Understand what plugin.http.runtime does, how auth policies work, and when runtime HTTP injection is the right tool

Plugin HTTP Injection

A plugin can declare:

http: {
  runtime: {
    authPolicies: [...],
    register({ app, getContext, pluginName }) {
      // register routes
    },
  },
}

What problem this solves

It lets a plugin declare:

and leaves server assembly to the runtime layer.

This describes:

The key idea is:

This is where the plugin adds its routes to the runtime Hono app.

The plugin does not need to start a server. It only contributes route registration.

The workboard plugin currently injects:

That is the clearest runtime HTTP plugin example in the current codebase.

Use it when:

you want a dedicated runtime HTTP endpoint
the endpoint belongs to one plugin capability surface
you want auth, availability, and control-plane identity to stay aligned with that plugin

If you only need:

then the built-in session HTTP layer should remain your first choice instead of building a parallel plugin HTTP interface.