Current state: a plugin holds its protected routes to one scope area by implementing sdk.AreaProvider, and the host treats an empty area as no declaration, so the route guard is skipped entirely. Nothing validates the value at startup. In this repo the arm is dead because only the WhatsApp plugin declares an area, but a third party deriving its area from configuration and finding it unset would fail open with no signal at all.
Proposal: decide whether an empty area is an error or a deliberate opt-out, then either refuse it when the host collects the areas or say plainly in the SDK contract that it means unguarded.
Trigger: the plugin route guard shipped with the empty case undecided.
Current state: a plugin holds its protected routes to one scope area by implementing
sdk.AreaProvider, and the host treats an empty area as no declaration, so the route guard is skipped entirely. Nothing validates the value at startup. In this repo the arm is dead because only the WhatsApp plugin declares an area, but a third party deriving its area from configuration and finding it unset would fail open with no signal at all.Proposal: decide whether an empty area is an error or a deliberate opt-out, then either refuse it when the host collects the areas or say plainly in the SDK contract that it means unguarded.
Trigger: the plugin route guard shipped with the empty case undecided.