feat: http:fetch permission + httpOrigins manifest field

2026-05-05 21:50:04 +02:00
parent ef8eb1d73b
commit 0885d3c13e
10 changed files with 225 additions and 9 deletions
@@ -53,6 +53,11 @@ export interface ServerPlugin {
   * embed. Merged into the host frame-src by the proxy.
   */
  frameOrigins?: string[];
+  /**
+   * Validated HTTPS origins the plugin may target via `api.http.fetch()`.
+   * Same syntax as `frameOrigins`. Surfaced to clients via /api/plugins.
+   */
+  httpOrigins?: string[];
 }

 export interface ServerTheme {