Skip to main content

Variable: HOST_PERMISSIONS

const HOST_PERMISSIONS: MiniappPermissions

Defined in: src/types/permissions.ts:73

Default permission set used by host controls.

Host code (application shell, useRuntimeControls, bridges writing on behalf of the host) shares the single setContext write entry with miniapps — the only difference is the permission mask bound at the call site. Host-writable capabilities mirror the fields the host legitimately owns in practice:

  • theme, language, sharedStorage, headers — host-owned configuration that the host UI or bridges mutate.

Everything else is read-only from the host side:

  • credits / authentication — driven by monetization / auth services through dedicated bridges that dispatch on the storm directly (trusted runtime-internal path, bypassing this mask).
  • scene / location / analytics — miniapp- or runtime-internal concerns.