Module widgets 

Permissioned widget manifests, signed catalogue data, and safe package installation.

Structs

Catalogue

The signed list of reviewed widgets.

CatalogueEntry

A widget listed in the catalogue.

InstalledMetadata 🔒

Install record written to .installed.json beside the manifest.

InstalledWidget

A widget installed on this device.

WidgetManifest

A widget’s widget.json.

WidgetProcess

A process a widget declares.

Enums

WidgetPermission

An action a widget may be granted, named as in manifests.

Constants

MAX_ARCHIVE_BYTES 🔒

Largest widget package download, in bytes.

MAX_EXPANDED_BYTES 🔒

Largest total size of a package’s extracted files, in bytes.

MAX_FILES 🔒

Most entries a package may contain.

Functions

discover_installed

Reads every installed widget, sorted by ID. Hidden folders, such as staging folders, are skipped, and each unreadable widget yields an error.

extract_archive 🔒

Extracts a ZIP into staging, rejecting unsafe or duplicate paths, symlinks, too many entries, and oversized content.

install_archive

Installs a widget package, replacing any installed version only after every check passes.

read_installed 🔒

Reads an installed widget and checks its install record, including that widget.json hasn’t changed since install. Debug builds accept widgets without a record.

read_manifest 🔒

Reads and validates widget.json, which may be at most 128 KB.

replace_atomically 🔒

Moves staging to destination, keeping the old folder in backup and restoring it if the move fails.

uninstall_widget

Removes an installed widget’s folder. A missing widget succeeds.

validate_archive_path 🔒

Rejects archive paths with parent, root, or drive components.

validate_https_origin 🔒

Accepts bare HTTPS origins, such as https://example.com, without a path, query, or credentials.

validate_process_id 🔒

Accepts IDs of 1 to 64 ASCII letters, digits, _, and -.

validate_relative_file 🔒

Requires a non-empty relative path that doesn’t leave the package.

validate_sha256 🔒

Requires 64 hex characters.

validate_widget_id 🔒

Accepts IDs of 1 to 64 lowercase letters, digits, and underscores.

verify_signature 🔒

Verifies a base64 Ed25519 signature with a base64 raw 32-byte public key.

write_installed_metadata 🔒

Writes .installed.json for a staged widget.