Package-level declarations
Types
The outcome of an access check: proceed, or answer the caller with a code and a message.
The three gates every guarded verb passes, in order: the caller resolves to a package, the WebID has a live session, and the caller's grant covers the verb.
Decides whether an app may run a verb as a WebID. The host decides through its grants.
Remembers a delegate's answers for ttlMillis, because resolving a module's containers reads the type index and a granted app calls many times a second. A container created through the data-module binder is announced with invalidate, so the next check sees it.
The resolver over the library's two data modules.
Where a data module lives on an account's pod, so a grant on the module can cover the module's resources when a raw resource verb names one of them.
One target a verb needs at one minimum level. A verb with two targets carries two of these.
The access policy over scoped grants: the effective level for a call is the highest level among the grant entries that cover the call's target, and the call passes when that level includes the verb's minimum.
The minimum level each group of verbs needs, in one place so the binders and the developer docs read the same table.
What a verb is about, matched against the caller's grant.