internal/

Package admin is the Admin API: its routes, administrator authentication and sessions, the Host, Origin and CSRF checks, the sign-in throttle, password hashing, the status, history, monitoring and security log reads, and the handlers that ask the controller for changes.

Package adminui holds the Dashboard's built files for a release build.

Package audit is the gateway's durable security log: one JSON record per request decision, administrator action and log event, appended to rotating files and synced to disk.

Package compile turns a policy document into an immutable generation: the route table, permits, rate rules and compiled body and header schemas that every request is decided against.

Package controller is the only authority that changes what the gateway enforces: it owns the database and the audit log of a deployment, compiles policy generations and publishes them, runs Confirmed Policy Activation and Temporary Policy Overrides with their deadlines and startup recovery, and publishes trust keys, blocked accounts and blocked addresses.

Package demoports applies the process's EAT_PORT_OFFSET to fixed local demonstration addresses.

Package fault holds the fault-injection points that tests use to crash, delay or fail the gateway at exact places.

Package forward sends an admitted request to the one upstream it is bound to, through the standard library's reverse proxy, and names what a failed exchange means for the gateway's answer.

Package gateway is the security policy gateway: its HTTP server and reverse proxy, the request pipeline that applies the five security controls (token verification, role permits, rate limits, request validation and the security event log), the policy compiler and controller with confirmed policy activation and temporary overrides, the SQLite store, the protected Admin API and the local operator commands.

Package gatewaytest is the test harness for the gateway: it builds the gateway, fixture and demo programs once per test binary, runs each test's gateway as its own process with a disposable deployment (database, security log, configuration file, listeners and upstream receivers), and gives tests clients for the data plane and the Admin API, readers for the security log and the database, and the policies the tests share.

Package issuertest is the token issuer tests stand in for: it generates an RSA signing key in memory for each run, never writes it anywhere, and signs the tokens the gateway's verifier is tested against.

Package monitor observes the gateway without deciding anything: the bounded window of recent requests and its live views, request metrics, traffic summaries, the fixed advice checks, impact previews and the security log search.

Package openapi turns an OpenAPI 3.0 or 3.1 description, in JSON or YAML, into a candidate policy document and a report of what it mapped, assumed, changed and refused.

Package operator runs the gateway's local operator commands: install, enrol, migrate, backup and restore.

Package pipeline is the data-plane request pipeline: it decides every request against the one generation it captures and forwards only a request that passed every stage, after its audit record is durable.

Package policy defines the policy document an administrator writes: its types, its strict JSON decoding and the limits and identifier formats every policy must meet.

Package session holds the administrator sessions of the Admin API in memory and makes the random tokens the Admin API and the operator commands hand out.

Package store is the gateway's one authoritative database: policy versions, draft changes and trials, temporary rules, blocked accounts, administrators and the durable receipt of every change, in SQLite with write-ahead logging.

Package storetest is test support only, never imported by production code: it seeds a disposable gateway database whose confirmed revision is a given policy, optionally with a provisional revision and its deadline and an administrator, reads single values back for assertions, and builds the small test policies the seeds use.

Package testfixture implements the three controlled REST APIs that sit behind the gateway in its security, proxy, concurrency and crash regressions: orders, inventory and reports.