@tetherto/mdk-app-runtime 0.0.0 → 0.12.1

package/lib/client.js

@@ -0,0 +1,297 @@
+'use strict'
+
+const crypto = require('crypto')
+const { Readable, pipeline } = require('stream')
+const debug = require('debug')('mdk:app:client')
+const HyperswarmRPC = require('@hyperswarm/rpc')
+const DHT = require('hyperdht')
+const protocol = require('./protocol')
+
+const { METHODS, STREAM_MESSAGES: MSG, ERR } = protocol
+
+function _unavailable (routeId, cause) {
+  const err = new Error(`${ERR.RUNTIME_UNAVAILABLE}: ${routeId}`)
+  err.statusCode = 502
+  err.code = ERR.RUNTIME_UNAVAILABLE
+  if (cause) err.cause = cause
+  return err
+}
+
+function _timeout (routeId, timeoutMs) {
+  const err = new Error(`${ERR.RUNTIME_TIMEOUT}: ${routeId} (${timeoutMs}ms)`)
+  err.statusCode = 504
+  err.code = ERR.RUNTIME_TIMEOUT
+  return err
+}
+
+function _aborted (routeId) {
+  const err = new Error(`${ERR.REQUEST_ABORTED}: ${routeId}`)
+  err.statusCode = 499
+  err.code = ERR.REQUEST_ABORTED
+  return err
+}
+
+function _overflow (routeId, limit) {
+  const err = new Error(`${ERR.STREAM_OVERFLOW}: ${routeId} buffered more than ${limit} bytes`)
+  err.statusCode = 502
+  err.code = ERR.STREAM_OVERFLOW
+  return err
+}
+
+function _versionError (got) {
+  return protocol.protocolError(502, ERR.PROTOCOL_VERSION, `expected ${protocol.PROTOCOL_VERSION}, got ${got}`)
+}
+
+const _buf = (v) => Buffer.isBuffer(v) ? v : Buffer.from(String(v).trim(), 'hex')
+
+// How long an idle connection to a runtime is kept for the next call.
+const POOL_LINGER_MS = 10000
+
+// Most body bytes one stream may hold unread before it is torn down (see
+// protocol.js, "Backpressure").
+const MAX_STREAM_BUFFER_BYTES = 16 * 1024 * 1024
+
+/**
+ * Caller side of app runtimes (see runtime.js / protocol.js). One transport and
+ * one key pair for every runtime it calls, so they all allow-list the same
+ * `publicKey`: derived from `seed` (hex or Buffer; random without one), or the
+ * injected `rpc`'s own. An injected `rpc` / `dht` is left alone by close().
+ * `runtimeKey` is a runtime's RPC public key (hex or Buffer).
+ *
+ * Unary calls share one connection per runtime, held open while any call on it
+ * is in flight and for `poolLingerMs` after the last one. (@hyperswarm/rpc's own
+ * pooled `request()` counts a call as finished as soon as it is sent, so its
+ * linger timer tears the connection down under a call slower than that.)
+ *
+ * A stream whose reader falls more than `maxStreamBufferBytes` (default 16 MiB)
+ * behind the runtime is destroyed with ERR_APP_STREAM_OVERFLOW and its channel
+ * closed, so a slow consumer cannot grow this process's memory without bound.
+ */
+function createRuntimeClient (opts = {}) {
+  const keyPair = opts.rpc ? opts.rpc.defaultKeyPair : DHT.keyPair(opts.seed ? _buf(opts.seed) : crypto.randomBytes(32))
+  const poolLingerMs = opts.poolLingerMs ?? POOL_LINGER_MS
+  const maxStreamBufferBytes = opts.maxStreamBufferBytes ?? MAX_STREAM_BUFFER_BYTES
+  if (!(maxStreamBufferBytes > 0)) throw new Error('ERR_APP_RUNTIME_CLIENT_OPTIONS_INVALID: maxStreamBufferBytes must be a positive number')
+  const pool = new Map()
+  let rpc = null
+
+  function assertConnected () {
+    if (!rpc) throw new Error('ERR_APP_RUNTIME_CLIENT_NOT_CONNECTED')
+  }
+
+  async function connect () {
+    if (!rpc) rpc = opts.rpc || new HyperswarmRPC({ keyPair, dht: opts.dht, bootstrap: opts.bootstrap, poolLinger: poolLingerMs })
+  }
+
+  function acquire (key) {
+    const id = key.toString('hex')
+    let ref = pool.get(id)
+    if (!ref) {
+      const conn = rpc.connect(key)
+      ref = { id, conn, active: 0, timer: null }
+      const entry = ref
+      conn.on('close', () => {
+        clearTimeout(entry.timer)
+        if (pool.get(id) === entry) pool.delete(id)
+      })
+      pool.set(id, ref)
+    }
+    clearTimeout(ref.timer)
+    ref.active++
+    return ref
+  }
+
+  function release (ref) {
+    if (--ref.active > 0) return
+    ref.timer = setTimeout(() => {
+      if (pool.get(ref.id) === ref) pool.delete(ref.id)
+      ref.conn.destroy()
+    }, poolLingerMs)
+    ref.timer.unref()
+  }
+
+  async function close () {
+    for (const ref of pool.values()) {
+      clearTimeout(ref.timer)
+      ref.conn.destroy()
+    }
+    pool.clear()
+    const r = rpc
+    rpc = null
+    if (r && !opts.rpc) await r.destroy()
+  }
+
+  // `signal` aborts a call whose caller has gone: while the connection is still
+  // opening and carries only this call, it is dropped, so the request never
+  // reaches the runtime.
+  async function invoke (runtimeKey, routeId, req, { identity, timeoutMs, signal } = {}) {
+    assertConnected()
+    if (signal && signal.aborted) throw _aborted(routeId)
+    let resBuf
+    const ref = acquire(_buf(runtimeKey))
+    const onAbort = () => {
+      if (ref.active === 1 && !(ref.conn.rpc && ref.conn.rpc.opened)) ref.conn.destroy()
+    }
+    if (signal) signal.addEventListener('abort', onAbort, { once: true })
+    try {
+      const options = timeoutMs > 0 ? { timeout: timeoutMs } : undefined
+      resBuf = await ref.conn.request(METHODS.INVOKE, protocol.encode(protocol.buildRequest(routeId, req, identity)), options)
+    } catch (cause) {
+      debug('transport failure for %s: %s', routeId, cause && cause.message)
+      if (signal && signal.aborted) throw _aborted(routeId)
+      if (cause && cause.code === 'TIMEOUT_EXCEEDED') throw _timeout(routeId, timeoutMs)
+      throw _unavailable(routeId, cause)
+    } finally {
+      if (signal) signal.removeEventListener('abort', onAbort)
+      release(ref)
+    }
+
+    let res
+    try {
+      res = protocol.decode(resBuf)
+    } catch (cause) {
+      throw _unavailable(routeId, cause)
+    }
+    if (!res || res.v !== protocol.PROTOCOL_VERSION) throw _versionError(res && res.v)
+    if (!res.ok) throw protocol.fromErrorResponse(res)
+    return res.result
+  }
+
+  // Streams ride a protomux channel on a dedicated connection (see protocol.js).
+  // `timeoutMs` bounds the wait for the response head; once the head arrived
+  // the body is bounded only by the stream's own lifetime. `signal` closes the
+  // channel while the head is still pending; after it, the caller destroys the
+  // returned stream. Unread body bytes are capped at maxStreamBufferBytes.
+  async function stream (runtimeKey, routeId, req, { identity, timeoutMs, signal } = {}) {
+    assertConnected()
+    if (signal && signal.aborted) throw _aborted(routeId)
+
+    return new Promise((resolve, reject) => {
+      const conn = rpc.connect(_buf(runtimeKey))
+      let channel = null
+      let settled = false
+      let ended = false
+      let readable = null
+      let timer = null
+
+      const onAbort = () => fail(_aborted(routeId))
+      const cleanup = () => {
+        clearTimeout(timer)
+        if (signal) signal.removeEventListener('abort', onAbort)
+        if (channel && !channel.closed) channel.close()
+        conn.destroy()
+      }
+
+      const fail = (err) => {
+        if (!settled) {
+          settled = true
+          cleanup()
+          reject(err)
+        } else if (readable && !readable.destroyed) {
+          readable.destroy(err)
+        }
+      }
+
+      const onclose = () => {
+        if (ended) return
+        fail(_unavailable(routeId))
+      }
+      conn.on('close', onclose)
+
+      if (timeoutMs > 0) {
+        timer = setTimeout(() => {
+          debug('no stream head for %s within %dms', routeId, timeoutMs)
+          fail(_timeout(routeId, timeoutMs))
+        }, timeoutMs)
+      }
+      if (signal) signal.addEventListener('abort', onAbort, { once: true })
+
+      const mux = conn.mux
+      if (!mux) return fail(_unavailable(routeId))
+
+      channel = mux.createChannel({
+        protocol: METHODS.STREAM,
+        messages: [
+          {},
+          {
+            onmessage: (buf) => {
+              if (settled) return
+              let head
+              try {
+                head = protocol.decode(buf)
+              } catch (cause) {
+                return fail(_unavailable(routeId, cause))
+              }
+              clearTimeout(timer)
+              if (signal) signal.removeEventListener('abort', onAbort)
+              readable = new Readable({
+                read () {},
+                destroy (err, cb) { cleanup(); cb(err) }
+              })
+              settled = true
+              resolve({ statusCode: head.statusCode, headers: head.headers || {}, stream: readable })
+            }
+          },
+          {
+            onmessage: (buf) => {
+              if (!readable || readable.destroyed) return
+              readable.push(Buffer.from(buf))
+              // The protocol has no flow control (see protocol.js), so a reader
+              // this far behind ends the stream; destroy() closes the channel
+              // and the connection, which stops the runtime's handler.
+              if (readable.readableLength > maxStreamBufferBytes) {
+                debug('stream %s overflowed %d buffered bytes', routeId, maxStreamBufferBytes)
+                readable.destroy(_overflow(routeId, maxStreamBufferBytes))
+              }
+            }
+          },
+          {
+            onmessage: () => {
+              // END with no HEAD before it: nothing to resolve with.
+              if (!settled) return fail(_unavailable(routeId))
+              ended = true
+              if (readable && !readable.destroyed) readable.push(null)
+              cleanup()
+            }
+          },
+          {
+            onmessage: (buf) => {
+              let err
+              try {
+                const res = protocol.decode(buf)
+                err = res && res.v === protocol.PROTOCOL_VERSION ? protocol.fromErrorResponse(res) : _versionError(res && res.v)
+              } catch (cause) {
+                err = _unavailable(routeId, cause)
+              }
+              ended = true
+              fail(err)
+            }
+          }
+        ],
+        onclose
+      })
+      if (!channel) return fail(_unavailable(routeId))
+
+      channel.open()
+      channel.messages[MSG.REQUEST].send(protocol.encode(protocol.buildRequest(routeId, req, identity)))
+    })
+  }
+
+  return { publicKey: Buffer.from(keyPair.publicKey), connect, invoke, stream, close }
+}
+
+// Writes the head of a stream() result, pipes its body and cleans up if either
+// side goes away. Resolves (never rejects) once the response finished or was
+// torn down.
+function pipeToResponse (streamResult, raw) {
+  raw.writeHead(streamResult.statusCode, streamResult.headers)
+  if (typeof raw.flushHeaders === 'function') raw.flushHeaders()
+  return new Promise((resolve) => {
+    pipeline(streamResult.stream, raw, (err) => {
+      if (err) debug('stream aborted: %s', err.message)
+      resolve()
+    })
+  })
+}
+
+module.exports = { createRuntimeClient, pipeToResponse, MAX_STREAM_BUFFER_BYTES }

package/lib/manifest.js

@@ -0,0 +1,75 @@
+'use strict'
+
+const fs = require('fs')
+const path = require('path')
+const YAML = require('yaml')
+
+const MANIFEST_FILE = 'mdk-app.yaml'
+const PLUGIN_FILE = 'mdk-plugin.json'
+
+const ID_RE = /^[a-z][a-z0-9]*(\.[a-z0-9][a-z0-9-]*)+$/
+const SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$/
+
+const isMapping = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+const isStrings = (v) => Array.isArray(v) && v.every(s => typeof s === 'string')
+
+// Shape only: the permission vocabulary belongs to the Kernel, which enforces
+// it. Other keys pass through untouched.
+function validateAppManifest (obj, label = MANIFEST_FILE) {
+  const fail = (reason) => { throw new Error(`ERR_APP_MANIFEST_INVALID: ${label}: ${reason}`) }
+
+  if (!isMapping(obj)) fail('must be a mapping')
+  if (typeof obj.id !== 'string' || !ID_RE.test(obj.id)) fail(`"id" must be reverse-DNS style (e.g. io.tether.example), got ${JSON.stringify(obj.id)}`)
+  if (typeof obj.version !== 'string' || !SEMVER_RE.test(obj.version)) fail(`"version" must be a semver string, got ${JSON.stringify(obj.version)}`)
+  if (typeof obj.displayName !== 'string' || !obj.displayName.trim()) fail('"displayName" must be a non-empty string')
+  if (obj.permissions != null) {
+    if (!Array.isArray(obj.permissions)) fail('"permissions" must be an array')
+    obj.permissions.forEach((rule, i) => {
+      if (!isMapping(rule) || !isStrings(rule.resources) || !isStrings(rule.verbs) || (rule.resourceNames != null && !isStrings(rule.resourceNames))) {
+        fail(`permissions[${i}] must be { resources: string[], verbs: string[], resourceNames?: string[] }`)
+      }
+    })
+  }
+  if (obj.config != null && !isMapping(obj.config)) fail('"config" must be a mapping')
+  if (obj.main != null && (typeof obj.main !== 'string' || !obj.main.trim())) fail('"main" must be a non-empty "<file>[#export]" string')
+
+  return { ...obj, permissions: obj.permissions || [], config: obj.config || {} }
+}
+
+function loadAppManifest (appDir) {
+  let dir
+  try {
+    dir = fs.realpathSync(appDir)
+  } catch {
+    throw new Error(`ERR_APP_MANIFEST_MISSING: ${appDir}`)
+  }
+
+  const file = path.join(dir, MANIFEST_FILE)
+  let text
+  try {
+    text = fs.readFileSync(file, 'utf8')
+  } catch (err) {
+    if (err.code === 'ENOENT' || err.code === 'ENOTDIR') throw new Error(`ERR_APP_MANIFEST_MISSING: ${dir}`)
+    throw new Error(`ERR_APP_MANIFEST_INVALID: ${file}: cannot read: ${err.message}`)
+  }
+
+  let parsed
+  try {
+    parsed = YAML.parse(text)
+  } catch (err) {
+    throw new Error(`ERR_APP_MANIFEST_INVALID: ${file}: not valid YAML: ${err.message}`)
+  }
+
+  return { manifest: validateAppManifest(parsed, file), dir }
+}
+
+// The directory of an app's route table: <appDir>/plugin if it holds a
+// mdk-plugin.json, else <appDir> itself.
+function resolvePluginDir (appDir) {
+  for (const dir of [path.join(appDir, 'plugin'), appDir]) {
+    if (fs.existsSync(path.join(dir, PLUGIN_FILE))) return path.resolve(dir)
+  }
+  throw new Error(`ERR_PLUGIN_MANIFEST_MISSING: ${appDir}`)
+}
+
+module.exports = { MANIFEST_FILE, validateAppManifest, loadAppManifest, resolvePluginDir }

package/lib/plugin-loader.js

@@ -0,0 +1,216 @@
+'use strict'
+
+const path = require('path')
+// Deep import: index.js would pull the whole worker runtime (hyperswarm) into
+// the gateway process, which also loads route tables through this file, for a
+// loader that only needs fs/path/module.
+const { createModuleContext } = require('@tetherto/mdk-worker/lib/module-context')
+
+const VALID_METHODS = new Set(['GET', 'POST', 'PUT', 'DELETE', 'PATCH'])
+
+function _resolveHttpFields (route) {
+  const http = route.http
+  if (!http) return route
+
+  const out = { ...route }
+  if (http.method) out.method = http.method
+  if (http.path) out.path = http.path
+
+  if (!out.schema) {
+    const schema = http.parameters ? _parametersToFastifySchema(http.parameters) : {}
+    const body = _requestBodyToFastifySchema(http.requestBody)
+    if (body) schema.body = body
+    if (Object.keys(schema).length) out.schema = schema
+  }
+
+  return out
+}
+
+// The same application/json schema MCP validates tool args against, so a route
+// accepts the same bodies over HTTP and over MCP. An optional body may be
+// omitted entirely; when one is sent it must match.
+function _requestBodyToFastifySchema (requestBody) {
+  const schema = requestBody?.content?.['application/json']?.schema
+  if (!schema || typeof schema !== 'object') return null
+  if (requestBody.required === true) return schema
+  return { anyOf: [schema, { type: 'null' }] }
+}
+
+function _parametersToFastifySchema (parameters) {
+  const schema = {}
+  const groups = { query: 'querystring', path: 'params', header: 'headers' }
+
+  for (const param of parameters) {
+    const target = groups[param.in]
+    if (!target) continue
+
+    if (!schema[target]) {
+      schema[target] = { type: 'object', properties: {} }
+    }
+
+    schema[target].properties[param.name] = param.schema || {}
+
+    if (param.required) {
+      if (!schema[target].required) schema[target].required = []
+      schema[target].required.push(param.name)
+    }
+  }
+
+  return schema
+}
+
+function _normalizePath (routePath) {
+  return routePath.replace(/\{([^{}]+)\}/g, ':$1')
+}
+
+function _validateManifest (manifest, pluginDir) {
+  if (!manifest || typeof manifest !== 'object') {
+    throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: must be a JSON object`)
+  }
+
+  for (const field of ['name', 'version']) {
+    if (typeof manifest[field] !== 'string' || !manifest[field]) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: missing required field "${field}"`)
+    }
+  }
+
+  if (!Array.isArray(manifest.routes) || manifest.routes.length === 0) {
+    throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: "routes" must be a non-empty array`)
+  }
+
+  const seenIds = new Set()
+  const seenRoutes = new Set()
+
+  for (const route of manifest.routes) {
+    if (typeof route.id !== 'string' || !route.id) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route missing required field "id"`)
+    }
+
+    if (typeof route.handler !== 'string' || !route.handler) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route missing required field "handler"`)
+    }
+
+    const method = (route.http?.method || route.method || '').toUpperCase()
+    if (!method) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route missing required field "method"`)
+    }
+    if (!VALID_METHODS.has(method)) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route "${route.id}" has invalid method "${method}"`)
+    }
+
+    const routePath = route.http?.path || route.path
+    if (typeof routePath !== 'string' || !routePath) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route missing required field "path"`)
+    }
+    // Mounted under a prefix, "health" would serve /apps/<name>health.
+    if (!routePath.startsWith('/')) {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route "${route.id}" path "${routePath}" must start with "/"`)
+    }
+
+    if (route.auth !== undefined && typeof route.auth !== 'boolean') {
+      throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: route "${route.id}" field "auth" must be a boolean`)
+    }
+
+    if (seenIds.has(route.id)) {
+      throw new Error(`ERR_PLUGIN_ROUTE_DUPLICATE_ID: ${pluginDir}: duplicate route id "${route.id}"`)
+    }
+    seenIds.add(route.id)
+
+    const key = `${method} ${_normalizePath(routePath)}`
+    if (seenRoutes.has(key)) {
+      throw new Error(`ERR_PLUGIN_ROUTE_DUPLICATE_PATH: ${pluginDir}: route "${route.id}" repeats ${key}`)
+    }
+    seenRoutes.add(key)
+  }
+}
+
+// A manifest names handlers relative to its own dir; one that resolves outside
+// it (../, an absolute path) would load code the operator never pointed at.
+function _confinedHandlerPath (pluginDir, handlerFile, what) {
+  const root = path.resolve(pluginDir)
+  const handlerPath = path.resolve(root, handlerFile)
+  const rel = path.relative(root, handlerPath)
+  if (!rel || rel === '..' || rel.startsWith('..' + path.sep) || path.isAbsolute(rel) || path.isAbsolute(handlerFile)) {
+    throw new Error(`ERR_PLUGIN_HANDLER_OUTSIDE_PLUGIN: ${pluginDir}: ${what} must be inside the plugin dir`)
+  }
+  return handlerPath
+}
+
+function _resolvable (file) {
+  try {
+    require.resolve(file)
+    return true
+  } catch {
+    return false
+  }
+}
+
+// `<file>[#export]` relative to the plugin dir, loaded through the plugin's
+// module registry. A file that exists but cannot load (a missing dependency, a
+// throw at load time) is LOAD_FAILED with the real cause, not NOT_FOUND.
+function _loadExport (moduleContext, pluginDir, spec, what) {
+  const [file, namedExport] = spec.split('#')
+  const filePath = _confinedHandlerPath(pluginDir, file, `${what} "${file}"`)
+  let mod
+  try {
+    mod = moduleContext.load(filePath)
+  } catch (err) {
+    if (err.code === 'MODULE_NOT_FOUND' && !_resolvable(filePath)) {
+      throw new Error(`ERR_PLUGIN_HANDLER_NOT_FOUND: ${pluginDir}: ${what} "${spec}"`)
+    }
+    throw new Error(`ERR_PLUGIN_HANDLER_LOAD_FAILED: ${pluginDir}: ${what} "${spec}": ${err.message}`, { cause: err })
+  }
+  return namedExport ? mod[namedExport] : mod
+}
+
+// With `handlers: false` only the manifest is read: no handler file is required.
+function loadPlugin (pluginDir, context, { handlers = true } = {}) {
+  const manifestPath = path.join(pluginDir, 'mdk-plugin.json')
+
+  let manifest
+  try {
+    manifest = require(manifestPath)
+  } catch (err) {
+    if (err.code === 'MODULE_NOT_FOUND') {
+      throw new Error(`ERR_PLUGIN_MANIFEST_MISSING: ${pluginDir}`)
+    }
+    throw new Error(`ERR_PLUGIN_MANIFEST_INVALID: ${pluginDir}: ${err.message}`)
+  }
+
+  _validateManifest(manifest, pluginDir)
+
+  // One private module registry per plugin: handler files and everything they
+  // require in-package (their lib/client.js, say) load fresh for this plugin,
+  // and '@tetherto/mdk-gateway/plugin' resolves to its own frozen context.
+  const moduleContext = createModuleContext({
+    dir: pluginDir,
+    ambient: context ? { '@tetherto/mdk-gateway/plugin': context } : {},
+    label: `[mdk-gateway-plugin:${manifest.name}]`
+  })
+
+  const routes = manifest.routes.map(route => {
+    const resolved = _resolveHttpFields(route)
+    if (!handlers) return { ...resolved, method: (resolved.method || '').toUpperCase(), path: _normalizePath(resolved.path) }
+
+    const handler = _loadExport(moduleContext, pluginDir, resolved.handler, `route "${resolved.id}" handler`)
+
+    if (typeof handler !== 'function') {
+      throw new Error(`ERR_PLUGIN_HANDLER_NOT_FUNCTION: ${pluginDir}: route "${resolved.id}" must export a function`)
+    }
+
+    return {
+      ...resolved,
+      method: (resolved.method || '').toUpperCase(),
+      path: _normalizePath(resolved.path),
+      _handler: handler
+    }
+  })
+
+  // Loads another `<file>[#export]` of the plugin (an app's `main`) in the same
+  // registry, so it shares module state and the ambient context with the handlers.
+  const load = (spec) => _loadExport(moduleContext, pluginDir, spec, 'module')
+
+  return { manifest, routes, load }
+}
+
+module.exports = { loadPlugin, validateManifest: _validateManifest }