internal/

Package account serves DELETE /v1/me: self-serve account deletion.

Package actionmetrics holds the Prometheus series for the closed-loop action broker (RFC 023 Observability).

Package actions implements the RFC 023 closed-loop action broker: the propose → approve → execute → watch machinery and the single-use, scoped, params-bound approval token that stands between the agent runtime and any money-moving product action.

Package agentchannels adapts inbound platform messages (RFC 027 channels) into durable agent sessions, funneling every message through the one canonical creation path (internal/agentsessions.Starter.CreateOrContinue) so a channel conversation threads to a single session.

Package agentgitops reconciles a declared repository of agent YAMLs to the desired state (RFC 028 P4): it diffs declared agents against the persisted managed_by=gitops definitions, repairs drift, and records agent_sync_state — mirroring internal/backgroundtaskschedule's reconciler (RFC 005).

Package agentregistry is the durable agent runtime's two-layer definition store (RFC 027):

Package agents serves the durable agent runtime HTTP surface (RFC 027): AgentDefinition CRUD and the agent-session lifecycle (create / submit turn / stream / events / approve / cancel) under /v1/*.

Package agentsessions owns the single canonical way a durable agent session is created and driven (RFC 027) — the analogue of internal/backgroundtaskruns.

Package agentspec is the versioned declarative authoring format for agents (RFC 028): the `apiVersion: agent.rowboat.dev/v1, kind: Agent` document, a strict YAML→JSON decoder, and the compile step that lowers a document into a neutral canonical form.

Package agentstream is the durable agent runtime's streaming layer (RFC 027): a Redis pub/sub fan-out for low-latency live deltas plus an NDJSON SSE handler that tails the AgentSessionEvent projection (the source of truth) and the bus together, backfilling missed events by seq and deduping by seq.

Package agenttoken mints and verifies the durable agent runtime's short-lived signed tokens (RFC 027 / RFC 012): per-invocation money-moving approval tokens (carrying the MFA step-up assertion) and session continuation tokens.

Package agentworkflow is the durable, multi-tenant agent runtime (RFC 027): a Temporal/Go analogue of eve.

Package appconfig loads process configuration from the environment.

Package auth holds request-scoped identity: the context helpers that carry the authenticated user (and the internal-caller flag) through a request, the JWT-verification middleware, and the WorkOS user upsert.

Package authmetrics holds the Prometheus series for the identity and authorization plane (RFC 011).

Package backgroundscheduler evaluates cron/window triggers for executionTarget=api background tasks inside the Oppulence API deployment, so scheduled cloud runs fire while the desktop is offline.

Package backgroundtaskmetrics holds Prometheus series for API-native background task (cloud) runs.

Package backgroundtaskruns owns the single canonical way an executor=api background-task run is created.

Package backgroundtaskruntime is the cloud-safe agent runtime for API background tasks (RFC 004): an LLM-backed, tool-scoped, limit-bounded execution loop that the Temporal worker's ExecuteAPITask activity delegates to.

Package backgroundtasks serves the cloud control plane mirror for desktop background tasks.

Package backgroundtaskschedule owns the Temporal Schedule lifecycle for exact-cron api-target tasks (RFC 005).

Package backgroundtaskworkflow contains the Temporal workflow used for API-native background task executions.

Package billing serves GET /v1/me, returning the user's plan, status and credit usage in the shape the desktop expects.

Package cloudevents implements RFC 003: cloud event ingestion and event-triggered cloud runs.

Package communicationsync projects Gmail and Google Calendar incremental feeds into the communication-intelligence metadata store.

Package composioapi provides the server-held, user-scoped Composio client.

Package config serves GET /v1/config — the public bootstrap document the desktop fetches before sign-in.

Package connectorcreds resolves a user's connector credential (the decrypted OAuth token) for durable-agent tools that act on the user's behalf (RFC 012).

Package connectormetrics contains bounded-cardinality broker metrics.

Package connectors implements the connector registry and the OAuth brokering endpoints (/v1/connectors, /v1/connections/*) plus the Ory pre-consent webhook and the internal force-disconnect endpoint.

Package console owns authenticated, durable console preferences and user-authored workspace artifacts.

Package credits holds credit-accounting math shared by the billing handler and the quota gate.

Package crypto provides application-layer AES-256-GCM sealing for columns that must be encrypted at rest (OAuth refresh tokens, parked payloads, vendor API keys).

Package db opens the ent client over Postgres (pgx) in production or a pure-Go SQLite database for local dev / tests, and installs the client-level hooks and interceptors that enforce audit logging, append-only ledgers, and per-user tenant isolation.

Package docs serves the rowboat-api OpenAPI document and API reference UI.

Package email is the transactional email boundary.

Package embeddings is a thin client for computing text embeddings against an OpenAI-compatible endpoint.

Package entities implements the org-scoped RFC 022 entity spine API.

Package entitymetrics holds bounded-cardinality RFC 022 entity-spine metrics.

Package faculties is the HTTP client for the Oppulence portfolio faculties (RFC 008): Conduit (the evidence plane) and Eigen (the foresight engine).

Package feedback serves POST /v1/feedback: it relays a signed-in user's message into Plain (plain.com) as a support thread (upsertCustomer + createThread).

Package google brokers the Google OAuth handoff.

Package googleapi is the shared client for server-side Google API calls made with a user's connected-account credentials: OAuth token exchange from the sealed refresh token, plus the narrow Gmail/Calendar/Drive read calls the cloud runtime's connector tools and the watch manager need.

Package googlechannel encodes account identity in Google Calendar and Drive watch IDs using only characters accepted by Google's channel API.

Package googlewatch keeps Google push subscriptions alive (RFC 003): for every connected Google account it registers — and renews before expiry — the Gmail users.watch, Calendar events channel, and Drive changes channel that make Google deliver pushes to /v1/webhooks/google.

Package gqlapi is the GraphQL server: gqlgen-generated execution + resolvers that delegate to the ent client, over the entgql-generated ent.graphql schema.

Package gqlid provides gqlgen marshalers for the uuid.UUID-backed GraphQL ID and UUID scalars.

Package httpx holds small HTTP response helpers shared by every handler: RFC 9457 problem details, JSON writers, bounded body readers, and idempotency-key helpers.

Package hubspotapi provides the server-held, user-scoped HubSpot CRM client.

Package llm is the OpenAI-compatible LLM gateway: it gates on credits, forwards to OpenRouter, streams responses back, settles the credit reservation against actual token usage, and records an LLMUsage row per call.

Package minutes meters a user's free cloud meeting-transcription minutes per UTC month (RFC 009 §16, Appendix O).

Package openapidoc enriches the ent-generated OpenAPI base document with runtime routes, examples, response contracts, and security metadata.

Package outbound centralizes policy for calls to external vendors.

Package parallel is a client for the Parallel Web Task API (RFC 039).

Package pricing maps usage to credits.

Package proxyutil holds small helpers shared by the vendor-proxy handlers (voice and search).

Package qualityguard checks Rowboat-specific architecture invariants that general-purpose Go linters cannot infer.

Package quota enforces credit limits with a reserve → settle/refund pattern.

Package ratelimit provides per-user, per-route-group rate limiting backed by a Redis fixed-window counter (production) or an in-memory counter (dev/test).

Package retention removes synced source content.

Package revenue implements the Rowboat side of RFC 030 (Revenue Memory and Outbound Governance): the relationship/action domain, the action-queue lifecycle with its hard invariants, and the client for the OutboundConsole preflight facade.

Package revenuemetrics holds the Prometheus series for the revenue memory and outbound governance plane (RFC 030 Observability).

Package search serves POST /v1/search/exa: a credit-gated pass-through proxy to Exa Search using the server-held x-api-key.

Package secrets is the vendor-key store.

Package securitytxt serves RFC 9116 security.txt.

Package server owns the HTTP lifecycle: the chi router + middleware chain, the public listener, the separate metrics listener, health probes, and graceful shutdown.

Package slack brokers the Slack workspace connect flow (OAuth v2).

Package slackclient is the minimal outbound Slack Web API client used by the durable agent runtime: it posts agent replies back into the originating Slack thread (RFC 027 channels — the CloudTag round-trip) and reads a thread's messages for Slack-native tools.

Package slacktoken resolves sealed Slack bot credentials for runtime use.

Package telemetry wires structured logging (zap) and tracing (OpenTelemetry).

Package transcription serves the per-user transcription quota the desktop reads to decide whether meetings stay on cloud or fall back to on-device (RFC 009 §16, Appendix O.6/O.8).

Package version holds build-time version metadata, stamped via -ldflags.

Package viewer carries the minimum request identity needed by persistence policies.

Package voice serves POST /v1/voice/text-to-speech/{voiceId}: a credit-gated proxy to ElevenLabs using the server-held xi-api-key.

Package voicecloud serves the Oppulence Voice control plane, opaque sync relay, and explicit capture-artifact ingestion boundary.

Package websearch is a minimal web-search client for the durable-agent web.search tool.

Package workosauth brokers the desktop's sign-in against WorkOS AuthKit.