@web-ts-toolkit/access-router 0.55.0 → 0.57.0

package/index.mjs

@@ -2140,10 +2140,34 @@ var init_field_catalog = __esm({
   }
 });
 
+// src/acl/populate-target-configuration.ts
+import { isPlainObject as isPlainObject12 } from "@web-ts-toolkit/utils";
+function capturePopulateTargetConfiguration(runtime, modelName, source, proposedOptions) {
+  const label = `Populate target "${modelName}" for ${source}`;
+  if (!proposedOptions && !runtime.hasModel(modelName))
+    authorizationError(
+      `${label} must be configured first in this runtime; register its Mongoose model and setModelOptions with an object permissionSchema`
+    );
+  const model = runtime.getModelInstance(modelName);
+  if (!model) authorizationError(`${label} requires an actual registered Mongoose model in this runtime`);
+  const options = proposedOptions ?? runtime.getModelOptions(modelName);
+  const permissionSchema = options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema;
+  if (!isPlainObject12(permissionSchema))
+    authorizationError(
+      `${label} requires an effective object permissionSchema; configure the model or runtime model defaults ({} explicitly closes business fields)`
+    );
+  return { model, options: { ...options, permissionSchema } };
+}
+var init_populate_target_configuration = __esm({
+  "src/acl/populate-target-configuration.ts"() {
+    init_authorization_snapshot();
+  }
+});
+
 // src/acl/virtual-populate-dependencies.ts
-import { get as get4, isPlainObject as isPlainObject12 } from "@web-ts-toolkit/utils";
+import { get as get4, isPlainObject as isPlainObject13 } from "@web-ts-toolkit/utils";
 function record(value, label) {
-  if (!isPlainObject12(value)) return fail(label, "entries must be plain { path, select? } objects");
+  if (!isPlainObject13(value)) return fail(label, "entries must be plain { path, select? } objects");
   for (const key of Reflect.ownKeys(value)) {
     const property = Object.getOwnPropertyDescriptor(value, key);
     if (typeof key !== "string" || !property.enumerable || !("value" in property))
@@ -2231,7 +2255,9 @@ function normalizeSelection(select, catalog, label) {
     includeId: selection.includes("_id")
   };
 }
-function captureVirtualPopulateDependencies(runtime, modelName, options) {
+function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const requireOperationAccessForPopulateDependencies = globalOptions.requireOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateQueries = globalOptions.requireOperationAccessForPopulateQueries !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2271,7 +2297,12 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
                 label,
                 `target "${ref}" requires a registered same-connection non-discriminator ObjectId model bound to the source ref`
               );
-            const targetOptions = ref === modelName ? options : runtime.getModelOptions(ref);
+            const { options: targetOptions } = capturePopulateTargetConfiguration(
+              runtime,
+              ref,
+              `dependsOnPopulate virtual "${label}"`,
+              ref === modelName ? options : void 0
+            );
             const defaults = runtime.getDefaultModelOptions();
             const readOption = (key) => resolveNestedOption((path2, fallback) => get4(targetOptions, path2, fallback), key, get4(defaults, key));
             const documentPermissionField = targetOptions.documentPermissionField ?? defaults.documentPermissionField;
@@ -2280,6 +2311,9 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
               {
                 catalog,
                 documentPermissionField,
+                requireOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateQueries,
+                permissionSchema: targetOptions.permissionSchema,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2328,13 +2362,13 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
         );
         continue;
       }
-      if (!isPlainObject12(raw)) continue;
+      if (!isPlainObject13(raw)) continue;
       const entry = raw;
       const label = join(sourcePrefix, name);
       captureList(entry.dependsOnPopulate, label);
       if (!("get" in entry))
         for (const access of accesses) {
-          if (isPlainObject12(entry[access]))
+          if (isPlainObject13(entry[access]))
             captureList(entry[access].dependsOnPopulate, `${label}.${access}`);
         }
       const byAccess = {};
@@ -2359,8 +2393,8 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
   visit(options.virtuals ?? {}, model?.schema, "", [], !!model && varyingModel(model));
   return Object.freeze({ scopes: Object.freeze(scopes) });
 }
-function captureVirtualPopulateSnapshot(runtime, modelName, options) {
-  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options);
+function captureVirtualPopulateSnapshot(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions);
   const token = () => {
   };
   snapshots.set(token, snapshot);
@@ -2392,6 +2426,7 @@ var init_virtual_populate_dependencies = __esm({
     init_authorization_snapshot();
     init_field_catalog();
     init_virtual_descriptor();
+    init_populate_target_configuration();
     elementType = (type) => type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster;
     join = (prefix, path) => prefix ? `${prefix}.${path}` : path;
     within = (path, parent) => path === parent || path.startsWith(`${parent}.`);
@@ -2416,7 +2451,7 @@ import {
   isBoolean,
   isFunction as isFunction2,
   isNil as isNil2,
-  isPlainObject as isPlainObject13,
+  isPlainObject as isPlainObject14,
   isString as isString4,
   keys,
   normalizeUrlPath,
@@ -2483,7 +2518,7 @@ var init_runtime = __esm({
       const modelPermissionKeys = {};
       forEach2(schemaKeys, (schemaKey) => {
         const schemaRule = permissionSchema[schemaKey];
-        const ruleEntries = isPlainObject13(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+        const ruleEntries = isPlainObject14(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
         for (let x = 0; x < ruleEntries.length; x++) {
           const [accessKey, value] = ruleEntries[x];
           if (!isArray5(globalPermissionKeys[accessKey])) {
@@ -2524,7 +2559,7 @@ var init_runtime = __esm({
     VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
     VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
     VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-    isVirtualContainerValue2 = (value) => isPlainObject13(value) && "sub" in value;
+    isVirtualContainerValue2 = (value) => isPlainObject14(value) && "sub" in value;
     virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
@@ -2619,7 +2654,7 @@ var init_runtime = __esm({
     };
     validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
       if (isFunction2(value)) return;
-      if (!isPlainObject13(value)) {
+      if (!isPlainObject14(value)) {
         throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
       }
       const record3 = value;
@@ -2665,7 +2700,7 @@ var init_runtime = __esm({
               `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
             );
           }
-          if (!isPlainObject13(record4.sub)) {
+          if (!isPlainObject14(record4.sub)) {
             throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
           }
           continue;
@@ -2676,7 +2711,7 @@ var init_runtime = __esm({
           );
         }
         if (isFunction2(raw)) continue;
-        if (!isPlainObject13(raw)) {
+        if (!isPlainObject14(raw)) {
           throw new Error(
             `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
           );
@@ -2730,7 +2765,7 @@ var init_runtime = __esm({
     };
     validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
       if (virtuals === void 0 || virtuals === null) return;
-      if (!isPlainObject13(virtuals)) {
+      if (!isPlainObject14(virtuals)) {
         throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
       }
       const rootSchema = model?.schema ?? null;
@@ -2782,7 +2817,8 @@ var init_runtime = __esm({
           {
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
-            requireRegisteredPopulateModels: true,
+            requireOperationAccessForPopulateQueries: true,
+            requireOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2955,9 +2991,18 @@ var init_runtime = __esm({
       }
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
-        this.globalOptions.assign(options);
+        const next = { ...options };
+        if ("requireOperationAccessForPopulateQueries" in next)
+          next.requireOperationAccessForPopulateQueries = next.requireOperationAccessForPopulateQueries !== false;
+        if ("requireOperationAccessForPopulateDependencies" in next)
+          next.requireOperationAccessForPopulateDependencies = next.requireOperationAccessForPopulateDependencies !== false;
+        this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
+        if (key === "requireOperationAccessForPopulateQueries" || key === "requireOperationAccessForPopulateDependencies") {
+          this.globalOptions.set(key, value !== false);
+          return;
+        }
         this.globalOptions.set(key, value);
       }
       getGlobalOptions() {
@@ -3078,10 +3123,10 @@ var init_runtime = __esm({
               const segments = nestedPath.split(".");
               let cursor = cloned;
               for (let i = 0; i < segments.length - 1; i++) {
-                if (!isPlainObject13(cursor)) break;
+                if (!isPlainObject14(cursor)) break;
                 cursor = cursor[segments[i]];
               }
-              if (isPlainObject13(cursor)) {
+              if (isPlainObject14(cursor)) {
                 delete cursor[segments[segments.length - 1]];
               }
               proposedVirtuals = cloned;
@@ -3573,7 +3618,6 @@ function normalizePolicy(value, applicability, configuration, targets) {
       const matches = targets.filter((target2) => target2.path === path);
       if (matches.length !== 1) authorizationError(`unused or ambiguous related path: ${path}`);
       const target = matches[0];
-      if (target.kind === "passthrough") authorizationError(`related policy requires a registered target: ${path}`);
       const child = authorizationRecord(entry, `related.${path}`);
       assertAuthorizationKeys(
         child,
@@ -4083,7 +4127,7 @@ var init_field_authorization = __esm({
 });
 
 // src/acl/virtual-projection.ts
-import { get as get6, isArray as isArray7, isPlainObject as isPlainObject15 } from "@web-ts-toolkit/utils";
+import { get as get6, isArray as isArray7, isPlainObject as isPlainObject16 } from "@web-ts-toolkit/utils";
 function planVirtualProjection(args) {
   if (args.snapshot.catalog) return planCatalogProjection(args);
   const {
@@ -4317,15 +4361,15 @@ var init_virtual_projection = __esm({
     init_virtual_populate_dependencies();
     init_virtual_descriptor();
     getScopedPermissionSchema = (root, scopePath) => {
-      if (!root || !isPlainObject15(root)) return null;
+      if (!root || !isPlainObject16(root)) return null;
       if (scopePath.length === 0) return root;
       const scoped = get6(root, scopePath.join("."));
-      return isPlainObject15(scoped) ? scoped : null;
+      return isPlainObject16(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
       if (!raw) return [];
       if (isArray7(raw)) return [...raw];
-      if (isPlainObject15(raw)) {
+      if (isPlainObject16(raw)) {
         const record3 = raw;
         const exact = record3[access];
         if (isArray7(exact)) return [...exact];
@@ -4599,15 +4643,22 @@ function getCapturedAuthorizationOption(configuration, key) {
   const defaultValue = key.startsWith("operationAccess.") ? get7(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
   return resolveNestedOption((path, fallback) => get7(configuration, path, fallback), key, defaultValue);
 }
-function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName)) {
+function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName), globalOptions = runtime.getGlobalOptions()) {
   const model = runtime.getModelInstance(modelName);
   if (!model) return authorizationError(`unknown receiving model: ${modelName}`);
   const virtuals = options.virtuals;
   return copyAuthorizationValue(
     {
       catalog: captureAuthorizationFieldCatalog(model.schema, virtuals, options.documentPermissionField),
-      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(runtime, modelName, options),
-      permissionSchema: options.permissionSchema,
+      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(
+        runtime,
+        modelName,
+        options,
+        globalOptions
+      ),
+      requireOperationAccessForPopulateDependencies: globalOptions.requireOperationAccessForPopulateDependencies !== false,
+      requireOperationAccessForPopulateQueries: globalOptions.requireOperationAccessForPopulateQueries !== false,
+      permissionSchema: options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
       modelPermissionPrefix: options.modelPermissionPrefix,
@@ -4673,15 +4724,15 @@ import {
   isBoolean as isBoolean2,
   isEmpty as isEmpty2,
   isFunction as isFunction3,
-  isPlainObject as isPlainObject16,
+  isPlainObject as isPlainObject17,
   isString as isString5
 } from "@web-ts-toolkit/utils";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 function isAndFilter(filter2) {
-  return !!filter2 && isPlainObject16(filter2) && Object.keys(filter2).length === 1 && isArray8(filter2.$and);
+  return !!filter2 && isPlainObject17(filter2) && Object.keys(filter2).length === 1 && isArray8(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && isPlainObject16(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && isPlainObject17(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4702,7 +4753,7 @@ function optimizeAndFilter(clausesInput) {
       const entries = Array.from(value, dedupeKey);
       return entries.every((entry) => entry !== void 0) ? `array:${JSON.stringify(entries)}` : void 0;
     }
-    if (isPlainObject16(value)) {
+    if (isPlainObject17(value)) {
       const entries = Object.keys(value).sort().map((key) => [key, dedupeKey(value[key])]);
       return entries.every(([, entry]) => entry !== void 0) ? `object:${JSON.stringify(entries)}` : void 0;
     }
@@ -4750,7 +4801,7 @@ function optimizeAndFilter(clausesInput) {
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !isPlainObject16(filter2) || isEmpty2(filter2)) return null;
+  if (!filter2 || !isPlainObject17(filter2) || isEmpty2(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
@@ -4828,7 +4879,7 @@ async function setRequestPermissions(req) {
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
   const permissions = isFunction3(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
-  if (isPlainObject16(permissions)) req[requestPermissionField] = permissions;
+  if (isPlainObject17(permissions)) req[requestPermissionField] = permissions;
   else if (isArray8(permissions)) req[requestPermissionField] = arrayToRecord(permissions);
   else if (isString5(permissions)) req[requestPermissionField] = { [permissions]: true };
   else req[requestPermissionField] = {};
@@ -5227,7 +5278,7 @@ var init_filter_resolution = __esm({
 // src/acl/virtual-populate-execution.ts
 import { Document as Document4, mongo as mongo4 } from "mongoose";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
-import { isPlainObject as isPlainObject19 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject20 } from "@web-ts-toolkit/utils";
 function projectVirtualPopulateView(source, selection, structurePaths = []) {
   const root = { children: /* @__PURE__ */ new Map() };
   for (const path of compactPersistedProjection(selection)) {
@@ -5259,8 +5310,8 @@ function equivalentVirtualPopulatePredicate(left, right) {
   }
   if (Array.isArray(left) || Array.isArray(right))
     return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((entry, index) => equivalentVirtualPopulatePredicate(entry, right[index]));
-  if (isPlainObject19(left) || isPlainObject19(right)) {
-    if (!isPlainObject19(left) || !isPlainObject19(right)) return false;
+  if (isPlainObject20(left) || isPlainObject20(right)) {
+    if (!isPlainObject20(left) || !isPlainObject20(right)) return false;
     const a = Object.keys(left), b = Object.keys(right);
     return a.length === b.length && a.every(
       (key, index) => key === b[index] && equivalentVirtualPopulatePredicate(
@@ -5277,7 +5328,8 @@ function createVirtualPopulateBatch(owner) {
     owner: { ...owner },
     rows: [],
     requests: [],
-    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache()
+    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache(),
+    readGuards: /* @__PURE__ */ new Map()
   });
   return batch;
 }
@@ -5326,7 +5378,12 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
       }
       const record3 = storage(value);
       if (!record3) return;
-      const occurrence = { address, plan: currentPlan, refs: /* @__PURE__ */ new Map(), dependencies: /* @__PURE__ */ new Map() };
+      const occurrence = {
+        address,
+        plan: currentPlan,
+        refs: /* @__PURE__ */ new Map(),
+        dependencies: /* @__PURE__ */ new Map()
+      };
       row.occurrences.set(addressKey(address), occurrence);
       for (const candidate of currentPlan.candidates) {
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
@@ -5392,6 +5449,27 @@ function referenceIds(original) {
   if (!original.present || original.value == null) return [];
   return (Array.isArray(original.value) ? original.value : [original.value]).filter((id) => id != null);
 }
+function targetReadAllowed(state, target) {
+  let pending = state.readGuards.get(target.identity);
+  if (!pending) {
+    const { owner } = state;
+    pending = getRequestWorkState(owner.request, owner.runtime).hookGate.run(
+      () => evaluateRouteGuard(
+        owner.request,
+        owner.permissions,
+        getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
+      )
+    ).then(
+      (allowed) => !!allowed,
+      () => {
+        warn("Virtual populated dependency unavailable", { modelName: target.modelName, category: "policy" });
+        return false;
+      }
+    );
+    state.readGuards.set(target.identity, pending);
+  }
+  return pending;
+}
 function executeVirtualPopulateBatch(batch) {
   const state = batches.get(batch);
   if (!state) throw new Error("Unknown private populate batch");
@@ -5408,14 +5486,8 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          const allowed = await work.hookGate.run(
-            () => evaluateRouteGuard(
-              owner.request,
-              owner.permissions,
-              getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
-            )
-          );
-          if (!allowed) return void 0;
+          if (target.configuration.requireOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+            return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
               req: owner.request,
@@ -5642,7 +5714,7 @@ var init_virtual_populate_execution = __esm({
     publicViewIdentities = /* @__PURE__ */ new WeakMap();
     familyRawFetches = /* @__PURE__ */ new WeakMap();
     addressKey = (address) => JSON.stringify(address);
-    storage = (value) => value instanceof Document4 ? value._doc : isPlainObject19(value) ? value : void 0;
+    storage = (value) => value instanceof Document4 ? value._doc : isPlainObject20(value) ? value : void 0;
     originalRef = (source, key) => {
       const record3 = storage(source);
       return {
@@ -5655,7 +5727,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireOperationAccessForPopulateDependencies === b.binding.configuration.requireOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -5669,7 +5741,7 @@ var init_virtual_populate_execution = __esm({
 });
 
 // src/acl/output-field-filter.ts
-import { isPlainObject as isPlainObject20 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject21 } from "@web-ts-toolkit/utils";
 async function resolveOutputDocumentAuthorization(args) {
   const { authorization, binding } = args;
   const { configuration, access } = readServiceAuthorization(authorization, binding);
@@ -5683,7 +5755,7 @@ async function resolveOutputDocumentAuthorization(args) {
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
-      return isPlainObject20(grants) ? grants : {};
+      return isPlainObject21(grants) ? grants : {};
     } catch (error2) {
       warn("docPermissions hook failed; applying empty document permissions", {
         modelName: binding.modelName,
@@ -5798,7 +5870,7 @@ function copyOutputValue(value, plan, path) {
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
     if (input instanceof Map) return visit(Object.fromEntries(input), current);
-    if (!isPlainObject20(input)) return deepIsolateValue(input);
+    if (!isPlainObject21(input)) return deepIsolateValue(input);
     const output = {};
     for (const [key, entry] of Object.entries(input)) {
       const child = `${current}.${key}`;
@@ -5814,25 +5886,21 @@ function copyOutputValue(value, plan, path) {
 }
 function copyAuthorizedReference(value, plan, path) {
   if (Array.isArray(value)) return value.map((entry) => copyAuthorizedReference(entry, plan, path));
-  if (!isPlainObject20(value)) return deepIsolateValue(value);
+  if (!isPlainObject21(value)) return deepIsolateValue(value);
   const handle = getAssociatedDocumentAuthorization(value, plan.authorization);
   if (handle) {
     const copy = deepIsolateValue(value);
     transferDocumentAuthorizationGraph(value, copy);
     return copy;
   }
-  const { relatedTargets } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  if (relatedTargets.some((target) => target.path === path && target.kind === "passthrough")) {
-    return deepIsolateValue(value);
-  }
   return Object.prototype.hasOwnProperty.call(value, "_id") ? deepIsolateValue(value._id) : void 0;
 }
 function retainOutputMetadata(output, source, configuration, scope2) {
   if (scope2.length || configuration.stripPermissionsField) return;
   const parts = (configuration.documentPermissionField ?? "_permissions").split(".");
   let value = source;
-  for (const part of parts) value = isPlainObject20(value) ? value[part] : void 0;
-  if (!isPlainObject20(value)) return;
+  for (const part of parts) value = isPlainObject21(value) ? value[part] : void 0;
+  if (!isPlainObject21(value)) return;
   const keys2 = configuration.exposedDocPermissionKeys;
   const metadata = Object.fromEntries(
     Object.entries(value).filter(
@@ -5842,7 +5910,7 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   const copy = { ...output };
   let target = copy;
   for (const part of parts.slice(0, -1)) {
-    target[part] = isPlainObject20(target[part]) ? { ...target[part] } : {};
+    target[part] = isPlainObject21(target[part]) ? { ...target[part] } : {};
     target = target[part];
   }
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
@@ -5884,7 +5952,7 @@ async function filterExistingOutput(source, plan, handle, associated) {
           for (const entry of value2) values.push(await one(entry) ?? null);
           return values;
         }
-        if (!isPlainObject20(value2)) return value2 === null ? null : void 0;
+        if (!isPlainObject21(value2)) return value2 === null ? null : void 0;
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
@@ -5964,7 +6032,7 @@ async function filterModelOutputForHelper(args) {
   const plan = helperPlan(normalized.authorization, binding);
   if (args.doc == null) return { output: args.doc, fields: [] };
   const source = isolateDocForOutput(args.doc);
-  if (!isPlainObject20(source)) return authorizationError("output helper requires one plain or hydrated document");
+  if (!isPlainObject21(source)) return authorizationError("output helper requires one plain or hydrated document");
   const knownOutput = !!args.doc && typeof args.doc === "object" && isKnownAuthorizationOutput(args.doc);
   const handle = await resolveOutputDocumentAuthorization({
     authorization: normalized.authorization,
@@ -6059,7 +6127,7 @@ __export(finalize_model_output_exports, {
   finalizeModelOutput: () => finalizeModelOutput,
   finalizeModelOutputs: () => finalizeModelOutputs
 });
-import { get as get9, isPlainObject as isPlainObject21, set as set7 } from "@web-ts-toolkit/utils";
+import { get as get9, isPlainObject as isPlainObject22, set as set7 } from "@web-ts-toolkit/utils";
 async function finalizeSingleDoc(args, input) {
   const scopePath = args.scopePath;
   const plan = args.plan;
@@ -6075,8 +6143,8 @@ async function finalizeSingleDoc(args, input) {
   const privateRow = args.virtualPopulateRow ?? (original && typeof original === "object" ? getVirtualPopulateRow(original) : void 0);
   const privateAddress = args.virtualPopulateAddress ?? [];
   const isolated = isolateDocForOutput(input);
-  const output = isPlainObject21(isolated) ? isolated : {};
-  if (captured && isPlainObject21(input))
+  const output = isPlainObject22(isolated) ? isolated : {};
+  if (captured && isPlainObject22(input))
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
@@ -6131,7 +6199,7 @@ async function finalizeSingleDoc(args, input) {
       );
       continue;
     }
-    if (captured && !isPlainObject21(rawContainer) && !Array.isArray(rawContainer)) {
+    if (captured && !isPlainObject22(rawContainer) && !Array.isArray(rawContainer)) {
       delete output[containerName];
       continue;
     }
@@ -6155,7 +6223,7 @@ async function finalizeSingleDoc(args, input) {
     const finalizeOneChild = async (rawChild, address) => {
       if (captured && Array.isArray(rawChild))
         return mapWithConcurrencyLimit(rawChild, limit, (entry, index) => finalizeOneChild(entry, [...address, index]));
-      if (!isPlainObject21(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
+      if (!isPlainObject22(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
       if (args.traversal?.finalizeEmbeddedChildren) {
         return args.traversal.finalizeEmbeddedChildren({
           containerName,
@@ -6181,7 +6249,7 @@ async function finalizeSingleDoc(args, input) {
         (entry, index) => finalizeOneChild(entry, [...privateAddress, containerName, index])
       );
       output[containerName] = finalized;
-    } else if (isPlainObject21(rawContainer)) {
+    } else if (isPlainObject22(rawContainer)) {
       output[containerName] = await finalizeOneChild(rawContainer, [
         ...privateAddress,
         containerName
@@ -6225,7 +6293,7 @@ async function finalizeSingleDoc(args, input) {
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
     const finalizeOneRelated = async (rawChild, originalChild = rawChild) => {
-      if (!isPlainObject21(rawChild) && !Array.isArray(rawChild)) return rawChild;
+      if (!isPlainObject22(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
       const childOriginal = getIncludeOriginal(originalChild);
       const childRow = childOriginal && typeof childOriginal === "object" ? getVirtualPopulateRow(childOriginal) : void 0;
@@ -6246,7 +6314,7 @@ async function finalizeSingleDoc(args, input) {
         limit,
         (entry, index) => finalizeOneRelated(entry, Array.isArray(originalRelated) ? originalRelated[index] : void 0)
       );
-    } else if (isPlainObject21(rawRelated)) {
+    } else if (isPlainObject22(rawRelated)) {
       finalized = await finalizeOneRelated(rawRelated, originalRelated);
     } else {
       continue;
@@ -6447,20 +6515,20 @@ var init_finalize_model_output = __esm({
     init_field_catalog();
     init_virtual_populate_execution();
     init_include_output();
-    isVirtualContainerValue3 = (value) => isPlainObject21(value) && "sub" in value;
+    isVirtualContainerValue3 = (value) => isPlainObject22(value) && "sub" in value;
     getScopeVirtualsObject2 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !isPlainObject21(rootVirtuals)) return null;
+      if (!rootVirtuals || !isPlainObject22(rootVirtuals)) return null;
       if (scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!isPlainObject21(current)) return null;
+        if (!isPlainObject22(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue3(container)) return null;
         current = container.sub;
-        if (!isPlainObject21(current)) return null;
+        if (!isPlainObject22(current)) return null;
       }
       return current;
     };
@@ -6473,11 +6541,11 @@ var init_finalize_model_output = __esm({
       return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue3(v)).map(([k]) => k);
     };
     getScopedPermissionSchema2 = (root, scopePath) => {
-      if (!root || !isPlainObject21(root)) return null;
+      if (!root || !isPlainObject22(root)) return null;
       if (scopePath.length === 0) return root;
       try {
         const scoped = get9(root, scopePath.join("."));
-        return isPlainObject21(scoped) ? scoped : null;
+        return isPlainObject22(scoped) ? scoped : null;
       } catch {
         return null;
       }
@@ -6536,7 +6604,7 @@ var init_finalize_model_output = __esm({
           const grants = await args.sharedGate.run(
             () => hook.call(args.request, isolatedForHook, globalPerms, scopeContext)
           );
-          const normalized = isPlainObject21(grants) ? grants : {};
+          const normalized = isPlainObject22(grants) ? grants : {};
           scopeContext.docPermissions = normalized;
           return normalized;
         }
@@ -6558,19 +6626,21 @@ var init_finalize_model_output = __esm({
 });
 
 // src/index.ts
-import { isPlainObject as isPlainObject30, isString as isString10, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject31, isString as isString10, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
 
 // src/middleware.ts
 import JsonRouter5 from "@web-ts-toolkit/express-json-router";
-import { isArray as isArray13, isFunction as isFunction7, isPlainObject as isPlainObject26, isString as isString7 } from "@web-ts-toolkit/utils";
+import { isArray as isArray13, isFunction as isFunction7, isPlainObject as isPlainObject27, isString as isString7 } from "@web-ts-toolkit/utils";
 
 // src/core.ts
 init_public_admission();
 init_options();
+init_permission();
 import {
   castArray as castArray4,
   compact as compact3,
   forEach as forEach6,
+  get as get15,
   isArray as isArray12,
   isBoolean as isBoolean5,
   isFunction as isFunction6,
@@ -6580,27 +6650,6 @@ import {
   uniq as uniq3
 } from "@web-ts-toolkit/utils";
 
-// src/meta.ts
-init_runtime();
-init_runtime_context();
-var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
-var getModelRef = (modelName, refPath) => {
-  const direct = getRuntime5().getModelRef(modelName, refPath);
-  if (direct) return direct;
-  if (!refPath.includes(".")) return null;
-  try {
-    const runtime = getRuntime5();
-    const instance = runtime.getModelInstance?.(
-      modelName
-    );
-    const schemaPath = instance?.schema?.path?.(refPath);
-    const ref = schemaPath?.options?.ref ?? schemaPath?.caster?.options?.ref ?? null;
-    return typeof ref === "string" && ref.length > 0 ? ref : null;
-  } catch {
-    return null;
-  }
-};
-
 // src/services/base.ts
 init_options();
 init_helpers();
@@ -6616,7 +6665,7 @@ import {
   forEach as forEach3,
   get as get8,
   isArray as isArray9,
-  isPlainObject as isPlainObject17,
+  isPlainObject as isPlainObject18,
   set as set6,
   uniq
 } from "@web-ts-toolkit/utils";
@@ -6741,7 +6790,7 @@ init_public_admission();
 // src/correlated-includes.ts
 init_request_complexity();
 init_sort_policy();
-import { cloneDeep, isArray as isArray6, isPlainObject as isPlainObject14 } from "@web-ts-toolkit/utils";
+import { cloneDeep, isArray as isArray6, isPlainObject as isPlainObject15 } from "@web-ts-toolkit/utils";
 var PARENT_MARKER_KEY = "$parent";
 var ESCAPE_WRAPPER_KEY = "$escape";
 var SUBQUERY_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["$$sq", "$$date"]);
@@ -6752,10 +6801,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return isPlainObject14(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return isPlainObject15(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return isPlainObject14(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return isPlainObject15(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -6779,7 +6828,7 @@ function containsParentMarkerShape(value) {
       seen.add(current);
       return current.some(visit);
     }
-    if (isPlainObject14(current)) {
+    if (isPlainObject15(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -6809,7 +6858,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if (isPlainObject14(value)) {
+  if (isPlainObject15(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -6874,7 +6923,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if (isPlainObject14(clause)) {
+        if (isPlainObject15(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -6885,7 +6934,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter2) {
   const issues = [];
-  if (!isPlainObject14(filter2)) {
+  if (!isPlainObject15(filter2)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -6934,7 +6983,7 @@ function collectFilterReferencePaths(filter2) {
       value.forEach(visitValue);
       return;
     }
-    if (isPlainObject14(value)) {
+    if (isPlainObject15(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       for (const [key, child] of Object.entries(value)) {
@@ -6980,7 +7029,7 @@ function getOwnPathValue(parent, path) {
   return current;
 }
 function cloneSubstitutedValue(value) {
-  if (isPlainObject14(value) || isArray6(value)) return cloneDeep(value);
+  if (isPlainObject15(value) || isArray6(value)) return cloneDeep(value);
   return value;
 }
 function literalParentRefObject(path) {
@@ -7029,7 +7078,7 @@ function resolveObjectEntries(obj, parent) {
         if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
           throw new CorrelatedReferenceError(`Unsupported $parent reference as a direct ${key} clause`);
         }
-        if (!isPlainObject14(clause)) return cloneSubstitutedValue(clause);
+        if (!isPlainObject15(clause)) return cloneSubstitutedValue(clause);
         return resolveObjectEntries(clause, parent);
       });
       continue;
@@ -7058,10 +7107,10 @@ function resolveValueNode(template, parent, bare) {
     }
     const value = getOwnPathValue(parent, path);
     if (value === void 0 || value === null) throw UNRESOLVABLE;
-    if (bare && isPlainObject14(value)) return { $eq: cloneDeep(value) };
+    if (bare && isPlainObject15(value)) return { $eq: cloneDeep(value) };
     return cloneSubstitutedValue(value);
   }
-  if (isPlainObject14(template)) {
+  if (isPlainObject15(template)) {
     if (hasMarkerKey(template)) {
       throw new CorrelatedReferenceError(
         'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }'
@@ -7103,7 +7152,7 @@ function resolveCorrelatedIdTemplate(id, parent) {
 }
 function resolveCorrelatedFilterTemplate(filter2, parent) {
   try {
-    if (!isPlainObject14(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
+    if (!isPlainObject15(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
       throw new CorrelatedReferenceError("Correlated include filter must be an object");
     }
     return { status: "resolved", filter: resolveObjectEntries(filter2, parent) };
@@ -7118,7 +7167,7 @@ function validateExpandedCorrelatedOperands(expanded, limits) {
 var MAX_NESTED_INCLUDE_DEPTH = 10;
 function validateCorrelatedArgsShape(args, op, depth) {
   if (args === void 0) return [];
-  if (!isPlainObject14(args)) return ["Correlated include args must be an object"];
+  if (!isPlainObject15(args)) return ["Correlated include args must be an object"];
   const record3 = args;
   const allowed = op === "list" ? /* @__PURE__ */ new Set(["select", "sort", "skip", "limit", "page", "pageSize", "include"]) : /* @__PURE__ */ new Set(["select", "sort", "include"]);
   for (const key of Object.keys(record3)) {
@@ -7140,7 +7189,7 @@ function validateCorrelatedArgsShape(args, op, depth) {
   return [];
 }
 function validateCorrelatedIncludeShape(entry, depth = 0) {
-  if (!isPlainObject14(entry)) return ["Correlated include must be an object"];
+  if (!isPlainObject15(entry)) return ["Correlated include must be an object"];
   const record3 = entry;
   if (record3.mode !== "correlated") return ['Correlated include mode must be "correlated"'];
   if (typeof record3.model !== "string" || record3.model.length === 0)
@@ -7153,7 +7202,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   if ("localField" in record3 || "foreignField" in record3) {
     return ["Correlated includes must not carry localField or foreignField"];
   }
-  if (record3.options !== void 0 && !(isPlainObject14(record3.options) && Object.keys(record3.options).length === 0)) {
+  if (record3.options !== void 0 && !(isPlainObject15(record3.options) && Object.keys(record3.options).length === 0)) {
     return ["Correlated include options must be absent or empty"];
   }
   const hasId = record3.id !== void 0;
@@ -7175,7 +7224,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   return validateCorrelatedArgsShape(record3.args, record3.op, depth);
 }
 function isCorrelatedInclude(value) {
-  return isPlainObject14(value) && value.mode === "correlated";
+  return isPlainObject15(value) && value.mode === "correlated";
 }
 
 // src/services/base.ts
@@ -7242,6 +7291,11 @@ function modelServiceOptions(receiver, read) {
   if (call?.receiver !== receiver) return read();
   return call.options ??= read();
 }
+function modelServiceGlobalOptions(receiver, runtime) {
+  const call = dispatch.getStore();
+  if (call?.receiver !== receiver) return runtime.getGlobalOptions();
+  return call.globalOptions ??= runtime.getGlobalOptions();
+}
 
 // src/services/base.ts
 init_request_work();
@@ -7394,9 +7448,31 @@ function castCountGroups(input, values) {
 // src/services/base.ts
 init_service_authorization();
 
+// src/meta.ts
+init_runtime();
+init_runtime_context();
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
+var getModelRef = (modelName, refPath, runtime = getRuntime5()) => {
+  const direct = runtime.getModelRef(modelName, refPath);
+  if (direct) return direct;
+  if (!refPath.includes(".")) return null;
+  try {
+    const instance = runtime.getModelInstance?.(
+      modelName
+    );
+    const schemaPath = instance?.schema?.path?.(refPath);
+    const element = schemaPath?.$embeddedSchemaType ?? schemaPath?.embeddedSchemaType ?? schemaPath?.caster;
+    const ref = schemaPath?.options?.ref ?? element?.options?.ref ?? null;
+    return typeof ref === "string" && ref.length > 0 ? ref : null;
+  } catch {
+    return null;
+  }
+};
+
 // src/acl/related-execution.ts
 init_public_admission();
 init_model_output_planning();
+init_populate_target_configuration();
 init_authorization_snapshot();
 
 // src/acl/service-execution.ts
@@ -7682,7 +7758,7 @@ function staticObjectIdReference(runtime, source, path, target) {
   const scalar = type?.instance === "Array" ? type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster : type;
   return scalar?.instance === "ObjectId" && (type?.options?.ref ?? scalar.options?.ref) === target && type?.options?.refPath === void 0 && scalar.options?.refPath === void 0;
 }
-function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
+function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalOptions = runtime.getGlobalOptions()) {
   if (depth > 32) authorizationError("related descriptor depth exceeded");
   assertPublicAdmission(args.populate, "populate");
   assertPublicAdmission(args.include, "include");
@@ -7691,21 +7767,20 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
   for (const entry of entries(args.populate)) {
     const path = typeof entry === "string" ? entry : entry.path;
     if (typeof entry !== "string") assertPopulateAccess(entry.access);
-    const model = getModelRef(modelName, path);
-    if (model && runtime.hasModel(model))
+    const model = getModelRef(modelName, path, runtime);
+    if (model) {
+      const target = capturePopulateTargetConfiguration(runtime, model, `${modelName}.${path}`);
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, target.options, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !runtime.getGlobalOption("requireRegisteredPopulateModels", true)) {
-      targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
     if (!runtime.hasModel(entry.model)) authorizationError(`Model ${entry.model} not found`);
-    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model);
+    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model, void 0, globalOptions);
     const queryIntent = entry.op === "count" ? void 0 : captureModelServiceIntent(
       {
         defaults: configuration.defaults ?? {},
@@ -7731,7 +7806,13 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
       configuration,
       queryIntent,
       operationGuard: runtime.getModelOption(entry.model, `operationAccess.${entry.op}`),
-      relatedTargets: captureRelatedTargets(runtime, entry.model, queryIntent?.args ?? entry.args ?? {}, depth + 1)
+      relatedTargets: captureRelatedTargets(
+        runtime,
+        entry.model,
+        queryIntent?.args ?? entry.args ?? {},
+        depth + 1,
+        globalOptions
+      )
     });
   }
   if (new Set(targets.map((target) => target.path)).size !== targets.length)
@@ -7880,20 +7961,20 @@ var copyAuthorizedOutput = (value) => {
   transferDocumentAuthorizationGraph(value, copy);
   return copy;
 };
-var isVirtualContainerValueForGuard = (value) => isPlainObject17(value) && "sub" in value;
+var isVirtualContainerValueForGuard = (value) => isPlainObject18(value) && "sub" in value;
 var getScopeVirtualsForGuard = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !isPlainObject17(rootVirtuals)) return null;
+  if (!rootVirtuals || !isPlainObject18(rootVirtuals)) return null;
   if (scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!isPlainObject17(current)) return null;
+    if (!isPlainObject18(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValueForGuard(container)) return null;
     current = container.sub;
-    if (!isPlainObject17(current)) return null;
+    if (!isPlainObject18(current)) return null;
   }
   return current;
 };
@@ -7959,7 +8040,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
       for (const entry of value) stripScope(entry, currentScope);
       return;
     }
-    if (!isPlainObject17(value)) return;
+    if (!isPlainObject18(value)) return;
     const record3 = value;
     const leaves = getScopeVirtualLeafNames(snapshot, currentScope);
     for (const leaf of leaves) {
@@ -7972,7 +8053,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
     for (const key of Object.keys(record3)) {
       if (leaves.has(key) || containers.has(key)) continue;
       const child = record3[key];
-      if (Array.isArray(child) || isPlainObject17(child)) {
+      if (Array.isArray(child) || isPlainObject18(child)) {
         stripScope(child, currentScope);
       }
     }
@@ -7984,7 +8065,7 @@ var LOGICAL_FILTER_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
 var isOperatorKey = (key) => key.startsWith("$");
 var REMOVED_VIRTUAL_FILTER = /* @__PURE__ */ Symbol("removed virtual filter clause");
 var rewriteFilterObject = (value, visit) => {
-  if (!isPlainObject17(value)) return value;
+  if (!isPlainObject18(value)) return value;
   let changed = false;
   const entries = [];
   for (const [key, child] of Object.entries(value)) {
@@ -8015,7 +8096,7 @@ var resolveVirtualFilterField = (path, scope2) => {
     if (!Object.hasOwn(scope2, segment) || scope2[segment] === void 0) return null;
     const definition = scope2[segment];
     if (!isVirtualContainerValueForGuard(definition)) return REMOVED_VIRTUAL_FILTER;
-    scope2 = isPlainObject17(definition.sub) ? definition.sub : null;
+    scope2 = isPlainObject18(definition.sub) ? definition.sub : null;
     inContainer = true;
   }
   return scope2;
@@ -8027,7 +8108,7 @@ var stripVirtualFilterOperator = (key, value, scope2) => {
   }
   if (key === "$all") {
     return rewriteFilterClauses(value, (entry) => {
-      if (!isPlainObject17(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
+      if (!isPlainObject18(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
       return rewriteFilterObject(entry, (operator, operand) => stripVirtualFilterOperator(operator, operand, scope2));
     });
   }
@@ -8042,7 +8123,7 @@ var stripVirtualFilterQuery = (value, scope2, element = false) => {
     if (isOperatorKey(key)) return element ? stripVirtualFilterOperator(key, child, scope2) : child;
     const fieldScope = resolveVirtualFilterField(key, scope2);
     if (fieldScope === REMOVED_VIRTUAL_FILTER) return REMOVED_VIRTUAL_FILTER;
-    if (!fieldScope || !isPlainObject17(child)) return child;
+    if (!fieldScope || !isPlainObject18(child)) return child;
     if (Object.keys(child).some(isOperatorKey)) {
       return rewriteFilterObject(
         child,
@@ -8066,7 +8147,7 @@ function getCorrelatedTemplateDepth(includes) {
   const visit = (entries, depth) => {
     const list = castArray2(entries).filter(Boolean);
     for (const entry of list) {
-      if (!isPlainObject17(entry)) continue;
+      if (!isPlainObject18(entry)) continue;
       max = Math.max(max, depth);
       const nested = entry.args?.include;
       if (nested !== void 0) {
@@ -8095,7 +8176,7 @@ function validateClientFilter(filter2) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!isPlainObject17(value)) return;
+    if (!isPlainObject18(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -8377,9 +8458,9 @@ var Base = class {
       const walk = (node, prefix) => {
         for (const [key, value] of Object.entries(node)) {
           if (value === void 0) continue;
-          if (isPlainObject17(value) && "sub" in value) {
+          if (isPlainObject18(value) && "sub" in value) {
             const sub = value.sub;
-            if (isPlainObject17(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
+            if (isPlainObject18(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
             continue;
           }
           out.push(prefix ? `${prefix}.${key}` : key);
@@ -8432,7 +8513,7 @@ var Base = class {
         this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
       }
       for (const entry of entries) {
-        if (!isPlainObject17(entry)) continue;
+        if (!isPlainObject18(entry)) continue;
         const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
         if (models.has(modelName)) continue;
         models.add(modelName);
@@ -9051,7 +9132,7 @@ import {
   get as get13,
   isArray as isArray10,
   isBoolean as isBoolean4,
-  isPlainObject as isPlainObject24,
+  isPlainObject as isPlainObject25,
   omit,
   set as set10,
   uniq as uniq2,
@@ -9152,7 +9233,7 @@ var model_default = Model;
 // src/acl/distinct-field-authorization.ts
 init_field_authorization();
 init_field_catalog();
-import { isPlainObject as isPlainObject18 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject19 } from "@web-ts-toolkit/utils";
 var schemaVariants = (schema) => Object.values(schema.discriminators ?? {});
 var scalarTypes = /* @__PURE__ */ new Set([
   "String",
@@ -9232,8 +9313,8 @@ function isDistinctFieldAuthorized(args) {
       if (path !== field && !path.startsWith(`${field}.`) && !field.startsWith(`${path}.`)) continue;
       if (path.startsWith(`${field}.`) && (!eligible(path) || !schemaShape(schema, path) || !granted(path)))
         return false;
-      if (isPlainObject18(raw) && raw.sub !== void 0) {
-        if (!isPlainObject18(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
+      if (isPlainObject19(raw) && raw.sub !== void 0) {
+        if (!isPlainObject19(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
       }
     }
     return true;
@@ -9315,7 +9396,9 @@ function prepareSubdocumentOutput(service, sub, operation, virtualAccess, output
     captureRelatedTargets(
       getServiceExecutors(service).binding().runtime,
       service.getServiceModelName(),
-      { populate }
+      { populate },
+      0,
+      configuration
     ),
     void 0,
     configuration,
@@ -9409,7 +9492,7 @@ init_populate_target();
 
 // src/helpers/apply-update.ts
 init_lib();
-import { isPlainObject as isPlainObject22, set as set8 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject23, set as set8 } from "@web-ts-toolkit/utils";
 function applyUpdate(target, data, allowedFields) {
   const wholeFields = /* @__PURE__ */ new Set();
   const partialContainers = /* @__PURE__ */ new Set();
@@ -9429,7 +9512,7 @@ function applyUpdate(target, data, allowedFields) {
   const apply = (values, prefix = "") => {
     for (const [key, value] of Object.entries(values)) {
       const path = prefix ? `${prefix}.${key}` : key;
-      if (partialContainers.has(path) && !wholeFields.has(path) && (isPlainObject22(value) || Array.isArray(value))) {
+      if (partialContainers.has(path) && !wholeFields.has(path) && (isPlainObject23(value) || Array.isArray(value))) {
         apply(value, path);
       } else if (isDocument2(target)) {
         target.set(path, value);
@@ -9446,7 +9529,7 @@ init_document();
 init_request_work();
 init_logger_helpers();
 init_request_complexity();
-import { get as get10, isPlainObject as isPlainObject23, set as set9 } from "@web-ts-toolkit/utils";
+import { get as get10, isPlainObject as isPlainObject24, set as set9 } from "@web-ts-toolkit/utils";
 import { mongo as mongo5 } from "mongoose";
 
 // src/acl/select-resolution.ts
@@ -9563,7 +9646,7 @@ init_field_catalog();
 init_service_authorization();
 var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var inside = (path, root) => path === root || path.startsWith(`${root}.`);
-var record2 = (value) => isPlainObject23(value);
+var record2 = (value) => isPlainObject24(value);
 function inputValue(value) {
   if (typeof value === "function" || typeof value === "symbol") {
     authorizationError("input values must be persisted data, not functions or symbols");
@@ -10354,10 +10437,12 @@ var Service = class extends Base {
         model: this.model.mongooseModel,
         modelName: this.modelName
       }),
-      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName, {
-        ...this.options,
-        defaults: this.defaults
-      }) : { catalog: { paths: [] }, ...this.options },
+      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(
+        this.requestRuntime,
+        this.modelName,
+        { ...this.options, defaults: this.defaults },
+        modelServiceGlobalOptions(this, this.requestRuntime)
+      ) : { catalog: { paths: [] }, ...this.options },
       permissions: () => this.requestCore.getPermissions?.() ?? new permission_default({}),
       parse: (filter2) => this.parseClientData(filter2, this.getCorrelatedExecState().scheduler),
       validate: (filter2, expanded) => {
@@ -10886,12 +10971,13 @@ var Service = class extends Base {
     });
   }
   captureRelated(args, defaults) {
+    const globalOptions = modelServiceGlobalOptions(this, this.requestRuntime);
     const effective = { populate: args?.populate ?? defaults?.populate, include: args?.include ?? defaults?.include };
     if (effective.include) {
       const processed = this.processInclude(effective.include);
       effective.include = [...processed.includes, ...processed.correlatedIncludes];
     }
-    return captureRelatedTargets(this.requestRuntime, this.modelName, effective);
+    return captureRelatedTargets(this.requestRuntime, this.modelName, effective, 0, globalOptions);
   }
   /** Canonical population uses the target's retained policy for both fetch and output. */
   async genExecutionPopulate(execution, access, populate) {
@@ -10913,14 +10999,9 @@ var Service = class extends Base {
         modelPermissionPrefix: captured.configuration.modelPermissionPrefix
       });
       if (sourceState === "denied") continue;
-      const modelName = getModelRef(this.modelName, descriptor.path);
+      const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
+      const modelName = target?.modelName;
       if (!modelName) continue;
-      if (!this.requestRuntime.hasModel(modelName)) {
-        if (captured.relatedTargets.some((target) => target.path === descriptor.path && target.kind === "passthrough")) {
-          result2.push({ path: descriptor.path, select: descriptor.select });
-        }
-        continue;
-      }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
       const svc = this.requestCore.getPublicService(modelName);
       const child = createRelatedExecution(
@@ -10939,7 +11020,7 @@ var Service = class extends Base {
       if (isExecutionRowDenied(svc, child)) continue;
       const childState = readServiceExecution(svc, child);
       const targetConfiguration = readServiceAuthorization(childState.authorization, childState.binding).configuration;
-      if (policy?.operation.mode !== "grant" && !await this.hookGate.run(
+      if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && policy?.operation.mode !== "grant" && !await this.hookGate.run(
         () => evaluateRouteGuard(
           this.req,
           getAuthorizationPermissions(childState.authorization, childState.binding),
@@ -10971,7 +11052,7 @@ var Service = class extends Base {
           schema: childState.binding.model.schema,
           configuration: targetConfiguration,
           requestRead: targetAccess === "read" && policy?.operation.mode !== "grant" && readServiceAuthorization(childState.authorization, childState.binding).authorization.rows.mode === "request",
-          staticObjectIdReference: captured.relatedTargets.find((target) => target.path === descriptor.path)?.staticObjectIdReference
+          staticObjectIdReference: captured.relatedTargets.find((target2) => target2.path === descriptor.path)?.staticObjectIdReference
         }
       });
       result2.push(ret);
@@ -10991,7 +11072,7 @@ var Service = class extends Base {
     if (this.isScalarPopulateValue(rawTarget)) return rawTarget;
     const isDoc = (() => {
       try {
-        if (isPlainObject24(rawTarget)) return true;
+        if (isPlainObject25(rawTarget)) return true;
         const maybe = rawTarget;
         if (maybe && typeof maybe === "object" && "_doc" in maybe) return true;
         if (maybe && typeof maybe.toObject === "function") return true;
@@ -11015,15 +11096,13 @@ var Service = class extends Base {
       transferDocumentAuthorizationGraph(source, copy2);
       return copy2;
     }
-    let targetMongooseModel;
-    try {
-      const inst = this.requestRuntime.getModelInstance?.(
-        meta.targetModelName
-      );
-      void inst;
-      targetMongooseModel = inst;
-    } catch {
-      targetMongooseModel = parentContext.mongooseModel;
+    let targetMongooseModel = meta.fetchBinding?.model;
+    if (!targetMongooseModel) {
+      try {
+        targetMongooseModel = this.requestRuntime.getModelInstance(meta.targetModelName);
+      } catch {
+        targetMongooseModel = parentContext.mongooseModel;
+      }
     }
     const targetContext = {
       mongooseModel: targetMongooseModel ?? parentContext.mongooseModel,
@@ -13396,7 +13475,7 @@ init_helpers();
 
 // src/processors.ts
 init_permissions_alias();
-import { cloneDeep as cloneDeep5, forEach as forEach5, get as get14, hasOwn as hasOwn3, isArray as isArray11, isPlainObject as isPlainObject25, map, set as set11 } from "@web-ts-toolkit/utils";
+import { cloneDeep as cloneDeep5, forEach as forEach5, get as get14, hasOwn as hasOwn3, isArray as isArray11, isPlainObject as isPlainObject26, map, set as set11 } from "@web-ts-toolkit/utils";
 function cloneProcessorValue(value) {
   const copy = cloneDeep5(value);
   copyPermissionsAliasGraph(value, copy);
@@ -13436,7 +13515,7 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!isPlainObject25(target)) return ret;
+      if (!isPlainObject26(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
       if (isArray11(next)) {
@@ -13450,7 +13529,7 @@ function resolveLeafParents(obj, src) {
   const leaf = segs[segs.length - 1];
   const pairs = [];
   forEach5(targets, (target) => {
-    if (!isPlainObject25(target)) return;
+    if (!isPlainObject26(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -13471,7 +13550,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     forEach5(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
         forEach5(targets, (target) => {
-          if (!isPlainObject25(target)) return;
+          if (!isPlainObject26(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
@@ -13479,7 +13558,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           if (isArray11(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => isPlainObject25(item))) {
+            } else if (leaf.every((item) => isPlainObject26(item))) {
               depopulated = map(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
@@ -13489,7 +13568,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if (isPlainObject25(leaf)) {
+          } else if (isPlainObject26(leaf)) {
             const id = get14(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
@@ -13503,7 +13582,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!isPlainObject25(target)) return ret;
+          if (!isPlainObject26(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
           if (isArray11(next)) {
@@ -13609,7 +13688,7 @@ var countPaths = (docObject, operations, options = { mutable: true }) => {
       let count;
       if (isArray11(leafValue)) {
         count = leafValue.length;
-      } else if (isPlainObject25(leafValue)) {
+      } else if (isPlainObject26(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
@@ -13687,6 +13766,8 @@ init_core_shared();
 init_virtual_projection();
 init_populate_target();
 init_model_output_planning();
+init_authorization_snapshot();
+init_document();
 init_output_field_filter();
 init_request_work();
 var emptyPermissionLeaf = () => ({ $: "_" });
@@ -13797,17 +13878,11 @@ var Core = class {
     return this.genSelect(modelName, access, targetFields, options);
   }
   /** Persisted request-only populate admission; fetch planning is not field authority. */
-  async requestPopulateSelect(modelName, access, targetFields = null, scopePath = []) {
+  async requestPopulateSelect(configuration, permissions, access, targetFields = null, scopePath = []) {
     const subPaths = scopePath.flatMap((part) => [part, "sub"]);
-    const permissionSchema = getModelOption(modelName, ["permissionSchema"].concat(subPaths).join("."));
-    const permissions = this.getGlobalPermissions();
-    let virtualNames;
-    try {
-      const runtime = getActiveRuntime() ?? defaultRuntime;
-      virtualNames = runtime.getVirtualNames(modelName, subPaths);
-    } catch {
-      virtualNames = [];
-    }
+    const permissionSchema = get15(configuration, ["permissionSchema", ...subPaths]);
+    const prefix = scopePath.length ? `${scopePath.join(".")}.` : "";
+    const virtualNames = (configuration.catalog.virtualPaths ?? []).filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).filter((path) => !path.includes("."));
     return resolveSelectForRequest({
       req: this.req,
       permissionSchema,
@@ -13826,13 +13901,21 @@ var Core = class {
     assertPublicAdmission(_populate, "populate");
     assertPopulateAccess(access);
     if (!_populate) return [];
-    let populate = Array.isArray(_populate) ? _populate : [_populate];
-    for (const p of populate) {
+    const descriptors = copyAuthorizationValue(Array.isArray(_populate) ? _populate : [_populate], true);
+    for (const p of descriptors) {
       if (!isString6(p)) assertPopulateAccess(p.access);
     }
-    populate = compact3(
+    const runtime = this.requestRuntime;
+    const globalOptions = modelServiceGlobalOptions(this, runtime);
+    const relatedTargets = captureRelatedTargets(runtime, modelName, { populate: descriptors }, 0, globalOptions);
+    const sourceConfiguration = captureModelAuthorizationConfiguration(runtime, modelName, void 0, globalOptions);
+    const originalPermissions = this.getGlobalPermissions();
+    const permissions = new permission_default(
+      Object.fromEntries(originalPermissions.keys.map((key) => [key, originalPermissions.has(key)]))
+    );
+    const populate = compact3(
       await Promise.all(
-        populate.map(async (p) => {
+        descriptors.map(async (p) => {
           const populateAccess = !isString6(p) && p.access ? p.access : access;
           assertPopulateAccess(populateAccess);
           const originalSelect = isString6(p) ? void 0 : p.select;
@@ -13844,78 +13927,86 @@ var Core = class {
           const pathForSourcePermission = scopePrefix && ret.path.startsWith(`${scopePrefix}.`) ? ret.path.slice(scopePrefix.length + 1) : ret.path;
           const parentPath = pathForSourcePermission.includes(".") ? pathForSourcePermission.split(".")[0] : pathForSourcePermission;
           const allowedParentPaths = await this.requestPopulateSelect(
-            modelName,
+            sourceConfiguration,
+            permissions,
             populateAccess,
             [parentPath],
             scopePath
           );
           if (!allowedParentPaths.includes(parentPath)) return null;
-          const refModelName = getModelRef(modelName, ret.path);
-          if (!refModelName) return null;
-          const runtime = getActiveRuntime();
-          if (!runtime) return null;
-          const requireRegisteredPopulateModels = getGlobalOption("requireRegisteredPopulateModels", true);
-          if (!runtime.hasModel(refModelName)) {
-            return requireRegisteredPopulateModels ? null : ret;
-          }
-          const allowedTargetOperation = await this.isAllowed(refModelName, populateAccess);
-          if (!allowedTargetOperation) {
+          const target = relatedTargets.find((entry) => entry.path === ret.path);
+          if (!target) return null;
+          const refModelName = target.modelName;
+          const targetConfiguration = target.configuration;
+          if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && !await withCapturedModelOperationGuard(
+            this,
+            refModelName,
+            populateAccess,
+            getCapturedAuthorizationOption(targetConfiguration, `operationAccess.${populateAccess}`),
+            permissions,
+            () => this.isAllowed(refModelName, populateAccess)
+          )) {
             return null;
           }
-          ret.select = await this.requestPopulateSelect(refModelName, populateAccess, ret.select);
-          const hookInputs = getModelOption(refModelName, `alwaysSelectFields.${populateAccess}`, []);
-          ret.select = uniq3([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
-          const filter2 = await this.genFilter(refModelName, populateAccess, null);
+          ret.select = await this.requestPopulateSelect(
+            targetConfiguration,
+            permissions,
+            populateAccess,
+            ret.select
+          );
+          const hookInputs = resolveAlwaysSelectForAccess(
+            targetConfiguration.alwaysSelectFields,
+            populateAccess
+          );
+          ret.select = uniq3([
+            ...ret.select,
+            ...stripVirtuals(hookInputs, [...targetConfiguration.catalog.virtualPaths ?? []])
+          ]);
+          const match = isString6(p) ? {} : p.match ?? {};
+          const filter2 = await resolveAccessFilterForRequest({
+            req: this.req,
+            permissions,
+            cache: this.caches.baseFilter,
+            cacheKey: `${refModelName}_baseFilter_${populateAccess}`,
+            access: populateAccess,
+            filter: deepIsolateValue(match),
+            getOption: (key) => getCapturedAuthorizationOption(targetConfiguration, key)
+          });
           if (filter2 === false) return null;
-          ret.match = filter2;
-          try {
-            const planAccess = populateAccess;
-            const targetSnapshot = {
-              permissionSchema: getModelOption(refModelName, "permissionSchema", null) ?? null,
-              virtuals: getModelOption(refModelName, "virtuals", null) ?? null,
-              alwaysSelectFields: getModelOption(refModelName, "alwaysSelectFields", null) ?? null,
-              modelPermissionPrefix: getModelOption(refModelName, "modelPermissionPrefix", "") ?? "",
-              requireExplicitSelect: getModelOption(refModelName, "requireExplicitSelect", false) ?? false,
-              documentPermissionField: getModelOption(refModelName, "documentPermissionField", "_permissions") ?? "_permissions",
-              exposedDocPermissionKeys: getModelOption(refModelName, "exposedDocPermissionKeys", void 0),
-              stripPermissionsField: getModelOption(refModelName, "stripPermissionsField", false) ?? false,
-              disableFieldPermissions: getModelOption(refModelName, "disableFieldPermissions", false) ?? false
-            };
-            const perms = this.getPermissions();
-            const globalForPlan = perms && typeof perms.has === "function" && typeof perms.hasKey === "function" ? perms : { has: () => false, hasKey: () => false };
-            const targetPlan = planVirtualProjection({
-              receivingModelName: refModelName,
-              snapshot: {
-                permissionSchema: targetSnapshot.permissionSchema,
-                virtuals: targetSnapshot.virtuals,
-                alwaysSelectFields: targetSnapshot.alwaysSelectFields,
-                modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
-                requireExplicitSelect: targetSnapshot.requireExplicitSelect,
-                documentPermissionField: targetSnapshot.documentPermissionField
-              },
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              internalFetch: { baseFields: ["_id"] },
-              globalPermissions: globalForPlan
-            });
-            const merged = uniq3([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
-              (t) => t !== "-_id" && !t.includes(".sub.")
-            );
-            if (!merged.includes("_id")) merged.push("_id");
-            ret.select = merged;
-            setPopulateTargetMeta(ret, {
-              targetModelName: refModelName,
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              plan: targetPlan,
-              snapshot: targetSnapshot
-            });
-          } catch {
-          }
+          ret.match = deepIsolateValue(intersectFilters(match, filter2));
+          const planAccess = populateAccess;
+          const targetSnapshot = targetConfiguration;
+          const targetPlan = planVirtualProjection({
+            receivingModelName: refModelName,
+            snapshot: {
+              permissionSchema: targetSnapshot.permissionSchema,
+              virtuals: targetSnapshot.virtuals,
+              alwaysSelectFields: targetSnapshot.alwaysSelectFields,
+              modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
+              requireExplicitSelect: targetSnapshot.requireExplicitSelect,
+              documentPermissionField: targetSnapshot.documentPermissionField
+            },
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            internalFetch: { baseFields: ["_id"] },
+            globalPermissions: permissions
+          });
+          const merged = uniq3([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
+            (t) => t !== "-_id" && !t.includes(".sub.")
+          );
+          if (!merged.includes("_id")) merged.push("_id");
+          ret.select = merged;
+          setPopulateTargetMeta(ret, {
+            targetModelName: refModelName,
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            plan: targetPlan,
+            snapshot: targetSnapshot
+          });
           return ret;
         })
       )
@@ -14239,12 +14330,12 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if (isPlainObject26(condition)) {
+    if (isPlainObject27(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
       let _id = isString7(id) ? id : null;
-      if (isPlainObject26(id)) {
+      if (isPlainObject27(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
@@ -14286,7 +14377,7 @@ import express2 from "express";
 
 // src/routers/model-router.ts
 import JsonRouter8 from "@web-ts-toolkit/express-json-router";
-import { forEach as forEach7, isPlainObject as isPlainObject28, isString as isString8, isUndefined as isUndefined2, normalizeUrlPath as normalizeUrlPath3, padEnd } from "@web-ts-toolkit/utils";
+import { forEach as forEach7, isPlainObject as isPlainObject29, isString as isString8, isUndefined as isUndefined2, normalizeUrlPath as normalizeUrlPath3, padEnd } from "@web-ts-toolkit/utils";
 init_logger_helpers();
 init_runtime();
 init_runtime_context();
@@ -14420,7 +14511,7 @@ import JsonRouter7 from "@web-ts-toolkit/express-json-router";
 
 // src/validation/common.ts
 import { z as z2 } from "zod";
-import { isPlainObject as isPlainObject27 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject28 } from "@web-ts-toolkit/utils";
 
 // src/validation/public-admission-schema.ts
 init_public_admission();
@@ -14549,7 +14640,7 @@ var correlatedFilterSchema = z2.record(z2.string(), z2.unknown()).superRefine((f
   }
 });
 var correlatedEmptyOptionsSchema = z2.unknown().refine(
-  (value) => value === void 0 || isPlainObject27(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || isPlainObject28(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = z2.string().min(1).superRefine((path, ctx) => {
@@ -14586,7 +14677,7 @@ var correlatedListArgsSchema = z2.object({
   include: z2.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = z2.unknown().refine(
-  (value) => value === void 0 || isPlainObject27(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || isPlainObject28(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = z2.object({
@@ -14639,7 +14730,7 @@ var correlatedNestedIncludeSchema = z2.union([includeItemSchema, z2.array(includ
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if (isPlainObject27(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if (isPlainObject28(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: z2.ZodIssueCode.custom,
@@ -16640,7 +16731,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && isPlainObject28(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject29(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(
         this.modelName,
@@ -17174,7 +17265,7 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 import JsonRouter10 from "@web-ts-toolkit/express-json-router";
-import { isPlainObject as isPlainObject29, isString as isString9, isUndefined as isUndefined3, normalizeUrlPath as normalizeUrlPath5 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject30, isString as isString9, isUndefined as isUndefined3, normalizeUrlPath as normalizeUrlPath5 } from "@web-ts-toolkit/utils";
 init_runtime();
 init_helpers();
 init_schemas();
@@ -17390,7 +17481,7 @@ var DataRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && isPlainObject29(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject30(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -17549,7 +17640,7 @@ function createRuntimeApi(runtime) {
     if (arguments.length === 2 && isString10(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && isPlainObject30(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject31(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };