@web-ts-toolkit/access-router 0.57.0 → 0.58.0

package/index.js

@@ -3543,6 +3543,47 @@ function serviceAuthorizationInput(policy, targets) {
   }
   return { rows: policy.rows, outputFields: policy.outputFields, related };
 }
+function hasStableConfigurationCopies(value) {
+  if (value === null || typeof value !== "object") return true;
+  if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return false;
+  return Object.values(value).every(hasStableConfigurationCopies);
+}
+function captureAuthorizationAccess(value) {
+  const input = authorizationRecord(value, "access");
+  const access = {};
+  for (const key of ["operation", "rowAccess", "virtualAccess", "outputAccess", "docPermissionsAccess"]) {
+    if (key === "rowAccess" && input[key] === void 0) continue;
+    if (typeof input[key] !== "string") authorizationError(`invalid access.${key}`);
+    access[key] = input[key];
+  }
+  return Object.freeze(access);
+}
+function captureAuthorizationCatalog(value) {
+  const input = authorizationRecord(value, "catalog");
+  const catalog = {};
+  for (const key of [
+    "paths",
+    "persistedPaths",
+    "arrayPaths",
+    "schemaVirtualPaths",
+    "metadataPaths",
+    "dynamicPaths",
+    "containerPaths",
+    "virtualPaths",
+    "virtualScopePaths",
+    "opaquePaths",
+    "referencePaths",
+    "protectedPaths"
+  ]) {
+    const paths = input[key];
+    if (key !== "paths" && paths === void 0) continue;
+    if (!Array.isArray(paths) || Array.from(paths).some((path) => typeof path !== "string")) {
+      authorizationError(`invalid catalog.${key}`);
+    }
+    catalog[key] = paths;
+  }
+  return Object.freeze(catalog);
+}
 function assertAuthorizationPath(path) {
   if (typeof path !== "string" || !isSafeOutputPath(path)) {
     authorizationError(`invalid response path: ${String(path)}`);
@@ -3672,6 +3713,9 @@ function resolveServiceAuthorization(input) {
   const raw = copyAuthorizationValue(input.authorization);
   const configuration = copyAuthorizationValue(input.configuration, true);
   const targets = copyAuthorizationValue(input.relatedTargets ?? [], true);
+  const access = copyAuthorizationValue(input.access);
+  const outputAccess = captureAuthorizationAccess(access);
+  const catalog = captureAuthorizationCatalog(configuration.catalog);
   const policy = copyAuthorizationValue(normalizePolicy(raw, input.applicability ?? "service", configuration, targets));
   const scopePath = Array.from(scope(input.binding));
   for (const part of scopePath) {
@@ -3684,17 +3728,21 @@ function resolveServiceAuthorization(input) {
       authorizationError("derived call request/runtime mismatch");
     }
   }
-  const permissions = Object.fromEntries(
-    input.requestPermissions.keys.map((key) => [key, input.requestPermissions.has(key)])
+  const permissions = new permission_default(
+    Object.fromEntries(input.requestPermissions.keys.map((key) => [key, input.requestPermissions.has(key) === true]))
   );
+  for (const value of Object.values(permissions)) if (value && typeof value === "object") Object.freeze(value);
+  Object.freeze(permissions);
   const call = Object.freeze(/* @__PURE__ */ Object.create(null));
   calls.set(call, {
     binding: Object.freeze({ ...input.binding, scopePath: Object.freeze(scopePath) }),
-    access: copyAuthorizationValue(input.access),
+    access,
     configuration,
     policy,
     relatedTargets: targets,
-    permissions: Object.freeze(permissions),
+    // normalizeFields constructs only mode strings and validated string paths.
+    output: Object.freeze({ access: outputAccess, catalog, outputFields: policy.outputFields }),
+    permissions,
     provenance: input.parent ? callRecord(input.parent).provenance : call
   });
   return call;
@@ -3712,12 +3760,75 @@ function readServiceAuthorization(call, binding) {
     true
   );
 }
+function readServiceAuthorizationAccess(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return callRecord(call).output.access;
+}
+function readServiceAuthorizationHydration(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return copyAuthorizationValue({ hydration: callRecord(call).configuration.hydration }, true);
+}
+function outputMetadata(configuration) {
+  return {
+    documentPermissionField: configuration.documentPermissionField,
+    exposedDocPermissionKeys: configuration.exposedDocPermissionKeys,
+    stripPermissionsField: configuration.stripPermissionsField,
+    disableFieldPermissions: configuration.disableFieldPermissions
+  };
+}
+function readServiceOutputMetadata(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return copyAuthorizationValue(outputMetadata(callRecord(call).configuration), true);
+}
+function readServiceDocumentPermissions(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  return Object.freeze({
+    catalog: record3.output.catalog,
+    ...copyAuthorizationValue({ docPermissions: record3.configuration.docPermissions }, true)
+  });
+}
+function readServiceFinalizerConfiguration(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  return Object.freeze({
+    catalog: record3.output.catalog,
+    ...copyAuthorizationValue(
+      {
+        ...outputMetadata(record3.configuration),
+        virtuals: record3.configuration.virtuals,
+        docPermissions: record3.configuration.docPermissions
+      },
+      true
+    )
+  });
+}
+function readServiceOutputPolicy(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  return callRecord(call).output;
+}
+function readServiceOutputFieldAuthorization(call, binding) {
+  assertAuthorizationBinding(call, binding);
+  const record3 = callRecord(call);
+  const reusable = record3.reusableFieldConfiguration ??= hasStableConfigurationCopies(record3.configuration.permissionSchema) && // Coercion methods can observe an object's identity even without native
+  // leaves. Keep those receivers local to the original resolution boundary.
+  (record3.configuration.modelPermissionPrefix === null || typeof record3.configuration.modelPermissionPrefix !== "object");
+  return Object.freeze({
+    access: record3.output.access,
+    outputFields: record3.output.outputFields,
+    reusable,
+    ...copyAuthorizationValue(
+      {
+        permissionSchema: record3.configuration.permissionSchema,
+        modelPermissionPrefix: record3.configuration.modelPermissionPrefix
+      },
+      true
+    )
+  });
+}
 function getAuthorizationPermissions(call, binding) {
   assertAuthorizationBinding(call, binding);
-  const permission = new permission_default({ ...callRecord(call).permissions });
-  for (const value of Object.values(permission)) if (value && typeof value === "object") Object.freeze(value);
-  Object.freeze(permission);
-  return permission;
+  return callRecord(call).permissions;
 }
 function getAuthorizationProvenance(call) {
   return callRecord(call).provenance;
@@ -3756,7 +3867,7 @@ function normalizeOutputAuthorizationOptions(input, options, purpose) {
     const stage = stageRecord(documentRecord(handle).stage);
     const binding = Object.freeze({ ...input.binding, scopePath: stage.binding.scopePath });
     assertAuthorizationBinding(stage.call, binding);
-    const access = readServiceAuthorization(stage.call, binding).access;
+    const access = readServiceAuthorizationAccess(stage.call, binding);
     if (input.access.outputAccess !== access.outputAccess) authorizationError("document access mismatch");
     return Object.freeze({ kind: "document", documentAuthorization: handle, binding });
   }
@@ -3834,7 +3945,16 @@ function readDocumentAuthorization(handle, binding) {
     authorization: stage.call,
     stage: record3.stage,
     grants: copyAuthorizationValue(record3.grants),
-    ...readServiceAuthorization(stage.call, binding).access
+    ...readServiceAuthorizationAccess(stage.call, binding)
+  });
+}
+function readDocumentAuthorizationAccess(handle, binding) {
+  const record3 = documentRecord(handle);
+  const stage = stageRecord(record3.stage);
+  return Object.freeze({
+    authorization: stage.call,
+    stage: record3.stage,
+    ...readServiceAuthorizationAccess(stage.call, binding)
   });
 }
 function memoizeDocumentFieldDecision(handle, binding, field, evaluate) {
@@ -3842,15 +3962,23 @@ function memoizeDocumentFieldDecision(handle, binding, field, evaluate) {
   const stage = stageRecord(record3.stage);
   assertAuthorizationBinding(stage.call, binding);
   let decision = record3.decisions.get(field);
-  if (!decision) {
+  if (decision) {
+    return decision.then((result2) => {
+      stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
+      return result2;
+    });
+  } else {
     decision = Promise.resolve().then(async () => {
       stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
       const result2 = await evaluate.call(
         stage.binding.request,
         getAuthorizationPermissions(stage.call, binding),
         copyAuthorizationValue(record3.grants)
       );
       stageRecord(record3.stage);
+      assertAuthorizationBinding(stage.call, binding);
       if (typeof result2 !== "boolean") authorizationError("field decision must be boolean");
       return result2;
     });
@@ -3867,7 +3995,7 @@ function assertDocumentAuthorization(handle, use) {
   const record3 = documentRecord(handle);
   const stage = stageRecord(record3.stage);
   assertAuthorizationBinding(stage.call, use.binding);
-  if (use.authorization !== void 0 && stage.call !== use.authorization || use.stage !== void 0 && record3.stage !== use.stage || readServiceAuthorization(stage.call, use.binding).access.outputAccess !== use.outputAccess) {
+  if (use.authorization !== void 0 && stage.call !== use.authorization || use.stage !== void 0 && record3.stage !== use.stage || readServiceAuthorizationAccess(stage.call, use.binding).outputAccess !== use.outputAccess) {
     authorizationError("document call/access/stage mismatch");
   }
   const association = outputs.get(use.output);
@@ -3922,7 +4050,7 @@ function transferDocumentAuthorizationGraph(source, copy, copyOrigins) {
         {
           binding: stage.binding,
           output: original,
-          outputAccess: readServiceAuthorization(stage.call, stage.binding).access.outputAccess,
+          outputAccess: readServiceAuthorizationAccess(stage.call, stage.binding).outputAccess,
           authorization: stage.call,
           stage: documentRecord(association.handle).stage
         },
@@ -4087,12 +4215,20 @@ function classifyRequestFieldRule(rule, permissions, modelPermissionPrefix = "")
   );
   return (typeof rule === "string" ? possible.stringHandler(rule) : possible.arrayHandler(rule)) ? "deferred" : "denied";
 }
+function prepareRequestFieldRule(rule, permissions, modelPermissionPrefix = "") {
+  const state = classifyRequestFieldRule(rule, permissions, modelPermissionPrefix);
+  const invariant = state === "denied" && modelPermissionPrefix ? classifyRequestFieldRule(rule, permissions) : state;
+  return Object.freeze({ state, decision: invariant === "deferred" ? void 0 : invariant === "granted" });
+}
+function combineFieldAuthorizationStates(states2) {
+  return states2.includes("denied") ? "denied" : states2.includes("deferred") ? "deferred" : "granted";
+}
 function classifyEffectiveFieldAuthorization(args) {
   if (hasExplicitFieldGrant(args.outputFields, args.path)) return "granted";
   const states2 = args.rules.map(
     (rule) => classifyRequestFieldRule(rule, args.globalPermissions, args.modelPermissionPrefix)
   );
-  return states2.includes("denied") ? "denied" : states2.includes("deferred") ? "deferred" : "granted";
+  return combineFieldAuthorizationStates(states2);
 }
 async function evaluateScopedAccessRule(args) {
   const { req, rule, globalPermissions, docPermissions, modelPermissionPrefix } = args;
@@ -5741,16 +5877,111 @@ var init_virtual_populate_execution = __esm({
 });
 
 // src/acl/output-field-filter.ts
+function callFieldPolicy(authorization, binding) {
+  assertAuthorizationBinding(authorization, binding);
+  let policy = fieldPolicies.get(authorization);
+  if (!policy) {
+    const view = readServiceOutputFieldAuthorization(authorization, binding);
+    policy = {
+      schema: view.permissionSchema,
+      requestPaths: view.permissionSchema == null || (0, import_utils28.isPlainObject)(view.permissionSchema) && Object.isFrozen(view.permissionSchema) ? Object.freeze(Object.keys(view.permissionSchema ?? {})) : void 0,
+      prefix: view.modelPermissionPrefix ?? "",
+      outputFields: view.outputFields,
+      accesses: /* @__PURE__ */ new Map()
+    };
+    if (view.reusable) fieldPolicies.set(authorization, policy);
+  }
+  return policy;
+}
+function requestRuleClassification(entry, authorization, permissions, prefix) {
+  if (typeof prefix !== "string") return void 0;
+  let classification = entry.classifications.get(authorization);
+  if (!classification) {
+    classification = prepareRequestFieldRule(entry.rule, permissions, prefix);
+    entry.classifications.set(authorization, classification);
+  }
+  return classification;
+}
+function invariantRuleLookup(schema, path) {
+  if (schema == null) return true;
+  if (!(0, import_utils28.isPlainObject)(schema) || !Object.isFrozen(schema)) return false;
+  const exact = Object.getOwnPropertyDescriptor(schema, path);
+  if (exact) {
+    const raw2 = exact.value;
+    return !raw2 || typeof raw2 !== "object" || Array.isArray(raw2) || (0, import_utils28.isPlainObject)(raw2) && Object.isFrozen(raw2);
+  }
+  const [head, ...rest] = path.split(".");
+  const raw = Object.getOwnPropertyDescriptor(schema, head)?.value;
+  if (raw == null) return true;
+  if (!(0, import_utils28.isPlainObject)(raw) || !Object.isFrozen(raw)) return false;
+  const sub = Object.getOwnPropertyDescriptor(raw, "sub");
+  return !rest.length || !sub || invariantRuleLookup(sub.value, rest.join("."));
+}
+function prepareOutputPath(policy, authorization, binding, path, access) {
+  let cache = policy.accesses.get(access);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    policy.accesses.set(access, cache);
+  }
+  let prepared = cache.get(path);
+  if (!prepared) {
+    const invariant = invariantRuleLookup(policy.schema, path);
+    const permissions = getAuthorizationPermissions(authorization, binding);
+    const entries = extractOutputFieldRuleEntries(policy.schema, path, access).map((entry) => ({
+      ...entry,
+      classifications: /* @__PURE__ */ new WeakMap()
+    }));
+    const classifications = entries.map(
+      (entry) => requestRuleClassification(entry, authorization, permissions, policy.prefix)
+    );
+    const backendGrant = hasExplicitFieldGrant(policy.outputFields, path);
+    prepared = {
+      entries,
+      backendGrant,
+      state: backendGrant ? "granted" : classifications.every((value) => value !== void 0) ? combineFieldAuthorizationStates(classifications.map((value) => value.state)) : void 0
+    };
+    if (invariant) cache.set(path, prepared);
+  }
+  return prepared;
+}
+function assertOwningOutputDocuments(handle) {
+  const owner = owningDocuments.get(handle);
+  if (owner) {
+    readDocumentAuthorizationAccess(owner.handle, owner.binding);
+    assertOwningOutputDocuments(owner.handle);
+  }
+}
+function prepareOutputDocumentAuthorization(authorization, binding, configuration) {
+  const access = readServiceAuthorizationAccess(authorization, binding);
+  const key = `docPermissions.${access.docPermissionsAccess}`;
+  const docPermissions = configuration.docPermissions;
+  const invariant = /^[A-Za-z0-9_-]+$/.test(access.docPermissionsAccess) && (docPermissions == null || (0, import_utils28.isPlainObject)(docPermissions));
+  const option = invariant ? getCapturedAuthorizationOption(configuration, key) : void 0;
+  const hook = typeof option === "function" ? option : void 0;
+  const resolveHook = invariant ? () => hook : () => {
+    const slice = { catalog: configuration.catalog, ...copyAuthorizationValue({ docPermissions }, true) };
+    const option2 = getCapturedAuthorizationOption(slice, key);
+    return typeof option2 === "function" ? option2 : void 0;
+  };
+  return async (args) => {
+    if (args.authorization !== authorization) authorizationError("document resolver call mismatch");
+    assertAuthorizationBinding(authorization, args.binding);
+    return resolveOutputDocumentAuthorizationWithHook(args, access, resolveHook);
+  };
+}
 async function resolveOutputDocumentAuthorization(args) {
+  const configuration = readServiceDocumentPermissions(args.authorization, args.binding);
+  return prepareOutputDocumentAuthorization(args.authorization, args.binding, configuration)(args);
+}
+async function resolveOutputDocumentAuthorizationWithHook(args, access, resolveHook) {
   const { authorization, binding } = args;
-  const { configuration, access } = readServiceAuthorization(authorization, binding);
   const stage = args.stage ?? createDocumentAuthorizationStage(authorization, binding, args.snapshot);
   if (args.stage) assertDocumentAuthorizationStage(stage, authorization, binding, args.snapshot);
   const handle = await resolveDocumentAuthorization(stage, async function(doc, permissions) {
     if (args.owningDocument) return readDocumentAuthorization(args.owningDocument, args.owningBinding).grants;
     if (args.knownOutput) return {};
-    const hook = getCapturedAuthorizationOption(configuration, `docPermissions.${access.docPermissionsAccess}`);
-    if (typeof hook !== "function") return {};
+    const hook = resolveHook();
+    if (!hook) return {};
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
@@ -5771,6 +6002,7 @@ async function resolveOutputDocumentAuthorization(args) {
   return handle;
 }
 function evaluateRequestRule(handle, binding, entry, prefix, access) {
+  assertOwningOutputDocuments(handle);
   const owner = owningDocuments.get(handle);
   if (owner && !entry.path.startsWith(`${(binding.scopePath ?? []).join(".")}.`)) {
     return evaluateRequestRule(owner.handle, owner.binding, entry, prefix, access);
@@ -5779,65 +6011,78 @@ function evaluateRequestRule(handle, binding, entry, prefix, access) {
     handle,
     binding,
     `request:${access}:${entry.path}`,
-    function(permissions, grants) {
-      return evaluateScopedAccessRule({
-        req: this,
-        rule: entry.rule,
-        globalPermissions: permissions,
-        docPermissions: grants,
-        modelPermissionPrefix: prefix
-      });
+    async function(permissions, grants) {
+      const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+      const classification = requestRuleClassification(entry, authorization, permissions, prefix);
+      let allowed = classification?.decision;
+      if (allowed === void 0) {
+        allowed = await evaluateScopedAccessRule({
+          req: this,
+          rule: entry.rule,
+          globalPermissions: permissions,
+          docPermissions: grants,
+          modelPermissionPrefix: prefix
+        });
+      }
+      assertOwningOutputDocuments(handle);
+      return allowed;
     }
   );
 }
 function evaluateAuthorizedOutputField(handle, binding, field) {
-  const { authorization } = readDocumentAuthorization(handle, binding);
-  const { configuration, authorization: policy, access } = readServiceAuthorization(authorization, binding);
+  const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+  assertOwningOutputDocuments(handle);
   const path = [...binding.scopePath ?? [], field].join(".");
-  const entries = extractOutputFieldRuleEntries(
-    configuration.permissionSchema,
-    path,
-    access.outputAccess
-  );
-  return memoizeDocumentFieldDecision(handle, binding, `output:${path}`, function(permissions, grants) {
-    const args = {
+  const decision = memoizeDocumentFieldDecision(handle, binding, `output:${path}`, async function(permissions) {
+    const policy = callFieldPolicy(authorization, binding);
+    const { outputAccess } = readDocumentAuthorizationAccess(handle, binding);
+    const prepared = prepareOutputPath(policy, authorization, binding, path, outputAccess);
+    const unresolved = unresolvedDocuments.has(handle);
+    const state = unresolved ? prepared.state ?? classifyEffectiveFieldAuthorization({
       path,
-      rules: entries.map((entry) => entry.rule),
+      rules: prepared.entries.map((entry) => entry.rule),
+      modelPermissionPrefix: policy.prefix,
       outputFields: policy.outputFields,
-      globalPermissions: permissions,
-      modelPermissionPrefix: configuration.modelPermissionPrefix ?? ""
-    };
-    if (unresolvedDocuments.has(handle) && classifyEffectiveFieldAuthorization(args) !== "granted") return false;
-    return evaluateEffectiveFieldAuthorization({
-      ...args,
-      req: this,
-      docPermissions: grants,
-      evaluateRule: (_rule, index) => evaluateRequestRule(handle, binding, entries[index], args.modelPermissionPrefix, access.outputAccess)
-    });
+      globalPermissions: permissions
+    }) : void 0;
+    let allowed;
+    if (unresolved && state !== "granted") allowed = false;
+    else if (prepared.backendGrant) allowed = true;
+    else {
+      allowed = true;
+      for (const entry of prepared.entries) {
+        if (!await evaluateRequestRule(handle, binding, entry, policy.prefix, outputAccess)) {
+          allowed = false;
+          break;
+        }
+      }
+    }
+    assertOwningOutputDocuments(handle);
+    return allowed;
   });
+  return owningDocuments.has(handle) ? decision.then((allowed) => {
+    assertOwningOutputDocuments(handle);
+    return allowed;
+  }) : decision;
 }
 async function requestOutputFieldPaths(handle, binding, access) {
-  const { authorization } = readDocumentAuthorization(handle, binding);
-  const { configuration } = readServiceAuthorization(authorization, binding);
-  const schema = configuration.permissionSchema;
+  const { authorization } = readDocumentAuthorizationAccess(handle, binding);
+  assertOwningOutputDocuments(handle);
+  const policy = callFieldPolicy(authorization, binding);
   const fields = [];
-  for (const path of Object.keys(schema ?? {})) {
-    const entries = extractOutputFieldRuleEntries(schema, path, access);
+  for (const path of policy.requestPaths ?? Object.keys(policy.schema ?? {})) {
+    const { entries } = prepareOutputPath(policy, authorization, binding, path, access);
     let allowed = true;
     for (const entry of entries) {
-      if (!await evaluateRequestRule(
-        handle,
-        binding,
-        entry,
-        configuration.modelPermissionPrefix ?? "",
-        access
-      )) {
+      if (!await evaluateRequestRule(handle, binding, entry, policy.prefix, access)) {
         allowed = false;
         break;
       }
     }
     if (allowed && entries.length) fields.push(path);
   }
+  assertOwningOutputDocuments(handle);
+  readDocumentAuthorizationAccess(handle, binding);
   return fields;
 }
 function authorizeEmbeddedOutputPlan(parent, child) {
@@ -5858,13 +6103,13 @@ function authorizeEmbeddedOutputPlan(parent, child) {
 function hasWholeOutputValueGrant(plan, field) {
   if (plan.fieldStates?.[field] !== "granted") return false;
   const binding = plan.authorizationBinding;
-  const { authorization } = readServiceAuthorization(plan.authorization, binding);
-  return hasExplicitFieldGrant(authorization.outputFields, [...binding.scopePath ?? [], field].join("."));
+  const { outputFields } = readServiceOutputPolicy(plan.authorization, binding);
+  return hasExplicitFieldGrant(outputFields, [...binding.scopePath ?? [], field].join("."));
 }
 function copyOutputValue(value, plan, path) {
-  const { configuration } = readServiceAuthorization(plan.authorization, plan.authorizationBinding);
-  const virtualValue = configuration.catalog.virtualPaths?.some((p) => matchesCatalogPattern(p, path));
-  const opaque = configuration.catalog.opaquePaths?.some((p) => matchesCatalogPattern(p, path));
+  const { catalog } = readServiceOutputPolicy(plan.authorization, plan.authorizationBinding);
+  const virtualValue = catalog.virtualPaths?.some((p) => matchesCatalogPattern(p, path));
+  const opaque = catalog.opaquePaths?.some((p) => matchesCatalogPattern(p, path));
   const excluded = plan.effectiveSelectNorm.filter((token) => token.startsWith("-")).map((token) => [...plan.authorizationBinding.scopePath ?? [], token.slice(1)].join("."));
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
@@ -5875,7 +6120,7 @@ function copyOutputValue(value, plan, path) {
       const child = `${current}.${key}`;
       if (excluded.some((entry2) => child === entry2 || child.startsWith(`${entry2}.`))) continue;
       const safeValueKey = !["__proto__", "constructor", "prototype", "_doc", "$__", "__v"].includes(key);
-      if (!(opaque ? safeValueKey : isSafeOutputPath(key)) || configuration.catalog.protectedPaths?.some((p) => matchesCatalogPattern(p, child, true)) || !opaque && !virtualValue && !isCatalogOutputPath(configuration.catalog, child))
+      if (!(opaque ? safeValueKey : isSafeOutputPath(key)) || catalog.protectedPaths?.some((p) => matchesCatalogPattern(p, child, true)) || !opaque && !virtualValue && !isCatalogOutputPath(catalog, child))
         continue;
       output[key] = visit(entry, child);
     }
@@ -5955,7 +6200,7 @@ async function filterExistingOutput(source, plan, handle, associated) {
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
-          const state = readDocumentAuthorization(childHandle, scoped.authorizationBinding);
+          const state = readDocumentAuthorizationAccess(childHandle, scoped.authorizationBinding);
           if (getAuthorizationProvenance(state.authorization) !== getAuthorizationProvenance(plan.authorization))
             authorizationError("child call mismatch");
           child = helperPlan(state.authorization, scoped.authorizationBinding);
@@ -6019,7 +6264,7 @@ async function filterModelOutputForHelper(args) {
   if (normalized.kind === "document") {
     const { documentAuthorization: handle2, binding: binding2 } = normalized;
     assertDocumentAuthorization(handle2, { binding: binding2, output: args.doc, outputAccess: access });
-    const state = readDocumentAuthorization(handle2, binding2);
+    const state = readDocumentAuthorizationAccess(handle2, binding2);
     return filterExistingOutput(
       args.doc,
       helperPlan(state.authorization, binding2),
@@ -6042,7 +6287,7 @@ async function filterModelOutputForHelper(args) {
   });
   return filterExistingOutput(source, plan, handle, false);
 }
-var import_utils28, unresolvedDocuments, owningDocuments;
+var import_utils28, unresolvedDocuments, owningDocuments, fieldPolicies;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
     import_utils28 = require("@web-ts-toolkit/utils");
@@ -6059,6 +6304,7 @@ var init_output_field_filter = __esm({
     init_output_projection();
     unresolvedDocuments = /* @__PURE__ */ new WeakSet();
     owningDocuments = /* @__PURE__ */ new WeakMap();
+    fieldPolicies = /* @__PURE__ */ new WeakMap();
   }
 });
 
@@ -6127,15 +6373,41 @@ __export(finalize_model_output_exports, {
   finalizeModelOutput: () => finalizeModelOutput,
   finalizeModelOutputs: () => finalizeModelOutputs
 });
-async function finalizeSingleDoc(args, input) {
-  const scopePath = args.scopePath;
+function assertFinalizerCall(args, prepared) {
   const plan = args.plan;
   const binding = plan.authorizationBinding;
-  const captured = plan.authorization && binding ? readServiceAuthorization(plan.authorization, binding) : void 0;
-  if (plan.authorization && (!binding || binding.request !== args.request || binding.modelName !== args.receivingModelName || captured?.access.virtualAccess !== args.virtualAccess || captured.access.outputAccess !== args.outputAccess || captured.access.docPermissionsAccess !== args.docPermissionsAccess || (binding.scopePath ?? []).join(".") !== scopePath.filter((p) => p !== "sub").join("."))) {
+  if (plan.authorization !== prepared.authorization) authorizationError("finalizer call changed during pass");
+  if (plan.authorization && binding) assertAuthorizationBinding(plan.authorization, binding);
+  const access = prepared.policy?.access;
+  if (plan.authorization && (!binding || binding.request !== args.request || binding.modelName !== args.receivingModelName || access?.virtualAccess !== args.virtualAccess || access.outputAccess !== args.outputAccess || access.docPermissionsAccess !== args.docPermissionsAccess || (binding.scopePath ?? []).join(".") !== args.scopePath.filter((p) => p !== "sub").join("."))) {
     authorizationError("finalizer call/model/scope/access mismatch");
   }
-  const snapshot = captured ? captured.configuration : args.snapshot;
+}
+function prepareFinalizer(args, sharedContext = false) {
+  const { authorization, authorizationBinding: binding } = args.plan;
+  const policy = authorization && binding ? readServiceOutputPolicy(authorization, binding) : void 0;
+  assertFinalizerCall(args, { authorization, policy });
+  const configuration = authorization ? readServiceFinalizerConfiguration(authorization, binding) : void 0;
+  const snapshot = configuration ? configuration : deepIsolateValue(args.snapshot);
+  return {
+    authorization,
+    policy,
+    snapshot,
+    baseContext: deepIsolateValue(args.context ?? {}),
+    sharedContext,
+    scopeVirtualNames: getScopeVirtualNames(snapshot, args.scopePath),
+    scopedSchema: configuration ? null : getScopedPermissionSchema2(snapshot.permissionSchema, args.scopePath),
+    permissions: authorization ? getAuthorizationPermissions(authorization, binding) : void 0,
+    resolveDocument: authorization ? prepareOutputDocumentAuthorization(authorization, binding, configuration) : void 0
+  };
+}
+async function finalizeSingleDoc(args, input, prepared) {
+  assertFinalizerCall(args, prepared);
+  const scopePath = args.scopePath;
+  const plan = args.plan;
+  const binding = plan.authorizationBinding;
+  const captured = prepared.policy;
+  const snapshot = prepared.snapshot;
   const limit = args.resolvedLimit;
   const gate = args.sharedGate;
   const original = getIncludeOriginal(input);
@@ -6147,7 +6419,7 @@ async function finalizeSingleDoc(args, input) {
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
-  const baseContext = args.context ?? {};
+  const baseContext = prepared.sharedContext ? deepIsolateValue(prepared.baseContext) : prepared.baseContext;
   const operation = captured?.access.operation ?? baseContext.operation ?? args.operation ?? args.virtualAccess;
   const scopeContext = {
     ...baseContext,
@@ -6165,7 +6437,7 @@ async function finalizeSingleDoc(args, input) {
   if (captured) {
     const projected = args.documentAuthorizationStage ? input : deepIsolateValue(output);
     metadataSource = deepIsolateValue(output);
-    documentAuthorization = await resolveOutputDocumentAuthorization({
+    documentAuthorization = await prepared.resolveDocument({
       authorization: plan.authorization,
       binding,
       snapshot: projected,
@@ -6178,13 +6450,10 @@ async function finalizeSingleDoc(args, input) {
   }
   const docGrants = documentAuthorization ? readDocumentAuthorization(documentAuthorization, binding).grants : await resolveDocPermissions(args, output, scopeContext);
   scopeContext.docPermissions = deepIsolateValue(docGrants);
-  const globalPerms = captured ? getAuthorizationPermissions(plan.authorization, binding) : resolveGlobalPermissions(args);
-  const modelPermissionPrefix = snapshot.modelPermissionPrefix ?? "";
-  const documentPermissionField = snapshot.documentPermissionField ?? "_permissions";
-  const scopedSchema = getScopedPermissionSchema2(
-    snapshot.permissionSchema ?? null,
-    scopePath
-  );
+  const globalPerms = prepared.permissions ?? resolveGlobalPermissions(args);
+  const modelPermissionPrefix = captured ? "" : deepIsolateValue(snapshot.modelPermissionPrefix ?? "");
+  const documentPermissionField = captured ? "_permissions" : deepIsolateValue(snapshot.documentPermissionField ?? "_permissions");
+  const scopedSchema = deepIsolateValue(prepared.scopedSchema);
   const childPlans = plan.childPlans ?? {};
   for (const [containerName, childPlan] of Object.entries(childPlans)) {
     if (!(containerName in output)) continue;
@@ -6203,12 +6472,13 @@ async function finalizeSingleDoc(args, input) {
       continue;
     }
     retainRawAssociation(output, containerName, rawContainer);
-    const childSnapshot = snapshot;
     const childBase = {
       ...args,
       scopePath: [...childPlan.scopePath ?? [...scopePath, containerName, "sub"]],
       plan: captured ? authorizeEmbeddedOutputPlan(plan, childPlan) : childPlan,
-      snapshot: childSnapshot,
+      // Authenticated preparation reads its own authority. Do not clone an
+      // otherwise unused public configuration graph on default traversal.
+      snapshot: args.snapshot,
       // Embedded reuses the owning parent's grants + accesses (VIRT-00A D2).
       docPermissions: docGrants,
       context: scopeContext,
@@ -6219,6 +6489,7 @@ async function finalizeSingleDoc(args, input) {
       related: [],
       virtualPopulateRow: privateRow
     };
+    let childPreparation;
     const finalizeOneChild = async (rawChild, address) => {
       if (captured && Array.isArray(rawChild))
         return mapWithConcurrencyLimit(rawChild, limit, (entry, index) => finalizeOneChild(entry, [...address, index]));
@@ -6239,7 +6510,14 @@ async function finalizeSingleDoc(args, input) {
           } : { ...args, virtualPopulateRow: privateRow, virtualPopulateAddress: address }
         });
       }
-      return finalizeSingleDoc({ ...childBase, virtualPopulateAddress: address }, rawChild);
+      return finalizeSingleDoc(
+        { ...childBase, virtualPopulateAddress: address },
+        rawChild,
+        childPreparation ??= prepareFinalizer(
+          childBase,
+          Array.isArray(rawContainer) && (rawContainer.length > 1 || Array.isArray(rawContainer[0]))
+        )
+      );
     };
     if (Array.isArray(rawContainer)) {
       const finalized = await mapWithConcurrencyLimit(
@@ -6291,6 +6569,7 @@ async function finalizeSingleDoc(args, input) {
       context: scopeContext,
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
+    let relatedPreparation;
     const finalizeOneRelated = async (rawChild, originalChild = rawChild) => {
       if (!(0, import_utils29.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
@@ -6304,7 +6583,11 @@ async function finalizeSingleDoc(args, input) {
           parentArgs: { ...args, virtualPopulateRow: childRow, virtualPopulateAddress: [] }
         });
       }
-      return finalizeSingleDoc({ ...relatedBase, virtualPopulateRow: childRow }, rawChild);
+      return finalizeSingleDoc(
+        { ...relatedBase, virtualPopulateRow: childRow },
+        rawChild,
+        relatedPreparation ??= prepareFinalizer(relatedBase, Array.isArray(rawRelated) && rawRelated.length > 1)
+      );
     };
     let finalized;
     if (Array.isArray(rawRelated)) {
@@ -6324,18 +6607,24 @@ async function finalizeSingleDoc(args, input) {
     } catch {
     }
   }
-  const scopeVirtualNames = getScopeVirtualNames(snapshot, scopePath);
-  for (const virtualName of scopeVirtualNames) {
+  for (const virtualName of prepared.scopeVirtualNames) {
     if (virtualName in output) delete output[virtualName];
   }
-  const stableBase = deepIsolateValue(output);
-  const scopeLabel = scopePath.length > 0 ? scopePath.join(".") : "";
   const candidates = plan.candidates ?? [];
+  const needsGetterView = candidates.some((candidate) => {
+    const descriptor = candidate.descriptor;
+    if (typeof descriptor?.get !== "function") return false;
+    if (!privateRow && descriptor.dependsOnPopulate?.length) return false;
+    const dependsOn = Array.isArray(descriptor.dependsOn) ? descriptor.dependsOn : [];
+    return dependsOn.every((dep) => typeof dep === "string" && !isAbsentDependency(output, dep));
+  });
+  let stableBase = needsGetterView ? deepIsolateValue(output) : void 0;
+  const scopeLabel = scopePath.length > 0 ? scopePath.join(".") : "";
   const staged = /* @__PURE__ */ new Map();
   const runCandidate = async (candidate) => {
     const dependsOn = Array.isArray(candidate.descriptor?.dependsOn) ? candidate.descriptor.dependsOn : [];
     for (const dep of dependsOn) {
-      if (typeof dep !== "string" || isAbsentDependency(stableBase, dep)) return;
+      if (typeof dep !== "string" || isAbsentDependency(stableBase ?? output, dep)) return;
     }
     const allowed = documentAuthorization ? await evaluateAuthorizedOutputField(documentAuthorization, binding, candidate.name) : await evaluateEffectiveFieldAuthorization({
       req: args.request,
@@ -6350,9 +6639,9 @@ async function finalizeSingleDoc(args, input) {
     if (typeof getter !== "function") return;
     const privateInputs = privateRow ? readVirtualPopulateInputs(privateRow, privateAddress, candidate.name) : candidate.descriptor.dependsOnPopulate?.length ? { available: false } : { available: true, populated: {} };
     if (!privateInputs.available) return;
-    const isolatedView = deepIsolateValue(stableBase);
+    const isolatedView = deepIsolateValue(stableBase ??= deepIsolateValue(output));
     const virtualContext = {
-      ...scopeContext,
+      ...deepIsolateValue(scopeContext),
       docPermissions: deepIsolateValue(docGrants)
     };
     const outcome = await runVirtualGetter({
@@ -6443,12 +6732,25 @@ async function finalizeSingleDoc(args, input) {
     if (!(key in output)) continue;
     if (captured && !plan.childPlans[key]) {
       const path = [...binding.scopePath ?? [], key].join(".");
-      trimmed[key] = captured.configuration.catalog.referencePaths?.some((p) => matchesCatalogPattern(p, path)) ? copyAuthorizedReference(output[key], plan, path) : copyOutputValue(output[key], plan, path);
+      trimmed[key] = captured.catalog.referencePaths?.some((p) => matchesCatalogPattern(p, path)) ? copyAuthorizedReference(output[key], plan, path) : copyOutputValue(output[key], plan, path);
       if (trimmed[key] === void 0) delete trimmed[key];
     } else trimmed[key] = output[key];
   }
   if (documentAuthorization) {
-    retainOutputMetadata(trimmed, metadataSource, captured.configuration, binding.scopePath ?? []);
+    retainOutputMetadata(
+      trimmed,
+      metadataSource,
+      copyAuthorizationValue(
+        {
+          documentPermissionField: snapshot.documentPermissionField,
+          stripPermissionsField: snapshot.stripPermissionsField,
+          exposedDocPermissionKeys: snapshot.exposedDocPermissionKeys,
+          disableFieldPermissions: snapshot.disableFieldPermissions
+        },
+        true
+      ),
+      binding.scopePath ?? []
+    );
     associateDocumentAuthorization(documentAuthorization, binding, trimmed);
     args.onFinalized?.(
       trimmed,
@@ -6457,7 +6759,7 @@ async function finalizeSingleDoc(args, input) {
         output: trimmed,
         outputAccess: args.outputAccess,
         authorization: plan.authorization,
-        stage: readDocumentAuthorization(documentAuthorization, binding).stage
+        stage: readDocumentAuthorizationAccess(documentAuthorization, binding).stage
       })
     );
   }
@@ -6478,7 +6780,7 @@ async function finalizeModelOutput(args) {
     sharedGate: gate,
     resolvedLimit: limit
   };
-  return finalizeSingleDoc(internal, args.input);
+  return finalizeSingleDoc(internal, args.input, prepareFinalizer(internal));
 }
 async function finalizeModelOutputs(args) {
   const gate = finalizerGate(args);
@@ -6487,16 +6789,24 @@ async function finalizeModelOutputs(args) {
   if ("documentAuthorizationStage" in args || documentAuthorizationStages && (documentAuthorizationStages.length !== inputs.length || new Set(documentAuthorizationStages).size !== inputs.length)) {
     authorizationError("list finalization requires a distinct document stage per row");
   }
+  if (!inputs.length) return [];
+  const internal = {
+    ...rest,
+    scopePath: [...rest.scopePath ?? rest.plan.scopePath ?? []],
+    sharedGate: gate,
+    resolvedLimit: limit
+  };
+  const prepared = prepareFinalizer(internal, inputs.length > 1);
   return mapWithConcurrencyLimit(inputs, limit, (input, index) => {
-    const internal = {
-      ...rest,
-      scopePath: [...rest.scopePath ?? rest.plan.scopePath ?? []],
-      onFinalized: rest.onFinalized ? (output, context) => rest.onFinalized(output, context, index) : void 0,
-      documentAuthorizationStage: documentAuthorizationStages?.[index],
-      sharedGate: gate,
-      resolvedLimit: limit
-    };
-    return finalizeSingleDoc(internal, input);
+    return finalizeSingleDoc(
+      {
+        ...internal,
+        onFinalized: rest.onFinalized ? (output, context) => rest.onFinalized(output, context, index) : void 0,
+        documentAuthorizationStage: documentAuthorizationStages?.[index]
+      },
+      input,
+      prepared
+    );
   });
 }
 var import_utils29, isVirtualContainerValue3, getScopeVirtualsObject2, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
@@ -6566,7 +6876,7 @@ var init_finalize_model_output = __esm({
     };
     resolveDocPermissions = async (args, isolatedForHook, scopeContext) => {
       if (args.docPermissions != null && typeof args.docPermissions === "object" && !Array.isArray(args.docPermissions)) {
-        const grants = args.docPermissions;
+        const grants = deepIsolateValue(args.docPermissions);
         scopeContext.docPermissions = grants;
         return grants;
       }
@@ -7537,9 +7847,9 @@ function createServiceExecution(receiver, access, authorization, applicability =
       receiver,
       binding,
       authorization: call,
-      access: readServiceAuthorization(call, binding).access,
+      access: readServiceAuthorizationAccess(call, binding),
       family: execution,
-      hydration: resolveHydration(readServiceAuthorization(call, binding).configuration, hydration)
+      hydration: resolveHydration(readServiceAuthorizationHydration(call, binding), hydration)
     })
   );
   return execution;
@@ -7550,7 +7860,7 @@ function resolveHydration(configuration, source) {
 }
 function withExecutionHydration(receiver, parent, source) {
   const record3 = readServiceExecution(receiver, parent);
-  const { configuration } = readServiceAuthorization(record3.authorization, record3.binding);
+  const configuration = readServiceAuthorizationHydration(record3.authorization, record3.binding);
   const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
   executions.set(execution, Object.freeze({ ...record3, hydration: resolveHydration(configuration, source) }));
   return execution;
@@ -7587,7 +7897,7 @@ function deriveServiceExecution(receiver, parent, access, applicability = "servi
   const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
   executions.set(
     execution,
-    Object.freeze({ ...record3, authorization: call, access: readServiceAuthorization(call, record3.binding).access })
+    Object.freeze({ ...record3, authorization: call, access: readServiceAuthorizationAccess(call, record3.binding) })
   );
   return execution;
 }
@@ -10663,7 +10973,8 @@ var Service = class extends Base {
   async finalizeDirectOutput(args) {
     const { plan, context } = args;
     const { authorization, authorizationBinding: binding } = plan;
-    const { access, configuration } = readServiceAuthorization(authorization, binding);
+    const access = readServiceAuthorizationAccess(authorization, binding);
+    const configuration = readServiceOutputMetadata(authorization, binding);
     const source = getIncludeSource(args.doc);
     const snapshot = isolateDocForOutput(source);
     for (const key of Object.keys(snapshot))