Directories
¶
| Path | Synopsis |
|---|---|
|
Package abilities is the control-plane half of the ability engine (Track B engine, slice E1): the global catalogue of reviewed abilities, each site's cached inventory of registered abilities, and the refresh job that fills it through the agent's `ability_run` command.
|
Package abilities is the control-plane half of the ability engine (Track B engine, slice E1): the global catalogue of reviewed abilities, each site's cached inventory of registered abilities, and the refresh job that fills it through the agent's `ability_run` command. |
|
Package abilityrequest is the person's side of the ability engine's write rail (engine v4 §1.4, §4; amendments W1, W3): the queue, approve and decline of assistant_ability_requests rows created by site_ability_run.
|
Package abilityrequest is the person's side of the ability engine's write rail (engine v4 §1.4, §4; amendments W1, W3): the queue, approve and decline of assistant_ability_requests rows created by site_ability_run. |
|
Package activity implements the CP side of the ADR-037 Sprint 3 WordPress activity log: ingest of the agent-shipped, hash-chained event stream, a server-side re-verification of that chain (tamper-evidence — a capability not shipped by leading site-management plugins), tenant-scoped listing with filters, and a wiring hook into the existing uptime alert Dispatcher for high-severity security events.
|
Package activity implements the CP side of the ADR-037 Sprint 3 WordPress activity log: ingest of the agent-shipped, hash-chained event stream, a server-side re-verification of that chain (tamper-evidence — a capability not shipped by leading site-management plugins), tenant-scoped listing with filters, and a wiring hook into the existing uptime alert Dispatcher for high-severity security events. |
|
Package admingate holds the ONE definition of instance-level authority (who may act on install-wide state rather than on one organisation's), plus the narrow database reads that decision needs.
|
Package admingate holds the ONE definition of instance-level authority (who may act on install-wide state rather than on one organisation's), plus the narrow database reads that decision needs. |
|
Package agent implements the agent side of the WPMgr control plane: the Ed25519 signed-request authentication scheme for agent->CP calls (with timestamp + nonce anti-replay), the agent metadata/heartbeat endpoints, and the periodic connection-health job (River worker).
|
Package agent implements the agent side of the WPMgr control plane: the Ed25519 signed-request authentication scheme for agent->CP calls (with timestamp + nonce anti-replay), the agent metadata/heartbeat endpoints, and the periodic connection-health job (River worker). |
|
Package agentcmd implements the control-plane side of the CP->agent command protocol: minting the Ed25519-signed bearer JWT the WordPress agent verifies (see apps/agent/includes/class-connector.php), and POSTing signed `update` and `rollback` commands to an enrolled site's agent over the SSRF-hardened HTTP client (ADR-009).
|
Package agentcmd implements the control-plane side of the CP->agent command protocol: minting the Ed25519-signed bearer JWT the WordPress agent verifies (see apps/agent/includes/class-connector.php), and POSTing signed `update` and `rollback` commands to an enrolled site's agent over the SSRF-hardened HTTP client (ADR-009). |
|
Package agentmirror is the persisted freshness sentinel for the upstream agent-release mirror (internal/agentupstream), GH #322.
|
Package agentmirror is the persisted freshness sentinel for the upstream agent-release mirror (internal/agentupstream), GH #322. |
|
Package agentplugin pins the identity of the WordPress plugin this control plane ships (the agent) so every layer recognizes the agent's own entry in a site's plugin inventory from ONE place.
|
Package agentplugin pins the identity of the WordPress plugin this control plane ships (the agent) so every layer recognizes the agent's own entry in a site's plugin inventory from ONE place. |
|
Package agentrelease provides ADDITIVE, read-only visibility into the currently published WPMgr agent release version, and classifies each site's reported agent_version against it for the fleet "agent freshness" dashboard (GET /api/v1/agent/latest, GET /api/v1/fleet/agents).
|
Package agentrelease provides ADDITIVE, read-only visibility into the currently published WPMgr agent release version, and classifies each site's reported agent_version against it for the fleet "agent freshness" dashboard (GET /api/v1/agent/latest, GET /api/v1/fleet/agents). |
|
Package agentupstream MIRRORS the public WPMgr agent release from GitHub into THIS install's own object storage (GH #302).
|
Package agentupstream MIRRORS the public WPMgr agent release from GitHub into THIS install's own object storage (GH #302). |
|
Package aipolicy decides whether one AI write request runs at once under the site's setting or waits for a person (ADR-065, approval tiers).
|
Package aipolicy decides whether one AI write request runs at once under the site's setting or waits for a person (ADR-065, approval tiers). |
|
Package aireadiness computes whether an AI assistant connected to WPMgr can work on a site, from what the site last reported.
|
Package aireadiness computes whether an AI assistant connected to WPMgr can work on a site, from what the site last reported. |
|
Package aitrust holds what a person chooses about how much AI connections may do without asking (ADR-065): a site's mode, a connection's switch for automatic changes, the connection's automatic usage against the server's fixed limits, and the AI activity feed.
|
Package aitrust holds what a person chooses about how much AI connections may do without asking (ADR-065): a site's mode, a connection's switch for automatic changes, the connection's automatic usage against the server's fixed limits, and the AI activity feed. |
|
api
|
|
|
gen
Package gen holds the ogen-generated OpenAPI types, validation, and client.
|
Package gen holds the ogen-generated OpenAPI types, validation, and client. |
|
Package apikey implements tenant-scoped API keys: generation of the `wpmgr_<prefix>_<secret>` token, sha256 hashing (only the hash + prefix are stored), and the create/list/revoke/authenticate operations.
|
Package apikey implements tenant-scoped API keys: generation of the `wpmgr_<prefix>_<secret>` token, sha256 hashing (only the hash + prefix are stored), and the create/list/revoke/authenticate operations. |
|
Package assistantrequest is everything a person and the dispatch worker do with an AI connection's cache-clear request once the connection has asked: the queue, approve and decline, the worker that sends an approved request to the site, and the sweeper and reconciler that close whatever is left open.
|
Package assistantrequest is everything a person and the dispatch worker do with an AI connection's cache-clear request once the connection has asked: the queue, approve and decline, the worker that sends an approved request to the site, and the sweeper and reconciler that close whatever is left open. |
|
Package audit implements an append-only, per-tenant hash-chained audit log.
|
Package audit implements an append-only, per-tenant hash-chained audit log. |
|
Package auth implements human and machine authentication for WPMgr: argon2id password hashing, the session manager (SCS), the email+password and OIDC login flows, and the request principal middleware that replaces the old X-Tenant-ID stub.
|
Package auth implements human and machine authentication for WPMgr: argon2id password hashing, the session manager (SCS), the email+password and OIDC login flows, and the request principal middleware that replaces the old X-Tenant-ID stub. |
|
twofactor
Package twofactor: recovery code generation and format helpers.
|
Package twofactor: recovery code generation and format helpers. |
|
Package authz defines the WPMgr role hierarchy, the permission matrix, and the helpers handlers/middleware use to enforce role minimums and discrete permissions.
|
Package authz defines the WPMgr role hierarchy, the permission matrix, and the helpers handlers/middleware use to enforce role minimums and discrete permissions. |
|
Package autologin implements the Phase 5.5 One-Click Login feature (ADR-030/031).
|
Package autologin implements the Phase 5.5 One-Click Login feature (ADR-030/031). |
|
Package backup implements the M4 incremental backup & restore feature.
|
Package backup implements the M4 incremental backup & restore feature. |
|
Package billing is the ONLY place in the control plane that knows the hosted-SaaS plan ladder (M16 Phase A).
|
Package billing is the ONLY place in the control plane that knows the hosted-SaaS plan ladder (M16 Phase A). |
|
razorpay
Package razorpay implements billing.Provider for Razorpay — the SECOND payment provider (alongside internal/billing/stripe), added for India pricing.
|
Package razorpay implements billing.Provider for Razorpay — the SECOND payment provider (alongside internal/billing/stripe), added for India pricing. |
|
stripe
Package stripe implements billing.Provider for Stripe.
|
Package stripe implements billing.Provider for Stripe. |
|
Package blobstore is a thin S3-compatible object-storage client over aws-sdk-go-v2 (ADR-010).
|
Package blobstore is a thin S3-compatible object-storage client over aws-sdk-go-v2 (ADR-010). |
|
Package client implements the agency clients domain: tenant-level client records that group WordPress sites under customer entities.
|
Package client implements the agency clients domain: tenant-level client records that group WordPress sites under customer entities. |
|
Package config loads WPMgr control-plane configuration using koanf, with a defaults < file < env precedence and the WPMGR_ env prefix (ADR-007).
|
Package config loads WPMgr control-plane configuration using koanf, with a defaults < file < env precedence and the WPMGR_ env prefix (ADR-007). |
|
Package content owns the page-ownership inventory (Track B slice S1): which editor owns each page on a site, and whether the content column is the thing a visitor sees.
|
Package content owns the page-ownership inventory (Track B slice S1): which editor owns each page on a site, and whether the content column is the thing a visitor sees. |
|
Package cryptbox holds the control plane's shared secret-at-rest primitive: an age (X25519) identity used to encrypt customer/operator secrets before they touch Postgres.
|
Package cryptbox holds the control plane's shared secret-at-rest primitive: an age (X25519) identity used to encrypt customer/operator secrets before they touch Postgres. |
|
Package db provides the pgx connection pool, an Atlas migration runner, and the RLS helper that scopes tenant-isolated work to a single transaction by setting the app.tenant_id GUC.
|
Package db provides the pgx connection pool, an Atlas migration runner, and the RLS helper that scopes tenant-isolated work to a single transaction by setting the app.tenant_id GUC. |
|
Package dbclean implements the Database Cleaner corpus-based classification pipeline.
|
Package dbclean implements the Database Cleaner corpus-based classification pipeline. |
|
Package diagnostics holds the ADR-037 Sprint 2 "site health" domain on the control-plane side.
|
Package diagnostics holds the ADR-037 Sprint 2 "site health" domain on the control-plane side. |
|
Package domain holds cross-cutting domain primitives: typed errors shared by all domains, a Clock abstraction, and the canonical error->HTTP mapping used by handlers.
|
Package domain holds cross-cutting domain primitives: typed errors shared by all domains, a Clock abstraction, and the canonical error->HTTP mapping used by handlers. |
|
Package elementornative owns the version-pinned ceiling for native controls.
|
Package elementornative owns the version-pinned ceiling for native controls. |
|
Package email is the per-site Email / SMTP Management control-plane domain.
|
Package email is the per-site Email / SMTP Management control-plane domain. |
|
Package files implements the File Manager feature (P1 read-only + P2 write).
|
Package files implements the File Manager feature (P1 read-only + P2 write). |
|
Package govcontext implements ADR-064: governed, versioned, human-authored context at two scopes — organisation (layer 2) and site (layer 3) of the seven-layer precedence order fixed by ADR-064 Decision 1 — plus the single shared resolver (Decision 8) that both the effective-context preview (GET .../context/effective) and any future model-facing assembly path call.
|
Package govcontext implements ADR-064: governed, versioned, human-authored context at two scopes — organisation (layer 2) and site (layer 3) of the seven-layer precedence order fixed by ADR-064 Decision 1 — plus the single shared resolver (Decision 8) that both the effective-context preview (GET .../context/effective) and any future model-facing assembly path call. |
|
Package httpclient centralizes the control plane's outbound HTTP client.
|
Package httpclient centralizes the control plane's outbound HTTP client. |
|
Package humantext is the one sanitiser for text a person reads that something other than WPMgr could have written: a site's name, a connection's name, or a message a site's agent reported.
|
Package humantext is the one sanitiser for text a person reads that something other than WPMgr could have written: a site's name, a connection's name, or a message a site's agent reported. |
|
Package invitation implements the tokenized invite-accept flow for both org membership invitations (scope=org) and per-site share invitations (scope=site).
|
Package invitation implements the tokenized invite-accept flow for both org membership invitations (scope=org) and per-site share invitations (scope=site). |
|
Package ipprovider infers the hosting/infrastructure provider of a managed site from the public egress IP the control plane observes on the agent's signed requests.
|
Package ipprovider infers the hosting/infrastructure provider of a managed site from the public egress IP the control plane observes on the agent's signed requests. |
|
Package loginbrand implements the M14 Login Whitelabel feature: a per-site login brand config (logo URL, logo link, message) stored on the control plane and pushed to the agent via a signed `sync_login_brand` command.
|
Package loginbrand implements the M14 Login Whitelabel feature: a per-site login brand config (logo URL, logo link, message) stored on the control plane and pushed to the agent via a signed `sync_login_brand` command. |
|
Package mailer is WPMgr's neutral transactional-email service: it loads the instance SMTP transport (DB row first, env fallback), renders brand HTML + plaintext templates, and sends over an SSRF-hardened go-mail client.
|
Package mailer is WPMgr's neutral transactional-email service: it loads the instance SMTP transport (DB row first, env fallback), renders brand HTML + plaintext templates, and sends over an SSRF-hardened go-mail client. |
|
Package mcp is the read-only MCP connection surface (ADR-064 S6b).
|
Package mcp is the read-only MCP connection surface (ADR-064 S6b). |
|
Package media implements the Media Optimizer control-plane domain (ADR-043): the CP-side orchestration of JPEG/PNG → WebP/AVIF optimization that runs the actual encode in a SEPARATE optional media-encoder service.
|
Package media implements the Media Optimizer control-plane domain (ADR-043): the CP-side orchestration of JPEG/PNG → WebP/AVIF optimization that runs the actual encode in a SEPARATE optional media-encoder service. |
|
encoder
Package encoder is the lilliput-backed (CGO) image encoder for the Media Optimizer.
|
Package encoder is the lilliput-backed (CGO) image encoder for the Media Optimizer. |
|
font
Package font provides server-side font transcoding for the WPMgr media pipeline.
|
Package font provides server-side font transcoding for the WPMgr media pipeline. |
|
handler
Package handler serves the Media Optimizer HTTP surface: the operator-facing dashboard routes under /api/v1/sites/:siteId/media/...
|
Package handler serves the Media Optimizer HTTP surface: the operator-facing dashboard routes under /api/v1/sites/:siteId/media/... |
|
model
Package model holds the PURE-Go domain types for the Media Optimizer (ADR-043).
|
Package model holds the PURE-Go domain types for the Media Optimizer (ADR-043). |
|
repo
Package repo is the persistence layer for the Media Optimizer domain.
|
Package repo is the persistence layer for the Media Optimizer domain. |
|
service
Package service is the Media Optimizer orchestration layer (ADR-043).
|
Package service is the Media Optimizer orchestration layer (ADR-043). |
|
Package metrics is the WPMgr uptime metrics store: a thin abstraction over the time-series backend used for uptime check results.
|
Package metrics is the WPMgr uptime metrics store: a thin abstraction over the time-series backend used for uptime check results. |
|
Package middleware provides Gin middleware: request-id injection, structured slog request logging, panic recovery, and tenant-context extraction.
|
Package middleware provides Gin middleware: request-id injection, structured slog request logging, panic recovery, and tenant-context extraction. |
|
Package objectcache is the control-plane domain for per-site object cache management (M68).
|
Package objectcache is the control-plane domain for per-site object cache management (M68). |
|
delete_handler.go — GH #152 part 2: owner-facing organisation deletion.
|
delete_handler.go — GH #152 part 2: owner-facing organisation deletion. |
|
Package perf is the Performance Suite control-plane domain (ADR-046, Phase 6).
|
Package perf is the Performance Suite control-plane domain (ADR-046, Phase 6). |
|
Package portal serves the m66 read-only client portal endpoints.
|
Package portal serves the m66 read-only client portal endpoints. |
|
Package pricing serves the PUBLIC, unauthenticated GET /api/v1/pricing endpoint the marketing site reads to show accurate hosted-plan prices.
|
Package pricing serves the PUBLIC, unauthenticated GET /api/v1/pricing endpoint the marketing site reads to show accurate hosted-plan prices. |
|
Package report implements the white-label client-report domain (m64): schedule management, on-demand generation, HTML + PDF rendering, and email delivery.
|
Package report implements the white-label client-report domain (m64): schedule management, on-demand generation, HTML + PDF rendering, and email delivery. |
|
render/html
Package html renders ReportData as a self-contained HTML document.
|
Package html renders ReportData as a self-contained HTML document. |
|
render/pdf
Package pdf contains the PDF renderer for client reports.
|
Package pdf contains the PDF renderer for client reports. |
|
reportdata
Package reportdata defines the ReportData struct and all sub-types used as the single aggregation shape for HTML rendering, PDF rendering, and the JSON snapshot stored in generated_reports.data_snapshot.
|
Package reportdata defines the ReportData struct and all sub-types used as the single aggregation shape for HTML rendering, PDF rendering, and the JSON snapshot stored in generated_reports.data_snapshot. |
|
restore
|
|
|
sqlinspect
Package sqlinspect produces a structured projection of a mysqldump-style SQL dump: per-table inventory, charset, table prefix, and WordPress hints (siteurl / home / db_version probed from a wp_options multi-row INSERT).
|
Package sqlinspect produces a structured projection of a mysqldump-style SQL dump: per-table inventory, charset, table prefix, and WordPress hints (siteurl / home / db_version probed from a wp_options multi-row INSERT). |
|
rucss
|
|
|
engine
Package engine is the pure-Go Remove-Unused-CSS (RUCSS) engine for the WPMgr performance suite.
|
Package engine is the pure-Go Remove-Unused-CSS (RUCSS) engine for the WPMgr performance suite. |
|
model
Package model holds the RUCSS domain view-models.
|
Package model holds the RUCSS domain view-models. |
|
repo
Package repo is the persistence layer for the RUCSS domain.
|
Package repo is the persistence layer for the RUCSS domain. |
|
service
Package service is the RUCSS business logic: it computes (or returns a cached) "used CSS" for one page-structure, stores the gzip-compressed result in object storage, and records the metadata in rucss_results.
|
Package service is the RUCSS business logic: it computes (or returns a cached) "used CSS" for one page-structure, stores the gzip-compressed result in object storage, and records the metadata in rucss_results. |
|
worker
Package worker is the River integration for the RUCSS domain: the rucss_process job, its worker, and a RiverEnqueuer.
|
Package worker is the River integration for the RUCSS domain: the rucss_process job, its worker, and a RiverEnqueuer. |
|
Package rum is the Real User Monitoring (RUM) control-plane domain (M56).
|
Package rum is the Real User Monitoring (RUM) control-plane domain (M56). |
|
Package scan implements the S3 Malware / File-Integrity Scan domain on the control-plane side.
|
Package scan implements the S3 Malware / File-Integrity Scan domain on the control-plane side. |
|
Package screenshot manages the capture, storage, and serving of per-site WordPress homepage screenshots.
|
Package screenshot manages the capture, storage, and serving of per-site WordPress homepage screenshots. |
|
capture
Package capture implements the site_screenshot_capture River worker.
|
Package capture implements the site_screenshot_capture River worker. |
|
ssrfproxy
Package ssrfproxy provides an in-process CONNECT proxy whose dialer runs every outbound connection through the code.dny.dev/ssrf guardian.
|
Package ssrfproxy provides an in-process CONNECT proxy whose dialer runs every outbound connection through the code.dny.dev/ssrf guardian. |
|
Package screenshotadapter bridges the site and screenshot packages without creating a circular import.
|
Package screenshotadapter bridges the site and screenshot packages without creating a circular import. |
|
Package security implements the S2 Login Protection + IP store domain and the Phase 1 hardening config + ban list (ADR-057) on the control-plane side.
|
Package security implements the S2 Login Protection + IP store domain and the Phase 1 hardening config + ban list (ADR-057) on the control-plane side. |
|
Package server wires the Gin engine, middleware stack, route groups, system endpoints (/healthz, /readyz), and graceful shutdown.
|
Package server wires the Gin engine, middleware stack, route groups, system endpoints (/healthz, /readyz), and graceful shutdown. |
|
httpx
Package httpx holds the central HTTP error->response mapping shared by all Gin handlers, so error semantics (status code + Error body) are consistent.
|
Package httpx holds the central HTTP error->response mapping shared by all Gin handlers, so error semantics (status code + Error body) are consistent. |
|
Package settings serves the instance-level SMTP configuration UI (ADR-045 Phase 1): GET (masked), PUT (age-encrypts the password on write), and a send-test that reuses the mailer's SSRF-guarded transport.
|
Package settings serves the instance-level SMTP configuration UI (ADR-045 Phase 1): GET (masked), PUT (age-encrypts the password on write), and a send-test that reuses the mailer's SSRF-guarded transport. |
|
Package sharing implements per-site collaborator grants (site_shares table).
|
Package sharing implements per-site collaborator grants (site_shares table). |
|
Package site implements the site domain: WordPress sites managed under a tenant.
|
Package site implements the site domain: WordPress sites managed under a tenant. |
|
events
Package events implements the ADR-038 cross-instance SSE bus for site connection-lifecycle events: a durable site_events journal + Postgres LISTEN/NOTIFY fan-out, a tenant-keyed in-process subscriber Hub, and the dashboard SSE endpoint plumbing.
|
Package events implements the ADR-038 cross-instance SSE bus for site connection-lifecycle events: a durable site_events journal + Postgres LISTEN/NOTIFY fan-out, a tenant-keyed in-process subscriber Hub, and the dashboard SSE endpoint plumbing. |
|
Package siteaddr holds the one rule for when two spellings of a site address name the same WordPress install, and when a reported address may replace a stored one.
|
Package siteaddr holds the one rule for when two spellings of a site address name the same WordPress install, and when a reported address may replace a stored one. |
|
Package sitedestination is the per-site backup-destination domain (ADR-036 P1).
|
Package sitedestination is the per-site backup-destination domain (ADR-036 P1). |
|
Package sitetag implements the GH #230 "rich tags" tenant-level tag registry (m100).
|
Package sitetag implements the GH #230 "rich tags" tenant-level tag registry (m100). |
|
Package telemetry initializes the OpenTelemetry tracer/meter providers with graceful shutdown (ADR-011).
|
Package telemetry initializes the OpenTelemetry tracer/meter providers with graceful shutdown (ADR-011). |
|
Package tenant implements the tenant domain: the registry of customer tenants the control plane serves.
|
Package tenant implements the tenant domain: the registry of customer tenants the control plane serves. |
|
Package update implements the M3 bulk plugin/theme/core update feature: an operator creates an update run targeting a selection of sites and items; the control plane fans the work out into per-(site,item) tasks executed by a River worker that snapshots, applies the update via a signed CP->agent command, health-probes the site, and auto-rolls-back on failure.
|
Package update implements the M3 bulk plugin/theme/core update feature: an operator creates an update run targeting a selection of sites and items; the control plane fans the work out into per-(site,item) tasks executed by a River worker that snapshots, applies the update via a signed CP->agent command, health-probes the site, and auto-rolls-back on failure. |
|
GH #291 Phase 3: application-health ALERTING.
|
GH #291 Phase 3: application-health ALERTING. |
|
alertdispatch.go — m103 (GH #247) vulnerability alerting.
|
alertdispatch.go — m103 (GH #247) vulnerability alerting. |
|
Package webhooktext prepares site-supplied values for alert webhook text.
|
Package webhooktext prepares site-supplied values for alert webhook text. |
|
Package wpfatal recognises the error documents WordPress itself renders, by their structure: the wp_die() screen, which carries WordPress's critical-error screen, and the database connection failure screen.
|
Package wpfatal recognises the error documents WordPress itself renders, by their structure: the wp_die() screen, which carries WordPress's critical-error screen, and the database connection failure screen. |
|
Package wpversion implements WordPress version-comparison semantics, replicating the behaviour of PHP's version_compare() function as documented in the PHP manual and as used by the WordPress plugin ecosystem.
|
Package wpversion implements WordPress version-comparison semantics, replicating the behaviour of PHP's version_compare() function as documented in the PHP manual and as used by the WordPress plugin ecosystem. |
Click to show internal directories.
Click to hide internal directories.