arcway 0.1.26 → 0.1.28

package/server/config/modules/secrets.js

@@ -0,0 +1,145 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+  deriveInfraSecrets,
+  encodeMasterSecret,
+  normalizeMasterSecret,
+  validateVaultKey,
+} from '../../lib/vault/secrets.js';
+
+const DEFAULT_KEY_FILE = '.build/arcway-master-secret.key';
+
+const EXPLICIT_ENV = Object.freeze({
+  session: 'SESSION_SECRET',
+  'plugin-vault': 'PLUGIN_VAULT_KEY',
+  'mcp-api': 'MCP_API_KEY',
+  'pty-api': 'PTY_API_KEY',
+  'pty-server-api': 'PTY_SERVER_API_KEY',
+});
+
+function isProduction(mode) {
+  return mode === 'production';
+}
+
+function readKeyFile(filePath) {
+  try {
+    const stat = fs.statSync(filePath);
+    if ((stat.mode & 0o077) !== 0) {
+      throw new Error('Arcway master secret keyfile permissions must be 0600');
+    }
+    return fs.readFileSync(filePath, 'utf8').trim();
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function createDevKeyFile(filePath) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const encoded = encodeMasterSecret();
+
+  try {
+    const fd = fs.openSync(
+      filePath,
+      fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY,
+      0o600,
+    );
+    try {
+      fs.writeFileSync(fd, `${encoded}\n`, 'utf8');
+    } finally {
+      fs.closeSync(fd);
+    }
+    return encoded;
+  } catch (error) {
+    if (error.code === 'EEXIST') return readKeyFile(filePath);
+    throw error;
+  }
+}
+
+function loadMasterSecret(rawSecrets, { rootDir, mode, env }) {
+  const configured = rawSecrets.master ?? env.ARCWAY_MASTER_SECRET;
+  if (configured) return { value: configured, source: 'config' };
+
+  if (isProduction(mode)) {
+    throw new Error(
+      'ARCWAY_MASTER_SECRET is required when arcway.config secrets are enabled in production',
+    );
+  }
+
+  const keyFile = path.resolve(rootDir, rawSecrets.keyFile ?? DEFAULT_KEY_FILE);
+  const existing = readKeyFile(keyFile);
+  if (existing) return { value: existing, source: 'keyfile', keyFile };
+
+  return { value: createDevKeyFile(keyFile), source: 'generated-keyfile', keyFile };
+}
+
+function explicitValue(name, rawSecrets, env) {
+  const explicit = rawSecrets.explicit?.[name];
+  if (explicit !== undefined && explicit !== null && explicit !== '') return explicit;
+
+  const envName = EXPLICIT_ENV[name];
+  const fromEnv = envName ? env[envName] : undefined;
+  return fromEnv || undefined;
+}
+
+function validateExplicit(name, value) {
+  if (name === 'plugin-vault') return validateVaultKey(value);
+  return String(value);
+}
+
+function resolve(config, { rootDir, mode } = {}) {
+  if (!config.secrets) return config;
+
+  const env = config.secrets.env ?? process.env;
+  const rawSecrets = config.secrets;
+  const master = loadMasterSecret(rawSecrets, { rootDir, mode, env });
+  normalizeMasterSecret(master.value);
+
+  const derived = deriveInfraSecrets(master.value);
+  const values = { ...derived };
+  const explicit = {};
+  const previousValues = {};
+
+  const previousMaster = rawSecrets.previous ?? env.ARCWAY_MASTER_SECRET_PREVIOUS;
+  if (previousMaster) {
+    normalizeMasterSecret(previousMaster, 'Previous Arcway master secret');
+    Object.assign(previousValues, deriveInfraSecrets(previousMaster));
+  }
+
+  for (const name of Object.keys(EXPLICIT_ENV)) {
+    const value = explicitValue(name, rawSecrets, env);
+    if (!value) continue;
+
+    explicit[name] = validateExplicit(name, value);
+    values[name] = explicit[name];
+    if (derived[name] !== explicit[name]) {
+      previousValues[name] = explicit[name];
+    }
+  }
+
+  const vapidPublic = rawSecrets.explicit?.vapidPublic ?? env.VAPID_PUBLIC_KEY;
+  const vapidPrivate = rawSecrets.explicit?.vapidPrivate ?? env.VAPID_PRIVATE_KEY;
+  if (vapidPublic || vapidPrivate) {
+    if (!vapidPublic || !vapidPrivate) {
+      throw new Error('VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY must be provided together');
+    }
+    explicit.vapid = { publicKey: String(vapidPublic), privateKey: String(vapidPrivate) };
+    values.vapid = explicit.vapid;
+    previousValues.vapid = explicit.vapid;
+  }
+
+  return {
+    ...config,
+    secrets: {
+      enabled: true,
+      keyFile: master.keyFile,
+      source: master.source,
+      values,
+      derived,
+      explicit,
+      previousValues,
+    },
+  };
+}
+
+export default resolve;

package/server/config/modules/server.js

@@ -1,3 +1,5 @@
+import { normalizeDurationMs, normalizeDurationSeconds } from '../duration.js';
+
 const DEFAULTS = {
   host: '0.0.0.0',
   port: 3000,
@@ -19,11 +21,21 @@ function resolveCors(config, mode) {
   if (config === false) return void 0;
   if (config === void 0 && mode === 'production') return void 0;
   const userConfig = typeof config === 'object' ? config : {};
-  return { ...DEFAULT_CORS, ...userConfig };
+  const resolved = { ...DEFAULT_CORS, ...userConfig };
+  if (resolved.maxAge !== undefined) {
+    resolved.maxAge = normalizeDurationSeconds(resolved.maxAge, 'server.cors.maxAge');
+  }
+  return resolved;
 }
 
 function resolve(config, { mode } = {}) {
   const server = { ...DEFAULTS, ...config.server };
+  if (server.shutdownTimeoutMs !== undefined) {
+    server.shutdownTimeoutMs = normalizeDurationMs(
+      server.shutdownTimeoutMs,
+      'server.shutdownTimeoutMs',
+    );
+  }
   server.cors = resolveCors(server.cors, mode);
   return { ...config, server };
 }

package/server/config/modules/session.js

@@ -2,7 +2,11 @@ import { resolveSessionConfig } from '../../session/index.js';
 
 function resolve(config, { mode } = {}) {
   if (!config.session) return config;
-  const session = resolveSessionConfig(config.session, mode);
+  const sessionInput = {
+    ...config.session,
+    password: config.session.password || config.secrets?.values?.session,
+  };
+  const session = resolveSessionConfig(sessionInput, mode);
   return { ...config, session };
 }
 

package/server/config/modules/websocket.js

@@ -1,3 +1,5 @@
+import { normalizeDurationMs } from '../duration.js';
+
 const DEFAULTS = {
   path: '/ws',
   pingIntervalMs: 30000,
@@ -8,6 +10,12 @@ const VALID_DRIVERS = new Set(['memory', 'redis']);
 
 function resolve(config) {
   const websocket = { ...DEFAULTS, ...config.websocket };
+  if (websocket.pingIntervalMs !== undefined) {
+    websocket.pingIntervalMs = normalizeDurationMs(
+      websocket.pingIntervalMs,
+      'websocket.pingIntervalMs',
+    );
+  }
   if (!VALID_DRIVERS.has(websocket.driver)) {
     throw new Error(
       `Invalid config: websocket.driver="${websocket.driver}" must be one of: ${[...VALID_DRIVERS].join(', ')}`,

package/server/context.js

@@ -1,3 +1,6 @@
+import * as vault from './lib/vault/index.js';
+import { wsBroadcastToPath, wsSendToSocket } from './ws/registry.js';
+
 function trackDb(db) {
   if (!db || typeof db !== 'function' && typeof db !== 'object') return { db, stats: { queries: 0, durationMs: 0 } };
   const stats = { queries: 0, durationMs: 0 };
@@ -58,8 +61,60 @@ function wrapBuilder(builder, stats) {
   return builder;
 }
 
+function buildErrResponse(input, status = 400) {
+  if (typeof input === 'string') {
+    return { status, error: { message: input } };
+  }
+  if (input instanceof Error) {
+    return { status, error: { message: input.message } };
+  }
+  if (input && typeof input === 'object') {
+    const { status: explicitStatus, ...error } = input;
+    return { status: explicitStatus ?? status, error };
+  }
+  return { status, error: { message: 'An error occurred' } };
+}
+
+function normalizeEvent(event) {
+  if (event === undefined) return undefined;
+  return {
+    name: event?.name ?? null,
+    payload: Object.prototype.hasOwnProperty.call(event || {}, 'payload')
+      ? (event.payload ?? null)
+      : null,
+  };
+}
+
+function normalizeMeta(meta) {
+  return {
+    builtAt: meta?.builtAt ?? null,
+    version: meta?.version ?? null,
+    buildNumber: meta?.buildNumber ?? null,
+    branch: meta?.branch ?? null,
+    tag: meta?.tag ?? null,
+    dirty: meta?.dirty ?? null,
+    environment: meta?.environment ?? process.env.NODE_ENV ?? 'development',
+    nodeVersion: meta?.nodeVersion ?? process.version,
+    shortSha: meta?.shortSha ?? null,
+    sha: meta?.sha ?? null,
+    packageVersion: meta?.packageVersion ?? null,
+  };
+}
+
 function buildContext(appContext, extras) {
   const tracked = trackDb(appContext.db);
+  const normalizedExtras = { ...extras };
+  if (Object.prototype.hasOwnProperty.call(normalizedExtras, 'event')) {
+    normalizedExtras.event = normalizeEvent(normalizedExtras.event);
+  }
+  const req = normalizedExtras.req;
+  const ws =
+    req?.socketId && req?.path
+      ? {
+          send: (response) => wsSendToSocket(req.socketId, req.path, response),
+          broadcast: (response) => wsBroadcastToPath(req.path, response),
+        }
+      : null;
   const ctx = {
     db: tracked.db,
     log: appContext.log,
@@ -68,10 +123,14 @@ function buildContext(appContext, extras) {
     queue: appContext.queue,
     files: appContext.files,
     mail: appContext.mail,
+    meta: normalizeMeta(appContext.meta),
+    vault,
+    ws,
+    err: (input, status) => buildErrResponse(input, status),
     _dbStats: tracked.stats,
-    ...extras,
+    ...normalizedExtras,
   };
   return ctx;
 }
 
-export { buildContext };
+export { buildContext, buildErrResponse };

package/server/db/index.js

@@ -6,18 +6,39 @@ import { loadModule } from '../module-loader.js';
 import { introspectSchema, generateSchemaMarkdown } from './schema/index.js';
 
 class MigrationSource {
-  constructor(directory) {
+  constructor(directory, pluginMigrations = []) {
     this.directory = directory;
+    this.pluginMigrations = pluginMigrations;
+    this.migrationPaths = new Map();
   }
   async getMigrations() {
-    const files = await discoverFiles(this.directory, { skipUnderscore: false });
-    return files.map((f) => f.name);
+    this.migrationPaths.clear();
+    const migrations = [];
+
+    if (this.directory) {
+      const files = await discoverFiles(this.directory, { skipUnderscore: false });
+      for (const file of files) {
+        migrations.push(file.name);
+        this.migrationPaths.set(file.name, file.filePath);
+      }
+    }
+
+    for (const plugin of this.pluginMigrations ?? []) {
+      const files = await discoverFiles(plugin.dir, { skipUnderscore: false });
+      for (const file of files) {
+        const name = `plugins/${plugin.pluginId}/${file.name}`;
+        migrations.push(name);
+        this.migrationPaths.set(name, file.filePath);
+      }
+    }
+
+    return migrations;
   }
   getMigrationName(migration) {
     return migration;
   }
   async getMigration(migration) {
-    const filePath = path.resolve(this.directory, migration);
+    const filePath = this.migrationPaths.get(migration) ?? path.resolve(this.directory, migration);
     return loadModule(filePath, import.meta.url);
   }
 }
@@ -43,7 +64,9 @@ async function createDB(config, { log } = {}) {
     ...hooks,
     client,
     connection,
-    ...(isSqlite ? { useNullAsDefault: true } : {}),
+    ...(isSqlite
+      ? { useNullAsDefault: config.sqlite?.useNullAsDefault ?? config.useNullAsDefault ?? true }
+      : {}),
   });
 
   try {
@@ -55,6 +78,9 @@ async function createDB(config, { log } = {}) {
   }
 
   if (isSqlite) {
+    if (config.sqlite?.foreignKeys) {
+      await db.raw('PRAGMA foreign_keys = ON');
+    }
     await db.raw('PRAGMA journal_mode = WAL');
     await db.raw('PRAGMA busy_timeout = 5000');
     await db.raw('PRAGMA synchronous = NORMAL');
@@ -72,9 +98,10 @@ async function createDB(config, { log } = {}) {
 
   db.runMigrations = async () => {
     const migrationsDir = config.dir;
-    if (!migrationsDir) return;
+    const pluginMigrations = config.pluginMigrations ?? [];
+    if (!migrationsDir && pluginMigrations.length === 0) return;
     const [batch, migrations] = await db.migrate.latest({
-      migrationSource: new MigrationSource(migrationsDir),
+      migrationSource: new MigrationSource(migrationsDir, pluginMigrations),
     });
     if (migrations.length > 0) {
       log?.info(`Migrations (batch ${batch}): ${migrations.join(', ')}`);
@@ -85,9 +112,12 @@ async function createDB(config, { log } = {}) {
 
   db.runRollback = async () => {
     const migrationsDir = config.dir;
-    if (!migrationsDir) throw new Error('No migrations dir configured');
+    const pluginMigrations = config.pluginMigrations ?? [];
+    if (!migrationsDir && pluginMigrations.length === 0) {
+      throw new Error('No migrations dir configured');
+    }
     const [batch, entries] = await db.migrate.rollback({
-      migrationSource: new MigrationSource(migrationsDir),
+      migrationSource: new MigrationSource(migrationsDir, pluginMigrations),
     });
     return { batch, log: entries };
   };

package/server/discovery.js

@@ -8,7 +8,10 @@ import { loadModule } from './module-loader.js';
  * Skips files starting with underscore by default.
  * Returns sorted array of { name, filePath, relativePath }.
  */
-async function discoverFiles(dir, { recursive = false, extensions = ['.js'], skipUnderscore = true, filter } = {}) {
+async function discoverFiles(
+  dir,
+  { recursive = false, extensions = ['.js'], skipUnderscore = true, filter } = {},
+) {
   if (!dir) return [];
 
   let files;
@@ -49,7 +52,10 @@ async function discoverFiles(dir, { recursive = false, extensions = ['.js'], ski
  * Returns sorted array of { name, filePath, relativePath, module }.
  * Throws with a descriptive message if any file fails to import.
  */
-async function discoverModules(dir, { recursive = false, extensions = ['.js'], skipUnderscore = true, filter, label = 'file' } = {}) {
+async function discoverModules(
+  dir,
+  { recursive = false, extensions = ['.js'], skipUnderscore = true, filter, label = 'file' } = {},
+) {
   const files = await discoverFiles(dir, { recursive, extensions, skipUnderscore, filter });
   const results = [];
   for (const entry of files) {
@@ -64,4 +70,40 @@ async function discoverModules(dir, { recursive = false, extensions = ['.js'], s
   return results;
 }
 
-export { discoverFiles, discoverModules };
+async function discoverPackageDirectories(
+  dir,
+  { markerFiles = ['package.json'], label = 'package' } = {},
+) {
+  if (!dir) return [];
+
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === 'ENOENT') return [];
+    throw err;
+  }
+
+  const packages = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name.startsWith('_')) continue;
+    const packageDir = path.join(dir, entry.name);
+    const hasMarker = await Promise.all(
+      markerFiles.map(async (marker) => {
+        try {
+          await fs.access(path.join(packageDir, marker));
+          return true;
+        } catch (err) {
+          if (err.code === 'ENOENT') return false;
+          throw err;
+        }
+      }),
+    );
+    if (!hasMarker.some(Boolean)) continue;
+    packages.push({ name: entry.name, dir: packageDir, label });
+  }
+  packages.sort((a, b) => a.name.localeCompare(b.name));
+  return packages;
+}
+
+export { discoverFiles, discoverModules, discoverPackageDirectories };

package/server/events/drivers/memory.js

@@ -1,22 +1,40 @@
+import { randomUUID } from 'node:crypto';
 import { patternToRegex } from '../pattern.js';
 class MemoryTransport {
   subscriptions = [];
   /** Subscribe to events matching a pattern. */
-  subscribe(pattern, handler) {
+  subscribe(pattern, handler, options = {}) {
     const regex = patternToRegex(pattern);
-    this.subscriptions.push({ pattern, regex, handler });
+    const subscription = { pattern, regex, handler, consumerGroup: options.consumerGroup };
+    this.subscriptions.push(subscription);
+    return () => {
+      const index = this.subscriptions.indexOf(subscription);
+      if (index !== -1) this.subscriptions.splice(index, 1);
+    };
   }
   /** Emit an event. Handlers run asynchronously — fire-and-forget. */
   async emit(eventName, payload) {
     const matching = this.subscriptions.filter((sub) => sub.regex.test(eventName));
     if (matching.length === 0) return;
+    const meta = { id: randomUUID() };
+    const grouped = [];
+    const seenGroups = new Set();
+    for (const sub of matching) {
+      if (!sub.consumerGroup) {
+        grouped.push(sub);
+        continue;
+      }
+      if (seenGroups.has(sub.consumerGroup)) continue;
+      seenGroups.add(sub.consumerGroup);
+      grouped.push(sub);
+    }
     Promise.allSettled(
-      matching.map((sub) => sub.handler(eventName, payload)),
+      grouped.map((sub) => sub.handler(payload, eventName, meta)),
     ).then((results) => {
       for (let i = 0; i < results.length; i++) {
         if (results[i].status === 'rejected') {
           console.error(
-            `Event listener error [${matching[i].pattern}] for event "${eventName}":`,
+            `Event listener error [${grouped[i].pattern}] for event "${eventName}":`,
             results[i].reason,
           );
         }

package/server/events/drivers/redis.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { patternToRegex } from '../pattern.js';
 class RedisTransport {
   pub;
@@ -10,17 +11,22 @@ class RedisTransport {
     this.sub = sub;
     this.prefix = `${keyPrefix}events:`;
   }
-  subscribe(pattern, handler) {
+  subscribe(pattern, handler, options = {}) {
     const regex = patternToRegex(pattern);
-    this.subscriptions.push({ pattern, regex, handler });
+    const subscription = { pattern, regex, handler, consumerGroup: options.consumerGroup };
+    this.subscriptions.push(subscription);
     if (!this.listening) {
       this.listening = true;
       this.startListening();
     }
+    return () => {
+      const index = this.subscriptions.indexOf(subscription);
+      if (index !== -1) this.subscriptions.splice(index, 1);
+    };
   }
   async emit(eventName, payload) {
     const channel = `${this.prefix}${eventName}`;
-    const message = JSON.stringify({ event: eventName, payload });
+    const message = JSON.stringify({ id: randomUUID(), event: eventName, payload });
     await this.pub.publish(channel, message);
   }
   startListening() {
@@ -36,10 +42,19 @@ class RedisTransport {
         console.warn('[RedisTransport] Malformed event message, skipping');
         return;
       }
-      const { event: eventName, payload } = parsed;
+      const { id, event: eventName, payload } = parsed;
       const matching = this.subscriptions.filter((sub) => sub.regex.test(eventName));
       if (matching.length === 0) return;
-      Promise.allSettled(matching.map((sub) => sub.handler(eventName, payload))).then((results) => {
+      Promise.allSettled(
+        matching.map(async (sub) => {
+          if (sub.consumerGroup) {
+            const claimKey = `${this.prefix}consumer-groups:${sub.consumerGroup}:${id}`;
+            const claimed = await this.pub.set(claimKey, '1', 'PX', 60 * 60 * 1000, 'NX');
+            if (claimed !== 'OK') return;
+          }
+          await sub.handler(payload, eventName, { id });
+        }),
+      ).then((results) => {
         for (let i = 0; i < results.length; i++) {
           if (results[i].status === 'rejected') {
             console.error(

package/server/events/handler.js

@@ -11,8 +11,10 @@ function listenerPathToEvent(relativePath) {
 
 function validateHandler(item, filePath, index) {
   const label = index !== undefined ? `[${index}]` : '';
-  if (typeof item === 'function') return item;
-  if (typeof item === 'object' && item !== null && typeof item.handler === 'function') return item.handler;
+  if (typeof item === 'function') return { handler: item };
+  if (typeof item === 'object' && item !== null && typeof item.handler === 'function') {
+    return { handler: item.handler, consumerGroup: item.consumerGroup };
+  }
   throw new Error(
     `Listener at ${filePath}${label} must be a function or an object with a "handler" function`,
   );
@@ -54,11 +56,23 @@ class EventHandler {
 
       const items = Array.isArray(exported) ? exported : [exported];
       for (let i = 0; i < items.length; i++) {
-        const handler = validateHandler(items[i], filePath, items.length > 1 ? i : undefined);
-        this._events.subscribe(event, (_eventName, payload) => {
-          const ctx = buildContext(this._appContext, { event: { name: _eventName, payload } });
-          handler(ctx);
-        });
+        const { handler, consumerGroup } = validateHandler(
+          items[i],
+          filePath,
+          items.length > 1 ? i : undefined,
+        );
+        const groupName =
+          consumerGroup === false
+            ? undefined
+            : consumerGroup ?? `listener:${relativePath}:${items.length > 1 ? i : 0}`;
+        this._events.subscribe(
+          event,
+          (payload, _eventName) => {
+            const ctx = buildContext(this._appContext, { event: { name: _eventName, payload } });
+            return handler(ctx);
+          },
+          { consumerGroup: groupName },
+        );
         this._listeners.push({ event, fileName: relativePath });
       }
       this._log?.info(`  ${relativePath} → ${event}${items.length > 1 ? ` (${items.length} listeners)` : ''}`);

package/server/events/index.js

@@ -18,8 +18,8 @@ class Events {
     }
   }
 
-  subscribe(pattern, handler) {
-    this._transport.subscribe(pattern, handler);
+  subscribe(pattern, handler, options) {
+    return this._transport.subscribe(pattern, handler, options);
   }
 
   async emit(eventName, payload) {

package/server/index.js

@@ -1,7 +1,8 @@
 export { type } from 'arktype';
 export { buildContext } from './context.js';
-export * as vault from './lib/vault/index.js';
 export { default as boot } from './boot.js';
+export { CapabilityNotAvailable, CapabilityRegistry } from './plugins/capabilities.js';
+export { PluginManager, createPluginManager } from './plugins/manager.js';
 export {
   Arcway,
   Solo,

package/server/internals.js

@@ -42,6 +42,9 @@ import { createRateLimitMiddleware } from './rate-limit/index.js';
 import { createHttpServer, listen, closeServer } from './server.js';
 import { startWatcher } from './watcher.js';
 import { build } from './build.js';
+import { CapabilityNotAvailable, CapabilityRegistry } from './plugins/capabilities.js';
+import { discoverPlugins } from './plugins/discovery.js';
+import { PluginManager, createPluginManager } from './plugins/manager.js';
 import {
   discoverPages,
   discoverLayouts,
@@ -68,6 +71,8 @@ import { attachGraphQLSubscriptions } from './graphql/subscriptions.js';
 export {
   ApiRouter,
   Cache,
+  CapabilityNotAvailable,
+  CapabilityRegistry,
   makeConfig,
   Files,
   KnexQueueDriver,
@@ -101,9 +106,11 @@ export {
   createLoaderFactory,
   createPagesHandler,
   createPagesWatcher,
+  createPluginManager,
   createRateLimitMiddleware,
   createWebSocketServer,
   discoverJobs,
+  discoverPlugins,
   EventHandler,
   discoverErrorPages,
   discoverGraphQL,
@@ -127,6 +134,7 @@ export {
   mergeWebSocketHandlers,
   parseCron,
   patternToFileName,
+  PluginManager,
   resolveLayoutChain,
   resolveSessionConfig,
   runSeeds,

package/server/jobs/drivers/run-handler.js

@@ -16,6 +16,9 @@ async function runHandler(reg, payload, workerPool) {
     return;
   }
   const ctx = buildContext(reg.store, { payload });
+  if (reg.definition.plugin) {
+    reg.store.plugins?.injectCapabilities(ctx, reg.definition.plugin.requires);
+  }
   await reg.definition.handler(ctx);
 }