OptionalauthOptional arm: AuthPlugin. Provided only when the caller supplies
auth configuration; omitted → auth not registered. Configure at least one
passive strategy (jwt, apiKey, session, or strategies). The plugin
registers its authentication middleware globally unless disabled.
OptionalconfigOptions for ConfigPlugin. Omitted → defaults.
OptionaldatabaseOptional arm: DatabasePlugin. Provided only when the caller supplies database credentials; omitted → database not registered.
OptionaldecoratorsOptions for DecoratorPlugin. Omitted → defaults.
OptionaldiOptional arm: DiPlugin. Omitted → decorated services are constructed
directly and registered in the kernel's ServiceRegistry, which is the
default and needs no container.
Supplying this arm changes how every decorated service in the application
is constructed: DecoratorPlugin branches on the presence of a container,
so with this arm each @Injectable class becomes a container provider that
honors its scope. That is why it is gated rather than always-on — the
default composition stays identical to a starter app without it.
OptionalgraphqlOptional arm: GraphqlPlugin. Gated because the plugin cannot boot without
an application-supplied schema — the rule that made session gated.
OptionalhealthOptions for HealthPlugin. Omitted → defaults.
OptionalhttpOptions for HttpSecurityPlugin. Omitted → defaults.
OptionalloggerOptions for LoggerPlugin. Omitted → defaults.
OptionalmessagingConfiguration for MessagingPlugin, which this tier ALWAYS
registers — unlike the gated arms inherited from
RestStarterOptions, omitting this does not skip the plugin.
Omitted → the memory broker default.
OptionalmetricsOptions for MetricsPlugin. Omitted → defaults.
OptionalopenapiOptions for OpenApiPlugin. Omitted → defaults.
OptionalqueueConfiguration for QueuePlugin, always registered. Omitted → the memory adapter default.
OptionalrealtimeOptional arm: the real-time plugins, one per sub-arm. Omitted → none of the three is registered.
OptionalresilienceConfiguration for ResiliencePlugin, always registered. Omitted → plugin defaults.
OptionalserviceOptional arm: ServiceDiscoveryPlugin. Provided → service discovery is registered; omitted → no discovery capability is added.
OptionalsessionOptional arm: SessionPlugin. Omitted → the application has no cookie
session and no session-backed form CSRF.
Gated because a session needs a secret nobody can default: the plugin
throws during register() without one, so an always-on arm would make
every starter application fail to boot until it supplied one. It is also
genuinely optional — a token-authenticated API has no use for cookies,
which is what auth covers.
Setting csrf additionally registers the synchronizer-token middleware at
priority 325, which is the check a progressive-enhancement <Form> post
can satisfy — unlike the stateless Origin/Referer check that
httpSecurity performs, which a form structurally cannot. Running both is
intended.
OptionaltelemetryConfiguration for TelemetryPlugin, always registered.
Omitted → a NoopTelemetryService, since no exporter is configured.
OptionalvalidationOptions for ValidationPlugin. Omitted → defaults.
Options for
createMicroserviceApp. ExtendsRestStarterOptionswith microservice-specific arms. Omitted plugins use their defaults.See
MicroserviceStarterOptions