Derives each operation's security requirement from the guards actually protecting its route, instead of requiring every route to declare one.

A guard brands itself with RouteSecurityMetadata (every guard @setu-ts/auth-plugin ships does); when this option is set, a route carrying a guard that requires authentication is documented as needing scheme, and one carrying a guard that marks it public is documented with an empty requirement.

scheme must be a key of OpenApiGeneratorOptions.securitySchemes — a guard cannot know what the document calls its scheme, so the name is configured here rather than inferred.

Only ROUTE-level middleware is inspected. Middleware added through app.middleware.add() is not visible on a route and is not consulted; that is correct for authMiddleware(), which populates the principal rather than enforcing anything.

A requirement declared on the route's own schema.security always wins.