interface RestStarterOptions

Options for createRestApp. Per-plugin optional arms are threaded straight through to each plugin factory. Omitted plugins use their default configuration (no arguments required).

Properties

optional
config: ConfigPluginOptions

Options for ConfigPlugin. Omitted → defaults.

optional
logger: LoggerPluginOptions

Options for LoggerPlugin. Omitted → defaults.

optional
validation: ValidationPluginOptions

Options for ValidationPlugin. Omitted → defaults.

optional
httpSecurity: HttpSecurityPluginOptions

Options for HttpSecurityPlugin. Omitted → defaults.

optional
health: HealthPluginOptions

Options for HealthPlugin. Omitted → defaults.

optional
metrics: MetricsPluginOptions

Options for MetricsPlugin. Omitted → defaults.

optional
openapi: OpenApiPluginOptions

Options for OpenApiPlugin. Omitted → defaults.

optional
decorators: DecoratorPluginOptions

Options for DecoratorPlugin. Omitted → defaults.

optional
database: DatabasePluginOptions

Optional arm: DatabasePlugin. Provided only when the caller supplies database credentials; omitted → database not registered.

optional
auth: AuthPluginOptions

Optional arm: AuthPlugin. Provided only when the caller supplies auth configuration; omitted → auth not registered. rbac is itself optional — supply jwt alone for a JWT-only application, which registers no authorization capability.

Optional arm: the real-time plugins, one per sub-arm. Omitted → none of the three is registered.

optional
session: SessionPluginOptions

Optional arm: SessionPlugin. Omitted → the application has no cookie session and no session-backed form CSRF.

Gated because a session needs a secret nobody can default: the plugin throws during register() without one, so an always-on arm would make every starter application fail to boot until it supplied one. It is also genuinely optional — a token-authenticated API has no use for cookies, which is what auth covers.

Setting csrf additionally registers the synchronizer-token middleware at priority 275, which is the check a progressive-enhancement <Form> post can satisfy — unlike the stateless Origin/Referer check that httpSecurity performs, which a form structurally cannot. Running both is intended.

optional
di: DiPluginOptions

Optional arm: DiPlugin. Omitted → decorated services are constructed directly and registered in the kernel's ServiceRegistry, which is the default and needs no container.

Supplying this arm changes how every decorated service in the application is constructed: DecoratorPlugin branches on the presence of a container, so with this arm each @Injectable class becomes a container provider that honors its scope. That is why it is gated rather than always-on — the default composition stays identical to a starter app without it.

Since 0.3.0
optional
graphql: GraphqlPluginOptions

Optional arm: GraphqlPlugin. Gated because the plugin cannot boot without an application-supplied schema — the rule that made session gated.

optional
serviceDiscovery: ServiceDiscoveryPluginOptions

Optional arm: ServiceDiscoveryPlugin. Provided → service discovery is registered; omitted → no discovery capability is added.

See

Usage

import { type RestStarterOptions } from "starters/rest-starter/src/index.ts";