@ethisyscore/extension-runtime 1.26.0 → 1.27.1

package/dist/plugin/index.d.cts

@@ -6,8 +6,186 @@ import { SduiNode, RenderMode } from '@ethisyscore/protocol';
 import { RemoteConnection } from '@remote-dom/core';
 import '../bridge-envelopes-BRKGSiSC.cjs';
 
+/**
+ * A single client-push event delivered from the host to a plugin surface. The host
+ * relays the plugin backend's `IClientPushPublisher` events over its realtime
+ * channel (SignalR); the transport envelope's extension identity is bound by the
+ * host at mount time, so the plugin sees only the event body.
+ *
+ * SCOPE + ORDERING: which channel/user/group an event concerns is carried INSIDE
+ * `payloadJson` by the emitting plugin — the transport envelope intentionally has no
+ * group field. Consumers therefore demultiplex + order by their own payload fields
+ * (e.g. a per-channel sequence in the payload), NOT by {@link eventSequence}, which
+ * is per-group at the host and would produce false gaps when multiple groups
+ * multiplex over one connection.
+ */
+interface ClientPushEvent {
+    /** Plugin-defined discriminator, e.g. `"chatMessageReceived"`. */
+    eventType: string;
+    /** Raw JSON payload authored by the plugin backend. */
+    payloadJson: string;
+    /**
+     * Host per-group monotonic sequence. Advisory only — do NOT use for
+     * cross-group gap detection (see the scope note above).
+     */
+    eventSequence: number;
+}
+interface ClientPushSubscribeOptions {
+    /**
+     * Opaque group names to enrol in (e.g. `"chat:channel:{id}"`). The host
+     * authorises each subscription via the plugin's `authorize-subscription` tool
+     * and enforces org/extension isolation — a plugin cannot subscribe outside its
+     * own extension + organisation.
+     */
+    groups: string[];
+    /** Called for each delivered (non-resync) event for the subscribed groups. */
+    onEvent: (event: ClientPushEvent) => void;
+    /**
+     * Called when the host signals a gap/resync for the subscribed groups (a
+     * dropped-event backpressure signal, or a reconnect). The consumer should
+     * re-fetch authoritative state (e.g. a delta/cold-load) rather than trusting
+     * incremental events.
+     */
+    onResync?: () => void;
+}
+/**
+ * Host-provided channel for realtime server-push. The channel is already scoped to
+ * the mounted surface's extension + organisation (bound by the host from the trusted
+ * mount descriptor — a plugin CANNOT widen it), so {@link subscribe} takes only
+ * opaque group names and returns an unsubscribe function.
+ */
+interface ClientPushChannel {
+    subscribe(options: ClientPushSubscribeOptions): () => void;
+}
+/**
+ * `null` = no host channel (standalone/mock, or a host that predates client-push) →
+ * {@link useClientPushSubscription} is inert. Provided by
+ * {@link ExtensionRuntimeProvider}'s optional `clientPush` prop.
+ */
+declare const ClientPushContext: react.Context<ClientPushChannel | null>;
+interface UseClientPushSubscriptionOptions {
+    /** Opaque groups to subscribe. Changing the SET re-subscribes; identity/order changes alone do not. */
+    groups: string[];
+    onEvent: (event: ClientPushEvent) => void;
+    onResync?: () => void;
+    /** Gate the subscription (e.g. until an id is known). Default `true`. */
+    enabled?: boolean;
+}
+/**
+ * Subscribe a plugin surface to host client-push events for `groups`.
+ *
+ * Inert (no-op) when no host channel is present (standalone/mock), when `enabled` is
+ * false, or when `groups` is empty. Re-subscribes when the group set changes and
+ * unsubscribes on unmount. Callback identities are held in refs, so passing new
+ * inline `onEvent`/`onResync` closures every render does NOT churn the subscription.
+ */
+declare function useClientPushSubscription(options: UseClientPushSubscriptionOptions): void;
+
+/** Current-user identity for a mounted plugin surface, bound by the host. */
+interface HostIdentityUser {
+    id: string;
+    firstName: string;
+    lastName: string;
+    fullName: string;
+    isExternal: boolean;
+}
+/** One resolved permission grant (bitMask over the plugin's PermissionMask bits). */
+interface HostPermission {
+    groupCode: string;
+    bitMask: number;
+}
+/** Host-provided identity context for the mounted surface. */
+interface HostIdentity {
+    /** null while host auth is still loading (see isLoading) OR when unauthenticated. */
+    user: HostIdentityUser | null;
+    /** true while the host's /auth/user resolution is in flight — disambiguates loading from unauthenticated. */
+    isLoading: boolean;
+    /** The mounted surface's OWN grant only, or null when the user has no grant for this extension. */
+    permission: HostPermission | null;
+    /** The mounted surface's own extension groupCode, host-bound from the trusted manifest. */
+    extensionGroupCode: string;
+    /**
+     * The active organisation id for the mounted surface, or null while host auth is loading /
+     * unauthenticated. Host-bound from the SPA's active-organisation context. Surfaces that scope
+     * realtime subscriptions or org-keyed queries read this (e.g. the chat client-push gate); it is
+     * NOT a security token — the plugin backend derives org from the server session independently.
+     */
+    organisationId: string | null;
+}
+/**
+ * `null` = no host channel (standalone/mock, or a host that predates the identity seam) →
+ * {@link useHostIdentity} returns null and the plugin falls back to its deny-by-default path.
+ * Provided by {@link ExtensionRuntimeProvider}'s optional `identity` prop.
+ */
+declare const HostIdentityContext: react.Context<HostIdentity | null>;
+/** Returns the host identity for the mounted surface, or null when no host context is present. */
+declare function useHostIdentity(): HostIdentity | null;
+
+/**
+ * A host-supplied realtime subscription source for a plugin.
+ *
+ * The SDK keeps this intentionally dumb — it only calls `source.subscribe`.
+ * All SignalR wiring, extensionId filtering, and connection lifecycle management
+ * live host-side (Task 6 in coreconnect-web). This lets the SDK be tested with
+ * a simple fake source.
+ */
+interface PluginRealtimeSource {
+    /**
+     * Subscribe to notifications whose `typeCode` matches the given value.
+     *
+     * @param typeCode  The application-level event type code to filter on
+     *                  (e.g. `"HelpdeskTicketCreated"`). Filtering by
+     *                  extensionId is the host's responsibility.
+     * @param handler   Called with the raw notification payload whenever a
+     *                  matching notification arrives.
+     * @returns         An unsubscribe function. Calling it removes this handler.
+     */
+    subscribe(typeCode: string, handler: (payload: unknown) => void): () => void;
+}
+/**
+ * React context carrying the plugin's active {@link PluginRealtimeSource}.
+ *
+ * `null` is the explicit "not provided" sentinel — hooks must treat null as a
+ * clean no-op (dev/mock/no-connection) rather than an error.
+ *
+ * Provided by {@link ExtensionRuntimeProvider} when the host passes a
+ * `realtime` prop; consumed by `usePluginRealtimeSource()`.
+ */
+declare const PluginRealtimeContext: react.Context<PluginRealtimeSource | null>;
+/**
+ * Returns the {@link PluginRealtimeSource} from context, or `null` when none
+ * is wired (dev/mock environments, unit tests that only care about MCP).
+ *
+ * Hooks built on top of this (e.g. `usePluginRealtime` in `plugin-ui`) should
+ * skip their subscription entirely when this returns `null`.
+ */
+declare function usePluginRealtimeSource(): PluginRealtimeSource | null;
+
 interface ExtensionRuntimeProviderProps {
     transport: McpTransport;
+    /**
+     * Optional host realtime channel consumed by {@link useClientPushSubscription}.
+     * Absent (or `null`) in standalone/mock hosts and hosts that predate client-push,
+     * in which case the hook is inert. The host binds this channel to the mounted
+     * surface's trusted extension + organisation identity.
+     */
+    clientPush?: ClientPushChannel | null;
+    /**
+     * Optional host identity/permission context consumed by {@link useHostIdentity}.
+     * Absent (or `null`) in standalone/mock hosts and hosts that predate this seam,
+     * in which case the hook is inert. The host binds this to the mounted surface's
+     * trusted extension identity and forwards only that extension's own grant.
+     */
+    identity?: HostIdentity | null;
+    /**
+     * Optional realtime subscription source supplied by the host.
+     *
+     * When provided, descendant components can call `usePluginRealtimeSource()`
+     * to obtain it and subscribe to push notifications. When omitted (dev/mock
+     * environments or plugins that don't need realtime), the context defaults
+     * to `null` and consumers no-op cleanly.
+     */
+    realtime?: PluginRealtimeSource;
     children?: ReactNode;
 }
 /**
@@ -19,7 +197,7 @@ interface ExtensionRuntimeProviderProps {
  * over the context value — useful for tests and for plugins that want to
  * shard work across multiple hosts.
  */
-declare function ExtensionRuntimeProvider({ transport, children }: ExtensionRuntimeProviderProps): ReactNode;
+declare function ExtensionRuntimeProvider({ transport, clientPush, identity, realtime, children }: ExtensionRuntimeProviderProps): ReactNode;
 
 interface UseMcpResourceOptions {
     /**
@@ -445,4 +623,4 @@ interface UseFrontendSessionTokenResult {
  */
 declare function useFrontendSessionToken(transport: McpTransport): UseFrontendSessionTokenResult;
 
-export { BridgeClientContext, type CreatePortMcpTransportOptions, type CreateRemoteRootOptions, type DeclarativePluginConfig, type EthisysPluginConfig, ExtensionRuntimeProvider, type ExtensionRuntimeProviderProps, type ItemsResponse, LocalePayload, McpTransport, PortBridgeClient, type PortShim, type RemoteRoot, ThemePayload, type UseFrontendSessionTokenResult, type UseMcpQueryOptions, type UseMcpQueryResult, type UseMcpResourceOptions, type UseMcpResourceResult, type UseMcpToolOptions, type UseMcpToolResult, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useFrontendSessionToken, useMcpQuery, useMcpResource, useMcpTool };
+export { BridgeClientContext, type ClientPushChannel, ClientPushContext, type ClientPushEvent, type ClientPushSubscribeOptions, type CreatePortMcpTransportOptions, type CreateRemoteRootOptions, type DeclarativePluginConfig, type EthisysPluginConfig, ExtensionRuntimeProvider, type ExtensionRuntimeProviderProps, type HostIdentity, HostIdentityContext, type HostIdentityUser, type HostPermission, type ItemsResponse, LocalePayload, McpTransport, PluginRealtimeContext, type PluginRealtimeSource, PortBridgeClient, type PortShim, type RemoteRoot, ThemePayload, type UseClientPushSubscriptionOptions, type UseFrontendSessionTokenResult, type UseMcpQueryOptions, type UseMcpQueryResult, type UseMcpResourceOptions, type UseMcpResourceResult, type UseMcpToolOptions, type UseMcpToolResult, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };

package/dist/plugin/index.d.ts

@@ -6,8 +6,186 @@ import { SduiNode, RenderMode } from '@ethisyscore/protocol';
 import { RemoteConnection } from '@remote-dom/core';
 import '../bridge-envelopes-BRKGSiSC.js';
 
+/**
+ * A single client-push event delivered from the host to a plugin surface. The host
+ * relays the plugin backend's `IClientPushPublisher` events over its realtime
+ * channel (SignalR); the transport envelope's extension identity is bound by the
+ * host at mount time, so the plugin sees only the event body.
+ *
+ * SCOPE + ORDERING: which channel/user/group an event concerns is carried INSIDE
+ * `payloadJson` by the emitting plugin — the transport envelope intentionally has no
+ * group field. Consumers therefore demultiplex + order by their own payload fields
+ * (e.g. a per-channel sequence in the payload), NOT by {@link eventSequence}, which
+ * is per-group at the host and would produce false gaps when multiple groups
+ * multiplex over one connection.
+ */
+interface ClientPushEvent {
+    /** Plugin-defined discriminator, e.g. `"chatMessageReceived"`. */
+    eventType: string;
+    /** Raw JSON payload authored by the plugin backend. */
+    payloadJson: string;
+    /**
+     * Host per-group monotonic sequence. Advisory only — do NOT use for
+     * cross-group gap detection (see the scope note above).
+     */
+    eventSequence: number;
+}
+interface ClientPushSubscribeOptions {
+    /**
+     * Opaque group names to enrol in (e.g. `"chat:channel:{id}"`). The host
+     * authorises each subscription via the plugin's `authorize-subscription` tool
+     * and enforces org/extension isolation — a plugin cannot subscribe outside its
+     * own extension + organisation.
+     */
+    groups: string[];
+    /** Called for each delivered (non-resync) event for the subscribed groups. */
+    onEvent: (event: ClientPushEvent) => void;
+    /**
+     * Called when the host signals a gap/resync for the subscribed groups (a
+     * dropped-event backpressure signal, or a reconnect). The consumer should
+     * re-fetch authoritative state (e.g. a delta/cold-load) rather than trusting
+     * incremental events.
+     */
+    onResync?: () => void;
+}
+/**
+ * Host-provided channel for realtime server-push. The channel is already scoped to
+ * the mounted surface's extension + organisation (bound by the host from the trusted
+ * mount descriptor — a plugin CANNOT widen it), so {@link subscribe} takes only
+ * opaque group names and returns an unsubscribe function.
+ */
+interface ClientPushChannel {
+    subscribe(options: ClientPushSubscribeOptions): () => void;
+}
+/**
+ * `null` = no host channel (standalone/mock, or a host that predates client-push) →
+ * {@link useClientPushSubscription} is inert. Provided by
+ * {@link ExtensionRuntimeProvider}'s optional `clientPush` prop.
+ */
+declare const ClientPushContext: react.Context<ClientPushChannel | null>;
+interface UseClientPushSubscriptionOptions {
+    /** Opaque groups to subscribe. Changing the SET re-subscribes; identity/order changes alone do not. */
+    groups: string[];
+    onEvent: (event: ClientPushEvent) => void;
+    onResync?: () => void;
+    /** Gate the subscription (e.g. until an id is known). Default `true`. */
+    enabled?: boolean;
+}
+/**
+ * Subscribe a plugin surface to host client-push events for `groups`.
+ *
+ * Inert (no-op) when no host channel is present (standalone/mock), when `enabled` is
+ * false, or when `groups` is empty. Re-subscribes when the group set changes and
+ * unsubscribes on unmount. Callback identities are held in refs, so passing new
+ * inline `onEvent`/`onResync` closures every render does NOT churn the subscription.
+ */
+declare function useClientPushSubscription(options: UseClientPushSubscriptionOptions): void;
+
+/** Current-user identity for a mounted plugin surface, bound by the host. */
+interface HostIdentityUser {
+    id: string;
+    firstName: string;
+    lastName: string;
+    fullName: string;
+    isExternal: boolean;
+}
+/** One resolved permission grant (bitMask over the plugin's PermissionMask bits). */
+interface HostPermission {
+    groupCode: string;
+    bitMask: number;
+}
+/** Host-provided identity context for the mounted surface. */
+interface HostIdentity {
+    /** null while host auth is still loading (see isLoading) OR when unauthenticated. */
+    user: HostIdentityUser | null;
+    /** true while the host's /auth/user resolution is in flight — disambiguates loading from unauthenticated. */
+    isLoading: boolean;
+    /** The mounted surface's OWN grant only, or null when the user has no grant for this extension. */
+    permission: HostPermission | null;
+    /** The mounted surface's own extension groupCode, host-bound from the trusted manifest. */
+    extensionGroupCode: string;
+    /**
+     * The active organisation id for the mounted surface, or null while host auth is loading /
+     * unauthenticated. Host-bound from the SPA's active-organisation context. Surfaces that scope
+     * realtime subscriptions or org-keyed queries read this (e.g. the chat client-push gate); it is
+     * NOT a security token — the plugin backend derives org from the server session independently.
+     */
+    organisationId: string | null;
+}
+/**
+ * `null` = no host channel (standalone/mock, or a host that predates the identity seam) →
+ * {@link useHostIdentity} returns null and the plugin falls back to its deny-by-default path.
+ * Provided by {@link ExtensionRuntimeProvider}'s optional `identity` prop.
+ */
+declare const HostIdentityContext: react.Context<HostIdentity | null>;
+/** Returns the host identity for the mounted surface, or null when no host context is present. */
+declare function useHostIdentity(): HostIdentity | null;
+
+/**
+ * A host-supplied realtime subscription source for a plugin.
+ *
+ * The SDK keeps this intentionally dumb — it only calls `source.subscribe`.
+ * All SignalR wiring, extensionId filtering, and connection lifecycle management
+ * live host-side (Task 6 in coreconnect-web). This lets the SDK be tested with
+ * a simple fake source.
+ */
+interface PluginRealtimeSource {
+    /**
+     * Subscribe to notifications whose `typeCode` matches the given value.
+     *
+     * @param typeCode  The application-level event type code to filter on
+     *                  (e.g. `"HelpdeskTicketCreated"`). Filtering by
+     *                  extensionId is the host's responsibility.
+     * @param handler   Called with the raw notification payload whenever a
+     *                  matching notification arrives.
+     * @returns         An unsubscribe function. Calling it removes this handler.
+     */
+    subscribe(typeCode: string, handler: (payload: unknown) => void): () => void;
+}
+/**
+ * React context carrying the plugin's active {@link PluginRealtimeSource}.
+ *
+ * `null` is the explicit "not provided" sentinel — hooks must treat null as a
+ * clean no-op (dev/mock/no-connection) rather than an error.
+ *
+ * Provided by {@link ExtensionRuntimeProvider} when the host passes a
+ * `realtime` prop; consumed by `usePluginRealtimeSource()`.
+ */
+declare const PluginRealtimeContext: react.Context<PluginRealtimeSource | null>;
+/**
+ * Returns the {@link PluginRealtimeSource} from context, or `null` when none
+ * is wired (dev/mock environments, unit tests that only care about MCP).
+ *
+ * Hooks built on top of this (e.g. `usePluginRealtime` in `plugin-ui`) should
+ * skip their subscription entirely when this returns `null`.
+ */
+declare function usePluginRealtimeSource(): PluginRealtimeSource | null;
+
 interface ExtensionRuntimeProviderProps {
     transport: McpTransport;
+    /**
+     * Optional host realtime channel consumed by {@link useClientPushSubscription}.
+     * Absent (or `null`) in standalone/mock hosts and hosts that predate client-push,
+     * in which case the hook is inert. The host binds this channel to the mounted
+     * surface's trusted extension + organisation identity.
+     */
+    clientPush?: ClientPushChannel | null;
+    /**
+     * Optional host identity/permission context consumed by {@link useHostIdentity}.
+     * Absent (or `null`) in standalone/mock hosts and hosts that predate this seam,
+     * in which case the hook is inert. The host binds this to the mounted surface's
+     * trusted extension identity and forwards only that extension's own grant.
+     */
+    identity?: HostIdentity | null;
+    /**
+     * Optional realtime subscription source supplied by the host.
+     *
+     * When provided, descendant components can call `usePluginRealtimeSource()`
+     * to obtain it and subscribe to push notifications. When omitted (dev/mock
+     * environments or plugins that don't need realtime), the context defaults
+     * to `null` and consumers no-op cleanly.
+     */
+    realtime?: PluginRealtimeSource;
     children?: ReactNode;
 }
 /**
@@ -19,7 +197,7 @@ interface ExtensionRuntimeProviderProps {
  * over the context value — useful for tests and for plugins that want to
  * shard work across multiple hosts.
  */
-declare function ExtensionRuntimeProvider({ transport, children }: ExtensionRuntimeProviderProps): ReactNode;
+declare function ExtensionRuntimeProvider({ transport, clientPush, identity, realtime, children }: ExtensionRuntimeProviderProps): ReactNode;
 
 interface UseMcpResourceOptions {
     /**
@@ -445,4 +623,4 @@ interface UseFrontendSessionTokenResult {
  */
 declare function useFrontendSessionToken(transport: McpTransport): UseFrontendSessionTokenResult;
 
-export { BridgeClientContext, type CreatePortMcpTransportOptions, type CreateRemoteRootOptions, type DeclarativePluginConfig, type EthisysPluginConfig, ExtensionRuntimeProvider, type ExtensionRuntimeProviderProps, type ItemsResponse, LocalePayload, McpTransport, PortBridgeClient, type PortShim, type RemoteRoot, ThemePayload, type UseFrontendSessionTokenResult, type UseMcpQueryOptions, type UseMcpQueryResult, type UseMcpResourceOptions, type UseMcpResourceResult, type UseMcpToolOptions, type UseMcpToolResult, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useFrontendSessionToken, useMcpQuery, useMcpResource, useMcpTool };
+export { BridgeClientContext, type ClientPushChannel, ClientPushContext, type ClientPushEvent, type ClientPushSubscribeOptions, type CreatePortMcpTransportOptions, type CreateRemoteRootOptions, type DeclarativePluginConfig, type EthisysPluginConfig, ExtensionRuntimeProvider, type ExtensionRuntimeProviderProps, type HostIdentity, HostIdentityContext, type HostIdentityUser, type HostPermission, type ItemsResponse, LocalePayload, McpTransport, PluginRealtimeContext, type PluginRealtimeSource, PortBridgeClient, type PortShim, type RemoteRoot, ThemePayload, type UseClientPushSubscriptionOptions, type UseFrontendSessionTokenResult, type UseMcpQueryOptions, type UseMcpQueryResult, type UseMcpResourceOptions, type UseMcpResourceResult, type UseMcpToolOptions, type UseMcpToolResult, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };

package/dist/plugin/index.js

@@ -1,4 +1,4 @@
-import { createContext, useMemo, useState, useRef, useEffect, useCallback, useContext } from 'react';
+import { createContext, useContext, useRef, useEffect, useMemo, useState, useCallback } from 'react';
 import { jsx } from 'react/jsx-runtime';
 import { BatchingRemoteConnection } from '@remote-dom/core/elements';
 import ReactReconciler from 'react-reconciler';
@@ -6,10 +6,43 @@ import { LegacyRoot, DefaultEventPriority } from 'react-reconciler/constants.js'
 import { MUTATION_TYPE_UPDATE_TEXT, MUTATION_TYPE_UPDATE_PROPERTY, MUTATION_TYPE_INSERT_CHILD, MUTATION_TYPE_REMOVE_CHILD, NODE_TYPE_TEXT, NODE_TYPE_ELEMENT, ROOT_ID } from '@remote-dom/core';
 
 // src/plugin/ExtensionRuntimeProvider.tsx
+var ClientPushContext = createContext(null);
+function useClientPushSubscription(options) {
+  const { groups, onEvent, onResync, enabled = true } = options;
+  const channel = useContext(ClientPushContext);
+  const onEventRef = useRef(onEvent);
+  onEventRef.current = onEvent;
+  const onResyncRef = useRef(onResync);
+  onResyncRef.current = onResync;
+  const normalizedGroups = [...new Set(groups)].sort();
+  const groupsKey = JSON.stringify(normalizedGroups);
+  useEffect(() => {
+    if (!channel || !enabled || normalizedGroups.length === 0) {
+      return;
+    }
+    const unsubscribe = channel.subscribe({
+      groups: normalizedGroups,
+      onEvent: (event) => onEventRef.current(event),
+      onResync: () => onResyncRef.current?.()
+    });
+    return unsubscribe;
+  }, [channel, enabled, groupsKey]);
+}
+var HostIdentityContext = createContext(null);
+function useHostIdentity() {
+  return useContext(HostIdentityContext);
+}
+var PluginRealtimeContext = createContext(null);
+function usePluginRealtimeSource() {
+  return useContext(PluginRealtimeContext);
+}
 var ExtensionRuntimeContext = createContext(null);
-function ExtensionRuntimeProvider({ transport, children }) {
+function ExtensionRuntimeProvider({ transport, clientPush = null, identity = null, realtime, children }) {
   const value = useMemo(() => transport, [transport]);
-  return /* @__PURE__ */ jsx(ExtensionRuntimeContext.Provider, { value, children });
+  const push = useMemo(() => clientPush, [clientPush]);
+  const id = useMemo(() => identity, [identity]);
+  const realtimeValue = useMemo(() => realtime ?? null, [realtime]);
+  return /* @__PURE__ */ jsx(ExtensionRuntimeContext.Provider, { value, children: /* @__PURE__ */ jsx(ClientPushContext.Provider, { value: push, children: /* @__PURE__ */ jsx(HostIdentityContext.Provider, { value: id, children: /* @__PURE__ */ jsx(PluginRealtimeContext.Provider, { value: realtimeValue, children }) }) }) });
 }
 function useExtensionRuntimeTransport(override) {
   const fromContext = useContext(ExtensionRuntimeContext);
@@ -718,6 +751,6 @@ function useFrontendSessionToken(transport) {
   return { token, isLoading, error };
 }
 
-export { BridgeClientContext, ExtensionRuntimeProvider, createPortBridgeClient, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useFrontendSessionToken, useMcpQuery, useMcpResource, useMcpTool };
+export { BridgeClientContext, ClientPushContext, ExtensionRuntimeProvider, HostIdentityContext, PluginRealtimeContext, createPortBridgeClient, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map