Interface PluginContext

Host-injected fetch for authenticated API calls. The host enforces permissions.network against the upstream hostname, applies the declared relay if any, never follows redirects (a redirect off the checked host would leak request headers), never attaches ambient credentials (credentials: 'omit' — a relay makes requests same-origin, so the default would send the app's own cookies upstream), and retries 429 and 503 responses carrying Retry-After with bounded backoff.

Providers must use this instead of global fetch.

Fetch for pre-signed, credential-free URLs — the download links some providers return, which point at a CDN or tenant host and are invalidated by sending an Authorization header at all.

Enforced against permissions.publicNetwork. The host strips every request header except Accept and Range, so a provider cannot use this path to smuggle a credential to a host outside permissions.network. Redirects are followed, since pre-signed URLs commonly bounce.

Namespaced key-value store (localStorage-backed in the reference host; treat values as user-revocable, not securely encrypted).