Fills each operation's requestBody and parameters from the validation middleware actually guarding its route, so a route that already carries validateBody(schema) does not have to repeat that schema in schema.body.

A middleware brands itself with RouteValidationMetadata (every helper @setu-ts/validation-plugin ships does). A value DECLARED on the route's own schema always wins, per field.

cookies brands are read and ignored: RouteSchema has no cookies field, so there is no declared counterpart, and @setu-ts/sdk's client generator refuses an in: 'cookie' parameter outright — emitting one would turn a working document into a codegen failure.

Unlike OpenApiGeneratorOptions.deriveSecurity this is ON by default, because nothing has to be configured for it: a security requirement names a scheme that cannot be inferred from a guard, while the schema on the route IS the schema the document wants.