Directories
¶
| Path | Synopsis |
|---|---|
|
Package admission holds the chassis's pre-pipeline admission gates: a per-tenant runtime-state check (a suspended or disabled tenant is denied before its stack runs), per-tenant node-local rate-limit and concurrency caps, and a process-level drain flag (signal-driven; bleeds the node out of a load balancer).
|
Package admission holds the chassis's pre-pipeline admission gates: a per-tenant runtime-state check (a suspended or disabled tenant is denied before its stack runs), per-tenant node-local rate-limit and concurrency caps, and a process-level drain flag (signal-driven; bleeds the node out of a load balancer). |
|
Package allowance is a tenant's own fuel budgets inside its tenant budget.
|
Package allowance is a tenant's own fuel budgets inside its tenant budget. |
|
Package app is the chassis entrypoint, factored out of cmd/txco so a downstream build (e.g.
|
Package app is the chassis entrypoint, factored out of cmd/txco so a downstream build (e.g. |
|
Package apppass is the app-password mechanism the stateful personalities share: argon2id hashing in PHC form, constant-time verification, a dummy verify that hides account existence, two generators (a grouped token and a BIP-39 word phrase), and a verified-login cache.
|
Package apppass is the app-password mechanism the stateful personalities share: argon2id hashing in PHC form, constant-time verification, a dummy verify that hides account existence, two generators (a grouped token and a BIP-39 word phrase), and a verified-login cache. |
|
Package artifact is the content-addressed artifact store: where snapshot (and future event) artifacts live.
|
Package artifact is the content-addressed artifact store: where snapshot (and future event) artifacts live. |
|
filestore
Package filestore is the local-filesystem artifact backend: the built-in default, zero infrastructure, directly inspectable.
|
Package filestore is the local-filesystem artifact backend: the built-in default, zero infrastructure, directly inspectable. |
|
Package attach is the seam behind an attached transport: a live resource inside a workspace bound to one external connection for as long as a lease allows, with the stack having authorized the binding ONCE rather than running on every byte.
|
Package attach is the seam behind an attached transport: a live resource inside a workspace bound to one external connection for as long as a lease allows, with the stack having authorized the binding ONCE rather than running on every byte. |
|
Package auth carries the request-scoped auth context plus its helpers.
|
Package auth carries the request-scoped auth context plus its helpers. |
|
policy
Package policy gates handlers behind capability checks.
|
Package policy gates handlers behind capability checks. |
|
registry
Package registry reads (and minimally mutates) the actor / actor_keys / tenants / actor_memberships tables.
|
Package registry reads (and minimally mutates) the actor / actor_keys / tenants / actor_memberships tables. |
|
signature
Package signature is the chassis-owned wrapper around RFC 9421 HTTP message signatures.
|
Package signature is the chassis-owned wrapper around RFC 9421 HTTP message signatures. |
|
throttle
Package throttle is a small per-key fixed-window rate limiter.
|
Package throttle is a small per-key fixed-window rate limiter. |
|
Package authn is the stack-plane identity store: the users, principal bindings and credentials a TENANT's stacks manage, and that the protocol heads authenticate against.
|
Package authn is the stack-plane identity store: the users, principal bindings and credentials a TENANT's stacks manage, and that the protocol heads authenticate against. |
|
authntest
Package authntest holds the identity store's behaviour suite and the helpers to stand a store up in a test.
|
Package authntest holds the identity store's behaviour suite and the helpers to stand a store up in a test. |
|
Package bgservice is the chassis seam for long-running background services that an overlay registers and the chassis owns — started with the other controllers and drained on shutdown.
|
Package bgservice is the chassis seam for long-running background services that an overlay registers and the chassis owns — started with the other controllers and drained on shutdown. |
|
Package blob is the name layer of the runtime blob store behind the txco://blob/* ops: validation of blob names and filenames, the derived-name recipe for user uploads, the permission vocabulary attached to names, and the Index — the mutable name → sha256 pointer table — over the tenant KV store.
|
Package blob is the name layer of the runtime blob store behind the txco://blob/* ops: validation of blob names and filenames, the derived-name recipe for user uploads, the permission vocabulary attached to names, and the Index — the mutable name → sha256 pointer table — over the tenant KV store. |
|
Package calendar is the durable calendar store behind the chassis `calendar` personality (CalDAV + ICS feeds) and the txco://calendar/* ops: accounts, per-account calendars, and per-calendar iCalendar objects.
|
Package calendar is the durable calendar store behind the chassis `calendar` personality (CalDAV + ICS feeds) and the txco://calendar/* ops: accounts, per-account calendars, and per-calendar iCalendar objects. |
|
Package capdecl is the declaration of what a stack can do for a run: a named capability, what a caller reads about it, and the input it takes.
|
Package capdecl is the declaration of what a stack can do for a run: a named capability, what a caller reads about it, and the input it takes. |
|
Package chat is the chassis-owned `ai://chat` exec dispatch surface.
|
Package chat is the chassis-owned `ai://chat` exec dispatch surface. |
|
openai
Package openai is a native OpenAI-direct ai://chat backend.
|
Package openai is a native OpenAI-direct ai://chat backend. |
|
openrouter
Package openrouter is the v1 ai://chat backend.
|
Package openrouter is the v1 ai://chat backend. |
|
Package cli holds the txco subcommand surface — the developer-facing rule-authoring loop.
|
Package cli holds the txco subcommand surface — the developer-facing rule-authoring loop. |
|
auth
Package auth implements the `txco auth …` CLI surface — keygen, dev enrollment, signed whoami, key rotation, and revocation.
|
Package auth implements the `txco auth …` CLI surface — keygen, dev enrollment, signed whoami, key rotation, and revocation. |
|
banner
Package banner holds the txco logo + small TTY helpers used by every subcommand's help/usage screen.
|
Package banner holds the txco logo + small TTY helpers used by every subcommand's help/usage screen. |
|
bundle
Package bundle walks an on-disk OPS/ tree and produces a flat list of (stack, scope, name, txcl, mock_req, mock_res) records suitable for POSTing to the admin /v1/ops/import endpoint.
|
Package bundle walks an on-disk OPS/ tree and produces a flat list of (stack, scope, name, txcl, mock_req, mock_res) records suitable for POSTing to the admin /v1/ops/import endpoint. |
|
client
Package client is the small HTTP client the txco CLI uses to talk to a running chassis admin server.
|
Package client is the small HTTP client the txco CLI uses to talk to a running chassis admin server. |
|
cloud
Package cloud implements `txco login` — cloud identity for the thanks-computer cloud, via OAuth (Authorization Code + PKCE).
|
Package cloud implements `txco login` — cloud identity for the thanks-computer cloud, via OAuth (Authorization Code + PKCE). |
|
dev
Package dev contains the process-spawning, health-checking, and file-watching helpers used by `txco dev`.
|
Package dev contains the process-spawning, health-checking, and file-watching helpers used by `txco dev`. |
|
lockfile
Package lockfile reads and writes txco.packages.lock.yaml — the repo-root, committed record of which packages produced the workspace's materialized files (workspace PROVENANCE).
|
Package lockfile reads and writes txco.packages.lock.yaml — the repo-root, committed record of which packages produced the workspace's materialized files (workspace PROVENANCE). |
|
manifest
Package manifest models txco.package.yaml — a TxCo package's identity, compatibility, op-resolution contract, and advisory metadata — and validates a package tree against it.
|
Package manifest models txco.package.yaml — a TxCo package's identity, compatibility, op-resolution contract, and advisory metadata — and validates a package tree against it. |
|
op
Package compute implements the authoring CLI for sandboxed op:// computes (wired as `txco op`).
|
Package compute implements the authoring CLI for sandboxed op:// computes (wired as `txco op`). |
|
op/javybin
Package javybin resolves a `javy` CLI binary matching the Javy version the vendored QuickJS plugin was emitted from (chassis/compute/javyplugin).
|
Package javybin resolves a `javy` CLI binary matching the Javy version the vendored QuickJS plugin was emitted from (chassis/compute/javyplugin). |
|
oprefs
Package oprefs resolves `op://NAME` symbolic references in txcl rule bodies to concrete URLs based on a workspace's operations registry.
|
Package oprefs resolves `op://NAME` symbolic references in txcl rule bodies to concrete URLs based on a workspace's operations registry. |
|
sign
Package sign implements txco's native ed25519 package-signature format: a small OCI artifact, discovered by the cosign tag convention (sha256:<hex> → sha256-<hex>.sig), whose single layer is the exact signed payload bytes and whose annotations carry the ed25519 signature, key id, and public key.
|
Package sign implements txco's native ed25519 package-signature format: a small OCI artifact, discovered by the cosign tag convention (sha256:<hex> → sha256-<hex>.sig), whose single layer is the exact signed payload bytes and whose annotations carry the ed25519 signature, key id, and public key. |
|
signer
Package signer is the CLI-side RFC 9421 signing surface.
|
Package signer is the CLI-side RFC 9421 signing surface. |
|
source
Package source fetches a tree from a remote or local origin and copies it into a destination directory.
|
Package source fetches a tree from a remote or local origin and copies it into a destination directory. |
|
state
Package state owns the .txco/<stack>.state.json file the txco CLI writes after a `pull` and reads on `push`.
|
Package state owns the .txco/<stack>.state.json file the txco CLI writes after a `pull` and reads on `push`. |
|
update
Package update implements `txco update check` and `txco upgrade`: it discovers the latest release from GitHub, compares versions, detects how the running binary was installed, and (for self-managed installs) downloads + verifies + atomically replaces the binary.
|
Package update implements `txco update check` and `txco upgrade`: it discovers the latest release from GitHub, compares versions, detects how the running binary was installed, and (for self-managed installs) downloads + verifies + atomically replaces the binary. |
|
Package clicmd is the server-side registry for CLI subcommands forwarded over the admin API — the "zero-install plugin" path.
|
Package clicmd is the server-side registry for CLI subcommands forwarded over the admin API — the "zero-install plugin" path. |
|
Package clientcmd is the CLIENT-side analog of chassis/clicmd: a registry for overlay-supplied `txco` subcommands that run in the CLI process (signing a request to a tenant-scoped admin endpoint, opening a browser) rather than being forwarded to the server's /v1/cli.
|
Package clientcmd is the CLIENT-side analog of chassis/clicmd: a registry for overlay-supplied `txco` subcommands that run in the CLI process (signing a request to a tenant-scoped admin endpoint, opening a browser) rather than being forwarded to the server's /v1/cli. |
|
Package compute is the sandboxed local-compute seam.
|
Package compute is the sandboxed local-compute seam. |
|
identity
Package identity is a reference compute engine that echoes its input back as output.
|
Package identity is a reference compute engine that echoes its input back as output. |
|
javyplugin
Package javyplugin vendors the Javy QuickJS plugin used to run JS/TS nano-ops as *dynamically linked* wasm modules.
|
Package javyplugin vendors the Javy QuickJS plugin used to run JS/TS nano-ops as *dynamically linked* wasm modules. |
|
storeresolver
Package storeresolver resolves compute refs against the chassis content-addressed artifact.Store (the same store snapshots use).
|
Package storeresolver resolves compute refs against the chassis content-addressed artifact.Store (the same store snapshots use). |
|
wazero
Package wazero is the reference in-process compute engine: it runs a content-addressed WASI module on the pure-Go wazero runtime (no CGO).
|
Package wazero is the reference in-process compute engine: it runs a content-addressed WASI module on the pure-Go wazero runtime (no CGO). |
|
Package computesrc is the source of a compute op, kept beside the wasm it was built from so the admin can show what a `compute://sha256/<digest>` does.
|
Package computesrc is the source of a compute op, kept beside the wasm it was built from so the admin can show what a `compute://sha256/<digest>` does. |
|
Package contacts is the durable contacts store behind the chassis `contacts` personality (CardDAV) and the txco://contacts/* ops: accounts, per-account address books, and per-book vCard objects.
|
Package contacts is the durable contacts store behind the chassis `contacts` personality (CardDAV) and the txco://contacts/* ops: accounts, per-account address books, and per-book vCard objects. |
|
Package continuation provides durable, immutable, event-sourced storage for suspended opstack runs ("continuations").
|
Package continuation provides durable, immutable, event-sourced storage for suspended opstack runs ("continuations"). |
|
filestore
Package filestore is the local-filesystem continuation backend: the bundled default, zero infrastructure, directly inspectable.
|
Package filestore is the local-filesystem continuation backend: the bundled default, zero infrastructure, directly inspectable. |
|
Package controlapply is the consume side of the control-plane contract: a background controller that polls a feed.Source for control events and applies them to the local databases so a fleet stays in sync.
|
Package controlapply is the consume side of the control-plane contract: a background controller that polls a feed.Source for control events and applies them to the local databases so a fleet stays in sync. |
|
Package controlevent defines the control-plane event contract: the notification a control plane appends and a fleet chassis consumes.
|
Package controlevent defines the control-plane event contract: the notification a control plane appends and a fleet chassis consumes. |
|
Package controlpublish is the producer half of fleet sync: a background pump that drains the control_events_outbox table and publishes pending rows via feed.Sink.
|
Package controlpublish is the producer half of fleet sync: a background pump that drains the control_events_outbox table and publishes pending rows via feed.Sink. |
|
Package cron is the cron-dispatch seam.
|
Package cron is the cron-dispatch seam. |
|
local
Package local is the in-process cron Queue: a buffered channel feeding a fixed pool of worker goroutines.
|
Package local is the in-process cron Queue: a buffered channel feeding a fixed pool of worker goroutines. |
|
Package dataset implements txco://dataset: stack-bundled, immutable SQLite artifacts queried at runtime through named, apply-time-validated queries.
|
Package dataset implements txco://dataset: stack-bundled, immutable SQLite artifacts queried at runtime through named, apply-time-validated queries. |
|
Package decide is the chassis-owned `ai://decide` exec dispatch surface.
|
Package decide is the chassis-owned `ai://decide` exec dispatch surface. |
|
vercel
Package vercel is the ai://decide backend for Vercel AI Gateway's evaluation API: POST https://ai-gateway.vercel.sh/v1/evaluate, documented at https://vercel.com/docs/ai-gateway/modalities/evaluation.
|
Package vercel is the ai://decide backend for Vercel AI Gateway's evaluation API: POST https://ai-gateway.vercel.sh/v1/evaluate, documented at https://vercel.com/docs/ai-gateway/modalities/evaluation. |
|
Package demo holds the txco demo's curriculum — the tracks, steps, and starting ops that `txco demo` seeds into a chassis at boot.
|
Package demo holds the txco demo's curriculum — the tracks, steps, and starting ops that `txco demo` seeds into a chassis at boot. |
|
Package drive is the mutable document store behind the chassis `webdav` personality and the txco://drive/* ops: per-tenant collections of files and directories whose bytes live in an ordinary object store and whose names, versions and hierarchy live in a SQL index.
|
Package drive is the mutable document store behind the chassis `webdav` personality and the txco://drive/* ops: per-tenant collections of files and directories whose bytes live in an ordinary object store and whose names, versions and hierarchy live in a SQL index. |
|
filestore
Package filestore is the local-filesystem drive object backend: the bundled default, zero infrastructure, directly inspectable.
|
Package filestore is the local-filesystem drive object backend: the bundled default, zero infrastructure, directly inspectable. |
|
scheduledsink
Package scheduledsink delivers drive mutation events through the scheduled store: every committed mutation becomes one pending scheduled_events row, due now, that the `scheduled` personality fires into the tenant's `_scheduled/0` stack like any other scheduled event (`@src == "scheduled"`, the facts under `@scheduled.payload`).
|
Package scheduledsink delivers drive mutation events through the scheduled store: every committed mutation becomes one pending scheduled_events row, due now, that the `scheduled` personality fires into the tenant's `_scheduled/0` stack like any other scheduled event (`@src == "scheduled"`, the facts under `@scheduled.payload`). |
|
Package edgeproxy is the chassis side of the trusted-edge contract:
|
Package edgeproxy is the chassis side of the trusted-edge contract: |
|
Package egress is the outbound op-dial policy seam.
|
Package egress is the outbound op-dial policy seam. |
|
open
Package open registers the "open" egress policy: it allows every outbound op dial.
|
Package open registers the "open" egress policy: it allows every outbound op dial. |
|
private
Package private registers the "private" egress policy: it blocks outbound op dials whose resolved IP falls in loopback, private, link-local (incl.
|
Package private registers the "private" egress policy: it blocks outbound op dials whose resolved IP falls in loopback, private, link-local (incl. |
|
wgtunnel
Package wgtunnel brings up a WireGuard tunnel inside the chassis process — userspace, no kernel interface, no root — so an outbound dial can leave through a peer on a private network the host itself is not on.
|
Package wgtunnel brings up a WireGuard tunnel inside the chassis process — userspace, no kernel interface, no root — so an outbound dial can leave through a peer on a private network the host itself is not on. |
|
Package embed is the chassis-owned `ai://embed` exec dispatch surface.
|
Package embed is the chassis-owned `ai://embed` exec dispatch surface. |
|
ollama
Package ollama is the v1 ai://embed backend: a local, keyless Ollama instance (https://ollama.com) speaking its /api/embed endpoint.
|
Package ollama is the v1 ai://embed backend: a local, keyless Ollama instance (https://ollama.com) speaking its /api/embed endpoint. |
|
openai
Package openai is the hosted ai://embed backend: OpenAI's /v1/embeddings endpoint.
|
Package openai is the hosted ai://embed backend: OpenAI's /v1/embeddings endpoint. |
|
Package feed is the control-event feed seam: where a chassis reads the ordered stream of control events it must apply to stay in sync.
|
Package feed is the control-event feed seam: where a chassis reads the ordered stream of control events it must apply to stay in sync. |
|
filesource
Package filesource is the local-directory feed source: zero infrastructure, directly inspectable, useful for development and as a drop point a sidecar can write into.
|
Package filesource is the local-directory feed source: zero infrastructure, directly inspectable, useful for development and as a drop point a sidecar can write into. |
|
nop
Package nop is the disabled feed source + sink: the single-node default.
|
Package nop is the disabled feed source + sink: the single-node default. |
|
Package fetch is the chassis's safe public-HTTP fetcher: one GET of a public web resource on a stack's behalf, bounded in every dimension.
|
Package fetch is the chassis's safe public-HTTP fetcher: one GET of a public web resource on a stack's behalf, bounded in every dimension. |
|
Package filecas is the content-addressed store for tenant FILES/ assets.
|
Package filecas is the content-addressed store for tenant FILES/ assets. |
|
filestore
Package filestore is the local-filesystem filecas backend: the bundled default, content-addressed, maildir-sharded (sha256/<ab>/<cd>/<hash>), zero infrastructure, directly inspectable.
|
Package filestore is the local-filesystem filecas backend: the bundled default, content-addressed, maildir-sharded (sha256/<ab>/<cd>/<hash>), zero infrastructure, directly inspectable. |
|
Package grantwire is what a command and the chassis agree on when the command exercises a run grant: the variables the command is handed, and the few lines of protocol the launcher (`txco sandbox`) speaks to the chassis over a Unix socket.
|
Package grantwire is what a command and the chassis agree on when the command exercises a run grant: the variables the command is handed, and the few lines of protocol the launcher (`txco sandbox`) speaks to the chassis over a Unix socket. |
|
Package htmlextract picks values out of an HTML document with CSS selectors, within fixed bounds.
|
Package htmlextract picks values out of an HTML document with CSS selectors, within fixed bounds. |
|
Package hxid produces sortable, base58-encoded unique IDs backed by ULIDs.
|
Package hxid produces sortable, base58-encoded unique IDs backed by ULIDs. |
|
Package imap is the durable mailbox store behind the chassis `imap` personality and the txco://imap/* ops: accounts, a per-account tree of mailboxes, and per-mailbox UID-ordered message rows whose retained object (a canonical Record, or verbatim RFC 5322 bytes) lives in the filecas by sha256.
|
Package imap is the durable mailbox store behind the chassis `imap` personality and the txco://imap/* ops: accounts, a per-account tree of mailboxes, and per-mailbox UID-ordered message rows whose retained object (a canonical Record, or verbatim RFC 5322 bytes) lives in the filecas by sha256. |
|
Package ipp is the chassis side of the print inlet: the durable job store the `ipp` personality writes to, plus the protocol helpers (codec, printer attributes, document sniffing) it answers with.
|
Package ipp is the chassis side of the print inlet: the durable job store the `ipp` personality writes to, plus the protocol helpers (codec, printer attributes, document sniffing) it answers with. |
|
Package jsonrpc is an internal framing helper for JSON-RPC 2.0 requests and responses.
|
Package jsonrpc is an internal framing helper for JSON-RPC 2.0 requests and responses. |
|
Package jsonx builds JSON documents with the exact byte-level semantics of a chain of sjson v1.0.4 Set/SetRaw calls — new keys PREPEND (so sequential inserts land in reverse order), existing values replace in place, "-1" appends to arrays, numeric indexes null-pad — but serialized ONCE instead of re-copying the whole document per call.
|
Package jsonx builds JSON documents with the exact byte-level semantics of a chain of sjson v1.0.4 Set/SetRaw calls — new keys PREPEND (so sequential inserts land in reverse order), existing values replace in place, "-1" appends to arrays, numeric indexes null-pad — but serialized ONCE instead of re-copying the whole document per call. |
|
Package kv is a thin, tenant-scoped wrapper over the configured key-value store backend that backs the op-writable key-value ops (txco://kv/*).
|
Package kv is a thin, tenant-scoped wrapper over the configured key-value store backend that backs the op-writable key-value ops (txco://kv/*). |
|
boltstore
Package boltstore is the chassis's boltdb backend for the op-writable KV (txco://kv/*), registered with valkeyrie under the same "boltdb" name the default TXCO_KVSTORE selects.
|
Package boltstore is the chassis's boltdb backend for the op-writable KV (txco://kv/*), registered with valkeyrie under the same "boltdb" name the default TXCO_KVSTORE selects. |
|
redisstore
Package redisstore is the chassis's redis backend for the op-writable KV (txco://kv/*), registered with valkeyrie under the same "redis" name the fleet's TXCO_KVSTORE env selects.
|
Package redisstore is the chassis's redis backend for the op-writable KV (txco://kv/*), registered with valkeyrie under the same "redis" name the fleet's TXCO_KVSTORE env selects. |
|
Package mail implements the bundled txco://sendmail op: it reads the `_sendmail` envelope contract a rule assembled, renders an email (a shell template wrapping the body — the bundled default, or a caller-supplied `_sendmail.templates.html`), enforces the per-tenant campaign at-most-once guard, verifies the From domain, submits to a relay, and emits a usage line.
|
Package mail implements the bundled txco://sendmail op: it reads the `_sendmail` envelope contract a rule assembled, renders an email (a shell template wrapping the body — the bundled default, or a caller-supplied `_sendmail.templates.html`), enforces the per-tenant campaign at-most-once guard, verifies the From domain, submits to a relay, and emits a usage line. |
|
Package metrics wires OpenTelemetry tracing and metrics for the chassis.
|
Package metrics wires OpenTelemetry tracing and metrics for the chassis. |
|
Package notebook is the append-only record a stack writes and reads through txco://notebook/*: per (tenant, namespace, name) a head row that allocates sequence numbers, and entries {seq, at, type, data, object_key} in that order.
|
Package notebook is the append-only record a stack writes and reads through txco://notebook/*: per (tenant, namespace, name) a head row that allocates sequence numbers, and entries {seq, at, type, data, object_key} in that order. |
|
Package ocitoken mints the bearer tokens an OCI registry (CNCF Distribution, "token" auth) accepts: a short-lived JWT whose `access` claim names exact repositories and the actions allowed on each.
|
Package ocitoken mints the bearer tokens an OCI registry (CNCF Distribution, "token" auth) accepts: a short-lived JWT whose `access` claim names exact repositories and the actions allowed on each. |
|
Package opname is the single source of truth for what a stack name and an operation (rule) name may contain.
|
Package opname is the single source of truth for what a stack name and an operation (rule) name may contain. |
|
Package ops hosts chassis-core op handlers that consume the per-tenant secret store.
|
Package ops hosts chassis-core op handlers that consume the per-tenant secret store. |
|
Package outlet implements outlet://<name>/<op>: a stack-declared, named connection to an external service the tenant already runs.
|
Package outlet implements outlet://<name>/<op>: a stack-declared, named connection to an external service the tenant already runs. |
|
outlettest
Package outlettest is an in-memory outlet driver for tests: canned rows, injectable delays and failures, counters.
|
Package outlettest is an in-memory outlet driver for tests: canned rows, injectable delays and failures, counters. |
|
postgres
Package postgres is the PostgreSQL outlet driver: pgx pools opened from a DSN the chassis holds, every dial through the egress guard, `query` in a READ ONLY transaction and `exec` in an explicit one that rolls back when a ceiling is crossed.
|
Package postgres is the PostgreSQL outlet driver: pgx pools opened from a DSN the chassis holds, every dial through the egress guard, `query` in a READ ONLY transaction and `exec` in an explicit one that rolls back when a ceiling is crossed. |
|
Package room is an in-process pub/sub for room timelines: the room inlet publishes messages to a (tenant, room); SSE subscribers receive them live, plus a short backfill of recent ones.
|
Package room is an in-process pub/sub for room timelines: the room inlet publishes messages to a (tenant, room); SSE subscribers receive them live, plus a short backfill of recent ones. |
|
Package rungrant mints and checks the token that travels with one piece of work: proof that the chassis dispatched it, and the id of the run grant row that says what it may ask for.
|
Package rungrant mints and checks the token that travels with one piece of work: proof that the chassis dispatched it, and the id of the run grant row that says what it may ask for. |
|
Package sandbox is the declaration of what a program may hold: a named, stack-deployed bundle that says which secrets a piece of work is handed and under which names.
|
Package sandbox is the declaration of what a program may hold: a named, stack-deployed bundle that says which secrets a piece of work is handed and under which names. |
|
Package scheduled is the durable backing store for the chassis `scheduled` inlet and the txco://schedule op: a table of future events ("run this payload, not before schedule_at") that the scheduled personality polls, claims, and fires.
|
Package scheduled is the durable backing store for the chassis `scheduled` inlet and the txco://schedule op: a table of future events ("run this payload, not before schedule_at") that the scheduled personality polls, claims, and fires. |
|
Package search is the chassis-owned lexical search store: a durable, tenant-scoped place to index text records and find them again by the words they contain, exposed to txcl as txco://search/*.
|
Package search is the chassis-owned lexical search store: a durable, tenant-scoped place to index text records and find them again by the words they contain, exposed to txcl as txco://search/*. |
|
blevestore
Package blevestore is the bundled lexical search backend: one Bleve index per (tenant, collection) on local disk.
|
Package blevestore is the bundled lexical search backend: one Bleve index per (tenant, collection) on local disk. |
|
blevestore/searchbench
command
Command searchbench indexes a file of records into one blevestore collection and runs a file of queries against it.
|
Command searchbench indexes a file of records into one blevestore collection and runs a file of queries against it. |
|
searchtest
Package searchtest holds the backend-agnostic conformance suite for search.Store implementations.
|
Package searchtest holds the backend-agnostic conformance suite for search.Store implementations. |
|
Package secrets implements the per-tenant secret store.
|
Package secrets implements the per-tenant secret store. |
|
admin
Package admin runs the second HTTP server fronting the rule-mutation API.
|
Package admin runs the second HTTP server fronting the rule-mutation API. |
|
admin/ui
Package ui owns the embedded admin-ui Svelte bundle and serves it over HTTP.
|
Package ui owns the embedded admin-ui Svelte bundle and serves it over HTTP. |
|
capgw
Package capgw is the capability inlet: `POST /v1/cap/<name>` on the web head, where dispatched work — a run on a NODE, a chassis of its own that this chassis dispatched a run to — asks this chassis to do something on its behalf: call a model, note a card, finish the run.
|
Package capgw is the capability inlet: `POST /v1/cap/<name>` on the web head, where dispatched work — a run on a NODE, a chassis of its own that this chassis dispatched a run to — asks this chassis to do something on its behalf: call a model, note a card, finish the run. |
|
continuation/ui
Package ui owns the embedded continuation "please wait" Svelte bundle.
|
Package ui owns the embedded continuation "please wait" Svelte bundle. |
|
grantgw
Package grantgw is the grant gateway: the one place a request made with a run grant is decided.
|
Package grantgw is the grant gateway: the one place a request made with a run grant is decided. |
|
grantsock
Package grantsock is the Unix socket the launcher (`txco sandbox`) reaches the chassis on: the `grant` personality.
|
Package grantsock is the Unix socket the launcher (`txco sandbox`) reaches the chassis on: the `grant` personality. |
|
ingress
Package ingress implements the chassis's first-class router: it maps source-specific signal keys (HTTP host, TCP listener, cron job) to a `(tenant, stack)` target, before any txcl rule evaluation.
|
Package ingress implements the chassis's first-class router: it maps source-specific signal keys (HTTP host, TCP listener, cron job) to a `(tenant, stack)` target, before any txcl rule evaluation. |
|
llmgw
Package llmgw is the AI-gateway inlet: existing AI clients (Claude Code first) point their base URL at the chassis, their Anthropic Messages request runs once through the tenant's `_llm` stack (which may reject it, rewrite it, or repoint the upstream), and the upstream response streams back byte-transparent.
|
Package llmgw is the AI-gateway inlet: existing AI clients (Claude Code first) point their base URL at the chassis, their Anthropic Messages request runs once through the tenant's `_llm` stack (which may reject it, rewrite it, or repoint the upstream), and the upstream response streams back byte-transparent. |
|
personality/calendar
Package calendar is the chassis's `calendar` personality: a CalDAV server and ICS feed publisher over the durable calendar store (chassis/calendar), mounted on the web head under a reserved path prefix (--calendar-path-prefix, default /dav) on every hostname the head serves.
|
Package calendar is the chassis's `calendar` personality: a CalDAV server and ICS feed publisher over the durable calendar store (chassis/calendar), mounted on the web head under a reserved path prefix (--calendar-path-prefix, default /dav) on every hostname the head serves. |
|
personality/contacts
Package contacts is the chassis's `contacts` personality: a CardDAV server over the durable contacts store (chassis/contacts), mounted on the web head under a reserved path prefix (--contacts-path-prefix, default /carddav) on every hostname the head serves.
|
Package contacts is the chassis's `contacts` personality: a CardDAV server over the durable contacts store (chassis/contacts), mounted on the web head under a reserved path prefix (--contacts-path-prefix, default /carddav) on every hostname the head serves. |
|
personality/dns
Package dns implements the chassis's authoritative-DNS head: a personality that answers DNS queries for zones explicitly delegated to this chassis, straight from an in-memory snapshot of the dns_zones/dns_records tables.
|
Package dns implements the chassis's authoritative-DNS head: a personality that answers DNS queries for zones explicitly delegated to this chassis, straight from an in-memory snapshot of the dns_zones/dns_records tables. |
|
personality/imap
Package imap implements the chassis's IMAP head: a personality that serves a tenant's durable mailbox store (chassis/imap) to any IMAP4rev1 client — Apple Mail, Thunderbird, mutt — so a mail client becomes a UI over state that stacks project into the store with txco://imap/* ops.
|
Package imap implements the chassis's IMAP head: a personality that serves a tenant's durable mailbox store (chassis/imap) to any IMAP4rev1 client — Apple Mail, Thunderbird, mutt — so a mail client becomes a UI over state that stacks project into the store with txco://imap/* ops. |
|
personality/ipp
Package ipp is the chassis's `ipp` personality: a stack presented to a user's computer as a PRINTER.
|
Package ipp is the chassis's `ipp` personality: a stack presented to a user's computer as a PRINTER. |
|
personality/ipp/ui
Package ui owns the embedded printer page: what a browser sees at a printer's own address (https://ipp.<zone>/p/<printer> — the https twin of its ipps:// URI, and where a configuration profile's description points).
|
Package ui owns the embedded printer page: what a browser sees at a printer's own address (https://ipp.<zone>/p/<printer> — the https twin of its ipps:// URI, and where a configuration profile's description points). |
|
personality/lmtp
Package lmtp implements the chassis's LMTP head: a personality that speaks LMTP (RFC 2033) to a colocated Postfix (or any LMTP client) and turns each delivery into a normal txcl envelope.
|
Package lmtp implements the chassis's LMTP head: a personality that speaks LMTP (RFC 2033) to a colocated Postfix (or any LMTP client) and turns each delivery into a normal txcl envelope. |
|
personality/mailmap
Package mailmap implements the chassis's "mail-domain accept map" head: a tiny TCP server that speaks the Postfix tcp_table(5) protocol so the edge Postfix can ask the chassis, per recipient domain, "is this an accepted mail domain?" before relaying it to the LMTP head.
|
Package mailmap implements the chassis's "mail-domain accept map" head: a tiny TCP server that speaks the Postfix tcp_table(5) protocol so the edge Postfix can ask the chassis, per recipient domain, "is this an accepted mail domain?" before relaying it to the LMTP head. |
|
personality/scheduled
Package scheduled is the chassis `scheduled` inlet: a per-period poll loop that drains the scheduled_events store (chassis/scheduled) and fires due events into their tenant's `_scheduled/0` stack.
|
Package scheduled is the chassis `scheduled` inlet: a per-period poll loop that drains the scheduled_events store (chassis/scheduled) and fires due events into their tenant's `_scheduled/0` stack. |
|
personality/source
Package source is the chassis `source` inlet: a per-period poll loop that claims due external-source watchers from the tenant_sources runtime table (chassis/source), opens each (a remote IMAP mailbox today), reads what is new past the source's durable cursor, fires each item into the source's `<stack>/_source/0`, and — once an item's run succeeds — acknowledges it at the source (marks it read, or moves it aside).
|
Package source is the chassis `source` inlet: a per-period poll loop that claims due external-source watchers from the tenant_sources runtime table (chassis/source), opens each (a remote IMAP mailbox today), reads what is new past the source's durable cursor, fires each item into the source's `<stack>/_source/0`, and — once an item's run succeeds — acknowledges it at the source (marks it read, or moves it aside). |
|
personality/state
Package state is the chassis `state` inlet: the dispatcher that presents committed state transitions (chassis/state's transactional outbox) into their tenant's `_state/0` stack, at least once each.
|
Package state is the chassis `state` inlet: the dispatcher that presents committed state transitions (chassis/state's transactional outbox) into their tenant's `_state/0` stack, at least once each. |
|
personality/sweep
Package sweep is the store janitor: a single periodic background pass per store.
|
Package sweep is the store janitor: a single periodic background pass per store. |
|
personality/webdav
Package webdav is the chassis's `webdav` personality: a WebDAV server over the drive store (chassis/drive), mounted on the web head under a reserved path prefix (--drive-path-prefix, default /drive) on every hostname the head serves.
|
Package webdav is the chassis's `webdav` personality: a WebDAV server over the drive store (chassis/drive), mounted on the web head under a reserved path prefix (--drive-path-prefix, default /drive) on every hostname the head serves. |
|
personality/websocket
Package websocket implements the chassis's `websocket` personality: the long-lived side of an HTTP Upgrade.
|
Package websocket implements the chassis's `websocket` personality: the long-lived side of an HTTP Upgrade. |
|
static
Package static serves bundled / workspace files for the txco://static op, layered first-match-wins: a routed stack's own <workspace>/OPS/<stack>/FILES/** , the chassis-wide <workspace>/FILES/** , then the embedded chassis default (favicon.ico).
|
Package static serves bundled / workspace files for the txco://static op, layered first-match-wins: a routed stack's own <workspace>/OPS/<stack>/FILES/** , the chassis-wide <workspace>/FILES/** , then the embedded chassis default (favicon.ico). |
|
Package serverext is the chassis seam for overlay-supplied HTTP routes on the admin server.
|
Package serverext is the chassis seam for overlay-supplied HTTP routes on the admin server. |
|
Package signedurl mints and checks the capability tokens behind `/_txc/signed/<token>`: a short-lived, self-contained grant to read ONE exact document, handed to something outside the chassis (a parser, a transcoder) so a large body never has to ride an envelope.
|
Package signedurl mints and checks the capability tokens behind `/_txc/signed/<token>`: a short-lived, self-contained grant to read ONE exact document, handed to something outside the chassis (a parser, a transcoder) so a large body never has to ride an envelope. |
|
Package snapshot turns the runtime SQLite DB into a content-addressed, checksummed, model-versioned artifact and restores one SAFELY.
|
Package snapshot turns the runtime SQLite DB into a content-addressed, checksummed, model-versioned artifact and restores one SAFELY. |
|
Package source is the chassis's outbound source-inlet seam: a cursor- bearing watcher that dials an EXTERNAL system a tenant delegated to us (today a remote IMAP mailbox; later Kafka/SQS/CDC/webhook-poll), reads what is new past a durable cursor, fires each item as a run of the tenant's `_source/0` stack, and — once that run succeeds — acknowledges the item at the source (marking it read, moving it aside).
|
Package source is the chassis's outbound source-inlet seam: a cursor- bearing watcher that dials an EXTERNAL system a tenant delegated to us (today a remote IMAP mailbox; later Kafka/SQS/CDC/webhook-poll), reads what is new past a durable cursor, fires each item as a run of the tenant's `_source/0` stack, and — once that run succeeds — acknowledges the item at the source (marking it read, moving it aside). |
|
imapsource
Package imapsource is the IMAP source kind: it connects OUT to a remote IMAP mailbox a tenant delegated (Gmail, Fastmail, Dovecot, an Exchange- compatible server), reads messages past a durable UID cursor, and — once a message's run has succeeded — marks it read or moves it aside.
|
Package imapsource is the IMAP source kind: it connects OUT to a remote IMAP mailbox a tenant delegated (Gmail, Fastmail, Dovecot, an Exchange- compatible server), reads messages past a durable UID cursor, and — once a message's run has succeeded — marks it read or moves it aside. |
|
Package stackdir is a stack version's own directory, handed to a workspace exec as a read-only tree: `WITH cwd = "$TXCO_STACK_DIR"` starts the command in it and sets TXCO_STACK_DIR to its path, so an op can run a program kept beside it by path instead of pasting it into stdin.
|
Package stackdir is a stack version's own directory, handed to a workspace exec as a read-only tree: `WITH cwd = "$TXCO_STACK_DIR"` starts the command in it and sets TXCO_STACK_DIR to its path, so an op can run a program kept beside it by path instead of pasting it into stdin. |
|
Package state is the chassis's durable state-record primitive: a named record (tenant, machine, id) with a state, a version and opaque JSON data; an atomic compare-and-swap transition that checks BOTH the current state and the expected version; and a durable event for every committed transition, written in the same transaction (a transactional outbox).
|
Package state is the chassis's durable state-record primitive: a named record (tenant, machine, id) with a state, a version and opaque JSON data; an atomic compare-and-swap transition that checks BOTH the current state and the expected version; and a durable event for every committed transition, written in the same transaction (a transactional outbox). |
|
blobseed
Package blobseed is the BLOBS/ store-seed Materializer: it reconciles a stack's BLOBS/** tree (chassis/storeseed) into the tenant's blob name index (chassis/blob).
|
Package blobseed is the BLOBS/ store-seed Materializer: it reconciles a stack's BLOBS/** tree (chassis/storeseed) into the tenant's blob name index (chassis/blob). |
|
calseed
Package calseed is the CALENDARS/ store-seed Materializer: it reconciles CALENDARS/<username>/<calendar>.jsonl packs (chassis/storeseed) into the calendar store (chassis/calendar) the `calendar` personality serves.
|
Package calseed is the CALENDARS/ store-seed Materializer: it reconciles CALENDARS/<username>/<calendar>.jsonl packs (chassis/storeseed) into the calendar store (chassis/calendar) the `calendar` personality serves. |
|
conseed
Package conseed is the CONTACTS/ store-seed Materializer: it reconciles CONTACTS/<username>/<addressbook>.jsonl packs (chassis/storeseed) into the contacts store (chassis/contacts) the `contacts` personality serves.
|
Package conseed is the CONTACTS/ store-seed Materializer: it reconciles CONTACTS/<username>/<addressbook>.jsonl packs (chassis/storeseed) into the contacts store (chassis/contacts) the `contacts` personality serves. |
|
kvseed
Package kvseed is the KV store-seed Materializer: it reconciles KV/<namespace>.jsonl packs (chassis/storeseed) into the tenant KV store.
|
Package kvseed is the KV store-seed Materializer: it reconciles KV/<namespace>.jsonl packs (chassis/storeseed) into the tenant KV store. |
|
srcseed
Package srcseed is the SOURCES/ store-seed Materializer: it reconciles SOURCES/<pack>.jsonl packs (chassis/storeseed) into the tenant_sources runtime table (chassis/source).
|
Package srcseed is the SOURCES/ store-seed Materializer: it reconciles SOURCES/<pack>.jsonl packs (chassis/storeseed) into the tenant_sources runtime table (chassis/source). |
|
vecseed
Package vecseed is the vector store-seed Materializer: it reconciles VECTORS/<collection>.jsonl packs (chassis/storeseed) into a vector.Store.
|
Package vecseed is the vector store-seed Materializer: it reconciles VECTORS/<collection>.jsonl packs (chassis/storeseed) into a vector.Store. |
|
Package sysops loads trusted, chassis-local opstacks into the in-memory ops snapshot at startup.
|
Package sysops loads trusted, chassis-local opstacks into the in-memory ops snapshot at startup. |
|
Package telemetry processes tenant-owned business metrics.
|
Package telemetry processes tenant-owned business metrics. |
|
log
Package log is the bundled "log" telemetry exporter: every validated metric event becomes one structured chassis log line.
|
Package log is the bundled "log" telemetry exporter: every validated metric event becomes one structured chassis log line. |
|
otlp
Package otlp is the bundled "otlp" telemetry exporter: each tenant's validated metric events feed a tenant-private OTel MeterProvider whose periodic reader ships OTLP/HTTP batches to the endpoint named by the tenant's TELEMETRY_ENDPOINT secret (auth headers from the optional TELEMETRY_HEADERS secret, OTel "k1=v1,k2=v2" format).
|
Package otlp is the bundled "otlp" telemetry exporter: each tenant's validated metric events feed a tenant-private OTel MeterProvider whose periodic reader ships OTLP/HTTP batches to the endpoint named by the tenant's TELEMETRY_ENDPOINT secret (auth headers from the optional TELEMETRY_HEADERS secret, OTel "k1=v1,k2=v2" format). |
|
Package tenants owns the tenants and tenant_hostnames tables in runtime.db.
|
Package tenants owns the tenants and tenant_hostnames tables in runtime.db. |
|
Package tls is the chassis's bundled TLS/ACME layer: an embedded ACME client (certmagic) that obtains and renews certificates for delegated zones, solving the ACME DNS-01 challenge IN-PROCESS against the chassis's own authoritative DNS head.
|
Package tls is the chassis's bundled TLS/ACME layer: an embedded ACME client (certmagic) that obtains and renews certificates for delegated zones, solving the ACME DNS-01 challenge IN-PROCESS against the chassis's own authoritative DNS head. |
|
Package trace records per-request artifacts (the inbound envelope, every op execution, the final response, plus a timeline of routing events) to durable storage.
|
Package trace records per-request artifacts (the inbound envelope, every op execution, the final response, plus a timeline of routing events) to durable storage. |
|
Package txcguard is the single source of truth for which `_txc.*` envelope paths an author-controlled producer may write or delete.
|
Package txcguard is the single source of truth for which `_txc.*` envelope paths an author-controlled producer may write or delete. |
|
ast
Package ast defines the runtime value AST nodes shared across the txcl parser, runtime evaluator, and processor.
|
Package ast defines the runtime value AST nodes shared across the txcl parser, runtime evaluator, and processor. |
|
funcs
Package funcs is the curated registry of inline txcl functions — the `&name(args...)` runtime calls that complement `txco://` ops.
|
Package funcs is the curated registry of inline txcl functions — the `&name(args...)` runtime calls that complement `txco://` ops. |
|
include
Package include expands `&include("path")` in txcl source: the named file's contents, written in as a txcl string literal.
|
Package include expands `&include("path")` in txcl source: the named file's contents, written in as a txcl string literal. |
|
runtime
Package runtime is the txcl value-resolution layer.
|
Package runtime is the txcl value-resolution layer. |
|
Package usage emits one append-only event per completed request — the raw material a future control plane aggregates into per-tenant counts, quotas, and billing.
|
Package usage emits one append-only event per completed request — the raw material a future control plane aggregates into per-tenant counts, quotas, and billing. |
|
utils
|
|
|
Package vector is the chassis-owned vector store: a durable, tenant-scoped place to upsert embeddings and find nearest neighbours, exposed to txcl as txco://vector/{upsert,search,delete,collection}.
|
Package vector is the chassis-owned vector store: a durable, tenant-scoped place to upsert embeddings and find nearest neighbours, exposed to txcl as txco://vector/{upsert,search,delete,collection}. |
|
sqlitevec
Package sqlitevec is the bundled vector.Store backend: SQLite + sqlite-vec, in a dedicated database file (never the config-reloaded runtime DB).
|
Package sqlitevec is the bundled vector.Store backend: SQLite + sqlite-vec, in a dedicated database file (never the config-reloaded runtime DB). |
|
vectortest
Package vectortest holds the backend-agnostic conformance suite for vector.Store implementations.
|
Package vectortest holds the backend-agnostic conformance suite for vector.Store implementations. |
|
Package webabi is the TxCo Web ABI on the installing side: the manifest (txco-web.json), a loaded ABI directory, the marker and provenance files an install writes, and the collision rules for laying an ABI directory over an author's stack tree.
|
Package webabi is the TxCo Web ABI on the installing side: the manifest (txco-web.json), a loaded ABI directory, the marker and provenance files an install writes, and the collision rules for laying an ABI directory over an author's stack tree. |
|
Package workspace is the seam behind `workspace://<name>/<verb>` EXEC dispatch: an owned, stateful execution environment — a directory on the chassis host in dev (chassis/workspace/local), a Fly Sprite in the fleet (overlay) — that a tenant's stack addresses by name and runs commands in.
|
Package workspace is the seam behind `workspace://<name>/<verb>` EXEC dispatch: an owned, stateful execution environment — a directory on the chassis host in dev (chassis/workspace/local), a Fly Sprite in the fleet (overlay) — that a tenant's stack addresses by name and runs commands in. |
|
local
Package local is the dev/self-host workspace provider: a workspace is a directory under --workspace-local-root, and exec runs the command as the chassis's own uid with that directory as HOME and cwd.
|
Package local is the dev/self-host workspace provider: a workspace is a directory under --workspace-local-root, and exec runs the command as the chassis's own uid with that directory as HOME and cwd. |
Click to show internal directories.
Click to hide internal directories.