@web-ts-toolkit/access-router 0.56.0 → 0.58.0

package/index.js

@@ -2161,9 +2161,34 @@ var init_field_catalog = __esm({
   }
 });
 
+// src/acl/populate-target-configuration.ts
+function capturePopulateTargetConfiguration(runtime, modelName, source, proposedOptions) {
+  const label = `Populate target "${modelName}" for ${source}`;
+  if (!proposedOptions && !runtime.hasModel(modelName))
+    authorizationError(
+      `${label} must be configured first in this runtime; register its Mongoose model and setModelOptions with an object permissionSchema`
+    );
+  const model = runtime.getModelInstance(modelName);
+  if (!model) authorizationError(`${label} requires an actual registered Mongoose model in this runtime`);
+  const options = proposedOptions ?? runtime.getModelOptions(modelName);
+  const permissionSchema = options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema;
+  if (!(0, import_utils15.isPlainObject)(permissionSchema))
+    authorizationError(
+      `${label} requires an effective object permissionSchema; configure the model or runtime model defaults ({} explicitly closes business fields)`
+    );
+  return { model, options: { ...options, permissionSchema } };
+}
+var import_utils15;
+var init_populate_target_configuration = __esm({
+  "src/acl/populate-target-configuration.ts"() {
+    import_utils15 = require("@web-ts-toolkit/utils");
+    init_authorization_snapshot();
+  }
+});
+
 // src/acl/virtual-populate-dependencies.ts
 function record(value, label) {
-  if (!(0, import_utils15.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
+  if (!(0, import_utils16.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
   for (const key of Reflect.ownKeys(value)) {
     const property = Object.getOwnPropertyDescriptor(value, key);
     if (typeof key !== "string" || !property.enumerable || !("value" in property))
@@ -2252,7 +2277,8 @@ function normalizeSelection(select, catalog, label) {
   };
 }
 function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
-  const requireReadOperationAccessForPopulateDependencies = globalOptions.requireReadOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateDependencies = globalOptions.requireOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateQueries = globalOptions.requireOperationAccessForPopulateQueries !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2292,16 +2318,23 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
                 label,
                 `target "${ref}" requires a registered same-connection non-discriminator ObjectId model bound to the source ref`
               );
-            const targetOptions = ref === modelName ? options : runtime.getModelOptions(ref);
+            const { options: targetOptions } = capturePopulateTargetConfiguration(
+              runtime,
+              ref,
+              `dependsOnPopulate virtual "${label}"`,
+              ref === modelName ? options : void 0
+            );
             const defaults = runtime.getDefaultModelOptions();
-            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils15.get)(targetOptions, path2, fallback), key, (0, import_utils15.get)(defaults, key));
+            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils16.get)(targetOptions, path2, fallback), key, (0, import_utils16.get)(defaults, key));
             const documentPermissionField = targetOptions.documentPermissionField ?? defaults.documentPermissionField;
             const catalog = captureAuthorizationFieldCatalog(targetModel.schema, void 0, documentPermissionField);
             const configuration = copyAuthorizationValue(
               {
                 catalog,
                 documentPermissionField,
-                requireReadOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateQueries,
+                permissionSchema: targetOptions.permissionSchema,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2350,13 +2383,13 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
         );
         continue;
       }
-      if (!(0, import_utils15.isPlainObject)(raw)) continue;
+      if (!(0, import_utils16.isPlainObject)(raw)) continue;
       const entry = raw;
       const label = join(sourcePrefix, name);
       captureList(entry.dependsOnPopulate, label);
       if (!("get" in entry))
         for (const access of accesses) {
-          if ((0, import_utils15.isPlainObject)(entry[access]))
+          if ((0, import_utils16.isPlainObject)(entry[access]))
             captureList(entry[access].dependsOnPopulate, `${label}.${access}`);
         }
       const byAccess = {};
@@ -2406,15 +2439,16 @@ function resolveVirtualPopulateDependencies(configuration, scopePath, virtualNam
     )
   );
 }
-var import_utils15, elementType, join, within, accesses, fail, varyingSchema, varyingModel, snapshots;
+var import_utils16, elementType, join, within, accesses, fail, varyingSchema, varyingModel, snapshots;
 var init_virtual_populate_dependencies = __esm({
   "src/acl/virtual-populate-dependencies.ts"() {
-    import_utils15 = require("@web-ts-toolkit/utils");
+    import_utils16 = require("@web-ts-toolkit/utils");
     init_query();
     init_manager();
     init_authorization_snapshot();
     init_field_catalog();
     init_virtual_descriptor();
+    init_populate_target_configuration();
     elementType = (type) => type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster;
     join = (prefix, path) => prefix ? `${prefix}.${path}` : path;
     within = (path, parent) => path === parent || path.startsWith(`${parent}.`);
@@ -2429,14 +2463,14 @@ var init_virtual_populate_dependencies = __esm({
 });
 
 // src/runtime.ts
-var import_mongoose4, import_mongoose_schema_jsonschema, import_utils16, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue2, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, AccessRuntime, defaultRuntime;
+var import_mongoose4, import_mongoose_schema_jsonschema, import_utils17, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue2, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, AccessRuntime, defaultRuntime;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     import_mongoose4 = __toESM(require("mongoose"));
     init_public_admission();
     init_hydration();
     import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-    import_utils16 = require("@web-ts-toolkit/utils");
+    import_utils17 = require("@web-ts-toolkit/utils");
     init_helpers();
     init_registry();
     init_logger_default();
@@ -2465,44 +2499,44 @@ var init_runtime = __esm({
       listHardLimit: DEFAULT_LIST_HARD_LIMIT
     };
     normalizeBasePath = (name, value) => {
-      if ((0, import_utils16.isNil)(value)) {
+      if ((0, import_utils17.isNil)(value)) {
         return `/${pluralize(name)}`;
       }
-      return (0, import_utils16.isString)(value) ? (0, import_utils16.addLeadingSlash)(value) : "";
+      return (0, import_utils17.isString)(value) ? (0, import_utils17.addLeadingSlash)(value) : "";
     };
     hasModelPermission = (value, modelPermissionPrefix) => {
       if (!modelPermissionPrefix) {
         return true;
       }
-      if ((0, import_utils16.isString)(value)) {
+      if ((0, import_utils17.isString)(value)) {
         return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
       }
-      if ((0, import_utils16.isArray)(value)) {
+      if ((0, import_utils17.isArray)(value)) {
         return value.some((item) => {
-          if ((0, import_utils16.isString)(item) || (0, import_utils16.isArray)(item)) {
+          if ((0, import_utils17.isString)(item) || (0, import_utils17.isArray)(item)) {
             return hasModelPermission(item, modelPermissionPrefix);
           }
           return true;
         });
       }
-      return (0, import_utils16.isFunction)(value);
+      return (0, import_utils17.isFunction)(value);
     };
     classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       const schemaKeys = Object.keys(permissionSchema);
       const globalPermissionKeys = {};
       const modelPermissionKeys = {};
-      (0, import_utils16.forEach)(schemaKeys, (schemaKey) => {
+      (0, import_utils17.forEach)(schemaKeys, (schemaKey) => {
         const schemaRule = permissionSchema[schemaKey];
-        const ruleEntries = (0, import_utils16.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+        const ruleEntries = (0, import_utils17.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
         for (let x = 0; x < ruleEntries.length; x++) {
           const [accessKey, value] = ruleEntries[x];
-          if (!(0, import_utils16.isArray)(globalPermissionKeys[accessKey])) {
+          if (!(0, import_utils17.isArray)(globalPermissionKeys[accessKey])) {
             globalPermissionKeys[accessKey] = [];
           }
-          if (!(0, import_utils16.isArray)(modelPermissionKeys[accessKey])) {
+          if (!(0, import_utils17.isArray)(modelPermissionKeys[accessKey])) {
             modelPermissionKeys[accessKey] = [];
           }
-          if ((0, import_utils16.isBoolean)(value)) {
+          if ((0, import_utils17.isBoolean)(value)) {
             globalPermissionKeys[accessKey].push(schemaKey);
             continue;
           }
@@ -2534,13 +2568,13 @@ var init_runtime = __esm({
     VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
     VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
     VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-    isVirtualContainerValue2 = (value) => (0, import_utils16.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue2 = (value) => (0, import_utils17.isPlainObject)(value) && "sub" in value;
     virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
       try {
-        if ((0, import_utils16.get)((0, import_utils16.set)({}, virtualPath, true), permissionField) !== void 0) return true;
-        if ((0, import_utils16.get)((0, import_utils16.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+        if ((0, import_utils17.get)((0, import_utils17.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+        if ((0, import_utils17.get)((0, import_utils17.set)({}, permissionField, true), virtualPath) !== void 0) return true;
       } catch {
         return false;
       }
@@ -2601,12 +2635,12 @@ var init_runtime = __esm({
     };
     validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
       if (dependsOn === void 0) return [];
-      if (!(0, import_utils16.isArray)(dependsOn)) {
+      if (!(0, import_utils17.isArray)(dependsOn)) {
         throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
       }
       const list = dependsOn;
       for (const dep of list) {
-        if (!(0, import_utils16.isString)(dep) || dep.length === 0) {
+        if (!(0, import_utils17.isString)(dep) || dep.length === 0) {
           throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
         }
         if (dep.includes(".")) {
@@ -2628,12 +2662,12 @@ var init_runtime = __esm({
       return list;
     };
     validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
-      if ((0, import_utils16.isFunction)(value)) return;
-      if (!(0, import_utils16.isPlainObject)(value)) {
+      if ((0, import_utils17.isFunction)(value)) return;
+      if (!(0, import_utils17.isPlainObject)(value)) {
         throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
       }
       const record3 = value;
-      if (!(0, import_utils16.isFunction)(record3.get)) {
+      if (!(0, import_utils17.isFunction)(record3.get)) {
         throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
       }
       validateVirtualDependsOn(record3.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
@@ -2675,7 +2709,7 @@ var init_runtime = __esm({
               `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
             );
           }
-          if (!(0, import_utils16.isPlainObject)(record4.sub)) {
+          if (!(0, import_utils17.isPlainObject)(record4.sub)) {
             throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
           }
           continue;
@@ -2685,8 +2719,8 @@ var init_runtime = __esm({
             `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
           );
         }
-        if ((0, import_utils16.isFunction)(raw)) continue;
-        if (!(0, import_utils16.isPlainObject)(raw)) {
+        if ((0, import_utils17.isFunction)(raw)) continue;
+        if (!(0, import_utils17.isPlainObject)(raw)) {
           throw new Error(
             `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
           );
@@ -2740,7 +2774,7 @@ var init_runtime = __esm({
     };
     validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
       if (virtuals === void 0 || virtuals === null) return;
-      if (!(0, import_utils16.isPlainObject)(virtuals)) {
+      if (!(0, import_utils17.isPlainObject)(virtuals)) {
         throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
       }
       const rootSchema = model?.schema ?? null;
@@ -2792,8 +2826,8 @@ var init_runtime = __esm({
           {
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
-            requireRegisteredPopulateModels: true,
-            requireReadOperationAccessForPopulateDependencies: true,
+            requireOperationAccessForPopulateQueries: true,
+            requireOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2848,7 +2882,7 @@ var init_runtime = __esm({
       }
       registerOpenApiRoute(route) {
         this.openApiRegistry.register(
-          this.openApiPathPrefix ? { ...route, path: (0, import_utils16.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+          this.openApiPathPrefix ? { ...route, path: (0, import_utils17.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
         );
       }
       /**
@@ -2859,7 +2893,7 @@ var init_runtime = __esm({
        */
       withOpenApiPathPrefix(prefix, build) {
         const previous = this.openApiPathPrefix;
-        this.openApiPathPrefix = (0, import_utils16.normalizeUrlPath)(`${previous}/${prefix}`);
+        this.openApiPathPrefix = (0, import_utils17.normalizeUrlPath)(`${previous}/${prefix}`);
         try {
           return build();
         } finally {
@@ -2967,13 +3001,15 @@ var init_runtime = __esm({
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
         const next = { ...options };
-        if ("requireReadOperationAccessForPopulateDependencies" in next)
-          next.requireReadOperationAccessForPopulateDependencies = next.requireReadOperationAccessForPopulateDependencies !== false;
+        if ("requireOperationAccessForPopulateQueries" in next)
+          next.requireOperationAccessForPopulateQueries = next.requireOperationAccessForPopulateQueries !== false;
+        if ("requireOperationAccessForPopulateDependencies" in next)
+          next.requireOperationAccessForPopulateDependencies = next.requireOperationAccessForPopulateDependencies !== false;
         this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
-        if (key === "requireReadOperationAccessForPopulateDependencies") {
-          this.globalOptions.set("requireReadOperationAccessForPopulateDependencies", value !== false);
+        if (key === "requireOperationAccessForPopulateQueries" || key === "requireOperationAccessForPopulateDependencies") {
+          this.globalOptions.set(key, value !== false);
           return;
         }
         this.globalOptions.set(key, value);
@@ -3002,7 +3038,7 @@ var init_runtime = __esm({
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils16.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils17.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
         this.defaultModelOptions.set(key, value);
@@ -3031,7 +3067,7 @@ var init_runtime = __esm({
         }).onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             modelName,
-            (0, import_utils16.isString)(newval) || (0, import_utils16.isNil)(newval) ? newval : void 0
+            (0, import_utils17.isString)(newval) || (0, import_utils17.isNil)(newval) ? newval : void 0
           );
         }).build();
         this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -3075,7 +3111,7 @@ var init_runtime = __esm({
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils16.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils17.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
         const manager = this.modelOptions[modelName];
@@ -3096,15 +3132,15 @@ var init_runtime = __esm({
               const segments = nestedPath.split(".");
               let cursor = cloned;
               for (let i = 0; i < segments.length - 1; i++) {
-                if (!(0, import_utils16.isPlainObject)(cursor)) break;
+                if (!(0, import_utils17.isPlainObject)(cursor)) break;
                 cursor = cursor[segments[i]];
               }
-              if ((0, import_utils16.isPlainObject)(cursor)) {
+              if ((0, import_utils17.isPlainObject)(cursor)) {
                 delete cursor[segments[segments.length - 1]];
               }
               proposedVirtuals = cloned;
             } else {
-              (0, import_utils16.set)(cloned, nestedPath, value);
+              (0, import_utils17.set)(cloned, nestedPath, value);
               proposedVirtuals = cloned;
             }
           }
@@ -3205,7 +3241,7 @@ var init_runtime = __esm({
         manager.onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             dataName,
-            (0, import_utils16.isString)(newval) || (0, import_utils16.isNil)(newval) ? newval : void 0
+            (0, import_utils17.isString)(newval) || (0, import_utils17.isNil)(newval) ? newval : void 0
           );
         }).build();
         return manager;
@@ -3265,20 +3301,20 @@ var init_runtime = __esm({
         const schema = model.schema;
         this.modelRefs[modelName] = buildRefs(schema.tree);
         this.modelSubs[modelName] = buildSubPaths(schema.tree);
-        this.modelAtts[modelName] = (0, import_utils16.keys)(schema.obj);
+        this.modelAtts[modelName] = (0, import_utils17.keys)(schema.obj);
       }
       getModelRef(modelName, refPath) {
         this.ensureModelMeta(modelName);
-        const value = (0, import_utils16.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-        return (0, import_utils16.isString)(value) ? value : null;
+        const value = (0, import_utils17.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+        return (0, import_utils17.isString)(value) ? value : null;
       }
       getModelSub(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils16.get)(this.modelSubs, modelName, []);
+        return (0, import_utils17.get)(this.modelSubs, modelName, []);
       }
       getModelAtt(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils16.get)(this.modelAtts, modelName, []);
+        return (0, import_utils17.get)(this.modelAtts, modelName, []);
       }
     };
     defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -3454,10 +3490,10 @@ var init_options = __esm({
 });
 
 // src/permission.ts
-var import_utils17, Permission, permission_default;
+var import_utils18, Permission, permission_default;
 var init_permission = __esm({
   "src/permission.ts"() {
-    import_utils17 = require("@web-ts-toolkit/utils");
+    import_utils18 = require("@web-ts-toolkit/utils");
     Permission = class {
       constructor(permissions) {
         this.permissions = { ...permissions };
@@ -3473,7 +3509,7 @@ var init_permission = __esm({
         return [permissionOrPermissions].concat(permissions);
       }
       hasKey(permission) {
-        return (0, import_utils17.hasOwn)(this.permissions, permission);
+        return (0, import_utils18.hasOwn)(this.permissions, permission);
       }
       has(permission) {
         return this.permissions[permission] === true;
@@ -3507,6 +3543,47 @@ function serviceAuthorizationInput(policy, targets) {
   }
   return { rows: policy.rows, outputFields: policy.outputFields, related };
 }
+function hasStableConfigurationCopies(value) {
+  if (value === null || typeof value !== "object") return true;
+  if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return false;
+  return Object.values(value).every(hasStableConfigurationCopies);
+}
+function captureAuthorizationAccess(value) {
+  const input = authorizationRecord(value, "access");
+  const access = {};
+  for (const key of ["operation", "rowAccess", "virtualAccess", "outputAccess", "docPermissionsAccess"]) {
+    if (key === "rowAccess" && input[key] === void 0) continue;
+    if (typeof input[key] !== "string") authorizationError(`invalid access.${key}`);
+    access[key] = input[key];
+  }
+  return Object.freeze(access);
+}
+function captureAuthorizationCatalog(value) {
+  const input = authorizationRecord(value, "catalog");
+  const catalog = {};
+  for (const key of [
+    "paths",
+    "persistedPaths",
+    "arrayPaths",
+    "schemaVirtualPaths",
+    "metadataPaths",
+    "dynamicPaths",
+    "containerPaths",
+    "virtualPaths",
+    "virtualScopePaths",
+    "opaquePaths",
+    "referencePaths",
+    "protectedPaths"
+  ]) {
+    const paths = input[key];
+    if (key !== "paths" && paths === void 0) continue;
+    if (!Array.isArray(paths) || Array.from(paths).some((path) => typeof path !== "string")) {
+      authorizationError(`invalid catalog.${key}`);
+    }
+    catalog[key] = paths;
+  }
+  return Object.freeze(catalog);
+}
 function assertAuthorizationPath(path) {
   if (typeof path !== "string" || !isSafeOutputPath(path)) {
     authorizationError(`invalid response path: ${String(path)}`);
@@ -3591,7 +3668,6 @@ function normalizePolicy(value, applicability, configuration, targets) {
       const matches = targets.filter((target2) => target2.path === path);
       if (matches.length !== 1) authorizationError(`unused or ambiguous related path: ${path}`);
       const target = matches[0];
-      if (target.kind === "passthrough") authorizationError(`related policy requires a registered target: ${path}`);
       const child = authorizationRecord(entry, `related.${path}`);
       assertAuthorizationKeys(
         child,
@@ -3637,6 +3713,9 @@ function resolveServiceAuthorization(input) {
   const raw = copyAuthorizationValue(input.authorization);
   const configuration = copyAuthorizationValue(input.configuration, true);
   const targets = copyAuthorizationValue(input.relatedTargets ?? [], true);
+  const access = copyAuthorizationValue(input.access);
+  const outputAccess = captureAuthorizationAccess(access);
+  const catalog = captureAuthorizationCatalog(configuration.catalog);
   const policy = copyAuthorizationValue(normalizePolicy(raw, input.applicability ?? "service", configuration, targets));
   const scopePath = Array.from(scope(input.binding));
   for (const part of scopePath) {
@@ -3649,17 +3728,21 @@ function resolveServiceAuthorization(input) {
       authorizationError("derived call request/runtime mismatch");
     }
   }
-  const permissions = Object.fromEntries(
-    input.requestPermissions.keys.map((key) => [key, input.requestPermissions.has(key)])
+  const permissions = new permission_default(
+    Object.fromEntries(input.requestPermissions.keys.map((key) => [key, input.requestPermissions.has(key) === true]))
   );
+  for (const value of Object.values(permissions)) if (value && typeof value === "object") Object.freeze(value);
+  Object.freeze(permissions);
   const call = Object.freeze(/* @__PURE__ */ Object.create(null));
   calls.set(call, {
     binding: Object.freeze({ ...input.binding, scopePath: Object.freeze(scopePath) }),
-    access: copyAuthorizationValue(input.access),
+    access,
     configuration,
     policy,
     relatedTargets: targets,
-    permissions: Object.freeze(permissions),
+    // normalizeFields constructs only mode strings and validated string paths.
+    output: Object.freeze({ access: outputAccess, catalog, outputFields: policy.outputFields }),
+    permissions,
     provenance: input.parent ? callRecord(input.parent).provenance : call
   });
   return call;
@@ -3677,12 +3760,75 @@ function readServiceAuthorization(call, binding) {
     true
   );
 }
+function readServiceAuthorizationAccess(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return callRecord(call).output.access;
+}
+function readServiceAuthorizationHydration(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return copyAuthorizationValue({ hydration: callRecord(call).configuration.hydration }, true);
+}
+function outputMetadata(configuration) {
+  return {
+    documentPermissionField: configuration.documentPermissionField,
+    exposedDocPermissionKeys: configuration.exposedDocPermissionKeys,
+    stripPermissionsField: configuration.stripPermissionsField,
+    disableFieldPermissions: configuration.disableFieldPermissions
+  };
+}
+function readServiceOutputMetadata(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return copyAuthorizationValue(outputMetadata(callRecord(call).configuration), true);
+}
+function readServiceDocumentPermissions(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  return Object.freeze({
+    catalog: record3.output.catalog,
+    ...copyAuthorizationValue({ docPermissions: record3.configuration.docPermissions }, true)
+  });
+}
+function readServiceFinalizerConfiguration(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  return Object.freeze({
+    catalog: record3.output.catalog,
+    ...copyAuthorizationValue(
+      {
+        ...outputMetadata(record3.configuration),
+        virtuals: record3.configuration.virtuals,
+        docPermissions: record3.configuration.docPermissions
+      },
+      true
+    )
+  });
+}
+function readServiceOutputPolicy(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return callRecord(call).output;
+}
+function readServiceOutputFieldAuthorization(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  const reusable = record3.reusableFieldConfiguration ??= hasStableConfigurationCopies(record3.configuration.permissionSchema) && // Coercion methods can observe an object's identity even without native
+  // leaves. Keep those receivers local to the original resolution boundary.
+  (record3.configuration.modelPermissionPrefix === null || typeof record3.configuration.modelPermissionPrefix !== "object");
+  return Object.freeze({
+    access: record3.output.access,
+    outputFields: record3.output.outputFields,
+    reusable,
+    ...copyAuthorizationValue(
+      {
+        permissionSchema: record3.configuration.permissionSchema,
+        modelPermissionPrefix: record3.configuration.modelPermissionPrefix
+      },
+      true
+    )
+  });
+}
 function getAuthorizationPermissions(call, binding) {
   assertAuthorizationBinding(call, binding);
-  const permission = new permission_default({ ...callRecord(call).permissions });
-  for (const value of Object.values(permission)) if (value && typeof value === "object") Object.freeze(value);
-  Object.freeze(permission);
-  return permission;
+  return callRecord(call).permissions;
 }
 function getAuthorizationProvenance(call) {
   return callRecord(call).provenance;
@@ -3721,7 +3867,7 @@ function normalizeOutputAuthorizationOptions(input, options, purpose) {
     const stage = stageRecord(documentRecord(handle).stage);
     const binding = Object.freeze({ ...input.binding, scopePath: stage.binding.scopePath });
     assertAuthorizationBinding(stage.call, binding);
-    const access = readServiceAuthorization(stage.call, binding).access;
+    const access = readServiceAuthorizationAccess(stage.call, binding);
     if (input.access.outputAccess !== access.outputAccess) authorizationError("document access mismatch");
     return Object.freeze({ kind: "document", documentAuthorization: handle, binding });
   }
@@ -3799,7 +3945,16 @@ function readDocumentAuthorization(handle, binding) {
     authorization: stage.call,
     stage: record3.stage,
     grants: copyAuthorizationValue(record3.grants),
-    ...readServiceAuthorization(stage.call, binding).access
+    ...readServiceAuthorizationAccess(stage.call, binding)
+  });
+}
+function readDocumentAuthorizationAccess(handle, binding) {
+  const record3 = documentRecord(handle);
+  const stage = stageRecord(record3.stage);
+  return Object.freeze({
+    authorization: stage.call,
+    stage: record3.stage,
+    ...readServiceAuthorizationAccess(stage.call, binding)
   });
 }
 function memoizeDocumentFieldDecision(handle, binding, field, evaluate) {
@@ -3807,15 +3962,23 @@ function memoizeDocumentFieldDecision(handle, binding, field, evaluate) {
   const stage = stageRecord(record3.stage);
   assertAuthorizationBinding(stage.call, binding);
   let decision = record3.decisions.get(field);
-  if (!decision) {
+  if (decision) {
+    return decision.then((result2) => {
+      stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
+      return result2;
+    });
+  } else {
     decision = Promise.resolve().then(async () => {
       stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
       const result2 = await evaluate.call(
         stage.binding.request,
         getAuthorizationPermissions(stage.call, binding),
         copyAuthorizationValue(record3.grants)
       );
       stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
       if (typeof result2 !== "boolean") authorizationError("field decision must be boolean");
       return result2;
     });
@@ -3832,7 +3995,7 @@ function assertDocumentAuthorization(handle, use) {
   const record3 = documentRecord(handle);
   const stage = stageRecord(record3.stage);
   assertAuthorizationBinding(stage.call, use.binding);
-  if (use.authorization !== void 0 && stage.call !== use.authorization || use.stage !== void 0 && record3.stage !== use.stage || readServiceAuthorization(stage.call, use.binding).access.outputAccess !== use.outputAccess) {
+  if (use.authorization !== void 0 && stage.call !== use.authorization || use.stage !== void 0 && record3.stage !== use.stage || readServiceAuthorizationAccess(stage.call, use.binding).outputAccess !== use.outputAccess) {
     authorizationError("document call/access/stage mismatch");
   }
   const association = outputs.get(use.output);
@@ -3887,7 +4050,7 @@ function transferDocumentAuthorizationGraph(source, copy, copyOrigins) {
         {
           binding: stage.binding,
           output: original,
-          outputAccess: readServiceAuthorization(stage.call, stage.binding).access.outputAccess,
+          outputAccess: readServiceAuthorizationAccess(stage.call, stage.binding).outputAccess,
           authorization: stage.call,
           stage: documentRecord(association.handle).stage
         },
@@ -3960,7 +4123,7 @@ function attachIncludeOutput(doc, path, value) {
   const state = stateFor(doc);
   if (!state) throw new Error("Include attachment requires a prepared output row");
   state.attachments.push({ path, value });
-  (0, import_utils18.set)(doc, path, deepIsolateValue(value));
+  (0, import_utils19.set)(doc, path, deepIsolateValue(value));
 }
 function getIncludeSource(doc) {
   return stateFor(doc)?.source ?? doc;
@@ -3975,14 +4138,14 @@ function restoreIncludeOutput(doc, output) {
   for (const { path, value } of attachments) {
     const copy = deepIsolateValue(value);
     if (copy !== null && typeof copy === "object") origins.set(copy, value);
-    (0, import_utils18.set)(output, path, copy);
+    (0, import_utils19.set)(output, path, copy);
   }
   return origins;
 }
-var import_utils18, outputs2, stateFor;
+var import_utils19, outputs2, stateFor;
 var init_include_output = __esm({
   "src/output/include-output.ts"() {
-    import_utils18 = require("@web-ts-toolkit/utils");
+    import_utils19 = require("@web-ts-toolkit/utils");
     init_document_authorization();
     init_document();
     outputs2 = /* @__PURE__ */ new WeakMap();
@@ -4052,12 +4215,20 @@ function classifyRequestFieldRule(rule, permissions, modelPermissionPrefix = "")
   );
   return (typeof rule === "string" ? possible.stringHandler(rule) : possible.arrayHandler(rule)) ? "deferred" : "denied";
 }
+function prepareRequestFieldRule(rule, permissions, modelPermissionPrefix = "") {
+  const state = classifyRequestFieldRule(rule, permissions, modelPermissionPrefix);
+  const invariant = state === "denied" && modelPermissionPrefix ? classifyRequestFieldRule(rule, permissions) : state;
+  return Object.freeze({ state, decision: invariant === "deferred" ? void 0 : invariant === "granted" });
+}
+function combineFieldAuthorizationStates(states2) {
+  return states2.includes("denied") ? "denied" : states2.includes("deferred") ? "deferred" : "granted";
+}
 function classifyEffectiveFieldAuthorization(args) {
   if (hasExplicitFieldGrant(args.outputFields, args.path)) return "granted";
   const states2 = args.rules.map(
     (rule) => classifyRequestFieldRule(rule, args.globalPermissions, args.modelPermissionPrefix)
   );
-  return states2.includes("denied") ? "denied" : states2.includes("deferred") ? "deferred" : "granted";
+  return combineFieldAuthorizationStates(states2);
 }
 async function evaluateScopedAccessRule(args) {
   const { req, rule, globalPermissions, docPermissions, modelPermissionPrefix } = args;
@@ -4324,10 +4495,10 @@ function planVirtualProjection(args) {
     relatedPlans
   };
 }
-var import_utils20, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
+var import_utils21, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
 var init_virtual_projection = __esm({
   "src/acl/virtual-projection.ts"() {
-    import_utils20 = require("@web-ts-toolkit/utils");
+    import_utils21 = require("@web-ts-toolkit/utils");
     init_query();
     init_field_authorization();
     init_output_projection();
@@ -4335,20 +4506,20 @@ var init_virtual_projection = __esm({
     init_virtual_populate_dependencies();
     init_virtual_descriptor();
     getScopedPermissionSchema = (root, scopePath) => {
-      if (!root || !(0, import_utils20.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils21.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
-      const scoped = (0, import_utils20.get)(root, scopePath.join("."));
-      return (0, import_utils20.isPlainObject)(scoped) ? scoped : null;
+      const scoped = (0, import_utils21.get)(root, scopePath.join("."));
+      return (0, import_utils21.isPlainObject)(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
       if (!raw) return [];
-      if ((0, import_utils20.isArray)(raw)) return [...raw];
-      if ((0, import_utils20.isPlainObject)(raw)) {
+      if ((0, import_utils21.isArray)(raw)) return [...raw];
+      if ((0, import_utils21.isPlainObject)(raw)) {
         const record3 = raw;
         const exact = record3[access];
-        if ((0, import_utils20.isArray)(exact)) return [...exact];
+        if ((0, import_utils21.isArray)(exact)) return [...exact];
         const def = record3.default;
-        if ((0, import_utils20.isArray)(def)) return [...def];
+        if ((0, import_utils21.isArray)(def)) return [...def];
         return [];
       }
       return [];
@@ -4613,8 +4784,8 @@ var init_output_projection = __esm({
 
 // src/acl/model-output-planning.ts
 function getCapturedAuthorizationOption(configuration, key) {
-  const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils21.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
-  return resolveNestedOption((path, fallback) => (0, import_utils21.get)(configuration, path, fallback), key, defaultValue);
+  const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils22.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
+  return resolveNestedOption((path, fallback) => (0, import_utils22.get)(configuration, path, fallback), key, defaultValue);
 }
 function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName), globalOptions = runtime.getGlobalOptions()) {
   const model = runtime.getModelInstance(modelName);
@@ -4629,9 +4800,9 @@ function captureModelAuthorizationConfiguration(runtime, modelName, options = ru
         options,
         globalOptions
       ),
-      requireReadOperationAccessForPopulateDependencies: globalOptions.requireReadOperationAccessForPopulateDependencies !== false,
-      requireRegisteredPopulateModels: globalOptions.requireRegisteredPopulateModels,
-      permissionSchema: options.permissionSchema,
+      requireOperationAccessForPopulateDependencies: globalOptions.requireOperationAccessForPopulateDependencies !== false,
+      requireOperationAccessForPopulateQueries: globalOptions.requireOperationAccessForPopulateQueries !== false,
+      permissionSchema: options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
       modelPermissionPrefix: options.modelPermissionPrefix,
@@ -4677,10 +4848,10 @@ function planModelOutputForHelper(args) {
     requestedSelect: args.select
   });
 }
-var import_utils21;
+var import_utils22;
 var init_model_output_planning = __esm({
   "src/acl/model-output-planning.ts"() {
-    import_utils21 = require("@web-ts-toolkit/utils");
+    import_utils22 = require("@web-ts-toolkit/utils");
     init_manager();
     init_field_catalog();
     init_authorization_snapshot();
@@ -4692,10 +4863,10 @@ var init_model_output_planning = __esm({
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils22.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils23.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils23.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils23.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4712,11 +4883,11 @@ function optimizeAndFilter(clausesInput) {
   const dedupeKey = (value) => {
     if (value instanceof RegExp) return `regexp:${JSON.stringify([value.source, value.flags])}`;
     if (value instanceof Date) return `date:${value.getTime()}`;
-    if ((0, import_utils22.isArray)(value)) {
+    if ((0, import_utils23.isArray)(value)) {
       const entries = Array.from(value, dedupeKey);
       return entries.every((entry) => entry !== void 0) ? `array:${JSON.stringify(entries)}` : void 0;
     }
-    if ((0, import_utils22.isPlainObject)(value)) {
+    if ((0, import_utils23.isPlainObject)(value)) {
       const entries = Object.keys(value).sort().map((key) => [key, dedupeKey(value[key])]);
       return entries.every(([, entry]) => entry !== void 0) ? `object:${JSON.stringify(entries)}` : void 0;
     }
@@ -4746,7 +4917,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if ((0, import_utils22.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
+      if ((0, import_utils23.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -4757,24 +4928,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils22.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils23.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils22.isPlainObject)(filter2) || (0, import_utils22.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils23.isPlainObject)(filter2) || (0, import_utils23.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils22.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils23.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils22.isString)(idField)) {
+  if ((0, import_utils23.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -4798,7 +4969,7 @@ async function resolveAccessFilterParts({
   }
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
   const baseFilterFn = rows2.mode === "request" ? getOption(`baseFilter.${access}`, null) : null;
-  if (nextFilter !== false && (0, import_utils22.isFunction)(overrideFilterFn)) {
+  if (nextFilter !== false && (0, import_utils23.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   if (nextFilter === false) return { transformed: false, scope: {}, filter: false };
@@ -4806,7 +4977,7 @@ async function resolveAccessFilterParts({
     const scope2 = rows2.mode === "scope" ? rows2.filter : {};
     return { transformed: nextFilter ?? {}, scope: scope2, filter: intersectFilters(nextFilter, scope2) };
   }
-  if (!(0, import_utils22.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
+  if (!(0, import_utils23.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
   const cached = cache.get(cacheKey);
   const reusable = cached?.resolver === baseFilterFn;
   const baseFilter = normalizeFilter(
@@ -4841,34 +5012,34 @@ async function setRequestPermissions(req) {
   if (owner === activeRuntime) return;
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  const permissions = (0, import_utils22.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
-  if ((0, import_utils22.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils22.isArray)(permissions)) req[requestPermissionField] = (0, import_utils22.arrayToRecord)(permissions);
-  else if ((0, import_utils22.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  const permissions = (0, import_utils23.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
+  if ((0, import_utils23.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils23.isArray)(permissions)) req[requestPermissionField] = (0, import_utils23.arrayToRecord)(permissions);
+  else if ((0, import_utils23.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
   else req[requestPermissionField] = {};
   owners.set(requestPermissionField, activeRuntime);
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils22.isBoolean)(routeGuard)) {
+  if ((0, import_utils23.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils22.isString)(routeGuard)) {
+  if ((0, import_utils23.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils22.isArray)(routeGuard)) {
+  if ((0, import_utils23.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils22.isFunction)(routeGuard)) {
+  if ((0, import_utils23.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils22.castArray)(hook);
+  const hooks = (0, import_utils23.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils22.isFunction)(hooks[x])) {
+    if ((0, import_utils23.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -4888,22 +5059,22 @@ async function collectSchemaFields({
   for (let x = 0; x < keys2.length; x++) {
     const key = keys2[x];
     const value = extractScopedOutputRule(permissionSchema, key, access);
-    if ((0, import_utils22.isBoolean)(value)) {
+    if ((0, import_utils23.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils22.isString)(value)) {
+    } else if ((0, import_utils23.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils22.isArray)(value)) {
+    } else if ((0, import_utils23.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils22.isFunction)(value)) {
+    } else if ((0, import_utils23.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
   return fields;
 }
-var import_utils22, import_node_util4, permissionFieldOwners;
+var import_utils23, import_node_util4, permissionFieldOwners;
 var init_core_shared = __esm({
   "src/core-shared.ts"() {
-    import_utils22 = require("@web-ts-toolkit/utils");
+    import_utils23 = require("@web-ts-toolkit/utils");
     import_node_util4 = require("util");
     init_helpers();
     init_options();
@@ -5272,8 +5443,8 @@ function equivalentVirtualPopulatePredicate(left, right) {
   }
   if (Array.isArray(left) || Array.isArray(right))
     return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((entry, index) => equivalentVirtualPopulatePredicate(entry, right[index]));
-  if ((0, import_utils26.isPlainObject)(left) || (0, import_utils26.isPlainObject)(right)) {
-    if (!(0, import_utils26.isPlainObject)(left) || !(0, import_utils26.isPlainObject)(right)) return false;
+  if ((0, import_utils27.isPlainObject)(left) || (0, import_utils27.isPlainObject)(right)) {
+    if (!(0, import_utils27.isPlainObject)(left) || !(0, import_utils27.isPlainObject)(right)) return false;
     const a = Object.keys(left), b = Object.keys(right);
     return a.length === b.length && a.every(
       (key, index) => key === b[index] && equivalentVirtualPopulatePredicate(
@@ -5344,7 +5515,6 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
         address,
         plan: currentPlan,
         refs: /* @__PURE__ */ new Map(),
-        referenceTargets: /* @__PURE__ */ new Map(),
         dependencies: /* @__PURE__ */ new Map()
       };
       row.occurrences.set(addressKey(address), occurrence);
@@ -5352,7 +5522,6 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
           if (!occurrence.refs.has(dependency.path))
             occurrence.refs.set(dependency.path, originalRef(value, dependency.path));
-          occurrence.referenceTargets.set(dependency.path, dependency.target);
           const request = {
             binding: dependency.target,
             target: dependency.target,
@@ -5450,7 +5619,7 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          if (target.configuration.requireReadOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+          if (target.configuration.requireOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
             return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
@@ -5536,12 +5705,6 @@ function readVirtualPopulateOriginalReference(row, address, path) {
 function hasVirtualPopulatePublicReference(row, address, path) {
   return !!rows.get(row)?.publicRequests.some((request) => addressKey(request.address) === addressKey([...address, path]));
 }
-function isVirtualPopulateReferenceVisible(row, address, path) {
-  const record3 = rows.get(row);
-  const occurrence = record3?.occurrences.get(addressKey(address));
-  const target = occurrence?.refs.get(path)?.present ? occurrence.referenceTargets.get(path) : void 0;
-  return record3 && target ? targetReadAllowed(record3.batch, target) : Promise.resolve(true);
-}
 function readVirtualPopulateInputs(row, address, virtualName) {
   const record3 = rows.get(row);
   if (!record3?.batch.completed) return { available: false };
@@ -5665,12 +5828,12 @@ async function loadVirtualPopulateOutputRows(owner, inputs, plan, publicPopulate
   }
   return output;
 }
-var import_mongoose7, import_node_util5, import_utils26, batches, rows, outputRows, fetchedPublicIdentities, publicViewIdentities, familyRawFetches, addressKey, storage, originalRef, copyOriginalValue, readPolicy, compatible, idKey, logUnavailable;
+var import_mongoose7, import_node_util5, import_utils27, batches, rows, outputRows, fetchedPublicIdentities, publicViewIdentities, familyRawFetches, addressKey, storage, originalRef, copyOriginalValue, readPolicy, compatible, idKey, logUnavailable;
 var init_virtual_populate_execution = __esm({
   "src/acl/virtual-populate-execution.ts"() {
     import_mongoose7 = require("mongoose");
     import_node_util5 = require("util");
-    import_utils26 = require("@web-ts-toolkit/utils");
+    import_utils27 = require("@web-ts-toolkit/utils");
     init_cache();
     init_core_shared();
     init_document();
@@ -5687,7 +5850,7 @@ var init_virtual_populate_execution = __esm({
     publicViewIdentities = /* @__PURE__ */ new WeakMap();
     familyRawFetches = /* @__PURE__ */ new WeakMap();
     addressKey = (address) => JSON.stringify(address);
-    storage = (value) => value instanceof import_mongoose7.Document ? value._doc : (0, import_utils26.isPlainObject)(value) ? value : void 0;
+    storage = (value) => value instanceof import_mongoose7.Document ? value._doc : (0, import_utils27.isPlainObject)(value) ? value : void 0;
     originalRef = (source, key) => {
       const record3 = storage(source);
       return {
@@ -5700,7 +5863,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireReadOperationAccessForPopulateDependencies === b.binding.configuration.requireReadOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireOperationAccessForPopulateDependencies === b.binding.configuration.requireOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -5714,20 +5877,115 @@ var init_virtual_populate_execution = __esm({
 });
 
 // src/acl/output-field-filter.ts
+function callFieldPolicy(authorization, binding) {
+  assertAuthorizationBinding(authorization, binding);
+  let policy = fieldPolicies.get(authorization);
+  if (!policy) {
+    const view = readServiceOutputFieldAuthorization(authorization, binding);
+    policy = {
+      schema: view.permissionSchema,
+      requestPaths: view.permissionSchema == null || (0, import_utils28.isPlainObject)(view.permissionSchema) && Object.isFrozen(view.permissionSchema) ? Object.freeze(Object.keys(view.permissionSchema ?? {})) : void 0,
+      prefix: view.modelPermissionPrefix ?? "",
+      outputFields: view.outputFields,
+      accesses: /* @__PURE__ */ new Map()
+    };
+    if (view.reusable) fieldPolicies.set(authorization, policy);
+  }
+  return policy;
+}
+function requestRuleClassification(entry, authorization, permissions, prefix) {
+  if (typeof prefix !== "string") return void 0;
+  let classification = entry.classifications.get(authorization);
+  if (!classification) {
+    classification = prepareRequestFieldRule(entry.rule, permissions, prefix);
+    entry.classifications.set(authorization, classification);
+  }
+  return classification;
+}
+function invariantRuleLookup(schema, path) {
+  if (schema == null) return true;
+  if (!(0, import_utils28.isPlainObject)(schema) || !Object.isFrozen(schema)) return false;
+  const exact = Object.getOwnPropertyDescriptor(schema, path);
+  if (exact) {
+    const raw2 = exact.value;
+    return !raw2 || typeof raw2 !== "object" || Array.isArray(raw2) || (0, import_utils28.isPlainObject)(raw2) && Object.isFrozen(raw2);
+  }
+  const [head, ...rest] = path.split(".");
+  const raw = Object.getOwnPropertyDescriptor(schema, head)?.value;
+  if (raw == null) return true;
+  if (!(0, import_utils28.isPlainObject)(raw) || !Object.isFrozen(raw)) return false;
+  const sub = Object.getOwnPropertyDescriptor(raw, "sub");
+  return !rest.length || !sub || invariantRuleLookup(sub.value, rest.join("."));
+}
+function prepareOutputPath(policy, authorization, binding, path, access) {
+  let cache = policy.accesses.get(access);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    policy.accesses.set(access, cache);
+  }
+  let prepared = cache.get(path);
+  if (!prepared) {
+    const invariant = invariantRuleLookup(policy.schema, path);
+    const permissions = getAuthorizationPermissions(authorization, binding);
+    const entries = extractOutputFieldRuleEntries(policy.schema, path, access).map((entry) => ({
+      ...entry,
+      classifications: /* @__PURE__ */ new WeakMap()
+    }));
+    const classifications = entries.map(
+      (entry) => requestRuleClassification(entry, authorization, permissions, policy.prefix)
+    );
+    const backendGrant = hasExplicitFieldGrant(policy.outputFields, path);
+    prepared = {
+      entries,
+      backendGrant,
+      state: backendGrant ? "granted" : classifications.every((value) => value !== void 0) ? combineFieldAuthorizationStates(classifications.map((value) => value.state)) : void 0
+    };
+    if (invariant) cache.set(path, prepared);
+  }
+  return prepared;
+}
+function assertOwningOutputDocuments(handle) {
+  const owner = owningDocuments.get(handle);
+  if (owner) {
+    readDocumentAuthorizationAccess(owner.handle, owner.binding);
+    assertOwningOutputDocuments(owner.handle);
+  }
+}
+function prepareOutputDocumentAuthorization(authorization, binding, configuration) {
+  const access = readServiceAuthorizationAccess(authorization, binding);
+  const key = `docPermissions.${access.docPermissionsAccess}`;
+  const docPermissions = configuration.docPermissions;
+  const invariant = /^[A-Za-z0-9_-]+$/.test(access.docPermissionsAccess) && (docPermissions == null || (0, import_utils28.isPlainObject)(docPermissions));
+  const option = invariant ? getCapturedAuthorizationOption(configuration, key) : void 0;
+  const hook = typeof option === "function" ? option : void 0;
+  const resolveHook = invariant ? () => hook : () => {
+    const slice = { catalog: configuration.catalog, ...copyAuthorizationValue({ docPermissions }, true) };
+    const option2 = getCapturedAuthorizationOption(slice, key);
+    return typeof option2 === "function" ? option2 : void 0;
+  };
+  return async (args) => {
+    if (args.authorization !== authorization) authorizationError("document resolver call mismatch");
+    assertAuthorizationBinding(authorization, args.binding);
+    return resolveOutputDocumentAuthorizationWithHook(args, access, resolveHook);
+  };
+}
 async function resolveOutputDocumentAuthorization(args) {
+  const configuration = readServiceDocumentPermissions(args.authorization, args.binding);
+  return prepareOutputDocumentAuthorization(args.authorization, args.binding, configuration)(args);
+}
+async function resolveOutputDocumentAuthorizationWithHook(args, access, resolveHook) {
   const { authorization, binding } = args;
-  const { configuration, access } = readServiceAuthorization(authorization, binding);
   const stage = args.stage ?? createDocumentAuthorizationStage(authorization, binding, args.snapshot);
   if (args.stage) assertDocumentAuthorizationStage(stage, authorization, binding, args.snapshot);
   const handle = await resolveDocumentAuthorization(stage, async function(doc, permissions) {
     if (args.owningDocument) return readDocumentAuthorization(args.owningDocument, args.owningBinding).grants;
     if (args.knownOutput) return {};
-    const hook = getCapturedAuthorizationOption(configuration, `docPermissions.${access.docPermissionsAccess}`);
-    if (typeof hook !== "function") return {};
+    const hook = resolveHook();
+    if (!hook) return {};
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
-      return (0, import_utils27.isPlainObject)(grants) ? grants : {};
+      return (0, import_utils28.isPlainObject)(grants) ? grants : {};
     } catch (error2) {
       warn("docPermissions hook failed; applying empty document permissions", {
         modelName: binding.modelName,
@@ -5744,6 +6002,7 @@ async function resolveOutputDocumentAuthorization(args) {
   return handle;
 }
 function evaluateRequestRule(handle, binding, entry, prefix, access) {
+  assertOwningOutputDocuments(handle);
   const owner = owningDocuments.get(handle);
   if (owner && !entry.path.startsWith(`${(binding.scopePath ?? []).join(".")}.`)) {
     return evaluateRequestRule(owner.handle, owner.binding, entry, prefix, access);
@@ -5752,65 +6011,78 @@ function evaluateRequestRule(handle, binding, entry, prefix, access) {
     handle,
     binding,
     `request:${access}:${entry.path}`,
-    function(permissions, grants) {
-      return evaluateScopedAccessRule({
-        req: this,
-        rule: entry.rule,
-        globalPermissions: permissions,
-        docPermissions: grants,
-        modelPermissionPrefix: prefix
-      });
+    async function(permissions, grants) {
+      const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+      const classification = requestRuleClassification(entry, authorization, permissions, prefix);
+      let allowed = classification?.decision;
+      if (allowed === void 0) {
+        allowed = await evaluateScopedAccessRule({
+          req: this,
+          rule: entry.rule,
+          globalPermissions: permissions,
+          docPermissions: grants,
+          modelPermissionPrefix: prefix
+        });
+      }
+      assertOwningOutputDocuments(handle);
+      return allowed;
     }
   );
 }
 function evaluateAuthorizedOutputField(handle, binding, field) {
-  const { authorization } = readDocumentAuthorization(handle, binding);
-  const { configuration, authorization: policy, access } = readServiceAuthorization(authorization, binding);
+  const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+  assertOwningOutputDocuments(handle);
   const path = [...binding.scopePath ?? [], field].join(".");
-  const entries = extractOutputFieldRuleEntries(
-    configuration.permissionSchema,
-    path,
-    access.outputAccess
-  );
-  return memoizeDocumentFieldDecision(handle, binding, `output:${path}`, function(permissions, grants) {
-    const args = {
+  const decision = memoizeDocumentFieldDecision(handle, binding, `output:${path}`, async function(permissions) {
+    const policy = callFieldPolicy(authorization, binding);
+    const { outputAccess } = readDocumentAuthorizationAccess(handle, binding);
+    const prepared = prepareOutputPath(policy, authorization, binding, path, outputAccess);
+    const unresolved = unresolvedDocuments.has(handle);
+    const state = unresolved ? prepared.state ?? classifyEffectiveFieldAuthorization({
       path,
-      rules: entries.map((entry) => entry.rule),
+      rules: prepared.entries.map((entry) => entry.rule),
+      modelPermissionPrefix: policy.prefix,
       outputFields: policy.outputFields,
-      globalPermissions: permissions,
-      modelPermissionPrefix: configuration.modelPermissionPrefix ?? ""
-    };
-    if (unresolvedDocuments.has(handle) && classifyEffectiveFieldAuthorization(args) !== "granted") return false;
-    return evaluateEffectiveFieldAuthorization({
-      ...args,
-      req: this,
-      docPermissions: grants,
-      evaluateRule: (_rule, index) => evaluateRequestRule(handle, binding, entries[index], args.modelPermissionPrefix, access.outputAccess)
-    });
+      globalPermissions: permissions
+    }) : void 0;
+    let allowed;
+    if (unresolved && state !== "granted") allowed = false;
+    else if (prepared.backendGrant) allowed = true;
+    else {
+      allowed = true;
+      for (const entry of prepared.entries) {
+        if (!await evaluateRequestRule(handle, binding, entry, policy.prefix, outputAccess)) {
+          allowed = false;
+          break;
+        }
+      }
+    }
+    assertOwningOutputDocuments(handle);
+    return allowed;
   });
+  return owningDocuments.has(handle) ? decision.then((allowed) => {
+    assertOwningOutputDocuments(handle);
+    return allowed;
+  }) : decision;
 }
 async function requestOutputFieldPaths(handle, binding, access) {
-  const { authorization } = readDocumentAuthorization(handle, binding);
-  const { configuration } = readServiceAuthorization(authorization, binding);
-  const schema = configuration.permissionSchema;
+  const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+  assertOwningOutputDocuments(handle);
+  const policy = callFieldPolicy(authorization, binding);
   const fields = [];
-  for (const path of Object.keys(schema ?? {})) {
-    const entries = extractOutputFieldRuleEntries(schema, path, access);
+  for (const path of policy.requestPaths ?? Object.keys(policy.schema ?? {})) {
+    const { entries } = prepareOutputPath(policy, authorization, binding, path, access);
     let allowed = true;
     for (const entry of entries) {
-      if (!await evaluateRequestRule(
-        handle,
-        binding,
-        entry,
-        configuration.modelPermissionPrefix ?? "",
-        access
-      )) {
+      if (!await evaluateRequestRule(handle, binding, entry, policy.prefix, access)) {
         allowed = false;
         break;
       }
     }
     if (allowed && entries.length) fields.push(path);
   }
+  assertOwningOutputDocuments(handle);
+  readDocumentAuthorizationAccess(handle, binding);
   return fields;
 }
 function authorizeEmbeddedOutputPlan(parent, child) {
@@ -5831,24 +6103,24 @@ function authorizeEmbeddedOutputPlan(parent, child) {
 function hasWholeOutputValueGrant(plan, field) {
   if (plan.fieldStates?.[field] !== "granted") return false;
   const binding = plan.authorizationBinding;
-  const { authorization } = readServiceAuthorization(plan.authorization, binding);
-  return hasExplicitFieldGrant(authorization.outputFields, [...binding.scopePath ?? [], field].join("."));
+  const { outputFields } = readServiceOutputPolicy(plan.authorization, binding);
+  return hasExplicitFieldGrant(outputFields, [...binding.scopePath ?? [], field].join("."));
 }
 function copyOutputValue(value, plan, path) {
-  const { configuration } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  const virtualValue = configuration.catalog.virtualPaths?.some((p) => matchesCatalogPattern(p, path));
-  const opaque = configuration.catalog.opaquePaths?.some((p) => matchesCatalogPattern(p, path));
+  const { catalog } = readServiceOutputPolicy(plan.authorization, plan.authorizationBinding);
+  const virtualValue = catalog.virtualPaths?.some((p) => matchesCatalogPattern(p, path));
+  const opaque = catalog.opaquePaths?.some((p) => matchesCatalogPattern(p, path));
   const excluded = plan.effectiveSelectNorm.filter((token) => token.startsWith("-")).map((token) => [...plan.authorizationBinding.scopePath ?? [], token.slice(1)].join("."));
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
     if (input instanceof Map) return visit(Object.fromEntries(input), current);
-    if (!(0, import_utils27.isPlainObject)(input)) return deepIsolateValue(input);
+    if (!(0, import_utils28.isPlainObject)(input)) return deepIsolateValue(input);
     const output = {};
     for (const [key, entry] of Object.entries(input)) {
       const child = `${current}.${key}`;
       if (excluded.some((entry2) => child === entry2 || child.startsWith(`${entry2}.`))) continue;
       const safeValueKey = !["__proto__", "constructor", "prototype", "_doc", "$__", "__v"].includes(key);
-      if (!(opaque ? safeValueKey : isSafeOutputPath(key)) || configuration.catalog.protectedPaths?.some((p) => matchesCatalogPattern(p, child, true)) || !opaque && !virtualValue && !isCatalogOutputPath(configuration.catalog, child))
+      if (!(opaque ? safeValueKey : isSafeOutputPath(key)) || catalog.protectedPaths?.some((p) => matchesCatalogPattern(p, child, true)) || !opaque && !virtualValue && !isCatalogOutputPath(catalog, child))
         continue;
       output[key] = visit(entry, child);
     }
@@ -5858,25 +6130,21 @@ function copyOutputValue(value, plan, path) {
 }
 function copyAuthorizedReference(value, plan, path) {
   if (Array.isArray(value)) return value.map((entry) => copyAuthorizedReference(entry, plan, path));
-  if (!(0, import_utils27.isPlainObject)(value)) return deepIsolateValue(value);
+  if (!(0, import_utils28.isPlainObject)(value)) return deepIsolateValue(value);
   const handle = getAssociatedDocumentAuthorization(value, plan.authorization);
   if (handle) {
     const copy = deepIsolateValue(value);
     transferDocumentAuthorizationGraph(value, copy);
     return copy;
   }
-  const { relatedTargets } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  if (relatedTargets.some((target) => target.path === path && target.kind === "passthrough")) {
-    return deepIsolateValue(value);
-  }
   return Object.prototype.hasOwnProperty.call(value, "_id") ? deepIsolateValue(value._id) : void 0;
 }
 function retainOutputMetadata(output, source, configuration, scope2) {
   if (scope2.length || configuration.stripPermissionsField) return;
   const parts = (configuration.documentPermissionField ?? "_permissions").split(".");
   let value = source;
-  for (const part of parts) value = (0, import_utils27.isPlainObject)(value) ? value[part] : void 0;
-  if (!(0, import_utils27.isPlainObject)(value)) return;
+  for (const part of parts) value = (0, import_utils28.isPlainObject)(value) ? value[part] : void 0;
+  if (!(0, import_utils28.isPlainObject)(value)) return;
   const keys2 = configuration.exposedDocPermissionKeys;
   const metadata = Object.fromEntries(
     Object.entries(value).filter(
@@ -5886,7 +6154,7 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   const copy = { ...output };
   let target = copy;
   for (const part of parts.slice(0, -1)) {
-    target[part] = (0, import_utils27.isPlainObject)(target[part]) ? { ...target[part] } : {};
+    target[part] = (0, import_utils28.isPlainObject)(target[part]) ? { ...target[part] } : {};
     target = target[part];
   }
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
@@ -5928,11 +6196,11 @@ async function filterExistingOutput(source, plan, handle, associated) {
           for (const entry of value2) values.push(await one(entry) ?? null);
           return values;
         }
-        if (!(0, import_utils27.isPlainObject)(value2)) return value2 === null ? null : void 0;
+        if (!(0, import_utils28.isPlainObject)(value2)) return value2 === null ? null : void 0;
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
-          const state = readDocumentAuthorization(childHandle, scoped.authorizationBinding);
+          const state = readDocumentAuthorizationAccess(childHandle, scoped.authorizationBinding);
           if (getAuthorizationProvenance(state.authorization) !== getAuthorizationProvenance(plan.authorization))
             authorizationError("child call mismatch");
           child = helperPlan(state.authorization, scoped.authorizationBinding);
@@ -5996,7 +6264,7 @@ async function filterModelOutputForHelper(args) {
   if (normalized.kind === "document") {
     const { documentAuthorization: handle2, binding: binding2 } = normalized;
     assertDocumentAuthorization(handle2, { binding: binding2, output: args.doc, outputAccess: access });
-    const state = readDocumentAuthorization(handle2, binding2);
+    const state = readDocumentAuthorizationAccess(handle2, binding2);
     return filterExistingOutput(
       args.doc,
       helperPlan(state.authorization, binding2),
@@ -6008,7 +6276,7 @@ async function filterModelOutputForHelper(args) {
   const plan = helperPlan(normalized.authorization, binding);
   if (args.doc == null) return { output: args.doc, fields: [] };
   const source = isolateDocForOutput(args.doc);
-  if (!(0, import_utils27.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
+  if (!(0, import_utils28.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
   const knownOutput = !!args.doc && typeof args.doc === "object" && isKnownAuthorizationOutput(args.doc);
   const handle = await resolveOutputDocumentAuthorization({
     authorization: normalized.authorization,
@@ -6019,10 +6287,10 @@ async function filterModelOutputForHelper(args) {
   });
   return filterExistingOutput(source, plan, handle, false);
 }
-var import_utils27, unresolvedDocuments, owningDocuments;
+var import_utils28, unresolvedDocuments, owningDocuments, fieldPolicies;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
-    import_utils27 = require("@web-ts-toolkit/utils");
+    import_utils28 = require("@web-ts-toolkit/utils");
     init_permissions_alias();
     init_document();
     init_request_work();
@@ -6036,6 +6304,7 @@ var init_output_field_filter = __esm({
     init_output_projection();
     unresolvedDocuments = /* @__PURE__ */ new WeakSet();
     owningDocuments = /* @__PURE__ */ new WeakMap();
+    fieldPolicies = /* @__PURE__ */ new WeakMap();
   }
 });
 
@@ -6104,27 +6373,53 @@ __export(finalize_model_output_exports, {
   finalizeModelOutput: () => finalizeModelOutput,
   finalizeModelOutputs: () => finalizeModelOutputs
 });
-async function finalizeSingleDoc(args, input) {
-  const scopePath = args.scopePath;
+function assertFinalizerCall(args, prepared) {
   const plan = args.plan;
   const binding = plan.authorizationBinding;
-  const captured = plan.authorization && binding ? readServiceAuthorization(plan.authorization, binding) : void 0;
-  if (plan.authorization && (!binding || binding.request !== args.request || binding.modelName !== args.receivingModelName || captured?.access.virtualAccess !== args.virtualAccess || captured.access.outputAccess !== args.outputAccess || captured.access.docPermissionsAccess !== args.docPermissionsAccess || (binding.scopePath ?? []).join(".") !== scopePath.filter((p) => p !== "sub").join("."))) {
+  if (plan.authorization !== prepared.authorization) authorizationError("finalizer call changed during pass");
+  if (plan.authorization && binding) assertAuthorizationBinding(plan.authorization, binding);
+  const access = prepared.policy?.access;
+  if (plan.authorization && (!binding || binding.request !== args.request || binding.modelName !== args.receivingModelName || access?.virtualAccess !== args.virtualAccess || access.outputAccess !== args.outputAccess || access.docPermissionsAccess !== args.docPermissionsAccess || (binding.scopePath ?? []).join(".") !== args.scopePath.filter((p) => p !== "sub").join("."))) {
     authorizationError("finalizer call/model/scope/access mismatch");
   }
-  const snapshot = captured ? captured.configuration : args.snapshot;
+}
+function prepareFinalizer(args, sharedContext = false) {
+  const { authorization, authorizationBinding: binding } = args.plan;
+  const policy = authorization && binding ? readServiceOutputPolicy(authorization, binding) : void 0;
+  assertFinalizerCall(args, { authorization, policy });
+  const configuration = authorization ? readServiceFinalizerConfiguration(authorization, binding) : void 0;
+  const snapshot = configuration ? configuration : deepIsolateValue(args.snapshot);
+  return {
+    authorization,
+    policy,
+    snapshot,
+    baseContext: deepIsolateValue(args.context ?? {}),
+    sharedContext,
+    scopeVirtualNames: getScopeVirtualNames(snapshot, args.scopePath),
+    scopedSchema: configuration ? null : getScopedPermissionSchema2(snapshot.permissionSchema, args.scopePath),
+    permissions: authorization ? getAuthorizationPermissions(authorization, binding) : void 0,
+    resolveDocument: authorization ? prepareOutputDocumentAuthorization(authorization, binding, configuration) : void 0
+  };
+}
+async function finalizeSingleDoc(args, input, prepared) {
+  assertFinalizerCall(args, prepared);
+  const scopePath = args.scopePath;
+  const plan = args.plan;
+  const binding = plan.authorizationBinding;
+  const captured = prepared.policy;
+  const snapshot = prepared.snapshot;
   const limit = args.resolvedLimit;
   const gate = args.sharedGate;
   const original = getIncludeOriginal(input);
   const privateRow = args.virtualPopulateRow ?? (original && typeof original === "object" ? getVirtualPopulateRow(original) : void 0);
   const privateAddress = args.virtualPopulateAddress ?? [];
   const isolated = isolateDocForOutput(input);
-  const output = (0, import_utils28.isPlainObject)(isolated) ? isolated : {};
-  if (captured && (0, import_utils28.isPlainObject)(input))
+  const output = (0, import_utils29.isPlainObject)(isolated) ? isolated : {};
+  if (captured && (0, import_utils29.isPlainObject)(input))
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
-  const baseContext = args.context ?? {};
+  const baseContext = prepared.sharedContext ? deepIsolateValue(prepared.baseContext) : prepared.baseContext;
   const operation = captured?.access.operation ?? baseContext.operation ?? args.operation ?? args.virtualAccess;
   const scopeContext = {
     ...baseContext,
@@ -6142,7 +6437,7 @@ async function finalizeSingleDoc(args, input) {
   if (captured) {
     const projected = args.documentAuthorizationStage ? input : deepIsolateValue(output);
     metadataSource = deepIsolateValue(output);
-    documentAuthorization = await resolveOutputDocumentAuthorization({
+    documentAuthorization = await prepared.resolveDocument({
       authorization: plan.authorization,
       binding,
       snapshot: projected,
@@ -6155,13 +6450,10 @@ async function finalizeSingleDoc(args, input) {
   }
   const docGrants = documentAuthorization ? readDocumentAuthorization(documentAuthorization, binding).grants : await resolveDocPermissions(args, output, scopeContext);
   scopeContext.docPermissions = deepIsolateValue(docGrants);
-  const globalPerms = captured ? getAuthorizationPermissions(plan.authorization, binding) : resolveGlobalPermissions(args);
-  const modelPermissionPrefix = snapshot.modelPermissionPrefix ?? "";
-  const documentPermissionField = snapshot.documentPermissionField ?? "_permissions";
-  const scopedSchema = getScopedPermissionSchema2(
-    snapshot.permissionSchema ?? null,
-    scopePath
-  );
+  const globalPerms = prepared.permissions ?? resolveGlobalPermissions(args);
+  const modelPermissionPrefix = captured ? "" : deepIsolateValue(snapshot.modelPermissionPrefix ?? "");
+  const documentPermissionField = captured ? "_permissions" : deepIsolateValue(snapshot.documentPermissionField ?? "_permissions");
+  const scopedSchema = deepIsolateValue(prepared.scopedSchema);
   const childPlans = plan.childPlans ?? {};
   for (const [containerName, childPlan] of Object.entries(childPlans)) {
     if (!(containerName in output)) continue;
@@ -6175,17 +6467,18 @@ async function finalizeSingleDoc(args, input) {
       );
       continue;
     }
-    if (captured && !(0, import_utils28.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
+    if (captured && !(0, import_utils29.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
       delete output[containerName];
       continue;
     }
     retainRawAssociation(output, containerName, rawContainer);
-    const childSnapshot = snapshot;
     const childBase = {
       ...args,
       scopePath: [...childPlan.scopePath ?? [...scopePath, containerName, "sub"]],
       plan: captured ? authorizeEmbeddedOutputPlan(plan, childPlan) : childPlan,
-      snapshot: childSnapshot,
+      // Authenticated preparation reads its own authority. Do not clone an
+      // otherwise unused public configuration graph on default traversal.
+      snapshot: args.snapshot,
       // Embedded reuses the owning parent's grants + accesses (VIRT-00A D2).
       docPermissions: docGrants,
       context: scopeContext,
@@ -6196,10 +6489,11 @@ async function finalizeSingleDoc(args, input) {
       related: [],
       virtualPopulateRow: privateRow
     };
+    let childPreparation;
     const finalizeOneChild = async (rawChild, address) => {
       if (captured && Array.isArray(rawChild))
         return mapWithConcurrencyLimit(rawChild, limit, (entry, index) => finalizeOneChild(entry, [...address, index]));
-      if (!(0, import_utils28.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
+      if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
       if (args.traversal?.finalizeEmbeddedChildren) {
         return args.traversal.finalizeEmbeddedChildren({
           containerName,
@@ -6216,7 +6510,14 @@ async function finalizeSingleDoc(args, input) {
           } : { ...args, virtualPopulateRow: privateRow, virtualPopulateAddress: address }
         });
       }
-      return finalizeSingleDoc({ ...childBase, virtualPopulateAddress: address }, rawChild);
+      return finalizeSingleDoc(
+        { ...childBase, virtualPopulateAddress: address },
+        rawChild,
+        childPreparation ??= prepareFinalizer(
+          childBase,
+          Array.isArray(rawContainer) && (rawContainer.length > 1 || Array.isArray(rawContainer[0]))
+        )
+      );
     };
     if (Array.isArray(rawContainer)) {
       const finalized = await mapWithConcurrencyLimit(
@@ -6225,7 +6526,7 @@ async function finalizeSingleDoc(args, input) {
         (entry, index) => finalizeOneChild(entry, [...privateAddress, containerName, index])
       );
       output[containerName] = finalized;
-    } else if ((0, import_utils28.isPlainObject)(rawContainer)) {
+    } else if ((0, import_utils29.isPlainObject)(rawContainer)) {
       output[containerName] = await finalizeOneChild(rawContainer, [
         ...privateAddress,
         containerName
@@ -6237,8 +6538,8 @@ async function finalizeSingleDoc(args, input) {
     let rawRelated;
     let originalRelated;
     try {
-      rawRelated = target.path.includes(".") ? (0, import_utils28.get)(output, target.path) : output[target.path];
-      originalRelated = (0, import_utils28.get)(original, target.path);
+      rawRelated = target.path.includes(".") ? (0, import_utils29.get)(output, target.path) : output[target.path];
+      originalRelated = (0, import_utils29.get)(original, target.path);
     } catch {
       continue;
     }
@@ -6268,8 +6569,9 @@ async function finalizeSingleDoc(args, input) {
       context: scopeContext,
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
+    let relatedPreparation;
     const finalizeOneRelated = async (rawChild, originalChild = rawChild) => {
-      if (!(0, import_utils28.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
+      if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
       const childOriginal = getIncludeOriginal(originalChild);
       const childRow = childOriginal && typeof childOriginal === "object" ? getVirtualPopulateRow(childOriginal) : void 0;
@@ -6281,7 +6583,11 @@ async function finalizeSingleDoc(args, input) {
           parentArgs: { ...args, virtualPopulateRow: childRow, virtualPopulateAddress: [] }
         });
       }
-      return finalizeSingleDoc({ ...relatedBase, virtualPopulateRow: childRow }, rawChild);
+      return finalizeSingleDoc(
+        { ...relatedBase, virtualPopulateRow: childRow },
+        rawChild,
+        relatedPreparation ??= prepareFinalizer(relatedBase, Array.isArray(rawRelated) && rawRelated.length > 1)
+      );
     };
     let finalized;
     if (Array.isArray(rawRelated)) {
@@ -6290,29 +6596,35 @@ async function finalizeSingleDoc(args, input) {
         limit,
         (entry, index) => finalizeOneRelated(entry, Array.isArray(originalRelated) ? originalRelated[index] : void 0)
       );
-    } else if ((0, import_utils28.isPlainObject)(rawRelated)) {
+    } else if ((0, import_utils29.isPlainObject)(rawRelated)) {
       finalized = await finalizeOneRelated(rawRelated, originalRelated);
     } else {
       continue;
     }
     try {
-      if (target.path.includes(".")) (0, import_utils28.set)(output, target.path, finalized);
+      if (target.path.includes(".")) (0, import_utils29.set)(output, target.path, finalized);
       else output[target.path] = finalized;
     } catch {
     }
   }
-  const scopeVirtualNames = getScopeVirtualNames(snapshot, scopePath);
-  for (const virtualName of scopeVirtualNames) {
+  for (const virtualName of prepared.scopeVirtualNames) {
     if (virtualName in output) delete output[virtualName];
   }
-  const stableBase = deepIsolateValue(output);
-  const scopeLabel = scopePath.length > 0 ? scopePath.join(".") : "";
   const candidates = plan.candidates ?? [];
+  const needsGetterView = candidates.some((candidate) => {
+    const descriptor = candidate.descriptor;
+    if (typeof descriptor?.get !== "function") return false;
+    if (!privateRow && descriptor.dependsOnPopulate?.length) return false;
+    const dependsOn = Array.isArray(descriptor.dependsOn) ? descriptor.dependsOn : [];
+    return dependsOn.every((dep) => typeof dep === "string" && !isAbsentDependency(output, dep));
+  });
+  let stableBase = needsGetterView ? deepIsolateValue(output) : void 0;
+  const scopeLabel = scopePath.length > 0 ? scopePath.join(".") : "";
   const staged = /* @__PURE__ */ new Map();
   const runCandidate = async (candidate) => {
     const dependsOn = Array.isArray(candidate.descriptor?.dependsOn) ? candidate.descriptor.dependsOn : [];
     for (const dep of dependsOn) {
-      if (typeof dep !== "string" || isAbsentDependency(stableBase, dep)) return;
+      if (typeof dep !== "string" || isAbsentDependency(stableBase ?? output, dep)) return;
     }
     const allowed = documentAuthorization ? await evaluateAuthorizedOutputField(documentAuthorization, binding, candidate.name) : await evaluateEffectiveFieldAuthorization({
       req: args.request,
@@ -6327,9 +6639,9 @@ async function finalizeSingleDoc(args, input) {
     if (typeof getter !== "function") return;
     const privateInputs = privateRow ? readVirtualPopulateInputs(privateRow, privateAddress, candidate.name) : candidate.descriptor.dependsOnPopulate?.length ? { available: false } : { available: true, populated: {} };
     if (!privateInputs.available) return;
-    const isolatedView = deepIsolateValue(stableBase);
+    const isolatedView = deepIsolateValue(stableBase ??= deepIsolateValue(output));
     const virtualContext = {
-      ...scopeContext,
+      ...deepIsolateValue(scopeContext),
       docPermissions: deepIsolateValue(docGrants)
     };
     const outcome = await runVirtualGetter({
@@ -6410,7 +6722,6 @@ async function finalizeSingleDoc(args, input) {
   if (!captured && documentPermissionField in output) keep.add(documentPermissionField);
   const trimmed = {};
   for (const key of keep) {
-    if (privateRow && !await isVirtualPopulateReferenceVisible(privateRow, privateAddress, key)) continue;
     if (privateRow && !hasVirtualPopulatePublicReference(privateRow, privateAddress, key)) {
       const ref = readVirtualPopulateOriginalReference(privateRow, privateAddress, key);
       if (ref) {
@@ -6421,12 +6732,25 @@ async function finalizeSingleDoc(args, input) {
     if (!(key in output)) continue;
     if (captured && !plan.childPlans[key]) {
       const path = [...binding.scopePath ?? [], key].join(".");
-      trimmed[key] = captured.configuration.catalog.referencePaths?.some((p) => matchesCatalogPattern(p, path)) ? copyAuthorizedReference(output[key], plan, path) : copyOutputValue(output[key], plan, path);
+      trimmed[key] = captured.catalog.referencePaths?.some((p) => matchesCatalogPattern(p, path)) ? copyAuthorizedReference(output[key], plan, path) : copyOutputValue(output[key], plan, path);
       if (trimmed[key] === void 0) delete trimmed[key];
     } else trimmed[key] = output[key];
   }
   if (documentAuthorization) {
-    retainOutputMetadata(trimmed, metadataSource, captured.configuration, binding.scopePath ?? []);
+    retainOutputMetadata(
+      trimmed,
+      metadataSource,
+      copyAuthorizationValue(
+        {
+          documentPermissionField: snapshot.documentPermissionField,
+          stripPermissionsField: snapshot.stripPermissionsField,
+          exposedDocPermissionKeys: snapshot.exposedDocPermissionKeys,
+          disableFieldPermissions: snapshot.disableFieldPermissions
+        },
+        true
+      ),
+      binding.scopePath ?? []
+    );
     associateDocumentAuthorization(documentAuthorization, binding, trimmed);
     args.onFinalized?.(
       trimmed,
@@ -6435,7 +6759,7 @@ async function finalizeSingleDoc(args, input) {
         output: trimmed,
         outputAccess: args.outputAccess,
         authorization: plan.authorization,
-        stage: readDocumentAuthorization(documentAuthorization, binding).stage
+        stage: readDocumentAuthorizationAccess(documentAuthorization, binding).stage
       })
     );
   }
@@ -6456,7 +6780,7 @@ async function finalizeModelOutput(args) {
     sharedGate: gate,
     resolvedLimit: limit
   };
-  return finalizeSingleDoc(internal, args.input);
+  return finalizeSingleDoc(internal, args.input, prepareFinalizer(internal));
 }
 async function finalizeModelOutputs(args) {
   const gate = finalizerGate(args);
@@ -6465,22 +6789,30 @@ async function finalizeModelOutputs(args) {
   if ("documentAuthorizationStage" in args || documentAuthorizationStages && (documentAuthorizationStages.length !== inputs.length || new Set(documentAuthorizationStages).size !== inputs.length)) {
     authorizationError("list finalization requires a distinct document stage per row");
   }
+  if (!inputs.length) return [];
+  const internal = {
+    ...rest,
+    scopePath: [...rest.scopePath ?? rest.plan.scopePath ?? []],
+    sharedGate: gate,
+    resolvedLimit: limit
+  };
+  const prepared = prepareFinalizer(internal, inputs.length > 1);
   return mapWithConcurrencyLimit(inputs, limit, (input, index) => {
-    const internal = {
-      ...rest,
-      scopePath: [...rest.scopePath ?? rest.plan.scopePath ?? []],
-      onFinalized: rest.onFinalized ? (output, context) => rest.onFinalized(output, context, index) : void 0,
-      documentAuthorizationStage: documentAuthorizationStages?.[index],
-      sharedGate: gate,
-      resolvedLimit: limit
-    };
-    return finalizeSingleDoc(internal, input);
+    return finalizeSingleDoc(
+      {
+        ...internal,
+        onFinalized: rest.onFinalized ? (output, context) => rest.onFinalized(output, context, index) : void 0,
+        documentAuthorizationStage: documentAuthorizationStages?.[index]
+      },
+      input,
+      prepared
+    );
   });
 }
-var import_utils28, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
+var import_utils29, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
 var init_finalize_model_output = __esm({
   "src/output/finalize-model-output.ts"() {
-    import_utils28 = require("@web-ts-toolkit/utils");
+    import_utils29 = require("@web-ts-toolkit/utils");
     init_document();
     init_concurrency();
     init_request_work();
@@ -6493,20 +6825,20 @@ var init_finalize_model_output = __esm({
     init_field_catalog();
     init_virtual_populate_execution();
     init_include_output();
-    isVirtualContainerValue3 = (value) => (0, import_utils28.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue3 = (value) => (0, import_utils29.isPlainObject)(value) && "sub" in value;
     getScopeVirtualsObject2 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !(0, import_utils28.isPlainObject)(rootVirtuals)) return null;
+      if (!rootVirtuals || !(0, import_utils29.isPlainObject)(rootVirtuals)) return null;
       if (scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!(0, import_utils28.isPlainObject)(current)) return null;
+        if (!(0, import_utils29.isPlainObject)(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue3(container)) return null;
         current = container.sub;
-        if (!(0, import_utils28.isPlainObject)(current)) return null;
+        if (!(0, import_utils29.isPlainObject)(current)) return null;
       }
       return current;
     };
@@ -6519,11 +6851,11 @@ var init_finalize_model_output = __esm({
       return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue3(v)).map(([k]) => k);
     };
     getScopedPermissionSchema2 = (root, scopePath) => {
-      if (!root || !(0, import_utils28.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils29.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
       try {
-        const scoped = (0, import_utils28.get)(root, scopePath.join("."));
-        return (0, import_utils28.isPlainObject)(scoped) ? scoped : null;
+        const scoped = (0, import_utils29.get)(root, scopePath.join("."));
+        return (0, import_utils29.isPlainObject)(scoped) ? scoped : null;
       } catch {
         return null;
       }
@@ -6544,7 +6876,7 @@ var init_finalize_model_output = __esm({
     };
     resolveDocPermissions = async (args, isolatedForHook, scopeContext) => {
       if (args.docPermissions != null && typeof args.docPermissions === "object" && !Array.isArray(args.docPermissions)) {
-        const grants = args.docPermissions;
+        const grants = deepIsolateValue(args.docPermissions);
         scopeContext.docPermissions = grants;
         return grants;
       }
@@ -6582,7 +6914,7 @@ var init_finalize_model_output = __esm({
           const grants = await args.sharedGate.run(
             () => hook.call(args.request, isolatedForHook, globalPerms, scopeContext)
           );
-          const normalized = (0, import_utils28.isPlainObject)(grants) ? grants : {};
+          const normalized = (0, import_utils29.isPlainObject)(grants) ? grants : {};
           scopeContext.docPermissions = normalized;
           return normalized;
         }
@@ -6654,40 +6986,20 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils46 = require("@web-ts-toolkit/utils");
+var import_utils47 = require("@web-ts-toolkit/utils");
 
 // src/middleware.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils39 = require("@web-ts-toolkit/utils");
+var import_utils40 = require("@web-ts-toolkit/utils");
 
 // src/core.ts
 init_public_admission();
-var import_utils38 = require("@web-ts-toolkit/utils");
+var import_utils39 = require("@web-ts-toolkit/utils");
 init_options();
-
-// src/meta.ts
-init_runtime();
-init_runtime_context();
-var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
-var getModelRef = (modelName, refPath) => {
-  const direct = getRuntime5().getModelRef(modelName, refPath);
-  if (direct) return direct;
-  if (!refPath.includes(".")) return null;
-  try {
-    const runtime = getRuntime5();
-    const instance = runtime.getModelInstance?.(
-      modelName
-    );
-    const schemaPath = instance?.schema?.path?.(refPath);
-    const ref = schemaPath?.options?.ref ?? schemaPath?.caster?.options?.ref ?? null;
-    return typeof ref === "string" && ref.length > 0 ? ref : null;
-  } catch {
-    return null;
-  }
-};
+init_permission();
 
 // src/services/base.ts
-var import_utils23 = require("@web-ts-toolkit/utils");
+var import_utils24 = require("@web-ts-toolkit/utils");
 init_options();
 init_helpers();
 init_document();
@@ -6813,7 +7125,7 @@ function requestFieldScope(options) {
 init_public_admission();
 
 // src/correlated-includes.ts
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_sort_policy();
 var PARENT_MARKER_KEY = "$parent";
@@ -6826,10 +7138,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return (0, import_utils19.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return (0, import_utils20.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return (0, import_utils19.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return (0, import_utils20.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -6848,12 +7160,12 @@ function containsParentMarkerShape(value) {
   const seen = /* @__PURE__ */ new Set();
   const visit = (current) => {
     if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
-    if ((0, import_utils19.isArray)(current)) {
+    if ((0, import_utils20.isArray)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       return current.some(visit);
     }
-    if ((0, import_utils19.isPlainObject)(current)) {
+    if ((0, import_utils20.isPlainObject)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -6883,7 +7195,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if ((0, import_utils19.isPlainObject)(value)) {
+  if ((0, import_utils20.isPlainObject)(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -6894,7 +7206,7 @@ function scanTemplateValueNode(value, path, issues) {
     scanTemplateObjectEntries(value, path, issues);
     return;
   }
-  if ((0, import_utils19.isArray)(value)) {
+  if ((0, import_utils20.isArray)(value)) {
     value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
   }
 }
@@ -6935,7 +7247,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils19.isArray)(child)) {
+      if (!(0, import_utils20.isArray)(child)) {
         scanTemplateValueNode(child, childPath, issues);
         continue;
       }
@@ -6948,7 +7260,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if ((0, import_utils19.isPlainObject)(clause)) {
+        if ((0, import_utils20.isPlainObject)(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -6959,7 +7271,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter2) {
   const issues = [];
-  if (!(0, import_utils19.isPlainObject)(filter2)) {
+  if (!(0, import_utils20.isPlainObject)(filter2)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -7002,13 +7314,13 @@ function collectFilterReferencePaths(filter2) {
       return;
     }
     if (isEscapedParentRef(value)) return;
-    if ((0, import_utils19.isArray)(value)) {
+    if ((0, import_utils20.isArray)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       value.forEach(visitValue);
       return;
     }
-    if ((0, import_utils19.isPlainObject)(value)) {
+    if ((0, import_utils20.isPlainObject)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       for (const [key, child] of Object.entries(value)) {
@@ -7054,7 +7366,7 @@ function getOwnPathValue(parent, path) {
   return current;
 }
 function cloneSubstitutedValue(value) {
-  if ((0, import_utils19.isPlainObject)(value) || (0, import_utils19.isArray)(value)) return (0, import_utils19.cloneDeep)(value);
+  if ((0, import_utils20.isPlainObject)(value) || (0, import_utils20.isArray)(value)) return (0, import_utils20.cloneDeep)(value);
   return value;
 }
 function literalParentRefObject(path) {
@@ -7095,7 +7407,7 @@ function resolveObjectEntries(obj, parent) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils19.isArray)(child)) {
+      if (!(0, import_utils20.isArray)(child)) {
         out[key] = resolveValueNode(child, parent, false);
         continue;
       }
@@ -7103,7 +7415,7 @@ function resolveObjectEntries(obj, parent) {
         if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
           throw new CorrelatedReferenceError(`Unsupported $parent reference as a direct ${key} clause`);
         }
-        if (!(0, import_utils19.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
+        if (!(0, import_utils20.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
         return resolveObjectEntries(clause, parent);
       });
       continue;
@@ -7132,10 +7444,10 @@ function resolveValueNode(template, parent, bare) {
     }
     const value = getOwnPathValue(parent, path);
     if (value === void 0 || value === null) throw UNRESOLVABLE;
-    if (bare && (0, import_utils19.isPlainObject)(value)) return { $eq: (0, import_utils19.cloneDeep)(value) };
+    if (bare && (0, import_utils20.isPlainObject)(value)) return { $eq: (0, import_utils20.cloneDeep)(value) };
     return cloneSubstitutedValue(value);
   }
-  if ((0, import_utils19.isPlainObject)(template)) {
+  if ((0, import_utils20.isPlainObject)(template)) {
     if (hasMarkerKey(template)) {
       throw new CorrelatedReferenceError(
         'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }'
@@ -7143,7 +7455,7 @@ function resolveValueNode(template, parent, bare) {
     }
     return resolveObjectEntries(template, parent);
   }
-  if ((0, import_utils19.isArray)(template)) {
+  if ((0, import_utils20.isArray)(template)) {
     return template.map((item) => resolveValueNode(item, parent, false));
   }
   return template;
@@ -7177,7 +7489,7 @@ function resolveCorrelatedIdTemplate(id, parent) {
 }
 function resolveCorrelatedFilterTemplate(filter2, parent) {
   try {
-    if (!(0, import_utils19.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
+    if (!(0, import_utils20.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
       throw new CorrelatedReferenceError("Correlated include filter must be an object");
     }
     return { status: "resolved", filter: resolveObjectEntries(filter2, parent) };
@@ -7192,7 +7504,7 @@ function validateExpandedCorrelatedOperands(expanded, limits) {
 var MAX_NESTED_INCLUDE_DEPTH = 10;
 function validateCorrelatedArgsShape(args, op, depth) {
   if (args === void 0) return [];
-  if (!(0, import_utils19.isPlainObject)(args)) return ["Correlated include args must be an object"];
+  if (!(0, import_utils20.isPlainObject)(args)) return ["Correlated include args must be an object"];
   const record3 = args;
   const allowed = op === "list" ? /* @__PURE__ */ new Set(["select", "sort", "skip", "limit", "page", "pageSize", "include"]) : /* @__PURE__ */ new Set(["select", "sort", "include"]);
   for (const key of Object.keys(record3)) {
@@ -7214,7 +7526,7 @@ function validateCorrelatedArgsShape(args, op, depth) {
   return [];
 }
 function validateCorrelatedIncludeShape(entry, depth = 0) {
-  if (!(0, import_utils19.isPlainObject)(entry)) return ["Correlated include must be an object"];
+  if (!(0, import_utils20.isPlainObject)(entry)) return ["Correlated include must be an object"];
   const record3 = entry;
   if (record3.mode !== "correlated") return ['Correlated include mode must be "correlated"'];
   if (typeof record3.model !== "string" || record3.model.length === 0)
@@ -7227,7 +7539,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   if ("localField" in record3 || "foreignField" in record3) {
     return ["Correlated includes must not carry localField or foreignField"];
   }
-  if (record3.options !== void 0 && !((0, import_utils19.isPlainObject)(record3.options) && Object.keys(record3.options).length === 0)) {
+  if (record3.options !== void 0 && !((0, import_utils20.isPlainObject)(record3.options) && Object.keys(record3.options).length === 0)) {
     return ["Correlated include options must be absent or empty"];
   }
   const hasId = record3.id !== void 0;
@@ -7249,7 +7561,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   return validateCorrelatedArgsShape(record3.args, record3.op, depth);
 }
 function isCorrelatedInclude(value) {
-  return (0, import_utils19.isPlainObject)(value) && value.mode === "correlated";
+  return (0, import_utils20.isPlainObject)(value) && value.mode === "correlated";
 }
 
 // src/services/base.ts
@@ -7473,9 +7785,31 @@ function castCountGroups(input, values) {
 // src/services/base.ts
 init_service_authorization();
 
+// src/meta.ts
+init_runtime();
+init_runtime_context();
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
+var getModelRef = (modelName, refPath, runtime = getRuntime5()) => {
+  const direct = runtime.getModelRef(modelName, refPath);
+  if (direct) return direct;
+  if (!refPath.includes(".")) return null;
+  try {
+    const instance = runtime.getModelInstance?.(
+      modelName
+    );
+    const schemaPath = instance?.schema?.path?.(refPath);
+    const element = schemaPath?.$embeddedSchemaType ?? schemaPath?.embeddedSchemaType ?? schemaPath?.caster;
+    const ref = schemaPath?.options?.ref ?? element?.options?.ref ?? null;
+    return typeof ref === "string" && ref.length > 0 ? ref : null;
+  } catch {
+    return null;
+  }
+};
+
 // src/acl/related-execution.ts
 init_public_admission();
 init_model_output_planning();
+init_populate_target_configuration();
 init_authorization_snapshot();
 
 // src/acl/service-execution.ts
@@ -7513,9 +7847,9 @@ function createServiceExecution(receiver, access, authorization, applicability =
       receiver,
       binding,
       authorization: call,
-      access: readServiceAuthorization(call, binding).access,
+      access: readServiceAuthorizationAccess(call, binding),
       family: execution,
-      hydration: resolveHydration(readServiceAuthorization(call, binding).configuration, hydration)
+      hydration: resolveHydration(readServiceAuthorizationHydration(call, binding), hydration)
     })
   );
   return execution;
@@ -7526,7 +7860,7 @@ function resolveHydration(configuration, source) {
 }
 function withExecutionHydration(receiver, parent, source) {
   const record3 = readServiceExecution(receiver, parent);
-  const { configuration } = readServiceAuthorization(record3.authorization, record3.binding);
+  const configuration = readServiceAuthorizationHydration(record3.authorization, record3.binding);
   const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
   executions.set(execution, Object.freeze({ ...record3, hydration: resolveHydration(configuration, source) }));
   return execution;
@@ -7563,7 +7897,7 @@ function deriveServiceExecution(receiver, parent, access, applicability = "servi
   const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
   executions.set(
     execution,
-    Object.freeze({ ...record3, authorization: call, access: readServiceAuthorization(call, record3.binding).access })
+    Object.freeze({ ...record3, authorization: call, access: readServiceAuthorizationAccess(call, record3.binding) })
   );
   return execution;
 }
@@ -7770,16 +8104,15 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalO
   for (const entry of entries(args.populate)) {
     const path = typeof entry === "string" ? entry : entry.path;
     if (typeof entry !== "string") assertPopulateAccess(entry.access);
-    const model = getModelRef(modelName, path);
-    if (model && runtime.hasModel(model))
+    const model = getModelRef(modelName, path, runtime);
+    if (model) {
+      const target = capturePopulateTargetConfiguration(runtime, model, `${modelName}.${path}`);
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model, void 0, globalOptions),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, target.options, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !(globalOptions.requireRegisteredPopulateModels === void 0 ? true : globalOptions.requireRegisteredPopulateModels)) {
-      targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
@@ -7965,20 +8298,20 @@ var copyAuthorizedOutput = (value) => {
   transferDocumentAuthorizationGraph(value, copy);
   return copy;
 };
-var isVirtualContainerValueForGuard = (value) => (0, import_utils23.isPlainObject)(value) && "sub" in value;
+var isVirtualContainerValueForGuard = (value) => (0, import_utils24.isPlainObject)(value) && "sub" in value;
 var getScopeVirtualsForGuard = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !(0, import_utils23.isPlainObject)(rootVirtuals)) return null;
+  if (!rootVirtuals || !(0, import_utils24.isPlainObject)(rootVirtuals)) return null;
   if (scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!(0, import_utils23.isPlainObject)(current)) return null;
+    if (!(0, import_utils24.isPlainObject)(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValueForGuard(container)) return null;
     current = container.sub;
-    if (!(0, import_utils23.isPlainObject)(current)) return null;
+    if (!(0, import_utils24.isPlainObject)(current)) return null;
   }
   return current;
 };
@@ -8044,7 +8377,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
       for (const entry of value) stripScope(entry, currentScope);
       return;
     }
-    if (!(0, import_utils23.isPlainObject)(value)) return;
+    if (!(0, import_utils24.isPlainObject)(value)) return;
     const record3 = value;
     const leaves = getScopeVirtualLeafNames(snapshot, currentScope);
     for (const leaf of leaves) {
@@ -8057,7 +8390,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
     for (const key of Object.keys(record3)) {
       if (leaves.has(key) || containers.has(key)) continue;
       const child = record3[key];
-      if (Array.isArray(child) || (0, import_utils23.isPlainObject)(child)) {
+      if (Array.isArray(child) || (0, import_utils24.isPlainObject)(child)) {
         stripScope(child, currentScope);
       }
     }
@@ -8069,7 +8402,7 @@ var LOGICAL_FILTER_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
 var isOperatorKey = (key) => key.startsWith("$");
 var REMOVED_VIRTUAL_FILTER = /* @__PURE__ */ Symbol("removed virtual filter clause");
 var rewriteFilterObject = (value, visit) => {
-  if (!(0, import_utils23.isPlainObject)(value)) return value;
+  if (!(0, import_utils24.isPlainObject)(value)) return value;
   let changed = false;
   const entries = [];
   for (const [key, child] of Object.entries(value)) {
@@ -8100,7 +8433,7 @@ var resolveVirtualFilterField = (path, scope2) => {
     if (!Object.hasOwn(scope2, segment) || scope2[segment] === void 0) return null;
     const definition = scope2[segment];
     if (!isVirtualContainerValueForGuard(definition)) return REMOVED_VIRTUAL_FILTER;
-    scope2 = (0, import_utils23.isPlainObject)(definition.sub) ? definition.sub : null;
+    scope2 = (0, import_utils24.isPlainObject)(definition.sub) ? definition.sub : null;
     inContainer = true;
   }
   return scope2;
@@ -8112,7 +8445,7 @@ var stripVirtualFilterOperator = (key, value, scope2) => {
   }
   if (key === "$all") {
     return rewriteFilterClauses(value, (entry) => {
-      if (!(0, import_utils23.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
+      if (!(0, import_utils24.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
       return rewriteFilterObject(entry, (operator, operand) => stripVirtualFilterOperator(operator, operand, scope2));
     });
   }
@@ -8127,7 +8460,7 @@ var stripVirtualFilterQuery = (value, scope2, element = false) => {
     if (isOperatorKey(key)) return element ? stripVirtualFilterOperator(key, child, scope2) : child;
     const fieldScope = resolveVirtualFilterField(key, scope2);
     if (fieldScope === REMOVED_VIRTUAL_FILTER) return REMOVED_VIRTUAL_FILTER;
-    if (!fieldScope || !(0, import_utils23.isPlainObject)(child)) return child;
+    if (!fieldScope || !(0, import_utils24.isPlainObject)(child)) return child;
     if (Object.keys(child).some(isOperatorKey)) {
       return rewriteFilterObject(
         child,
@@ -8149,9 +8482,9 @@ var stripSubVirtualKeysFromFilter = (filter2, snapshot, sub) => {
 function getCorrelatedTemplateDepth(includes) {
   let max = 0;
   const visit = (entries, depth) => {
-    const list = (0, import_utils23.castArray)(entries).filter(Boolean);
+    const list = (0, import_utils24.castArray)(entries).filter(Boolean);
     for (const entry of list) {
-      if (!(0, import_utils23.isPlainObject)(entry)) continue;
+      if (!(0, import_utils24.isPlainObject)(entry)) continue;
       max = Math.max(max, depth);
       const nested = entry.args?.include;
       if (nested !== void 0) {
@@ -8176,11 +8509,11 @@ function validateClientFilter(filter2) {
   }
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils23.isArray)(value)) {
+    if ((0, import_utils24.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils23.isPlainObject)(value)) return;
+    if (!(0, import_utils24.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -8385,7 +8718,7 @@ var Base = class {
   }
   processInclude(include, authorization) {
     assertPublicAdmission(include, "include");
-    const items = (0, import_utils23.compact)((0, import_utils23.castArray)(include));
+    const items = (0, import_utils24.compact)((0, import_utils24.castArray)(include));
     const legacy = [];
     const correlated = [];
     const correlatedReferenceFields = [];
@@ -8421,23 +8754,23 @@ var Base = class {
     else this.assertIncludeOutputPaths([...legacy, ...correlated]);
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils23.forEach)(legacy, (inc) => {
+    (0, import_utils24.forEach)(legacy, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils23.uniq)((0, import_utils23.compact)(includeLocalFields));
-    includePaths = (0, import_utils23.uniq)((0, import_utils23.compact)(includePaths));
+    includeLocalFields = (0, import_utils24.uniq)((0, import_utils24.compact)(includeLocalFields));
+    includePaths = (0, import_utils24.uniq)((0, import_utils24.compact)(includePaths));
     return {
       includes: legacy,
       correlatedIncludes: correlated,
       includeLocalFields,
       includePaths,
-      correlatedReferenceFields: (0, import_utils23.uniq)((0, import_utils23.compact)(correlatedReferenceFields))
+      correlatedReferenceFields: (0, import_utils24.uniq)((0, import_utils24.compact)(correlatedReferenceFields))
     };
   }
   validateIncludeOutputPath(path, modelName, configuration) {
     const permissionField = configuration ? configuration.documentPermissionField ?? "_permissions" : getModelOption(modelName, "documentPermissionField");
-    if ((0, import_utils23.get)((0, import_utils23.set)({}, path, true), permissionField) !== void 0 || (0, import_utils23.get)((0, import_utils23.set)({}, permissionField, true), path) !== void 0) {
+    if ((0, import_utils24.get)((0, import_utils24.set)({}, path, true), permissionField) !== void 0 || (0, import_utils24.get)((0, import_utils24.set)({}, permissionField, true), path) !== void 0) {
       this.throwClientRequestError(
         "bad_request" /* BadRequest */,
         `Include output path ${path} overlaps document permission field ${permissionField} on model ${modelName}`
@@ -8462,9 +8795,9 @@ var Base = class {
       const walk = (node, prefix) => {
         for (const [key, value] of Object.entries(node)) {
           if (value === void 0) continue;
-          if ((0, import_utils23.isPlainObject)(value) && "sub" in value) {
+          if ((0, import_utils24.isPlainObject)(value) && "sub" in value) {
             const sub = value.sub;
-            if ((0, import_utils23.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
+            if ((0, import_utils24.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
             continue;
           }
           out.push(prefix ? `${prefix}.${key}` : key);
@@ -8517,7 +8850,7 @@ var Base = class {
         this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
       }
       for (const entry of entries) {
-        if (!(0, import_utils23.isPlainObject)(entry)) continue;
+        if (!(0, import_utils24.isPlainObject)(entry)) continue;
         const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
         if (models.has(modelName)) continue;
         models.add(modelName);
@@ -8530,7 +8863,7 @@ var Base = class {
           const target = targets?.find((target2) => target2.path === entry.path);
           if (nested)
             pending.push({
-              entries: (0, import_utils23.compact)((0, import_utils23.castArray)(nested)),
+              entries: (0, import_utils24.compact)((0, import_utils24.castArray)(nested)),
               modelName: entry.model,
               configuration: target?.configuration,
               targets: target?.relatedTargets
@@ -8540,7 +8873,7 @@ var Base = class {
     }
   }
   getForeignKeyValues(value) {
-    return (0, import_utils23.flatten)((0, import_utils23.castArray)(value));
+    return (0, import_utils24.flatten)((0, import_utils24.castArray)(value));
   }
   getForeignKey(value) {
     return String(value);
@@ -8548,7 +8881,7 @@ var Base = class {
   buildForeignKeyIndex(rows2, foreignField) {
     const index = /* @__PURE__ */ new Map();
     for (const row of rows2) {
-      for (const value of this.getForeignKeyValues((0, import_utils23.get)(row, foreignField))) {
+      for (const value of this.getForeignKeyValues((0, import_utils24.get)(row, foreignField))) {
         const key = this.getForeignKey(value);
         const values = index.get(key);
         if (values) values.push(row);
@@ -8584,9 +8917,9 @@ var Base = class {
   async includeDocs(docs, include, parentAuthorization) {
     assertPublicAdmission(include, "include");
     if (!include) return docs;
-    const includes = (0, import_utils23.compact)((0, import_utils23.castArray)(include));
+    const includes = (0, import_utils24.compact)((0, import_utils24.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils23.isArray)(docs);
+    const isSingle = !(0, import_utils24.isArray)(docs);
     let docList = (isSingle ? [docs] : docs).map(prepareIncludeOutput);
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
@@ -8616,7 +8949,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, "read", path, parentAuthorization);
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils23.get)(doc, localField);
+      const localValue = (0, import_utils24.get)(doc, localField);
       const execution = this.relatedExecution(svc, include, parentAuthorization);
       const prepared = await prepareModelQuery(
         svc,
@@ -8651,15 +8984,15 @@ var Base = class {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
     const svc = await this.getAuthorizedTargetService(model, op, path, parentAuthorization);
     const includeLocalValues = [];
-    (0, import_utils23.forEach)(docs, (doc) => {
-      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils23.get)(doc, localField)));
+    (0, import_utils24.forEach)(docs, (doc) => {
+      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils24.get)(doc, localField)));
     });
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
       execution,
       { kind: "client-read", filter: _filters ?? {} },
-      { [foreignField]: { $in: (0, import_utils23.flatten)(includeLocalValues) } },
+      { [foreignField]: { $in: (0, import_utils24.flatten)(includeLocalValues) } },
       true
     );
     const trustedArgs = this.sanitizeIncludeArgs(args, "list");
@@ -8702,7 +9035,7 @@ var Base = class {
     }
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const matches = this.getIndexedMatches(index, (0, import_utils23.get)(doc, localField));
+      const matches = this.getIndexedMatches(index, (0, import_utils24.get)(doc, localField));
       const isolated = matches.map((m) => copyAuthorizedOutput(m));
       attachIncludeOutput(doc, path, op === "list" ? isolated : isolated[0]);
     }
@@ -8711,7 +9044,7 @@ var Base = class {
   async includeDocsCount(docs, include, parentAuthorization) {
     const { model, path, localField, foreignField, filter: _filters } = include;
     const svc = await this.getAuthorizedTargetService(model, "count", path, parentAuthorization);
-    const groups = prepareCountGroups(docs, (doc) => (0, import_utils23.get)(doc, localField));
+    const groups = prepareCountGroups(docs, (doc) => (0, import_utils24.get)(doc, localField));
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
@@ -8765,7 +9098,7 @@ var Base = class {
     }
     const state = this.getCorrelatedExecState();
     docs = docs.map(prepareIncludeOutput);
-    const resolvedSnapshots = snapshots2 ?? docs.map((doc) => (0, import_utils23.cloneDeep)(toObject(getIncludeSource(doc))));
+    const resolvedSnapshots = snapshots2 ?? docs.map((doc) => (0, import_utils24.cloneDeep)(toObject(getIncludeSource(doc))));
     for (const include of correlatedIncludes) {
       switch (include.op) {
         case "read":
@@ -9114,10 +9447,10 @@ var Base = class {
     }
     let ret = result2.data;
     if (sqOptions.path) {
-      ret = (0, import_utils23.isArray)(ret) ? (0, import_utils23.flatten)(ret.map((v) => (0, import_utils23.get)(v, sqOptions.path))) : (0, import_utils23.get)(ret, sqOptions.path);
+      ret = (0, import_utils24.isArray)(ret) ? (0, import_utils24.flatten)(ret.map((v) => (0, import_utils24.get)(v, sqOptions.path))) : (0, import_utils24.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils23.compact)((0, import_utils23.castArray)(ret));
+      ret = (0, import_utils24.compact)((0, import_utils24.castArray)(ret));
     }
     return ret;
   }
@@ -9129,11 +9462,11 @@ var Base = class {
 };
 
 // src/services/service.ts
-var import_utils34 = require("@web-ts-toolkit/utils");
+var import_utils35 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 
 // src/model.ts
-var import_utils24 = require("@web-ts-toolkit/utils");
+var import_utils25 = require("@web-ts-toolkit/utils");
 init_runtime_context();
 init_runtime();
 function admitModelPersistence(adapter, scheduler) {
@@ -9209,7 +9542,7 @@ var Model = class {
   }
   /** Cast a copy using this model's query schema/setters, without executing query middleware or persistence. */
   castFilter(filter2) {
-    const query = this.mongooseModel.countDocuments((0, import_utils24.cloneDeep)(filter2));
+    const query = this.mongooseModel.countDocuments((0, import_utils25.cloneDeep)(filter2));
     return query.cast(this.mongooseModel);
   }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
@@ -9223,7 +9556,7 @@ var Model = class {
 var model_default = Model;
 
 // src/acl/distinct-field-authorization.ts
-var import_utils25 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 init_field_authorization();
 init_field_catalog();
 var schemaVariants = (schema) => Object.values(schema.discriminators ?? {});
@@ -9305,8 +9638,8 @@ function isDistinctFieldAuthorized(args) {
       if (path !== field && !path.startsWith(`${field}.`) && !field.startsWith(`${path}.`)) continue;
       if (path.startsWith(`${field}.`) && (!eligible(path) || !schemaShape(schema, path) || !granted(path)))
         return false;
-      if ((0, import_utils25.isPlainObject)(raw) && raw.sub !== void 0) {
-        if (!(0, import_utils25.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
+      if ((0, import_utils26.isPlainObject)(raw) && raw.sub !== void 0) {
+        if (!(0, import_utils26.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
       }
     }
     return true;
@@ -9483,7 +9816,7 @@ init_document();
 init_populate_target();
 
 // src/helpers/apply-update.ts
-var import_utils29 = require("@web-ts-toolkit/utils");
+var import_utils30 = require("@web-ts-toolkit/utils");
 init_lib();
 function applyUpdate(target, data, allowedFields) {
   const wholeFields = /* @__PURE__ */ new Set();
@@ -9499,17 +9832,17 @@ function applyUpdate(target, data, allowedFields) {
     }
   };
   for (const field of allowedFields) {
-    collectBoundary((0, import_utils29.set)({}, field, true));
+    collectBoundary((0, import_utils30.set)({}, field, true));
   }
   const apply = (values, prefix = "") => {
     for (const [key, value] of Object.entries(values)) {
       const path = prefix ? `${prefix}.${key}` : key;
-      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils29.isPlainObject)(value) || Array.isArray(value))) {
+      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils30.isPlainObject)(value) || Array.isArray(value))) {
         apply(value, path);
       } else if (isDocument2(target)) {
         target.set(path, value);
       } else {
-        (0, import_utils29.set)(target, path, value);
+        (0, import_utils30.set)(target, path, value);
       }
     }
   };
@@ -9517,7 +9850,7 @@ function applyUpdate(target, data, allowedFields) {
 }
 
 // src/acl/model-input-admission.ts
-var import_utils31 = require("@web-ts-toolkit/utils");
+var import_utils32 = require("@web-ts-toolkit/utils");
 var import_mongoose8 = require("mongoose");
 init_document();
 init_request_work();
@@ -9525,7 +9858,7 @@ init_logger_helpers();
 init_request_complexity();
 
 // src/acl/select-resolution.ts
-var import_utils30 = require("@web-ts-toolkit/utils");
+var import_utils31 = require("@web-ts-toolkit/utils");
 init_core_shared();
 init_helpers();
 async function collectAllowedFieldsForRequest({
@@ -9599,15 +9932,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils30.difference)(fields, normalizedSelect);
+        fields = (0, import_utils31.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils30.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils31.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(strippedAlways);
   }
-  return (0, import_utils30.intersection)(normalizedSelect, fields);
+  return (0, import_utils31.intersection)(normalizedSelect, fields);
 }
 function stripVirtuals(fields, virtualNames) {
   const set13 = virtualNames instanceof Set ? virtualNames : new Set(virtualNames ?? []);
@@ -9638,7 +9971,7 @@ init_field_catalog();
 init_service_authorization();
 var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var inside = (path, root) => path === root || path.startsWith(`${root}.`);
-var record2 = (value) => (0, import_utils31.isPlainObject)(value);
+var record2 = (value) => (0, import_utils32.isPlainObject)(value);
 function inputValue(value) {
   if (typeof value === "function" || typeof value === "symbol") {
     authorizationError("input values must be persisted data, not functions or symbols");
@@ -9707,7 +10040,7 @@ function requestBoundaries(fields) {
       else visit(value, path);
     }
   };
-  for (const field of fields) visit((0, import_utils31.set)({}, field, true));
+  for (const field of fields) visit((0, import_utils32.set)({}, field, true));
   return [...new Set(result2)];
 }
 function ownValue(data, parts) {
@@ -9837,7 +10170,7 @@ function admitModelInput(args) {
     if (forbidden(catalog, path, requested)) continue;
     const supplied = ownValue(data, parts);
     if (!supplied) continue;
-    (0, import_utils31.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
+    (0, import_utils32.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
     selected.push(field);
   }
   return { allowedData, allowedFields };
@@ -9849,7 +10182,7 @@ async function requestInputFields(args) {
   const prefix = configuration.modelPermissionPrefix ?? "";
   return collectModelRequestFields({
     req: args.binding.request,
-    permissionSchema: args.scopePath ? (0, import_utils31.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
+    permissionSchema: args.scopePath ? (0, import_utils32.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
     access: args.access,
     permissions,
     grants,
@@ -9893,13 +10226,13 @@ init_logger_helpers();
 init_lib();
 
 // src/services/model-subdocument-service.ts
-var import_utils33 = require("@web-ts-toolkit/utils");
+var import_utils34 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_public_admission();
 
 // src/acl/subdocument-authorization.ts
-var import_utils32 = require("@web-ts-toolkit/utils");
+var import_utils33 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_core_shared();
@@ -10088,8 +10421,8 @@ async function subdocumentGateAllowed(service, gate) {
   let guard2;
   if (access.startsWith("subs.")) {
     const [, sub, op] = access.split(".");
-    guard2 = (0, import_utils32.get)(configuration, `operationAccess.${access}`);
-    if (guard2 === void 0) guard2 = (0, import_utils32.get)(configuration, `operationAccess.subs.${sub}`);
+    guard2 = (0, import_utils33.get)(configuration, `operationAccess.${access}`);
+    if (guard2 === void 0) guard2 = (0, import_utils33.get)(configuration, `operationAccess.subs.${sub}`);
     if (guard2 === void 0) guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${op}`);
   } else guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${access}`);
   return evaluateRouteGuard(
@@ -10220,7 +10553,7 @@ async function visibleMutationRows(service, call, parentId, rows2) {
     const read = await subdocumentRows(service, visibility.child, selected, selected, call.sub);
     const list = visibility.list ? await subdocumentRows(service, visibility.list, {}, {}, call.sub) : {};
     if (read === false || list === false) return [];
-    const visible = filterCollection((0, import_utils33.get)(parent, call.sub), intersectFilters(read, list));
+    const visible = filterCollection((0, import_utils34.get)(parent, call.sub), intersectFilters(read, list));
     return await finalizeSubdocumentRows(service, call.output, parent, visible);
   } catch {
     return [];
@@ -10245,7 +10578,7 @@ async function listSub(service, id, sub, options) {
       populate: []
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const rows2 = filterCollection((0, import_utils33.get)(parent, sub), childFilter);
+    const rows2 = filterCollection((0, import_utils34.get)(parent, sub), childFilter);
     const data = await finalizeSubdocumentRows(service, call.output, parent, rows2);
     return { success: true, kind: "list", code: "success" /* Success */, data, count: data.length };
   });
@@ -10269,7 +10602,7 @@ async function readSub(service, id, sub, subId, options) {
     });
     if (!parent) return denied2("not_found" /* NotFound */);
     const row = findElement(
-      (0, import_utils33.get)(capture ? parent : copySubdocumentParent(parent), sub),
+      (0, import_utils34.get)(capture ? parent : copySubdocumentParent(parent), sub),
       childFilter
     );
     if (!row) return denied2("not_found" /* NotFound */);
@@ -10290,7 +10623,7 @@ async function updateSub(service, persist, id, sub, subId, data, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils33.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils34.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     const original = isolateDocForOutput(row);
     const admit = await inputAdmission(service, call, parent);
@@ -10317,7 +10650,7 @@ async function bulkUpdateSub(service, persist, id, sub, data, options) {
     const selected = { _id: { $in: data.map((row) => row._id) } };
     const filter2 = await subdocumentRows(service, call.child, selected, selected, sub);
     if (filter2 === false) return denied2();
-    const rows2 = filterCollection((0, import_utils33.get)(parent, sub), filter2);
+    const rows2 = filterCollection((0, import_utils34.get)(parent, sub), filter2);
     const originals = rows2.map((row) => isolateDocForOutput(row));
     const admit = await inputAdmission(service, call, parent);
     for (const [index, row] of rows2.entries()) {
@@ -10346,7 +10679,7 @@ async function createSub(service, persist, id, sub, data, options) {
     const lookup = await mutationParent(service, id, call);
     if ("error" in lookup) return lookup.error;
     const { parent } = lookup;
-    const rows2 = (0, import_utils33.get)(parent, sub);
+    const rows2 = (0, import_utils34.get)(parent, sub);
     const admit = await inputAdmission(service, call, parent);
     const allowed = (Array.isArray(data) ? data : [data]).map((row) => admit(row).allowedData);
     if (addFirst) rows2.unshift(...allowed);
@@ -10367,7 +10700,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils33.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils34.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     await ("deleteOne" in row ? row.deleteOne?.() : row.remove?.());
     await persist(() => parent.save());
@@ -10640,7 +10973,8 @@ var Service = class extends Base {
   async finalizeDirectOutput(args) {
     const { plan, context } = args;
     const { authorization, authorizationBinding: binding } = plan;
-    const { access, configuration } = readServiceAuthorization(authorization, binding);
+    const access = readServiceAuthorizationAccess(authorization, binding);
+    const configuration = readServiceOutputMetadata(authorization, binding);
     const source = getIncludeSource(args.doc);
     const snapshot = isolateDocForOutput(source);
     for (const key of Object.keys(snapshot))
@@ -10681,20 +11015,20 @@ var Service = class extends Base {
     const field = configuration.documentPermissionField ?? "_permissions";
     unsetDocPath(output, field);
     if (!configuration.stripPermissionsField) {
-      (0, import_utils34.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
+      (0, import_utils35.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
       if (args.includeFieldPermissions && !configuration.disableFieldPermissions) {
         const rowAccess = this.asServiceHookContext(context).fieldPermissionAccess ?? await this.getFieldPermissionAccess([snapshot._id]);
         const id = String(snapshot._id);
         const views = rowAccess.readIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "read") : [];
         const edits = rowAccess.updateIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "update") : [];
         const map2 = (paths) => paths.length ? Object.fromEntries(paths.map((path) => [path, true])) : { $: "_" };
-        (0, import_utils34.set)(output, `${field}._view`, map2(views));
-        (0, import_utils34.set)(output, `${field}._edit`, map2(edits));
-      } else if (!args.includePermissions) (0, import_utils34.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
+        (0, import_utils35.set)(output, `${field}._view`, map2(views));
+        (0, import_utils35.set)(output, `${field}._edit`, map2(edits));
+      } else if (!args.includePermissions) (0, import_utils35.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
       const exposed = configuration.exposedDocPermissionKeys;
       if (exposed) {
-        const metadata = (0, import_utils34.get)(output, field);
-        (0, import_utils34.set)(
+        const metadata = (0, import_utils35.get)(output, field);
+        (0, import_utils35.set)(
           output,
           field,
           Object.fromEntries(
@@ -10955,7 +11289,7 @@ var Service = class extends Base {
     return docs.map((doc) => {
       try {
         const plain = toObject(doc);
-        const val = (0, import_utils34.get)(plain, associationField);
+        const val = (0, import_utils35.get)(plain, associationField);
         return deepIsolateValue(val);
       } catch {
         return void 0;
@@ -10994,10 +11328,6 @@ var Service = class extends Base {
       const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
       const modelName = target?.modelName;
       if (!modelName) continue;
-      if (target.kind === "passthrough") {
-        result2.push({ path: descriptor.path, select: descriptor.select });
-        continue;
-      }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
       const svc = this.requestCore.getPublicService(modelName);
       const child = createRelatedExecution(
@@ -11016,7 +11346,7 @@ var Service = class extends Base {
       if (isExecutionRowDenied(svc, child)) continue;
       const childState = readServiceExecution(svc, child);
       const targetConfiguration = readServiceAuthorization(childState.authorization, childState.binding).configuration;
-      if (policy?.operation.mode !== "grant" && !await this.hookGate.run(
+      if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && policy?.operation.mode !== "grant" && !await this.hookGate.run(
         () => evaluateRouteGuard(
           this.req,
           getAuthorizationPermissions(childState.authorization, childState.binding),
@@ -11068,7 +11398,7 @@ var Service = class extends Base {
     if (this.isScalarPopulateValue(rawTarget)) return rawTarget;
     const isDoc = (() => {
       try {
-        if ((0, import_utils34.isPlainObject)(rawTarget)) return true;
+        if ((0, import_utils35.isPlainObject)(rawTarget)) return true;
         const maybe = rawTarget;
         if (maybe && typeof maybe === "object" && "_doc" in maybe) return true;
         if (maybe && typeof maybe.toObject === "function") return true;
@@ -11156,7 +11486,7 @@ var Service = class extends Base {
       child = getDocValue(current, key);
       if (child === void 0) {
         try {
-          child = (0, import_utils34.get)(current, key);
+          child = (0, import_utils35.get)(current, key);
         } catch {
           return;
         }
@@ -11391,7 +11721,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    const correlatedSnapshots = [(0, import_utils34.cloneDeep)(toObject(doc))];
+    const correlatedSnapshots = [(0, import_utils35.cloneDeep)(toObject(doc))];
     try {
       doc = await this.includeDocs(doc, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -11573,7 +11903,7 @@ var Service = class extends Base {
     const findAssociationField = this.getAssociationFieldFromOptions(options);
     const withAssocSelect = findAssociationField && !finalSelect.includes(findAssociationField) ? [...finalSelect, findAssociationField] : finalSelect;
     const dbSelect = this.buildDbSelectForAssociation(withAssocSelect, findAssociationField);
-    const filteredPopulate = (0, import_utils34.isArray)(withAssocSelect) && (0, import_utils34.isArray)(_populate) ? _populate.filter(
+    const filteredPopulate = (0, import_utils35.isArray)(withAssocSelect) && (0, import_utils35.isArray)(_populate) ? _populate.filter(
       (p) => [
         ...virtualPlan.publicPersistedFetchSelection,
         ...findAssociationField ? [findAssociationField] : []
@@ -11633,7 +11963,7 @@ var Service = class extends Base {
         findAssociationField ? [findAssociationField] : []
       );
     const capturedAssociation = findAssociationField ? this.captureAssociationValues(docs, findAssociationField) : void 0;
-    const correlatedSnapshots = docs.map((doc) => (0, import_utils34.cloneDeep)(toObject(doc)));
+    const correlatedSnapshots = docs.map((doc) => (0, import_utils35.cloneDeep)(toObject(doc)));
     try {
       docs = await this.includeDocs(docs, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -11832,12 +12162,12 @@ var Service = class extends Base {
       context.allowedFields = allowedFields;
       context.allowedData = allowedData;
       const validated = await this.validate(allowedData, "create", context);
-      if ((0, import_utils34.isBoolean)(validated)) {
+      if ((0, import_utils35.isBoolean)(validated)) {
         if (!validated) {
           validationErrors.push({ index, errors: [] });
           return void 0;
         }
-      } else if ((0, import_utils34.isArray)(validated)) {
+      } else if ((0, import_utils35.isArray)(validated)) {
         if (validated.length > 0) {
           validationErrors.push({
             index,
@@ -12048,7 +12378,7 @@ var Service = class extends Base {
     }
     let doc = await this.model.findOne({
       filter: _filter,
-      select: (0, import_utils34.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
+      select: (0, import_utils35.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
         (path) => `+${path}`
       )
     });
@@ -12087,12 +12417,12 @@ var Service = class extends Base {
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils34.isBoolean)(validated)) {
+    if ((0, import_utils35.isBoolean)(validated)) {
       if (!validated) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
       }
-    } else if ((0, import_utils34.isArray)(validated)) {
+    } else if ((0, import_utils35.isArray)(validated)) {
       if (validated.length > 0) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
@@ -12112,10 +12442,10 @@ var Service = class extends Base {
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_just_diff.diff)(
-        (0, import_utils34.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils34.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils35.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils35.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils34.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
+      context.modifiedPaths = (0, import_utils35.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -12203,7 +12533,7 @@ var Service = class extends Base {
       const upsertOptions = this.resolveUpsertOptions(options);
       const updateIntent = captureModelServiceIntent(this, "updateOne", upsertArgs, upsertOptions);
       const createIntent = captureModelServiceIntent(this, "create", upsertArgs, upsertOptions);
-      const related = (0, import_utils34.uniqBy)(
+      const related = (0, import_utils35.uniqBy)(
         [...this.captureRelated(updateIntent.args), ...this.captureRelated(createIntent.args)],
         (target) => target.path
       );
@@ -12644,7 +12974,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils34.compact)((0, import_utils34.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
+    const uniqueIds = (0, import_utils35.compact)((0, import_utils35.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -12690,7 +13020,7 @@ var Service = class extends Base {
    * (direct/root-entry 200); count measures visible rows, not all updated rows.
    */
   async bulkUpdateSub(id, sub, data, options) {
-    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils34.castArray)(data), options);
+    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils35.castArray)(data), options);
   }
   /**
    * Append/prepend admitted rows, then return the visible full array (including when
@@ -12714,7 +13044,7 @@ var Service = class extends Base {
 };
 
 // src/services/public-service.ts
-var import_utils35 = require("@web-ts-toolkit/utils");
+var import_utils36 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_permissions_alias();
 init_document();
@@ -12840,7 +13170,7 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
         d = this.runTasks(d, tasks);
-        if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
         return d;
       }
     );
@@ -13059,8 +13389,8 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
         d = this.runTasks(d, tasks);
-        if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
-        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, returningKeys));
+        if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, returningKeys));
         return d;
       }
     );
@@ -13143,8 +13473,8 @@ var PublicService = class extends Service {
             let d = toObject(doc);
             d = await this.decorate(d, "update", context);
             d = this.runTasks(d, tasks2);
-            if (select) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
-            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, returningKeys));
+            if (select) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, returningKeys));
             return d;
           }
         );
@@ -13169,7 +13499,7 @@ var PublicService = class extends Service {
           d = await this.decorate(d, "create", context);
           d = this.runTasks(d, tasks);
           if (createSelect)
-            d = copyPermissionsAlias(d, (0, import_utils35.pick)(d, [...normalizeSelect(createSelect), ...this.baseFieldsExt]));
+            d = copyPermissionsAlias(d, (0, import_utils36.pick)(d, [...normalizeSelect(createSelect), ...this.baseFieldsExt]));
           return d;
         }
       );
@@ -13314,7 +13644,7 @@ var PublicService = class extends Service {
 init_options();
 init_data_values();
 init_helpers();
-var import_utils36 = require("@web-ts-toolkit/utils");
+var import_utils37 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_runtime_context();
 init_runtime();
@@ -13343,7 +13673,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils36.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils37.pick)(doc, _select);
     return {
       success: true,
       kind: "single",
@@ -13389,13 +13719,13 @@ var DataService = class {
     const totalCount = docs.length;
     if (sort) {
       const normalizedSort = normalizeSortForOrderBy(sort);
-      docs = (0, import_utils36.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
+      docs = (0, import_utils37.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
     }
     const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     const { maxHookConcurrency } = this.getRequestComplexity();
     const trimmed = await mapWithConcurrencyLimit(pagedDocs, maxHookConcurrency, async (doc) => {
       doc = await this.trimOutputFields(doc, "list");
-      if (_select.length > 0) doc = (0, import_utils36.pick)(doc, _select);
+      if (_select.length > 0) doc = (0, import_utils37.pick)(doc, _select);
       return copyDataValue(doc);
     });
     if (!hasExplicitLimit && trimmed.length === totalCount) {
@@ -13470,10 +13800,10 @@ var DataService = class {
 init_helpers();
 
 // src/processors.ts
-var import_utils37 = require("@web-ts-toolkit/utils");
+var import_utils38 = require("@web-ts-toolkit/utils");
 init_permissions_alias();
 function cloneProcessorValue(value) {
-  const copy = (0, import_utils37.cloneDeep)(value);
+  const copy = (0, import_utils38.cloneDeep)(value);
   copyPermissionsAliasGraph(value, copy);
   return copy;
 }
@@ -13511,10 +13841,10 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!(0, import_utils37.isPlainObject)(target)) return ret;
+      if (!(0, import_utils38.isPlainObject)(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
-      if ((0, import_utils37.isArray)(next)) {
+      if ((0, import_utils38.isArray)(next)) {
         for (const item of next) {
           ret.push(item);
         }
@@ -13524,8 +13854,8 @@ function resolveLeafParents(obj, src) {
   }
   const leaf = segs[segs.length - 1];
   const pairs = [];
-  (0, import_utils37.forEach)(targets, (target) => {
-    if (!(0, import_utils37.isPlainObject)(target)) return;
+  (0, import_utils38.forEach)(targets, (target) => {
+    if (!(0, import_utils38.isPlainObject)(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -13534,7 +13864,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
   const mutable = options.mutable !== false;
   const idField = options.idField ?? "_id";
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13543,19 +13873,19 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     assertSafePath(dest);
     let targets = [obj];
     const segs = src.split(".");
-    (0, import_utils37.forEach)(segs, (seg, ind) => {
+    (0, import_utils38.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils37.forEach)(targets, (target) => {
-          if (!(0, import_utils37.isPlainObject)(target)) return;
+        (0, import_utils38.forEach)(targets, (target) => {
+          if (!(0, import_utils38.isPlainObject)(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
           let depopulated;
-          if ((0, import_utils37.isArray)(leaf)) {
+          if ((0, import_utils38.isArray)(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => (0, import_utils37.isPlainObject)(item))) {
-              depopulated = (0, import_utils37.map)(leaf, idField).map((id, i) => {
+            } else if (leaf.every((item) => (0, import_utils38.isPlainObject)(item))) {
+              depopulated = (0, import_utils38.map)(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
                 }
@@ -13564,8 +13894,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if ((0, import_utils37.isPlainObject)(leaf)) {
-            const id = (0, import_utils37.get)(leaf, idField);
+          } else if ((0, import_utils38.isPlainObject)(leaf)) {
+            const id = (0, import_utils38.get)(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
             }
@@ -13573,15 +13903,15 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           } else {
             return;
           }
-          (0, import_utils37.set)(targetObject, dest, sourceForDest);
-          (0, import_utils37.set)(targetObject, seg, depopulated);
+          (0, import_utils38.set)(targetObject, dest, sourceForDest);
+          (0, import_utils38.set)(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!(0, import_utils37.isPlainObject)(target)) return ret;
+          if (!(0, import_utils38.isPlainObject)(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
-          if ((0, import_utils37.isArray)(next)) {
+          if ((0, import_utils38.isArray)(next)) {
             for (const item of next) {
               ret.push(item);
             }
@@ -13596,7 +13926,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
 var copyPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13604,9 +13934,9 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "copyPaths");
     assertSafePath(dest, "copyPaths");
     if (src === dest) return;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
-      (0, import_utils37.set)(parent, dest, cloneProcessorValue(parent[leaf]));
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
+      (0, import_utils38.set)(parent, dest, cloneProcessorValue(parent[leaf]));
     });
   });
   return obj;
@@ -13614,7 +13944,7 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
 var movePaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -13622,10 +13952,10 @@ var movePaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "movePaths");
     assertSafePath(dest, "movePaths");
     if (src === dest) return;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
       const value = cloneProcessorValue(parent[leaf]);
-      (0, import_utils37.set)(parent, dest, value);
+      (0, import_utils38.set)(parent, dest, value);
       if (dest === leaf || dest.startsWith(`${leaf}.`)) return;
       delete parent[leaf];
     });
@@ -13637,7 +13967,7 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
   const maxSlice = options.maxSlice ?? DEFAULT_MAX_SLICE;
   assertNonNegativeSafeInteger(maxSlice, "maxSlice", "sliceArrays");
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
@@ -13654,15 +13984,15 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
       assertNonNegativeSafeInteger(op.limit, "limit", "sliceArrays");
       limit = Math.min(op.limit, maxSlice);
     }
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       const leafValue = parent[leaf];
-      if (!(0, import_utils37.isArray)(leafValue)) return;
+      if (!(0, import_utils38.isArray)(leafValue)) return;
       const end = typeof limit === "undefined" ? void 0 : skip + limit;
       const window = leafValue.slice(skip, end);
       if (typeof rawDest === "undefined") {
-        (0, import_utils37.set)(parent, leaf, window);
+        (0, import_utils38.set)(parent, leaf, window);
       } else {
-        (0, import_utils37.set)(parent, rawDest, window);
+        (0, import_utils38.set)(parent, rawDest, window);
       }
     });
   });
@@ -13671,27 +14001,27 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
 var countPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
     if (src.length === 0 || dest.length === 0) return;
     assertSafePath(src, "countPaths");
     assertSafePath(dest, "countPaths");
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
       const leafValue = parent[leaf];
       let count;
-      if ((0, import_utils37.isArray)(leafValue)) {
+      if ((0, import_utils38.isArray)(leafValue)) {
         count = leafValue.length;
-      } else if ((0, import_utils37.isPlainObject)(leafValue)) {
+      } else if ((0, import_utils38.isPlainObject)(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
       } else {
         count = 1;
       }
-      (0, import_utils37.set)(parent, dest, count);
+      (0, import_utils38.set)(parent, dest, count);
     });
   });
   return obj;
@@ -13699,15 +14029,15 @@ var countPaths = (docObject, operations, options = { mutable: true }) => {
 var maskPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
   const obj = mutable ? docObject : cloneProcessorValue(docObject);
-  (0, import_utils37.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  (0, import_utils38.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
     assertSafePath(src, "maskPaths");
     const replacement = Object.prototype.hasOwnProperty.call(op, "replacement") ? op.replacement : DEFAULT_MASK_REPLACEMENT;
-    (0, import_utils37.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils37.hasOwn)(parent, leaf)) return;
-      (0, import_utils37.set)(parent, leaf, replacement);
+    (0, import_utils38.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils38.hasOwn)(parent, leaf)) return;
+      (0, import_utils38.set)(parent, leaf, replacement);
     });
   });
   return obj;
@@ -13762,6 +14092,8 @@ init_core_shared();
 init_virtual_projection();
 init_populate_target();
 init_model_output_planning();
+init_authorization_snapshot();
+init_document();
 init_output_field_filter();
 init_request_work();
 var emptyPermissionLeaf = () => ({ $: "_" });
@@ -13779,10 +14111,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils38.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils39.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils38.isString)(idField)) {
+    if ((0, import_utils39.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -13872,17 +14204,11 @@ var Core = class {
     return this.genSelect(modelName, access, targetFields, options);
   }
   /** Persisted request-only populate admission; fetch planning is not field authority. */
-  async requestPopulateSelect(modelName, access, targetFields = null, scopePath = []) {
+  async requestPopulateSelect(configuration, permissions, access, targetFields = null, scopePath = []) {
     const subPaths = scopePath.flatMap((part) => [part, "sub"]);
-    const permissionSchema = getModelOption(modelName, ["permissionSchema"].concat(subPaths).join("."));
-    const permissions = this.getGlobalPermissions();
-    let virtualNames;
-    try {
-      const runtime = getActiveRuntime() ?? defaultRuntime;
-      virtualNames = runtime.getVirtualNames(modelName, subPaths);
-    } catch {
-      virtualNames = [];
-    }
+    const permissionSchema = (0, import_utils39.get)(configuration, ["permissionSchema", ...subPaths]);
+    const prefix = scopePath.length ? `${scopePath.join(".")}.` : "";
+    const virtualNames = (configuration.catalog.virtualPaths ?? []).filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).filter((path) => !path.includes("."));
     return resolveSelectForRequest({
       req: this.req,
       permissionSchema,
@@ -13901,17 +14227,25 @@ var Core = class {
     assertPublicAdmission(_populate, "populate");
     assertPopulateAccess(access);
     if (!_populate) return [];
-    let populate = Array.isArray(_populate) ? _populate : [_populate];
-    for (const p of populate) {
-      if (!(0, import_utils38.isString)(p)) assertPopulateAccess(p.access);
-    }
-    populate = (0, import_utils38.compact)(
+    const descriptors = copyAuthorizationValue(Array.isArray(_populate) ? _populate : [_populate], true);
+    for (const p of descriptors) {
+      if (!(0, import_utils39.isString)(p)) assertPopulateAccess(p.access);
+    }
+    const runtime = this.requestRuntime;
+    const globalOptions = modelServiceGlobalOptions(this, runtime);
+    const relatedTargets = captureRelatedTargets(runtime, modelName, { populate: descriptors }, 0, globalOptions);
+    const sourceConfiguration = captureModelAuthorizationConfiguration(runtime, modelName, void 0, globalOptions);
+    const originalPermissions = this.getGlobalPermissions();
+    const permissions = new permission_default(
+      Object.fromEntries(originalPermissions.keys.map((key) => [key, originalPermissions.has(key)]))
+    );
+    const populate = (0, import_utils39.compact)(
       await Promise.all(
-        populate.map(async (p) => {
-          const populateAccess = !(0, import_utils38.isString)(p) && p.access ? p.access : access;
+        descriptors.map(async (p) => {
+          const populateAccess = !(0, import_utils39.isString)(p) && p.access ? p.access : access;
           assertPopulateAccess(populateAccess);
-          const originalSelect = (0, import_utils38.isString)(p) ? void 0 : p.select;
-          const ret = (0, import_utils38.isString)(p) ? { path: p } : {
+          const originalSelect = (0, import_utils39.isString)(p) ? void 0 : p.select;
+          const ret = (0, import_utils39.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -13919,78 +14253,86 @@ var Core = class {
           const pathForSourcePermission = scopePrefix && ret.path.startsWith(`${scopePrefix}.`) ? ret.path.slice(scopePrefix.length + 1) : ret.path;
           const parentPath = pathForSourcePermission.includes(".") ? pathForSourcePermission.split(".")[0] : pathForSourcePermission;
           const allowedParentPaths = await this.requestPopulateSelect(
-            modelName,
+            sourceConfiguration,
+            permissions,
             populateAccess,
             [parentPath],
             scopePath
           );
           if (!allowedParentPaths.includes(parentPath)) return null;
-          const refModelName = getModelRef(modelName, ret.path);
-          if (!refModelName) return null;
-          const runtime = getActiveRuntime();
-          if (!runtime) return null;
-          const requireRegisteredPopulateModels = getGlobalOption("requireRegisteredPopulateModels", true);
-          if (!runtime.hasModel(refModelName)) {
-            return requireRegisteredPopulateModels ? null : ret;
-          }
-          const allowedTargetOperation = await this.isAllowed(refModelName, populateAccess);
-          if (!allowedTargetOperation) {
+          const target = relatedTargets.find((entry) => entry.path === ret.path);
+          if (!target) return null;
+          const refModelName = target.modelName;
+          const targetConfiguration = target.configuration;
+          if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && !await withCapturedModelOperationGuard(
+            this,
+            refModelName,
+            populateAccess,
+            getCapturedAuthorizationOption(targetConfiguration, `operationAccess.${populateAccess}`),
+            permissions,
+            () => this.isAllowed(refModelName, populateAccess)
+          )) {
             return null;
           }
-          ret.select = await this.requestPopulateSelect(refModelName, populateAccess, ret.select);
-          const hookInputs = getModelOption(refModelName, `alwaysSelectFields.${populateAccess}`, []);
-          ret.select = (0, import_utils38.uniq)([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
-          const filter2 = await this.genFilter(refModelName, populateAccess, null);
+          ret.select = await this.requestPopulateSelect(
+            targetConfiguration,
+            permissions,
+            populateAccess,
+            ret.select
+          );
+          const hookInputs = resolveAlwaysSelectForAccess(
+            targetConfiguration.alwaysSelectFields,
+            populateAccess
+          );
+          ret.select = (0, import_utils39.uniq)([
+            ...ret.select,
+            ...stripVirtuals(hookInputs, [...targetConfiguration.catalog.virtualPaths ?? []])
+          ]);
+          const match = (0, import_utils39.isString)(p) ? {} : p.match ?? {};
+          const filter2 = await resolveAccessFilterForRequest({
+            req: this.req,
+            permissions,
+            cache: this.caches.baseFilter,
+            cacheKey: `${refModelName}_baseFilter_${populateAccess}`,
+            access: populateAccess,
+            filter: deepIsolateValue(match),
+            getOption: (key) => getCapturedAuthorizationOption(targetConfiguration, key)
+          });
           if (filter2 === false) return null;
-          ret.match = filter2;
-          try {
-            const planAccess = populateAccess;
-            const targetSnapshot = {
-              permissionSchema: getModelOption(refModelName, "permissionSchema", null) ?? null,
-              virtuals: getModelOption(refModelName, "virtuals", null) ?? null,
-              alwaysSelectFields: getModelOption(refModelName, "alwaysSelectFields", null) ?? null,
-              modelPermissionPrefix: getModelOption(refModelName, "modelPermissionPrefix", "") ?? "",
-              requireExplicitSelect: getModelOption(refModelName, "requireExplicitSelect", false) ?? false,
-              documentPermissionField: getModelOption(refModelName, "documentPermissionField", "_permissions") ?? "_permissions",
-              exposedDocPermissionKeys: getModelOption(refModelName, "exposedDocPermissionKeys", void 0),
-              stripPermissionsField: getModelOption(refModelName, "stripPermissionsField", false) ?? false,
-              disableFieldPermissions: getModelOption(refModelName, "disableFieldPermissions", false) ?? false
-            };
-            const perms = this.getPermissions();
-            const globalForPlan = perms && typeof perms.has === "function" && typeof perms.hasKey === "function" ? perms : { has: () => false, hasKey: () => false };
-            const targetPlan = planVirtualProjection({
-              receivingModelName: refModelName,
-              snapshot: {
-                permissionSchema: targetSnapshot.permissionSchema,
-                virtuals: targetSnapshot.virtuals,
-                alwaysSelectFields: targetSnapshot.alwaysSelectFields,
-                modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
-                requireExplicitSelect: targetSnapshot.requireExplicitSelect,
-                documentPermissionField: targetSnapshot.documentPermissionField
-              },
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              internalFetch: { baseFields: ["_id"] },
-              globalPermissions: globalForPlan
-            });
-            const merged = (0, import_utils38.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
-              (t) => t !== "-_id" && !t.includes(".sub.")
-            );
-            if (!merged.includes("_id")) merged.push("_id");
-            ret.select = merged;
-            setPopulateTargetMeta(ret, {
-              targetModelName: refModelName,
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              plan: targetPlan,
-              snapshot: targetSnapshot
-            });
-          } catch {
-          }
+          ret.match = deepIsolateValue(intersectFilters(match, filter2));
+          const planAccess = populateAccess;
+          const targetSnapshot = targetConfiguration;
+          const targetPlan = planVirtualProjection({
+            receivingModelName: refModelName,
+            snapshot: {
+              permissionSchema: targetSnapshot.permissionSchema,
+              virtuals: targetSnapshot.virtuals,
+              alwaysSelectFields: targetSnapshot.alwaysSelectFields,
+              modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
+              requireExplicitSelect: targetSnapshot.requireExplicitSelect,
+              documentPermissionField: targetSnapshot.documentPermissionField
+            },
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            internalFetch: { baseFields: ["_id"] },
+            globalPermissions: permissions
+          });
+          const merged = (0, import_utils39.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
+            (t) => t !== "-_id" && !t.includes(".sub.")
+          );
+          if (!merged.includes("_id")) merged.push("_id");
+          ret.select = merged;
+          setPopulateTargetMeta(ret, {
+            targetModelName: refModelName,
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            plan: targetPlan,
+            snapshot: targetSnapshot
+          });
           return ret;
         })
       )
@@ -13999,10 +14341,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils38.isFunction)(validate)) {
+    if ((0, import_utils39.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils38.isBoolean)(validate) || (0, import_utils38.isArray)(validate)) {
+    } else if ((0, import_utils39.isBoolean)(validate) || (0, import_utils39.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -14027,7 +14369,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils38.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils39.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -14051,7 +14393,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils38.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils39.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await getRequestWorkState(this.req, this.requestRuntime).hookGate.run(
@@ -14135,7 +14477,7 @@ var Core = class {
       readExists ? requestFields("read") : [],
       updateExists ? requestFields("update") : []
     ]);
-    const viewObj = (0, import_utils38.reduce)(
+    const viewObj = (0, import_utils39.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -14143,7 +14485,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils38.reduce)(
+    const editObj = (0, import_utils39.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -14174,9 +14516,9 @@ var Core = class {
     });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils38.compact)((0, import_utils38.castArray)(task));
+    const tasks = (0, import_utils39.compact)((0, import_utils39.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils38.forEach)(tasks, (task2) => {
+    (0, import_utils39.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -14246,9 +14588,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils38.isUndefined)(subOption)) {
+      if ((0, import_utils39.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils38.isUndefined)(subFieldOption)) {
+        if ((0, import_utils39.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -14314,25 +14656,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils39.isPlainObject)(condition)) {
+    if ((0, import_utils40.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils39.isString)(id) ? id : null;
-      if ((0, import_utils39.isPlainObject)(id)) {
+      let _id = (0, import_utils40.isString)(id) ? id : null;
+      if ((0, import_utils40.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils39.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils40.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils39.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils40.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils39.isString)(_id) || !_id) {
+      if (!(0, import_utils40.isString)(_id) || !_id) {
         return next(new import_express_json_router5.default.clientErrors.BadRequestError());
       }
       const result2 = await svc._read(_id, { select });
@@ -14344,11 +14686,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils39.isString)(cond)) {
+    if ((0, import_utils40.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils39.isArray)(cond)) {
+    } else if ((0, import_utils40.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils39.isFunction)(cond)) {
+    } else if ((0, import_utils40.isFunction)(cond)) {
       const result2 = await cond.call(req, permissions);
       if (!!result2) return next();
     }
@@ -14361,7 +14703,7 @@ var import_express2 = __toESM(require("express"));
 
 // src/routers/model-router.ts
 var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils43 = require("@web-ts-toolkit/utils");
+var import_utils44 = require("@web-ts-toolkit/utils");
 init_logger_helpers();
 init_runtime();
 init_runtime_context();
@@ -14495,7 +14837,7 @@ init_request_complexity();
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils40 = require("@web-ts-toolkit/utils");
+var import_utils41 = require("@web-ts-toolkit/utils");
 
 // src/validation/public-admission-schema.ts
 init_public_admission();
@@ -14624,7 +14966,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils40.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils41.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -14661,7 +15003,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils40.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils41.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -14714,7 +15056,7 @@ var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, impo
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils40.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils41.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,
@@ -15687,7 +16029,7 @@ var rootQuerySchema = publicBoundarySchema(
 init_helpers();
 
 // src/routers/shared.ts
-var import_utils41 = require("@web-ts-toolkit/utils");
+var import_utils42 = require("@web-ts-toolkit/utils");
 
 // src/routers/model-router-collection-routes.ts
 init_schemas();
@@ -15718,15 +16060,15 @@ function setModelCollectionRoutes(context) {
       sort
     } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = (0, import_utils41.parseBooleanString)(include_count);
-    const includeExtraHeaders = (0, import_utils41.parseBooleanString)(include_extra_headers);
+    const includeCount = (0, import_utils42.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils42.parseBooleanString)(include_extra_headers);
     const result2 = await svc._list(
       {},
       { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
       {
-        skim: (0, import_utils41.parseBooleanString)(skim),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions),
+        skim: (0, import_utils42.parseBooleanString)(skim),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions),
         includeCount
       }
     );
@@ -15786,8 +16128,8 @@ function setModelCollectionRoutes(context) {
       data,
       {},
       {
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -15825,8 +16167,8 @@ function setModelCollectionRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -15923,9 +16265,9 @@ function setModelDocumentRoutes(context) {
       id,
       { select: parseSelectParam(select) },
       {
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions),
-        tryList: (0, import_utils41.parseBooleanString)(try_list)
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions),
+        tryList: (0, import_utils42.parseBooleanString)(try_list)
       }
     );
     handleResultError(result2);
@@ -16025,9 +16367,9 @@ function setModelDocumentRoutes(context) {
       data,
       { select: parseSelectParam(select) },
       {
-        returningAll: (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -16076,9 +16418,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -16109,9 +16451,9 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils41.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils42.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -16158,9 +16500,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils41.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils41.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils41.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils42.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils42.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils42.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -16400,11 +16742,11 @@ function setModelSubDocumentRoutes(context) {
 }
 
 // src/openapi/route-registration.ts
-var import_utils42 = require("@web-ts-toolkit/utils");
+var import_utils43 = require("@web-ts-toolkit/utils");
 function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
   runtime.registerOpenApiRoute({
     ...route,
-    path: (0, import_utils42.normalizeUrlPath)(basePath + route.path),
+    path: (0, import_utils43.normalizeUrlPath)(basePath + route.path),
     tags: route.tags ?? [defaultTag]
   });
 }
@@ -16412,8 +16754,8 @@ function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router8.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils43.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils43.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils44.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils44.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(
     this.modelName,
@@ -16615,7 +16957,7 @@ var ModelRouter = class _ModelRouter {
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils43.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils44.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router8.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName, this.runtime);
@@ -16701,13 +17043,13 @@ var ModelRouter = class _ModelRouter {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils43.forEach)(this.router.getEndpoints(), ({ method, path }) => {
-        logInfoMessage(`${(0, import_utils43.padEnd)(method, 6)} ${(0, import_utils43.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils44.forEach)(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${(0, import_utils44.padEnd)(method, 6)} ${(0, import_utils44.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils43.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils44.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -16715,7 +17057,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils43.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils44.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(
         this.modelName,
@@ -16743,7 +17085,7 @@ var ModelRouter = class _ModelRouter {
 
 // src/routers/root-router.ts
 var import_express_json_router9 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils44 = require("@web-ts-toolkit/utils");
+var import_utils45 = require("@web-ts-toolkit/utils");
 
 // src/core-data.ts
 init_options();
@@ -17051,7 +17393,7 @@ var RootRouter = class {
     this.setRoutes();
   }
   registerOpenApiRoute(route) {
-    registerOpenApiRoute(this.runtime, (0, import_utils44.normalizeUrlPath)(this.basename), "root", route);
+    registerOpenApiRoute(this.runtime, (0, import_utils45.normalizeUrlPath)(this.basename), "root", route);
   }
   wrapResult(index, item, result2) {
     return {
@@ -17160,7 +17502,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     const groups = /* @__PURE__ */ new Map();
     items.forEach((item, index) => {
-      const order = (0, import_utils44.isNumber)(item.order) ? item.order : 0;
+      const order = (0, import_utils45.isNumber)(item.order) ? item.order : 0;
       const group = groups.get(order);
       if (group) {
         group.push({ index, item });
@@ -17231,7 +17573,7 @@ var RootRouter = class {
         const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
-      return (0, import_utils44.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils45.orderBy)(results, ["index"], ["asc"]);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -17249,14 +17591,14 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 var import_express_json_router10 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils45 = require("@web-ts-toolkit/utils");
+var import_utils46 = require("@web-ts-toolkit/utils");
 init_runtime();
 init_helpers();
 init_schemas();
 var clientErrors4 = import_express_json_router10.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils45.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils45.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils46.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils46.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -17305,7 +17647,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils45.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils46.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router10.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -17338,8 +17680,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = (0, import_utils41.parseBooleanString)(include_count);
-      const includeExtraHeaders = (0, import_utils41.parseBooleanString)(include_extra_headers);
+      const includeCount = (0, import_utils42.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils42.parseBooleanString)(include_extra_headers);
       const result2 = await svc.find(
         {},
         { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
@@ -17457,7 +17799,7 @@ var DataRouter = class {
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils45.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils46.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(
         this.dataName,
@@ -17465,7 +17807,7 @@ var DataRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils45.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils46.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -17600,7 +17942,7 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    if ((0, import_utils46.isUndefined)(options)) {
+    if ((0, import_utils47.isUndefined)(options)) {
       return new RootRouter(modelName, runtime);
     }
     if (typeof modelName === "string") {
@@ -17621,10 +17963,10 @@ function createRuntimeApi(runtime) {
   };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils46.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils47.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils46.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils47.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };