api/

Package agentpush isolates the live-push flow that builds a workspace's secret batch (session-independent, via the one builder) and delivers it to the running workspace pod's agentd via HTTP.

Package contractstream is the API-side on-demand proxy of a pod's ABI contract stream (US-69.10, design 0055 S3/D1-B): one upstream connection per workspace while ≥1 browser subscriber is attached, fanning raw StreamFrames out to every subscriber.

Package database — query tracer.

Package email provides the orchestration layer for outbound transactional email.

Package health runs the API server's periodic dependency health probe.

Package outbox implements the D3 durable-prompt outbox (design 0050, #907): accept-then-deliver decoupling so a client disconnect can never lose an accepted message.

Package passkey implements WebAuthn / FIDO2 passkey registration and login (Epic 59) plus the one-time-use recovery-code fallback for passkey-only users.

Package secretautopush wires the workspace watcher's per-CRD-event callback to a fire-and-forget push of the workspace's secret batch to the workspace pod's agentd.

Package sessionalerts persists D6 (#998) hung-session escalations to the session_alerts table.

Package shadowconsumer is the Epic 69 S1 shadow consumer (US-69.5): the API subscribes on-demand to a pod's ABI stream with the reference client, folds it, and diffs the fold against its own API-side dialect derivation (ReferenceFold — the proxy-tracker semantics).

Package sso implements OIDC single sign-on for organizations (US-43.10, D17).

Package wsstate holds the per-workspace state that ProxyHandler previously kept in process-local maps.

Package testharness is the single source of Postgres + Redis wiring for the API service's integration tests.