@web-ts-toolkit/access-router 0.56.0 → 0.58.0

package/index.mjs

@@ -2140,10 +2140,34 @@ var init_field_catalog = __esm({
   }
 });
 
+// src/acl/populate-target-configuration.ts
+import { isPlainObject as isPlainObject12 } from "@web-ts-toolkit/utils";
+function capturePopulateTargetConfiguration(runtime, modelName, source, proposedOptions) {
+  const label = `Populate target "${modelName}" for ${source}`;
+  if (!proposedOptions && !runtime.hasModel(modelName))
+    authorizationError(
+      `${label} must be configured first in this runtime; register its Mongoose model and setModelOptions with an object permissionSchema`
+    );
+  const model = runtime.getModelInstance(modelName);
+  if (!model) authorizationError(`${label} requires an actual registered Mongoose model in this runtime`);
+  const options = proposedOptions ?? runtime.getModelOptions(modelName);
+  const permissionSchema = options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema;
+  if (!isPlainObject12(permissionSchema))
+    authorizationError(
+      `${label} requires an effective object permissionSchema; configure the model or runtime model defaults ({} explicitly closes business fields)`
+    );
+  return { model, options: { ...options, permissionSchema } };
+}
+var init_populate_target_configuration = __esm({
+  "src/acl/populate-target-configuration.ts"() {
+    init_authorization_snapshot();
+  }
+});
+
 // src/acl/virtual-populate-dependencies.ts
-import { get as get4, isPlainObject as isPlainObject12 } from "@web-ts-toolkit/utils";
+import { get as get4, isPlainObject as isPlainObject13 } from "@web-ts-toolkit/utils";
 function record(value, label) {
-  if (!isPlainObject12(value)) return fail(label, "entries must be plain { path, select? } objects");
+  if (!isPlainObject13(value)) return fail(label, "entries must be plain { path, select? } objects");
   for (const key of Reflect.ownKeys(value)) {
     const property = Object.getOwnPropertyDescriptor(value, key);
     if (typeof key !== "string" || !property.enumerable || !("value" in property))
@@ -2232,7 +2256,8 @@ function normalizeSelection(select, catalog, label) {
   };
 }
 function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
-  const requireReadOperationAccessForPopulateDependencies = globalOptions.requireReadOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateDependencies = globalOptions.requireOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateQueries = globalOptions.requireOperationAccessForPopulateQueries !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2272,7 +2297,12 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
                 label,
                 `target "${ref}" requires a registered same-connection non-discriminator ObjectId model bound to the source ref`
               );
-            const targetOptions = ref === modelName ? options : runtime.getModelOptions(ref);
+            const { options: targetOptions } = capturePopulateTargetConfiguration(
+              runtime,
+              ref,
+              `dependsOnPopulate virtual "${label}"`,
+              ref === modelName ? options : void 0
+            );
             const defaults = runtime.getDefaultModelOptions();
             const readOption = (key) => resolveNestedOption((path2, fallback) => get4(targetOptions, path2, fallback), key, get4(defaults, key));
             const documentPermissionField = targetOptions.documentPermissionField ?? defaults.documentPermissionField;
@@ -2281,7 +2311,9 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
               {
                 catalog,
                 documentPermissionField,
-                requireReadOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateQueries,
+                permissionSchema: targetOptions.permissionSchema,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2330,13 +2362,13 @@ function captureVirtualPopulateDependencies(runtime, modelName, options, globalO
         );
         continue;
       }
-      if (!isPlainObject12(raw)) continue;
+      if (!isPlainObject13(raw)) continue;
       const entry = raw;
       const label = join(sourcePrefix, name);
       captureList(entry.dependsOnPopulate, label);
       if (!("get" in entry))
         for (const access of accesses) {
-          if (isPlainObject12(entry[access]))
+          if (isPlainObject13(entry[access]))
             captureList(entry[access].dependsOnPopulate, `${label}.${access}`);
         }
       const byAccess = {};
@@ -2394,6 +2426,7 @@ var init_virtual_populate_dependencies = __esm({
     init_authorization_snapshot();
     init_field_catalog();
     init_virtual_descriptor();
+    init_populate_target_configuration();
     elementType = (type) => type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster;
     join = (prefix, path) => prefix ? `${prefix}.${path}` : path;
     within = (path, parent) => path === parent || path.startsWith(`${parent}.`);
@@ -2418,7 +2451,7 @@ import {
   isBoolean,
   isFunction as isFunction2,
   isNil as isNil2,
-  isPlainObject as isPlainObject13,
+  isPlainObject as isPlainObject14,
   isString as isString4,
   keys,
   normalizeUrlPath,
@@ -2485,7 +2518,7 @@ var init_runtime = __esm({
       const modelPermissionKeys = {};
       forEach2(schemaKeys, (schemaKey) => {
         const schemaRule = permissionSchema[schemaKey];
-        const ruleEntries = isPlainObject13(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+        const ruleEntries = isPlainObject14(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
         for (let x = 0; x < ruleEntries.length; x++) {
           const [accessKey, value] = ruleEntries[x];
           if (!isArray5(globalPermissionKeys[accessKey])) {
@@ -2526,7 +2559,7 @@ var init_runtime = __esm({
     VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
     VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
     VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-    isVirtualContainerValue2 = (value) => isPlainObject13(value) && "sub" in value;
+    isVirtualContainerValue2 = (value) => isPlainObject14(value) && "sub" in value;
     virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
@@ -2621,7 +2654,7 @@ var init_runtime = __esm({
     };
     validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
       if (isFunction2(value)) return;
-      if (!isPlainObject13(value)) {
+      if (!isPlainObject14(value)) {
         throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
       }
       const record3 = value;
@@ -2667,7 +2700,7 @@ var init_runtime = __esm({
               `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
             );
           }
-          if (!isPlainObject13(record4.sub)) {
+          if (!isPlainObject14(record4.sub)) {
             throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
           }
           continue;
@@ -2678,7 +2711,7 @@ var init_runtime = __esm({
           );
         }
         if (isFunction2(raw)) continue;
-        if (!isPlainObject13(raw)) {
+        if (!isPlainObject14(raw)) {
           throw new Error(
             `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
           );
@@ -2732,7 +2765,7 @@ var init_runtime = __esm({
     };
     validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
       if (virtuals === void 0 || virtuals === null) return;
-      if (!isPlainObject13(virtuals)) {
+      if (!isPlainObject14(virtuals)) {
         throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
       }
       const rootSchema = model?.schema ?? null;
@@ -2784,8 +2817,8 @@ var init_runtime = __esm({
           {
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
-            requireRegisteredPopulateModels: true,
-            requireReadOperationAccessForPopulateDependencies: true,
+            requireOperationAccessForPopulateQueries: true,
+            requireOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2959,13 +2992,15 @@ var init_runtime = __esm({
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
         const next = { ...options };
-        if ("requireReadOperationAccessForPopulateDependencies" in next)
-          next.requireReadOperationAccessForPopulateDependencies = next.requireReadOperationAccessForPopulateDependencies !== false;
+        if ("requireOperationAccessForPopulateQueries" in next)
+          next.requireOperationAccessForPopulateQueries = next.requireOperationAccessForPopulateQueries !== false;
+        if ("requireOperationAccessForPopulateDependencies" in next)
+          next.requireOperationAccessForPopulateDependencies = next.requireOperationAccessForPopulateDependencies !== false;
         this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
-        if (key === "requireReadOperationAccessForPopulateDependencies") {
-          this.globalOptions.set("requireReadOperationAccessForPopulateDependencies", value !== false);
+        if (key === "requireOperationAccessForPopulateQueries" || key === "requireOperationAccessForPopulateDependencies") {
+          this.globalOptions.set(key, value !== false);
           return;
         }
         this.globalOptions.set(key, value);
@@ -3088,10 +3123,10 @@ var init_runtime = __esm({
               const segments = nestedPath.split(".");
               let cursor = cloned;
               for (let i = 0; i < segments.length - 1; i++) {
-                if (!isPlainObject13(cursor)) break;
+                if (!isPlainObject14(cursor)) break;
                 cursor = cursor[segments[i]];
               }
-              if (isPlainObject13(cursor)) {
+              if (isPlainObject14(cursor)) {
                 delete cursor[segments[segments.length - 1]];
               }
               proposedVirtuals = cloned;
@@ -3499,6 +3534,47 @@ function serviceAuthorizationInput(policy, targets) {
   }
   return { rows: policy.rows, outputFields: policy.outputFields, related };
 }
+function hasStableConfigurationCopies(value) {
+  if (value === null || typeof value !== "object") return true;
+  if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return false;
+  return Object.values(value).every(hasStableConfigurationCopies);
+}
+function captureAuthorizationAccess(value) {
+  const input = authorizationRecord(value, "access");
+  const access = {};
+  for (const key of ["operation", "rowAccess", "virtualAccess", "outputAccess", "docPermissionsAccess"]) {
+    if (key === "rowAccess" && input[key] === void 0) continue;
+    if (typeof input[key] !== "string") authorizationError(`invalid access.${key}`);
+    access[key] = input[key];
+  }
+  return Object.freeze(access);
+}
+function captureAuthorizationCatalog(value) {
+  const input = authorizationRecord(value, "catalog");
+  const catalog = {};
+  for (const key of [
+    "paths",
+    "persistedPaths",
+    "arrayPaths",
+    "schemaVirtualPaths",
+    "metadataPaths",
+    "dynamicPaths",
+    "containerPaths",
+    "virtualPaths",
+    "virtualScopePaths",
+    "opaquePaths",
+    "referencePaths",
+    "protectedPaths"
+  ]) {
+    const paths = input[key];
+    if (key !== "paths" && paths === void 0) continue;
+    if (!Array.isArray(paths) || Array.from(paths).some((path) => typeof path !== "string")) {
+      authorizationError(`invalid catalog.${key}`);
+    }
+    catalog[key] = paths;
+  }
+  return Object.freeze(catalog);
+}
 function assertAuthorizationPath(path) {
   if (typeof path !== "string" || !isSafeOutputPath(path)) {
     authorizationError(`invalid response path: ${String(path)}`);
@@ -3583,7 +3659,6 @@ function normalizePolicy(value, applicability, configuration, targets) {
       const matches = targets.filter((target2) => target2.path === path);
       if (matches.length !== 1) authorizationError(`unused or ambiguous related path: ${path}`);
       const target = matches[0];
-      if (target.kind === "passthrough") authorizationError(`related policy requires a registered target: ${path}`);
       const child = authorizationRecord(entry, `related.${path}`);
       assertAuthorizationKeys(
         child,
@@ -3629,6 +3704,9 @@ function resolveServiceAuthorization(input) {
   const raw = copyAuthorizationValue(input.authorization);
   const configuration = copyAuthorizationValue(input.configuration, true);
   const targets = copyAuthorizationValue(input.relatedTargets ?? [], true);
+  const access = copyAuthorizationValue(input.access);
+  const outputAccess = captureAuthorizationAccess(access);
+  const catalog = captureAuthorizationCatalog(configuration.catalog);
   const policy = copyAuthorizationValue(normalizePolicy(raw, input.applicability ?? "service", configuration, targets));
   const scopePath = Array.from(scope(input.binding));
   for (const part of scopePath) {
@@ -3641,17 +3719,21 @@ function resolveServiceAuthorization(input) {
       authorizationError("derived call request/runtime mismatch");
     }
   }
-  const permissions = Object.fromEntries(
-    input.requestPermissions.keys.map((key) => [key, input.requestPermissions.has(key)])
+  const permissions = new permission_default(
+    Object.fromEntries(input.requestPermissions.keys.map((key) => [key, input.requestPermissions.has(key) === true]))
   );
+  for (const value of Object.values(permissions)) if (value && typeof value === "object") Object.freeze(value);
+  Object.freeze(permissions);
   const call = Object.freeze(/* @__PURE__ */ Object.create(null));
   calls.set(call, {
     binding: Object.freeze({ ...input.binding, scopePath: Object.freeze(scopePath) }),
-    access: copyAuthorizationValue(input.access),
+    access,
     configuration,
     policy,
     relatedTargets: targets,
-    permissions: Object.freeze(permissions),
+    // normalizeFields constructs only mode strings and validated string paths.
+    output: Object.freeze({ access: outputAccess, catalog, outputFields: policy.outputFields }),
+    permissions,
     provenance: input.parent ? callRecord(input.parent).provenance : call
   });
   return call;
@@ -3669,12 +3751,75 @@ function readServiceAuthorization(call, binding) {
     true
   );
 }
+function readServiceAuthorizationAccess(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return callRecord(call).output.access;
+}
+function readServiceAuthorizationHydration(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return copyAuthorizationValue({ hydration: callRecord(call).configuration.hydration }, true);
+}
+function outputMetadata(configuration) {
+  return {
+    documentPermissionField: configuration.documentPermissionField,
+    exposedDocPermissionKeys: configuration.exposedDocPermissionKeys,
+    stripPermissionsField: configuration.stripPermissionsField,
+    disableFieldPermissions: configuration.disableFieldPermissions
+  };
+}
+function readServiceOutputMetadata(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return copyAuthorizationValue(outputMetadata(callRecord(call).configuration), true);
+}
+function readServiceDocumentPermissions(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  return Object.freeze({
+    catalog: record3.output.catalog,
+    ...copyAuthorizationValue({ docPermissions: record3.configuration.docPermissions }, true)
+  });
+}
+function readServiceFinalizerConfiguration(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  return Object.freeze({
+    catalog: record3.output.catalog,
+    ...copyAuthorizationValue(
+      {
+        ...outputMetadata(record3.configuration),
+        virtuals: record3.configuration.virtuals,
+        docPermissions: record3.configuration.docPermissions
+      },
+      true
+    )
+  });
+}
+function readServiceOutputPolicy(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return callRecord(call).output;
+}
+function readServiceOutputFieldAuthorization(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  const reusable = record3.reusableFieldConfiguration ??= hasStableConfigurationCopies(record3.configuration.permissionSchema) && // Coercion methods can observe an object's identity even without native
+  // leaves. Keep those receivers local to the original resolution boundary.
+  (record3.configuration.modelPermissionPrefix === null || typeof record3.configuration.modelPermissionPrefix !== "object");
+  return Object.freeze({
+    access: record3.output.access,
+    outputFields: record3.output.outputFields,
+    reusable,
+    ...copyAuthorizationValue(
+      {
+        permissionSchema: record3.configuration.permissionSchema,
+        modelPermissionPrefix: record3.configuration.modelPermissionPrefix
+      },
+      true
+    )
+  });
+}
 function getAuthorizationPermissions(call, binding) {
   assertAuthorizationBinding(call, binding);
-  const permission = new permission_default({ ...callRecord(call).permissions });
-  for (const value of Object.values(permission)) if (value && typeof value === "object") Object.freeze(value);
-  Object.freeze(permission);
-  return permission;
+  return callRecord(call).permissions;
 }
 function getAuthorizationProvenance(call) {
   return callRecord(call).provenance;
@@ -3714,7 +3859,7 @@ function normalizeOutputAuthorizationOptions(input, options, purpose) {
     const stage = stageRecord(documentRecord(handle).stage);
     const binding = Object.freeze({ ...input.binding, scopePath: stage.binding.scopePath });
     assertAuthorizationBinding(stage.call, binding);
-    const access = readServiceAuthorization(stage.call, binding).access;
+    const access = readServiceAuthorizationAccess(stage.call, binding);
     if (input.access.outputAccess !== access.outputAccess) authorizationError("document access mismatch");
     return Object.freeze({ kind: "document", documentAuthorization: handle, binding });
   }
@@ -3792,7 +3937,16 @@ function readDocumentAuthorization(handle, binding) {
     authorization: stage.call,
     stage: record3.stage,
     grants: copyAuthorizationValue(record3.grants),
-    ...readServiceAuthorization(stage.call, binding).access
+    ...readServiceAuthorizationAccess(stage.call, binding)
+  });
+}
+function readDocumentAuthorizationAccess(handle, binding) {
+  const record3 = documentRecord(handle);
+  const stage = stageRecord(record3.stage);
+  return Object.freeze({
+    authorization: stage.call,
+    stage: record3.stage,
+    ...readServiceAuthorizationAccess(stage.call, binding)
   });
 }
 function memoizeDocumentFieldDecision(handle, binding, field, evaluate) {
@@ -3800,15 +3954,23 @@ function memoizeDocumentFieldDecision(handle, binding, field, evaluate) {
   const stage = stageRecord(record3.stage);
   assertAuthorizationBinding(stage.call, binding);
   let decision = record3.decisions.get(field);
-  if (!decision) {
+  if (decision) {
+    return decision.then((result2) => {
+      stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
+      return result2;
+    });
+  } else {
     decision = Promise.resolve().then(async () => {
       stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
       const result2 = await evaluate.call(
         stage.binding.request,
         getAuthorizationPermissions(stage.call, binding),
         copyAuthorizationValue(record3.grants)
       );
       stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
       if (typeof result2 !== "boolean") authorizationError("field decision must be boolean");
       return result2;
     });
@@ -3825,7 +3987,7 @@ function assertDocumentAuthorization(handle, use) {
   const record3 = documentRecord(handle);
   const stage = stageRecord(record3.stage);
   assertAuthorizationBinding(stage.call, use.binding);
-  if (use.authorization !== void 0 && stage.call !== use.authorization || use.stage !== void 0 && record3.stage !== use.stage || readServiceAuthorization(stage.call, use.binding).access.outputAccess !== use.outputAccess) {
+  if (use.authorization !== void 0 && stage.call !== use.authorization || use.stage !== void 0 && record3.stage !== use.stage || readServiceAuthorizationAccess(stage.call, use.binding).outputAccess !== use.outputAccess) {
     authorizationError("document call/access/stage mismatch");
   }
   const association = outputs.get(use.output);
@@ -3880,7 +4042,7 @@ function transferDocumentAuthorizationGraph(source, copy, copyOrigins) {
         {
           binding: stage.binding,
           output: original,
-          outputAccess: readServiceAuthorization(stage.call, stage.binding).access.outputAccess,
+          outputAccess: readServiceAuthorizationAccess(stage.call, stage.binding).outputAccess,
           authorization: stage.call,
           stage: documentRecord(association.handle).stage
         },
@@ -4044,12 +4206,20 @@ function classifyRequestFieldRule(rule, permissions, modelPermissionPrefix = "")
   );
   return (typeof rule === "string" ? possible.stringHandler(rule) : possible.arrayHandler(rule)) ? "deferred" : "denied";
 }
+function prepareRequestFieldRule(rule, permissions, modelPermissionPrefix = "") {
+  const state = classifyRequestFieldRule(rule, permissions, modelPermissionPrefix);
+  const invariant = state === "denied" && modelPermissionPrefix ? classifyRequestFieldRule(rule, permissions) : state;
+  return Object.freeze({ state, decision: invariant === "deferred" ? void 0 : invariant === "granted" });
+}
+function combineFieldAuthorizationStates(states2) {
+  return states2.includes("denied") ? "denied" : states2.includes("deferred") ? "deferred" : "granted";
+}
 function classifyEffectiveFieldAuthorization(args) {
   if (hasExplicitFieldGrant(args.outputFields, args.path)) return "granted";
   const states2 = args.rules.map(
     (rule) => classifyRequestFieldRule(rule, args.globalPermissions, args.modelPermissionPrefix)
   );
-  return states2.includes("denied") ? "denied" : states2.includes("deferred") ? "deferred" : "granted";
+  return combineFieldAuthorizationStates(states2);
 }
 async function evaluateScopedAccessRule(args) {
   const { req, rule, globalPermissions, docPermissions, modelPermissionPrefix } = args;
@@ -4093,7 +4263,7 @@ var init_field_authorization = __esm({
 });
 
 // src/acl/virtual-projection.ts
-import { get as get6, isArray as isArray7, isPlainObject as isPlainObject15 } from "@web-ts-toolkit/utils";
+import { get as get6, isArray as isArray7, isPlainObject as isPlainObject16 } from "@web-ts-toolkit/utils";
 function planVirtualProjection(args) {
   if (args.snapshot.catalog) return planCatalogProjection(args);
   const {
@@ -4327,15 +4497,15 @@ var init_virtual_projection = __esm({
     init_virtual_populate_dependencies();
     init_virtual_descriptor();
     getScopedPermissionSchema = (root, scopePath) => {
-      if (!root || !isPlainObject15(root)) return null;
+      if (!root || !isPlainObject16(root)) return null;
       if (scopePath.length === 0) return root;
       const scoped = get6(root, scopePath.join("."));
-      return isPlainObject15(scoped) ? scoped : null;
+      return isPlainObject16(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
       if (!raw) return [];
       if (isArray7(raw)) return [...raw];
-      if (isPlainObject15(raw)) {
+      if (isPlainObject16(raw)) {
         const record3 = raw;
         const exact = record3[access];
         if (isArray7(exact)) return [...exact];
@@ -4622,9 +4792,9 @@ function captureModelAuthorizationConfiguration(runtime, modelName, options = ru
         options,
         globalOptions
       ),
-      requireReadOperationAccessForPopulateDependencies: globalOptions.requireReadOperationAccessForPopulateDependencies !== false,
-      requireRegisteredPopulateModels: globalOptions.requireRegisteredPopulateModels,
-      permissionSchema: options.permissionSchema,
+      requireOperationAccessForPopulateDependencies: globalOptions.requireOperationAccessForPopulateDependencies !== false,
+      requireOperationAccessForPopulateQueries: globalOptions.requireOperationAccessForPopulateQueries !== false,
+      permissionSchema: options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
       modelPermissionPrefix: options.modelPermissionPrefix,
@@ -4690,15 +4860,15 @@ import {
   isBoolean as isBoolean2,
   isEmpty as isEmpty2,
   isFunction as isFunction3,
-  isPlainObject as isPlainObject16,
+  isPlainObject as isPlainObject17,
   isString as isString5
 } from "@web-ts-toolkit/utils";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 function isAndFilter(filter2) {
-  return !!filter2 && isPlainObject16(filter2) && Object.keys(filter2).length === 1 && isArray8(filter2.$and);
+  return !!filter2 && isPlainObject17(filter2) && Object.keys(filter2).length === 1 && isArray8(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && isPlainObject16(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && isPlainObject17(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4719,7 +4889,7 @@ function optimizeAndFilter(clausesInput) {
       const entries = Array.from(value, dedupeKey);
       return entries.every((entry) => entry !== void 0) ? `array:${JSON.stringify(entries)}` : void 0;
     }
-    if (isPlainObject16(value)) {
+    if (isPlainObject17(value)) {
       const entries = Object.keys(value).sort().map((key) => [key, dedupeKey(value[key])]);
       return entries.every(([, entry]) => entry !== void 0) ? `object:${JSON.stringify(entries)}` : void 0;
     }
@@ -4767,7 +4937,7 @@ function optimizeAndFilter(clausesInput) {
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !isPlainObject16(filter2) || isEmpty2(filter2)) return null;
+  if (!filter2 || !isPlainObject17(filter2) || isEmpty2(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
@@ -4845,7 +5015,7 @@ async function setRequestPermissions(req) {
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
   const permissions = isFunction3(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
-  if (isPlainObject16(permissions)) req[requestPermissionField] = permissions;
+  if (isPlainObject17(permissions)) req[requestPermissionField] = permissions;
   else if (isArray8(permissions)) req[requestPermissionField] = arrayToRecord(permissions);
   else if (isString5(permissions)) req[requestPermissionField] = { [permissions]: true };
   else req[requestPermissionField] = {};
@@ -5244,7 +5414,7 @@ var init_filter_resolution = __esm({
 // src/acl/virtual-populate-execution.ts
 import { Document as Document4, mongo as mongo4 } from "mongoose";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
-import { isPlainObject as isPlainObject19 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject20 } from "@web-ts-toolkit/utils";
 function projectVirtualPopulateView(source, selection, structurePaths = []) {
   const root = { children: /* @__PURE__ */ new Map() };
   for (const path of compactPersistedProjection(selection)) {
@@ -5276,8 +5446,8 @@ function equivalentVirtualPopulatePredicate(left, right) {
   }
   if (Array.isArray(left) || Array.isArray(right))
     return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((entry, index) => equivalentVirtualPopulatePredicate(entry, right[index]));
-  if (isPlainObject19(left) || isPlainObject19(right)) {
-    if (!isPlainObject19(left) || !isPlainObject19(right)) return false;
+  if (isPlainObject20(left) || isPlainObject20(right)) {
+    if (!isPlainObject20(left) || !isPlainObject20(right)) return false;
     const a = Object.keys(left), b = Object.keys(right);
     return a.length === b.length && a.every(
       (key, index) => key === b[index] && equivalentVirtualPopulatePredicate(
@@ -5348,7 +5518,6 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
         address,
         plan: currentPlan,
         refs: /* @__PURE__ */ new Map(),
-        referenceTargets: /* @__PURE__ */ new Map(),
         dependencies: /* @__PURE__ */ new Map()
       };
       row.occurrences.set(addressKey(address), occurrence);
@@ -5356,7 +5525,6 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
           if (!occurrence.refs.has(dependency.path))
             occurrence.refs.set(dependency.path, originalRef(value, dependency.path));
-          occurrence.referenceTargets.set(dependency.path, dependency.target);
           const request = {
             binding: dependency.target,
             target: dependency.target,
@@ -5454,7 +5622,7 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          if (target.configuration.requireReadOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+          if (target.configuration.requireOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
             return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
@@ -5540,12 +5708,6 @@ function readVirtualPopulateOriginalReference(row, address, path) {
 function hasVirtualPopulatePublicReference(row, address, path) {
   return !!rows.get(row)?.publicRequests.some((request) => addressKey(request.address) === addressKey([...address, path]));
 }
-function isVirtualPopulateReferenceVisible(row, address, path) {
-  const record3 = rows.get(row);
-  const occurrence = record3?.occurrences.get(addressKey(address));
-  const target = occurrence?.refs.get(path)?.present ? occurrence.referenceTargets.get(path) : void 0;
-  return record3 && target ? targetReadAllowed(record3.batch, target) : Promise.resolve(true);
-}
 function readVirtualPopulateInputs(row, address, virtualName) {
   const record3 = rows.get(row);
   if (!record3?.batch.completed) return { available: false };
@@ -5688,7 +5850,7 @@ var init_virtual_populate_execution = __esm({
     publicViewIdentities = /* @__PURE__ */ new WeakMap();
     familyRawFetches = /* @__PURE__ */ new WeakMap();
     addressKey = (address) => JSON.stringify(address);
-    storage = (value) => value instanceof Document4 ? value._doc : isPlainObject19(value) ? value : void 0;
+    storage = (value) => value instanceof Document4 ? value._doc : isPlainObject20(value) ? value : void 0;
     originalRef = (source, key) => {
       const record3 = storage(source);
       return {
@@ -5701,7 +5863,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireReadOperationAccessForPopulateDependencies === b.binding.configuration.requireReadOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireOperationAccessForPopulateDependencies === b.binding.configuration.requireOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -5715,21 +5877,116 @@ var init_virtual_populate_execution = __esm({
 });
 
 // src/acl/output-field-filter.ts
-import { isPlainObject as isPlainObject20 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject21 } from "@web-ts-toolkit/utils";
+function callFieldPolicy(authorization, binding) {
+  assertAuthorizationBinding(authorization, binding);
+  let policy = fieldPolicies.get(authorization);
+  if (!policy) {
+    const view = readServiceOutputFieldAuthorization(authorization, binding);
+    policy = {
+      schema: view.permissionSchema,
+      requestPaths: view.permissionSchema == null || isPlainObject21(view.permissionSchema) && Object.isFrozen(view.permissionSchema) ? Object.freeze(Object.keys(view.permissionSchema ?? {})) : void 0,
+      prefix: view.modelPermissionPrefix ?? "",
+      outputFields: view.outputFields,
+      accesses: /* @__PURE__ */ new Map()
+    };
+    if (view.reusable) fieldPolicies.set(authorization, policy);
+  }
+  return policy;
+}
+function requestRuleClassification(entry, authorization, permissions, prefix) {
+  if (typeof prefix !== "string") return void 0;
+  let classification = entry.classifications.get(authorization);
+  if (!classification) {
+    classification = prepareRequestFieldRule(entry.rule, permissions, prefix);
+    entry.classifications.set(authorization, classification);
+  }
+  return classification;
+}
+function invariantRuleLookup(schema, path) {
+  if (schema == null) return true;
+  if (!isPlainObject21(schema) || !Object.isFrozen(schema)) return false;
+  const exact = Object.getOwnPropertyDescriptor(schema, path);
+  if (exact) {
+    const raw2 = exact.value;
+    return !raw2 || typeof raw2 !== "object" || Array.isArray(raw2) || isPlainObject21(raw2) && Object.isFrozen(raw2);
+  }
+  const [head, ...rest] = path.split(".");
+  const raw = Object.getOwnPropertyDescriptor(schema, head)?.value;
+  if (raw == null) return true;
+  if (!isPlainObject21(raw) || !Object.isFrozen(raw)) return false;
+  const sub = Object.getOwnPropertyDescriptor(raw, "sub");
+  return !rest.length || !sub || invariantRuleLookup(sub.value, rest.join("."));
+}
+function prepareOutputPath(policy, authorization, binding, path, access) {
+  let cache = policy.accesses.get(access);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    policy.accesses.set(access, cache);
+  }
+  let prepared = cache.get(path);
+  if (!prepared) {
+    const invariant = invariantRuleLookup(policy.schema, path);
+    const permissions = getAuthorizationPermissions(authorization, binding);
+    const entries = extractOutputFieldRuleEntries(policy.schema, path, access).map((entry) => ({
+      ...entry,
+      classifications: /* @__PURE__ */ new WeakMap()
+    }));
+    const classifications = entries.map(
+      (entry) => requestRuleClassification(entry, authorization, permissions, policy.prefix)
+    );
+    const backendGrant = hasExplicitFieldGrant(policy.outputFields, path);
+    prepared = {
+      entries,
+      backendGrant,
+      state: backendGrant ? "granted" : classifications.every((value) => value !== void 0) ? combineFieldAuthorizationStates(classifications.map((value) => value.state)) : void 0
+    };
+    if (invariant) cache.set(path, prepared);
+  }
+  return prepared;
+}
+function assertOwningOutputDocuments(handle) {
+  const owner = owningDocuments.get(handle);
+  if (owner) {
+    readDocumentAuthorizationAccess(owner.handle, owner.binding);
+    assertOwningOutputDocuments(owner.handle);
+  }
+}
+function prepareOutputDocumentAuthorization(authorization, binding, configuration) {
+  const access = readServiceAuthorizationAccess(authorization, binding);
+  const key = `docPermissions.${access.docPermissionsAccess}`;
+  const docPermissions = configuration.docPermissions;
+  const invariant = /^[A-Za-z0-9_-]+$/.test(access.docPermissionsAccess) && (docPermissions == null || isPlainObject21(docPermissions));
+  const option = invariant ? getCapturedAuthorizationOption(configuration, key) : void 0;
+  const hook = typeof option === "function" ? option : void 0;
+  const resolveHook = invariant ? () => hook : () => {
+    const slice = { catalog: configuration.catalog, ...copyAuthorizationValue({ docPermissions }, true) };
+    const option2 = getCapturedAuthorizationOption(slice, key);
+    return typeof option2 === "function" ? option2 : void 0;
+  };
+  return async (args) => {
+    if (args.authorization !== authorization) authorizationError("document resolver call mismatch");
+    assertAuthorizationBinding(authorization, args.binding);
+    return resolveOutputDocumentAuthorizationWithHook(args, access, resolveHook);
+  };
+}
 async function resolveOutputDocumentAuthorization(args) {
+  const configuration = readServiceDocumentPermissions(args.authorization, args.binding);
+  return prepareOutputDocumentAuthorization(args.authorization, args.binding, configuration)(args);
+}
+async function resolveOutputDocumentAuthorizationWithHook(args, access, resolveHook) {
   const { authorization, binding } = args;
-  const { configuration, access } = readServiceAuthorization(authorization, binding);
   const stage = args.stage ?? createDocumentAuthorizationStage(authorization, binding, args.snapshot);
   if (args.stage) assertDocumentAuthorizationStage(stage, authorization, binding, args.snapshot);
   const handle = await resolveDocumentAuthorization(stage, async function(doc, permissions) {
     if (args.owningDocument) return readDocumentAuthorization(args.owningDocument, args.owningBinding).grants;
     if (args.knownOutput) return {};
-    const hook = getCapturedAuthorizationOption(configuration, `docPermissions.${access.docPermissionsAccess}`);
-    if (typeof hook !== "function") return {};
+    const hook = resolveHook();
+    if (!hook) return {};
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
-      return isPlainObject20(grants) ? grants : {};
+      return isPlainObject21(grants) ? grants : {};
     } catch (error2) {
       warn("docPermissions hook failed; applying empty document permissions", {
         modelName: binding.modelName,
@@ -5746,6 +6003,7 @@ async function resolveOutputDocumentAuthorization(args) {
   return handle;
 }
 function evaluateRequestRule(handle, binding, entry, prefix, access) {
+  assertOwningOutputDocuments(handle);
   const owner = owningDocuments.get(handle);
   if (owner && !entry.path.startsWith(`${(binding.scopePath ?? []).join(".")}.`)) {
     return evaluateRequestRule(owner.handle, owner.binding, entry, prefix, access);
@@ -5754,65 +6012,78 @@ function evaluateRequestRule(handle, binding, entry, prefix, access) {
     handle,
     binding,
     `request:${access}:${entry.path}`,
-    function(permissions, grants) {
-      return evaluateScopedAccessRule({
-        req: this,
-        rule: entry.rule,
-        globalPermissions: permissions,
-        docPermissions: grants,
-        modelPermissionPrefix: prefix
-      });
+    async function(permissions, grants) {
+      const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+      const classification = requestRuleClassification(entry, authorization, permissions, prefix);
+      let allowed = classification?.decision;
+      if (allowed === void 0) {
+        allowed = await evaluateScopedAccessRule({
+          req: this,
+          rule: entry.rule,
+          globalPermissions: permissions,
+          docPermissions: grants,
+          modelPermissionPrefix: prefix
+        });
+      }
+      assertOwningOutputDocuments(handle);
+      return allowed;
     }
   );
 }
 function evaluateAuthorizedOutputField(handle, binding, field) {
-  const { authorization } = readDocumentAuthorization(handle, binding);
-  const { configuration, authorization: policy, access } = readServiceAuthorization(authorization, binding);
+  const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+  assertOwningOutputDocuments(handle);
   const path = [...binding.scopePath ?? [], field].join(".");
-  const entries = extractOutputFieldRuleEntries(
-    configuration.permissionSchema,
-    path,
-    access.outputAccess
-  );
-  return memoizeDocumentFieldDecision(handle, binding, `output:${path}`, function(permissions, grants) {
-    const args = {
+  const decision = memoizeDocumentFieldDecision(handle, binding, `output:${path}`, async function(permissions) {
+    const policy = callFieldPolicy(authorization, binding);
+    const { outputAccess } = readDocumentAuthorizationAccess(handle, binding);
+    const prepared = prepareOutputPath(policy, authorization, binding, path, outputAccess);
+    const unresolved = unresolvedDocuments.has(handle);
+    const state = unresolved ? prepared.state ?? classifyEffectiveFieldAuthorization({
       path,
-      rules: entries.map((entry) => entry.rule),
+      rules: prepared.entries.map((entry) => entry.rule),
+      modelPermissionPrefix: policy.prefix,
       outputFields: policy.outputFields,
-      globalPermissions: permissions,
-      modelPermissionPrefix: configuration.modelPermissionPrefix ?? ""
-    };
-    if (unresolvedDocuments.has(handle) && classifyEffectiveFieldAuthorization(args) !== "granted") return false;
-    return evaluateEffectiveFieldAuthorization({
-      ...args,
-      req: this,
-      docPermissions: grants,
-      evaluateRule: (_rule, index) => evaluateRequestRule(handle, binding, entries[index], args.modelPermissionPrefix, access.outputAccess)
-    });
+      globalPermissions: permissions
+    }) : void 0;
+    let allowed;
+    if (unresolved && state !== "granted") allowed = false;
+    else if (prepared.backendGrant) allowed = true;
+    else {
+      allowed = true;
+      for (const entry of prepared.entries) {
+        if (!await evaluateRequestRule(handle, binding, entry, policy.prefix, outputAccess)) {
+          allowed = false;
+          break;
+        }
+      }
+    }
+    assertOwningOutputDocuments(handle);
+    return allowed;
   });
+  return owningDocuments.has(handle) ? decision.then((allowed) => {
+    assertOwningOutputDocuments(handle);
+    return allowed;
+  }) : decision;
 }
 async function requestOutputFieldPaths(handle, binding, access) {
-  const { authorization } = readDocumentAuthorization(handle, binding);
-  const { configuration } = readServiceAuthorization(authorization, binding);
-  const schema = configuration.permissionSchema;
+  const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+  assertOwningOutputDocuments(handle);
+  const policy = callFieldPolicy(authorization, binding);
   const fields = [];
-  for (const path of Object.keys(schema ?? {})) {
-    const entries = extractOutputFieldRuleEntries(schema, path, access);
+  for (const path of policy.requestPaths ?? Object.keys(policy.schema ?? {})) {
+    const { entries } = prepareOutputPath(policy, authorization, binding, path, access);
     let allowed = true;
     for (const entry of entries) {
-      if (!await evaluateRequestRule(
-        handle,
-        binding,
-        entry,
-        configuration.modelPermissionPrefix ?? "",
-        access
-      )) {
+      if (!await evaluateRequestRule(handle, binding, entry, policy.prefix, access)) {
         allowed = false;
         break;
       }
     }
     if (allowed && entries.length) fields.push(path);
   }
+  assertOwningOutputDocuments(handle);
+  readDocumentAuthorizationAccess(handle, binding);
   return fields;
 }
 function authorizeEmbeddedOutputPlan(parent, child) {
@@ -5833,24 +6104,24 @@ function authorizeEmbeddedOutputPlan(parent, child) {
 function hasWholeOutputValueGrant(plan, field) {
   if (plan.fieldStates?.[field] !== "granted") return false;
   const binding = plan.authorizationBinding;
-  const { authorization } = readServiceAuthorization(plan.authorization, binding);
-  return hasExplicitFieldGrant(authorization.outputFields, [...binding.scopePath ?? [], field].join("."));
+  const { outputFields } = readServiceOutputPolicy(plan.authorization, binding);
+  return hasExplicitFieldGrant(outputFields, [...binding.scopePath ?? [], field].join("."));
 }
 function copyOutputValue(value, plan, path) {
-  const { configuration } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  const virtualValue = configuration.catalog.virtualPaths?.some((p) => matchesCatalogPattern(p, path));
-  const opaque = configuration.catalog.opaquePaths?.some((p) => matchesCatalogPattern(p, path));
+  const { catalog } = readServiceOutputPolicy(plan.authorization, plan.authorizationBinding);
+  const virtualValue = catalog.virtualPaths?.some((p) => matchesCatalogPattern(p, path));
+  const opaque = catalog.opaquePaths?.some((p) => matchesCatalogPattern(p, path));
   const excluded = plan.effectiveSelectNorm.filter((token) => token.startsWith("-")).map((token) => [...plan.authorizationBinding.scopePath ?? [], token.slice(1)].join("."));
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
     if (input instanceof Map) return visit(Object.fromEntries(input), current);
-    if (!isPlainObject20(input)) return deepIsolateValue(input);
+    if (!isPlainObject21(input)) return deepIsolateValue(input);
     const output = {};
     for (const [key, entry] of Object.entries(input)) {
       const child = `${current}.${key}`;
       if (excluded.some((entry2) => child === entry2 || child.startsWith(`${entry2}.`))) continue;
       const safeValueKey = !["__proto__", "constructor", "prototype", "_doc", "$__", "__v"].includes(key);
-      if (!(opaque ? safeValueKey : isSafeOutputPath(key)) || configuration.catalog.protectedPaths?.some((p) => matchesCatalogPattern(p, child, true)) || !opaque && !virtualValue && !isCatalogOutputPath(configuration.catalog, child))
+      if (!(opaque ? safeValueKey : isSafeOutputPath(key)) || catalog.protectedPaths?.some((p) => matchesCatalogPattern(p, child, true)) || !opaque && !virtualValue && !isCatalogOutputPath(catalog, child))
         continue;
       output[key] = visit(entry, child);
     }
@@ -5860,25 +6131,21 @@ function copyOutputValue(value, plan, path) {
 }
 function copyAuthorizedReference(value, plan, path) {
   if (Array.isArray(value)) return value.map((entry) => copyAuthorizedReference(entry, plan, path));
-  if (!isPlainObject20(value)) return deepIsolateValue(value);
+  if (!isPlainObject21(value)) return deepIsolateValue(value);
   const handle = getAssociatedDocumentAuthorization(value, plan.authorization);
   if (handle) {
     const copy = deepIsolateValue(value);
     transferDocumentAuthorizationGraph(value, copy);
     return copy;
   }
-  const { relatedTargets } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  if (relatedTargets.some((target) => target.path === path && target.kind === "passthrough")) {
-    return deepIsolateValue(value);
-  }
   return Object.prototype.hasOwnProperty.call(value, "_id") ? deepIsolateValue(value._id) : void 0;
 }
 function retainOutputMetadata(output, source, configuration, scope2) {
   if (scope2.length || configuration.stripPermissionsField) return;
   const parts = (configuration.documentPermissionField ?? "_permissions").split(".");
   let value = source;
-  for (const part of parts) value = isPlainObject20(value) ? value[part] : void 0;
-  if (!isPlainObject20(value)) return;
+  for (const part of parts) value = isPlainObject21(value) ? value[part] : void 0;
+  if (!isPlainObject21(value)) return;
   const keys2 = configuration.exposedDocPermissionKeys;
   const metadata = Object.fromEntries(
     Object.entries(value).filter(
@@ -5888,7 +6155,7 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   const copy = { ...output };
   let target = copy;
   for (const part of parts.slice(0, -1)) {
-    target[part] = isPlainObject20(target[part]) ? { ...target[part] } : {};
+    target[part] = isPlainObject21(target[part]) ? { ...target[part] } : {};
     target = target[part];
   }
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
@@ -5930,11 +6197,11 @@ async function filterExistingOutput(source, plan, handle, associated) {
           for (const entry of value2) values.push(await one(entry) ?? null);
           return values;
         }
-        if (!isPlainObject20(value2)) return value2 === null ? null : void 0;
+        if (!isPlainObject21(value2)) return value2 === null ? null : void 0;
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
-          const state = readDocumentAuthorization(childHandle, scoped.authorizationBinding);
+          const state = readDocumentAuthorizationAccess(childHandle, scoped.authorizationBinding);
           if (getAuthorizationProvenance(state.authorization) !== getAuthorizationProvenance(plan.authorization))
             authorizationError("child call mismatch");
           child = helperPlan(state.authorization, scoped.authorizationBinding);
@@ -5998,7 +6265,7 @@ async function filterModelOutputForHelper(args) {
   if (normalized.kind === "document") {
     const { documentAuthorization: handle2, binding: binding2 } = normalized;
     assertDocumentAuthorization(handle2, { binding: binding2, output: args.doc, outputAccess: access });
-    const state = readDocumentAuthorization(handle2, binding2);
+    const state = readDocumentAuthorizationAccess(handle2, binding2);
     return filterExistingOutput(
       args.doc,
       helperPlan(state.authorization, binding2),
@@ -6010,7 +6277,7 @@ async function filterModelOutputForHelper(args) {
   const plan = helperPlan(normalized.authorization, binding);
   if (args.doc == null) return { output: args.doc, fields: [] };
   const source = isolateDocForOutput(args.doc);
-  if (!isPlainObject20(source)) return authorizationError("output helper requires one plain or hydrated document");
+  if (!isPlainObject21(source)) return authorizationError("output helper requires one plain or hydrated document");
   const knownOutput = !!args.doc && typeof args.doc === "object" && isKnownAuthorizationOutput(args.doc);
   const handle = await resolveOutputDocumentAuthorization({
     authorization: normalized.authorization,
@@ -6021,7 +6288,7 @@ async function filterModelOutputForHelper(args) {
   });
   return filterExistingOutput(source, plan, handle, false);
 }
-var unresolvedDocuments, owningDocuments;
+var unresolvedDocuments, owningDocuments, fieldPolicies;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
     init_permissions_alias();
@@ -6037,6 +6304,7 @@ var init_output_field_filter = __esm({
     init_output_projection();
     unresolvedDocuments = /* @__PURE__ */ new WeakSet();
     owningDocuments = /* @__PURE__ */ new WeakMap();
+    fieldPolicies = /* @__PURE__ */ new WeakMap();
   }
 });
 
@@ -6105,28 +6373,54 @@ __export(finalize_model_output_exports, {
   finalizeModelOutput: () => finalizeModelOutput,
   finalizeModelOutputs: () => finalizeModelOutputs
 });
-import { get as get9, isPlainObject as isPlainObject21, set as set7 } from "@web-ts-toolkit/utils";
-async function finalizeSingleDoc(args, input) {
-  const scopePath = args.scopePath;
+import { get as get9, isPlainObject as isPlainObject22, set as set7 } from "@web-ts-toolkit/utils";
+function assertFinalizerCall(args, prepared) {
   const plan = args.plan;
   const binding = plan.authorizationBinding;
-  const captured = plan.authorization && binding ? readServiceAuthorization(plan.authorization, binding) : void 0;
-  if (plan.authorization && (!binding || binding.request !== args.request || binding.modelName !== args.receivingModelName || captured?.access.virtualAccess !== args.virtualAccess || captured.access.outputAccess !== args.outputAccess || captured.access.docPermissionsAccess !== args.docPermissionsAccess || (binding.scopePath ?? []).join(".") !== scopePath.filter((p) => p !== "sub").join("."))) {
+  if (plan.authorization !== prepared.authorization) authorizationError("finalizer call changed during pass");
+  if (plan.authorization && binding) assertAuthorizationBinding(plan.authorization, binding);
+  const access = prepared.policy?.access;
+  if (plan.authorization && (!binding || binding.request !== args.request || binding.modelName !== args.receivingModelName || access?.virtualAccess !== args.virtualAccess || access.outputAccess !== args.outputAccess || access.docPermissionsAccess !== args.docPermissionsAccess || (binding.scopePath ?? []).join(".") !== args.scopePath.filter((p) => p !== "sub").join("."))) {
     authorizationError("finalizer call/model/scope/access mismatch");
   }
-  const snapshot = captured ? captured.configuration : args.snapshot;
+}
+function prepareFinalizer(args, sharedContext = false) {
+  const { authorization, authorizationBinding: binding } = args.plan;
+  const policy = authorization && binding ? readServiceOutputPolicy(authorization, binding) : void 0;
+  assertFinalizerCall(args, { authorization, policy });
+  const configuration = authorization ? readServiceFinalizerConfiguration(authorization, binding) : void 0;
+  const snapshot = configuration ? configuration : deepIsolateValue(args.snapshot);
+  return {
+    authorization,
+    policy,
+    snapshot,
+    baseContext: deepIsolateValue(args.context ?? {}),
+    sharedContext,
+    scopeVirtualNames: getScopeVirtualNames(snapshot, args.scopePath),
+    scopedSchema: configuration ? null : getScopedPermissionSchema2(snapshot.permissionSchema, args.scopePath),
+    permissions: authorization ? getAuthorizationPermissions(authorization, binding) : void 0,
+    resolveDocument: authorization ? prepareOutputDocumentAuthorization(authorization, binding, configuration) : void 0
+  };
+}
+async function finalizeSingleDoc(args, input, prepared) {
+  assertFinalizerCall(args, prepared);
+  const scopePath = args.scopePath;
+  const plan = args.plan;
+  const binding = plan.authorizationBinding;
+  const captured = prepared.policy;
+  const snapshot = prepared.snapshot;
   const limit = args.resolvedLimit;
   const gate = args.sharedGate;
   const original = getIncludeOriginal(input);
   const privateRow = args.virtualPopulateRow ?? (original && typeof original === "object" ? getVirtualPopulateRow(original) : void 0);
   const privateAddress = args.virtualPopulateAddress ?? [];
   const isolated = isolateDocForOutput(input);
-  const output = isPlainObject21(isolated) ? isolated : {};
-  if (captured && isPlainObject21(input))
+  const output = isPlainObject22(isolated) ? isolated : {};
+  if (captured && isPlainObject22(input))
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
-  const baseContext = args.context ?? {};
+  const baseContext = prepared.sharedContext ? deepIsolateValue(prepared.baseContext) : prepared.baseContext;
   const operation = captured?.access.operation ?? baseContext.operation ?? args.operation ?? args.virtualAccess;
   const scopeContext = {
     ...baseContext,
@@ -6144,7 +6438,7 @@ async function finalizeSingleDoc(args, input) {
   if (captured) {
     const projected = args.documentAuthorizationStage ? input : deepIsolateValue(output);
     metadataSource = deepIsolateValue(output);
-    documentAuthorization = await resolveOutputDocumentAuthorization({
+    documentAuthorization = await prepared.resolveDocument({
       authorization: plan.authorization,
       binding,
       snapshot: projected,
@@ -6157,13 +6451,10 @@ async function finalizeSingleDoc(args, input) {
   }
   const docGrants = documentAuthorization ? readDocumentAuthorization(documentAuthorization, binding).grants : await resolveDocPermissions(args, output, scopeContext);
   scopeContext.docPermissions = deepIsolateValue(docGrants);
-  const globalPerms = captured ? getAuthorizationPermissions(plan.authorization, binding) : resolveGlobalPermissions(args);
-  const modelPermissionPrefix = snapshot.modelPermissionPrefix ?? "";
-  const documentPermissionField = snapshot.documentPermissionField ?? "_permissions";
-  const scopedSchema = getScopedPermissionSchema2(
-    snapshot.permissionSchema ?? null,
-    scopePath
-  );
+  const globalPerms = prepared.permissions ?? resolveGlobalPermissions(args);
+  const modelPermissionPrefix = captured ? "" : deepIsolateValue(snapshot.modelPermissionPrefix ?? "");
+  const documentPermissionField = captured ? "_permissions" : deepIsolateValue(snapshot.documentPermissionField ?? "_permissions");
+  const scopedSchema = deepIsolateValue(prepared.scopedSchema);
   const childPlans = plan.childPlans ?? {};
   for (const [containerName, childPlan] of Object.entries(childPlans)) {
     if (!(containerName in output)) continue;
@@ -6177,17 +6468,18 @@ async function finalizeSingleDoc(args, input) {
       );
       continue;
     }
-    if (captured && !isPlainObject21(rawContainer) && !Array.isArray(rawContainer)) {
+    if (captured && !isPlainObject22(rawContainer) && !Array.isArray(rawContainer)) {
       delete output[containerName];
       continue;
     }
     retainRawAssociation(output, containerName, rawContainer);
-    const childSnapshot = snapshot;
     const childBase = {
       ...args,
       scopePath: [...childPlan.scopePath ?? [...scopePath, containerName, "sub"]],
       plan: captured ? authorizeEmbeddedOutputPlan(plan, childPlan) : childPlan,
-      snapshot: childSnapshot,
+      // Authenticated preparation reads its own authority. Do not clone an
+      // otherwise unused public configuration graph on default traversal.
+      snapshot: args.snapshot,
       // Embedded reuses the owning parent's grants + accesses (VIRT-00A D2).
       docPermissions: docGrants,
       context: scopeContext,
@@ -6198,10 +6490,11 @@ async function finalizeSingleDoc(args, input) {
       related: [],
       virtualPopulateRow: privateRow
     };
+    let childPreparation;
     const finalizeOneChild = async (rawChild, address) => {
       if (captured && Array.isArray(rawChild))
         return mapWithConcurrencyLimit(rawChild, limit, (entry, index) => finalizeOneChild(entry, [...address, index]));
-      if (!isPlainObject21(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
+      if (!isPlainObject22(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
       if (args.traversal?.finalizeEmbeddedChildren) {
         return args.traversal.finalizeEmbeddedChildren({
           containerName,
@@ -6218,7 +6511,14 @@ async function finalizeSingleDoc(args, input) {
           } : { ...args, virtualPopulateRow: privateRow, virtualPopulateAddress: address }
         });
       }
-      return finalizeSingleDoc({ ...childBase, virtualPopulateAddress: address }, rawChild);
+      return finalizeSingleDoc(
+        { ...childBase, virtualPopulateAddress: address },
+        rawChild,
+        childPreparation ??= prepareFinalizer(
+          childBase,
+          Array.isArray(rawContainer) && (rawContainer.length > 1 || Array.isArray(rawContainer[0]))
+        )
+      );
     };
     if (Array.isArray(rawContainer)) {
       const finalized = await mapWithConcurrencyLimit(
@@ -6227,7 +6527,7 @@ async function finalizeSingleDoc(args, input) {
         (entry, index) => finalizeOneChild(entry, [...privateAddress, containerName, index])
       );
       output[containerName] = finalized;
-    } else if (isPlainObject21(rawContainer)) {
+    } else if (isPlainObject22(rawContainer)) {
       output[containerName] = await finalizeOneChild(rawContainer, [
         ...privateAddress,
         containerName
@@ -6270,8 +6570,9 @@ async function finalizeSingleDoc(args, input) {
       context: scopeContext,
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
+    let relatedPreparation;
     const finalizeOneRelated = async (rawChild, originalChild = rawChild) => {
-      if (!isPlainObject21(rawChild) && !Array.isArray(rawChild)) return rawChild;
+      if (!isPlainObject22(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
       const childOriginal = getIncludeOriginal(originalChild);
       const childRow = childOriginal && typeof childOriginal === "object" ? getVirtualPopulateRow(childOriginal) : void 0;
@@ -6283,7 +6584,11 @@ async function finalizeSingleDoc(args, input) {
           parentArgs: { ...args, virtualPopulateRow: childRow, virtualPopulateAddress: [] }
         });
       }
-      return finalizeSingleDoc({ ...relatedBase, virtualPopulateRow: childRow }, rawChild);
+      return finalizeSingleDoc(
+        { ...relatedBase, virtualPopulateRow: childRow },
+        rawChild,
+        relatedPreparation ??= prepareFinalizer(relatedBase, Array.isArray(rawRelated) && rawRelated.length > 1)
+      );
     };
     let finalized;
     if (Array.isArray(rawRelated)) {
@@ -6292,7 +6597,7 @@ async function finalizeSingleDoc(args, input) {
         limit,
         (entry, index) => finalizeOneRelated(entry, Array.isArray(originalRelated) ? originalRelated[index] : void 0)
       );
-    } else if (isPlainObject21(rawRelated)) {
+    } else if (isPlainObject22(rawRelated)) {
       finalized = await finalizeOneRelated(rawRelated, originalRelated);
     } else {
       continue;
@@ -6303,18 +6608,24 @@ async function finalizeSingleDoc(args, input) {
     } catch {
     }
   }
-  const scopeVirtualNames = getScopeVirtualNames(snapshot, scopePath);
-  for (const virtualName of scopeVirtualNames) {
+  for (const virtualName of prepared.scopeVirtualNames) {
     if (virtualName in output) delete output[virtualName];
   }
-  const stableBase = deepIsolateValue(output);
-  const scopeLabel = scopePath.length > 0 ? scopePath.join(".") : "";
   const candidates = plan.candidates ?? [];
+  const needsGetterView = candidates.some((candidate) => {
+    const descriptor = candidate.descriptor;
+    if (typeof descriptor?.get !== "function") return false;
+    if (!privateRow && descriptor.dependsOnPopulate?.length) return false;
+    const dependsOn = Array.isArray(descriptor.dependsOn) ? descriptor.dependsOn : [];
+    return dependsOn.every((dep) => typeof dep === "string" && !isAbsentDependency(output, dep));
+  });
+  let stableBase = needsGetterView ? deepIsolateValue(output) : void 0;
+  const scopeLabel = scopePath.length > 0 ? scopePath.join(".") : "";
   const staged = /* @__PURE__ */ new Map();
   const runCandidate = async (candidate) => {
     const dependsOn = Array.isArray(candidate.descriptor?.dependsOn) ? candidate.descriptor.dependsOn : [];
     for (const dep of dependsOn) {
-      if (typeof dep !== "string" || isAbsentDependency(stableBase, dep)) return;
+      if (typeof dep !== "string" || isAbsentDependency(stableBase ?? output, dep)) return;
     }
     const allowed = documentAuthorization ? await evaluateAuthorizedOutputField(documentAuthorization, binding, candidate.name) : await evaluateEffectiveFieldAuthorization({
       req: args.request,
@@ -6329,9 +6640,9 @@ async function finalizeSingleDoc(args, input) {
     if (typeof getter !== "function") return;
     const privateInputs = privateRow ? readVirtualPopulateInputs(privateRow, privateAddress, candidate.name) : candidate.descriptor.dependsOnPopulate?.length ? { available: false } : { available: true, populated: {} };
     if (!privateInputs.available) return;
-    const isolatedView = deepIsolateValue(stableBase);
+    const isolatedView = deepIsolateValue(stableBase ??= deepIsolateValue(output));
     const virtualContext = {
-      ...scopeContext,
+      ...deepIsolateValue(scopeContext),
       docPermissions: deepIsolateValue(docGrants)
     };
     const outcome = await runVirtualGetter({
@@ -6412,7 +6723,6 @@ async function finalizeSingleDoc(args, input) {
   if (!captured && documentPermissionField in output) keep.add(documentPermissionField);
   const trimmed = {};
   for (const key of keep) {
-    if (privateRow && !await isVirtualPopulateReferenceVisible(privateRow, privateAddress, key)) continue;
     if (privateRow && !hasVirtualPopulatePublicReference(privateRow, privateAddress, key)) {
       const ref = readVirtualPopulateOriginalReference(privateRow, privateAddress, key);
       if (ref) {
@@ -6423,12 +6733,25 @@ async function finalizeSingleDoc(args, input) {
     if (!(key in output)) continue;
     if (captured && !plan.childPlans[key]) {
       const path = [...binding.scopePath ?? [], key].join(".");
-      trimmed[key] = captured.configuration.catalog.referencePaths?.some((p) => matchesCatalogPattern(p, path)) ? copyAuthorizedReference(output[key], plan, path) : copyOutputValue(output[key], plan, path);
+      trimmed[key] = captured.catalog.referencePaths?.some((p) => matchesCatalogPattern(p, path)) ? copyAuthorizedReference(output[key], plan, path) : copyOutputValue(output[key], plan, path);
       if (trimmed[key] === void 0) delete trimmed[key];
     } else trimmed[key] = output[key];
   }
   if (documentAuthorization) {
-    retainOutputMetadata(trimmed, metadataSource, captured.configuration, binding.scopePath ?? []);
+    retainOutputMetadata(
+      trimmed,
+      metadataSource,
+      copyAuthorizationValue(
+        {
+          documentPermissionField: snapshot.documentPermissionField,
+          stripPermissionsField: snapshot.stripPermissionsField,
+          exposedDocPermissionKeys: snapshot.exposedDocPermissionKeys,
+          disableFieldPermissions: snapshot.disableFieldPermissions
+        },
+        true
+      ),
+      binding.scopePath ?? []
+    );
     associateDocumentAuthorization(documentAuthorization, binding, trimmed);
     args.onFinalized?.(
       trimmed,
@@ -6437,7 +6760,7 @@ async function finalizeSingleDoc(args, input) {
         output: trimmed,
         outputAccess: args.outputAccess,
         authorization: plan.authorization,
-        stage: readDocumentAuthorization(documentAuthorization, binding).stage
+        stage: readDocumentAuthorizationAccess(documentAuthorization, binding).stage
       })
     );
   }
@@ -6458,7 +6781,7 @@ async function finalizeModelOutput(args) {
     sharedGate: gate,
     resolvedLimit: limit
   };
-  return finalizeSingleDoc(internal, args.input);
+  return finalizeSingleDoc(internal, args.input, prepareFinalizer(internal));
 }
 async function finalizeModelOutputs(args) {
   const gate = finalizerGate(args);
@@ -6467,16 +6790,24 @@ async function finalizeModelOutputs(args) {
   if ("documentAuthorizationStage" in args || documentAuthorizationStages && (documentAuthorizationStages.length !== inputs.length || new Set(documentAuthorizationStages).size !== inputs.length)) {
     authorizationError("list finalization requires a distinct document stage per row");
   }
+  if (!inputs.length) return [];
+  const internal = {
+    ...rest,
+    scopePath: [...rest.scopePath ?? rest.plan.scopePath ?? []],
+    sharedGate: gate,
+    resolvedLimit: limit
+  };
+  const prepared = prepareFinalizer(internal, inputs.length > 1);
   return mapWithConcurrencyLimit(inputs, limit, (input, index) => {
-    const internal = {
-      ...rest,
-      scopePath: [...rest.scopePath ?? rest.plan.scopePath ?? []],
-      onFinalized: rest.onFinalized ? (output, context) => rest.onFinalized(output, context, index) : void 0,
-      documentAuthorizationStage: documentAuthorizationStages?.[index],
-      sharedGate: gate,
-      resolvedLimit: limit
-    };
-    return finalizeSingleDoc(internal, input);
+    return finalizeSingleDoc(
+      {
+        ...internal,
+        onFinalized: rest.onFinalized ? (output, context) => rest.onFinalized(output, context, index) : void 0,
+        documentAuthorizationStage: documentAuthorizationStages?.[index]
+      },
+      input,
+      prepared
+    );
   });
 }
 var isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
@@ -6494,20 +6825,20 @@ var init_finalize_model_output = __esm({
     init_field_catalog();
     init_virtual_populate_execution();
     init_include_output();
-    isVirtualContainerValue3 = (value) => isPlainObject21(value) && "sub" in value;
+    isVirtualContainerValue3 = (value) => isPlainObject22(value) && "sub" in value;
     getScopeVirtualsObject2 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !isPlainObject21(rootVirtuals)) return null;
+      if (!rootVirtuals || !isPlainObject22(rootVirtuals)) return null;
       if (scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!isPlainObject21(current)) return null;
+        if (!isPlainObject22(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue3(container)) return null;
         current = container.sub;
-        if (!isPlainObject21(current)) return null;
+        if (!isPlainObject22(current)) return null;
       }
       return current;
     };
@@ -6520,11 +6851,11 @@ var init_finalize_model_output = __esm({
       return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue3(v)).map(([k]) => k);
     };
     getScopedPermissionSchema2 = (root, scopePath) => {
-      if (!root || !isPlainObject21(root)) return null;
+      if (!root || !isPlainObject22(root)) return null;
       if (scopePath.length === 0) return root;
       try {
         const scoped = get9(root, scopePath.join("."));
-        return isPlainObject21(scoped) ? scoped : null;
+        return isPlainObject22(scoped) ? scoped : null;
       } catch {
         return null;
       }
@@ -6545,7 +6876,7 @@ var init_finalize_model_output = __esm({
     };
     resolveDocPermissions = async (args, isolatedForHook, scopeContext) => {
       if (args.docPermissions != null && typeof args.docPermissions === "object" && !Array.isArray(args.docPermissions)) {
-        const grants = args.docPermissions;
+        const grants = deepIsolateValue(args.docPermissions);
         scopeContext.docPermissions = grants;
         return grants;
       }
@@ -6583,7 +6914,7 @@ var init_finalize_model_output = __esm({
           const grants = await args.sharedGate.run(
             () => hook.call(args.request, isolatedForHook, globalPerms, scopeContext)
           );
-          const normalized = isPlainObject21(grants) ? grants : {};
+          const normalized = isPlainObject22(grants) ? grants : {};
           scopeContext.docPermissions = normalized;
           return normalized;
         }
@@ -6605,19 +6936,21 @@ var init_finalize_model_output = __esm({
 });
 
 // src/index.ts
-import { isPlainObject as isPlainObject30, isString as isString10, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject31, isString as isString10, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
 
 // src/middleware.ts
 import JsonRouter5 from "@web-ts-toolkit/express-json-router";
-import { isArray as isArray13, isFunction as isFunction7, isPlainObject as isPlainObject26, isString as isString7 } from "@web-ts-toolkit/utils";
+import { isArray as isArray13, isFunction as isFunction7, isPlainObject as isPlainObject27, isString as isString7 } from "@web-ts-toolkit/utils";
 
 // src/core.ts
 init_public_admission();
 init_options();
+init_permission();
 import {
   castArray as castArray4,
   compact as compact3,
   forEach as forEach6,
+  get as get15,
   isArray as isArray12,
   isBoolean as isBoolean5,
   isFunction as isFunction6,
@@ -6627,27 +6960,6 @@ import {
   uniq as uniq3
 } from "@web-ts-toolkit/utils";
 
-// src/meta.ts
-init_runtime();
-init_runtime_context();
-var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
-var getModelRef = (modelName, refPath) => {
-  const direct = getRuntime5().getModelRef(modelName, refPath);
-  if (direct) return direct;
-  if (!refPath.includes(".")) return null;
-  try {
-    const runtime = getRuntime5();
-    const instance = runtime.getModelInstance?.(
-      modelName
-    );
-    const schemaPath = instance?.schema?.path?.(refPath);
-    const ref = schemaPath?.options?.ref ?? schemaPath?.caster?.options?.ref ?? null;
-    return typeof ref === "string" && ref.length > 0 ? ref : null;
-  } catch {
-    return null;
-  }
-};
-
 // src/services/base.ts
 init_options();
 init_helpers();
@@ -6663,7 +6975,7 @@ import {
   forEach as forEach3,
   get as get8,
   isArray as isArray9,
-  isPlainObject as isPlainObject17,
+  isPlainObject as isPlainObject18,
   set as set6,
   uniq
 } from "@web-ts-toolkit/utils";
@@ -6788,7 +7100,7 @@ init_public_admission();
 // src/correlated-includes.ts
 init_request_complexity();
 init_sort_policy();
-import { cloneDeep, isArray as isArray6, isPlainObject as isPlainObject14 } from "@web-ts-toolkit/utils";
+import { cloneDeep, isArray as isArray6, isPlainObject as isPlainObject15 } from "@web-ts-toolkit/utils";
 var PARENT_MARKER_KEY = "$parent";
 var ESCAPE_WRAPPER_KEY = "$escape";
 var SUBQUERY_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["$$sq", "$$date"]);
@@ -6799,10 +7111,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return isPlainObject14(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return isPlainObject15(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return isPlainObject14(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return isPlainObject15(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -6826,7 +7138,7 @@ function containsParentMarkerShape(value) {
       seen.add(current);
       return current.some(visit);
     }
-    if (isPlainObject14(current)) {
+    if (isPlainObject15(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -6856,7 +7168,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if (isPlainObject14(value)) {
+  if (isPlainObject15(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -6921,7 +7233,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if (isPlainObject14(clause)) {
+        if (isPlainObject15(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -6932,7 +7244,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter2) {
   const issues = [];
-  if (!isPlainObject14(filter2)) {
+  if (!isPlainObject15(filter2)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -6981,7 +7293,7 @@ function collectFilterReferencePaths(filter2) {
       value.forEach(visitValue);
       return;
     }
-    if (isPlainObject14(value)) {
+    if (isPlainObject15(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       for (const [key, child] of Object.entries(value)) {
@@ -7027,7 +7339,7 @@ function getOwnPathValue(parent, path) {
   return current;
 }
 function cloneSubstitutedValue(value) {
-  if (isPlainObject14(value) || isArray6(value)) return cloneDeep(value);
+  if (isPlainObject15(value) || isArray6(value)) return cloneDeep(value);
   return value;
 }
 function literalParentRefObject(path) {
@@ -7076,7 +7388,7 @@ function resolveObjectEntries(obj, parent) {
         if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
           throw new CorrelatedReferenceError(`Unsupported $parent reference as a direct ${key} clause`);
         }
-        if (!isPlainObject14(clause)) return cloneSubstitutedValue(clause);
+        if (!isPlainObject15(clause)) return cloneSubstitutedValue(clause);
         return resolveObjectEntries(clause, parent);
       });
       continue;
@@ -7105,10 +7417,10 @@ function resolveValueNode(template, parent, bare) {
     }
     const value = getOwnPathValue(parent, path);
     if (value === void 0 || value === null) throw UNRESOLVABLE;
-    if (bare && isPlainObject14(value)) return { $eq: cloneDeep(value) };
+    if (bare && isPlainObject15(value)) return { $eq: cloneDeep(value) };
     return cloneSubstitutedValue(value);
   }
-  if (isPlainObject14(template)) {
+  if (isPlainObject15(template)) {
     if (hasMarkerKey(template)) {
       throw new CorrelatedReferenceError(
         'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }'
@@ -7150,7 +7462,7 @@ function resolveCorrelatedIdTemplate(id, parent) {
 }
 function resolveCorrelatedFilterTemplate(filter2, parent) {
   try {
-    if (!isPlainObject14(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
+    if (!isPlainObject15(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
       throw new CorrelatedReferenceError("Correlated include filter must be an object");
     }
     return { status: "resolved", filter: resolveObjectEntries(filter2, parent) };
@@ -7165,7 +7477,7 @@ function validateExpandedCorrelatedOperands(expanded, limits) {
 var MAX_NESTED_INCLUDE_DEPTH = 10;
 function validateCorrelatedArgsShape(args, op, depth) {
   if (args === void 0) return [];
-  if (!isPlainObject14(args)) return ["Correlated include args must be an object"];
+  if (!isPlainObject15(args)) return ["Correlated include args must be an object"];
   const record3 = args;
   const allowed = op === "list" ? /* @__PURE__ */ new Set(["select", "sort", "skip", "limit", "page", "pageSize", "include"]) : /* @__PURE__ */ new Set(["select", "sort", "include"]);
   for (const key of Object.keys(record3)) {
@@ -7187,7 +7499,7 @@ function validateCorrelatedArgsShape(args, op, depth) {
   return [];
 }
 function validateCorrelatedIncludeShape(entry, depth = 0) {
-  if (!isPlainObject14(entry)) return ["Correlated include must be an object"];
+  if (!isPlainObject15(entry)) return ["Correlated include must be an object"];
   const record3 = entry;
   if (record3.mode !== "correlated") return ['Correlated include mode must be "correlated"'];
   if (typeof record3.model !== "string" || record3.model.length === 0)
@@ -7200,7 +7512,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   if ("localField" in record3 || "foreignField" in record3) {
     return ["Correlated includes must not carry localField or foreignField"];
   }
-  if (record3.options !== void 0 && !(isPlainObject14(record3.options) && Object.keys(record3.options).length === 0)) {
+  if (record3.options !== void 0 && !(isPlainObject15(record3.options) && Object.keys(record3.options).length === 0)) {
     return ["Correlated include options must be absent or empty"];
   }
   const hasId = record3.id !== void 0;
@@ -7222,7 +7534,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   return validateCorrelatedArgsShape(record3.args, record3.op, depth);
 }
 function isCorrelatedInclude(value) {
-  return isPlainObject14(value) && value.mode === "correlated";
+  return isPlainObject15(value) && value.mode === "correlated";
 }
 
 // src/services/base.ts
@@ -7446,9 +7758,31 @@ function castCountGroups(input, values) {
 // src/services/base.ts
 init_service_authorization();
 
+// src/meta.ts
+init_runtime();
+init_runtime_context();
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
+var getModelRef = (modelName, refPath, runtime = getRuntime5()) => {
+  const direct = runtime.getModelRef(modelName, refPath);
+  if (direct) return direct;
+  if (!refPath.includes(".")) return null;
+  try {
+    const instance = runtime.getModelInstance?.(
+      modelName
+    );
+    const schemaPath = instance?.schema?.path?.(refPath);
+    const element = schemaPath?.$embeddedSchemaType ?? schemaPath?.embeddedSchemaType ?? schemaPath?.caster;
+    const ref = schemaPath?.options?.ref ?? element?.options?.ref ?? null;
+    return typeof ref === "string" && ref.length > 0 ? ref : null;
+  } catch {
+    return null;
+  }
+};
+
 // src/acl/related-execution.ts
 init_public_admission();
 init_model_output_planning();
+init_populate_target_configuration();
 init_authorization_snapshot();
 
 // src/acl/service-execution.ts
@@ -7486,9 +7820,9 @@ function createServiceExecution(receiver, access, authorization, applicability =
       receiver,
       binding,
       authorization: call,
-      access: readServiceAuthorization(call, binding).access,
+      access: readServiceAuthorizationAccess(call, binding),
       family: execution,
-      hydration: resolveHydration(readServiceAuthorization(call, binding).configuration, hydration)
+      hydration: resolveHydration(readServiceAuthorizationHydration(call, binding), hydration)
     })
   );
   return execution;
@@ -7499,7 +7833,7 @@ function resolveHydration(configuration, source) {
 }
 function withExecutionHydration(receiver, parent, source) {
   const record3 = readServiceExecution(receiver, parent);
-  const { configuration } = readServiceAuthorization(record3.authorization, record3.binding);
+  const configuration = readServiceAuthorizationHydration(record3.authorization, record3.binding);
   const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
   executions.set(execution, Object.freeze({ ...record3, hydration: resolveHydration(configuration, source) }));
   return execution;
@@ -7536,7 +7870,7 @@ function deriveServiceExecution(receiver, parent, access, applicability = "servi
   const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
   executions.set(
     execution,
-    Object.freeze({ ...record3, authorization: call, access: readServiceAuthorization(call, record3.binding).access })
+    Object.freeze({ ...record3, authorization: call, access: readServiceAuthorizationAccess(call, record3.binding) })
   );
   return execution;
 }
@@ -7743,16 +8077,15 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalO
   for (const entry of entries(args.populate)) {
     const path = typeof entry === "string" ? entry : entry.path;
     if (typeof entry !== "string") assertPopulateAccess(entry.access);
-    const model = getModelRef(modelName, path);
-    if (model && runtime.hasModel(model))
+    const model = getModelRef(modelName, path, runtime);
+    if (model) {
+      const target = capturePopulateTargetConfiguration(runtime, model, `${modelName}.${path}`);
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model, void 0, globalOptions),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, target.options, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !(globalOptions.requireRegisteredPopulateModels === void 0 ? true : globalOptions.requireRegisteredPopulateModels)) {
-      targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
@@ -7938,20 +8271,20 @@ var copyAuthorizedOutput = (value) => {
   transferDocumentAuthorizationGraph(value, copy);
   return copy;
 };
-var isVirtualContainerValueForGuard = (value) => isPlainObject17(value) && "sub" in value;
+var isVirtualContainerValueForGuard = (value) => isPlainObject18(value) && "sub" in value;
 var getScopeVirtualsForGuard = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !isPlainObject17(rootVirtuals)) return null;
+  if (!rootVirtuals || !isPlainObject18(rootVirtuals)) return null;
   if (scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!isPlainObject17(current)) return null;
+    if (!isPlainObject18(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValueForGuard(container)) return null;
     current = container.sub;
-    if (!isPlainObject17(current)) return null;
+    if (!isPlainObject18(current)) return null;
   }
   return current;
 };
@@ -8017,7 +8350,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
       for (const entry of value) stripScope(entry, currentScope);
       return;
     }
-    if (!isPlainObject17(value)) return;
+    if (!isPlainObject18(value)) return;
     const record3 = value;
     const leaves = getScopeVirtualLeafNames(snapshot, currentScope);
     for (const leaf of leaves) {
@@ -8030,7 +8363,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
     for (const key of Object.keys(record3)) {
       if (leaves.has(key) || containers.has(key)) continue;
       const child = record3[key];
-      if (Array.isArray(child) || isPlainObject17(child)) {
+      if (Array.isArray(child) || isPlainObject18(child)) {
         stripScope(child, currentScope);
       }
     }
@@ -8042,7 +8375,7 @@ var LOGICAL_FILTER_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
 var isOperatorKey = (key) => key.startsWith("$");
 var REMOVED_VIRTUAL_FILTER = /* @__PURE__ */ Symbol("removed virtual filter clause");
 var rewriteFilterObject = (value, visit) => {
-  if (!isPlainObject17(value)) return value;
+  if (!isPlainObject18(value)) return value;
   let changed = false;
   const entries = [];
   for (const [key, child] of Object.entries(value)) {
@@ -8073,7 +8406,7 @@ var resolveVirtualFilterField = (path, scope2) => {
     if (!Object.hasOwn(scope2, segment) || scope2[segment] === void 0) return null;
     const definition = scope2[segment];
     if (!isVirtualContainerValueForGuard(definition)) return REMOVED_VIRTUAL_FILTER;
-    scope2 = isPlainObject17(definition.sub) ? definition.sub : null;
+    scope2 = isPlainObject18(definition.sub) ? definition.sub : null;
     inContainer = true;
   }
   return scope2;
@@ -8085,7 +8418,7 @@ var stripVirtualFilterOperator = (key, value, scope2) => {
   }
   if (key === "$all") {
     return rewriteFilterClauses(value, (entry) => {
-      if (!isPlainObject17(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
+      if (!isPlainObject18(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
       return rewriteFilterObject(entry, (operator, operand) => stripVirtualFilterOperator(operator, operand, scope2));
     });
   }
@@ -8100,7 +8433,7 @@ var stripVirtualFilterQuery = (value, scope2, element = false) => {
     if (isOperatorKey(key)) return element ? stripVirtualFilterOperator(key, child, scope2) : child;
     const fieldScope = resolveVirtualFilterField(key, scope2);
     if (fieldScope === REMOVED_VIRTUAL_FILTER) return REMOVED_VIRTUAL_FILTER;
-    if (!fieldScope || !isPlainObject17(child)) return child;
+    if (!fieldScope || !isPlainObject18(child)) return child;
     if (Object.keys(child).some(isOperatorKey)) {
       return rewriteFilterObject(
         child,
@@ -8124,7 +8457,7 @@ function getCorrelatedTemplateDepth(includes) {
   const visit = (entries, depth) => {
     const list = castArray2(entries).filter(Boolean);
     for (const entry of list) {
-      if (!isPlainObject17(entry)) continue;
+      if (!isPlainObject18(entry)) continue;
       max = Math.max(max, depth);
       const nested = entry.args?.include;
       if (nested !== void 0) {
@@ -8153,7 +8486,7 @@ function validateClientFilter(filter2) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!isPlainObject17(value)) return;
+    if (!isPlainObject18(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -8435,9 +8768,9 @@ var Base = class {
       const walk = (node, prefix) => {
         for (const [key, value] of Object.entries(node)) {
           if (value === void 0) continue;
-          if (isPlainObject17(value) && "sub" in value) {
+          if (isPlainObject18(value) && "sub" in value) {
             const sub = value.sub;
-            if (isPlainObject17(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
+            if (isPlainObject18(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
             continue;
           }
           out.push(prefix ? `${prefix}.${key}` : key);
@@ -8490,7 +8823,7 @@ var Base = class {
         this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
       }
       for (const entry of entries) {
-        if (!isPlainObject17(entry)) continue;
+        if (!isPlainObject18(entry)) continue;
         const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
         if (models.has(modelName)) continue;
         models.add(modelName);
@@ -9109,7 +9442,7 @@ import {
   get as get13,
   isArray as isArray10,
   isBoolean as isBoolean4,
-  isPlainObject as isPlainObject24,
+  isPlainObject as isPlainObject25,
   omit,
   set as set10,
   uniq as uniq2,
@@ -9210,7 +9543,7 @@ var model_default = Model;
 // src/acl/distinct-field-authorization.ts
 init_field_authorization();
 init_field_catalog();
-import { isPlainObject as isPlainObject18 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject19 } from "@web-ts-toolkit/utils";
 var schemaVariants = (schema) => Object.values(schema.discriminators ?? {});
 var scalarTypes = /* @__PURE__ */ new Set([
   "String",
@@ -9290,8 +9623,8 @@ function isDistinctFieldAuthorized(args) {
       if (path !== field && !path.startsWith(`${field}.`) && !field.startsWith(`${path}.`)) continue;
       if (path.startsWith(`${field}.`) && (!eligible(path) || !schemaShape(schema, path) || !granted(path)))
         return false;
-      if (isPlainObject18(raw) && raw.sub !== void 0) {
-        if (!isPlainObject18(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
+      if (isPlainObject19(raw) && raw.sub !== void 0) {
+        if (!isPlainObject19(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
       }
     }
     return true;
@@ -9469,7 +9802,7 @@ init_populate_target();
 
 // src/helpers/apply-update.ts
 init_lib();
-import { isPlainObject as isPlainObject22, set as set8 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject23, set as set8 } from "@web-ts-toolkit/utils";
 function applyUpdate(target, data, allowedFields) {
   const wholeFields = /* @__PURE__ */ new Set();
   const partialContainers = /* @__PURE__ */ new Set();
@@ -9489,7 +9822,7 @@ function applyUpdate(target, data, allowedFields) {
   const apply = (values, prefix = "") => {
     for (const [key, value] of Object.entries(values)) {
       const path = prefix ? `${prefix}.${key}` : key;
-      if (partialContainers.has(path) && !wholeFields.has(path) && (isPlainObject22(value) || Array.isArray(value))) {
+      if (partialContainers.has(path) && !wholeFields.has(path) && (isPlainObject23(value) || Array.isArray(value))) {
         apply(value, path);
       } else if (isDocument2(target)) {
         target.set(path, value);
@@ -9506,7 +9839,7 @@ init_document();
 init_request_work();
 init_logger_helpers();
 init_request_complexity();
-import { get as get10, isPlainObject as isPlainObject23, set as set9 } from "@web-ts-toolkit/utils";
+import { get as get10, isPlainObject as isPlainObject24, set as set9 } from "@web-ts-toolkit/utils";
 import { mongo as mongo5 } from "mongoose";
 
 // src/acl/select-resolution.ts
@@ -9623,7 +9956,7 @@ init_field_catalog();
 init_service_authorization();
 var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var inside = (path, root) => path === root || path.startsWith(`${root}.`);
-var record2 = (value) => isPlainObject23(value);
+var record2 = (value) => isPlainObject24(value);
 function inputValue(value) {
   if (typeof value === "function" || typeof value === "symbol") {
     authorizationError("input values must be persisted data, not functions or symbols");
@@ -10625,7 +10958,8 @@ var Service = class extends Base {
   async finalizeDirectOutput(args) {
     const { plan, context } = args;
     const { authorization, authorizationBinding: binding } = plan;
-    const { access, configuration } = readServiceAuthorization(authorization, binding);
+    const access = readServiceAuthorizationAccess(authorization, binding);
+    const configuration = readServiceOutputMetadata(authorization, binding);
     const source = getIncludeSource(args.doc);
     const snapshot = isolateDocForOutput(source);
     for (const key of Object.keys(snapshot))
@@ -10979,10 +11313,6 @@ var Service = class extends Base {
       const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
       const modelName = target?.modelName;
       if (!modelName) continue;
-      if (target.kind === "passthrough") {
-        result2.push({ path: descriptor.path, select: descriptor.select });
-        continue;
-      }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
       const svc = this.requestCore.getPublicService(modelName);
       const child = createRelatedExecution(
@@ -11001,7 +11331,7 @@ var Service = class extends Base {
       if (isExecutionRowDenied(svc, child)) continue;
       const childState = readServiceExecution(svc, child);
       const targetConfiguration = readServiceAuthorization(childState.authorization, childState.binding).configuration;
-      if (policy?.operation.mode !== "grant" && !await this.hookGate.run(
+      if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && policy?.operation.mode !== "grant" && !await this.hookGate.run(
         () => evaluateRouteGuard(
           this.req,
           getAuthorizationPermissions(childState.authorization, childState.binding),
@@ -11053,7 +11383,7 @@ var Service = class extends Base {
     if (this.isScalarPopulateValue(rawTarget)) return rawTarget;
     const isDoc = (() => {
       try {
-        if (isPlainObject24(rawTarget)) return true;
+        if (isPlainObject25(rawTarget)) return true;
         const maybe = rawTarget;
         if (maybe && typeof maybe === "object" && "_doc" in maybe) return true;
         if (maybe && typeof maybe.toObject === "function") return true;
@@ -13456,7 +13786,7 @@ init_helpers();
 
 // src/processors.ts
 init_permissions_alias();
-import { cloneDeep as cloneDeep5, forEach as forEach5, get as get14, hasOwn as hasOwn3, isArray as isArray11, isPlainObject as isPlainObject25, map, set as set11 } from "@web-ts-toolkit/utils";
+import { cloneDeep as cloneDeep5, forEach as forEach5, get as get14, hasOwn as hasOwn3, isArray as isArray11, isPlainObject as isPlainObject26, map, set as set11 } from "@web-ts-toolkit/utils";
 function cloneProcessorValue(value) {
   const copy = cloneDeep5(value);
   copyPermissionsAliasGraph(value, copy);
@@ -13496,7 +13826,7 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!isPlainObject25(target)) return ret;
+      if (!isPlainObject26(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
       if (isArray11(next)) {
@@ -13510,7 +13840,7 @@ function resolveLeafParents(obj, src) {
   const leaf = segs[segs.length - 1];
   const pairs = [];
   forEach5(targets, (target) => {
-    if (!isPlainObject25(target)) return;
+    if (!isPlainObject26(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -13531,7 +13861,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     forEach5(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
         forEach5(targets, (target) => {
-          if (!isPlainObject25(target)) return;
+          if (!isPlainObject26(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
@@ -13539,7 +13869,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           if (isArray11(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => isPlainObject25(item))) {
+            } else if (leaf.every((item) => isPlainObject26(item))) {
               depopulated = map(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
@@ -13549,7 +13879,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if (isPlainObject25(leaf)) {
+          } else if (isPlainObject26(leaf)) {
             const id = get14(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
@@ -13563,7 +13893,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!isPlainObject25(target)) return ret;
+          if (!isPlainObject26(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
           if (isArray11(next)) {
@@ -13669,7 +13999,7 @@ var countPaths = (docObject, operations, options = { mutable: true }) => {
       let count;
       if (isArray11(leafValue)) {
         count = leafValue.length;
-      } else if (isPlainObject25(leafValue)) {
+      } else if (isPlainObject26(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
@@ -13747,6 +14077,8 @@ init_core_shared();
 init_virtual_projection();
 init_populate_target();
 init_model_output_planning();
+init_authorization_snapshot();
+init_document();
 init_output_field_filter();
 init_request_work();
 var emptyPermissionLeaf = () => ({ $: "_" });
@@ -13857,17 +14189,11 @@ var Core = class {
     return this.genSelect(modelName, access, targetFields, options);
   }
   /** Persisted request-only populate admission; fetch planning is not field authority. */
-  async requestPopulateSelect(modelName, access, targetFields = null, scopePath = []) {
+  async requestPopulateSelect(configuration, permissions, access, targetFields = null, scopePath = []) {
     const subPaths = scopePath.flatMap((part) => [part, "sub"]);
-    const permissionSchema = getModelOption(modelName, ["permissionSchema"].concat(subPaths).join("."));
-    const permissions = this.getGlobalPermissions();
-    let virtualNames;
-    try {
-      const runtime = getActiveRuntime() ?? defaultRuntime;
-      virtualNames = runtime.getVirtualNames(modelName, subPaths);
-    } catch {
-      virtualNames = [];
-    }
+    const permissionSchema = get15(configuration, ["permissionSchema", ...subPaths]);
+    const prefix = scopePath.length ? `${scopePath.join(".")}.` : "";
+    const virtualNames = (configuration.catalog.virtualPaths ?? []).filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).filter((path) => !path.includes("."));
     return resolveSelectForRequest({
       req: this.req,
       permissionSchema,
@@ -13886,13 +14212,21 @@ var Core = class {
     assertPublicAdmission(_populate, "populate");
     assertPopulateAccess(access);
     if (!_populate) return [];
-    let populate = Array.isArray(_populate) ? _populate : [_populate];
-    for (const p of populate) {
+    const descriptors = copyAuthorizationValue(Array.isArray(_populate) ? _populate : [_populate], true);
+    for (const p of descriptors) {
       if (!isString6(p)) assertPopulateAccess(p.access);
     }
-    populate = compact3(
+    const runtime = this.requestRuntime;
+    const globalOptions = modelServiceGlobalOptions(this, runtime);
+    const relatedTargets = captureRelatedTargets(runtime, modelName, { populate: descriptors }, 0, globalOptions);
+    const sourceConfiguration = captureModelAuthorizationConfiguration(runtime, modelName, void 0, globalOptions);
+    const originalPermissions = this.getGlobalPermissions();
+    const permissions = new permission_default(
+      Object.fromEntries(originalPermissions.keys.map((key) => [key, originalPermissions.has(key)]))
+    );
+    const populate = compact3(
       await Promise.all(
-        populate.map(async (p) => {
+        descriptors.map(async (p) => {
           const populateAccess = !isString6(p) && p.access ? p.access : access;
           assertPopulateAccess(populateAccess);
           const originalSelect = isString6(p) ? void 0 : p.select;
@@ -13904,78 +14238,86 @@ var Core = class {
           const pathForSourcePermission = scopePrefix && ret.path.startsWith(`${scopePrefix}.`) ? ret.path.slice(scopePrefix.length + 1) : ret.path;
           const parentPath = pathForSourcePermission.includes(".") ? pathForSourcePermission.split(".")[0] : pathForSourcePermission;
           const allowedParentPaths = await this.requestPopulateSelect(
-            modelName,
+            sourceConfiguration,
+            permissions,
             populateAccess,
             [parentPath],
             scopePath
           );
           if (!allowedParentPaths.includes(parentPath)) return null;
-          const refModelName = getModelRef(modelName, ret.path);
-          if (!refModelName) return null;
-          const runtime = getActiveRuntime();
-          if (!runtime) return null;
-          const requireRegisteredPopulateModels = getGlobalOption("requireRegisteredPopulateModels", true);
-          if (!runtime.hasModel(refModelName)) {
-            return requireRegisteredPopulateModels ? null : ret;
-          }
-          const allowedTargetOperation = await this.isAllowed(refModelName, populateAccess);
-          if (!allowedTargetOperation) {
+          const target = relatedTargets.find((entry) => entry.path === ret.path);
+          if (!target) return null;
+          const refModelName = target.modelName;
+          const targetConfiguration = target.configuration;
+          if (targetConfiguration.requireOperationAccessForPopulateQueries !== false && !await withCapturedModelOperationGuard(
+            this,
+            refModelName,
+            populateAccess,
+            getCapturedAuthorizationOption(targetConfiguration, `operationAccess.${populateAccess}`),
+            permissions,
+            () => this.isAllowed(refModelName, populateAccess)
+          )) {
             return null;
           }
-          ret.select = await this.requestPopulateSelect(refModelName, populateAccess, ret.select);
-          const hookInputs = getModelOption(refModelName, `alwaysSelectFields.${populateAccess}`, []);
-          ret.select = uniq3([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
-          const filter2 = await this.genFilter(refModelName, populateAccess, null);
+          ret.select = await this.requestPopulateSelect(
+            targetConfiguration,
+            permissions,
+            populateAccess,
+            ret.select
+          );
+          const hookInputs = resolveAlwaysSelectForAccess(
+            targetConfiguration.alwaysSelectFields,
+            populateAccess
+          );
+          ret.select = uniq3([
+            ...ret.select,
+            ...stripVirtuals(hookInputs, [...targetConfiguration.catalog.virtualPaths ?? []])
+          ]);
+          const match = isString6(p) ? {} : p.match ?? {};
+          const filter2 = await resolveAccessFilterForRequest({
+            req: this.req,
+            permissions,
+            cache: this.caches.baseFilter,
+            cacheKey: `${refModelName}_baseFilter_${populateAccess}`,
+            access: populateAccess,
+            filter: deepIsolateValue(match),
+            getOption: (key) => getCapturedAuthorizationOption(targetConfiguration, key)
+          });
           if (filter2 === false) return null;
-          ret.match = filter2;
-          try {
-            const planAccess = populateAccess;
-            const targetSnapshot = {
-              permissionSchema: getModelOption(refModelName, "permissionSchema", null) ?? null,
-              virtuals: getModelOption(refModelName, "virtuals", null) ?? null,
-              alwaysSelectFields: getModelOption(refModelName, "alwaysSelectFields", null) ?? null,
-              modelPermissionPrefix: getModelOption(refModelName, "modelPermissionPrefix", "") ?? "",
-              requireExplicitSelect: getModelOption(refModelName, "requireExplicitSelect", false) ?? false,
-              documentPermissionField: getModelOption(refModelName, "documentPermissionField", "_permissions") ?? "_permissions",
-              exposedDocPermissionKeys: getModelOption(refModelName, "exposedDocPermissionKeys", void 0),
-              stripPermissionsField: getModelOption(refModelName, "stripPermissionsField", false) ?? false,
-              disableFieldPermissions: getModelOption(refModelName, "disableFieldPermissions", false) ?? false
-            };
-            const perms = this.getPermissions();
-            const globalForPlan = perms && typeof perms.has === "function" && typeof perms.hasKey === "function" ? perms : { has: () => false, hasKey: () => false };
-            const targetPlan = planVirtualProjection({
-              receivingModelName: refModelName,
-              snapshot: {
-                permissionSchema: targetSnapshot.permissionSchema,
-                virtuals: targetSnapshot.virtuals,
-                alwaysSelectFields: targetSnapshot.alwaysSelectFields,
-                modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
-                requireExplicitSelect: targetSnapshot.requireExplicitSelect,
-                documentPermissionField: targetSnapshot.documentPermissionField
-              },
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              internalFetch: { baseFields: ["_id"] },
-              globalPermissions: globalForPlan
-            });
-            const merged = uniq3([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
-              (t) => t !== "-_id" && !t.includes(".sub.")
-            );
-            if (!merged.includes("_id")) merged.push("_id");
-            ret.select = merged;
-            setPopulateTargetMeta(ret, {
-              targetModelName: refModelName,
-              virtualAccess: planAccess,
-              outputAccess: planAccess,
-              docPermissionsAccess: planAccess,
-              requestedSelect: originalSelect,
-              plan: targetPlan,
-              snapshot: targetSnapshot
-            });
-          } catch {
-          }
+          ret.match = deepIsolateValue(intersectFilters(match, filter2));
+          const planAccess = populateAccess;
+          const targetSnapshot = targetConfiguration;
+          const targetPlan = planVirtualProjection({
+            receivingModelName: refModelName,
+            snapshot: {
+              permissionSchema: targetSnapshot.permissionSchema,
+              virtuals: targetSnapshot.virtuals,
+              alwaysSelectFields: targetSnapshot.alwaysSelectFields,
+              modelPermissionPrefix: targetSnapshot.modelPermissionPrefix,
+              requireExplicitSelect: targetSnapshot.requireExplicitSelect,
+              documentPermissionField: targetSnapshot.documentPermissionField
+            },
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            internalFetch: { baseFields: ["_id"] },
+            globalPermissions: permissions
+          });
+          const merged = uniq3([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
+            (t) => t !== "-_id" && !t.includes(".sub.")
+          );
+          if (!merged.includes("_id")) merged.push("_id");
+          ret.select = merged;
+          setPopulateTargetMeta(ret, {
+            targetModelName: refModelName,
+            virtualAccess: planAccess,
+            outputAccess: planAccess,
+            docPermissionsAccess: planAccess,
+            requestedSelect: originalSelect,
+            plan: targetPlan,
+            snapshot: targetSnapshot
+          });
           return ret;
         })
       )
@@ -14299,12 +14641,12 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if (isPlainObject26(condition)) {
+    if (isPlainObject27(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
       let _id = isString7(id) ? id : null;
-      if (isPlainObject26(id)) {
+      if (isPlainObject27(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
@@ -14346,7 +14688,7 @@ import express2 from "express";
 
 // src/routers/model-router.ts
 import JsonRouter8 from "@web-ts-toolkit/express-json-router";
-import { forEach as forEach7, isPlainObject as isPlainObject28, isString as isString8, isUndefined as isUndefined2, normalizeUrlPath as normalizeUrlPath3, padEnd } from "@web-ts-toolkit/utils";
+import { forEach as forEach7, isPlainObject as isPlainObject29, isString as isString8, isUndefined as isUndefined2, normalizeUrlPath as normalizeUrlPath3, padEnd } from "@web-ts-toolkit/utils";
 init_logger_helpers();
 init_runtime();
 init_runtime_context();
@@ -14480,7 +14822,7 @@ import JsonRouter7 from "@web-ts-toolkit/express-json-router";
 
 // src/validation/common.ts
 import { z as z2 } from "zod";
-import { isPlainObject as isPlainObject27 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject28 } from "@web-ts-toolkit/utils";
 
 // src/validation/public-admission-schema.ts
 init_public_admission();
@@ -14609,7 +14951,7 @@ var correlatedFilterSchema = z2.record(z2.string(), z2.unknown()).superRefine((f
   }
 });
 var correlatedEmptyOptionsSchema = z2.unknown().refine(
-  (value) => value === void 0 || isPlainObject27(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || isPlainObject28(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = z2.string().min(1).superRefine((path, ctx) => {
@@ -14646,7 +14988,7 @@ var correlatedListArgsSchema = z2.object({
   include: z2.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = z2.unknown().refine(
-  (value) => value === void 0 || isPlainObject27(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || isPlainObject28(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = z2.object({
@@ -14699,7 +15041,7 @@ var correlatedNestedIncludeSchema = z2.union([includeItemSchema, z2.array(includ
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if (isPlainObject27(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if (isPlainObject28(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: z2.ZodIssueCode.custom,
@@ -16700,7 +17042,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && isPlainObject28(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject29(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(
         this.modelName,
@@ -17234,7 +17576,7 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 import JsonRouter10 from "@web-ts-toolkit/express-json-router";
-import { isPlainObject as isPlainObject29, isString as isString9, isUndefined as isUndefined3, normalizeUrlPath as normalizeUrlPath5 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject30, isString as isString9, isUndefined as isUndefined3, normalizeUrlPath as normalizeUrlPath5 } from "@web-ts-toolkit/utils";
 init_runtime();
 init_helpers();
 init_schemas();
@@ -17450,7 +17792,7 @@ var DataRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && isPlainObject29(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject30(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -17609,7 +17951,7 @@ function createRuntimeApi(runtime) {
     if (arguments.length === 2 && isString10(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && isPlainObject30(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject31(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };