OptionalauthOptional arm: AuthPlugin. Provided only when the caller supplies
auth configuration; omitted → auth not registered. Configure at least one
passive strategy (jwt, apiKey, session, or strategies). The plugin
registers its authentication middleware globally unless disabled.
OptionalconfigOptions for ConfigPlugin. Omitted → defaults.
OptionaldatabaseOptional arm: DatabasePlugin. Provided only when the caller supplies database credentials; omitted → database not registered.
OptionaldecoratorsOptions for DecoratorPlugin. Omitted → defaults.
OptionaldiOptional arm: DiPlugin. Omitted → decorated services are constructed
directly and registered in the kernel's ServiceRegistry, which is the
default and needs no container.
Supplying this arm changes how every decorated service in the application
is constructed: DecoratorPlugin branches on the presence of a container,
so with this arm each @Injectable class becomes a container provider that
honors its scope. That is why it is gated rather than always-on — the
default composition stays identical to a starter app without it.
OptionalgraphqlOptional arm: GraphqlPlugin. Gated because the plugin cannot boot without
an application-supplied schema — the rule that made session gated.
OptionalhealthOptions for HealthPlugin. Omitted → defaults.
OptionalhttpOptions for HttpSecurityPlugin. Omitted → defaults.
OptionalloggerOptions for LoggerPlugin. Omitted → defaults.
OptionalmetricsOptions for MetricsPlugin. Omitted → defaults.
OptionalopenapiOptions for OpenApiPlugin. Omitted → defaults.
OptionalrealtimeOptional arm: the real-time plugins, one per sub-arm. Omitted → none of the three is registered.
OptionalserviceOptional arm: ServiceDiscoveryPlugin. Provided → service discovery is registered; omitted → no discovery capability is added.
OptionalsessionOptional arm: SessionPlugin. Omitted → the application has no cookie
session and no session-backed form CSRF.
Gated because a session needs a secret nobody can default: the plugin
throws during register() without one, so an always-on arm would make
every starter application fail to boot until it supplied one. It is also
genuinely optional — a token-authenticated API has no use for cookies,
which is what auth covers.
Setting csrf additionally registers the synchronizer-token middleware at
priority 325, which is the check a progressive-enhancement <Form> post
can satisfy — unlike the stateless Origin/Referer check that
httpSecurity performs, which a form structurally cannot. Running both is
intended.
OptionalvalidationOptions for ValidationPlugin. Omitted → defaults.
Options for
createRestApp. Per-plugin optional arms are threaded straight through to each plugin factory. Omitted plugins use their default configuration (no arguments required).See
RestStarterOptions