Struct WidgetPackages 

pub struct WidgetPackages {
    pub widgets_dir: PathBuf,
    approvals_path: PathBuf,
    pins_path: PathBuf,
    secret: String,
    inner: Mutex<Inner>,
}

srv’s view of the widgets folder and this instance’s approvals.

Fields

widgets_dir: PathBuf

approvals_path: PathBuf

pins_path: PathBuf

secret: String

inner: Mutex<Inner>

Implementations

impl WidgetPackages

pub fn new(widgets_dir: PathBuf, data_dir: &Path, secret: String) -> Self

pub fn install_global(self) -> &'static Arc<WidgetPackages>

pub fn rescan( &self, v1_entries: &HashMap<String, WidgetConfigType>, ) -> Vec<WidgetPackageInfo>

Scan again, with the v1 entries currently in the user’s widgets.json.

pub fn list(&self) -> Vec<WidgetPackageInfo>

pub fn approve( &self, id: &str, hash: &str, shown_signer: &str, ) -> Result<(), String>

Record the user’s approval of exactly hash, signed by the key whose fingerprint the prompt showed (shown_signer, “” for unsigned); the host-only route calls this. Fails if the package or its signature changed since the prompt was shown: widget.sig isn’t in the hash, so it is checked here (SPEC_WIDGET_SHARING_2026_10_10.md §2.3).

pub fn describe_signature( &self, id: &str, signer: Option<&str>, ) -> WidgetSignatureInfo

Who signed a package, against this instance’s pins.

pub fn approved_package( &self, id: &str, ) -> Result<(String, BTreeMap<String, Vec<u8>>), String>

An approved sandboxed package’s approved bytes, for a bundle export (SPEC_WIDGET_SHARING_2026_10_10.md §3.4): every file hashed again against the approval, never a newer copy on disk, and its widget.sig when it still names the approved signer.

pub fn publishers(&self) -> Vec<WidgetPublisherPin>

The publishers this instance has pinned to a key, for Settings.

pub fn forget_publisher(&self, publisher: &str) -> Result<(), String>

Forget a publisher’s key (the user’s Forget key, through the host route): its next signed package pins it again.

pub fn set_enabled(&self, id: &str, enabled: bool) -> Result<(), String>

pub fn forget(&self, id: &str) -> Result<(), String>

Forget a package’s approval (uninstall does this; so does a v1 entry leaving widgets.json, at the next rescan’s caller’s choice).

pub fn package_dir(&self, id: &str) -> Option<(PathBuf, bool)>

pub fn read_file( &self, id: &str, hash: &str, key: &str, path: &str, ) -> Result<Vec<u8>, FileError>

The bytes of path in package id, if hash and key name its approved version and the file on disk still matches that approval (hashed now, not trusted from the last scan).