Module widget_access 

What a sandboxed widget can reach through srv (docs/specs/SPEC_USER_WIDGETS_AND_WIDGET_API_2026_10_09.md §6.3, §11).

The widget itself never talks to srv: its pane host does, for the calls that need srv (storage, net, agents). Each pane gets a session token when it opens. The token is no credential anywhere else; it names one package at the hash the user approved, and every call checks again that the package is still approved at that hash, enabled, and granted the permission the call needs, whatever the frontend already checked.

Structs

AccessError

Session

Sessions

State 🔒

Constants

ERROR_PREFIX

Errors reach the pane host as widget-error: and a JSON object { code, message, data? }, the bridge’s own error (§6.6).

MAX_SESSIONS 🔒

SENDS_PER_MINUTE

SEND_MAX_BYTES

STORAGE_KEY_MAX_BYTES

STORAGE_MAX_BYTES

STORAGE_VALUE_MAX_BYTES

Functions

check_key

A storage key: non-empty, at most 256 bytes.

require

Refuses unless pkg was granted permission.

runnable 🔒

The package as it is now, if it may run at all: approved, at this hash, sandboxed (a trusted widget runs in the app and needs no session).

sessions