Options for createRestApp. Per-plugin optional arms are threaded
straight through to each plugin factory. Omitted plugins use their default
configuration (no arguments required).
config: ConfigPluginOptions
Options for ConfigPlugin. Omitted → defaults.
logger: LoggerPluginOptions
Options for LoggerPlugin. Omitted → defaults.
validation: ValidationPluginOptions
Options for ValidationPlugin. Omitted → defaults.
httpSecurity: HttpSecurityPluginOptions
Options for HttpSecurityPlugin. Omitted → defaults.
health: HealthPluginOptions
Options for HealthPlugin. Omitted → defaults.
metrics: MetricsPluginOptions
Options for MetricsPlugin. Omitted → defaults.
openapi: OpenApiPluginOptions
Options for OpenApiPlugin. Omitted → defaults.
decorators: DecoratorPluginOptions
Options for DecoratorPlugin. Omitted → defaults.
database: DatabasePluginOptions
Optional arm: DatabasePlugin. Provided only when the caller
supplies database credentials; omitted → database not registered.
auth: AuthPluginOptions
Optional arm: AuthPlugin. Provided only when the caller supplies
auth configuration; omitted → auth not registered. rbac is itself
optional — supply jwt alone for a JWT-only application, which registers
no authorization capability.
realtime: RealtimeArm
Optional arm: the real-time plugins, one per sub-arm. Omitted → none of the three is registered.
session: SessionPluginOptions
Optional arm: SessionPlugin. Omitted → the application has no cookie
session and no session-backed form CSRF.
Gated because a session needs a secret nobody can default: the plugin
throws during register() without one, so an always-on arm would make
every starter application fail to boot until it supplied one. It is also
genuinely optional — a token-authenticated API has no use for cookies,
which is what auth covers.
Setting csrf additionally registers the synchronizer-token middleware at
priority 275, which is the check a progressive-enhancement <Form> post
can satisfy — unlike the stateless Origin/Referer check that
httpSecurity performs, which a form structurally cannot. Running both is
intended.
di: DiPluginOptions
Optional arm: DiPlugin. Omitted → decorated services are constructed
directly and registered in the kernel's ServiceRegistry, which is the
default and needs no container.
Supplying this arm changes how every decorated service in the application
is constructed: DecoratorPlugin branches on the presence of a container,
so with this arm each @Injectable class becomes a container provider that
honors its scope. That is why it is gated rather than always-on — the
default composition stays identical to a starter app without it.
graphql: GraphqlPluginOptions
Optional arm: GraphqlPlugin. Gated because the plugin cannot boot without
an application-supplied schema — the rule that made session gated.
serviceDiscovery: ServiceDiscoveryPluginOptions
Optional arm: ServiceDiscoveryPlugin. Provided → service discovery is registered; omitted → no discovery capability is added.