@nifrajs/core 3.5.0 → 4.0.0

package/dist/internal/route-execution.d.ts

@@ -17,18 +17,20 @@
  * The `Server` import is type-only and erased, so there is no runtime cycle back into the kernel.
  */
 import type { RequestBudget } from "../budget.js";
-import type { StandardSchemaV1 } from "../schema/standard.js";
+import type { AuthenticationStage } from "../server/auth.js";
 import type { Platform, RouteSchema } from "../server/context.js";
 import type { ResolvedIdempotency } from "../server/idempotency-lane.js";
 import type { ResolvedEffectLedger } from "../server/ledger-lane.js";
 import type { Registry } from "../server/registry.js";
-import type { ResponseContractRuntime } from "../server/response-contract-lane.js";
+import type { ResponseContractDefinition, ResponseContractRuntime } from "../server/response-contract-lane.js";
 import type { HandlerResult, ResponseResult } from "../server/runtime-core.js";
 import type { CtxSet, MaybePromise, RawContext, RequestSource, Server } from "../server/server.js";
 import type { RouteProgram } from "./route-program.js";
 export type InternalHandler = (ctx: RawContext) => MaybePromise<HandlerResult>;
 /** A `derive` computes per-request context extensions; stored path-erased. */
 export type RawDerive = (ctx: RawContext) => MaybePromise<object>;
+/** A route-scoped authentication provider, stored path-erased after registration. */
+export type RawAuthStage = AuthenticationStage<unknown, unknown>;
 export type RawBeforeHandle = (ctx: RawContext) => MaybePromise<unknown>;
 export type RawAfterHandle = (result: unknown, ctx: RawContext) => MaybePromise<unknown>;
 export type RawErrorHandler = (error: unknown, ctx: RawContext) => MaybePromise<unknown>;
@@ -81,10 +83,12 @@ export interface RouteEntry {
      * still take the fused/native lanes). */
     readonly responseContract: {
         readonly runtime: ResponseContractRuntime;
-        readonly schema: StandardSchemaV1;
+        readonly definition: ResponseContractDefinition;
     } | undefined;
     /** Per-request context extensions captured at registration (order-scoped). */
     readonly derives: ReadonlyArray<RawDerive>;
+    /** Dedicated auth stages run before validation; ordinary derives keep their existing order. */
+    readonly authStages: ReadonlyArray<RawAuthStage>;
     /** Static context extensions captured at registration. */
     readonly decorations: Record<PropertyKey, unknown>;
     /** Whether {@link decorations} has any keys - precomputed so the hot path skips a no-op

package/dist/internal/route-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-execution.d.ts","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,aAAa,CAAC,CAAA;AAE9E,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,MAAM,CAAC,CAAA;AACjE,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAA;AAE5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC1D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA;AA4DpB,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;AACxE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAA;AAE1F;;;gFAGgF;AAChF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,SAAS,EACd,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,SAAS,CAAA;CACd,GAAG,kBAAkB,CA8HrB;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C;;qDAEiD;IACjD,QAAQ,CAAC,SAAS,EACd,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,SAAS,CAAA;CACd;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,SAAS,CAAA;IACpD,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACnD;;6CAEyC;IACzC,QAAQ,CAAC,gBAAgB,EACrB;QAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAChF,SAAS,CAAA;IACb,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD;8DAC0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,EAAE,eAAe,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC/E,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACzC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAC/B;AAED,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,KACnB,YAAY,CAAC,QAAQ,CAAC,CAAA;AAE3B;wEACwE;AACxE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,EAC9B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,CAAC,EAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"route-execution.d.ts","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,aAAa,CAAC,CAAA;AAE9E,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,MAAM,CAAC,CAAA;AACjE,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAA;AAE5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC1D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA;AA4DpB,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;AACxE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAA;AAE1F;;;gFAGgF;AAChF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,SAAS,EACd,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,SAAS,CAAA;CACd,GAAG,kBAAkB,CA8HrB;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C;;qDAEiD;IACjD,QAAQ,CAAC,SAAS,EACd,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,SAAS,CAAA;CACd;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,SAAS,CAAA;IACpD,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACnD;;6CAEyC;IACzC,QAAQ,CAAC,gBAAgB,EACrB;QACE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;QACzC,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAA;KAChD,GACD,SAAS,CAAA;IACb,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC1C,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChD,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD;8DAC0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,EAAE,eAAe,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC/E,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACzC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAC/B;AAED,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,KACnB,YAAY,CAAC,QAAQ,CAAC,CAAA;AAE3B;wEACwE;AACxE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,EAC9B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,CAAC,EAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA"}

package/dist/internal/route-execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-execution.js","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAMxD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAmG7D;;;gFAGgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,OAgBzC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAE3F,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,EAAE,CACD,OAA4C,CAAC,kBAAkB,CAC9D,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,YAAY,CACb,CAAA;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAuB,CAAA;IACrF,CAAC;IAED,IAAI,KAAyB,CAAA;IAC7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;YAC3F,MAAK;QACP,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,WAAW,CACvD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP,KAAK,OAAO;YACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,YAAY,CACxD,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP;YACE,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,UAAU,CACtD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;IACP,CAAC;IAED,MAAM,OAAO,GAAuB,SAAS;QAC3C,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACrD,OAA4C,CAAC,aAAa,CACzD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EAChE,QAAQ,EACR,YAAY,CACb;QACL,CAAC,CAAC,KAAK,CAAA;IAET,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,EAAE;QACF,MAAM,MAAM,GAAG,OAA2C,CAAA;QAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,IAAI,oBAAoB,CAAA;QAC5D,MAAM,GAAG,GAAG,aAAa;YACvB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;YAC9F,CAAC,CAAC,IAAI,cAAc,CAChB,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,CAAC,cAAc,CACtB,CAAA;QACL,IAAI,MAAiC,CAAA;QACrC,2FAA2F;QAC3F,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAA;QAChD,IAAI,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACvC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAA;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,OAAO,GAAG,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzF,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,CACzD,CACF,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAuB,CAAA;AACrF,CAAC"}
+{"version":3,"file":"route-execution.js","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAMxD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAwG7D;;;gFAGgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,OAgBzC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAE3F,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,EAAE,CACD,OAA4C,CAAC,kBAAkB,CAC9D,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,YAAY,CACb,CAAA;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAuB,CAAA;IACrF,CAAC;IAED,IAAI,KAAyB,CAAA;IAC7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;YAC3F,MAAK;QACP,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,WAAW,CACvD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP,KAAK,OAAO;YACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,YAAY,CACxD,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP;YACE,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,UAAU,CACtD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;IACP,CAAC;IAED,MAAM,OAAO,GAAuB,SAAS;QAC3C,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACrD,OAA4C,CAAC,aAAa,CACzD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EAChE,QAAQ,EACR,YAAY,CACb;QACL,CAAC,CAAC,KAAK,CAAA;IAET,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,EAAE;QACF,MAAM,MAAM,GAAG,OAA2C,CAAA;QAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,IAAI,oBAAoB,CAAA;QAC5D,MAAM,GAAG,GAAG,aAAa;YACvB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;YAC9F,CAAC,CAAC,IAAI,cAAc,CAChB,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,CAAC,cAAc,CACtB,CAAA;QACL,IAAI,MAAiC,CAAA;QACrC,2FAA2F;QAC3F,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAA;QAChD,IAAI,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACvC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAA;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,OAAO,GAAG,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzF,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,CACzD,CACF,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAuB,CAAA;AACrF,CAAC"}

package/dist/internal/route-lanes.d.ts

@@ -21,6 +21,7 @@ export interface RouteLaneSelection {
 }
 export declare function selectRouteLanes(options: {
     readonly schema: RouteSchema | undefined;
+    readonly hasAuth?: boolean;
     readonly hasIdempotency: boolean;
     readonly hasLedger: boolean;
     readonly hasResponseContract: boolean;

package/dist/internal/route-lanes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-lanes.d.ts","sourceRoot":"","sources":["../../src/internal/route-lanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,eAAe,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC/E,QAAQ,CAAC,SAAS,EACd,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,SAAS,CAAA;CACd;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC3C,GAAG,kBAAkB,CAiLrB"}
+{"version":3,"file":"route-lanes.d.ts","sourceRoot":"","sources":["../../src/internal/route-lanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,eAAe,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC/E,QAAQ,CAAC,SAAS,EACd,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,SAAS,CAAA;CACd;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC3C,GAAG,kBAAkB,CAyLrB"}

package/dist/internal/route-lanes.js

@@ -1,7 +1,10 @@
 export function selectRouteLanes(options) {
     const { schema, hasIdempotency, hasLedger, hasResponseContract, hasDecorations, derives, beforeHandle, afterHandle, onError, around, defaultOnValidationError, } = options;
-    const bare = schema?.params === undefined &&
-        schema?.headers === undefined &&
+    const authBeforeValidation = options.hasAuth === true || schema?.validationOrder === "auth-before-validation";
+    // No fused lane validates params, headers, or cookies: any of those schemas keeps the stage runner.
+    const plain = schema?.params === undefined && schema?.headers === undefined && schema?.cookies === undefined;
+    const bare = !authBeforeValidation &&
+        plain &&
         schema?.body === undefined &&
         schema?.query === undefined &&
         !hasIdempotency &&
@@ -17,11 +20,11 @@ export function selectRouteLanes(options) {
     // wrappers, and validation-error recovery (schema or server default) - the fused invalid path is
     // exactly `validationError(issues)`, so any recovery semantics keep the generic lane.
     const fusedQuery = !bare &&
+        !authBeforeValidation &&
         !hasResponseContract &&
         schema?.query !== undefined &&
         schema.body === undefined &&
-        schema.params === undefined &&
-        schema.headers === undefined &&
+        plain &&
         schema.onValidationError === undefined &&
         !defaultOnValidationError &&
         !hasIdempotency &&
@@ -31,42 +34,44 @@ export function selectRouteLanes(options) {
         afterHandle === 0 &&
         onError === 0 &&
         around === 0;
-    const bodyOnly = !hasResponseContract &&
+    const bodyOnly = !authBeforeValidation &&
+        !hasResponseContract &&
         schema?.body !== undefined &&
         schema.query === undefined &&
-        schema.params === undefined &&
-        schema.headers === undefined &&
+        plain &&
         derives === 0 &&
         beforeHandle === 0 &&
         afterHandle === 0 &&
         onError === 0;
     const fusedBody = !bare &&
+        !authBeforeValidation &&
         bodyOnly &&
         schema.onValidationError === undefined &&
         !defaultOnValidationError &&
         !hasIdempotency &&
         !hasLedger &&
         around === 0;
-    const lane = bare
-        ? "bare"
-        : bodyOnly
-            ? "body"
-            : !hasResponseContract &&
-                schema?.body === undefined &&
-                schema?.query !== undefined &&
-                schema.params === undefined &&
-                schema.headers === undefined &&
-                derives === 0 &&
-                beforeHandle === 0 &&
-                afterHandle === 0 &&
-                onError === 0
-                ? "query"
-                : "lifecycle";
+    const lane = authBeforeValidation
+        ? "lifecycle"
+        : bare
+            ? "bare"
+            : bodyOnly
+                ? "body"
+                : !hasResponseContract &&
+                    schema?.body === undefined &&
+                    schema?.query !== undefined &&
+                    plain &&
+                    derives === 0 &&
+                    beforeHandle === 0 &&
+                    afterHandle === 0 &&
+                    onError === 0
+                    ? "query"
+                    : "lifecycle";
     // Lifecycle routes with no params schema are the common middleware shape: derive/before plus an
     // optional query or body schema. Select their complete validation stage at registration so the
     // request path never re-checks params/body presence. Parameter-schema routes retain the generic
     // lifecycle runner until their more involved recovery matrix is selected explicitly.
-    const lifecycleLane = lane !== "lifecycle" || schema?.params !== undefined || schema?.headers !== undefined
+    const lifecycleLane = lane !== "lifecycle" || !plain
         ? undefined
         : schema?.body !== undefined
             ? schema.query !== undefined
@@ -78,20 +83,20 @@ export function selectRouteLanes(options) {
     // The realistic middleware shape is commonly exactly one synchronous-or-async derive followed by
     // one before hook. Keep the generic runner for every route that can observe decorations, after hooks,
     // error hooks, or response contracts; this lane only removes the two per-request hook-loop dispatches
-    // and preserves the same async continuations and error handling. A params or headers schema routes
-    // back to the generic lane because the fused builder has no `params` / `headers` validation step
+    // and preserves the same async continuations and error handling. A params, headers, or cookies schema
+    // routes back to the generic lane because the fused builder has no validation step for them
     // baked in - adding them would be more code than it saves. A `body` schema is the same story
     // because the fused derive-before / derive-before-after builders don't parse the body: routes with a
     // body schema are routed to the `body-derive-before` / `body-derive-before-after` lane below.
     const lifecycleHookLane = lane === "lifecycle" &&
+        !authBeforeValidation &&
         !hasResponseContract &&
         !hasDecorations &&
         !hasIdempotency &&
         !hasLedger &&
         schema?.onValidationError === undefined &&
         !defaultOnValidationError &&
-        schema?.params === undefined &&
-        schema?.headers === undefined &&
+        plain &&
         schema?.body === undefined &&
         derives === 1 &&
         beforeHandle === 1 &&
@@ -107,10 +112,10 @@ export function selectRouteLanes(options) {
     // parse → validate → derive → before → handler → after → respond in one function frame, the same
     // win `fusedBody` already gives for the no-hooks body shape.
     const fusedBodyLifecycle = lane === "lifecycle" &&
+        !authBeforeValidation &&
         schema?.body !== undefined &&
         schema?.query === undefined &&
-        schema?.params === undefined &&
-        schema?.headers === undefined &&
+        plain &&
         schema?.onValidationError === undefined &&
         !defaultOnValidationError &&
         !hasResponseContract &&

package/dist/internal/route-lanes.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-lanes.js","sourceRoot":"","sources":["../../src/internal/route-lanes.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,gBAAgB,CAAC,OAYhC;IACC,MAAM,EACJ,MAAM,EACN,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,OAAO,EACP,YAAY,EACZ,WAAW,EACX,OAAO,EACP,MAAM,EACN,wBAAwB,GACzB,GAAG,OAAO,CAAA;IAEX,MAAM,IAAI,GACR,MAAM,EAAE,MAAM,KAAK,SAAS;QAC5B,MAAM,EAAE,OAAO,KAAK,SAAS;QAC7B,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,MAAM,EAAE,KAAK,KAAK,SAAS;QAC3B,CAAC,cAAc;QACf,CAAC,SAAS;QACV,CAAC,mBAAmB;QACpB,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC,CAAA;IAEf,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,sFAAsF;IACtF,MAAM,UAAU,GACd,CAAC,IAAI;QACL,CAAC,mBAAmB;QACpB,MAAM,EAAE,KAAK,KAAK,SAAS;QAC3B,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,MAAM,KAAK,SAAS;QAC3B,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,CAAC,wBAAwB;QACzB,CAAC,cAAc;QACf,CAAC,SAAS;QACV,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;QACb,MAAM,KAAK,CAAC,CAAA;IAEd,MAAM,QAAQ,GACZ,CAAC,mBAAmB;QACpB,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,MAAM,CAAC,KAAK,KAAK,SAAS;QAC1B,MAAM,CAAC,MAAM,KAAK,SAAS;QAC3B,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC,CAAA;IAEf,MAAM,SAAS,GACb,CAAC,IAAI;QACL,QAAQ;QACR,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,CAAC,wBAAwB;QACzB,CAAC,cAAc;QACf,CAAC,SAAS;QACV,MAAM,KAAK,CAAC,CAAA;IAEd,MAAM,IAAI,GAAuB,IAAI;QACnC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,mBAAmB;gBAClB,MAAM,EAAE,IAAI,KAAK,SAAS;gBAC1B,MAAM,EAAE,KAAK,KAAK,SAAS;gBAC3B,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC3B,MAAM,CAAC,OAAO,KAAK,SAAS;gBAC5B,OAAO,KAAK,CAAC;gBACb,YAAY,KAAK,CAAC;gBAClB,WAAW,KAAK,CAAC;gBACjB,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,WAAW,CAAA;IAEnB,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,aAAa,GACjB,IAAI,KAAK,WAAW,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS;QACnF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS;YAC1B,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;gBAC1B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,MAAM;YACV,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS;gBAC3B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,OAAO,CAAA;IAEjB,iGAAiG;IACjG,sGAAsG;IACtG,sGAAsG;IACtG,mGAAmG;IACnG,iGAAiG;IACjG,6FAA6F;IAC7F,qGAAqG;IACrG,8FAA8F;IAC9F,MAAM,iBAAiB,GACrB,IAAI,KAAK,WAAW;QACpB,CAAC,mBAAmB;QACpB,CAAC,cAAc;QACf,CAAC,cAAc;QACf,CAAC,SAAS;QACV,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACvC,CAAC,wBAAwB;QACzB,MAAM,EAAE,MAAM,KAAK,SAAS;QAC5B,MAAM,EAAE,OAAO,KAAK,SAAS;QAC7B,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,IAAI,CAAC;QAChB,OAAO,KAAK,CAAC;QACb,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,WAAW,KAAK,CAAC;YACjB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,qBAAqB;QACzB,CAAC,CAAC,SAAS,CAAA;IAEf,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,6DAA6D;IAC7D,MAAM,kBAAkB,GACtB,IAAI,KAAK,WAAW;QACpB,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,MAAM,EAAE,KAAK,KAAK,SAAS;QAC3B,MAAM,EAAE,MAAM,KAAK,SAAS;QAC5B,MAAM,EAAE,OAAO,KAAK,SAAS;QAC7B,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACvC,CAAC,wBAAwB;QACzB,CAAC,mBAAmB;QACpB,CAAC,cAAc;QACf,CAAC,cAAc;QACf,CAAC,SAAS;QACV,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,IAAI,CAAC;QAChB,OAAO,KAAK,CAAC;QACb,MAAM,KAAK,CAAC,CAAA;IAEd,OAAO;QACL,IAAI;QACJ,UAAU;QACV,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,aAAa;QACb,iBAAiB;QACjB,SAAS,EACP,MAAM,KAAK,CAAC;YACV,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;oBACT,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI;wBACJ,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,iBAAiB,KAAK,SAAS;4BAC/B,CAAC,CAAE,iBAA6D;4BAChE,CAAC,CAAC,kBAAkB;gCAClB,CAAC,CAAC,WAAW,KAAK,CAAC;oCACjB,CAAC,CAAC,oBAAoB;oCACtB,CAAC,CAAC,0BAA0B;gCAC9B,CAAC,CAAC,SAAS;YACrB,CAAC,CAAC,SAAS;KAChB,CAAA;AACH,CAAC"}
+{"version":3,"file":"route-lanes.js","sourceRoot":"","sources":["../../src/internal/route-lanes.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,gBAAgB,CAAC,OAahC;IACC,MAAM,EACJ,MAAM,EACN,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,OAAO,EACP,YAAY,EACZ,WAAW,EACX,OAAO,EACP,MAAM,EACN,wBAAwB,GACzB,GAAG,OAAO,CAAA;IAEX,MAAM,oBAAoB,GACxB,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,EAAE,eAAe,KAAK,wBAAwB,CAAA;IAClF,oGAAoG;IACpG,MAAM,KAAK,GACT,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,CAAA;IAEhG,MAAM,IAAI,GACR,CAAC,oBAAoB;QACrB,KAAK;QACL,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,MAAM,EAAE,KAAK,KAAK,SAAS;QAC3B,CAAC,cAAc;QACf,CAAC,SAAS;QACV,CAAC,mBAAmB;QACpB,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC,CAAA;IAEf,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,sFAAsF;IACtF,MAAM,UAAU,GACd,CAAC,IAAI;QACL,CAAC,oBAAoB;QACrB,CAAC,mBAAmB;QACpB,MAAM,EAAE,KAAK,KAAK,SAAS;QAC3B,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,KAAK;QACL,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,CAAC,wBAAwB;QACzB,CAAC,cAAc;QACf,CAAC,SAAS;QACV,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;QACb,MAAM,KAAK,CAAC,CAAA;IAEd,MAAM,QAAQ,GACZ,CAAC,oBAAoB;QACrB,CAAC,mBAAmB;QACpB,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,MAAM,CAAC,KAAK,KAAK,SAAS;QAC1B,KAAK;QACL,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC,CAAA;IAEf,MAAM,SAAS,GACb,CAAC,IAAI;QACL,CAAC,oBAAoB;QACrB,QAAQ;QACR,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,CAAC,wBAAwB;QACzB,CAAC,cAAc;QACf,CAAC,SAAS;QACV,MAAM,KAAK,CAAC,CAAA;IAEd,MAAM,IAAI,GAAuB,oBAAoB;QACnD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI;YACJ,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,CAAC,mBAAmB;oBAClB,MAAM,EAAE,IAAI,KAAK,SAAS;oBAC1B,MAAM,EAAE,KAAK,KAAK,SAAS;oBAC3B,KAAK;oBACL,OAAO,KAAK,CAAC;oBACb,YAAY,KAAK,CAAC;oBAClB,WAAW,KAAK,CAAC;oBACjB,OAAO,KAAK,CAAC;oBACf,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,WAAW,CAAA;IAErB,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,aAAa,GACjB,IAAI,KAAK,WAAW,IAAI,CAAC,KAAK;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS;YAC1B,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;gBAC1B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,MAAM;YACV,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS;gBAC3B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,OAAO,CAAA;IAEjB,iGAAiG;IACjG,sGAAsG;IACtG,sGAAsG;IACtG,sGAAsG;IACtG,4FAA4F;IAC5F,6FAA6F;IAC7F,qGAAqG;IACrG,8FAA8F;IAC9F,MAAM,iBAAiB,GACrB,IAAI,KAAK,WAAW;QACpB,CAAC,oBAAoB;QACrB,CAAC,mBAAmB;QACpB,CAAC,cAAc;QACf,CAAC,cAAc;QACf,CAAC,SAAS;QACV,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACvC,CAAC,wBAAwB;QACzB,KAAK;QACL,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,IAAI,CAAC;QAChB,OAAO,KAAK,CAAC;QACb,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,WAAW,KAAK,CAAC;YACjB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,qBAAqB;QACzB,CAAC,CAAC,SAAS,CAAA;IAEf,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,6DAA6D;IAC7D,MAAM,kBAAkB,GACtB,IAAI,KAAK,WAAW;QACpB,CAAC,oBAAoB;QACrB,MAAM,EAAE,IAAI,KAAK,SAAS;QAC1B,MAAM,EAAE,KAAK,KAAK,SAAS;QAC3B,KAAK;QACL,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACvC,CAAC,wBAAwB;QACzB,CAAC,mBAAmB;QACpB,CAAC,cAAc;QACf,CAAC,cAAc;QACf,CAAC,SAAS;QACV,OAAO,KAAK,CAAC;QACb,YAAY,KAAK,CAAC;QAClB,WAAW,IAAI,CAAC;QAChB,OAAO,KAAK,CAAC;QACb,MAAM,KAAK,CAAC,CAAA;IAEd,OAAO;QACL,IAAI;QACJ,UAAU;QACV,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,aAAa;QACb,iBAAiB;QACjB,SAAS,EACP,MAAM,KAAK,CAAC;YACV,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;oBACT,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI;wBACJ,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,iBAAiB,KAAK,SAAS;4BAC/B,CAAC,CAAE,iBAA6D;4BAChE,CAAC,CAAC,kBAAkB;gCAClB,CAAC,CAAC,WAAW,KAAK,CAAC;oCACjB,CAAC,CAAC,oBAAoB;oCACtB,CAAC,CAAC,0BAA0B;gCAC9B,CAAC,CAAC,SAAS;YACrB,CAAC,CAAC,SAAS;KAChB,CAAA;AACH,CAAC"}

package/dist/internal/route-program.d.ts

@@ -10,8 +10,8 @@ import type { StandardSchemaV1 } from "../schema/standard.js";
 import type { Registry } from "../server/registry.js";
 import { type ResponseResult } from "../server/runtime-core.js";
 import type { CtxSet, MaybePromise, RawContext, RequestSource, Server } from "../server/server.js";
-import type { InternalHandler, RawAfterHandle, RawBeforeHandle, RawDerive, RawErrorHandler, RouteEntry } from "./route-execution.js";
-export type ProgramValidationKind = "headers" | "params" | "body" | "query";
+import type { InternalHandler, RawAfterHandle, RawAuthStage, RawBeforeHandle, RawDerive, RawErrorHandler, RouteEntry } from "./route-execution.js";
+export type ProgramValidationKind = "headers" | "cookies" | "params" | "body" | "query";
 export type RouteProgramStage = {
     readonly kind: ProgramValidationKind;
     readonly schema: StandardSchemaV1;
@@ -31,6 +31,11 @@ export type RouteProgramStage = {
 /** The complete registration-time lifecycle, in semantic execution order. */
 export interface RouteProgram {
     readonly stages: readonly RouteProgramStage[];
+    readonly validationOrder: "validate-before-auth" | "auth-before-validation";
+    readonly authBeforeValidation: boolean;
+    readonly authStages: readonly RawAuthStage[];
+    /** Protected route fast lane: auth plus validation/handler, with no general lifecycle hooks. */
+    readonly authFastLane: boolean;
     readonly validationStages: readonly Extract<RouteProgramStage, {
         kind: ProgramValidationKind;
     }>[];
@@ -49,6 +54,7 @@ export interface RouteProgramInput {
     readonly schema: RouteEntry["schema"];
     readonly handler: InternalHandler;
     readonly derives: readonly RawDerive[];
+    readonly authStages?: readonly RawAuthStage[];
     readonly beforeHandle: readonly RawBeforeHandle[];
     readonly afterHandle: readonly RawAfterHandle[];
     readonly onError: readonly RawErrorHandler[];

package/dist/internal/route-program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-program.d.ts","sourceRoot":"","sources":["../../src/internal/route-program.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,SAAS,EACT,eAAe,EACf,UAAU,EACX,MAAM,sBAAsB,CAAA;AAE7B,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;AAE3E,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAA;AAE5D,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,OAAO,CAAC,iBAAiB,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,EAAE,CAAA;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA2C1E;AAsCD,KAAK,aAAa,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;AASvC,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,GACvD,aAAa,CAAC,CAAC,CAAC,CAQlB"}
+{"version":3,"file":"route-program.d.ts","sourceRoot":"","sources":["../../src/internal/route-program.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,YAAY,EACZ,eAAe,EACf,SAAS,EACT,eAAe,EACf,UAAU,EACX,MAAM,sBAAsB,CAAA;AAE7B,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;AAEvF,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAA;AAE5D,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,sBAAsB,GAAG,wBAAwB,CAAA;IAC3E,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAA;IAC5C,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,OAAO,CAAC,iBAAiB,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,EAAE,CAAA;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA4C1E;AA2XD,KAAK,aAAa,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;AAuDvC,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,GACvD,aAAa,CAAC,CAAC,CAAC,CAyBlB"}

package/dist/internal/route-program.js

@@ -6,31 +6,24 @@
  * program is frozen at registration so the request path walks one immutable stage sequence instead
  * of rediscovering which lifecycle features are present.
  */
-import { CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, isResponseResult, } from "../server/runtime-core.js";
+import { pathnameOf } from "../server/http.js";
+import { CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, isResponseResult, status, } from "../server/runtime-core.js";
 /** Build the immutable stage sequence once, while the server is still configurable. */
 export function compileRouteProgram(input) {
     const stages = [];
     const validationStages = [];
     const schema = input.schema;
-    if (schema?.headers !== undefined) {
-        const stage = { kind: "headers", schema: schema.headers };
-        stages.push(stage);
-        validationStages.push(stage);
-    }
-    if (schema?.params !== undefined) {
-        const stage = { kind: "params", schema: schema.params };
-        stages.push(stage);
-        validationStages.push(stage);
-    }
-    if (schema?.body !== undefined) {
-        const stage = { kind: "body", schema: schema.body };
-        stages.push(stage);
-        validationStages.push(stage);
-    }
-    if (schema?.query !== undefined) {
-        const stage = { kind: "query", schema: schema.query };
-        stages.push(stage);
-        validationStages.push(stage);
+    const authStages = input.authStages ?? [];
+    const authBeforeValidation = authStages.length > 0
+        ? schema?.validationOrder !== "validate-before-auth"
+        : schema?.validationOrder === "auth-before-validation";
+    for (const kind of ["headers", "cookies", "params", "body", "query"]) {
+        const validator = schema?.[kind];
+        if (validator !== undefined) {
+            const stage = { kind, schema: validator };
+            stages.push(stage);
+            validationStages.push(stage);
+        }
     }
     for (const derive of input.derives)
         stages.push({ kind: "derive", run: derive });
@@ -41,6 +34,13 @@ export function compileRouteProgram(input) {
         stages.push({ kind: "after", run: after });
     return Object.freeze({
         stages: Object.freeze(stages),
+        validationOrder: authBeforeValidation ? "auth-before-validation" : "validate-before-auth",
+        authBeforeValidation,
+        authStages: Object.freeze([...authStages]),
+        authFastLane: authStages.length > 0 &&
+            input.derives.length === 0 &&
+            input.beforeHandle.length === 0 &&
+            input.afterHandle.length === 0,
         validationStages: Object.freeze(validationStages),
         derives: Object.freeze([...input.derives]),
         beforeHandle: Object.freeze([...input.beforeHandle]),
@@ -60,10 +60,212 @@ function responseSet(ctx) {
 function isEarly(value) {
     return value instanceof Response || isResponseResult(value);
 }
+function authHeadersOf(source) {
+    return Object.freeze({
+        get: (name) => source.headers.get(name),
+        has: (name) => source.headers.has(name),
+        forEach: (callback) => {
+            source.headers.forEach(callback);
+        },
+    });
+}
+function authenticationInputOf(source, ctx) {
+    return Object.freeze({
+        method: source.method,
+        pathname: pathnameOf(source.url),
+        headers: authHeadersOf(source),
+        params: Object.freeze({ ...ctx.params }),
+        env: ctx.env,
+        clientIp: ctx.clientIp,
+        signal: ctx.signal,
+    });
+}
+function defaultAuthenticationResponse(reason) {
+    if (reason === "forbidden")
+        return status(403, { ok: false, error: "forbidden" });
+    if (reason === "unavailable")
+        return status(503, { ok: false, error: "auth_unavailable" });
+    return status(401, { ok: false, error: "unauthorized" });
+}
+function validAuthenticationFailureReason(value) {
+    return (value === undefined ||
+        value === "unauthenticated" ||
+        value === "forbidden" ||
+        value === "unavailable");
+}
+function runAuthenticationStages(host, entry, program, source, ctx, finalize, wrapResponse, start = 0, validationComplete = false) {
+    if (start >= program.authStages.length) {
+        if (program.authFastLane) {
+            const validationIndex = validationComplete ? program.validationStages.length : 0;
+            return runFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+        }
+        return validationComplete
+            ? runSync(host, entry, program, source, ctx, finalize, wrapResponse, program.validationStages.length, undefined)
+            : runValidatedProgram(host, entry, program, source, ctx, finalize, wrapResponse);
+    }
+    const input = authenticationInputOf(source, ctx);
+    const stage = program.authStages[start];
+    let outcome;
+    try {
+        outcome = stage.run(input);
+    }
+    catch {
+        return finalize(defaultAuthenticationResponse("unavailable"), responseSet(ctx));
+    }
+    if (outcome instanceof Promise) {
+        return outcome.then((settled) => finishAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, settled, start + 1, validationComplete), () => finalize(defaultAuthenticationResponse("unavailable"), responseSet(ctx)));
+    }
+    return finishAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, outcome, start + 1, validationComplete);
+}
+function finishAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, result, next, validationComplete = false) {
+    if (result === null ||
+        typeof result !== "object" ||
+        (result.kind !== "authenticated" && result.kind !== "rejected")) {
+        return finalize(defaultAuthenticationResponse("unavailable"), responseSet(ctx));
+    }
+    if (result.kind === "rejected") {
+        if (!validAuthenticationFailureReason(result.reason)) {
+            return finalize(defaultAuthenticationResponse("unavailable"), responseSet(ctx));
+        }
+        if (result.response !== undefined &&
+            !(result.response instanceof Response) &&
+            !isResponseResult(result.response)) {
+            return finalize(defaultAuthenticationResponse("unavailable"), responseSet(ctx));
+        }
+        const response = result.response ?? defaultAuthenticationResponse(result.reason);
+        return finalize(response, responseSet(ctx));
+    }
+    if (result.principal === null || result.principal === undefined) {
+        return finalize(defaultAuthenticationResponse("unavailable"), responseSet(ctx));
+    }
+    Object.defineProperty(ctx, "principal", {
+        value: result.principal,
+        enumerable: true,
+        configurable: true,
+        writable: false,
+    });
+    return runAuthenticationStages(host, entry, program, source, ctx, finalize, wrapResponse, next, validationComplete);
+}
+/** Validate first only when a route explicitly opts out of the protected auth-first default. */
+function runFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex) {
+    for (let i = validationIndex; i < program.validationStages.length; i++) {
+        const stage = program.validationStages[i];
+        const outcome = stage.kind === "body"
+            ? host.readProgramBody(entry, source, ctx)
+            : host.validateProgramStage(entry, stage, source, ctx);
+        if (outcome instanceof Promise) {
+            return continueFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, i + 1, outcome);
+        }
+        if (outcome !== undefined)
+            return wrapResponse(outcome);
+    }
+    return runFastAuthenticatedHandler(host, entry, program, ctx, finalize, wrapResponse);
+}
+async function continueFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex, pending) {
+    try {
+        const settled = await pending;
+        if (settled !== undefined)
+            return wrapResponse(settled);
+        return await runFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+    }
+    catch (error) {
+        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+}
+function runFastAuthenticatedHandler(host, entry, program, ctx, finalize, wrapResponse) {
+    let result;
+    try {
+        result = program.handler(ctx);
+    }
+    catch (error) {
+        return host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+    if (result instanceof Promise) {
+        return result.then((value) => host.finishProgramResult(entry, ctx, value, finalize, wrapResponse), (error) => host.handleProgramError(entry, error, ctx, finalize, wrapResponse));
+    }
+    return host.finishProgramResult(entry, ctx, result, finalize, wrapResponse);
+}
+function runValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex = 0) {
+    for (let i = validationIndex; i < program.validationStages.length; i++) {
+        const stage = program.validationStages[i];
+        const outcome = stage.kind === "body"
+            ? host.readProgramBody(entry, source, ctx)
+            : host.validateProgramStage(entry, stage, source, ctx);
+        if (outcome instanceof Promise) {
+            return continueValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, i + 1, outcome);
+        }
+        if (outcome !== undefined)
+            return wrapResponse(outcome);
+    }
+    return runAuthenticationStages(host, entry, program, source, ctx, finalize, wrapResponse, 0, true);
+}
+async function continueValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex, pending) {
+    try {
+        const settled = await pending;
+        if (settled !== undefined)
+            return wrapResponse(settled);
+        return await runValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+    }
+    catch (error) {
+        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+}
+function runValidatedProgram(host, entry, program, source, ctx, finalize, wrapResponse) {
+    if (program.hasDecorations)
+        Object.assign(ctx, program.decorations);
+    return runSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, undefined);
+}
+/** Opt-in sensitive-route lane: run authentication/policy hooks before parsing untrusted input. */
+async function runAuthBeforeValidation(host, entry, program, source, ctx, finalize, wrapResponse) {
+    try {
+        if (program.hasDecorations)
+            Object.assign(ctx, program.decorations);
+        for (const derive of program.derives) {
+            const result = derive(ctx);
+            const settled = result instanceof Promise ? await result : result;
+            if (isEarly(settled))
+                return finalize(settled, responseSet(ctx));
+            Object.assign(ctx, settled);
+        }
+        for (const before of program.beforeHandle) {
+            const result = before(ctx);
+            const settled = result instanceof Promise ? await result : result;
+            if (settled !== undefined)
+                return finalize(settled, responseSet(ctx));
+        }
+        for (const stage of program.validationStages) {
+            const result = stage.kind === "body"
+                ? await host.readProgramBody(entry, source, ctx)
+                : host.validateProgramStage(entry, stage, source, ctx);
+            const settled = result instanceof Promise ? await result : result;
+            if (settled !== undefined)
+                return wrapResponse(settled);
+        }
+        let result = await program.handler(ctx);
+        for (const after of program.afterHandle) {
+            const transformed = after(result, ctx);
+            result = transformed instanceof Promise ? await transformed : transformed;
+        }
+        return await host.finishProgramResult(entry, ctx, result, finalize, wrapResponse);
+    }
+    catch (error) {
+        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+}
 /** Execute the general program. The first synchronous stage sequence stays synchronous. */
 export function executeRouteProgram(runtime, entry, program, source, ctx, finalize, wrapResponse) {
     const host = runtime;
     try {
+        if (program.authStages.length > 0) {
+            if (program.hasDecorations)
+                Object.assign(ctx, program.decorations);
+            return program.authBeforeValidation
+                ? runAuthenticationStages(host, entry, program, source, ctx, finalize, wrapResponse)
+                : runValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse);
+        }
+        if (program.validationOrder === "auth-before-validation") {
+            return runAuthBeforeValidation(host, entry, program, source, ctx, finalize, wrapResponse);
+        }
         if (program.hasDecorations)
             Object.assign(ctx, program.decorations);
         return runSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, undefined);