internal/

Package cliflags defines the jaas binary's CLI surface in one place so the runtime (main.run) and the documentation generator (hack/flaggen) derive from a single source.

Package eval wraps go-jsonnet with the ergonomics JaaS needs: per-call VM construction, deadline-aware evaluation, TLA/ExtVar plumbing, and a pluggable Importer.

Package handler implements the HTTP surface: the Jsonnet evaluation endpoint plus the startup, readiness, and liveness probes.

Package mcp exposes jaas's Jsonnet evaluator as a Model Context Protocol server so an LLM agent can render and validate snippets directly.

Package observability holds the OpenTelemetry tracer plumbing the operator opts into via --tracing-endpoint.

Package operator implements the controller-runtime-based reconciler half of JaaS, activated by --enable-flux-integration.

Package opstate carries whether the operator subsystem is currently able to reconcile.

Package sources fetches Flux source artifacts referenced by JaaS CRs.

Package startupcheck reports, at boot, which of the operator's watched resources are not yet reconcilable — a CRD that is not installed, or one the operator ServiceAccount may not list/watch.

Package storage holds the on-disk artifact store the operator uses to materialize ExternalArtifact tarballs.

Package urlguard hosts the SSRF-defence checks the operator applies to every URL it follows on behalf of a tenant.