elysia 2.0.0-beta.20 → 2.0.0-beta.21

package/dist/compile/handler/index.mjs

@@ -1,15 +1,18 @@
 import { isBun } from "../../universal/constants.mjs";
 import { ElysiaFile } from "../../universal/file.mjs";
-import { cloneHook, compactBeforeHandleConflicts, compactBeforeHandlePrefix, eventProperties, flattenChain, flattenChainMemo, flattenChainMemoReadonly, fnOrigin, isCompactBeforeHandleOnly, isHTMLBundle, isLocalScope, isNotEmpty, macroEpoch, mergeHook, nullObject, replaceUrlPath, rootSnapshot } from "../../utils.mjs";
+import { cloneHook, compactBeforeHandleConflicts, compactBeforeHandlePrefix, compositionKeys, eventProperties, flattenChain, flattenChainMemo, flattenChainMemoReadonly, fnOrigin, fnv1a, isCompactBeforeHandleOnly, isHTMLBundle, isLocalScope, isNotEmpty, macroEpoch, mergeHook, nullObject, refTargets, replaceUrlPath, rootSnapshot } from "../../utils.mjs";
 import { ElysiaStatus } from "../../error.mjs";
 import { mapResponse } from "../../adapter/web-standard/handler.mjs";
-import { Capture, Compiled } from "../aot.mjs";
+import { Capture, Compiled, aotDrift, warnAotDrift } from "../aot.mjs";
 import { frozenRootOf } from "../../generation.mjs";
+import { isAsyncFunction } from "../utils.mjs";
 import { returnedErrorClasses } from "../../handler/utils.mjs";
+import { deriveModes } from "./utils.mjs";
 import { resolveHandlerParams } from "./params.mjs";
 import { compileHandlerJit, createInlineHandler, setCaptureHeaderShorthand } from "./jit.mjs";
-import { describeRoute, routeDescriptors } from "./descriptor.mjs";
+import { isResponseMap } from "./frozen-validator.mjs";
 import { Reconstrct } from "./reconstruct.mjs";
+import { describeRoute, routeDescriptors } from "./descriptor.mjs";
 import { defaultAdapter } from "../../adapter/constants.mjs";
 
 //#region src/compile/handler/index.ts
@@ -273,18 +276,129 @@ function composeRouteHook(instance, localHook, appHook, inheritedChain, root, ma
 	}
 	return hook;
 }
-const hookStateAliases = [
-	"ho",
-	"tf",
-	"bf",
-	"af",
-	"mr",
-	"er",
-	"ar",
-	"va",
-	"cc",
-	"tr"
+const shapeEvents = [
+	"parse",
+	"transform",
+	"beforeHandle",
+	"afterHandle",
+	"mapResponse",
+	"afterResponse",
+	"error",
+	"trace"
+];
+const shapeSlots = [
+	"body",
+	"headers",
+	"params",
+	"query",
+	"cookie",
+	"response"
 ];
+const isCookieAt = (at) => at === "cookie" || at === "field";
+function childAt(at, k, value, deferred) {
+	if (at.endsWith("*")) return at.slice(0, -1);
+	if (at.endsWith("^")) return k === "0" ? at.slice(0, -1) + (Array.isArray(value) ? "*" : "") : "";
+	if (!isCookieAt(at)) return "";
+	switch (k) {
+		case "$ref": return at;
+		case "properties": return at === "cookie" ? "field*" : "";
+		case "parameters": return deferred ? at + "^" : "";
+	}
+	return k === "$defs" || compositionKeys.includes(k) ? at + "*" : "";
+}
+function routeShape(hook, handler, root) {
+	const frozenRoot = frozenRootOf(root);
+	const config = frozenRoot["~config"];
+	const models = frozenRoot["~ext"]?.models;
+	const refs = /* @__PURE__ */ new Map();
+	const addRef = (name, at = "") => {
+		if (!isCookieAt(at)) at = "";
+		if (at === "cookie" || !refs.get(name)) refs.set(name, at);
+	};
+	const ids = /* @__PURE__ */ new Map();
+	const visiting = /* @__PURE__ */ new Set();
+	let unsupported = false;
+	for (const _ in []) return;
+	const shape = (v, at = "") => {
+		switch (typeof v) {
+			case "string": return JSON.stringify(v);
+			case "number": return "n" + (Object.is(v, -0) ? "-0" : v);
+			case "bigint": return "b" + v;
+			case "boolean": return v ? "T" : "F";
+			case "undefined": return "U";
+			case "function":
+				if (ids.has(v)) return "#" + ids.get(v);
+				ids.set(v, ids.size);
+				return isAsyncFunction(v) ? "fa" : "fs";
+			case "symbol":
+				unsupported = true;
+				return "";
+		}
+		if (v === null) return "N";
+		if ("~standard" in v) return "S";
+		if (visiting.has(v)) {
+			unsupported = true;
+			return "";
+		}
+		let tag = "";
+		const list = Array.isArray(v);
+		const proto = Object.getPrototypeOf(v);
+		if (list ? proto !== Array.prototype : proto !== null && proto !== Object.prototype) {
+			const kind = proto && Object.getOwnPropertyDescriptor(proto, "~kind");
+			if (!kind || !("value" in kind) || Reflect.ownKeys(proto).length !== 1 || Object.getPrototypeOf(proto) !== Object.prototype) {
+				unsupported = true;
+				return "";
+			}
+			tag = shape(kind.value);
+		}
+		visiting.add(v);
+		const map = at === "response" && isResponseMap(v);
+		const deferred = v["~kind"] === "Deferred";
+		let s = (list ? "[" : "{") + tag;
+		for (const k of Reflect.ownKeys(v)) {
+			const d = Object.getOwnPropertyDescriptor(v, k);
+			if (typeof k === "symbol" || !("value" in d)) {
+				unsupported = true;
+				break;
+			}
+			const value = d.value;
+			if (k === "$ref" && typeof value === "string") addRef(value, at);
+			s += "," + (d.enumerable ? "" : "!") + JSON.stringify(k) + ":";
+			if (map) s += named(value);
+			else if (k === "config" && isCookieAt(at)) s += shape([value?.sign, !!value?.secrets]);
+			else if (k === "secrets" && (typeof value === "string" || Array.isArray(value))) s += shape(!!value);
+			else s += shape(value, childAt(at, k, value, deferred));
+		}
+		visiting.delete(v);
+		return s + (list ? "]" : "}");
+	};
+	const named = (v, at) => {
+		if (typeof v === "string") addRef(v, at);
+		return shape(v, at);
+	};
+	let s = typeof handler === "function" || handler == null ? shape(handler) : handler instanceof Response ? "R" : handler instanceof Promise ? "P" : typeof handler === "object" ? "O" : "V";
+	for (const event of shapeEvents) {
+		s += "|";
+		const fns = hook?.[event];
+		if (fns) for (const fn of Array.isArray(fns) ? fns : [fns]) s += shape(fn);
+	}
+	const bf = hook?.beforeHandle;
+	s += "|" + JSON.stringify(bf && deriveModes(Array.isArray(bf) ? bf : [bf], hook["~deriveEntries"]));
+	for (const from of [hook, ...hook?.schemas || []]) for (const slot of shapeSlots) s += "|" + named(from?.[slot], slot);
+	let targets;
+	for (const [ref, at] of refs) for (const target of at ? (targets ??= refTargets([], models))(ref) : [models?.[ref]]) s += "|" + JSON.stringify(ref) + shape(target, at);
+	s += "|" + JSON.stringify([
+		config?.cookie?.sign,
+		config?.cookie?.verify,
+		config?.normalize,
+		!!config?.allowUnsafeValidationDetails,
+		config?.abortSignal !== false,
+		isNotEmpty(frozenRoot["~ext"]?.headers),
+		!!(config?.adapter ?? defaultAdapter).response.supportsDefaultHeaderSink,
+		!!returnedErrorClasses(hook, root)
+	]) + shape(config?.sanitize);
+	return unsupported ? void 0 : fnv1a(s);
+}
 const isBareArrow = /^(?:async\s*)?\(\s*\)\s*=>/;
 const isSucroseOpaque = /arguments|eval|\[native code\]/;
 function compileHandler(route, root, liveOnly = false) {
@@ -302,17 +416,7 @@ function compileHandler(route, root, liveOnly = false) {
 		handler = (c) => handle(new Request(replaceUrlPath(c.request.url, c.path.slice(c.path.startsWith(encRoot) ? encLen : rawLen) || "/"), c.request));
 	}
 	const reconstructed = liveOnly ? void 0 : Compiled.getHandler(frozenRoot["~programId"], method, path);
-	if (reconstructed && typeof handler === "function" && !frozenRoot["~ext"]?.macro && !frozenRootOf(localMacroRoot(macroScope ?? instance, root))["~ext"]?.macro) {
-		if (!reconstructed.a.some((name) => hookStateAliases.includes(name))) return reconstructed.f(handler, ...resolveHandlerParams(reconstructed.a, {
-			root,
-			parse: adapter.parse,
-			res: adapter.response,
-			hook: nullObject(),
-			vali: void 0,
-			cookieConfig: void 0,
-			tracers: void 0
-		}));
-	}
+	if (!reconstructed) liveOnly ||= Compiled.hasProgram(frozenRoot["~programId"]);
 	const hook = composeRouteHook(instance, localHook, appHook, inheritedChain, root, macroScope, !reconstructed);
 	if (hook) {
 		promoteDerive(hook);
@@ -350,6 +454,20 @@ function compileHandler(route, root, liveOnly = false) {
 		const resolve = (p) => typeof p === "string" && p in namedParsers ? namedParsers[p] : p;
 		hook.parse = Array.isArray(hook.parse) ? hook.parse.map(resolve) : resolve(hook.parse);
 	}
+	let shape;
+	if (reconstructed || Capture.isCapturing()) {
+		shape = routeShape(hook, handler, root);
+		if (reconstructed && (!shape || reconstructed.k !== shape)) {
+			let live;
+			try {
+				live = compileHandler(route, root, true);
+			} catch (cause) {
+				throw new Error(aotDrift(method, path), { cause });
+			}
+			warnAotDrift(method, path);
+			return live;
+		}
+	}
 	if (reconstructed) return reconstructed.f(handler, ...resolveHandlerParams(reconstructed.a, {
 		root,
 		parse: adapter.parse,
@@ -401,9 +519,10 @@ function compileHandler(route, root, liveOnly = false) {
 		isStaticResponse,
 		isPromiseHandler,
 		errorClasses,
-		state
+		state,
+		shape
 	});
 }
 
 //#endregion
-export { buildNativeStaticResponse, chainResolver, clearHandlerAnalysisCaches, compileHandler, composeRouteHook, localMacroRoot, resolveLocalHook, resolveWSLocalHook, setCaptureHeaderShorthand };
+export { buildNativeStaticResponse, chainResolver, clearHandlerAnalysisCaches, compileHandler, composeRouteHook, localMacroRoot, resolveLocalHook, resolveWSLocalHook, routeShape, setCaptureHeaderShorthand };

package/dist/compile/handler/jit.d.ts

@@ -37,6 +37,8 @@ interface CompileHandlerJitOptions {
    * The JIT no longer re-derives these facts; it names its emissions off them.
    */
   state: RouteCompileState;
+  /** `routeShape`, recorded with the captured code */
+  shape?: number;
 }
 declare function compileHandlerJit(options: CompileHandlerJitOptions, tailPass?: TailMode): CompiledHandler;
 //#endregion

package/dist/compile/handler/jit.js

@@ -162,7 +162,7 @@ const createInlineHandler = (map, h) => ((c) => {
 	return map(r, c.request, true);
 });
 function compileHandlerJit(options, tailPass) {
-	const { method, path, handler, root, errorRoot, hook, adapter, isHandleFunction, isStaticResponse, isPromiseHandler, errorClasses, state } = options;
+	const { method, path, handler, root, errorRoot, hook, adapter, isHandleFunction, isStaticResponse, isPromiseHandler, errorClasses, state, shape } = options;
 	const { vali, inference, cookieConfig, beforeHandlePrefix, traceHandlers, tracePhases, hasAnyPhase, traceHandleOn, descriptor: { async: isAsync, tail: tailRoute, responseMode, hasBody, bodyValiIsAsync, headersValiIsAsync, paramsValiIsAsync, queryValiIsAsync, cookieValiIsAsync: cookieValidIsAsync, responseValiAsync, hasCookieSign, syncCookieSign, asyncCookieSign, lazyCookieVerify, hasErrorHook, hasAfterResponse, hasBeforeHandle, hasAfterHandle, hasMapResponse, hasResponseValidator, hasTrace, traceCount, hasLifecycleHook, syncErrorHook, syncAfterResponse } } = state;
 	const hasStaticAfterResponse = !!hook?.afterResponse?.length;
 	const hasDeriveDispose = !!hook?.["~deriveEntries"]?.length;
@@ -567,7 +567,8 @@ if(_vr)_r.response=${responseValiAsync ? awaitValue(encodeStatus, arm) : encodeS
 		method,
 		path,
 		alias: fullAlias,
-		code
+		code,
+		k: shape
 	});
 	onEmit?.(code);
 	const isGeneratorHandler = isHandleFunction && handler.constructor.name.endsWith("GeneratorFunction");

package/dist/compile/handler/jit.mjs

@@ -161,7 +161,7 @@ const createInlineHandler = (map, h) => ((c) => {
 	return map(r, c.request, true);
 });
 function compileHandlerJit(options, tailPass) {
-	const { method, path, handler, root, errorRoot, hook, adapter, isHandleFunction, isStaticResponse, isPromiseHandler, errorClasses, state } = options;
+	const { method, path, handler, root, errorRoot, hook, adapter, isHandleFunction, isStaticResponse, isPromiseHandler, errorClasses, state, shape } = options;
 	const { vali, inference, cookieConfig, beforeHandlePrefix, traceHandlers, tracePhases, hasAnyPhase, traceHandleOn, descriptor: { async: isAsync, tail: tailRoute, responseMode, hasBody, bodyValiIsAsync, headersValiIsAsync, paramsValiIsAsync, queryValiIsAsync, cookieValiIsAsync: cookieValidIsAsync, responseValiAsync, hasCookieSign, syncCookieSign, asyncCookieSign, lazyCookieVerify, hasErrorHook, hasAfterResponse, hasBeforeHandle, hasAfterHandle, hasMapResponse, hasResponseValidator, hasTrace, traceCount, hasLifecycleHook, syncErrorHook, syncAfterResponse } } = state;
 	const hasStaticAfterResponse = !!hook?.afterResponse?.length;
 	const hasDeriveDispose = !!hook?.["~deriveEntries"]?.length;
@@ -566,7 +566,8 @@ if(_vr)_r.response=${responseValiAsync ? awaitValue(encodeStatus, arm) : encodeS
 		method,
 		path,
 		alias: fullAlias,
-		code
+		code,
+		k: shape
 	});
 	onEmit?.(code);
 	const isGeneratorHandler = isHandleFunction && handler.constructor.name.endsWith("GeneratorFunction");

package/dist/compile/handler/reconstruct.js

@@ -28,14 +28,15 @@ var Reconstrct = class {
 			});
 		} catch (error) {
 			if (!require_compile_handler_frozen_validator.isBridgeNotInitialized(error)) throw error;
-			if (liveOnly) throw new Error("Duplicate route must compile JIT but the TypeBox bridge is not initialized", { cause: error });
+			if (liveOnly) throw new Error("Route requires live compilation but the TypeBox bridge is not initialized", { cause: error });
 			const frozen = require_compile_handler_frozen_validator.buildFrozenRouteValidator(hook, root, method, path);
 			if (frozen) return frozen;
 			throw error;
 		}
 	}
 	static cookie(hook, root) {
-		return require_cookie_config.compileCookieConfig(hook?.cookie, require_generation.frozenRootOf(root)["~config"]?.cookie);
+		const frozenRoot = require_generation.frozenRootOf(root);
+		return require_cookie_config.compileCookieConfig(hook?.cookie, frozenRoot["~config"]?.cookie, frozenRoot["~ext"]?.models, hook?.schemas);
 	}
 	static trace(hook, root) {
 		const traceHandlers = hook?.trace;

package/dist/compile/handler/reconstruct.mjs

@@ -27,14 +27,15 @@ var Reconstrct = class {
 			});
 		} catch (error) {
 			if (!isBridgeNotInitialized(error)) throw error;
-			if (liveOnly) throw new Error("Duplicate route must compile JIT but the TypeBox bridge is not initialized", { cause: error });
+			if (liveOnly) throw new Error("Route requires live compilation but the TypeBox bridge is not initialized", { cause: error });
 			const frozen = buildFrozenRouteValidator(hook, root, method, path);
 			if (frozen) return frozen;
 			throw error;
 		}
 	}
 	static cookie(hook, root) {
-		return compileCookieConfig(hook?.cookie, frozenRootOf(root)["~config"]?.cookie);
+		const frozenRoot = frozenRootOf(root);
+		return compileCookieConfig(hook?.cookie, frozenRoot["~config"]?.cookie, frozenRoot["~ext"]?.models, hook?.schemas);
 	}
 	static trace(hook, root) {
 		const traceHandlers = hook?.trace;

package/dist/cookie/config.d.ts

@@ -9,6 +9,7 @@ interface FieldCookieConfig {
   secrets?: string | null | (string | null)[];
   sign: boolean;
   defaults?: Partial<BaseCookie>;
+  legacySignature?: boolean;
 }
 interface CompiledCookieConfig {
   defaults: Partial<BaseCookie>;
@@ -20,7 +21,10 @@ interface CompiledCookieConfig {
   verify: 'lazy' | 'eager';
   legacySignature: boolean;
 }
-declare function compileCookieConfig(routeSchema: AnySchema | undefined, appConfig: AppCookieConfig | undefined): CompiledCookieConfig;
+declare function compileCookieConfig(routeSchema: AnySchema | string | undefined, appConfig: AppCookieConfig | undefined, models?: Record<string, unknown>, schemas?: {
+  cookie?: unknown;
+}[]): CompiledCookieConfig;
+declare const legacySignatureOf: (name: string, config: CompiledCookieConfig) => boolean;
 declare function resolveSignSecrets(name: string, config: CompiledCookieConfig): CompiledCookieConfig['globalSecrets'] | undefined;
 declare function isCookieSigned(name: string, config: CompiledCookieConfig): {
   signed: true;
@@ -29,4 +33,4 @@ declare function isCookieSigned(name: string, config: CompiledCookieConfig): {
   signed: false;
 };
 //#endregion
-export { AppCookieConfig, CompiledCookieConfig, FieldCookieConfig, compileCookieConfig, isCookieSigned, resolveSignSecrets };
+export { AppCookieConfig, CompiledCookieConfig, FieldCookieConfig, compileCookieConfig, isCookieSigned, legacySignatureOf, resolveSignSecrets };

package/dist/cookie/config.js

@@ -26,8 +26,67 @@ function getAttributes(source) {
 	return out;
 }
 const hasUsableSecret = (secrets) => Array.isArray(secrets) ? secrets.some((s) => !!s?.trim()) : !!secrets?.trim();
-function compileCookieConfig(routeSchema, appConfig) {
-	const routeConfig = routeSchema?.config ?? void 0;
+const gathered = () => ({
+	config: require_utils.nullObject(),
+	fields: require_utils.nullObject()
+});
+function canonical(config) {
+	const out = require_utils.nullObject();
+	for (const key of Object.keys(config).sort()) if (key !== "sign") out[key] = key === "secrets" ? asList(config[key]) : config[key];
+	return out;
+}
+const unsigned = (from) => {
+	const fields = require_utils.nullObject();
+	for (const name of Object.keys(from.fields).sort()) {
+		const field = canonical(from.fields[name]);
+		if (Object.keys(field).length) fields[name] = field;
+	}
+	return JSON.stringify([canonical(from.config), fields]);
+};
+const unclear = () => /* @__PURE__ */ new Error("[Elysia] Cookie schema `$ref` is unresolvable or ambiguous; use a model name or `$id` instead");
+const asList = (value) => JSON.stringify(typeof value === "string" ? [value] : value);
+function foldConfig(into, config) {
+	for (const key in config) {
+		const value = config[key];
+		const prev = into[key];
+		if (value === void 0) continue;
+		if (prev === void 0) into[key] = value;
+		else if (key === "sign") into.sign = prev === true || value === true || [].concat(prev, value);
+		else if ((key === "secrets" || key === "legacySignature") && asList(prev) !== asList(value)) throw new Error(`[Elysia] Merged cookie schemas disagree on \`${key}\``);
+	}
+}
+function compileCookieConfig(routeSchema, appConfig, models, schemas) {
+	const roots = [routeSchema, ...(schemas ?? []).map((schema) => schema?.cookie).reverse()].map((schema) => typeof schema === "string" ? models?.[schema] : schema);
+	let targets;
+	const resolve = (name) => (targets ??= require_utils.refTargets(roots, models))(name);
+	const gather = (schema, into, field, path) => {
+		if (!schema || path.has(schema)) return;
+		path.add(schema);
+		const ref = schema.$ref;
+		const targets = typeof ref === "string" ? [...resolve(ref)] : [ref];
+		if (typeof ref === "string" && !targets.length || schema.$dynamicRef !== void 0 || schema.$recursiveRef !== void 0) throw unclear();
+		if (field === void 0) {
+			foldConfig(into.config, schema.config);
+			for (const name in schema.properties) gather(schema.properties[name], into, name, /* @__PURE__ */ new Set());
+		} else if (schema.config) foldConfig(into.fields[field] ??= require_utils.nullObject(), schema.config);
+		if (targets.length > 1) {
+			let first;
+			for (const target of targets) {
+				const from = gathered();
+				gather(target, from, field, path);
+				if ((first ??= unsigned(from)) !== unsigned(from)) throw unclear();
+				foldConfig(into.config, from.config);
+				for (const name in from.fields) foldConfig(into.fields[name] ??= require_utils.nullObject(), from.fields[name]);
+			}
+		} else gather(targets[0], into, field, path);
+		for (const key of require_utils.compositionKeys) if (Array.isArray(schema[key])) for (const member of schema[key]) gather(member, into, field, path);
+		if (schema["~kind"] === "Deferred") for (const operand of [].concat(schema.parameters?.[0])) gather(operand, into, field, path);
+		path.delete(schema);
+	};
+	const route = gathered();
+	for (const root of roots) gather(root, route, void 0, /* @__PURE__ */ new Set());
+	const routeConfig = route.config;
+	const fieldConfigs = route.fields;
 	const appAttributes = getAttributes(appConfig);
 	const routeAttributes = getAttributes(routeConfig);
 	const defaults = appAttributes && routeAttributes ? {
@@ -43,17 +102,16 @@ function compileCookieConfig(routeSchema, appConfig) {
 	else globalSign = [rawSign];
 	const globalSecrets = routeConfig?.secrets !== void 0 ? routeConfig.secrets : appConfig?.secrets;
 	const fields = require_utils.nullObject();
-	const properties = routeSchema?.properties;
 	let hasSign = false;
-	if (properties) for (const name in properties) {
-		const config = properties[name]?.config;
-		if (!config) continue;
-		const sign = !!config.secrets || config.sign === true;
+	for (const name in fieldConfigs) {
+		const config = fieldConfigs[name];
+		const sign = config.secrets != null || config.sign === true;
 		if (sign) hasSign = true;
 		fields[name] = {
 			secrets: config.secrets,
 			sign,
-			defaults: getAttributes(config)
+			defaults: getAttributes(config),
+			legacySignature: config.legacySignature
 		};
 	}
 	if (globalSign !== void 0) hasSign = true;
@@ -77,6 +135,7 @@ function compileCookieConfig(routeSchema, appConfig) {
 		legacySignature: (routeConfig?.legacySignature ?? appConfig?.legacySignature) !== false
 	};
 }
+const legacySignatureOf = (name, config) => config.fields[name]?.legacySignature ?? config.legacySignature;
 function resolveSignSecrets(name, config) {
 	const field = config.fields[name];
 	if (field?.sign) return field.secrets ?? config.globalSecrets;
@@ -95,4 +154,5 @@ function isCookieSigned(name, config) {
 //#endregion
 exports.compileCookieConfig = compileCookieConfig;
 exports.isCookieSigned = isCookieSigned;
+exports.legacySignatureOf = legacySignatureOf;
 exports.resolveSignSecrets = resolveSignSecrets;

package/dist/cookie/config.mjs

@@ -1,4 +1,4 @@
-import { nullObject } from "../utils.mjs";
+import { compositionKeys, nullObject, refTargets } from "../utils.mjs";
 import { InvalidCookie } from "./error.mjs";
 
 //#region src/cookie/config.ts
@@ -25,8 +25,67 @@ function getAttributes(source) {
 	return out;
 }
 const hasUsableSecret = (secrets) => Array.isArray(secrets) ? secrets.some((s) => !!s?.trim()) : !!secrets?.trim();
-function compileCookieConfig(routeSchema, appConfig) {
-	const routeConfig = routeSchema?.config ?? void 0;
+const gathered = () => ({
+	config: nullObject(),
+	fields: nullObject()
+});
+function canonical(config) {
+	const out = nullObject();
+	for (const key of Object.keys(config).sort()) if (key !== "sign") out[key] = key === "secrets" ? asList(config[key]) : config[key];
+	return out;
+}
+const unsigned = (from) => {
+	const fields = nullObject();
+	for (const name of Object.keys(from.fields).sort()) {
+		const field = canonical(from.fields[name]);
+		if (Object.keys(field).length) fields[name] = field;
+	}
+	return JSON.stringify([canonical(from.config), fields]);
+};
+const unclear = () => /* @__PURE__ */ new Error("[Elysia] Cookie schema `$ref` is unresolvable or ambiguous; use a model name or `$id` instead");
+const asList = (value) => JSON.stringify(typeof value === "string" ? [value] : value);
+function foldConfig(into, config) {
+	for (const key in config) {
+		const value = config[key];
+		const prev = into[key];
+		if (value === void 0) continue;
+		if (prev === void 0) into[key] = value;
+		else if (key === "sign") into.sign = prev === true || value === true || [].concat(prev, value);
+		else if ((key === "secrets" || key === "legacySignature") && asList(prev) !== asList(value)) throw new Error(`[Elysia] Merged cookie schemas disagree on \`${key}\``);
+	}
+}
+function compileCookieConfig(routeSchema, appConfig, models, schemas) {
+	const roots = [routeSchema, ...(schemas ?? []).map((schema) => schema?.cookie).reverse()].map((schema) => typeof schema === "string" ? models?.[schema] : schema);
+	let targets;
+	const resolve = (name) => (targets ??= refTargets(roots, models))(name);
+	const gather = (schema, into, field, path) => {
+		if (!schema || path.has(schema)) return;
+		path.add(schema);
+		const ref = schema.$ref;
+		const targets = typeof ref === "string" ? [...resolve(ref)] : [ref];
+		if (typeof ref === "string" && !targets.length || schema.$dynamicRef !== void 0 || schema.$recursiveRef !== void 0) throw unclear();
+		if (field === void 0) {
+			foldConfig(into.config, schema.config);
+			for (const name in schema.properties) gather(schema.properties[name], into, name, /* @__PURE__ */ new Set());
+		} else if (schema.config) foldConfig(into.fields[field] ??= nullObject(), schema.config);
+		if (targets.length > 1) {
+			let first;
+			for (const target of targets) {
+				const from = gathered();
+				gather(target, from, field, path);
+				if ((first ??= unsigned(from)) !== unsigned(from)) throw unclear();
+				foldConfig(into.config, from.config);
+				for (const name in from.fields) foldConfig(into.fields[name] ??= nullObject(), from.fields[name]);
+			}
+		} else gather(targets[0], into, field, path);
+		for (const key of compositionKeys) if (Array.isArray(schema[key])) for (const member of schema[key]) gather(member, into, field, path);
+		if (schema["~kind"] === "Deferred") for (const operand of [].concat(schema.parameters?.[0])) gather(operand, into, field, path);
+		path.delete(schema);
+	};
+	const route = gathered();
+	for (const root of roots) gather(root, route, void 0, /* @__PURE__ */ new Set());
+	const routeConfig = route.config;
+	const fieldConfigs = route.fields;
 	const appAttributes = getAttributes(appConfig);
 	const routeAttributes = getAttributes(routeConfig);
 	const defaults = appAttributes && routeAttributes ? {
@@ -42,17 +101,16 @@ function compileCookieConfig(routeSchema, appConfig) {
 	else globalSign = [rawSign];
 	const globalSecrets = routeConfig?.secrets !== void 0 ? routeConfig.secrets : appConfig?.secrets;
 	const fields = nullObject();
-	const properties = routeSchema?.properties;
 	let hasSign = false;
-	if (properties) for (const name in properties) {
-		const config = properties[name]?.config;
-		if (!config) continue;
-		const sign = !!config.secrets || config.sign === true;
+	for (const name in fieldConfigs) {
+		const config = fieldConfigs[name];
+		const sign = config.secrets != null || config.sign === true;
 		if (sign) hasSign = true;
 		fields[name] = {
 			secrets: config.secrets,
 			sign,
-			defaults: getAttributes(config)
+			defaults: getAttributes(config),
+			legacySignature: config.legacySignature
 		};
 	}
 	if (globalSign !== void 0) hasSign = true;
@@ -76,6 +134,7 @@ function compileCookieConfig(routeSchema, appConfig) {
 		legacySignature: (routeConfig?.legacySignature ?? appConfig?.legacySignature) !== false
 	};
 }
+const legacySignatureOf = (name, config) => config.fields[name]?.legacySignature ?? config.legacySignature;
 function resolveSignSecrets(name, config) {
 	const field = config.fields[name];
 	if (field?.sign) return field.secrets ?? config.globalSecrets;
@@ -92,4 +151,4 @@ function isCookieSigned(name, config) {
 }
 
 //#endregion
-export { compileCookieConfig, isCookieSigned, resolveSignSecrets };
+export { compileCookieConfig, isCookieSigned, legacySignatureOf, resolveSignSecrets };

package/dist/cookie/utils.js

@@ -66,7 +66,7 @@ async function parseCookieRaw(cookieString, config, lazy) {
 		let value = (0, deuri.default)(v) ?? v;
 		const signCheck = require_cookie_config.resolveSignSecrets(name, config);
 		if (signCheck !== void 0) try {
-			value = await require_cookie_crypto.unsignWithSecrets(name, value, signCheck, config.legacySignature);
+			value = await require_cookie_crypto.unsignWithSecrets(name, value, signCheck, require_cookie_config.legacySignatureOf(name, config));
 		} catch (error) {
 			if (!lazy || !(error instanceof require_cookie_error.InvalidCookie)) throw error;
 			out[name] = invalidSignature();
@@ -87,7 +87,7 @@ function parseCookieRawSigned(cookieString, config, lazy) {
 		let value = (0, deuri.default)(v) ?? v;
 		const signCheck = require_cookie_config.resolveSignSecrets(name, config);
 		if (signCheck !== void 0) try {
-			value = require_cookie_crypto.unsignWithSecretsSync(name, value, signCheck, config.legacySignature);
+			value = require_cookie_crypto.unsignWithSecretsSync(name, value, signCheck, require_cookie_config.legacySignatureOf(name, config));
 		} catch (error) {
 			if (!lazy || !(error instanceof require_cookie_error.InvalidCookie)) throw error;
 			out[name] = invalidSignature();
@@ -111,7 +111,7 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 			const secrets = require_cookie_config.resolveSignSecrets(name, config);
 			if (secrets !== void 0) {
 				entry["~unsign"] = secrets;
-				if (!config.legacySignature) entry["~strict"] = 1;
+				if (!require_cookie_config.legacySignatureOf(name, config)) entry["~strict"] = 1;
 			}
 		} else {
 			const value = entry.value;

package/dist/cookie/utils.mjs

@@ -3,7 +3,7 @@ import { InvalidCookie } from "./error.mjs";
 import { parse } from "./lib.mjs";
 import { deriveSignKey, hasSyncHmac, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieSyncImpl, unsignWithSecrets, unsignWithSecretsSync } from "./crypto.mjs";
 import { Cookie } from "./cookie.mjs";
-import { isCookieSigned, resolveSignSecrets } from "./config.mjs";
+import { isCookieSigned, legacySignatureOf, resolveSignSecrets } from "./config.mjs";
 import decodeComponent from "deuri";
 
 //#region src/cookie/utils.ts
@@ -63,7 +63,7 @@ async function parseCookieRaw(cookieString, config, lazy) {
 		let value = decodeComponent(v) ?? v;
 		const signCheck = resolveSignSecrets(name, config);
 		if (signCheck !== void 0) try {
-			value = await unsignWithSecrets(name, value, signCheck, config.legacySignature);
+			value = await unsignWithSecrets(name, value, signCheck, legacySignatureOf(name, config));
 		} catch (error) {
 			if (!lazy || !(error instanceof InvalidCookie)) throw error;
 			out[name] = invalidSignature();
@@ -84,7 +84,7 @@ function parseCookieRawSigned(cookieString, config, lazy) {
 		let value = decodeComponent(v) ?? v;
 		const signCheck = resolveSignSecrets(name, config);
 		if (signCheck !== void 0) try {
-			value = unsignWithSecretsSync(name, value, signCheck, config.legacySignature);
+			value = unsignWithSecretsSync(name, value, signCheck, legacySignatureOf(name, config));
 		} catch (error) {
 			if (!lazy || !(error instanceof InvalidCookie)) throw error;
 			out[name] = invalidSignature();
@@ -108,7 +108,7 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 			const secrets = resolveSignSecrets(name, config);
 			if (secrets !== void 0) {
 				entry["~unsign"] = secrets;
-				if (!config.legacySignature) entry["~strict"] = 1;
+				if (!legacySignatureOf(name, config)) entry["~strict"] = 1;
 			}
 		} else {
 			const value = entry.value;

package/dist/package.js

@@ -1,6 +1,6 @@
 
 //#region package.json
-var version = "2.0.0-beta.20";
+var version = "2.0.0-beta.21";
 
 //#endregion
 Object.defineProperty(exports, 'version', {

package/dist/package.mjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.0.0-beta.20";
+var version = "2.0.0-beta.21";
 
 //#endregion
 export { version };

package/dist/plugin/aot/core.d.ts

@@ -3,6 +3,11 @@ import { JITProbeResult } from "../../compile/jit-probe.js";
 import { AotModuleCondition, AotTarget } from "./source.js";
 
 //#region src/plugin/aot/core.d.ts
+/**
+ * A route that differs from the build compiles live with a warning, or fails
+ * when the JIT is stripped. A conditional hook must change the hook list
+ * (`isProd ? [auth] : []`), not swap functions. Keep `async` native
+ */
 interface ElysiaAotOptions {
   /**
    * Specifier the generated module imports `Compiled` from