Elysia 1.4

Apply the TypeScript 7 prompt first. These rules cover Elysia 1.4 and were checked against 1.4.30. Apply Bun server and WebSocket settings only to the Bun adapter; verify equivalent controls on the actual Node.js adapter or Fetch-based host. Pin independently versioned plugins compatible with Elysia 1.4.

Routes, lifecycle, and authorization

• Register guards and route lifecycle hooks before protected routes and before .use() imports their routes. For hooks with scope, local covers the declaring instance and its descendants; scoped additionally reaches its immediate parent, and global propagates through ancestors. Export a security plugin's hooks deliberately with as rather than assuming .use(plugin) protects subsequent parent routes.
• Perform authentication and resource authorization in resolve or onBeforeHandle before handlers perform effects. derive and onTransform run before schema validation; use their input as unvalidated data. Order resolve before hooks that consume its principal, and check tenant, ownership, operation, and current resource state.
• Treat onRequest as global and pre-routing: it lacks validated body, parameters, and derived identity. Returning a value skips the remaining lifecycle, so an early cache response must independently satisfy authorization and privacy requirements.
• Return a denial such as return status(401, 'Unauthorized') from beforeHandle, or throw a handled error. Merely setting set.status does not stop the handler. Keep authorization out of afterHandle, mapResponse, and afterResponse, which