@synoikia/create-plugin 0.1.0

package/templates/plugin/openapi-rest/src/plugin.ts

@@ -0,0 +1,89 @@
+import {
+  buildOpenApiCatalog,
+  compileRules,
+  definePlugin,
+  ErrorCodes,
+  HttpJsonClient,
+  isPlainObject,
+  joinApiPath,
+  parsePluginSettings,
+  PluginError,
+  requireString,
+  restBinding,
+  restLookup,
+  stringOr,
+} from '@synoikia/plugin-sdk';
+import type { PluginHandlers } from '@synoikia/plugin-sdk';
+import raw from '../plugin.yaml';
+import { authHeaders } from './auth.js';
+
+/**
+ * The {{name}} plugin: the catalog is {{name}}'s OpenAPI spec, and the sandbox calls
+ * `{{namespace}}.request({ method, path, query, body })`. Locks and secrets are in plugin.yaml.
+ */
+
+const SERVICE = '{{name}}';
+
+export const settings = parsePluginSettings(raw, {
+  parse(value) {
+    const p = isPlainObject(value) ? value : {};
+    const text = (key: string) => {
+      if (typeof p[key] !== 'string') throw new Error(`plugin.yaml plugin.${key} must be a string`);
+      return p[key];
+    };
+    return {
+      apiPath: text('apiPath'),
+      specPath: text('specPath'),
+      versionPath: text('versionPath'),
+      versionField: text('versionField'),
+      minOperations: typeof p.minOperations === 'number' ? p.minOperations : 1,
+    };
+  },
+});
+
+export function create{{Pascal}}Plugin(): PluginHandlers {
+  return definePlugin({
+    connect: (init) =>
+      new HttpJsonClient({
+        baseUrl: joinApiPath(requireString(init.config, 'baseUrl'), settings.plugin.apiPath),
+        service: SERVICE,
+        verifyTls: init.config.verifyTls !== false,
+        headers: authHeaders(init),
+        timeoutMs: settings.defaults.timeouts.request,
+      }),
+
+    async version(kit) {
+      const status = await kit.client().request('GET', settings.plugin.versionPath);
+      const version = isPlainObject(status) ? stringOr(status[settings.plugin.versionField]) : undefined;
+      if (!version) throw new PluginError(ErrorCodes.UpstreamError, `${SERVICE} reported no version`);
+      return version;
+    },
+
+    handlers(kit) {
+      const rules = compileRules(settings, { lookup: restLookup(kit.client) });
+      const catalog = kit.lazy(async () => {
+        const spec = await kit.client().request('GET', settings.plugin.specPath);
+        if (typeof spec !== 'string' && !isPlainObject(spec))
+          throw new PluginError(ErrorCodes.UpstreamError, `${SERVICE} served no OpenAPI spec`);
+        return buildOpenApiCatalog(spec, { service: SERVICE, rules, minOperations: settings.plugin.minOperations });
+      });
+      const binding = restBinding({
+        namespace: '{{namespace}}',
+        service: SERVICE,
+        rules,
+        catalog: catalog.get,
+        client: kit.client,
+        stripPrefix: settings.plugin.apiPath,
+      });
+      return {
+        async syncCatalog() {
+          const upstreamVersion = await kit.version();
+          return { upstreamVersion, operations: (await catalog.reload()).operations };
+        },
+        resolveOperation: binding.resolveOperation,
+        summarize: binding.summarize,
+        invoke: (params) => binding.invoke(params),
+      };
+    },
+  });
+}

package/templates/plugin/openapi-rest/test/e2e.test.ts

@@ -0,0 +1,49 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { checkPluginContract, startPluginHarness } from '@synoikia/core/testing';
+import type { PluginHarness } from '@synoikia/core/testing';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { CREDENTIALS } from './fake-auth.js';
+import { startFake{{Pascal}}, UPSTREAM_SECRET } from './fake-upstream.js';
+import type { Fake{{Pascal}} } from './fake-upstream.js';
+
+/**
+ * The real Synoikia core running this plugin's built bundle (a permission-confined child, as in
+ * production) against the fake {{name}}, through core's plugin harness.
+ */
+
+const PLUGIN_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let h: PluginHarness;
+let fake: Fake{{Pascal}};
+
+beforeAll(async () => {
+  fake = await startFake{{Pascal}}();
+  h = await startPluginHarness({ pluginDir: PLUGIN_DIR, connection: { baseUrl: fake.url, ...CREDENTIALS } });
+}, 60_000);
+
+afterAll(async () => {
+  await h?.stop();
+  await fake?.close();
+});
+
+describe('{{name}} end to end (fake {{name}})', () => {
+  it('keeps the plugin contract', async () => {
+    expect(
+      await checkPluginContract(h, {
+        read: { key: 'GET /items', code: `return await {{namespace}}.request({ path: '/items' });` },
+        write: {
+          key: 'POST /items',
+          code: `return await {{namespace}}.request({ method: 'POST', path: '/items', body: { name: 'x' } });`,
+        },
+        locked: {
+          key: 'DELETE /items/{itemId}',
+          code: `return await {{namespace}}.request({ method: 'DELETE', path: '/items/1' });`,
+          confirm: 'First item',
+        },
+        secrets: { code: `return await {{namespace}}.request({ path: '/settings' });`, values: [UPSTREAM_SECRET] },
+      }),
+    ).toEqual([]);
+    expect(fake.items.has(1)).toBe(false);
+  });
+});

package/templates/plugin/openapi-rest/test/fake-upstream.ts

@@ -0,0 +1,63 @@
+import { startFakeHttp } from '@synoikia/core/testing';
+import type { FakeHttp } from '@synoikia/core/testing';
+import { authorized } from './fake-auth.js';
+
+/**
+ * A fake {{name}}: just enough of its API to exercise the plugin, including a response that holds a
+ * secret, so the tests prove it never reaches the sandbox. Extend it as the plugin grows.
+ */
+
+export const UPSTREAM_SECRET = 'fake-upstream-secret-123';
+
+const SPEC = {
+  openapi: '3.0.3',
+  paths: {
+    '/status': { get: { summary: 'Version and name', tags: ['System'] } },
+    '/settings': { get: { summary: 'Settings, including an integration key', tags: ['Settings'] } },
+    '/items': {
+      get: { summary: 'List items', tags: ['Items'] },
+      post: {
+        summary: 'Create an item',
+        tags: ['Items'],
+        requestBody: {
+          content: { 'application/json': { schema: { type: 'object', properties: { name: { type: 'string' } } } } },
+        },
+      },
+    },
+    '/items/{itemId}': {
+      parameters: [{ name: 'itemId', in: 'path', required: true, schema: { type: 'number' } }],
+      get: { summary: 'Get an item', tags: ['Items'] },
+      delete: { summary: 'Delete an item', tags: ['Items'] },
+    },
+  },
+};
+
+export interface Fake{{Pascal}} extends FakeHttp {
+  items: Map<number, { id: number; name: string }>;
+}
+
+export async function startFake{{Pascal}}(): Promise<Fake{{Pascal}}> {
+  const items = new Map([[1, { id: 1, name: 'First item' }]]);
+  let next = 2;
+  const fake = await startFakeHttp({
+    guard: (req) => (authorized(req.headers) ? undefined : { status: 401, body: { message: 'Unauthorized' } }),
+    routes: {
+      'GET /api/status': () => ({ body: { version: '1.2.3', name: 'Home {{name}}' } }),
+      'GET /api/openapi.json': () => ({ body: SPEC }),
+      'GET /api/settings': () => ({ body: { title: 'Home', apiKey: UPSTREAM_SECRET } }),
+      'GET /api/items': () => ({ body: [...items.values()] }),
+      'POST /api/items': (req) => {
+        const item = { id: next++, name: String((req.body as { name?: unknown })?.name ?? 'Unnamed') };
+        items.set(item.id, item);
+        return { status: 201, body: item };
+      },
+      'GET /api/items/{itemId}': (req) => {
+        const item = items.get(Number(req.params.itemId));
+        return item ? { body: item } : { status: 404, body: { message: 'No such item' } };
+      },
+      'DELETE /api/items/{itemId}': (req) =>
+        items.delete(Number(req.params.itemId)) ? { status: 204 } : { status: 404, body: { message: 'No such item' } },
+    },
+  });
+  return { ...fake, items };
+}

package/templates/plugin/openapi-rest/test/plugin.test.ts

@@ -0,0 +1,66 @@
+import { readFileSync } from 'node:fs';
+import { checkConformance, ErrorCodes } from '@synoikia/plugin-sdk';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { create{{Pascal}}Plugin, settings } from '../src/plugin.js';
+import { CREDENTIALS } from './fake-auth.js';
+import { startFake{{Pascal}} } from './fake-upstream.js';
+import type { Fake{{Pascal}} } from './fake-upstream.js';
+
+const manifest: unknown = JSON.parse(readFileSync(new URL('../manifest.json', import.meta.url), 'utf8'));
+
+let fake: Fake{{Pascal}};
+const plugin = create{{Pascal}}Plugin();
+
+beforeAll(async () => {
+  fake = await startFake{{Pascal}}();
+});
+afterAll(async () => {
+  await plugin.shutdown?.();
+  await fake?.close();
+});
+
+const connection = () => {
+  const { username, ...secrets } = CREDENTIALS as Record<string, string>;
+  return { instanceId: '{{id}}', config: { baseUrl: fake.url, ...(username ? { username } : {}) }, secrets };
+};
+
+describe('{{name}} plugin', () => {
+  it('passes the SDK conformance checks against the fake', async () => {
+    const issues = await checkConformance({
+      manifest,
+      settings,
+      handlers: plugin,
+      init: connection(),
+      samples: [
+        { fn: 'request', args: [{ path: '/items' }], expectKey: 'GET /items' },
+        { fn: 'request', args: [{ method: 'DELETE', path: '/items/1' }], expectKey: 'DELETE /items/{itemId}' },
+      ],
+      rejects: [{ fn: 'request', args: [{ path: '/nope' }] }, { fn: 'other', args: [] }],
+    });
+    expect(issues).toEqual([]);
+  });
+
+  it('locks deletes and names the item in the confirmation', async () => {
+    await plugin.init({ ...connection(), sdkVersion: '1' });
+    const { operations } = await plugin.syncCatalog();
+    expect(operations.find((o) => o.key === 'DELETE /items/{itemId}')).toMatchObject({ locked: true });
+    expect(
+      await plugin.summarize({ key: 'DELETE /items/{itemId}', params: { path: { itemId: '1' } }, targets: [] }),
+    ).toEqual({ text: '{{name}} DELETE /items/1', confirmLiteral: 'First item' });
+  });
+
+  it('reports rejected credentials without throwing', async () => {
+    const wrong = Object.fromEntries(Object.keys(connection().secrets).map((k) => [k, 'wrong']));
+    if (!Object.keys(wrong).length) return; // nothing to reject without authentication
+    const bad = create{{Pascal}}Plugin();
+    await bad.init({ ...connection(), secrets: wrong, sdkVersion: '1' });
+    expect(await bad.testConnection()).toMatchObject({ ok: false, message: expect.stringContaining('denied') });
+    await bad.shutdown?.();
+  });
+
+  it('refuses a connection without a base URL', async () => {
+    await expect(create{{Pascal}}Plugin().init({ ...connection(), config: {}, sdkVersion: '1' })).rejects.toMatchObject({
+      code: ErrorCodes.InvalidParams,
+    });
+  });
+});

package/templates/plugin/static-rest/plugin.yaml

@@ -0,0 +1,61 @@
+# yaml-language-server: $schema=./node_modules/@synoikia/plugin-sdk/plugin-settings.schema.json
+#
+# What {{name}} tells Synoikia about its operations. With no spec to discover, every operation is
+# declared here with its own classification; rules lock and describe them on top. Core decides what is
+# allowed. Reference: docs/plugin-authoring.md.
+
+defaults:
+  confirm: instance
+  timeouts: { request: 15000, lookup: 10000 }
+
+instanceName: { op: 'GET /status', field: name, fallback: '{{name}}' }
+
+operations:
+  - key: items.list
+    group: items
+    classification: read
+    summary: List items.
+    http: { method: GET, path: /items }
+  - key: items.get
+    group: items
+    classification: read
+    summary: One item.
+    http: { method: GET, path: '/items/{itemId}' }
+    paramsSchema:
+      type: object
+      properties: { path: { type: object, properties: { itemId: { type: string } }, required: [itemId] } }
+  - key: items.create
+    group: items
+    classification: write
+    summary: Create an item.
+    http: { method: POST, path: /items }
+    paramsSchema:
+      type: object
+      properties: { body: { type: object, properties: { name: { type: string } }, required: [name] } }
+  - key: items.delete
+    group: items
+    classification: write
+    summary: Delete an item.
+    http: { method: DELETE, path: '/items/{itemId}' }
+  - key: settings.get
+    group: settings
+    classification: read
+    summary: Settings, including an integration key.
+    http: { method: GET, path: /settings }
+
+rules:
+  # Destructive or irreversible: always a human who types the confirmation literal.
+  - match: items.delete
+    locked: true
+    confirm:
+      lookup:
+        op: 'GET /items/{itemId}'
+        args: [{ itemId: { $param: /path/itemId } }]
+        field: name
+
+plugin:
+  # Path of the API under the base URL.
+  apiPath: /api
+  # Endpoint and field that report the version.
+  versionPath: /status
+  versionField: version

package/templates/plugin/static-rest/src/plugin.ts

@@ -0,0 +1,70 @@
+import {
+  compileRules,
+  definePlugin,
+  ErrorCodes,
+  HttpJsonClient,
+  isPlainObject,
+  joinApiPath,
+  parsePluginSettings,
+  PluginError,
+  requireString,
+  restLookup,
+  staticCatalog,
+  staticHttpBinding,
+  stringOr,
+} from '@synoikia/plugin-sdk';
+import type { PluginHandlers } from '@synoikia/plugin-sdk';
+import raw from '../plugin.yaml';
+import { authHeaders } from './auth.js';
+
+/**
+ * The {{name}} plugin: operations are declared in plugin.yaml, and the sandbox calls
+ * `{{namespace}}.call(operation, { path, query, body })`.
+ */
+
+const SERVICE = '{{name}}';
+
+export const settings = parsePluginSettings(raw, {
+  parse(value) {
+    const p = isPlainObject(value) ? value : {};
+    const text = (key: string) => {
+      if (typeof p[key] !== 'string') throw new Error(`plugin.yaml plugin.${key} must be a string`);
+      return p[key];
+    };
+    return { apiPath: text('apiPath'), versionPath: text('versionPath'), versionField: text('versionField') };
+  },
+});
+
+export function create{{Pascal}}Plugin(): PluginHandlers {
+  return definePlugin({
+    connect: (init) =>
+      new HttpJsonClient({
+        baseUrl: joinApiPath(requireString(init.config, 'baseUrl'), settings.plugin.apiPath),
+        service: SERVICE,
+        verifyTls: init.config.verifyTls !== false,
+        headers: authHeaders(init),
+        timeoutMs: settings.defaults.timeouts.request,
+      }),
+
+    async version(kit) {
+      const status = await kit.client().request('GET', settings.plugin.versionPath);
+      const version = isPlainObject(status) ? stringOr(status[settings.plugin.versionField]) : undefined;
+      if (!version) throw new PluginError(ErrorCodes.UpstreamError, `${SERVICE} reported no version`);
+      return version;
+    },
+
+    handlers(kit) {
+      const rules = compileRules(settings, { lookup: restLookup(kit.client) });
+      const operations = staticCatalog(rules);
+      const binding = staticHttpBinding({ namespace: '{{namespace}}', service: SERVICE, rules, client: kit.client });
+      return {
+        async syncCatalog() {
+          return { upstreamVersion: await kit.version(), operations };
+        },
+        resolveOperation: binding.resolveOperation,
+        summarize: binding.summarize,
+        invoke: binding.invoke,
+      };
+    },
+  });
+}

package/templates/plugin/static-rest/test/e2e.test.ts

@@ -0,0 +1,46 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { checkPluginContract, startPluginHarness } from '@synoikia/core/testing';
+import type { PluginHarness } from '@synoikia/core/testing';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { CREDENTIALS } from './fake-auth.js';
+import { startFake{{Pascal}}, UPSTREAM_SECRET } from './fake-upstream.js';
+import type { Fake{{Pascal}} } from './fake-upstream.js';
+
+/**
+ * The real Synoikia core running this plugin's built bundle (a permission-confined child, as in
+ * production) against the fake {{name}}, through core's plugin harness.
+ */
+
+const PLUGIN_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let h: PluginHarness;
+let fake: Fake{{Pascal}};
+
+beforeAll(async () => {
+  fake = await startFake{{Pascal}}();
+  h = await startPluginHarness({ pluginDir: PLUGIN_DIR, connection: { baseUrl: fake.url, ...CREDENTIALS } });
+}, 60_000);
+
+afterAll(async () => {
+  await h?.stop();
+  await fake?.close();
+});
+
+describe('{{name}} end to end (fake {{name}})', () => {
+  it('keeps the plugin contract', async () => {
+    expect(
+      await checkPluginContract(h, {
+        read: { key: 'items.list', code: `return await {{namespace}}.call('items.list');` },
+        write: { key: 'items.create', code: `return await {{namespace}}.call('items.create', { body: { name: 'x' } });` },
+        locked: {
+          key: 'items.delete',
+          code: `return await {{namespace}}.call('items.delete', { path: { itemId: '1' } });`,
+          confirm: 'First item',
+        },
+        secrets: { code: `return await {{namespace}}.call('settings.get');`, values: [UPSTREAM_SECRET] },
+      }),
+    ).toEqual([]);
+    expect(fake.items.has(1)).toBe(false);
+  });
+});

package/templates/plugin/static-rest/test/fake-upstream.ts

@@ -0,0 +1,39 @@
+import { startFakeHttp } from '@synoikia/core/testing';
+import type { FakeHttp } from '@synoikia/core/testing';
+import { authorized } from './fake-auth.js';
+
+/**
+ * A fake {{name}}: just enough of its API to exercise the plugin, including a response that holds a
+ * secret, so the tests prove it never reaches the sandbox. Extend it as the plugin grows.
+ */
+
+export const UPSTREAM_SECRET = 'fake-upstream-secret-123';
+
+export interface Fake{{Pascal}} extends FakeHttp {
+  items: Map<number, { id: number; name: string }>;
+}
+
+export async function startFake{{Pascal}}(): Promise<Fake{{Pascal}}> {
+  const items = new Map([[1, { id: 1, name: 'First item' }]]);
+  let next = 2;
+  const fake = await startFakeHttp({
+    guard: (req) => (authorized(req.headers) ? undefined : { status: 401, body: { message: 'Unauthorized' } }),
+    routes: {
+      'GET /api/status': () => ({ body: { version: '1.2.3', name: 'Home {{name}}' } }),
+      'GET /api/settings': () => ({ body: { title: 'Home', apiKey: UPSTREAM_SECRET } }),
+      'GET /api/items': () => ({ body: [...items.values()] }),
+      'POST /api/items': (req) => {
+        const item = { id: next++, name: String((req.body as { name?: unknown })?.name ?? 'Unnamed') };
+        items.set(item.id, item);
+        return { status: 201, body: item };
+      },
+      'GET /api/items/{itemId}': (req) => {
+        const item = items.get(Number(req.params.itemId));
+        return item ? { body: item } : { status: 404, body: { message: 'No such item' } };
+      },
+      'DELETE /api/items/{itemId}': (req) =>
+        items.delete(Number(req.params.itemId)) ? { status: 204 } : { status: 404, body: { message: 'No such item' } },
+    },
+  });
+  return { ...fake, items };
+}

package/templates/plugin/static-rest/test/plugin.test.ts

@@ -0,0 +1,67 @@
+import { readFileSync } from 'node:fs';
+import { checkConformance, ErrorCodes } from '@synoikia/plugin-sdk';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { create{{Pascal}}Plugin, settings } from '../src/plugin.js';
+import { CREDENTIALS } from './fake-auth.js';
+import { startFake{{Pascal}} } from './fake-upstream.js';
+import type { Fake{{Pascal}} } from './fake-upstream.js';
+
+const manifest: unknown = JSON.parse(readFileSync(new URL('../manifest.json', import.meta.url), 'utf8'));
+
+let fake: Fake{{Pascal}};
+const plugin = create{{Pascal}}Plugin();
+
+beforeAll(async () => {
+  fake = await startFake{{Pascal}}();
+});
+afterAll(async () => {
+  await plugin.shutdown?.();
+  await fake?.close();
+});
+
+const connection = () => {
+  const { username, ...secrets } = CREDENTIALS as Record<string, string>;
+  return { instanceId: '{{id}}', config: { baseUrl: fake.url, ...(username ? { username } : {}) }, secrets };
+};
+
+describe('{{name}} plugin', () => {
+  it('passes the SDK conformance checks against the fake', async () => {
+    const issues = await checkConformance({
+      manifest,
+      settings,
+      handlers: plugin,
+      init: connection(),
+      samples: [
+        { fn: 'call', args: ['items.list'], expectKey: 'items.list' },
+        { fn: 'call', args: ['items.delete', { path: { itemId: '1' } }], expectKey: 'items.delete' },
+      ],
+      rejects: [{ fn: 'call', args: ['items.nope'] }, { fn: 'other', args: [] }],
+    });
+    expect(issues).toEqual([]);
+  });
+
+  it('locks deletes and names the item in the confirmation', async () => {
+    await plugin.init({ ...connection(), sdkVersion: '1' });
+    const { operations } = await plugin.syncCatalog();
+    expect(operations.find((o) => o.key === 'items.delete')).toMatchObject({ locked: true });
+    expect(await plugin.summarize({ key: 'items.delete', params: { path: { itemId: '1' } }, targets: [] })).toEqual({
+      text: '{{name}} items.delete: DELETE /items/1',
+      confirmLiteral: 'First item',
+    });
+  });
+
+  it('reports rejected credentials without throwing', async () => {
+    const wrong = Object.fromEntries(Object.keys(connection().secrets).map((k) => [k, 'wrong']));
+    if (!Object.keys(wrong).length) return; // nothing to reject without authentication
+    const bad = create{{Pascal}}Plugin();
+    await bad.init({ ...connection(), secrets: wrong, sdkVersion: '1' });
+    expect(await bad.testConnection()).toMatchObject({ ok: false, message: expect.stringContaining('denied') });
+    await bad.shutdown?.();
+  });
+
+  it('refuses a connection without a base URL', async () => {
+    await expect(create{{Pascal}}Plugin().init({ ...connection(), config: {}, sdkVersion: '1' })).rejects.toMatchObject({
+      code: ErrorCodes.InvalidParams,
+    });
+  });
+});

package/templates/plugin/websocket-rpc/plugin.yaml

@@ -0,0 +1,45 @@
+# yaml-language-server: $schema=./node_modules/@synoikia/plugin-sdk/plugin-settings.schema.json
+#
+# What {{name}} tells Synoikia about its JSON-RPC methods. Each method is declared here with its own
+# classification; rules lock and describe them on top. If the upstream can list its methods, build the
+# catalog from that instead and keep only the rules. Reference: docs/plugin-authoring.md.
+
+defaults:
+  confirm: instance
+  timeouts: { request: 15000, lookup: 10000 }
+
+# Lookups call a read method with these params.
+instanceName: { op: system.info, field: name, fallback: '{{name}}' }
+
+operations:
+  - { key: system.info, kind: method, group: system, classification: read, summary: Name and version. }
+  - { key: items.list, kind: method, group: items, classification: read, summary: List items. }
+  - key: items.get
+    kind: method
+    group: items
+    classification: read
+    summary: One item by id.
+    paramsSchema: { type: object, properties: { id: { type: number } }, required: [id] }
+  - key: items.create
+    kind: method
+    group: items
+    classification: write
+    summary: Create an item.
+    paramsSchema: { type: object, properties: { name: { type: string } }, required: [name] }
+  - key: items.delete
+    kind: method
+    group: items
+    classification: write
+    summary: Delete an item by id.
+    paramsSchema: { type: object, properties: { id: { type: number } }, required: [id] }
+  - { key: settings.get, kind: method, group: settings, classification: read, summary: 'Settings, including an integration key.' }
+
+rules:
+  - match: items.delete
+    locked: true
+    confirm:
+      lookup: { op: items.get, args: [{ id: { $param: /id } }], field: name }
+
+plugin:
+  # WebSocket path under the base URL.
+  path: /rpc