utils37 = require("@web-ts-toolkit/utils");
+var import_utils38 = require("@web-ts-toolkit/utils");
 init_permissions_alias();
 function cloneProcessorValue(value) {
-  const copy = (0, import_utils37.cloneDeep)(value);
+  const copy = (0, import_utils38.cloneDeep)(value);
   copyPermissionsAliasGraph(value, copy);
   return copy;
 }
@@ -13451,10 +13530,10 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!(0, import_utils37.isPlainObject)(target)) return ret;
+      if (!(0, import_utils38.isPlainObject)(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
-      if ((0, import_utils37.isArray)(next)) {
+      if ((0, import_utils38.isArray)(next)) {
         for (const item of next) {
           ret.push(item);
         }
@@ -13464,8 +13543,8 @@ function resolveLeafParents(obj, src) {
   }
   const leaf = segs[segs.length - 1];
   const pairs = [];
-  (0, import_utils37.forEach)(targets, (target) => {
-    if (!(0, import_utils37.isPlainObject)(target)) return;
+  (0, import_utils38.forEach)(targets, (target) => {
+    if (!(0, import_utils38.isPlainObject)(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -13474,7 +13553,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
   const mutable = options.mutable !== false;
   const idField = options.idField ?? "_id";
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13483,19 +13562,19 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     assertSafePath(dest);
     let targets = [obj];
     const segs = src.split(".");
-    (0, import_utils37.forEach)(segs, (seg, ind) => {
+    (0, import_utils38.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils37.forEach)(targets, (target) => {
-          if (!(0, import_utils37.isPlainObject)(target)) return;
+        (0, import_utils38.forEach)(targets, (target) => {
+          if (!(0, import_utils38.isPlainObject)(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
           let depopulated;
-          if ((0, import_utils37.isArray)(leaf)) {
+          if ((0, import_utils38.isArray)(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => (0, import_utils37.isPlainObject)(item))) {
-              depopulated = (0, import_utils37.map)(leaf, idField).map((id, i) => {
+            } else if (leaf.every((item) => (0, import_utils38.isPlainObject)(item))) {
+              depopulated = (0, import_utils38.map)(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
                 }
@@ -13504,8 +13583,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if ((0, import_utils37.isPlainObject)(leaf)) {
-            const id = (0, import_utils37.get)(leaf, idField);
+          } else if ((0, import_utils38.isPlainObject)(leaf)) {
+            const id = (0, import_utils38.get)(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
             }
@@ -13513,15 +13592,15 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           } else {
             return;
           }
-          (0, import_utils37.set)(targetObject, dest, sourceForDest);
-          (0, import_utils37.set)(targetObject, seg, depopulated);
+          (0, import_utils38.set)(targetObject, dest, sourceForDest);
+          (0, import_utils38.set)(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!(0, import_utils37.isPlainObject)(target)) return ret;
+          if (!(0, import_utils38.isPlainObject)(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
-          if ((0, import_utils37.isArray)(next)) {
+          if ((0, import_utils38.isArray)(next)) {
             for (const item of next) {
               ret.push(item);
             }
@@ -13536,7 +13615,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
 var copyPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13544,9 +13623,9 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "copyPaths");
     assertSafePath(dest, "copyPaths");
     if (src === dest) return;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
-      (0, import_utils37.set)(parent, dest, cloneProcessorValue(parent[leaf]));
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
+      (0, import_utils38.set)(parent, dest, cloneProcessorValue(parent[leaf]));
     });
   });
   return obj;
@@ -13554,7 +13633,7 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
 var movePaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13562,10 +13641,10 @@ var movePaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "movePaths");
     assertSafePath(dest, "movePaths");
     if (src === dest) return;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
       const value = cloneProcessorValue(parent[leaf]);
-      (0, import_utils37.set)(parent, dest, value);
+      (0, import_utils38.set)(parent, dest, value);
       if (dest === leaf || dest.startsWith(`${leaf}.`)) return;
       delete parent[leaf];
     });
@@ -13577,7 +13656,7 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
   const maxSlice = options.maxSlice ?? DEFAULT_MAX_SLICE;
   assertNonNegativeSafeInteger(maxSlice, "maxSlice", "sliceArrays");
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
@@ -13594,15 +13673,15 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
       assertNonNegativeSafeInteger(op.limit, "limit", "sliceArrays");
       limit = Math.min(op.limit, maxSlice);
     }
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       const leafValue = parent[leaf];
-      if (!(0, import_utils37.isArray)(leafValue)) return;
+      if (!(0, import_utils38.isArray)(leafValue)) return;
       const end = typeof limit === "undefined" ? void 0 : skip + limit;
       const window = leafValue.slice(skip, end);
       if (typeof rawDest === "undefined") {
-        (0, import_utils37.set)(parent, leaf, window);
+        (0, import_utils38.set)(parent, leaf, window);
       } else {
-        (0, import_utils37.set)(parent, rawDest, window);
+        (0, import_utils38.set)(parent, rawDest, window);
       }
     });
   });
@@ -13611,27 +13690,27 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
 var countPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
     if (src.length === 0 || dest.length === 0) return;
     assertSafePath(src, "countPaths");
     assertSafePath(dest, "countPaths");
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
       const leafValue = parent[leaf];
       let count;
-      if ((0, import_utils37.isArray)(leafValue)) {
+      if ((0, import_utils38.isArray)(leafValue)) {
         count = leafValue.length;
-      } else if ((0, import_utils37.isPlainObject)(leafValue)) {
+      } else if ((0, import_utils38.isPlainObject)(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
       } else {
         count = 1;
       }
-      (0, import_utils37.set)(parent, dest, count);
+      (0, import_utils38.set)(parent, dest, count);
     });
   });
   return obj;
@@ -13639,15 +13718,15 @@ var countPaths = (docObject, operations, options = { mutable: true }) => {
 var maskPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
     assertSafePath(src, "maskPaths");
     const replacement = Object.prototype.hasOwnProperty.call(op, "replacement") ? op.replacement : DEFAULT_MASK_REPLACEMENT;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
-      (0, import_utils37.set)(parent, leaf, replacement);
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
+      (0, import_utils38.set)(parent, leaf, replacement);
     });
   });
   return obj;
@@ -13702,6 +13781,8 @@ init_core_shared();
 init_virtual_projection();
 init_populate_target();
 init_model_output_planning();
+init_authorization_snapshot();
+init_document();
 init_output_field_filter();
 init_request_work();
 var emptyPermissionLeaf = () => ({ $: "_" });
@@ -13719,10 +13800,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils38.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils39.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils38.isString)(idField)) {
+    if ((0, import_utils39.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -13812,17 +13893,11 @@ var Core = class {
     return this.genSelect(modelName, access, targetFields, options);
   }
   /** Persisted request-only populate admission; fetch planning is not field authority. */
-  async requestPopulateSelect(modelName, access, targetFields = null, scopePath = []) {
+  async requestPopulateSelect(configuration, permissions, access, targetFields = null, scopePath = []) {
     const subPaths = scopePath.flatMap((part) => [part, "sub"]);
-    const permissionSchema = getModelOption(modelName, ["permissionSchema"].concat(subPaths).join("."));
-    const permissions = this.getGlobalPermissions();
-    let virtualNames;
-    try {
-      const runtime = getActiveRuntime() ?? defaultRuntime;
-      virtualNames = runtime.getVirtualNames(modelName, subPaths);
-    } catch {
-      virtualNames = [];
-    }
+    const permissionSchema = (0, import_utils39.get)(configuration, ["permissionSchema", ...subPaths]);
+    const prefix = scopePath.length ? `${scopePath.join(".")}.` : "";
+    const virtualNames = (configuration.catalog.virtualPaths ?? []).filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).filter((path) => !path.includes("."));
     return resolveSelectForRequest({
       req: this.req,
       permissionSchema,
@@ -13841,17 +13916,25 @@ var Core = class {
     assertPublicAdmission(_populate, "populate");
     assertPopulateAccess(access);
     if (!_populate) return [];
-    let populate = Array.isArray(_populate) ? _populate : [_populate];
-    for (const p of populate) {
-      if (!(0, import_utils38.isString)(p)) assertPopulateAccess(p.access);
-    }
-    populate = (0, import_utils38.compact)(
+    const descriptors = copyAuthorizationValue(Array.isArray(_populate) ? _populate : [_populate], true);
+    for (const p of descriptors) {
+      if (!(0, import_utils39.isString)(p)) assertPopulateAccess(p.access);
+    }
+    const runtime = this.requestRuntime;
+    const globalOptions = modelServiceGlobalOptions(this, runtime);
+    const relatedTargets = captureRelatedTargets(runtime, modelName, { populate: descriptors }, 0, globalOptions);
+    const sourceConfiguration = captureModelAuthorizationConfiguration(runtime, modelName, void 0, globalOptions);
+    const originalPermissions = this.getGlobalPermissions();
+    const permissions = new permission_default(
+      Object.fromEntries(originalPermissions.keys.map((key) => [key, originalPermissions.has(key)]))
+    );
+    const populate = (0, import_utils39.compact)(
       await Promise.all(
-        populate.map(async (p) => {
-          const populateAccess = !(0, import_utils38.isString)(p) && p.access ? p.access : access;
+        descriptors.map(async (p) => {
+          const populateAccess = !(0, import_utils39.isString)(p) && p.access ? p.access : access;
           assertPopulateAccess(populateAccess);
-          const originalSelect = (0, import_utils38.isString)(p) ? void 0 : p.select;
-          const ret = (0, import_utils38.isString)(p) ? { path: p } : {
+          const originalSelect = (0, import_utils39.isString)(p) ? void 0 : p.select;
+          const ret = (0, import_utils39.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -13859,78 +13942,86 @@ var Core = class {
           const pathForSourcePermission = scopePrefix && ret.path.startsWith(`${scopePrefix}.`) ? ret.path.slice(scopePrefix.length + 1) : ret.path;
           const parentPath = pathForSourcePermission.includes(".") ? pathForSourcePermission.split(".")[0] : pathForSourcePermission;
           const allowedParentPaths = await this.requestPopulateSelect(
-            modelName,
+            sourceConfiguration,
+            permissions,
             populateAccess,
             [parentPath],
             scopePath
           );
           if (!allowedParentPaths.includes(parentPath)) return null;
-          const refModelName = getModelRef(modelName, ret.path);
-          if (!refModelName) return null;
-          const runtime = getActiveRuntime();
-          if (!runtime) return null;
-          const requireRegisteredPopulateModels = getGlobalOption("requireRegisteredPopulateModels", true);
-          if (!runtime.hasModel(refModelName)) {
-            return requireRegisteredPopulateModels ? null : ret;
-          }
-          const allowedTargetOperation = await this.isAllowed(refModelName, populateAccess);
-          if (!allowedTargetOperation) {
+          const target = relatedTargets.find((entry) => entry.path === ret.path);
+          if (!target) return null;
+          const refModelName = target.modelName;
+          const targetConfiguration = target.configuration;
+          if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && !await withCapturedModelOperationGuard(
+            this,
+            refModelName,
+            populateAccess,
+            getCapturedAuthorizationOption(targetConfiguration, `operationAccess.${populateAccess}`),
+            permissions,
+            () => this.isAllowed(refModelName, populateAccess)
+          )) {
             return null;
           }
-          ret.select = await this.requestPopulateSelect(refModelName, populateAccess, ret.select);
-          const hookInputs = getModelOption(refModelName, `alwaysSelectFields.${populateAccess}`, []);
-          ret.select = (0, import_utils38.uniq)([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
-          const filter2 = await this.genFilter(refModelName, populateAccess, null);
+          ret.select = await this.requestPopulateSelect(
+            targetConfiguration,
+            permissions,
+            populateAccess,
+            ret.select
+          );
+          const hookInputs = resolveAlwaysSelectForAccess(
+            targetConfiguration.alwaysSelectFields,
+            populateAccess
+          );
+          ret.select = (0, import_utils39.uniq)([
+            ...ret.select,
+            ...stripVirtuals(hookInputs, [...targetConfiguration.catalog.virtualPaths ?? []])
+          ]);
+          const match = (0, import_utils39.isString)(p) ? {} : p.match ?? {};
+          const filter2 = await resolveAccessFilterForRequest({
+            req: this.req,
+            permissions,
+            cache: this.caches.baseFilter,
+            cacheKey: `${refModelName}_baseFilter_${populateAccess}`,
+            access: populateAccess,
+            filter: deepIsolateValue(match),
+            getOption: (key) => getCapturedAuthorizationOption(targetConfiguration, key)
+          });
           if (filter2 === false) return null;
-          ret.match = filter2;
-          try {
-            const planAccess = populateAccess;
-            const targetSnapshot = {
-              permissionSchema: getModelOption(refModelName, "permissionSchema", null) ?? null,
-              virtuals: getModelOption(refModelName, "virtuals", null) ?? null,
-              alwaysSelectFields: getModelOption(refModelName, "alwaysSelectFields", null) ?? null,
-              modelPermissionPrefix: getModelOption(refModelName, "modelPermissionPrefix", "") ?? "",
-              requireExplicitSelect: getModelOption(refModelName, "requireExplicitSelect", false) ?? false,
-              documentPermissionField: getModelOption(refModelName, "documentPermissionField", "_permissions") ?? "_permissions",
-              exposedDocPermissionKeys: getModelOption(refModelName, "exposedDocPermissionKeys", void 0),
-              stripPermissionsField: getModelOption(refModelName, "stripPermissionsField", false) ?? false,
-              disableFieldPermissions: getModelOption(refModelName, "disableFieldPermissions", false) ?? false
-            };
-            const perms = this.getPermissions();
-            const globalForPlan = perms && typeof perms.has === "function" && typeof perms.hasKey === "function" ? perms : { has: () => false, hasKey: () => false };
-            const targetPlan = planVirtualProjection({
-              receivingModelName: refModelName,
-              snapshot: {
-                permissionSchema: targetSnapshot.permissionSchema,
-                virtuals: targetSnapshot.virtuals,
-                alwaysSelectFields: targetSnapshot.alwaysSelectFields,
-                modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
-                requireExplicitSelect: targetSnapshot.requireExplicitSelect,
-                documentPermissionField: targetSnapshot.documentPermissionField
-              },
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              internalFetch: { baseFields: ["_id"] },
-              globalPermissions: globalForPlan
-            });
-            const merged = (0, import_utils38.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
-              (t) => t !== "-_id" && !t.includes(".sub.")
-            );
-            if (!merged.includes("_id")) merged.push("_id");
-            ret.select = merged;
-            setPopulateTargetMeta(ret, {
-              targetModelName: refModelName,
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              plan: targetPlan,
-              snapshot: targetSnapshot
-            });
-          } catch {
-          }
+          ret.match = deepIsolateValue(intersectFilters(match, filter2));
+          const planAccess = populateAccess;
+          const targetSnapshot = targetConfiguration;
+          const targetPlan = planVirtualProjection({
+            receivingModelName: refModelName,
+            snapshot: {
+              permissionSchema: targetSnapshot.permissionSchema,
+              virtuals: targetSnapshot.virtuals,
+              alwaysSelectFields: targetSnapshot.alwaysSelectFields,
+              modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
+              requireExplicitSelect: targetSnapshot.requireExplicitSelect,
+              documentPermissionField: targetSnapshot.documentPermissionField
+            },
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            internalFetch: { baseFields: ["_id"] },
+            globalPermissions: permissions
+          });
+          const merged = (0, import_utils39.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
+            (t) => t !== "-_id" && !t.includes(".sub.")
+          );
+          if (!merged.includes("_id")) merged.push("_id");
+          ret.select = merged;
+          setPopulateTargetMeta(ret, {
+            targetModelName: refModelName,
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            plan: targetPlan,
+            snapshot: targetSnapshot
+          });
           return ret;
         })
       )
@@ -13939,10 +14030,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils38.isFunction)(validate)) {
+    if ((0, import_utils39.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils38.isBoolean)(validate) || (0, import_utils38.isArray)(validate)) {
+    } else if ((0, import_utils39.isBoolean)(validate) || (0, import_utils39.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -13967,7 +14058,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils38.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils39.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -13991,7 +14082,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils38.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils39.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await getRequestWorkState(this.req, this.requestRuntime).hookGate.run(
@@ -14075,7 +14166,7 @@ var Core = class {
       readExists ? requestFields("read") : [],
       updateExists ? requestFields("update") : []
     ]);
-    const viewObj = (0, import_utils38.reduce)(
+    const viewObj = (0, import_utils39.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -14083,7 +14174,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils38.reduce)(
+    const editObj = (0, import_utils39.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -14114,9 +14205,9 @@ var Core = class {
     });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils38.compact)((0, import_utils38.castArray)(task));
+    const tasks = (0, import_utils39.compact)((0, import_utils39.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils38.forEach)(tasks, (task2) => {
+    (0, import_utils39.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -14186,9 +14277,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils38.isUndefined)(subOption)) {
+      if ((0, import_utils39.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils38.isUndefined)(subFieldOption)) {
+        if ((0, import_utils39.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -14254,25 +14345,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils39.isPlainObject)(condition)) {
+    if ((0, import_utils40.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils39.isString)(id) ? id : null;
-      if ((0, import_utils39.isPlainObject)(id)) {
+      let _id = (0, import_utils40.isString)(id) ? id : null;
+      if ((0, import_utils40.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils39.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils40.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils39.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils40.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils39.isString)(_id) || !_id) {
+      if (!(0, import_utils40.isString)(_id) || !_id) {
         return next(new import_express_json_router5.default.clientErrors.BadRequestError());
       }
       const result2 = await svc._read(_id, { select });
@@ -14284,11 +14375,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils39.isString)(cond)) {
+    if ((0, import_utils40.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils39.isArray)(cond)) {
+    } else if ((0, import_utils40.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils39.isFunction)(cond)) {
+    } else if ((0, import_utils40.isFunction)(cond)) {
       const result2 = await cond.call(req, permissions);
       if (!!result2) return next();
     }
@@ -14301,7 +14392,7 @@ var import_express2 = __toESM(require("express"));
 
 // src/routers/model-router.ts
 var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils43 = require("@web-ts-toolkit/utils");
+var import_utils44 = require("@web-ts-toolkit/utils");
 init_logger_helpers();
 init_runtime();
 init_runtime_context();
@@ -14435,7 +14526,7 @@ init_request_complexity();
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils40 = require("@web-ts-toolkit/utils");
+var import_utils41 = require("@web-ts-toolkit/utils");
 
 // src/validation/public-admission-schema.ts
 init_public_admission();
@@ -14564,7 +14655,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils40.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils41.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -14601,7 +14692,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils40.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils41.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -14654,7 +14745,7 @@ var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, impo
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils40.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils41.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,
@@ -15627,7 +15718,7 @@ var rootQuerySchema = publicBoundarySchema(
 init_helpers();
 
 // src/routers/shared.ts
-var import_utils41 = require("@web-ts-toolkit/utils");
+var import_utils42 = require("@web-ts-toolkit/utils");
 
 // src/routers/model-router-collection-routes.ts
 init_schemas();
@@ -15658,15 +15749,15 @@ function setModelCollectionRoutes(context) {
       sort
     } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = (0, import_utils41.parseBooleanString)(include_count);
-    const includeExtraHeaders = (0, import_utils41.parseBooleanString)(include_extra_headers);
+    const includeCount = (0, import_utils42.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils42.parseBooleanString)(include_extra_headers);
     const result2 = await svc._list(
       {},
       { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
       {
-        skim: (0, import_utils41.parseBooleanString)(skim),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions),
+        skim: (0, import_utils42.parseBooleanString)(skim),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions),
         includeCount
       }
     );
@@ -15726,8 +15817,8 @@ function setModelCollectionRoutes(context) {
       data,
       {},
       {
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -15765,8 +15856,8 @@ function setModelCollectionRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -15863,9 +15954,9 @@ function setModelDocumentRoutes(context) {
       id,
       { select: parseSelectParam(select) },
       {
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions),
-        tryList: (0, import_utils41.parseBooleanString)(try_list)
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions),
+        tryList: (0, import_utils42.parseBooleanString)(try_list)
       }
     );
     handleResultError(result2);
@@ -15965,9 +16056,9 @@ function setModelDocumentRoutes(context) {
       data,
       { select: parseSelectParam(select) },
       {
-        returningAll: (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -16016,9 +16107,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -16049,9 +16140,9 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -16098,9 +16189,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -16340,11 +16431,11 @@ function setModelSubDocumentRoutes(context) {
 }
 
 // src/openapi/route-registration.ts
-var import_utils42 = require("@web-ts-toolkit/utils");
+var import_utils43 = require("@web-ts-toolkit/utils");
 function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
   runtime.registerOpenApiRoute({
     ...route,
-    path: (0, import_utils42.normalizeUrlPath)(basePath + route.path),
+    path: (0, import_utils43.normalizeUrlPath)(basePath + route.path),
     tags: route.tags ?? [defaultTag]
   });
 }
@@ -16352,8 +16443,8 @@ function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router8.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils43.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils43.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils44.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils44.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(
     this.modelName,
@@ -16555,7 +16646,7 @@ var ModelRouter = class _ModelRouter {
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils43.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils44.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router8.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName, this.runtime);
@@ -16641,13 +16732,13 @@ var ModelRouter = class _ModelRouter {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils43.forEach)(this.router.getEndpoints(), ({ method, path }) => {
-        logInfoMessage(`${(0, import_utils43.padEnd)(method, 6)} ${(0, import_utils43.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils44.forEach)(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${(0, import_utils44.padEnd)(method, 6)} ${(0, import_utils44.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils43.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils44.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -16655,7 +16746,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils43.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils44.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(
         this.modelName,
@@ -16683,7 +16774,7 @@ var ModelRouter = class _ModelRouter {
 
 // src/routers/root-router.ts
 var import_express_json_router9 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils44 = require("@web-ts-toolkit/utils");
+var import_utils45 = require("@web-ts-toolkit/utils");
 
 // src/core-data.ts
 init_options();
@@ -16991,7 +17082,7 @@ var RootRouter = class {
     this.setRoutes();
   }
   registerOpenApiRoute(route) {
-    registerOpenApiRoute(this.runtime, (0, import_utils44.normalizeUrlPath)(this.basename), "root", route);
+    registerOpenApiRoute(this.runtime, (0, import_utils45.normalizeUrlPath)(this.basename), "root", route);
   }
   wrapResult(index, item, result2) {
     return {
@@ -17100,7 +17191,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     const groups = /* @__PURE__ */ new Map();
     items.forEach((item, index) => {
-      const order = (0, import_utils44.isNumber)(item.order) ? item.order : 0;
+      const order = (0, import_utils45.isNumber)(item.order) ? item.order : 0;
       const group = groups.get(order);
       if (group) {
         group.push({ index, item });
@@ -17171,7 +17262,7 @@ var RootRouter = class {
         const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
-      return (0, import_utils44.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils45.orderBy)(results, ["index"], ["asc"]);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -17189,14 +17280,14 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 var import_express_json_router10 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils45 = require("@web-ts-toolkit/utils");
+var import_utils46 = require("@web-ts-toolkit/utils");
 init_runtime();
 init_helpers();
 init_schemas();
 var clientErrors4 = import_express_json_router10.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils45.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils45.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils46.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils46.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -17245,7 +17336,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils45.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils46.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router10.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -17278,8 +17369,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = (0, import_utils41.parseBooleanString)(include_count);
-      const includeExtraHeaders = (0, import_utils41.parseBooleanString)(include_extra_headers);
+      const includeCount = (0, import_utils42.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils42.parseBooleanString)(include_extra_headers);
       const result2 = await svc.find(
         {},
         { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
@@ -17397,7 +17488,7 @@ var DataRouter = class {
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils45.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils46.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(
         this.dataName,
@@ -17405,7 +17496,7 @@ var DataRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils45.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils46.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -17540,7 +17631,7 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    if ((0, import_utils46.isUndefined)(options)) {
+    if ((0, import_utils47.isUndefined)(options)) {
       return new RootRouter(modelName, runtime);
     }
     if (typeof modelName === "string") {
@@ -17561,10 +17652,10 @@ function createRuntimeApi(runtime) {
   };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils46.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils47.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils46.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils47.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };