internal/

Package accountlinks holds the Account links of C-18: which messenger account, in which identity space, acts as which User.

Package api is the HTTP API of the app listener (ADR-0008): the strict server generated from api/openapi.yaml, mounted under /api/v1, behind the middleware of the contract — request metrics, authentication by a bearer token or the session cookie, the CSRF check of the session, request validation and the Permission of each operation's x-permission — with every error answered as an RFC 9457 problem.

Package audit is the writer of the Audit log (C-03.FR-14): it appends an entry to audit_log with the actor, the token used, the Transport, a stable action `<resource>.<verb>`, the resource, a before/after diff and details, and copies every entry to stdout as the log event audit_entry.

Package auth signs people in and keeps their sessions (C-03): local sign-in with argon2id passwords and its throttling, the second step of a user with TOTP and the limited session states, sessions in PostgreSQL carried in the muster_session cookie, the CSRF token derived from the session, the password change, the client address behind trusted proxies, and the Permissions of the Roles.

Package buildinfo holds the version and commit injected at build time with -ldflags -X.

Package buttons holds the Command buttons of messages (C-12.FR-1, reference.md "Buttons and links by status") and their signed action ids (ADR-0011).

Package cli parses the command line of the muster binary and runs its subcommands.

Package clock holds the two clocks of Muster, which code takes by injection instead of calling time.Now() or SQL now() (ADR-0006).

Package config reads the bootstrap settings of C-02.FR-1 and FR-2 from the environment (ADR-0010): only MUSTER_* variables, read with caarlos0/env and checked with go-playground/validator.

Package connections holds the Connections of C-13.FR-1, FR-6 and C-14.FR-1: a messenger server or bot that Destinations post through.

Package db holds the database connections (ADR-0006): the main pool, for every query, and the session connection, for what needs a real session — the migration lock here, the Leader lock and LISTEN later.

Package delivery is the delivery engine (C-11, ADR-0005): the Desired state of each Root message per Alert Group and Destination, which the dispatcher's re-render step sets through Enqueue; the delivery worker, which brings the actual message to the latest Desired state with one call per change, Urgent first and within the limiters of the Destination and its Connection; Thread replies with the Thread batching window; the interactive path for calls a person waits for; the delivery events; and the Telegram copy buffer of comment Threads.

Package destinations holds the Destinations (C-11.FR-18): Mattermost channels and Telegram channels reached through a Connection, and outgoing webhooks.

Package devmode is the development mode of `muster dev`: its published defaults, the rule that lets the environment replace them, the fake Alertmanager, Mattermost, Telegram and OIDC servers, the fake webhook receiver and the fake HTTP and SOCKS5 proxies on fixed loopback addresses, the demo OIDC configuration, and Muster itself in the same process, against the development database and migrated on start, with the demo Integration that the fake Alertmanager sends to; and the development clock that every replica of the development database shares.

Package doctor is `muster doctor` (C-02.FR-14, FR-15): it checks the database, its connections, the Keyring and the clock, prints one line per check as `OK|WARN|FAIL <check>: <detail>` and reports whether any check failed.

Package groups is the Alert Group lifecycle (C-09, ADR-0003, ADR-0004, ADR-0016): grouping of newly firing Alerts, the state machine with its system transitions, the Timeline with the lifecycle events, and the reads of one Alert Group.

Package heartbeat holds the Heartbeat of C-07: the endpoint on the ingest listener that records the signals of an Integration's Alertmanager, the four Heartbeat states, the liveness clock that the signals advance, and the Leader's Heartbeat check that makes a silent Integration Heartbeat lost and raises MusterHeartbeatLost.

Package ingest is the ingestion of C-05 on the ingest listener: it takes a webhook with an Integration token, stores its body exactly as received as a pending Stored Snapshot in one short insert-only transaction and answers 202 once it committed (ADR-0002).

Package integrations holds the Integrations of C-05: one per Alertmanager cluster, with its Connection mode, Static labels, duplicate window, Heartbeat settings and Integration tokens.

Package internalalerts holds the closed registry of Internal alerts (C-06.FR-14, ADR-0014) and raises and resolves them.

Package keyring holds the master keys of ADR-0011: the Keyring loaded through a key provider, each key's id derived from its material, the sub-keys derived per purpose, AES-256-GCM encryption of secret fields, the active key and the key canary in keyring_state, and the replica key records in replicas.

Package leader elects the Leader (C-02.FR-10, ADR-0007): one replica holds a session advisory lock with a constant key on a dedicated connection and runs the closed list of Leader tasks in tasks.go.

Package links holds the links of C-12.FR-9: the Organization's Lookup tables — named columns and rows of a key and one value per column, which a template reads one cell of with `lookup "<table>" <key> "<column>"` — and its Link rules — a name, Matchers checked against an Alert Group's common labels, a scope and a URL template run in the sandbox of ADR-0012 — with the built-in "Explore" rule.

Package live is the stream of live-update hints (ADR-0009; C-09.FR-25, C-03.FR-18): each replica runs one Hub that takes the hints of LISTEN/NOTIFY — writers send them in the transaction of their change — and of its own notice watcher, and fans them out to its server-sent events streams.

Package logging is the domain logger (C-02.FR-17, ADR-0014): one JSON object per line, written only as the events registered in events.go and only with the fields each event declares.

Package matchers parses Matchers in the Alertmanager syntax and matches label sets with them: name, operator (=, !=, =~, !~) and value, the value of =~ and !~ being an RE2 expression anchored at both ends as in Alertmanager, and a label the set lacks counting as the empty value.

Package mattermost is the REST client of Mattermost Connections (C-13.FR-1): the calls of the Mattermost REST API v4 with the bot token as a bearer token, through internal/outbound with the Connection's proxy, in the client class of the caller (ADR-0015); and the Destination check of a Mattermost Destination (C-13.FR-10).

Package mentions holds the Mention settings of C-12.FR-8 and FR-12: whom a Destination mentions for each kind of Loud event — nobody, everyone in the chat with the word its messenger offers, chosen Users or messenger groups — validated per Destination type, and the resolution of a Loud message's symbolic Mentions into targets: the Destination's setting for a kind, the Owner the lifecycle event recorded, or its previous Owner.

Package messages renders what Muster sends to messengers (C-12): the markup-neutral Root message of C-12.FR-1 with its default content, the Thread replies, the Storm summary and the notices, in English or Russian per route.language and with absolute times in organization.time_zone; Route templates run in the sandbox of ADR-0012 with a dry run on save and a preview, and the Fallback template stands in for a template that fails at runtime.

Package metrics is the metric registry (C-02.FR-19, ADR-0014): every metric Muster exports is declared in catalogue.go with its type, labels, capability and, for histograms, its le buckets, and is reachable only through the handles the declarations return.

Package oidc is sign-in through an OpenID Connect identity provider (C-03): the OIDC settings with their write-only client secret, proxy, warnings and connection check, the back channel to the identity provider through the outbound HTTP package, and the redirect flow with PKCE that creates users on their first sign-in, maps their groups to a Role and opens their sessions, linking an identity to an account from its web session, and the offline token with the background re-checks of OIDC users at the identity provider.

Package organization holds the single Organization of L1 and its settings (C-02.FR-23): the start-up step that creates it with the defaults of defaults.md together with its outbound address policy, and the read accessor that later capabilities use.

Package outbound is the only code that makes outbound HTTP requests (ADR-0015, C-02.FR-20 to FR-22): clients are built per client class with a connect timeout and an overall timeout, never follow redirects, classify every answer into an outcome, retry by the policy of their class, redact registered secrets from everything they log and return, count their requests in the muster_client_* metrics, and connect only to addresses that pass the Organization's outbound address policy, directly or through their own proxy.

Package partitions maintains the partitions of the five partitioned tables (C-02.FR-11, design/db/schema.md §6): it creates the partitions Muster will need ahead of time, at startup before serving and hourly on the Leader, and drops a partition whose whole range is older than the Organization's retention period.

Package proxyconf is the shared proxy settings object (C-03.FR-19, C-02.FR-22): whether a client uses a proxy of its own, its type, address and username, stored as `proxy jsonb`, and its password, a Secret stored beside it with the helper of internal/keyring.

Package publicid generates and parses the opaque public_id of every resource (ADR-0008): a type prefix and 12 random characters of Crockford base32 (60 bits) from crypto/rand, written in upper case.

Package routing holds the Routes of C-08 and routes Alerts with them.

Package runtime wires the process: the server command, `muster migrate` and Muster inside `muster dev`.

Package server runs the three listeners of C-02.FR-3: ingest (ingestion, Heartbeat, Mattermost callbacks, the Telegram webhook), app (UI and API) and internal (health and metrics).

Package telegram is the Bot API client of Telegram Connections (C-14.FR-1, FR-10 to FR-12): calls to `<base>/bot<token>/<method>` through internal/outbound with the Connection's proxy, in the client class of the caller (ADR-0015), with the bot token registered for redaction so that every error and log line carries `bot[redacted]`; the step-by-step connection check with its dry probe; and the receiving of updates — long polling on the Leader or the webhook endpoint with its secret token — and the update router both modes share; the Destination check of a Telegram Destination and the delivery adapter of its Root messages.

Package templates is the template sandbox of ADR-0012 (C-12.FR-4): Go text/template with the sprout registries strings, lists, maps, conversions and regular expressions (RE2) registered explicitly, Alertmanager's template functions under their Alertmanager names, and `now` from Muster's business clock.

Package timers is the worker of the timer rows (C-09.FR-12, ADR-0006, ADR-0007): on every replica it claims the due timers of each Organization with FOR UPDATE SKIP LOCKED and a lease, fires each in a transaction of its own through the handler of its kind, and waits for the earliest deadline, a notification of a new timer or a move of the development clock.

Package tokens holds the API tokens of C-04: Personal access tokens, which act as their User with Permissions narrowed to the ones chosen for them, and Service accounts with a Role and their tokens.

Package totp is the second factor of the users (C-03.FR-10, FR-11, FR-27): TOTP of RFC 6238 — six digits, 30-second steps, HMAC-SHA-1 for authenticator compatibility and one step of tolerance either way — with the seed stored as a Secret through the Keyring, a pending seed between the start of an enrolment and its confirmation, a replay guard that accepts each time step once, and single-use recovery codes hashed with argon2id.

Package users holds the Users of the Organization (C-03): reading a user, the profile a user edits — display name, time zone and language — the start-up step that creates the bootstrap Admin, the administration of users by Admins with the rule that the Organization keeps an active Admin, the single-use password setup links and the emergency password reset of the CLI.

Package webhooks is the outgoing webhook (C-15): the request templates of the events mode with their Secrets, the Signing secret in the style of the Standard Webhooks specification, the version 1 body of an event with its Mentions as data, and the adapter that sends an event through internal/outbound under the outbound address policy and the Destination's proxy and maps the answer to a delivery outcome.