internal/

Package admin serves the local-only web console for operating a running bridge instance — adding/removing library roots, pairing/revoking client devices, and surfacing scan + uptime stats.

Package adminauth manages the admin console's single-user authentication layer: bcrypt-hashed credentials persisted to disk, in-memory session tokens, and a per-(IP, username) login rate limiter.

Package advertise enumerates every network endpoint a running bridge is reachable at — LAN IPv4 / IPv6, mDNS hostname, Tailscale interface — so /v1/health can self-report the full list to iOS clients, and the admin pairing QR can bake alternates into `bridge://pair?urls=...`.

Package analyze owns the bridge's offline audio analysis: decoding a source file to PCM via sox(1), reducing it to a compact peak waveform sidecar, and the worker pool the `bridge analyze` CLI and the serve-side background pass share.

Package api implements the HTTP/2 handlers for the v1 wire protocol (see PROTOCOL.md at the repo root).

Package atlasharvest is the bridge side of the Phase-H bridge-driven bulk harvest.

Package atomicwrite provides the tmp-file-then-rename helper the scanner and enricher both use to commit cached JPEGs to disk without a concurrent reader ever observing a torn file.

Package auth manages bearer tokens: generation, hashed storage, and request-time validation.

Package backup snapshots and restores the bridge's state directory.

Package config loads and validates bridge.yaml (library roots, listen address, TLS paths, scan interval).

Package dlna implements a UPnP/DLNA MediaServer surface that lets spec-compliant network audio renderers (Chord 2go, Lumin, dCS Network Bridge, Auralic Aries, Bluesound, Eversolo, …) discover and stream the bridge's library bit-exact.

Package doctor runs environment preflight checks for `bridge init` and `bridge doctor`.

Package dsn builds SQLite URI DSN strings that safely encode filesystem paths containing URL-reserved characters (?, #, %) across POSIX and Windows.

Package enrich looks up external metadata (MusicBrainz, Cover Art Archive) for tracks that are missing MBIDs or artwork, then updates the manifest store.

Package fs resolves client-supplied relative paths against a configured library root and rejects LEXICAL traversal (`..`, absolute paths, NUL bytes).

Package fsutil holds small cross-cutting filesystem helpers shared across the bridge — today the durability barrier (file + parent-dir fsync) that producers of on-disk sidecars run before committing the SQLite row that points at the freshly-written file.

Package integrity contains the bridge's proactive consistency watchers — long-lived goroutines that walk durable state on a schedule and reconcile drift between what the bridge thinks exists (SQLite manifest, track_variants table) and what actually exists on disk.

Package logging owns the bridge's structured-logging entry point.

Package lrucache implements a small bounded LRU cache safe for concurrent use.

Package manifest owns the library index: the SQLite-backed store, per- format tag extractors (FLAC / DSF / ALAC / WAV / MP3), and the filesystem scanner that drives them.

Package mdns advertises the bridge on the local network as _onebit-bridge._tcp.local.

Package metrics is the Prometheus exposition surface for the bridge.

Package packaging renders service-manager unit files (launchd plist on darwin, systemd user unit on linux) and installs them where the user's service manager expects to find them.

Package pairing implements the in-memory state machine for the admin-approval pairing flow.

Package smartplaylist generates server-side "smart" / dynamic playlists (Heavy Rotation, Auto Mix, Forgotten Favorites, time-of-day, Daily Mix, The Finish Line) from playback-history aggregations + offline audio analysis.

Package smartplaylistgen orchestrates smart-playlist regeneration: it assembles the pure engine's Inputs from manifest.Store aggregations, runs internal/smartplaylist.Generate, and writes the populated families to the `smart_playlists` cache.

Package supervision answers a single runtime question: "if this process calls os.Exit(0), will something relaunch us?"

Package tailscale wraps the small surface area of the Tailscale CLI the bridge needs for HTTPS auto-pilot: detecting whether Tailscale is installed and what the local node's MagicDNS name is, and minting an HTTPS certificate via `tailscale cert`.

Package tls mints a self-signed certificate on first run and loads existing cert/key material on subsequent runs.

Package tlsacme wraps `golang.org/x/crypto/acme/autocert` with the glue the bridge needs to participate in `internal/tls.Manager`'s SNI switcher:

Package transcode owns offline PCM-upscaling: building sox(1) invocations, choosing variant identifiers + sidecar paths, and the worker pool the CLI subcommand and (in Phase 2.5) the HTTP `POST /v1/upscale` handler share.

Package tsnet wraps the upstream tailscale.com/tsnet library so the bridge can run as its own embedded tailnet node — no external `tailscaled` daemon, no CLI shell-out, no on-disk Let's Encrypt cert files.

Package updater polls the GitHub Releases API for newer 1-bit-bridge builds and drives the full self-update lifecycle: poll → download → SHA-256 verify (always) → platform signature verify (macOS Apple codesign + Team-ID; Linux/Windows currently TLS-of-checksums.txt only, see verify_other.go for the seam where Sigstore / minisign / SignPath would land) → swap (atomic rename on Unix; live rename + caller-driven restart on Windows, see swap_windows.go — note this is NOT the MoveFileEx/MOVEFILE_DELAY_UNTIL_REBOOT "pending rename" mechanism) → arm rollback marker.

Package upnp is the bridge's UPnP/DLNA control-point client toward an UPSTREAM MediaServer (e.g.

Package upnpingest is the orchestration layer that turns a discovered upstream UPnP MediaServer into rows in the bridge's manifest store.

Package upnpproxy contains the HTTP byte proxy that fronts an upstream UPnP MediaServer's `<res>` URL with bit-exact passthrough.

Package version exports the server build version and the wire protocol version.