arcway 0.2.0 → 0.3.0

package/server/jobs/worker-entry.js

@@ -4,6 +4,8 @@ import { serializeError } from './worker-pool.js';
 import { resolveWorkerConfig } from './worker-config.js';
 import { buildContext } from '../context.js';
 import { createInfrastructure, destroyInfrastructure } from '../boot/infrastructure.js';
+import { CallbackRegistry } from '../callbacks/index.js';
+import { CallbackStore } from '../callbacks/store.js';
 
 // Worker-side entry for the jobs WorkerPool. Each worker owns its own DB /
 // redis / queue / cache / files / mail / events / log — built lazily on the
@@ -70,8 +72,14 @@ async function runTask(task) {
   // and any future cpu-only caller) gets the raw payload — no DB spin-up.
   if (withContext) {
     const services = await ensureInfrastructure();
+    const callbackStore = new CallbackStore(services.db);
+    await callbackStore.init();
+    const callbacks = new CallbackRegistry({
+      store: callbackStore,
+      secret: resolvedConfig?.vault?.values?.callback,
+    });
     const ctx = buildContext(
-      { ...services, meta: workerData?.meta, vault: resolvedConfig?.vault },
+      { ...services, meta: workerData?.meta, vault: resolvedConfig?.vault, callbacks },
       { payload },
     );
     return fn(ctx);

package/server/lib/vault/jwt.js

@@ -1,19 +1,26 @@
-import { SignJWT, jwtVerify, errors } from 'jose';
+import { SignJWT, jwtVerify } from 'jose';
+
 function secretToKey(secret) {
   return new TextEncoder().encode(secret);
 }
+
 function parseExpiration(expiresIn) {
   if (typeof expiresIn === 'number') {
     return `${expiresIn}s`;
   }
   return expiresIn;
 }
-async function jwtEncode(payload, secret, options) {
+
+function requireJwtSecret(secret) {
   if (!secret) {
-    throw new Error('JWT secret is required');
+    throw new Error('JWT key is required');
   }
+  return secret;
+}
+
+async function encodeWithSecret(payload, secret, options) {
   const alg = options?.algorithm ?? 'HS256';
-  const key = secretToKey(secret);
+  const key = secretToKey(requireJwtSecret(secret));
   let builder = new SignJWT(payload).setProtectedHeader({ alg }).setIssuedAt();
   if (options?.expiresIn !== void 0) {
     builder = builder.setExpirationTime(parseExpiration(options.expiresIn));
@@ -26,11 +33,9 @@ async function jwtEncode(payload, secret, options) {
   }
   return builder.sign(key);
 }
-async function jwtDecode(token, secret, options) {
-  if (!secret) {
-    throw new Error('JWT secret is required');
-  }
-  const key = secretToKey(secret);
+
+async function decodeWithSecret(token, secret, options) {
+  const key = secretToKey(requireJwtSecret(secret));
   const algorithms = options?.algorithms ?? ['HS256'];
   try {
     const { payload } = await jwtVerify(token, key, {
@@ -39,17 +44,25 @@ async function jwtDecode(token, secret, options) {
       audience: options?.audience,
     });
     return payload;
-  } catch (err) {
-    if (err instanceof errors.JWTExpired) {
-      throw new Error('JWT token has expired');
-    }
-    if (err instanceof errors.JWSSignatureVerificationFailed) {
-      throw new Error('JWT signature verification failed');
-    }
-    if (err instanceof errors.JWTClaimValidationFailed) {
-      throw new Error(`JWT claim validation failed: ${err.message}`);
-    }
-    throw new Error(`JWT verification failed: ${err.message}`);
+  } catch {
+    throw new Error('JWT verification failed');
   }
 }
-export { jwtDecode, jwtEncode };
+
+function createJwtCodec(secret) {
+  const jwtSecret = requireJwtSecret(secret);
+  return {
+    jwtEncode: (payload, options) => encodeWithSecret(payload, jwtSecret, options),
+    jwtDecode: (token, options) => decodeWithSecret(token, jwtSecret, options),
+  };
+}
+
+async function jwtEncode(_payload, _options) {
+  throw new Error('JWT key is required; use ctx.vault.jwtEncode() with configured vault');
+}
+
+async function jwtDecode(_token, _options) {
+  throw new Error('JWT key is required; use ctx.vault.jwtDecode() with configured vault');
+}
+
+export { createJwtCodec, jwtDecode, jwtEncode };

package/server/lib/vault/secrets.js

@@ -5,7 +5,7 @@ const MASTER_BYTES = 32;
 const VAULT_KEY_BYTES = 32;
 const HKDF_SALT = 'arcway:infra-secrets:v1';
 
-const SECRET_NAMES = Object.freeze(['session', 'plugin-vault', 'mcp-api']);
+const SECRET_NAMES = Object.freeze(['session', 'plugin-vault', 'mcp-api', 'jwt', 'callback']);
 
 function base64Url(buffer) {
   return Buffer.from(buffer).toString('base64url');
@@ -102,6 +102,8 @@ function deriveInfraSecret(master, name) {
   if (name === 'session') return base64Url(deriveBytes(master, name, 48));
   if (name === 'plugin-vault') return formatVaultKey(deriveBytes(master, name, VAULT_KEY_BYTES));
   if (name === 'mcp-api') return base64Url(deriveBytes(master, name, 48));
+  if (name === 'jwt') return base64Url(deriveBytes(master, name, 48));
+  if (name === 'callback') return base64Url(deriveBytes(master, name, 48));
   throw new Error(`Unknown Arcway infra secret namespace: ${name}`);
 }
 

package/server/plugins/bundle.js

@@ -0,0 +1,122 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { build } from 'esbuild';
+import { discoverFiles } from '../discovery.js';
+import { loadModule } from '../module-loader.js';
+
+let bundleCounter = 0;
+
+async function exists(filePath) {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch (err) {
+    if (err.code === 'ENOENT') return false;
+    throw err;
+  }
+}
+
+function importLine(name, filePath, namespace = true) {
+  const imported = namespace ? `* as ${name}` : name;
+  return `import ${imported} from ${JSON.stringify(filePath)};`;
+}
+
+function moduleEntry(name, entry) {
+  return `{ name: ${JSON.stringify(entry.name)}, filePath: ${JSON.stringify(entry.filePath)}, relativePath: ${JSON.stringify(entry.relativePath)}, module: ${name} }`;
+}
+
+async function loadPluginBundle(packageDir) {
+  const bundleDir = path.join(packageDir, '.arcway', 'plugin-bundles');
+  await fs.mkdir(bundleDir, { recursive: true });
+
+  const pluginJs = path.join(packageDir, 'plugin.js');
+  const exportsJs = path.join(packageDir, 'exports.js');
+  const jobsDir = path.join(packageDir, 'jobs');
+  const callbacksDir = path.join(packageDir, 'callbacks');
+  const capabilitiesDir = path.join(packageDir, 'capabilities');
+  const hooksDir = path.join(packageDir, 'hooks');
+
+  const hasPluginJs = await exists(pluginJs);
+  const hasExportsJs = await exists(exportsJs);
+  const jobs = await discoverFiles(jobsDir, { recursive: true });
+  const callbacks = await discoverFiles(callbacksDir, { recursive: true });
+  const capabilities = await discoverFiles(capabilitiesDir);
+  const hooks = await discoverFiles(hooksDir);
+
+  const lines = [];
+  if (hasPluginJs) lines.push(importLine('pluginModule', pluginJs));
+  if (hasExportsJs) lines.push(importLine('pluginExports', exportsJs, false));
+
+  for (const [index, entry] of jobs.entries()) {
+    lines.push(importLine(`job${index}`, entry.filePath));
+  }
+  for (const [index, entry] of callbacks.entries()) {
+    lines.push(importLine(`callback${index}`, entry.filePath));
+  }
+  for (const [index, entry] of capabilities.entries()) {
+    lines.push(importLine(`capability${index}`, entry.filePath, false));
+  }
+  for (const [index, entry] of hooks.entries()) {
+    lines.push(importLine(`hook${index}`, entry.filePath, false));
+  }
+
+  lines.push(`export const module = ${hasPluginJs ? 'pluginModule' : '{}'};`);
+  lines.push(
+    `export const exportsModule = ${hasExportsJs ? '{ default: pluginExports }' : 'null'};`,
+  );
+  lines.push(
+    `export const jobs = [${jobs.map((entry, index) => moduleEntry(`job${index}`, entry)).join(',')}];`,
+  );
+  lines.push(
+    `export const callbacks = [${callbacks.map((entry, index) => moduleEntry(`callback${index}`, entry)).join(',')}];`,
+  );
+  lines.push(
+    `export const capabilities = {${capabilities
+      .map((entry, index) => {
+        const name = path.basename(entry.name, path.extname(entry.name));
+        return `${JSON.stringify(name)}: capability${index}`;
+      })
+      .join(',')}};`,
+  );
+  lines.push(
+    `export const hooks = {${hooks
+      .map((entry, index) => {
+        const name = path.basename(entry.name, path.extname(entry.name));
+        return `${JSON.stringify(name)}: hook${index}`;
+      })
+      .join(',')}};`,
+  );
+
+  const counter = ++bundleCounter;
+  const entryPath = path.join(bundleDir, `entry-${counter}.mjs`);
+  const outFile = path.join(bundleDir, `bundle-${counter}.mjs`);
+  await fs.writeFile(entryPath, lines.join('\n'));
+
+  await build({
+    entryPoints: [entryPath],
+    outfile: outFile,
+    bundle: true,
+    format: 'esm',
+    platform: 'node',
+    target: 'node20',
+    logLevel: 'silent',
+  });
+
+  const bundled = await loadModule(outFile);
+  return {
+    module: bundled.module ?? {},
+    exportsModule: bundled.exportsModule ?? null,
+    jobs: bundled.jobs ?? [],
+    callbacks: bundled.callbacks ?? [],
+    capabilities: bundled.capabilities ?? {},
+    hooks: bundled.hooks ?? {},
+    artifact: outFile,
+  };
+}
+
+function fileUrl(filePath) {
+  return pathToFileURL(filePath).href;
+}
+
+export { fileUrl, loadPluginBundle };

package/server/plugins/discovery.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { discoverModules, discoverPackageDirectories } from '../discovery.js';
 import { loadModule } from '../module-loader.js';
 import { validateManifest } from './manifest.js';
+import { loadPluginBundle } from './bundle.js';
 
 async function exists(filePath) {
   try {
@@ -60,7 +61,7 @@ async function loadConventionModules(dir, label) {
   return map;
 }
 
-async function loadPluginPackage(packageDir) {
+async function loadPluginPackage(packageDir, { bundle = false } = {}) {
   const packageJsonPath = path.join(packageDir, 'package.json');
   if (!(await exists(packageJsonPath))) {
     throw new Error(`Plugin package at ${packageDir} must include package.json`);
@@ -72,18 +73,24 @@ async function loadPluginPackage(packageDir) {
   const exportsJs = path.join(packageDir, 'exports.js');
   let manifestPath;
   let module = {};
+  let bundled = null;
   let rawManifest;
 
   if (await exists(pluginJs)) {
     manifestPath = pluginJs;
-    module = await loadModule(pluginJs, import.meta.url);
+    if (bundle) {
+      bundled = await loadPluginBundle(packageDir);
+      module = bundled.module;
+    } else {
+      module = await loadModule(pluginJs, import.meta.url);
+    }
     rawManifest = getManifest(module, pluginJs);
   } else if (await exists(pluginJson)) {
     manifestPath = pluginJson;
     rawManifest = await readJson(pluginJson, 'plugin.json');
   } else if (packageJson.arcway && typeof packageJson.arcway === 'object') {
     // Metadata-only plugin: the manifest lives in package.json's "arcway" block,
-    // and code is discovered by folder convention (routes/, jobs/, capabilities/, hooks/).
+    // and code is discovered by folder convention (jobs/, callbacks/, capabilities/, hooks/).
     manifestPath = packageJsonPath;
     rawManifest = {};
   } else {
@@ -104,11 +111,14 @@ async function loadPluginPackage(packageDir) {
     { packageName: packageJson.name },
   );
 
-  const routesDir = path.join(packageDir, 'routes');
   const jobsDir = path.join(packageDir, 'jobs');
-  const exportsModule = (await exists(exportsJs))
-    ? await loadModule(exportsJs, import.meta.url)
-    : null;
+  const callbacksDir = path.join(packageDir, 'callbacks');
+  if (bundle && !bundled) bundled = await loadPluginBundle(packageDir);
+  const exportsModule = bundled
+    ? bundled.exportsModule
+    : (await exists(exportsJs))
+      ? await loadModule(exportsJs, import.meta.url)
+      : null;
 
   return {
     id: manifest.id,
@@ -116,16 +126,23 @@ async function loadPluginPackage(packageDir) {
     packageJson,
     manifest,
     module,
+    bundle: bundled ? { artifact: bundled.artifact } : null,
     manifestPath,
     exports: exportsModule ? getExports(exportsModule, exportsJs) : {},
-    routesDir: (await exists(routesDir)) ? routesDir : null,
     jobsDir: (await exists(jobsDir)) ? jobsDir : null,
-    capabilities: await loadConventionModules(path.join(packageDir, 'capabilities'), 'capability'),
-    hooks: await loadConventionModules(path.join(packageDir, 'hooks'), 'lifecycle hook'),
+    callbacksDir: (await exists(callbacksDir)) ? callbacksDir : null,
+    bundledJobs: bundled?.jobs ?? null,
+    bundledCallbacks: bundled?.callbacks ?? null,
+    capabilities:
+      bundled?.capabilities ??
+      (await loadConventionModules(path.join(packageDir, 'capabilities'), 'capability')),
+    hooks:
+      bundled?.hooks ??
+      (await loadConventionModules(path.join(packageDir, 'hooks'), 'lifecycle hook')),
   };
 }
 
-async function discoverPlugins(dirs) {
+async function discoverPlugins(dirs, options = {}) {
   const plugins = [];
   const seen = new Map();
 
@@ -135,7 +152,7 @@ async function discoverPlugins(dirs) {
       label: 'plugin',
     });
     for (const entry of packages) {
-      const plugin = await loadPluginPackage(entry.dir);
+      const plugin = await loadPluginPackage(entry.dir, options);
       if (!plugin) continue;
       if (seen.has(plugin.id)) {
         throw new Error(

package/server/plugins/graph.js

@@ -18,29 +18,43 @@ function buildProviderMap(plugins) {
 function resolvePluginGraph(plugins, enabledIds) {
   const allProviders = buildProviderMap(plugins);
   const byId = new Map(plugins.map((plugin) => [plugin.id, plugin]));
-  const enabled = new Set(enabledIds);
+  const enabled = new Set([...enabledIds].map((id) => String(id)));
   const missing = [];
   const edges = new Map();
 
   for (const plugin of plugins) {
-    edges.set(plugin.id, new Set());
-    if (!enabled.has(plugin.id)) continue;
+    const pluginId = String(plugin.id);
+    edges.set(pluginId, new Set());
+  }
+
+  for (const plugin of plugins) {
+    const pluginId = String(plugin.id);
+    if (!enabled.has(pluginId)) continue;
     for (const capability of requiredCapabilities(plugin.manifest.requires)) {
       const provider = allProviders.get(capability);
       if (!provider) {
-        missing.push({ pluginId: plugin.id, capability, reason: 'missing provider' });
+        missing.push({ pluginId, capability, reason: 'missing provider' });
         continue;
       }
-      if (!enabled.has(provider.id)) {
+      const providerId = String(provider.id);
+      if (!enabled.has(providerId)) {
         missing.push({
-          pluginId: plugin.id,
+          pluginId,
           capability,
-          providerId: provider.id,
+          providerId,
           reason: 'provider disabled',
         });
         continue;
       }
-      if (provider.id !== plugin.id) edges.get(provider.id).add(plugin.id);
+      if (providerId !== pluginId) {
+        const providerEdges = edges.get(providerId);
+        if (!providerEdges) {
+          throw new Error(
+            `Plugin ${pluginId} requires capability ${capability} from unknown provider ${providerId}`,
+          );
+        }
+        providerEdges.add(pluginId);
+      }
     }
   }
 

package/server/plugins/manager.js

@@ -1,5 +1,6 @@
-import { discoverRoutes } from '../router/routes.js';
-import { discoverJobs } from '../jobs/runner.js';
+import path from 'node:path';
+import { buildJobsFromModules, discoverJobs } from '../jobs/runner.js';
+import { buildCallbacksFromModules, discoverCallbacks } from '../callbacks/discovery.js';
 import { CapabilityRegistry } from './capabilities.js';
 import { discoverPlugins } from './discovery.js';
 import { buildProviderMap, cascadeDisabled, resolvePluginGraph } from './graph.js';
@@ -26,6 +27,29 @@ function capabilityFactory(plugin, capability) {
   );
 }
 
+function collectDependentIds(plugins, ids) {
+  const affected = new Set(ids);
+  const providers = buildProviderMap(plugins);
+  let changed = true;
+
+  while (changed) {
+    changed = false;
+    for (const plugin of plugins) {
+      if (affected.has(plugin.id)) continue;
+      for (const capability of requiredCapabilities(plugin.manifest.requires)) {
+        const provider = providers.get(capability);
+        if (provider && affected.has(provider.id)) {
+          affected.add(plugin.id);
+          changed = true;
+          break;
+        }
+      }
+    }
+  }
+
+  return affected;
+}
+
 function bindPluginExports(plugin, ctx) {
   return new Proxy(
     {},
@@ -56,10 +80,11 @@ function bindPluginExports(plugin, ctx) {
 }
 
 class PluginManager {
-  constructor(config, { log, runLifecycle = true } = {}) {
+  constructor(config, { log, runLifecycle = true, bundle = false } = {}) {
     this.config = config ?? { enabled: false, dirs: [] };
     this.log = log;
     this.runLifecycle = runLifecycle;
+    this.bundle = bundle;
     this.plugins = [];
     this.enabled = new Set();
     this.status = new Map();
@@ -70,7 +95,7 @@ class PluginManager {
   async init() {
     if (this.config.enabled !== true) return this;
 
-    this.plugins = await discoverPlugins(this.config.dirs);
+    this.plugins = await discoverPlugins(this.config.dirs, { bundle: this.bundle });
     const enablements = configuredEnablements(this.config);
     this.enabled = new Set(
       this.plugins
@@ -141,27 +166,14 @@ class PluginManager {
     };
   }
 
-  async discoverRoutes() {
-    const routes = [];
-    for (const plugin of this.enabledPlugins) {
-      if (!plugin.routesDir) continue;
-      const discovered = await discoverRoutes(plugin.routesDir, {
-        prefix: `/_plugins/${plugin.id}`,
-        plugin: {
-          id: plugin.id,
-          requires: plugin.manifest.requires,
-        },
-      });
-      routes.push(...discovered);
-    }
-    return routes;
-  }
-
   async discoverJobs() {
     const jobs = [];
     for (const plugin of this.enabledPlugins) {
-      if (!plugin.jobsDir) continue;
-      const discovered = await discoverJobs(plugin.jobsDir);
+      const discovered = plugin.bundledJobs
+        ? buildJobsFromModules(plugin.bundledJobs)
+        : plugin.jobsDir
+          ? await discoverJobs(plugin.jobsDir)
+          : [];
       for (const job of discovered) {
         const definition = {
           ...job.definition,
@@ -177,6 +189,130 @@ class PluginManager {
     return jobs;
   }
 
+  async discoverCallbacks() {
+    const callbacks = new Map();
+    for (const plugin of this.enabledPlugins) {
+      const discovered = plugin.bundledCallbacks
+        ? buildCallbacksFromModules(plugin.bundledCallbacks)
+        : plugin.callbacksDir
+          ? await discoverCallbacks(plugin.callbacksDir)
+          : new Map();
+      for (const [name, callback] of discovered) {
+        const target = `plugins/${plugin.id}/${name}`;
+        callbacks.set(target, { ...callback, name: target, plugin });
+      }
+    }
+    return callbacks;
+  }
+
+  async reload(ids) {
+    if (this.config.enabled !== true) return { reloaded: [] };
+
+    const requested = ids ? new Set(Array.isArray(ids) ? ids : [ids]) : null;
+    const oldPlugins = this.plugins;
+    const oldEnabledIds = new Set(
+      oldPlugins
+        .filter((plugin) => this.status.get(plugin.id) === 'enabled')
+        .map((plugin) => plugin.id),
+    );
+    let affected = requested ? collectDependentIds(oldPlugins, requested) : new Set();
+
+    const discovered = await discoverPlugins(this.config.dirs, { bundle: this.bundle });
+    const discoveredIds = new Set(discovered.map((plugin) => plugin.id));
+    const enablements = configuredEnablements(this.config);
+    const nextEnabled = new Set();
+    for (const plugin of discovered) {
+      if (
+        this.enabled.has(plugin.id) ||
+        (!oldPlugins.some((old) => old.id === plugin.id) &&
+          pluginEnabledByDefault(plugin, enablements))
+      ) {
+        nextEnabled.add(plugin.id);
+      }
+    }
+
+    if (!requested) {
+      affected = new Set([...oldPlugins.map((plugin) => plugin.id), ...discoveredIds]);
+    } else {
+      for (const id of requested) {
+        if (!discoveredIds.has(id) && !oldPlugins.some((plugin) => plugin.id === id)) {
+          affected = new Set([...oldPlugins.map((plugin) => plugin.id), ...discoveredIds]);
+          break;
+        }
+      }
+      affected = collectDependentIds(discovered, affected);
+    }
+
+    const oldAffectedEnabled = [...this.loadOrder]
+      .filter((plugin) => affected.has(plugin.id) && oldEnabledIds.has(plugin.id))
+      .reverse();
+    for (const plugin of oldAffectedEnabled) {
+      if (this.runLifecycle) await this.#runLifecycle(plugin, 'onDisable');
+    }
+
+    this.plugins = discovered;
+    this.enabled = nextEnabled;
+    this.#rebuildGraph();
+
+    for (const plugin of this.loadOrder) {
+      if (!affected.has(plugin.id)) continue;
+      if (this.runLifecycle) {
+        await this.#runLifecycle(plugin, 'onLoad');
+        await this.#runLifecycle(plugin, 'onEnable');
+      }
+      this.log?.info?.(`Plugin reloaded: ${plugin.id}`);
+    }
+
+    return {
+      reloaded: [...affected].filter((id) => discoveredIds.has(id)),
+      removed: [...affected].filter((id) => !discoveredIds.has(id)),
+    };
+  }
+
+  pluginIdsForChangedFiles(events) {
+    const ids = new Set();
+    for (const event of events) {
+      const filePath = event.path;
+      const existing = this.plugins.find(
+        (plugin) => filePath === plugin.dir || filePath.startsWith(plugin.dir + path.sep),
+      );
+      if (existing) {
+        ids.add(existing.id);
+        continue;
+      }
+
+      const rootDir = (this.config.dirs ?? []).find((dir) => {
+        const relative = path.relative(dir, filePath);
+        return relative && !relative.startsWith('..') && !path.isAbsolute(relative);
+      });
+      if (!rootDir) continue;
+      const [packageDirName] = path.relative(rootDir, filePath).split(path.sep);
+      if (!packageDirName) continue;
+      if (!this.plugins.some((plugin) => plugin.id === packageDirName)) return null;
+      ids.add(packageDirName);
+    }
+    return ids;
+  }
+
+  watch(fileWatcher, { jobRunner } = {}) {
+    if (this.config.enabled !== true || !fileWatcher) return;
+    fileWatcher.subscribe('plugins', {
+      dirs: this.config.dirs,
+      extensions: ['.js', '.json'],
+      debounceMs: 200,
+      onChange: async (events) => {
+        const changedIds = this.pluginIdsForChangedFiles(events);
+        await this.reload(changedIds);
+        await jobRunner?.reload?.();
+      },
+    });
+    this.log?.info?.('Plugins: watching for changes');
+  }
+
+  unwatch(fileWatcher) {
+    fileWatcher?.unsubscribe?.('plugins');
+  }
+
   #rebuildGraph() {
     const providers = buildProviderMap(this.plugins);
     for (const plugin of this.plugins) {

package/server/router/api-router.js

@@ -39,7 +39,6 @@ class ApiRouter {
   _appContext;
   _sessionConfig;
   _redis;
-  _pluginManager;
   _routes = [];
   _middleware = [];
   _prefix = '';
@@ -54,7 +53,6 @@ class ApiRouter {
     this._appContext = appContext ?? null;
     this._sessionConfig = sessionConfig ?? null;
     this._redis = appContext?.redis ?? null;
-    this._pluginManager = appContext?.plugins ?? null;
   }
 
   get routes() {
@@ -103,7 +101,6 @@ class ApiRouter {
     const chainedHandler = buildMiddlewareChain(middlewareFns, route.config.handler);
     const ctx = this._buildCtx(reqInfo);
     try {
-      if (route.plugin) this._pluginManager?.injectCapabilities(ctx, route.plugin.requires);
       return await chainedHandler(ctx);
     } catch (err) {
       this._log.error(`Handler error in ${route.method} ${route.pattern}`, {
@@ -265,7 +262,6 @@ class ApiRouter {
 
     let response;
     try {
-      if (route.plugin) this._pluginManager?.injectCapabilities(ctx, route.plugin.requires);
       response = await chainedHandler(ctx);
     } catch (err) {
       const errorMsg = toErrorMessage(err);
@@ -347,6 +343,10 @@ class ApiRouter {
     }
   }
 
+  async reload() {
+    return this._reload();
+  }
+
   async close() {
     if (this._mode === 'development' && this._fileWatcher) {
       this._fileWatcher.unsubscribe('routes');
@@ -354,12 +354,10 @@ class ApiRouter {
   }
 
   async _discover() {
-    const [routes, middleware, pluginRoutes] = await Promise.all([
+    const [routes, middleware] = await Promise.all([
       discoverRoutes(this._config.dir),
       discoverMiddleware(this._config.dir),
-      this._pluginManager?.discoverRoutes?.() ?? [],
     ]);
-    routes.push(...pluginRoutes);
     sortBySpecificity(routes);
 
     applyPrefix(routes, middleware, this._prefix);