internal/

Package configfile reads apic generator configs in JSON or YAML and normalises them to JSON bytes — the only form the generator, the schema validator, and the MCP config tools ever see.

Package configschema derives the published JSON Schema (schema/apic-config.schema.json) from the generator's config model, and validates JSON/YAML configs against it.

Package corpusgen produces deterministic edge-case seed values from neutral schema/auth constraints.

GraphQL config validators, split out of config_validate.go to keep each file focused (QG-086 / QG-050 file-size gate).

Package genheader is the single Go source of the generated-code marker apic stamps on every file it emits and of the regex the repo's guards use to detect it.

Package ginsrv holds the handful of Gin-server building blocks that are byte-for-byte identical between the api package (the framework-level server) and pkg/htpx (a parallel, independently-versioned fork retained for backward compatibility -- see pkg/htpx/VENDORED.md for the fork policy).

Package jwtalg is the canonical JWS algorithm-confusion guard shared by the OIDC/JWKS verification paths in api/oidc.go and pkg/htpx/oidc.go, which previously each carried a byte-identical private copy of the asymmetric allowlist plus the unverified-header parse (QG-060/QG-081).

Package webauthntestca materializes a synthetic, self-signed WebAuthn attestation trust-anchor certificate for the repo's fixture configs (configs/webauthn-passkey.json, configs/fedramp-baseline.json, configs/webauthn-and-webhook-combo.json, configs/webauthn-passkey-hardened.json), each of which points security.webauthn.attestation_roots_path at configs/testdata/webauthn-attestation-roots.pem (R10-2 step 4; APPSEC-14 requires the pairing whenever aaguid_allow_list is non-empty; webauthnx.NewServer fails closed on a nil pool).