When true, auto-scan controllersPath for decorated classes. Discovery failures are logged as warnings and never crash the application.

Glob path for controller discovery (used when autoDiscover is true).

Explicit list of controller classes to register.

Explicit list of service classes to register.

Module classes to expand before registration. Imported modules are visited depth-first; each module's providers are collected before its controllers.

When true (the default), a route decorated with @ValidateBody / @ValidateQuery / @ValidateParams gets the registered validation capability's enforcing middleware appended LAST in its chain (innermost, after guards and filters), so an invalid request is rejected with 400 before the handler runs — while guard 401/403 precedence is preserved.

When false, schemas stay description-only (surfaced via RouteDefinition.schema for OpenAPI) and no enforcement middleware is appended; the absent-capability warning is also silenced.

When true (the default), a route decorated with @Roles / @Permissions gets enforcing authorization middleware appended to its chain — after the route's guards and filters, before any validation middleware. The middleware resolves CAPABILITIES.AUTHORIZATION per request: with a provider registered it answers 401/403 exactly like the equivalent @UseGuards(requireRole(...)) spelling; with none, the route FAILS CLOSED — it answers 501 and is never served unguarded — and register() warns once per affected route.

When false, role/permission metadata stays description-only (no enforcement middleware is appended) and the absent-capability warning is silenced: the pre-M89a behaviour.