Plugin Configuration and Secrets

Enterprise 3.3.0+. Set FUME_PLUGINS_CONFIG to a local .json, .yaml or .yml deployment file. An unset/blank setting disables the runtime. An explicit invalid file fails startup; it is not ignored. The setting is resolved from server working directory; installation paths are resolved relative to the deployment file and canonicalized to real local .cjs files. No URLs, base64 files, npm names or remote installation are accepted.

Deployment schema

Required version is literal 1. Every numeric limit is an integer. Unknown fields are rejected. plugins and rootAliases default to empty arrays.

Field	Default	Inclusive range
workers	1	1–8
maxConcurrencyPerWorker	8	1–64
maxQueue	128	0–4096
maxPayloadBytes	1048576	1–16777216
maxDepth	64	1–256
maxCallbacksPerInvocation	1000	1–100000
maxConcurrentCallbacksPerInvocation	4	1–64
maxConcurrentCallbacks	32	1–1024
workerHeapMb	128	32–4096
startupTimeoutMs	30000	1–300000
shutdownTimeoutMs	5000	1–300000

Times are milliseconds; heap is MiB; payload is encoded UTF-8 bytes. Callback limits are invocation-total, invocation-concurrent and server-global-concurrent respectively. The runtime guide explains queue/deadline behavior.

Installation schema

Field	Type / default
id	Required identifier, unique across all installations, matching manifest ID.
path	Required nonempty local artifact path. Enabled installations require an existing real .cjs file.
enabled	Boolean, default true; disabled artifacts are not loaded or required to exist.
mode	bundled or unbundled, default bundled. Neither installs packages.
timeoutMs	Integer, default 5000, range 1–300000.
config	JSON object, default {}; passed frozen to the factory.
configEnv	Object of config key -> environment-variable name, default {}. Values are injected as strings.

A root alias contains required path (a literal single-root path using route grammar) and mappingId (a nonempty ordinary user mapping ID). It exposes that user mapping at the alias without modifying its evaluator scope or creating a new provider key. Targets must exist at startup; duplicate aliases and root-route collisions fail.

Secrets

version: 1
plugins:
  - id: external-service
    path: ./dist/external-service.cjs
    config:
      endpoint: https://api.example.org/
    configEnv:
      apiToken: EXTERNAL_SERVICE_TOKEN

This assumes an artifact whose manifest ID is external-service. The factory receives config.apiToken; expressions do not gain $apiToken. Missing environment variables and keys duplicated between config and configEnv fail safely. An empty environment string is still a string; authors must validate required secret content. Do not put secrets in manifest variables or return them as results. Worker environment is minimized; read injected factory config rather than relying on ambient server variables.

Manage secrets using your deployment platform's existing environment/secret mechanisms. Mount artifact/config directories read-only and limit OS permissions. Changing a file does not hot-reload it: deploy an immutable versioned directory, update configuration and restart. Roll back by restoring the previous artifact/configuration pair and restarting. Keep aliases and dependent user mappings consistent with that pair.