Interface DecoratorPluginOptions

When true, auto-scan controllersPath for decorated classes. Discovery failures are logged as warnings and never crash the application.

Explicit list of controller classes to register.

Glob path for controller discovery (used when autoDiscover is true).

When true (the default), a route decorated with @Roles / @Permissions gets enforcing authorization middleware appended to its chain — after the route's guards and filters, before any validation middleware. The middleware resolves CAPABILITIES.AUTHORIZATION per request: with a provider registered it answers 401/403 exactly like the equivalent @UseGuards(requireRole(...)) spelling; with none, the route FAILS CLOSED — it answers 501 and is never served unguarded — and register() warns once per affected route.

When false, role/permission metadata stays description-only (no enforcement middleware is appended) and the absent-capability warning is silenced: the pre-M89a behaviour.

When true (the default), a route decorated with @ValidateBody / @ValidateQuery / @ValidateParams gets the registered validation capability's enforcing middleware appended LAST in its chain (innermost, after guards and filters), so an invalid request is rejected with 400 before the handler runs — while guard 401/403 precedence is preserved.

When false, schemas stay description-only (surfaced via RouteDefinition.schema for OpenAPI) and no enforcement middleware is appended; the absent-capability warning is also silenced.

Explicit list of classes carrying non-HTTP ingress decorators.

Module classes to expand before registration. Imported modules are visited depth-first; each module's providers are collected before its controllers.

@Policy classes to register with the authorization policy service AuthPlugin provides (M110a). Each is constructed like a controller — with constructor injection — and registered before any controller, so a route's @RequirePolicy can name it. Listing a class with no policy service registered, a class without @Policy, or one without an @Ability() method refuses register().

Explicit list of service classes to register.