npm - @web-ts-toolkit/access-router - Versions diffs - 0.56.0 → 0.57.0 - Mend

@web-ts-toolkit/access-router 0.56.0 → 0.57.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +177 -120
package/advanced.d.mts +1 -1
package/advanced.d.ts +1 -1
package/advanced.js +95 -66
package/advanced.mjs +62 -33
package/index.d.mts +2 -2
package/index.d.ts +2 -2
package/index.js +545 -514
package/index.mjs +282 -251
package/llms.txt +2 -2
package/package.json +3 -3
package/{parsers-BXKoUKMa.d.mts → parsers-CngKnVjW.d.mts} +65 -37
package/{parsers-BXKoUKMa.d.ts → parsers-CngKnVjW.d.ts} +65 -37

package/index.js CHANGED Viewed

@@ -2161,9 +2161,34 @@ var init_field_catalog = __esm({
   }
 });
+// src/acl/populate-target-configuration.ts
+function capturePopulateTargetConfiguration(runtime, modelName, source, proposedOptions) {
+  const label = `Populate target "${modelName}" for ${source}`;
+  if (!proposedOptions && !runtime.hasModel(modelName))
+    authorizationError(
+      `${label} must be configured first in this runtime; register its Mongoose model and setModelOptions with an object permissionSchema`
+    );
+  const model = runtime.getModelInstance(modelName);
+  if (!model) authorizationError(`${label} requires an actual registered Mongoose model in this runtime`);
+  const options = proposedOptions ?? runtime.getModelOptions(modelName);
+  const permissionSchema = options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema;
+  if (!(0, import_utils15.isPlainObject)(permissionSchema))
+    authorizationError(
+      `${label} requires an effective object permissionSchema; configure the model or runtime model defaults ({} explicitly closes business fields)`
+    );
+  return { model, options: { ...options, permissionSchema } };
+}
+var import_utils15;
+var init_populate_target_configuration = __esm({
+  "src/acl/populate-target-configuration.ts"() {
+    import_utils15 = require("@web-ts-toolkit/utils");
+    init_authorization_snapshot();
+  }
+});
 // src/acl/virtual-populate-dependencies.ts
 function record(value, label) {
-  if (!(0, import_utils15.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
+  if (!(0, import_utils16.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
   for (const key of Reflect.ownKeys(value)) {
     const property = Object.getOwnPropertyDescriptor(value, key);
     if (typeof key !== "string" || !property.enumerable || !("value" in property))
@@ -2252,7 +2277,8 @@ function normalizeSelection(select, catalog, label) {
   };
 }
 function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
-  const requireReadOperationAccessForPopulateDependencies = globalOptions.requireReadOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateDependencies = globalOptions.requireOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateQueries = globalOptions.requireOperationAccessForPopulateQueries !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2292,16 +2318,23 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
                 label,
                 `target "${ref}" requires a registered same-connection non-discriminator ObjectId model bound to the source ref`
               );
-            const targetOptions = ref === modelName ? options : runtime.getModelOptions(ref);
+            const { options: targetOptions } = capturePopulateTargetConfiguration(
+              runtime,
+              ref,
+              `dependsOnPopulate virtual "${label}"`,
+              ref === modelName ? options : void 0
+            );
             const defaults = runtime.getDefaultModelOptions();
-            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils15.get)(targetOptions, path2, fallback), key, (0, import_utils15.get)(defaults, key));
+            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils16.get)(targetOptions, path2, fallback), key, (0, import_utils16.get)(defaults, key));
             const documentPermissionField = targetOptions.documentPermissionField ?? defaults.documentPermissionField;
             const catalog = captureAuthorizationFieldCatalog(targetModel.schema, void 0, documentPermissionField);
             const configuration = copyAuthorizationValue(
               {
                 catalog,
                 documentPermissionField,
-                requireReadOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateQueries,
+                permissionSchema: targetOptions.permissionSchema,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2350,13 +2383,13 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
         );
         continue;
       }
-      if (!(0, import_utils15.isPlainObject)(raw)) continue;
+      if (!(0, import_utils16.isPlainObject)(raw)) continue;
       const entry = raw;
       const label = join(sourcePrefix, name);
       captureList(entry.dependsOnPopulate, label);
       if (!("get" in entry))
         for (const access of accesses) {
-          if ((0, import_utils15.isPlainObject)(entry[access]))
+          if ((0, import_utils16.isPlainObject)(entry[access]))
             captureList(entry[access].dependsOnPopulate, `${label}.${access}`);
         }
       const byAccess = {};
@@ -2406,15 +2439,16 @@ function resolveVirtualPopulateDependencies(configuration, scopePath, virtualNam
     )
   );
 }
-var import_utils15, elementType, join, within, accesses, fail, varyingSchema, varyingModel, snapshots;
+var import_utils16, elementType, join, within, accesses, fail, varyingSchema, varyingModel, snapshots;
 var init_virtual_populate_dependencies = __esm({
   "src/acl/virtual-populate-dependencies.ts"() {
-    import_utils15 = require("@web-ts-toolkit/utils");
+    import_utils16 = require("@web-ts-toolkit/utils");
     init_query();
     init_manager();
     init_authorization_snapshot();
     init_field_catalog();
     init_virtual_descriptor();
+    init_populate_target_configuration();
     elementType = (type) => type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster;
     join = (prefix, path) => prefix ? `${prefix}.${path}` : path;
     within = (path, parent) => path === parent || path.startsWith(`${parent}.`);
@@ -2429,14 +2463,14 @@ var init_virtual_populate_dependencies = __esm({
 });
 // src/runtime.ts
-var import_mongoose4, import_mongoose_schema_jsonschema, import_utils16, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue2, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, AccessRuntime, defaultRuntime;
+var import_mongoose4, import_mongoose_schema_jsonschema, import_utils17, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue2, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, AccessRuntime, defaultRuntime;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     import_mongoose4 = __toESM(require("mongoose"));
     init_public_admission();
     init_hydration();
     import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-    import_utils16 = require("@web-ts-toolkit/utils");
+    import_utils17 = require("@web-ts-toolkit/utils");
     init_helpers();
     init_registry();
     init_logger_default();
@@ -2465,44 +2499,44 @@ var init_runtime = __esm({
       listHardLimit: DEFAULT_LIST_HARD_LIMIT
     };
     normalizeBasePath = (name, value) => {
-      if ((0, import_utils16.isNil)(value)) {
+      if ((0, import_utils17.isNil)(value)) {
         return `/${pluralize(name)}`;
       }
-      return (0, import_utils16.isString)(value) ? (0, import_utils16.addLeadingSlash)(value) : "";
+      return (0, import_utils17.isString)(value) ? (0, import_utils17.addLeadingSlash)(value) : "";
     };
     hasModelPermission = (value, modelPermissionPrefix) => {
       if (!modelPermissionPrefix) {
         return true;
       }
-      if ((0, import_utils16.isString)(value)) {
+      if ((0, import_utils17.isString)(value)) {
         return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
       }
-      if ((0, import_utils16.isArray)(value)) {
+      if ((0, import_utils17.isArray)(value)) {
         return value.some((item) => {
-          if ((0, import_utils16.isString)(item) || (0, import_utils16.isArray)(item)) {
+          if ((0, import_utils17.isString)(item) || (0, import_utils17.isArray)(item)) {
             return hasModelPermission(item, modelPermissionPrefix);
           }
           return true;
         });
       }
-      return (0, import_utils16.isFunction)(value);
+      return (0, import_utils17.isFunction)(value);
     };
     classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       const schemaKeys = Object.keys(permissionSchema);
       const globalPermissionKeys = {};
       const modelPermissionKeys = {};
-      (0, import_utils16.forEach)(schemaKeys, (schemaKey) => {
+      (0, import_utils17.forEach)(schemaKeys, (schemaKey) => {
         const schemaRule = permissionSchema[schemaKey];
-        const ruleEntries = (0, import_utils16.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+        const ruleEntries = (0, import_utils17.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
         for (let x = 0; x < ruleEntries.length; x++) {
           const [accessKey, value] = ruleEntries[x];
-          if (!(0, import_utils16.isArray)(globalPermissionKeys[accessKey])) {
+          if (!(0, import_utils17.isArray)(globalPermissionKeys[accessKey])) {
             globalPermissionKeys[accessKey] = [];
           }
-          if (!(0, import_utils16.isArray)(modelPermissionKeys[accessKey])) {
+          if (!(0, import_utils17.isArray)(modelPermissionKeys[accessKey])) {
             modelPermissionKeys[accessKey] = [];
           }
-          if ((0, import_utils16.isBoolean)(value)) {
+          if ((0, import_utils17.isBoolean)(value)) {
             globalPermissionKeys[accessKey].push(schemaKey);
             continue;
           }
@@ -2534,13 +2568,13 @@ var init_runtime = __esm({
     VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
     VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
     VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-    isVirtualContainerValue2 = (value) => (0, import_utils16.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue2 = (value) => (0, import_utils17.isPlainObject)(value) && "sub" in value;
     virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
       try {
-        if ((0, import_utils16.get)((0, import_utils16.set)({}, virtualPath, true), permissionField) !== void 0) return true;
-        if ((0, import_utils16.get)((0, import_utils16.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+        if ((0, import_utils17.get)((0, import_utils17.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+        if ((0, import_utils17.get)((0, import_utils17.set)({}, permissionField, true), virtualPath) !== void 0) return true;
       } catch {
         return false;
       }
@@ -2601,12 +2635,12 @@ var init_runtime = __esm({
     };
     validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
       if (dependsOn === void 0) return [];
-      if (!(0, import_utils16.isArray)(dependsOn)) {
+      if (!(0, import_utils17.isArray)(dependsOn)) {
         throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
       }
       const list = dependsOn;
       for (const dep of list) {
-        if (!(0, import_utils16.isString)(dep) || dep.length === 0) {
+        if (!(0, import_utils17.isString)(dep) || dep.length === 0) {
           throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
         }
         if (dep.includes(".")) {
@@ -2628,12 +2662,12 @@ var init_runtime = __esm({
       return list;
     };
     validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
-      if ((0, import_utils16.isFunction)(value)) return;
-      if (!(0, import_utils16.isPlainObject)(value)) {
+      if ((0, import_utils17.isFunction)(value)) return;
+      if (!(0, import_utils17.isPlainObject)(value)) {
         throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
       }
       const record3 = value;
-      if (!(0, import_utils16.isFunction)(record3.get)) {
+      if (!(0, import_utils17.isFunction)(record3.get)) {
         throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
       }
       validateVirtualDependsOn(record3.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
@@ -2675,7 +2709,7 @@ var init_runtime = __esm({
               `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
             );
           }
-          if (!(0, import_utils16.isPlainObject)(record4.sub)) {
+          if (!(0, import_utils17.isPlainObject)(record4.sub)) {
             throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
           }
           continue;
@@ -2685,8 +2719,8 @@ var init_runtime = __esm({
             `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
           );
         }
-        if ((0, import_utils16.isFunction)(raw)) continue;
-        if (!(0, import_utils16.isPlainObject)(raw)) {
+        if ((0, import_utils17.isFunction)(raw)) continue;
+        if (!(0, import_utils17.isPlainObject)(raw)) {
           throw new Error(
             `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
           );
@@ -2740,7 +2774,7 @@ var init_runtime = __esm({
     };
     validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
       if (virtuals === void 0 || virtuals === null) return;
-      if (!(0, import_utils16.isPlainObject)(virtuals)) {
+      if (!(0, import_utils17.isPlainObject)(virtuals)) {
         throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
       }
       const rootSchema = model?.schema ?? null;
@@ -2792,8 +2826,8 @@ var init_runtime = __esm({
           {
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
-            requireRegisteredPopulateModels: true,
-            requireReadOperationAccessForPopulateDependencies: true,
+            requireOperationAccessForPopulateQueries: true,
+            requireOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2848,7 +2882,7 @@ var init_runtime = __esm({
       }
       registerOpenApiRoute(route) {
         this.openApiRegistry.register(
-          this.openApiPathPrefix ? { ...route, path: (0, import_utils16.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+          this.openApiPathPrefix ? { ...route, path: (0, import_utils17.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
         );
       }
       /**
@@ -2859,7 +2893,7 @@ var init_runtime = __esm({
        */
       withOpenApiPathPrefix(prefix, build) {
         const previous = this.openApiPathPrefix;
-        this.openApiPathPrefix = (0, import_utils16.normalizeUrlPath)(`${previous}/${prefix}`);
+        this.openApiPathPrefix = (0, import_utils17.normalizeUrlPath)(`${previous}/${prefix}`);
         try {
           return build();
         } finally {
@@ -2967,13 +3001,15 @@ var init_runtime = __esm({
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
         const next = { ...options };
-        if ("requireReadOperationAccessForPopulateDependencies" in next)
-          next.requireReadOperationAccessForPopulateDependencies = next.requireReadOperationAccessForPopulateDependencies !== false;
+        if ("requireOperationAccessForPopulateQueries" in next)
+          next.requireOperationAccessForPopulateQueries = next.requireOperationAccessForPopulateQueries !== false;
+        if ("requireOperationAccessForPopulateDependencies" in next)
+          next.requireOperationAccessForPopulateDependencies = next.requireOperationAccessForPopulateDependencies !== false;
         this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
-        if (key === "requireReadOperationAccessForPopulateDependencies") {
-          this.globalOptions.set("requireReadOperationAccessForPopulateDependencies", value !== false);
+        if (key === "requireOperationAccessForPopulateQueries" || key === "requireOperationAccessForPopulateDependencies") {
+          this.globalOptions.set(key, value !== false);
           return;
         }
         this.globalOptions.set(key, value);
@@ -3002,7 +3038,7 @@ var init_runtime = __esm({
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils16.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils17.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
         this.defaultModelOptions.set(key, value);
@@ -3031,7 +3067,7 @@ var init_runtime = __esm({
         }).onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             modelName,
-            (0, import_utils16.isString)(newval) || (0, import_utils16.isNil)(newval) ? newval : void 0
+            (0, import_utils17.isString)(newval) || (0, import_utils17.isNil)(newval) ? newval : void 0
           );
         }).build();
         this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -3075,7 +3111,7 @@ var init_runtime = __esm({
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils16.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils17.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
         const manager = this.modelOptions[modelName];
@@ -3096,15 +3132,15 @@ var init_runtime = __esm({
               const segments = nestedPath.split(".");
               let cursor = cloned;
               for (let i = 0; i < segments.length - 1; i++) {
-                if (!(0, import_utils16.isPlainObject)(cursor)) break;
+                if (!(0, import_utils17.isPlainObject)(cursor)) break;
                 cursor = cursor[segments[i]];
               }
-              if ((0, import_utils16.isPlainObject)(cursor)) {
+              if ((0, import_utils17.isPlainObject)(cursor)) {
                 delete cursor[segments[segments.length - 1]];
               }
               proposedVirtuals = cloned;
             } else {
-              (0, import_utils16.set)(cloned, nestedPath, value);
+              (0, import_utils17.set)(cloned, nestedPath, value);
               proposedVirtuals = cloned;
             }
           }
@@ -3205,7 +3241,7 @@ var init_runtime = __esm({
         manager.onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             dataName,
-            (0, import_utils16.isString)(newval) || (0, import_utils16.isNil)(newval) ? newval : void 0
+            (0, import_utils17.isString)(newval) || (0, import_utils17.isNil)(newval) ? newval : void 0
           );
         }).build();
         return manager;
@@ -3265,20 +3301,20 @@ var init_runtime = __esm({
         const schema = model.schema;
         this.modelRefs[modelName] = buildRefs(schema.tree);
         this.modelSubs[modelName] = buildSubPaths(schema.tree);
-        this.modelAtts[modelName] = (0, import_utils16.keys)(schema.obj);
+        this.modelAtts[modelName] = (0, import_utils17.keys)(schema.obj);
       }
       getModelRef(modelName, refPath) {
         this.ensureModelMeta(modelName);
-        const value = (0, import_utils16.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-        return (0, import_utils16.isString)(value) ? value : null;
+        const value = (0, import_utils17.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+        return (0, import_utils17.isString)(value) ? value : null;
       }
       getModelSub(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils16.get)(this.modelSubs, modelName, []);
+        return (0, import_utils17.get)(this.modelSubs, modelName, []);
       }
       getModelAtt(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils16.get)(this.modelAtts, modelName, []);
+        return (0, import_utils17.get)(this.modelAtts, modelName, []);
       }
     };
     defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -3454,10 +3490,10 @@ var init_options = __esm({
 });
 // src/permission.ts
-var import_utils17, Permission, permission_default;
+var import_utils18, Permission, permission_default;
 var init_permission = __esm({
   "src/permission.ts"() {
-    import_utils17 = require("@web-ts-toolkit/utils");
+    import_utils18 = require("@web-ts-toolkit/utils");
     Permission = class {
       constructor(permissions) {
         this.permissions = { ...permissions };
@@ -3473,7 +3509,7 @@ var init_permission = __esm({
         return [permissionOrPermissions].concat(permissions);
       }
       hasKey(permission) {
-        return (0, import_utils17.hasOwn)(this.permissions, permission);
+        return (0, import_utils18.hasOwn)(this.permissions, permission);
       }
       has(permission) {
         return this.permissions[permission] === true;
@@ -3591,7 +3627,6 @@ function normalizePolicy(value, applicability, configuration, targets) {
       const matches = targets.filter((target2) => target2.path === path);
       if (matches.length !== 1) authorizationError(`unused or ambiguous related path: ${path}`);
       const target = matches[0];
-      if (target.kind === "passthrough") authorizationError(`related policy requires a registered target: ${path}`);
       const child = authorizationRecord(entry, `related.${path}`);
       assertAuthorizationKeys(
         child,
@@ -3960,7 +3995,7 @@ function attachIncludeOutput(doc, path, value) {
   const state = stateFor(doc);
   if (!state) throw new Error("Include attachment requires a prepared output row");
   state.attachments.push({ path, value });
-  (0, import_utils18.set)(doc, path, deepIsolateValue(value));
+  (0, import_utils19.set)(doc, path, deepIsolateValue(value));
 }
 function getIncludeSource(doc) {
   return stateFor(doc)?.source ?? doc;
@@ -3975,14 +4010,14 @@ function restoreIncludeOutput(doc, output) {
   for (const { path, value } of attachments) {
     const copy = deepIsolateValue(value);
     if (copy !== null && typeof copy === "object") origins.set(copy, value);
-    (0, import_utils18.set)(output, path, copy);
+    (0, import_utils19.set)(output, path, copy);
   }
   return origins;
 }
-var import_utils18, outputs2, stateFor;
+var import_utils19, outputs2, stateFor;
 var init_include_output = __esm({
   "src/output/include-output.ts"() {
-    import_utils18 = require("@web-ts-toolkit/utils");
+    import_utils19 = require("@web-ts-toolkit/utils");
     init_document_authorization();
     init_document();
     outputs2 = /* @__PURE__ */ new WeakMap();
@@ -4324,10 +4359,10 @@ function planVirtualProjection(args) {
     relatedPlans
   };
 }
-var import_utils20, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
+var import_utils21, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
 var init_virtual_projection = __esm({
   "src/acl/virtual-projection.ts"() {
-    import_utils20 = require("@web-ts-toolkit/utils");
+    import_utils21 = require("@web-ts-toolkit/utils");
     init_query();
     init_field_authorization();
     init_output_projection();
@@ -4335,20 +4370,20 @@ var init_virtual_projection = __esm({
     init_virtual_populate_dependencies();
     init_virtual_descriptor();
     getScopedPermissionSchema = (root, scopePath) => {
-      if (!root || !(0, import_utils20.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils21.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
-      const scoped = (0, import_utils20.get)(root, scopePath.join("."));
-      return (0, import_utils20.isPlainObject)(scoped) ? scoped : null;
+      const scoped = (0, import_utils21.get)(root, scopePath.join("."));
+      return (0, import_utils21.isPlainObject)(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
       if (!raw) return [];
-      if ((0, import_utils20.isArray)(raw)) return [...raw];
-      if ((0, import_utils20.isPlainObject)(raw)) {
+      if ((0, import_utils21.isArray)(raw)) return [...raw];
+      if ((0, import_utils21.isPlainObject)(raw)) {
         const record3 = raw;
         const exact = record3[access];
-        if ((0, import_utils20.isArray)(exact)) return [...exact];
+        if ((0, import_utils21.isArray)(exact)) return [...exact];
         const def = record3.default;
-        if ((0, import_utils20.isArray)(def)) return [...def];
+        if ((0, import_utils21.isArray)(def)) return [...def];
         return [];
       }
       return [];
@@ -4613,8 +4648,8 @@ var init_output_projection = __esm({
 // src/acl/model-output-planning.ts
 function getCapturedAuthorizationOption(configuration, key) {
-  const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils21.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
-  return resolveNestedOption((path, fallback) => (0, import_utils21.get)(configuration, path, fallback), key, defaultValue);
+  const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils22.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
+  return resolveNestedOption((path, fallback) => (0, import_utils22.get)(configuration, path, fallback), key, defaultValue);
 }
 function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName), globalOptions = runtime.getGlobalOptions()) {
   const model = runtime.getModelInstance(modelName);
@@ -4629,9 +4664,9 @@ function captureModelAuthorizationConfiguration(runtime, modelName, options = ru
         options,
         globalOptions
       ),
-      requireReadOperationAccessForPopulateDependencies: globalOptions.requireReadOperationAccessForPopulateDependencies !== false,
-      requireRegisteredPopulateModels: globalOptions.requireRegisteredPopulateModels,
-      permissionSchema: options.permissionSchema,
+      requireOperationAccessForPopulateDependencies: globalOptions.requireOperationAccessForPopulateDependencies !== false,
+      requireOperationAccessForPopulateQueries: globalOptions.requireOperationAccessForPopulateQueries !== false,
+      permissionSchema: options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
       modelPermissionPrefix: options.modelPermissionPrefix,
@@ -4677,10 +4712,10 @@ function planModelOutputForHelper(args) {
     requestedSelect: args.select
   });
 }
-var import_utils21;
+var import_utils22;
 var init_model_output_planning = __esm({
   "src/acl/model-output-planning.ts"() {
-    import_utils21 = require("@web-ts-toolkit/utils");
+    import_utils22 = require("@web-ts-toolkit/utils");
     init_manager();
     init_field_catalog();
     init_authorization_snapshot();
@@ -4692,10 +4727,10 @@ var init_model_output_planning = __esm({
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils22.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils23.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils23.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils23.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4712,11 +4747,11 @@ function optimizeAndFilter(clausesInput) {
   const dedupeKey = (value) => {
     if (value instanceof RegExp) return `regexp:${JSON.stringify([value.source, value.flags])}`;
     if (value instanceof Date) return `date:${value.getTime()}`;
-    if ((0, import_utils22.isArray)(value)) {
+    if ((0, import_utils23.isArray)(value)) {
       const entries = Array.from(value, dedupeKey);
       return entries.every((entry) => entry !== void 0) ? `array:${JSON.stringify(entries)}` : void 0;
     }
-    if ((0, import_utils22.isPlainObject)(value)) {
+    if ((0, import_utils23.isPlainObject)(value)) {
       const entries = Object.keys(value).sort().map((key) => [key, dedupeKey(value[key])]);
       return entries.every(([, entry]) => entry !== void 0) ? `object:${JSON.stringify(entries)}` : void 0;
     }
@@ -4746,7 +4781,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if ((0, import_utils22.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
+      if ((0, import_utils23.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -4757,24 +4792,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils22.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils23.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils22.isPlainObject)(filter2) || (0, import_utils22.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils23.isPlainObject)(filter2) || (0, import_utils23.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils22.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils23.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils22.isString)(idField)) {
+  if ((0, import_utils23.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -4798,7 +4833,7 @@ async function resolveAccessFilterParts({
   }
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
   const baseFilterFn = rows2.mode === "request" ? getOption(`baseFilter.${access}`, null) : null;
-  if (nextFilter !== false && (0, import_utils22.isFunction)(overrideFilterFn)) {
+  if (nextFilter !== false && (0, import_utils23.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   if (nextFilter === false) return { transformed: false, scope: {}, filter: false };
@@ -4806,7 +4841,7 @@ async function resolveAccessFilterParts({
     const scope2 = rows2.mode === "scope" ? rows2.filter : {};
     return { transformed: nextFilter ?? {}, scope: scope2, filter: intersectFilters(nextFilter, scope2) };
   }
-  if (!(0, import_utils22.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
+  if (!(0, import_utils23.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
   const cached = cache.get(cacheKey);
   const reusable = cached?.resolver === baseFilterFn;
   const baseFilter = normalizeFilter(
@@ -4841,34 +4876,34 @@ async function setRequestPermissions(req) {
   if (owner === activeRuntime) return;
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  const permissions = (0, import_utils22.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
-  if ((0, import_utils22.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils22.isArray)(permissions)) req[requestPermissionField] = (0, import_utils22.arrayToRecord)(permissions);
-  else if ((0, import_utils22.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  const permissions = (0, import_utils23.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
+  if ((0, import_utils23.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils23.isArray)(permissions)) req[requestPermissionField] = (0, import_utils23.arrayToRecord)(permissions);
+  else if ((0, import_utils23.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
   else req[requestPermissionField] = {};
   owners.set(requestPermissionField, activeRuntime);
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils22.isBoolean)(routeGuard)) {
+  if ((0, import_utils23.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils22.isString)(routeGuard)) {
+  if ((0, import_utils23.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils22.isArray)(routeGuard)) {
+  if ((0, import_utils23.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils22.isFunction)(routeGuard)) {
+  if ((0, import_utils23.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils22.castArray)(hook);
+  const hooks = (0, import_utils23.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils22.isFunction)(hooks[x])) {
+    if ((0, import_utils23.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -4888,22 +4923,22 @@ async function collectSchemaFields({
   for (let x = 0; x < keys2.length; x++) {
     const key = keys2[x];
     const value = extractScopedOutputRule(permissionSchema, key, access);
-    if ((0, import_utils22.isBoolean)(value)) {
+    if ((0, import_utils23.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils22.isString)(value)) {
+    } else if ((0, import_utils23.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils22.isArray)(value)) {
+    } else if ((0, import_utils23.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils22.isFunction)(value)) {
+    } else if ((0, import_utils23.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
   return fields;
 }
-var import_utils22, import_node_util4, permissionFieldOwners;
+var import_utils23, import_node_util4, permissionFieldOwners;
 var init_core_shared = __esm({
   "src/core-shared.ts"() {
-    import_utils22 = require("@web-ts-toolkit/utils");
+    import_utils23 = require("@web-ts-toolkit/utils");
     import_node_util4 = require("util");
     init_helpers();
     init_options();
@@ -5272,8 +5307,8 @@ function equivalentVirtualPopulatePredicate(left, right) {
   }
   if (Array.isArray(left) || Array.isArray(right))
     return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((entry, index) => equivalentVirtualPopulatePredicate(entry, right[index]));
-  if ((0, import_utils26.isPlainObject)(left) || (0, import_utils26.isPlainObject)(right)) {
-    if (!(0, import_utils26.isPlainObject)(left) || !(0, import_utils26.isPlainObject)(right)) return false;
+  if ((0, import_utils27.isPlainObject)(left) || (0, import_utils27.isPlainObject)(right)) {
+    if (!(0, import_utils27.isPlainObject)(left) || !(0, import_utils27.isPlainObject)(right)) return false;
     const a = Object.keys(left), b = Object.keys(right);
     return a.length === b.length && a.every(
       (key, index) => key === b[index] && equivalentVirtualPopulatePredicate(
@@ -5344,7 +5379,6 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
         address,
         plan: currentPlan,
         refs: /* @__PURE__ */ new Map(),
-        referenceTargets: /* @__PURE__ */ new Map(),
         dependencies: /* @__PURE__ */ new Map()
       };
       row.occurrences.set(addressKey(address), occurrence);
@@ -5352,7 +5386,6 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
           if (!occurrence.refs.has(dependency.path))
             occurrence.refs.set(dependency.path, originalRef(value, dependency.path));
-          occurrence.referenceTargets.set(dependency.path, dependency.target);
           const request = {
             binding: dependency.target,
             target: dependency.target,
@@ -5450,7 +5483,7 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          if (target.configuration.requireReadOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+          if (target.configuration.requireOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
             return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
@@ -5536,12 +5569,6 @@ function readVirtualPopulateOriginalReference(row, address, path) {
 function hasVirtualPopulatePublicReference(row, address, path) {
   return !!rows.get(row)?.publicRequests.some((request) => addressKey(request.address) === addressKey([...address, path]));
 }
-function isVirtualPopulateReferenceVisible(row, address, path) {
-  const record3 = rows.get(row);
-  const occurrence = record3?.occurrences.get(addressKey(address));
-  const target = occurrence?.refs.get(path)?.present ? occurrence.referenceTargets.get(path) : void 0;
-  return record3 && target ? targetReadAllowed(record3.batch, target) : Promise.resolve(true);
-}
 function readVirtualPopulateInputs(row, address, virtualName) {
   const record3 = rows.get(row);
   if (!record3?.batch.completed) return { available: false };
@@ -5665,12 +5692,12 @@ async function loadVirtualPopulateOutputRows(owner, inputs, plan, publicPopulate
   }
   return output;
 }
-var import_mongoose7, import_node_util5, import_utils26, batches, rows, outputRows, fetchedPublicIdentities, publicViewIdentities, familyRawFetches, addressKey, storage, originalRef, copyOriginalValue, readPolicy, compatible, idKey, logUnavailable;
+var import_mongoose7, import_node_util5, import_utils27, batches, rows, outputRows, fetchedPublicIdentities, publicViewIdentities, familyRawFetches, addressKey, storage, originalRef, copyOriginalValue, readPolicy, compatible, idKey, logUnavailable;
 var init_virtual_populate_execution = __esm({
   "src/acl/virtual-populate-execution.ts"() {
     import_mongoose7 = require("mongoose");
     import_node_util5 = require("util");
-    import_utils26 = require("@web-ts-toolkit/utils");
+    import_utils27 = require("@web-ts-toolkit/utils");
     init_cache();
     init_core_shared();
     init_document();
@@ -5687,7 +5714,7 @@ var init_virtual_populate_execution = __esm({
     publicViewIdentities = /* @__PURE__ */ new WeakMap();
     familyRawFetches = /* @__PURE__ */ new WeakMap();
     addressKey = (address) => JSON.stringify(address);
-    storage = (value) => value instanceof import_mongoose7.Document ? value._doc : (0, import_utils26.isPlainObject)(value) ? value : void 0;
+    storage = (value) => value instanceof import_mongoose7.Document ? value._doc : (0, import_utils27.isPlainObject)(value) ? value : void 0;
     originalRef = (source, key) => {
       const record3 = storage(source);
       return {
@@ -5700,7 +5727,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireReadOperationAccessForPopulateDependencies === b.binding.configuration.requireReadOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireOperationAccessForPopulateDependencies === b.binding.configuration.requireOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -5727,7 +5754,7 @@ async function resolveOutputDocumentAuthorization(args) {
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
-      return (0, import_utils27.isPlainObject)(grants) ? grants : {};
+      return (0, import_utils28.isPlainObject)(grants) ? grants : {};
     } catch (error2) {
       warn("docPermissions hook failed; applying empty document permissions", {
         modelName: binding.modelName,
@@ -5842,7 +5869,7 @@ function copyOutputValue(value, plan, path) {
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
     if (input instanceof Map) return visit(Object.fromEntries(input), current);
-    if (!(0, import_utils27.isPlainObject)(input)) return deepIsolateValue(input);
+    if (!(0, import_utils28.isPlainObject)(input)) return deepIsolateValue(input);
     const output = {};
     for (const [key, entry] of Object.entries(input)) {
       const child = `${current}.${key}`;
@@ -5858,25 +5885,21 @@ function copyOutputValue(value, plan, path) {
 }
 function copyAuthorizedReference(value, plan, path) {
   if (Array.isArray(value)) return value.map((entry) => copyAuthorizedReference(entry, plan, path));
-  if (!(0, import_utils27.isPlainObject)(value)) return deepIsolateValue(value);
+  if (!(0, import_utils28.isPlainObject)(value)) return deepIsolateValue(value);
   const handle = getAssociatedDocumentAuthorization(value, plan.authorization);
   if (handle) {
     const copy = deepIsolateValue(value);
     transferDocumentAuthorizationGraph(value, copy);
     return copy;
   }
-  const { relatedTargets } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  if (relatedTargets.some((target) => target.path === path && target.kind === "passthrough")) {
-    return deepIsolateValue(value);
-  }
   return Object.prototype.hasOwnProperty.call(value, "_id") ? deepIsolateValue(value._id) : void 0;
 }
 function retainOutputMetadata(output, source, configuration, scope2) {
   if (scope2.length || configuration.stripPermissionsField) return;
   const parts = (configuration.documentPermissionField ?? "_permissions").split(".");
   let value = source;
-  for (const part of parts) value = (0, import_utils27.isPlainObject)(value) ? value[part] : void 0;
-  if (!(0, import_utils27.isPlainObject)(value)) return;
+  for (const part of parts) value = (0, import_utils28.isPlainObject)(value) ? value[part] : void 0;
+  if (!(0, import_utils28.isPlainObject)(value)) return;
   const keys2 = configuration.exposedDocPermissionKeys;
   const metadata = Object.fromEntries(
     Object.entries(value).filter(
@@ -5886,7 +5909,7 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   const copy = { ...output };
   let target = copy;
   for (const part of parts.slice(0, -1)) {
-    target[part] = (0, import_utils27.isPlainObject)(target[part]) ? { ...target[part] } : {};
+    target[part] = (0, import_utils28.isPlainObject)(target[part]) ? { ...target[part] } : {};
     target = target[part];
   }
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
@@ -5928,7 +5951,7 @@ async function filterExistingOutput(source, plan, handle, associated) {
           for (const entry of value2) values.push(await one(entry) ?? null);
           return values;
         }
-        if (!(0, import_utils27.isPlainObject)(value2)) return value2 === null ? null : void 0;
+        if (!(0, import_utils28.isPlainObject)(value2)) return value2 === null ? null : void 0;
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
@@ -6008,7 +6031,7 @@ async function filterModelOutputForHelper(args) {
   const plan = helperPlan(normalized.authorization, binding);
   if (args.doc == null) return { output: args.doc, fields: [] };
   const source = isolateDocForOutput(args.doc);
-  if (!(0, import_utils27.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
+  if (!(0, import_utils28.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
   const knownOutput = !!args.doc && typeof args.doc === "object" && isKnownAuthorizationOutput(args.doc);
   const handle = await resolveOutputDocumentAuthorization({
     authorization: normalized.authorization,
@@ -6019,10 +6042,10 @@ async function filterModelOutputForHelper(args) {
   });
   return filterExistingOutput(source, plan, handle, false);
 }
-var import_utils27, unresolvedDocuments, owningDocuments;
+var import_utils28, unresolvedDocuments, owningDocuments;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
-    import_utils27 = require("@web-ts-toolkit/utils");
+    import_utils28 = require("@web-ts-toolkit/utils");
     init_permissions_alias();
     init_document();
     init_request_work();
@@ -6119,8 +6142,8 @@ async function finalizeSingleDoc(args, input) {
   const privateRow = args.virtualPopulateRow ?? (original && typeof original === "object" ? getVirtualPopulateRow(original) : void 0);
   const privateAddress = args.virtualPopulateAddress ?? [];
   const isolated = isolateDocForOutput(input);
-  const output = (0, import_utils28.isPlainObject)(isolated) ? isolated : {};
-  if (captured && (0, import_utils28.isPlainObject)(input))
+  const output = (0, import_utils29.isPlainObject)(isolated) ? isolated : {};
+  if (captured && (0, import_utils29.isPlainObject)(input))
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
@@ -6175,7 +6198,7 @@ async function finalizeSingleDoc(args, input) {
       );
       continue;
     }
-    if (captured && !(0, import_utils28.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
+    if (captured && !(0, import_utils29.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
       delete output[containerName];
       continue;
     }
@@ -6199,7 +6222,7 @@ async function finalizeSingleDoc(args, input) {
     const finalizeOneChild = async (rawChild, address) => {
       if (captured && Array.isArray(rawChild))
         return mapWithConcurrencyLimit(rawChild, limit, (entry, index) => finalizeOneChild(entry, [...address, index]));
-      if (!(0, import_utils28.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
+      if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
       if (args.traversal?.finalizeEmbeddedChildren) {
         return args.traversal.finalizeEmbeddedChildren({
           containerName,
@@ -6225,7 +6248,7 @@ async function finalizeSingleDoc(args, input) {
         (entry, index) => finalizeOneChild(entry, [...privateAddress, containerName, index])
       );
       output[containerName] = finalized;
-    } else if ((0, import_utils28.isPlainObject)(rawContainer)) {
+    } else if ((0, import_utils29.isPlainObject)(rawContainer)) {
       output[containerName] = await finalizeOneChild(rawContainer, [
         ...privateAddress,
         containerName
@@ -6237,8 +6260,8 @@ async function finalizeSingleDoc(args, input) {
     let rawRelated;
     let originalRelated;
     try {
-      rawRelated = target.path.includes(".") ? (0, import_utils28.get)(output, target.path) : output[target.path];
-      originalRelated = (0, import_utils28.get)(original, target.path);
+      rawRelated = target.path.includes(".") ? (0, import_utils29.get)(output, target.path) : output[target.path];
+      originalRelated = (0, import_utils29.get)(original, target.path);
     } catch {
       continue;
     }
@@ -6269,7 +6292,7 @@ async function finalizeSingleDoc(args, input) {
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
     const finalizeOneRelated = async (rawChild, originalChild = rawChild) => {
-      if (!(0, import_utils28.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
+      if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
       const childOriginal = getIncludeOriginal(originalChild);
       const childRow = childOriginal && typeof childOriginal === "object" ? getVirtualPopulateRow(childOriginal) : void 0;
@@ -6290,13 +6313,13 @@ async function finalizeSingleDoc(args, input) {
         limit,
         (entry, index) => finalizeOneRelated(entry, Array.isArray(originalRelated) ? originalRelated[index] : void 0)
       );
-    } else if ((0, import_utils28.isPlainObject)(rawRelated)) {
+    } else if ((0, import_utils29.isPlainObject)(rawRelated)) {
       finalized = await finalizeOneRelated(rawRelated, originalRelated);
     } else {
       continue;
     }
     try {
-      if (target.path.includes(".")) (0, import_utils28.set)(output, target.path, finalized);
+      if (target.path.includes(".")) (0, import_utils29.set)(output, target.path, finalized);
       else output[target.path] = finalized;
     } catch {
     }
@@ -6410,7 +6433,6 @@ async function finalizeSingleDoc(args, input) {
   if (!captured && documentPermissionField in output) keep.add(documentPermissionField);
   const trimmed = {};
   for (const key of keep) {
-    if (privateRow && !await isVirtualPopulateReferenceVisible(privateRow, privateAddress, key)) continue;
     if (privateRow && !hasVirtualPopulatePublicReference(privateRow, privateAddress, key)) {
       const ref = readVirtualPopulateOriginalReference(privateRow, privateAddress, key);
       if (ref) {
@@ -6477,10 +6499,10 @@ async function finalizeModelOutputs(args) {
     return finalizeSingleDoc(internal, input);
   });
 }
-var import_utils28, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
+var import_utils29, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
 var init_finalize_model_output = __esm({
   "src/output/finalize-model-output.ts"() {
-    import_utils28 = require("@web-ts-toolkit/utils");
+    import_utils29 = require("@web-ts-toolkit/utils");
     init_document();
     init_concurrency();
     init_request_work();
@@ -6493,20 +6515,20 @@ var init_finalize_model_output = __esm({
     init_field_catalog();
     init_virtual_populate_execution();
     init_include_output();
-    isVirtualContainerValue3 = (value) => (0, import_utils28.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue3 = (value) => (0, import_utils29.isPlainObject)(value) && "sub" in value;
     getScopeVirtualsObject2 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !(0, import_utils28.isPlainObject)(rootVirtuals)) return null;
+      if (!rootVirtuals || !(0, import_utils29.isPlainObject)(rootVirtuals)) return null;
       if (scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!(0, import_utils28.isPlainObject)(current)) return null;
+        if (!(0, import_utils29.isPlainObject)(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue3(container)) return null;
         current = container.sub;
-        if (!(0, import_utils28.isPlainObject)(current)) return null;
+        if (!(0, import_utils29.isPlainObject)(current)) return null;
       }
       return current;
     };
@@ -6519,11 +6541,11 @@ var init_finalize_model_output = __esm({
       return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue3(v)).map(([k]) => k);
     };
     getScopedPermissionSchema2 = (root, scopePath) => {
-      if (!root || !(0, import_utils28.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils29.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
       try {
-        const scoped = (0, import_utils28.get)(root, scopePath.join("."));
-        return (0, import_utils28.isPlainObject)(scoped) ? scoped : null;
+        const scoped = (0, import_utils29.get)(root, scopePath.join("."));
+        return (0, import_utils29.isPlainObject)(scoped) ? scoped : null;
       } catch {
         return null;
       }
@@ -6582,7 +6604,7 @@ var init_finalize_model_output = __esm({
           const grants = await args.sharedGate.run(
             () => hook.call(args.request, isolatedForHook, globalPerms, scopeContext)
           );
-          const normalized = (0, import_utils28.isPlainObject)(grants) ? grants : {};
+          const normalized = (0, import_utils29.isPlainObject)(grants) ? grants : {};
           scopeContext.docPermissions = normalized;
           return normalized;
         }
@@ -6654,40 +6676,20 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils46 = require("@web-ts-toolkit/utils");
+var import_utils47 = require("@web-ts-toolkit/utils");
 // src/middleware.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils39 = require("@web-ts-toolkit/utils");
+var import_utils40 = require("@web-ts-toolkit/utils");
 // src/core.ts
 init_public_admission();
-var import_utils38 = require("@web-ts-toolkit/utils");
+var import_utils39 = require("@web-ts-toolkit/utils");
 init_options();
-// src/meta.ts
-init_runtime();
-init_runtime_context();
-var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
-var getModelRef = (modelName, refPath) => {
-  const direct = getRuntime5().getModelRef(modelName, refPath);
-  if (direct) return direct;
-  if (!refPath.includes(".")) return null;
-  try {
-    const runtime = getRuntime5();
-    const instance = runtime.getModelInstance?.(
-      modelName
-    );
-    const schemaPath = instance?.schema?.path?.(refPath);
-    const ref = schemaPath?.options?.ref ?? schemaPath?.caster?.options?.ref ?? null;
-    return typeof ref === "string" && ref.length > 0 ? ref : null;
-  } catch {
-    return null;
-  }
-};
+init_permission();
 // src/services/base.ts
-var import_utils23 = require("@web-ts-toolkit/utils");
+var import_utils24 = require("@web-ts-toolkit/utils");
 init_options();
 init_helpers();
 init_document();
@@ -6813,7 +6815,7 @@ function requestFieldScope(options) {
 init_public_admission();
 // src/correlated-includes.ts
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_sort_policy();
 var PARENT_MARKER_KEY = "$parent";
@@ -6826,10 +6828,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return (0, import_utils19.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return (0, import_utils20.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return (0, import_utils19.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return (0, import_utils20.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -6848,12 +6850,12 @@ function containsParentMarkerShape(value) {
   const seen = /* @__PURE__ */ new Set();
   const visit = (current) => {
     if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
-    if ((0, import_utils19.isArray)(current)) {
+    if ((0, import_utils20.isArray)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       return current.some(visit);
     }
-    if ((0, import_utils19.isPlainObject)(current)) {
+    if ((0, import_utils20.isPlainObject)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -6883,7 +6885,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if ((0, import_utils19.isPlainObject)(value)) {
+  if ((0, import_utils20.isPlainObject)(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -6894,7 +6896,7 @@ function scanTemplateValueNode(value, path, issues) {
     scanTemplateObjectEntries(value, path, issues);
     return;
   }
-  if ((0, import_utils19.isArray)(value)) {
+  if ((0, import_utils20.isArray)(value)) {
     value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
   }
 }
@@ -6935,7 +6937,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils19.isArray)(child)) {
+      if (!(0, import_utils20.isArray)(child)) {
         scanTemplateValueNode(child, childPath, issues);
         continue;
       }
@@ -6948,7 +6950,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if ((0, import_utils19.isPlainObject)(clause)) {
+        if ((0, import_utils20.isPlainObject)(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -6959,7 +6961,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter2) {
   const issues = [];
-  if (!(0, import_utils19.isPlainObject)(filter2)) {
+  if (!(0, import_utils20.isPlainObject)(filter2)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -7002,13 +7004,13 @@ function collectFilterReferencePaths(filter2) {
       return;
     }
     if (isEscapedParentRef(value)) return;
-    if ((0, import_utils19.isArray)(value)) {
+    if ((0, import_utils20.isArray)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       value.forEach(visitValue);
       return;
     }
-    if ((0, import_utils19.isPlainObject)(value)) {
+    if ((0, import_utils20.isPlainObject)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       for (const [key, child] of Object.entries(value)) {
@@ -7054,7 +7056,7 @@ function getOwnPathValue(parent, path) {
   return current;
 }
 function cloneSubstitutedValue(value) {
-  if ((0, import_utils19.isPlainObject)(value) || (0, import_utils19.isArray)(value)) return (0, import_utils19.cloneDeep)(value);
+  if ((0, import_utils20.isPlainObject)(value) || (0, import_utils20.isArray)(value)) return (0, import_utils20.cloneDeep)(value);
   return value;
 }
 function literalParentRefObject(path) {
@@ -7095,7 +7097,7 @@ function resolveObjectEntries(obj, parent) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils19.isArray)(child)) {
+      if (!(0, import_utils20.isArray)(child)) {
         out[key] = resolveValueNode(child, parent, false);
         continue;
       }
@@ -7103,7 +7105,7 @@ function resolveObjectEntries(obj, parent) {
         if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
           throw new CorrelatedReferenceError(`Unsupported $parent reference as a direct ${key} clause`);
         }
-        if (!(0, import_utils19.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
+        if (!(0, import_utils20.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
         return resolveObjectEntries(clause, parent);
       });
       continue;
@@ -7132,10 +7134,10 @@ function resolveValueNode(template, parent, bare) {
     }
     const value = getOwnPathValue(parent, path);
     if (value === void 0 || value === null) throw UNRESOLVABLE;
-    if (bare && (0, import_utils19.isPlainObject)(value)) return { $eq: (0, import_utils19.cloneDeep)(value) };
+    if (bare && (0, import_utils20.isPlainObject)(value)) return { $eq: (0, import_utils20.cloneDeep)(value) };
     return cloneSubstitutedValue(value);
   }
-  if ((0, import_utils19.isPlainObject)(template)) {
+  if ((0, import_utils20.isPlainObject)(template)) {
     if (hasMarkerKey(template)) {
       throw new CorrelatedReferenceError(
         'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }'
@@ -7143,7 +7145,7 @@ function resolveValueNode(template, parent, bare) {
     }
     return resolveObjectEntries(template, parent);
   }
-  if ((0, import_utils19.isArray)(template)) {
+  if ((0, import_utils20.isArray)(template)) {
     return template.map((item) => resolveValueNode(item, parent, false));
   }
   return template;
@@ -7177,7 +7179,7 @@ function resolveCorrelatedIdTemplate(id, parent) {
 }
 function resolveCorrelatedFilterTemplate(filter2, parent) {
   try {
-    if (!(0, import_utils19.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
+    if (!(0, import_utils20.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
       throw new CorrelatedReferenceError("Correlated include filter must be an object");
     }
     return { status: "resolved", filter: resolveObjectEntries(filter2, parent) };
@@ -7192,7 +7194,7 @@ function validateExpandedCorrelatedOperands(expanded, limits) {
 var MAX_NESTED_INCLUDE_DEPTH = 10;
 function validateCorrelatedArgsShape(args, op, depth) {
   if (args === void 0) return [];
-  if (!(0, import_utils19.isPlainObject)(args)) return ["Correlated include args must be an object"];
+  if (!(0, import_utils20.isPlainObject)(args)) return ["Correlated include args must be an object"];
   const record3 = args;
   const allowed = op === "list" ? /* @__PURE__ */ new Set(["select", "sort", "skip", "limit", "page", "pageSize", "include"]) : /* @__PURE__ */ new Set(["select", "sort", "include"]);
   for (const key of Object.keys(record3)) {
@@ -7214,7 +7216,7 @@ function validateCorrelatedArgsShape(args, op, depth) {
   return [];
 }
 function validateCorrelatedIncludeShape(entry, depth = 0) {
-  if (!(0, import_utils19.isPlainObject)(entry)) return ["Correlated include must be an object"];
+  if (!(0, import_utils20.isPlainObject)(entry)) return ["Correlated include must be an object"];
   const record3 = entry;
   if (record3.mode !== "correlated") return ['Correlated include mode must be "correlated"'];
   if (typeof record3.model !== "string" || record3.model.length === 0)
@@ -7227,7 +7229,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   if ("localField" in record3 || "foreignField" in record3) {
     return ["Correlated includes must not carry localField or foreignField"];
   }
-  if (record3.options !== void 0 && !((0, import_utils19.isPlainObject)(record3.options) && Object.keys(record3.options).length === 0)) {
+  if (record3.options !== void 0 && !((0, import_utils20.isPlainObject)(record3.options) && Object.keys(record3.options).length === 0)) {
     return ["Correlated include options must be absent or empty"];
   }
   const hasId = record3.id !== void 0;
@@ -7249,7 +7251,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   return validateCorrelatedArgsShape(record3.args, record3.op, depth);
 }
 function isCorrelatedInclude(value) {
-  return (0, import_utils19.isPlainObject)(value) && value.mode === "correlated";
+  return (0, import_utils20.isPlainObject)(value) && value.mode === "correlated";
 }
 // src/services/base.ts
@@ -7473,9 +7475,31 @@ function castCountGroups(input, values) {
 // src/services/base.ts
 init_service_authorization();
+// src/meta.ts
+init_runtime();
+init_runtime_context();
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
+var getModelRef = (modelName, refPath, runtime = getRuntime5()) => {
+  const direct = runtime.getModelRef(modelName, refPath);
+  if (direct) return direct;
+  if (!refPath.includes(".")) return null;
+  try {
+    const instance = runtime.getModelInstance?.(
+      modelName
+    );
+    const schemaPath = instance?.schema?.path?.(refPath);
+    const element = schemaPath?.$embeddedSchemaType ?? schemaPath?.embeddedSchemaType ?? schemaPath?.caster;
+    const ref = schemaPath?.options?.ref ?? element?.options?.ref ?? null;
+    return typeof ref === "string" && ref.length > 0 ? ref : null;
+  } catch {
+    return null;
+  }
+};
 // src/acl/related-execution.ts
 init_public_admission();
 init_model_output_planning();
+init_populate_target_configuration();
 init_authorization_snapshot();
 // src/acl/service-execution.ts
@@ -7770,16 +7794,15 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalO
   for (const entry of entries(args.populate)) {
     const path = typeof entry === "string" ? entry : entry.path;
     if (typeof entry !== "string") assertPopulateAccess(entry.access);
-    const model = getModelRef(modelName, path);
-    if (model && runtime.hasModel(model))
+    const model = getModelRef(modelName, path, runtime);
+    if (model) {
+      const target = capturePopulateTargetConfiguration(runtime, model, `${modelName}.${path}`);
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model, void 0, globalOptions),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, target.options, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !(globalOptions.requireRegisteredPopulateModels === void 0 ? true : globalOptions.requireRegisteredPopulateModels)) {
-      targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
@@ -7965,20 +7988,20 @@ var copyAuthorizedOutput = (value) => {
   transferDocumentAuthorizationGraph(value, copy);
   return copy;
 };
-var isVirtualContainerValueForGuard = (value) => (0, import_utils23.isPlainObject)(value) && "sub" in value;
+var isVirtualContainerValueForGuard = (value) => (0, import_utils24.isPlainObject)(value) && "sub" in value;
 var getScopeVirtualsForGuard = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !(0, import_utils23.isPlainObject)(rootVirtuals)) return null;
+  if (!rootVirtuals || !(0, import_utils24.isPlainObject)(rootVirtuals)) return null;
   if (scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!(0, import_utils23.isPlainObject)(current)) return null;
+    if (!(0, import_utils24.isPlainObject)(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValueForGuard(container)) return null;
     current = container.sub;
-    if (!(0, import_utils23.isPlainObject)(current)) return null;
+    if (!(0, import_utils24.isPlainObject)(current)) return null;
   }
   return current;
 };
@@ -8044,7 +8067,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
       for (const entry of value) stripScope(entry, currentScope);
       return;
     }
-    if (!(0, import_utils23.isPlainObject)(value)) return;
+    if (!(0, import_utils24.isPlainObject)(value)) return;
     const record3 = value;
     const leaves = getScopeVirtualLeafNames(snapshot, currentScope);
     for (const leaf of leaves) {
@@ -8057,7 +8080,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
     for (const key of Object.keys(record3)) {
       if (leaves.has(key) || containers.has(key)) continue;
       const child = record3[key];
-      if (Array.isArray(child) || (0, import_utils23.isPlainObject)(child)) {
+      if (Array.isArray(child) || (0, import_utils24.isPlainObject)(child)) {
         stripScope(child, currentScope);
       }
     }
@@ -8069,7 +8092,7 @@ var LOGICAL_FILTER_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
 var isOperatorKey = (key) => key.startsWith("$");
 var REMOVED_VIRTUAL_FILTER = /* @__PURE__ */ Symbol("removed virtual filter clause");
 var rewriteFilterObject = (value, visit) => {
-  if (!(0, import_utils23.isPlainObject)(value)) return value;
+  if (!(0, import_utils24.isPlainObject)(value)) return value;
   let changed = false;
   const entries = [];
   for (const [key, child] of Object.entries(value)) {
@@ -8100,7 +8123,7 @@ var resolveVirtualFilterField = (path, scope2) => {
     if (!Object.hasOwn(scope2, segment) || scope2[segment] === void 0) return null;
     const definition = scope2[segment];
     if (!isVirtualContainerValueForGuard(definition)) return REMOVED_VIRTUAL_FILTER;
-    scope2 = (0, import_utils23.isPlainObject)(definition.sub) ? definition.sub : null;
+    scope2 = (0, import_utils24.isPlainObject)(definition.sub) ? definition.sub : null;
     inContainer = true;
   }
   return scope2;
@@ -8112,7 +8135,7 @@ var stripVirtualFilterOperator = (key, value, scope2) => {
   }
   if (key === "$all") {
     return rewriteFilterClauses(value, (entry) => {
-      if (!(0, import_utils23.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
+      if (!(0, import_utils24.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
       return rewriteFilterObject(entry, (operator, operand) => stripVirtualFilterOperator(operator, operand, scope2));
     });
   }
@@ -8127,7 +8150,7 @@ var stripVirtualFilterQuery = (value, scope2, element = false) => {
     if (isOperatorKey(key)) return element ? stripVirtualFilterOperator(key, child, scope2) : child;
     const fieldScope = resolveVirtualFilterField(key, scope2);
     if (fieldScope === REMOVED_VIRTUAL_FILTER) return REMOVED_VIRTUAL_FILTER;
-    if (!fieldScope || !(0, import_utils23.isPlainObject)(child)) return child;
+    if (!fieldScope || !(0, import_utils24.isPlainObject)(child)) return child;
     if (Object.keys(child).some(isOperatorKey)) {
       return rewriteFilterObject(
         child,
@@ -8149,9 +8172,9 @@ var stripSubVirtualKeysFromFilter = (filter2, snapshot, sub) => {
 function getCorrelatedTemplateDepth(includes) {
   let max = 0;
   const visit = (entries, depth) => {
-    const list = (0, import_utils23.castArray)(entries).filter(Boolean);
+    const list = (0, import_utils24.castArray)(entries).filter(Boolean);
     for (const entry of list) {
-      if (!(0, import_utils23.isPlainObject)(entry)) continue;
+      if (!(0, import_utils24.isPlainObject)(entry)) continue;
       max = Math.max(max, depth);
       const nested = entry.args?.include;
       if (nested !== void 0) {
@@ -8176,11 +8199,11 @@ function validateClientFilter(filter2) {
   }
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils23.isArray)(value)) {
+    if ((0, import_utils24.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils23.isPlainObject)(value)) return;
+    if (!(0, import_utils24.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -8385,7 +8408,7 @@ var Base = class {
   }
   processInclude(include, authorization) {
     assertPublicAdmission(include, "include");
-    const items = (0, import_utils23.compact)((0, import_utils23.castArray)(include));
+    const items = (0, import_utils24.compact)((0, import_utils24.castArray)(include));
     const legacy = [];
     const correlated = [];
     const correlatedReferenceFields = [];
@@ -8421,23 +8444,23 @@ var Base = class {
     else this.assertIncludeOutputPaths([...legacy, ...correlated]);
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils23.forEach)(legacy, (inc) => {
+    (0, import_utils24.forEach)(legacy, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils23.uniq)((0, import_utils23.compact)(includeLocalFields));
-    includePaths = (0, import_utils23.uniq)((0, import_utils23.compact)(includePaths));
+    includeLocalFields = (0, import_utils24.uniq)((0, import_utils24.compact)(includeLocalFields));
+    includePaths = (0, import_utils24.uniq)((0, import_utils24.compact)(includePaths));
     return {
       includes: legacy,
       correlatedIncludes: correlated,
       includeLocalFields,
       includePaths,
-      correlatedReferenceFields: (0, import_utils23.uniq)((0, import_utils23.compact)(correlatedReferenceFields))
+      correlatedReferenceFields: (0, import_utils24.uniq)((0, import_utils24.compact)(correlatedReferenceFields))
     };
   }
   validateIncludeOutputPath(path, modelName, configuration) {
     const permissionField = configuration ? configuration.documentPermissionField ?? "_permissions" : getModelOption(modelName, "documentPermissionField");
-    if ((0, import_utils23.get)((0, import_utils23.set)({}, path, true), permissionField) !== void 0 || (0, import_utils23.get)((0, import_utils23.set)({}, permissionField, true), path) !== void 0) {
+    if ((0, import_utils24.get)((0, import_utils24.set)({}, path, true), permissionField) !== void 0 || (0, import_utils24.get)((0, import_utils24.set)({}, permissionField, true), path) !== void 0) {
       this.throwClientRequestError(
         "bad_request" /* BadRequest */,
         `Include output path ${path} overlaps document permission field ${permissionField} on model ${modelName}`
@@ -8462,9 +8485,9 @@ var Base = class {
       const walk = (node, prefix) => {
         for (const [key, value] of Object.entries(node)) {
           if (value === void 0) continue;
-          if ((0, import_utils23.isPlainObject)(value) && "sub" in value) {
+          if ((0, import_utils24.isPlainObject)(value) && "sub" in value) {
             const sub = value.sub;
-            if ((0, import_utils23.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
+            if ((0, import_utils24.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
             continue;
           }
           out.push(prefix ? `${prefix}.${key}` : key);
@@ -8517,7 +8540,7 @@ var Base = class {
         this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
       }
       for (const entry of entries) {
-        if (!(0, import_utils23.isPlainObject)(entry)) continue;
+        if (!(0, import_utils24.isPlainObject)(entry)) continue;
         const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
         if (models.has(modelName)) continue;
         models.add(modelName);
@@ -8530,7 +8553,7 @@ var Base = class {
           const target = targets?.find((target2) => target2.path === entry.path);
           if (nested)
             pending.push({
-              entries: (0, import_utils23.compact)((0, import_utils23.castArray)(nested)),
+              entries: (0, import_utils24.compact)((0, import_utils24.castArray)(nested)),
               modelName: entry.model,
               configuration: target?.configuration,
               targets: target?.relatedTargets
@@ -8540,7 +8563,7 @@ var Base = class {
     }
   }
   getForeignKeyValues(value) {
-    return (0, import_utils23.flatten)((0, import_utils23.castArray)(value));
+    return (0, import_utils24.flatten)((0, import_utils24.castArray)(value));
   }
   getForeignKey(value) {
     return String(value);
@@ -8548,7 +8571,7 @@ var Base = class {
   buildForeignKeyIndex(rows2, foreignField) {
     const index = /* @__PURE__ */ new Map();
     for (const row of rows2) {
-      for (const value of this.getForeignKeyValues((0, import_utils23.get)(row, foreignField))) {
+      for (const value of this.getForeignKeyValues((0, import_utils24.get)(row, foreignField))) {
         const key = this.getForeignKey(value);
         const values = index.get(key);
         if (values) values.push(row);
@@ -8584,9 +8607,9 @@ var Base = class {
   async includeDocs(docs, include, parentAuthorization) {
     assertPublicAdmission(include, "include");
     if (!include) return docs;
-    const includes = (0, import_utils23.compact)((0, import_utils23.castArray)(include));
+    const includes = (0, import_utils24.compact)((0, import_utils24.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils23.isArray)(docs);
+    const isSingle = !(0, import_utils24.isArray)(docs);
     let docList = (isSingle ? [docs] : docs).map(prepareIncludeOutput);
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
@@ -8616,7 +8639,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, "read", path, parentAuthorization);
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils23.get)(doc, localField);
+      const localValue = (0, import_utils24.get)(doc, localField);
       const execution = this.relatedExecution(svc, include, parentAuthorization);
       const prepared = await prepareModelQuery(
         svc,
@@ -8651,15 +8674,15 @@ var Base = class {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
     const svc = await this.getAuthorizedTargetService(model, op, path, parentAuthorization);
     const includeLocalValues = [];
-    (0, import_utils23.forEach)(docs, (doc) => {
-      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils23.get)(doc, localField)));
+    (0, import_utils24.forEach)(docs, (doc) => {
+      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils24.get)(doc, localField)));
     });
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
       execution,
       { kind: "client-read", filter: _filters ?? {} },
-      { [foreignField]: { $in: (0, import_utils23.flatten)(includeLocalValues) } },
+      { [foreignField]: { $in: (0, import_utils24.flatten)(includeLocalValues) } },
       true
     );
     const trustedArgs = this.sanitizeIncludeArgs(args, "list");
@@ -8702,7 +8725,7 @@ var Base = class {
     }
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const matches = this.getIndexedMatches(index, (0, import_utils23.get)(doc, localField));
+      const matches = this.getIndexedMatches(index, (0, import_utils24.get)(doc, localField));
       const isolated = matches.map((m) => copyAuthorizedOutput(m));
       attachIncludeOutput(doc, path, op === "list" ? isolated : isolated[0]);
     }
@@ -8711,7 +8734,7 @@ var Base = class {
   async includeDocsCount(docs, include, parentAuthorization) {
     const { model, path, localField, foreignField, filter: _filters } = include;
     const svc = await this.getAuthorizedTargetService(model, "count", path, parentAuthorization);
-    const groups = prepareCountGroups(docs, (doc) => (0, import_utils23.get)(doc, localField));
+    const groups = prepareCountGroups(docs, (doc) => (0, import_utils24.get)(doc, localField));
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
@@ -8765,7 +8788,7 @@ var Base = class {
     }
     const state = this.getCorrelatedExecState();
     docs = docs.map(prepareIncludeOutput);
-    const resolvedSnapshots = snapshots2 ?? docs.map((doc) => (0, import_utils23.cloneDeep)(toObject(getIncludeSource(doc))));
+    const resolvedSnapshots = snapshots2 ?? docs.map((doc) => (0, import_utils24.cloneDeep)(toObject(getIncludeSource(doc))));
     for (const include of correlatedIncludes) {
       switch (include.op) {
         case "read":
@@ -9114,10 +9137,10 @@ var Base = class {
     }
     let ret = result2.data;
     if (sqOptions.path) {
-      ret = (0, import_utils23.isArray)(ret) ? (0, import_utils23.flatten)(ret.map((v) => (0, import_utils23.get)(v, sqOptions.path))) : (0, import_utils23.get)(ret, sqOptions.path);
+      ret = (0, import_utils24.isArray)(ret) ? (0, import_utils24.flatten)(ret.map((v) => (0, import_utils24.get)(v, sqOptions.path))) : (0, import_utils24.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils23.compact)((0, import_utils23.castArray)(ret));
+      ret = (0, import_utils24.compact)((0, import_utils24.castArray)(ret));
     }
     return ret;
   }
@@ -9129,11 +9152,11 @@ var Base = class {
 };
 // src/services/service.ts
-var import_utils34 = require("@web-ts-toolkit/utils");
+var import_utils35 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 // src/model.ts
-var import_utils24 = require("@web-ts-toolkit/utils");
+var import_utils25 = require("@web-ts-toolkit/utils");
 init_runtime_context();
 init_runtime();
 function admitModelPersistence(adapter, scheduler) {
@@ -9209,7 +9232,7 @@ var Model = class {
   }
   /** Cast a copy using this model's query schema/setters, without executing query middleware or persistence. */
   castFilter(filter2) {
-    const query = this.mongooseModel.countDocuments((0, import_utils24.cloneDeep)(filter2));
+    const query = this.mongooseModel.countDocuments((0, import_utils25.cloneDeep)(filter2));
     return query.cast(this.mongooseModel);
   }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
@@ -9223,7 +9246,7 @@ var Model = class {
 var model_default = Model;
 // src/acl/distinct-field-authorization.ts
-var import_utils25 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 init_field_authorization();
 init_field_catalog();
 var schemaVariants = (schema) => Object.values(schema.discriminators ?? {});
@@ -9305,8 +9328,8 @@ function isDistinctFieldAuthorized(args) {
       if (path !== field && !path.startsWith(`${field}.`) && !field.startsWith(`${path}.`)) continue;
       if (path.startsWith(`${field}.`) && (!eligible(path) || !schemaShape(schema, path) || !granted(path)))
         return false;
-      if ((0, import_utils25.isPlainObject)(raw) && raw.sub !== void 0) {
-        if (!(0, import_utils25.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
+      if ((0, import_utils26.isPlainObject)(raw) && raw.sub !== void 0) {
+        if (!(0, import_utils26.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
       }
     }
     return true;
@@ -9483,7 +9506,7 @@ init_document();
 init_populate_target();
 // src/helpers/apply-update.ts
-var import_utils29 = require("@web-ts-toolkit/utils");
+var import_utils30 = require("@web-ts-toolkit/utils");
 init_lib();
 function applyUpdate(target, data, allowedFields) {
   const wholeFields = /* @__PURE__ */ new Set();
@@ -9499,17 +9522,17 @@ function applyUpdate(target, data, allowedFields) {
     }
   };
   for (const field of allowedFields) {
-    collectBoundary((0, import_utils29.set)({}, field, true));
+    collectBoundary((0, import_utils30.set)({}, field, true));
   }
   const apply = (values, prefix = "") => {
     for (const [key, value] of Object.entries(values)) {
       const path = prefix ? `${prefix}.${key}` : key;
-      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils29.isPlainObject)(value) || Array.isArray(value))) {
+      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils30.isPlainObject)(value) || Array.isArray(value))) {
         apply(value, path);
       } else if (isDocument2(target)) {
         target.set(path, value);
       } else {
-        (0, import_utils29.set)(target, path, value);
+        (0, import_utils30.set)(target, path, value);
       }
     }
   };
@@ -9517,7 +9540,7 @@ function applyUpdate(target, data, allowedFields) {
 }
 // src/acl/model-input-admission.ts
-var import_utils31 = require("@web-ts-toolkit/utils");
+var import_utils32 = require("@web-ts-toolkit/utils");
 var import_mongoose8 = require("mongoose");
 init_document();
 init_request_work();
@@ -9525,7 +9548,7 @@ init_logger_helpers();
 init_request_complexity();
 // src/acl/select-resolution.ts
-var import_utils30 = require("@web-ts-toolkit/utils");
+var import_utils31 = require("@web-ts-toolkit/utils");
 init_core_shared();
 init_helpers();
 async function collectAllowedFieldsForRequest({
@@ -9599,15 +9622,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils30.difference)(fields, normalizedSelect);
+        fields = (0, import_utils31.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils30.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils31.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(strippedAlways);
   }
-  return (0, import_utils30.intersection)(normalizedSelect, fields);
+  return (0, import_utils31.intersection)(normalizedSelect, fields);
 }
 function stripVirtuals(fields, virtualNames) {
   const set13 = virtualNames instanceof Set ? virtualNames : new Set(virtualNames ?? []);
@@ -9638,7 +9661,7 @@ init_field_catalog();
 init_service_authorization();
 var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var inside = (path, root) => path === root || path.startsWith(`${root}.`);
-var record2 = (value) => (0, import_utils31.isPlainObject)(value);
+var record2 = (value) => (0, import_utils32.isPlainObject)(value);
 function inputValue(value) {
   if (typeof value === "function" || typeof value === "symbol") {
     authorizationError("input values must be persisted data, not functions or symbols");
@@ -9707,7 +9730,7 @@ function requestBoundaries(fields) {
       else visit(value, path);
     }
   };
-  for (const field of fields) visit((0, import_utils31.set)({}, field, true));
+  for (const field of fields) visit((0, import_utils32.set)({}, field, true));
   return [...new Set(result2)];
 }
 function ownValue(data, parts) {
@@ -9837,7 +9860,7 @@ function admitModelInput(args) {
     if (forbidden(catalog, path, requested)) continue;
     const supplied = ownValue(data, parts);
     if (!supplied) continue;
-    (0, import_utils31.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
+    (0, import_utils32.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
     selected.push(field);
   }
   return { allowedData, allowedFields };
@@ -9849,7 +9872,7 @@ async function requestInputFields(args) {
   const prefix = configuration.modelPermissionPrefix ?? "";
   return collectModelRequestFields({
     req: args.binding.request,
-    permissionSchema: args.scopePath ? (0, import_utils31.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
+    permissionSchema: args.scopePath ? (0, import_utils32.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
     access: args.access,
     permissions,
     grants,
@@ -9893,13 +9916,13 @@ init_logger_helpers();
 init_lib();
 // src/services/model-subdocument-service.ts
-var import_utils33 = require("@web-ts-toolkit/utils");
+var import_utils34 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_public_admission();
 // src/acl/subdocument-authorization.ts
-var import_utils32 = require("@web-ts-toolkit/utils");
+var import_utils33 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_core_shared();
@@ -10088,8 +10111,8 @@ async function subdocumentGateAllowed(service, gate) {
   let guard2;
   if (access.startsWith("subs.")) {
     const [, sub, op] = access.split(".");
-    guard2 = (0, import_utils32.get)(configuration, `operationAccess.${access}`);
-    if (guard2 === void 0) guard2 = (0, import_utils32.get)(configuration, `operationAccess.subs.${sub}`);
+    guard2 = (0, import_utils33.get)(configuration, `operationAccess.${access}`);
+    if (guard2 === void 0) guard2 = (0, import_utils33.get)(configuration, `operationAccess.subs.${sub}`);
     if (guard2 === void 0) guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${op}`);
   } else guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${access}`);
   return evaluateRouteGuard(
@@ -10220,7 +10243,7 @@ async function visibleMutationRows(service, call, parentId, rows2) {
     const read = await subdocumentRows(service, visibility.child, selected, selected, call.sub);
     const list = visibility.list ? await subdocumentRows(service, visibility.list, {}, {}, call.sub) : {};
     if (read === false || list === false) return [];
-    const visible = filterCollection((0, import_utils33.get)(parent, call.sub), intersectFilters(read, list));
+    const visible = filterCollection((0, import_utils34.get)(parent, call.sub), intersectFilters(read, list));
     return await finalizeSubdocumentRows(service, call.output, parent, visible);
   } catch {
     return [];
@@ -10245,7 +10268,7 @@ async function listSub(service, id, sub, options) {
       populate: []
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const rows2 = filterCollection((0, import_utils33.get)(parent, sub), childFilter);
+    const rows2 = filterCollection((0, import_utils34.get)(parent, sub), childFilter);
     const data = await finalizeSubdocumentRows(service, call.output, parent, rows2);
     return { success: true, kind: "list", code: "success" /* Success */, data, count: data.length };
   });
@@ -10269,7 +10292,7 @@ async function readSub(service, id, sub, subId, options) {
     });
     if (!parent) return denied2("not_found" /* NotFound */);
     const row = findElement(
-      (0, import_utils33.get)(capture ? parent : copySubdocumentParent(parent), sub),
+      (0, import_utils34.get)(capture ? parent : copySubdocumentParent(parent), sub),
       childFilter
     );
     if (!row) return denied2("not_found" /* NotFound */);
@@ -10290,7 +10313,7 @@ async function updateSub(service, persist, id, sub, subId, data, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils33.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils34.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     const original = isolateDocForOutput(row);
     const admit = await inputAdmission(service, call, parent);
@@ -10317,7 +10340,7 @@ async function bulkUpdateSub(service, persist, id, sub, data, options) {
     const selected = { _id: { $in: data.map((row) => row._id) } };
     const filter2 = await subdocumentRows(service, call.child, selected, selected, sub);
     if (filter2 === false) return denied2();
-    const rows2 = filterCollection((0, import_utils33.get)(parent, sub), filter2);
+    const rows2 = filterCollection((0, import_utils34.get)(parent, sub), filter2);
     const originals = rows2.map((row) => isolateDocForOutput(row));
     const admit = await inputAdmission(service, call, parent);
     for (const [index, row] of rows2.entries()) {
@@ -10346,7 +10369,7 @@ async function createSub(service, persist, id, sub, data, options) {
     const lookup = await mutationParent(service, id, call);
     if ("error" in lookup) return lookup.error;
     const { parent } = lookup;
-    const rows2 = (0, import_utils33.get)(parent, sub);
+    const rows2 = (0, import_utils34.get)(parent, sub);
     const admit = await inputAdmission(service, call, parent);
     const allowed = (Array.isArray(data) ? data : [data]).map((row) => admit(row).allowedData);
     if (addFirst) rows2.unshift(...allowed);
@@ -10367,7 +10390,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils33.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils34.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     await ("deleteOne" in row ? row.deleteOne?.() : row.remove?.());
     await persist(() => parent.save());
@@ -10681,20 +10704,20 @@ var Service = class extends Base {
     const field = configuration.documentPermissionField ?? "_permissions";
     unsetDocPath(output, field);
     if (!configuration.stripPermissionsField) {
-      (0, import_utils34.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
+      (0, import_utils35.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
       if (args.includeFieldPermissions && !configuration.disableFieldPermissions) {
         const rowAccess = this.asServiceHookContext(context).fieldPermissionAccess ?? await this.getFieldPermissionAccess([snapshot._id]);
         const id = String(snapshot._id);
         const views = rowAccess.readIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "read") : [];
         const edits = rowAccess.updateIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "update") : [];
         const map2 = (paths) => paths.length ? Object.fromEntries(paths.map((path) => [path, true])) : { $: "_" };
-        (0, import_utils34.set)(output, `${field}._view`, map2(views));
-        (0, import_utils34.set)(output, `${field}._edit`, map2(edits));
-      } else if (!args.includePermissions) (0, import_utils34.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
+        (0, import_utils35.set)(output, `${field}._view`, map2(views));
+        (0, import_utils35.set)(output, `${field}._edit`, map2(edits));
+      } else if (!args.includePermissions) (0, import_utils35.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
       const exposed = configuration.exposedDocPermissionKeys;
       if (exposed) {
-        const metadata = (0, import_utils34.get)(output, field);
-        (0, import_utils34.set)(
+        const metadata = (0, import_utils35.get)(output, field);
+        (0, import_utils35.set)(
           output,
           field,
           Object.fromEntries(
@@ -10955,7 +10978,7 @@ var Service = class extends Base {
     return docs.map((doc) => {
       try {
         const plain = toObject(doc);
-        const val = (0, import_utils34.get)(plain, associationField);
+        const val = (0, import_utils35.get)(plain, associationField);
         return deepIsolateValue(val);
       } catch {
         return void 0;
@@ -10994,10 +11017,6 @@ var Service = class extends Base {
       const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
       const modelName = target?.modelName;
       if (!modelName) continue;
-      if (target.kind === "passthrough") {
-        result2.push({ path: descriptor.path, select: descriptor.select });
-        continue;
-      }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
       const svc = this.requestCore.getPublicService(modelName);
       const child = createRelatedExecution(
@@ -11016,7 +11035,7 @@ var Service = class extends Base {
       if (isExecutionRowDenied(svc, child)) continue;
       const childState = readServiceExecution(svc, child);
       const targetConfiguration = readServiceAuthorization(childState.authorization, childState.binding).configuration;
-      if (policy?.operation.mode !== "grant" && !await this.hookGate.run(
+      if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && policy?.operation.mode !== "grant" && !await this.hookGate.run(
         () => evaluateRouteGuard(
           this.req,
           getAuthorizationPermissions(childState.authorization, childState.binding),
@@ -11068,7 +11087,7 @@ var Service = class extends Base {
     if (this.isScalarPopulateValue(rawTarget)) return rawTarget;
     const isDoc = (() => {
       try {
-        if ((0, import_utils34.isPlainObject)(rawTarget)) return true;
+        if ((0, import_utils35.isPlainObject)(rawTarget)) return true;
         const maybe = rawTarget;
         if (maybe && typeof maybe === "object" && "_doc" in maybe) return true;
         if (maybe && typeof maybe.toObject === "function") return true;
@@ -11156,7 +11175,7 @@ var Service = class extends Base {
       child = getDocValue(current, key);
       if (child === void 0) {
         try {
-          child = (0, import_utils34.get)(current, key);
+          child = (0, import_utils35.get)(current, key);
         } catch {
           return;
         }
@@ -11391,7 +11410,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    const correlatedSnapshots = [(0, import_utils34.cloneDeep)(toObject(doc))];
+    const correlatedSnapshots = [(0, import_utils35.cloneDeep)(toObject(doc))];
     try {
       doc = await this.includeDocs(doc, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -11573,7 +11592,7 @@ var Service = class extends Base {
     const findAssociationField = this.getAssociationFieldFromOptions(options);
     const withAssocSelect = findAssociationField && !finalSelect.includes(findAssociationField) ? [...finalSelect, findAssociationField] : finalSelect;
     const dbSelect = this.buildDbSelectForAssociation(withAssocSelect, findAssociationField);
-    const filteredPopulate = (0, import_utils34.isArray)(withAssocSelect) && (0, import_utils34.isArray)(_populate) ? _populate.filter(
+    const filteredPopulate = (0, import_utils35.isArray)(withAssocSelect) && (0, import_utils35.isArray)(_populate) ? _populate.filter(
       (p) => [
         ...virtualPlan.publicPersistedFetchSelection,
         ...findAssociationField ? [findAssociationField] : []
@@ -11633,7 +11652,7 @@ var Service = class extends Base {
         findAssociationField ? [findAssociationField] : []
       );
     const capturedAssociation = findAssociationField ? this.captureAssociationValues(docs, findAssociationField) : void 0;
-    const correlatedSnapshots = docs.map((doc) => (0, import_utils34.cloneDeep)(toObject(doc)));
+    const correlatedSnapshots = docs.map((doc) => (0, import_utils35.cloneDeep)(toObject(doc)));
     try {
       docs = await this.includeDocs(docs, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -11832,12 +11851,12 @@ var Service = class extends Base {
       context.allowedFields = allowedFields;
       context.allowedData = allowedData;
       const validated = await this.validate(allowedData, "create", context);
-      if ((0, import_utils34.isBoolean)(validated)) {
+      if ((0, import_utils35.isBoolean)(validated)) {
         if (!validated) {
           validationErrors.push({ index, errors: [] });
           return void 0;
         }
-      } else if ((0, import_utils34.isArray)(validated)) {
+      } else if ((0, import_utils35.isArray)(validated)) {
         if (validated.length > 0) {
           validationErrors.push({
             index,
@@ -12048,7 +12067,7 @@ var Service = class extends Base {
     }
     let doc = await this.model.findOne({
       filter: _filter,
-      select: (0, import_utils34.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
+      select: (0, import_utils35.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
         (path) => `+${path}`
       )
     });
@@ -12087,12 +12106,12 @@ var Service = class extends Base {
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils34.isBoolean)(validated)) {
+    if ((0, import_utils35.isBoolean)(validated)) {
       if (!validated) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
       }
-    } else if ((0, import_utils34.isArray)(validated)) {
+    } else if ((0, import_utils35.isArray)(validated)) {
       if (validated.length > 0) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
@@ -12112,10 +12131,10 @@ var Service = class extends Base {
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_just_diff.diff)(
-        (0, import_utils34.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils34.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils35.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils35.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils34.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
+      context.modifiedPaths = (0, import_utils35.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -12203,7 +12222,7 @@ var Service = class extends Base {
       const upsertOptions = this.resolveUpsertOptions(options);
       const updateIntent = captureModelServiceIntent(this, "updateOne", upsertArgs, upsertOptions);
       const createIntent = captureModelServiceIntent(this, "create", upsertArgs, upsertOptions);
-      const related = (0, import_utils34.uniqBy)(
+      const related = (0, import_utils35.uniqBy)(
         [...this.captureRelated(updateIntent.args), ...this.captureRelated(createIntent.args)],
         (target) => target.path
       );
@@ -12644,7 +12663,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils34.compact)((0, import_utils34.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
+    const uniqueIds = (0, import_utils35.compact)((0, import_utils35.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -12690,7 +12709,7 @@ var Service = class extends Base {
    * (direct/root-entry 200); count measures visible rows, not all updated rows.
    */
   async bulkUpdateSub(id, sub, data, options) {
-    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils34.castArray)(data), options);
+    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils35.castArray)(data), options);
   }
   /**
    * Append/prepend admitted rows, then return the visible full array (including when
@@ -12714,7 +12733,7 @@ var Service = class extends Base {
 };
 // src/services/public-service.ts
-var import_utils35 = require("@web-ts-toolkit/utils");
+var import_utils36 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_permissions_alias();
 init_document();
@@ -12840,7 +12859,7 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
         d = this.runTasks(d, tasks);
-        if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
         return d;
       }
     );
@@ -13059,8 +13078,8 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
         d = this.runTasks(d, tasks);
-        if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
-        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, returningKeys));
+        if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, returningKeys));
         return d;
       }
     );
@@ -13143,8 +13162,8 @@ var PublicService = class extends Service {
             let d = toObject(doc);
             d = await this.decorate(d, "update", context);
             d = this.runTasks(d, tasks2);
-            if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
-            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, returningKeys));
+            if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, returningKeys));
             return d;
           }
         );
@@ -13169,7 +13188,7 @@ var PublicService = class extends Service {
           d = await this.decorate(d, "create", context);
           d = this.runTasks(d, tasks);
           if (createSelect)
-            d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(createSelect), ...this.baseFieldsExt]));
+            d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(createSelect), ...this.baseFieldsExt]));
           return d;
         }
       );
@@ -13314,7 +13333,7 @@ var PublicService = class extends Service {
 init_options();
 init_data_values();
 init_helpers();
-var import_utils36 = require("@web-ts-toolkit/utils");
+var import_utils37 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_runtime_context();
 init_runtime();
@@ -13343,7 +13362,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils36.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils37.pick)(doc, _select);
     return {
       success: true,
       kind: "single",
@@ -13389,13 +13408,13 @@ var DataService = class {
     const totalCount = docs.length;
     if (sort) {
       const normalizedSort = normalizeSortForOrderBy(sort);
-      docs = (0, import_utils36.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
+      docs = (0, import_utils37.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
     }
     const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     const { maxHookConcurrency } = this.getRequestComplexity();
     const trimmed = await mapWithConcurrencyLimit(pagedDocs, maxHookConcurrency, async (doc) => {
       doc = await this.trimOutputFields(doc, "list");
-      if (_select.length > 0) doc = (0, import_utils36.pick)(doc, _select);
+      if (_select.length > 0) doc = (0, import_utils37.pick)(doc, _select);
       return copyDataValue(doc);
     });
     if (!hasExplicitLimit && trimmed.length === totalCount) {
@@ -13470,10 +13489,10 @@ var DataService = class {
 init_helpers();
 // src/processors.ts
-var import_utils37 = require("@web-ts-toolkit/utils");
+var import_utils38 = require("@web-ts-toolkit/utils");
 init_permissions_alias();
 function cloneProcessorValue(value) {
-  const copy = (0, import_utils37.cloneDeep)(value);
+  const copy = (0, import_utils38.cloneDeep)(value);
   copyPermissionsAliasGraph(value, copy);
   return copy;
 }
@@ -13511,10 +13530,10 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!(0, import_utils37.isPlainObject)(target)) return ret;
+      if (!(0, import_utils38.isPlainObject)(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
-      if ((0, import_utils37.isArray)(next)) {
+      if ((0, import_utils38.isArray)(next)) {
         for (const item of next) {
           ret.push(item);
         }
@@ -13524,8 +13543,8 @@ function resolveLeafParents(obj, src) {
   }
   const leaf = segs[segs.length - 1];
   const pairs = [];
-  (0, import_utils37.forEach)(targets, (target) => {
-    if (!(0, import_utils37.isPlainObject)(target)) return;
+  (0, import_utils38.forEach)(targets, (target) => {
+    if (!(0, import_utils38.isPlainObject)(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -13534,7 +13553,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
   const mutable = options.mutable !== false;
   const idField = options.idField ?? "_id";
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13543,19 +13562,19 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     assertSafePath(dest);
     let targets = [obj];
     const segs = src.split(".");
-    (0, import_utils37.forEach)(segs, (seg, ind) => {
+    (0, import_utils38.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils37.forEach)(targets, (target) => {
-          if (!(0, import_utils37.isPlainObject)(target)) return;
+        (0, import_utils38.forEach)(targets, (target) => {
+          if (!(0, import_utils38.isPlainObject)(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
           let depopulated;
-          if ((0, import_utils37.isArray)(leaf)) {
+          if ((0, import_utils38.isArray)(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => (0, import_utils37.isPlainObject)(item))) {
-              depopulated = (0, import_utils37.map)(leaf, idField).map((id, i) => {
+            } else if (leaf.every((item) => (0, import_utils38.isPlainObject)(item))) {
+              depopulated = (0, import_utils38.map)(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
                 }
@@ -13564,8 +13583,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if ((0, import_utils37.isPlainObject)(leaf)) {
-            const id = (0, import_utils37.get)(leaf, idField);
+          } else if ((0, import_utils38.isPlainObject)(leaf)) {
+            const id = (0, import_utils38.get)(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
             }
@@ -13573,15 +13592,15 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           } else {
             return;
           }
-          (0, import_utils37.set)(targetObject, dest, sourceForDest);
-          (0, import_utils37.set)(targetObject, seg, depopulated);
+          (0, import_utils38.set)(targetObject, dest, sourceForDest);
+          (0, import_utils38.set)(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!(0, import_utils37.isPlainObject)(target)) return ret;
+          if (!(0, import_utils38.isPlainObject)(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
-          if ((0, import_utils37.isArray)(next)) {
+          if ((0, import_utils38.isArray)(next)) {
             for (const item of next) {
               ret.push(item);
             }
@@ -13596,7 +13615,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
 var copyPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13604,9 +13623,9 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "copyPaths");
     assertSafePath(dest, "copyPaths");
     if (src === dest) return;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
-      (0, import_utils37.set)(parent, dest, cloneProcessorValue(parent[leaf]));
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
+      (0, import_utils38.set)(parent, dest, cloneProcessorValue(parent[leaf]));
     });
   });
   return obj;
@@ -13614,7 +13633,7 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
 var movePaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13622,10 +13641,10 @@ var movePaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "movePaths");
     assertSafePath(dest, "movePaths");
     if (src === dest) return;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
       const value = cloneProcessorValue(parent[leaf]);
-      (0, import_utils37.set)(parent, dest, value);
+      (0, import_utils38.set)(parent, dest, value);
       if (dest === leaf || dest.startsWith(`${leaf}.`)) return;
       delete parent[leaf];
     });
@@ -13637,7 +13656,7 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
   const maxSlice = options.maxSlice ?? DEFAULT_MAX_SLICE;
   assertNonNegativeSafeInteger(maxSlice, "maxSlice", "sliceArrays");
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
@@ -13654,15 +13673,15 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
       assertNonNegativeSafeInteger(op.limit, "limit", "sliceArrays");
       limit = Math.min(op.limit, maxSlice);
     }
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       const leafValue = parent[leaf];
-      if (!(0, import_utils37.isArray)(leafValue)) return;
+      if (!(0, import_utils38.isArray)(leafValue)) return;
       const end = typeof limit === "undefined" ? void 0 : skip + limit;
       const window = leafValue.slice(skip, end);
       if (typeof rawDest === "undefined") {
-        (0, import_utils37.set)(parent, leaf, window);
+        (0, import_utils38.set)(parent, leaf, window);
       } else {
-        (0, import_utils37.set)(parent, rawDest, window);
+        (0, import_utils38.set)(parent, rawDest, window);
       }
     });
   });
@@ -13671,27 +13690,27 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
 var countPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
     if (src.length === 0 || dest.length === 0) return;
     assertSafePath(src, "countPaths");
     assertSafePath(dest, "countPaths");
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
       const leafValue = parent[leaf];
       let count;
-      if ((0, import_utils37.isArray)(leafValue)) {
+      if ((0, import_utils38.isArray)(leafValue)) {
         count = leafValue.length;
-      } else if ((0, import_utils37.isPlainObject)(leafValue)) {
+      } else if ((0, import_utils38.isPlainObject)(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
       } else {
         count = 1;
       }
-      (0, import_utils37.set)(parent, dest, count);
+      (0, import_utils38.set)(parent, dest, count);
     });
   });
   return obj;
@@ -13699,15 +13718,15 @@ var countPaths = (docObject, operations, options = { mutable: true }) => {
 var maskPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
     assertSafePath(src, "maskPaths");
     const replacement = Object.prototype.hasOwnProperty.call(op, "replacement") ? op.replacement : DEFAULT_MASK_REPLACEMENT;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
-      (0, import_utils37.set)(parent, leaf, replacement);
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
+      (0, import_utils38.set)(parent, leaf, replacement);
     });
   });
   return obj;
@@ -13762,6 +13781,8 @@ init_core_shared();
 init_virtual_projection();
 init_populate_target();
 init_model_output_planning();
+init_authorization_snapshot();
+init_document();
 init_output_field_filter();
 init_request_work();
 var emptyPermissionLeaf = () => ({ $: "_" });
@@ -13779,10 +13800,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils38.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils39.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils38.isString)(idField)) {
+    if ((0, import_utils39.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -13872,17 +13893,11 @@ var Core = class {
     return this.genSelect(modelName, access, targetFields, options);
   }
   /** Persisted request-only populate admission; fetch planning is not field authority. */
-  async requestPopulateSelect(modelName, access, targetFields = null, scopePath = []) {
+  async requestPopulateSelect(configuration, permissions, access, targetFields = null, scopePath = []) {
     const subPaths = scopePath.flatMap((part) => [part, "sub"]);
-    const permissionSchema = getModelOption(modelName, ["permissionSchema"].concat(subPaths).join("."));
-    const permissions = this.getGlobalPermissions();
-    let virtualNames;
-    try {
-      const runtime = getActiveRuntime() ?? defaultRuntime;
-      virtualNames = runtime.getVirtualNames(modelName, subPaths);
-    } catch {
-      virtualNames = [];
-    }
+    const permissionSchema = (0, import_utils39.get)(configuration, ["permissionSchema", ...subPaths]);
+    const prefix = scopePath.length ? `${scopePath.join(".")}.` : "";
+    const virtualNames = (configuration.catalog.virtualPaths ?? []).filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).filter((path) => !path.includes("."));
     return resolveSelectForRequest({
       req: this.req,
       permissionSchema,
@@ -13901,17 +13916,25 @@ var Core = class {
     assertPublicAdmission(_populate, "populate");
     assertPopulateAccess(access);
     if (!_populate) return [];
-    let populate = Array.isArray(_populate) ? _populate : [_populate];
-    for (const p of populate) {
-      if (!(0, import_utils38.isString)(p)) assertPopulateAccess(p.access);
-    }
-    populate = (0, import_utils38.compact)(
+    const descriptors = copyAuthorizationValue(Array.isArray(_populate) ? _populate : [_populate], true);
+    for (const p of descriptors) {
+      if (!(0, import_utils39.isString)(p)) assertPopulateAccess(p.access);
+    }
+    const runtime = this.requestRuntime;
+    const globalOptions = modelServiceGlobalOptions(this, runtime);
+    const relatedTargets = captureRelatedTargets(runtime, modelName, { populate: descriptors }, 0, globalOptions);
+    const sourceConfiguration = captureModelAuthorizationConfiguration(runtime, modelName, void 0, globalOptions);
+    const originalPermissions = this.getGlobalPermissions();
+    const permissions = new permission_default(
+      Object.fromEntries(originalPermissions.keys.map((key) => [key, originalPermissions.has(key)]))
+    );
+    const populate = (0, import_utils39.compact)(
       await Promise.all(
-        populate.map(async (p) => {
-          const populateAccess = !(0, import_utils38.isString)(p) && p.access ? p.access : access;
+        descriptors.map(async (p) => {
+          const populateAccess = !(0, import_utils39.isString)(p) && p.access ? p.access : access;
           assertPopulateAccess(populateAccess);
-          const originalSelect = (0, import_utils38.isString)(p) ? void 0 : p.select;
-          const ret = (0, import_utils38.isString)(p) ? { path: p } : {
+          const originalSelect = (0, import_utils39.isString)(p) ? void 0 : p.select;
+          const ret = (0, import_utils39.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -13919,78 +13942,86 @@ var Core = class {
           const pathForSourcePermission = scopePrefix && ret.path.startsWith(`${scopePrefix}.`) ? ret.path.slice(scopePrefix.length + 1) : ret.path;
           const parentPath = pathForSourcePermission.includes(".") ? pathForSourcePermission.split(".")[0] : pathForSourcePermission;
           const allowedParentPaths = await this.requestPopulateSelect(
-            modelName,
+            sourceConfiguration,
+            permissions,
             populateAccess,
             [parentPath],
             scopePath
           );
           if (!allowedParentPaths.includes(parentPath)) return null;
-          const refModelName = getModelRef(modelName, ret.path);
-          if (!refModelName) return null;
-          const runtime = getActiveRuntime();
-          if (!runtime) return null;
-          const requireRegisteredPopulateModels = getGlobalOption("requireRegisteredPopulateModels", true);
-          if (!runtime.hasModel(refModelName)) {
-            return requireRegisteredPopulateModels ? null : ret;
-          }
-          const allowedTargetOperation = await this.isAllowed(refModelName, populateAccess);
-          if (!allowedTargetOperation) {
+          const target = relatedTargets.find((entry) => entry.path === ret.path);
+          if (!target) return null;
+          const refModelName = target.modelName;
+          const targetConfiguration = target.configuration;
+          if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && !await withCapturedModelOperationGuard(
+            this,
+            refModelName,
+            populateAccess,
+            getCapturedAuthorizationOption(targetConfiguration, `operationAccess.${populateAccess}`),
+            permissions,
+            () => this.isAllowed(refModelName, populateAccess)
+          )) {
             return null;
           }
-          ret.select = await this.requestPopulateSelect(refModelName, populateAccess, ret.select);
-          const hookInputs = getModelOption(refModelName, `alwaysSelectFields.${populateAccess}`, []);
-          ret.select = (0, import_utils38.uniq)([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
-          const filter2 = await this.genFilter(refModelName, populateAccess, null);
+          ret.select = await this.requestPopulateSelect(
+            targetConfiguration,
+            permissions,
+            populateAccess,
+            ret.select
+          );
+          const hookInputs = resolveAlwaysSelectForAccess(
+            targetConfiguration.alwaysSelectFields,
+            populateAccess
+          );
+          ret.select = (0, import_utils39.uniq)([
+            ...ret.select,
+            ...stripVirtuals(hookInputs, [...targetConfiguration.catalog.virtualPaths ?? []])
+          ]);
+          const match = (0, import_utils39.isString)(p) ? {} : p.match ?? {};
+          const filter2 = await resolveAccessFilterForRequest({
+            req: this.req,
+            permissions,
+            cache: this.caches.baseFilter,
+            cacheKey: `${refModelName}_baseFilter_${populateAccess}`,
+            access: populateAccess,
+            filter: deepIsolateValue(match),
+            getOption: (key) => getCapturedAuthorizationOption(targetConfiguration, key)
+          });
           if (filter2 === false) return null;
-          ret.match = filter2;
-          try {
-            const planAccess = populateAccess;
-            const targetSnapshot = {
-              permissionSchema: getModelOption(refModelName, "permissionSchema", null) ?? null,
-              virtuals: getModelOption(refModelName, "virtuals", null) ?? null,
-              alwaysSelectFields: getModelOption(refModelName, "alwaysSelectFields", null) ?? null,
-              modelPermissionPrefix: getModelOption(refModelName, "modelPermissionPrefix", "") ?? "",
-              requireExplicitSelect: getModelOption(refModelName, "requireExplicitSelect", false) ?? false,
-              documentPermissionField: getModelOption(refModelName, "documentPermissionField", "_permissions") ?? "_permissions",
-              exposedDocPermissionKeys: getModelOption(refModelName, "exposedDocPermissionKeys", void 0),
-              stripPermissionsField: getModelOption(refModelName, "stripPermissionsField", false) ?? false,
-              disableFieldPermissions: getModelOption(refModelName, "disableFieldPermissions", false) ?? false
-            };
-            const perms = this.getPermissions();
-            const globalForPlan = perms && typeof perms.has === "function" && typeof perms.hasKey === "function" ? perms : { has: () => false, hasKey: () => false };
-            const targetPlan = planVirtualProjection({
-              receivingModelName: refModelName,
-              snapshot: {
-                permissionSchema: targetSnapshot.permissionSchema,
-                virtuals: targetSnapshot.virtuals,
-                alwaysSelectFields: targetSnapshot.alwaysSelectFields,
-                modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
-                requireExplicitSelect: targetSnapshot.requireExplicitSelect,
-                documentPermissionField: targetSnapshot.documentPermissionField
-              },
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              internalFetch: { baseFields: ["_id"] },
-              globalPermissions: globalForPlan
-            });
-            const merged = (0, import_utils38.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
-              (t) => t !== "-_id" && !t.includes(".sub.")
-            );
-            if (!merged.includes("_id")) merged.push("_id");
-            ret.select = merged;
-            setPopulateTargetMeta(ret, {
-              targetModelName: refModelName,
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              plan: targetPlan,
-              snapshot: targetSnapshot
-            });
-          } catch {
-          }
+          ret.match = deepIsolateValue(intersectFilters(match, filter2));
+          const planAccess = populateAccess;
+          const targetSnapshot = targetConfiguration;
+          const targetPlan = planVirtualProjection({
+            receivingModelName: refModelName,
+            snapshot: {
+              permissionSchema: targetSnapshot.permissionSchema,
+              virtuals: targetSnapshot.virtuals,
+              alwaysSelectFields: targetSnapshot.alwaysSelectFields,
+              modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
+              requireExplicitSelect: targetSnapshot.requireExplicitSelect,
+              documentPermissionField: targetSnapshot.documentPermissionField
+            },
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            internalFetch: { baseFields: ["_id"] },
+            globalPermissions: permissions
+          });
+          const merged = (0, import_utils39.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
+            (t) => t !== "-_id" && !t.includes(".sub.")
+          );
+          if (!merged.includes("_id")) merged.push("_id");
+          ret.select = merged;
+          setPopulateTargetMeta(ret, {
+            targetModelName: refModelName,
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            plan: targetPlan,
+            snapshot: targetSnapshot
+          });
           return ret;
         })
       )
@@ -13999,10 +14030,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils38.isFunction)(validate)) {
+    if ((0, import_utils39.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils38.isBoolean)(validate) || (0, import_utils38.isArray)(validate)) {
+    } else if ((0, import_utils39.isBoolean)(validate) || (0, import_utils39.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -14027,7 +14058,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils38.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils39.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -14051,7 +14082,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils38.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils39.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await getRequestWorkState(this.req, this.requestRuntime).hookGate.run(
@@ -14135,7 +14166,7 @@ var Core = class {
       readExists ? requestFields("read") : [],
       updateExists ? requestFields("update") : []
     ]);
-    const viewObj = (0, import_utils38.reduce)(
+    const viewObj = (0, import_utils39.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -14143,7 +14174,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils38.reduce)(
+    const editObj = (0, import_utils39.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -14174,9 +14205,9 @@ var Core = class {
     });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils38.compact)((0, import_utils38.castArray)(task));
+    const tasks = (0, import_utils39.compact)((0, import_utils39.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils38.forEach)(tasks, (task2) => {
+    (0, import_utils39.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -14246,9 +14277,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils38.isUndefined)(subOption)) {
+      if ((0, import_utils39.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils38.isUndefined)(subFieldOption)) {
+        if ((0, import_utils39.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -14314,25 +14345,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils39.isPlainObject)(condition)) {
+    if ((0, import_utils40.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils39.isString)(id) ? id : null;
-      if ((0, import_utils39.isPlainObject)(id)) {
+      let _id = (0, import_utils40.isString)(id) ? id : null;
+      if ((0, import_utils40.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils39.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils40.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils39.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils40.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils39.isString)(_id) || !_id) {
+      if (!(0, import_utils40.isString)(_id) || !_id) {
         return next(new import_express_json_router5.default.clientErrors.BadRequestError());
       }
       const result2 = await svc._read(_id, { select });
@@ -14344,11 +14375,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils39.isString)(cond)) {
+    if ((0, import_utils40.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils39.isArray)(cond)) {
+    } else if ((0, import_utils40.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils39.isFunction)(cond)) {
+    } else if ((0, import_utils40.isFunction)(cond)) {
       const result2 = await cond.call(req, permissions);
       if (!!result2) return next();
     }
@@ -14361,7 +14392,7 @@ var import_express2 = __toESM(require("express"));
 // src/routers/model-router.ts
 var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils43 = require("@web-ts-toolkit/utils");
+var import_utils44 = require("@web-ts-toolkit/utils");
 init_logger_helpers();
 init_runtime();
 init_runtime_context();
@@ -14495,7 +14526,7 @@ init_request_complexity();
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils40 = require("@web-ts-toolkit/utils");
+var import_utils41 = require("@web-ts-toolkit/utils");
 // src/validation/public-admission-schema.ts
 init_public_admission();
@@ -14624,7 +14655,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils40.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils41.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -14661,7 +14692,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils40.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils41.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -14714,7 +14745,7 @@ var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, impo
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils40.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils41.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,
@@ -15687,7 +15718,7 @@ var rootQuerySchema = publicBoundarySchema(
 init_helpers();
 // src/routers/shared.ts
-var import_utils41 = require("@web-ts-toolkit/utils");
+var import_utils42 = require("@web-ts-toolkit/utils");
 // src/routers/model-router-collection-routes.ts
 init_schemas();
@@ -15718,15 +15749,15 @@ function setModelCollectionRoutes(context) {
       sort
     } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = (0, import_utils41.parseBooleanString)(include_count);
-    const includeExtraHeaders = (0, import_utils41.parseBooleanString)(include_extra_headers);
+    const includeCount = (0, import_utils42.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils42.parseBooleanString)(include_extra_headers);
     const result2 = await svc._list(
       {},
       { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
       {
-        skim: (0, import_utils41.parseBooleanString)(skim),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions),
+        skim: (0, import_utils42.parseBooleanString)(skim),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions),
         includeCount
       }
     );
@@ -15786,8 +15817,8 @@ function setModelCollectionRoutes(context) {
       data,
       {},
       {
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -15825,8 +15856,8 @@ function setModelCollectionRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -15923,9 +15954,9 @@ function setModelDocumentRoutes(context) {
       id,
       { select: parseSelectParam(select) },
       {
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions),
-        tryList: (0, import_utils41.parseBooleanString)(try_list)
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions),
+        tryList: (0, import_utils42.parseBooleanString)(try_list)
       }
     );
     handleResultError(result2);
@@ -16025,9 +16056,9 @@ function setModelDocumentRoutes(context) {
       data,
       { select: parseSelectParam(select) },
       {
-        returningAll: (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -16076,9 +16107,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -16109,9 +16140,9 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -16158,9 +16189,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -16400,11 +16431,11 @@ function setModelSubDocumentRoutes(context) {
 }
 // src/openapi/route-registration.ts
-var import_utils42 = require("@web-ts-toolkit/utils");
+var import_utils43 = require("@web-ts-toolkit/utils");
 function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
   runtime.registerOpenApiRoute({
     ...route,
-    path: (0, import_utils42.normalizeUrlPath)(basePath + route.path),
+    path: (0, import_utils43.normalizeUrlPath)(basePath + route.path),
     tags: route.tags ?? [defaultTag]
   });
 }
@@ -16412,8 +16443,8 @@ function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router8.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils43.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils43.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils44.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils44.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(
     this.modelName,
@@ -16615,7 +16646,7 @@ var ModelRouter = class _ModelRouter {
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils43.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils44.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router8.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName, this.runtime);
@@ -16701,13 +16732,13 @@ var ModelRouter = class _ModelRouter {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils43.forEach)(this.router.getEndpoints(), ({ method, path }) => {
-        logInfoMessage(`${(0, import_utils43.padEnd)(method, 6)} ${(0, import_utils43.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils44.forEach)(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${(0, import_utils44.padEnd)(method, 6)} ${(0, import_utils44.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils43.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils44.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -16715,7 +16746,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils43.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils44.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(
         this.modelName,
@@ -16743,7 +16774,7 @@ var ModelRouter = class _ModelRouter {
 // src/routers/root-router.ts
 var import_express_json_router9 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils44 = require("@web-ts-toolkit/utils");
+var import_utils45 = require("@web-ts-toolkit/utils");
 // src/core-data.ts
 init_options();
@@ -17051,7 +17082,7 @@ var RootRouter = class {
     this.setRoutes();
   }
   registerOpenApiRoute(route) {
-    registerOpenApiRoute(this.runtime, (0, import_utils44.normalizeUrlPath)(this.basename), "root", route);
+    registerOpenApiRoute(this.runtime, (0, import_utils45.normalizeUrlPath)(this.basename), "root", route);
   }
   wrapResult(index, item, result2) {
     return {
@@ -17160,7 +17191,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     const groups = /* @__PURE__ */ new Map();
     items.forEach((item, index) => {
-      const order = (0, import_utils44.isNumber)(item.order) ? item.order : 0;
+      const order = (0, import_utils45.isNumber)(item.order) ? item.order : 0;
       const group = groups.get(order);
       if (group) {
         group.push({ index, item });
@@ -17231,7 +17262,7 @@ var RootRouter = class {
         const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
-      return (0, import_utils44.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils45.orderBy)(results, ["index"], ["asc"]);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -17249,14 +17280,14 @@ var RootRouter = class {
 // src/routers/data-router.ts
 var import_express_json_router10 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils45 = require("@web-ts-toolkit/utils");
+var import_utils46 = require("@web-ts-toolkit/utils");
 init_runtime();
 init_helpers();
 init_schemas();
 var clientErrors4 = import_express_json_router10.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils45.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils45.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils46.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils46.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -17305,7 +17336,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils45.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils46.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router10.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -17338,8 +17369,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = (0, import_utils41.parseBooleanString)(include_count);
-      const includeExtraHeaders = (0, import_utils41.parseBooleanString)(include_extra_headers);
+      const includeCount = (0, import_utils42.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils42.parseBooleanString)(include_extra_headers);
       const result2 = await svc.find(
         {},
         { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
@@ -17457,7 +17488,7 @@ var DataRouter = class {
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils45.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils46.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(
         this.dataName,
@@ -17465,7 +17496,7 @@ var DataRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils45.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils46.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -17600,7 +17631,7 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    if ((0, import_utils46.isUndefined)(options)) {
+    if ((0, import_utils47.isUndefined)(options)) {
       return new RootRouter(modelName, runtime);
     }
     if (typeof modelName === "string") {
@@ -17621,10 +17652,10 @@ function createRuntimeApi(runtime) {
   };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils46.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils47.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils46.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils47.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };