internal/

Package accessroute validates and renders the deliberately small language used to publish selected paths through an otherwise protected resource.

Package adoption maps unmanaged Docker resources onto the AkerDock model (PRD §20.7, ADR-013).

Agent loop (ADR-040 phase 1): the helper pushes outbound observations — Docker state transitions of managed containers, scale-to-zero wakes, a heartbeat — to the control plane over HTTPS, authenticated by a per-server token injected at container creation.

Package agentrelay reaches a server's agent channel from a process that does not terminate it — worker, scheduler (ADR-052 §8).

Package agentwire defines the wire protocol of the agent channel: the ADR-041 observation frames (v1) and the ADR-052 typed command frames (v2).

Package api provides primitives to interact with the openapi HTTP API.

Package audit records the append-only audit trail of §23.4 and the transactional outbox events of §24.2.

Package auth implements the bearer-token authentication and permission model of the public API (§10.3): team-scoped tokens with granular permissions, SHA-256 hashed with an identification prefix.

Package bootstrap implements the first-start seeding of instance-config §6.2/§6.3: instance_settings singleton and root user.

Package cli implements the local `akerdock` client subcommands (ADR-031, ADR-032, ADR-033, spec docs/specs/cli.md).

Package compose parses, validates and transforms the Docker Compose subset of compose-spec.md.

Package config loads and validates the instance configuration following docs/specs/instance-config.md: environment variables take precedence over an optional YAML file (AKERDOCK_CONFIG_FILE), which takes precedence over compiled defaults.

Package cronexpr parses the 5-field cron expressions of the backup plans (§7.1) and computes their next occurrence in a given timezone.

Package dockerruntime is the single Docker runtime adapter (PRD §18.1, ADR-004, ADR-051): every Docker Engine API call AkerDock makes — from the control plane's jobs and handlers or from the server agent — goes through the Runtime interface.

Package envelope implements the multi-version master key file (instance-config §3) and the envelope encryption format of every *_enc column (data-dictionary §2.7, ADR-003).

Package events publishes the transactional outbox (§18.2, §24.2) and fans the published events out to the SSE subscribers of each team (ADR-024).

Package gitforge implements the degraded preview feedback path (§20.4.6, protocols §4.4/§6.3): commit statuses and ONE upserted comment against the GitLab and Gitea APIs, authenticated by a provider API token stored on the git source.

Package githubapp implements the GitHub App integration of git-webhook-protocols.md §2: manifest conversion, App JWTs, installation access tokens, repository discovery and the rich preview feedback (checks, deployments, upserted PR comment).

Package gitwebhook receives and authenticates the webhooks Git providers send (spec git-webhook-protocols).

Agent ingestion (ADR-040 phase 1): the server helper POSTs observation batches here, authenticated by its per-server token.

The ADR-055 phase-2 build primitive, agent side: a BuildKit build driven against the LOCAL daemon's embedded builder — the exact rail `docker build` uses — with the context read from the mounted tree.

Package httpapi holds the shared HTTP plumbing of the public API: the single Error schema of §24.1 and JSON response helpers.

Package httpserver serves the single control-plane port (ADR-021, instance-config §2.1 AKERDOCK_PORT).

Package instance caches the instance_settings singleton.

Scale-to-zero provisioning (ADR-036): deploy the agent helper (born akerdock-waker, renamed by ADR-056) container in front of a preview and maintain its shared routing table.

Package logredact wraps a slog.Handler to mask the values of sensitive attributes before they are written anywhere (§23.4, INV-003, ISO A.8.12).

Package mcp implements the built-in Model Context Protocol server (ADR-043, PRD §12): JSON-RPC 2.0 over Streamable HTTP, ten READ-ONLY tools scoped to one team.

Package notify turns an outbox event into a message on a channel (§11, ADR-019).

Package oidc implements the relying-party side of the dashboard's federated login (PRD §10.2): OpenID Connect for Google, Azure and a generic IdP, plain OAuth2-plus-userinfo for GitHub, GitLab and Bitbucket.

Package password hashes user passwords with Argon2id (PRD §23.2) using the PHC string format, so parameters can evolve without a schema change.

Package pguuid bridges pgtype.UUID with the string form used by the API and generates application-side UUIDs (needed when the envelope AAD must bind a ciphertext to its row uuid before the insert).

Package pki mints the per-server certificate authority that signs the TLS certificates of the managed databases (§6.3).

Package postgres opens the application pool and applies the embedded migrations, following the startup sequence of instance-config §6.1.

Package proxy implements the intermediate representation of docs/specs/proxy-contract.md and its Traefik generation (P0).

Package queue implements the durable PostgreSQL job queue of ADR-002: enqueue with idempotency keys, FOR UPDATE SKIP LOCKED dequeue, leases with heartbeat, bounded retries with jitter, and a dead letter (§21.3).

Package s3 speaks just enough of the S3 REST API to store and retrieve database backups: PUT, GET, HEAD, DELETE and a listing of one prefix.

Package safedial hardens outbound HTTP against SSRF (PRD §23.3, ISO A.8.23): a request whose URL comes from a low-privilege user must never reach the control plane's own network — loopback, private ranges, link-local (including the cloud metadata endpoint 169.254.169.254), CGNAT space, or the unspecified address.

Package scheduler runs the instance maintenance crons (§18.2): retention purges and proxy drift reconciliation.

Package scim implements the JSON contract of SCIM 2.0 (RFC 7643/7644) used to provision and deprovision users from an identity provider (ISO A.5.16/A.5.18).

Package serverdial opens the SSH connection to a managed server: the provisioned private key comes from the store, is decrypted by the keyring, and the server's host key is pinned (§20.1).

Package session implements browser authentication for the dashboard (PRD §698): a login endpoint, HttpOnly session cookies, CSRF protection, session rotation and lockout.

Package sshexec runs commands on target servers over SSH (§3.1).

Package sshkey parses and generates SSH key material (PRD §3.1: keys without passphrase, public part and SHA256 fingerprint derived from the private material).

Package telemetry wires traces, metrics and logs to an OTLP endpoint (ADR-008: "OTLP everywhere, no proprietary protocol").

Package terminal bridges a WebSocket connection to a remote PTY (§24.4, ADR-024).

Package totp implements RFC 6238 time-based one-time passwords over the RFC 4226 HOTP construction, for the dashboard's 2FA (PRD §10.2, §23.3).

Package tunnel bridges a WebSocket to TCP streams multiplexed over it (ADR-032, subprotocol akerdock-tunnel-v1).

Package uptime implements the integrated uptime monitoring of ADR-017: simple HTTP/TCP probes run from the control plane — outside the monitored workload, which is the whole point: a struggling server must not be the one vouching for its own workloads — and a threshold-based state machine whose transitions ARE the anti-flapping.

Package web serves the dashboard from the single port of the control plane (§27.1, ADR-021): UI, API, SSE and terminal all live behind one port, so an operator opens one URL and a reverse proxy has one thing to forward.