internal/

Package cli is ovdb's command-line presentation of the onboarding and configuration capabilities: `ovdb server …`, `ovdb open`, `ovdb config …` and the preview `ovdb status`.

Package client is how every presentation (CLI now, TUI in 1c, and the shared rules the web console relies on) reaches the local OVDB server.

Package envelope is the one error shape every ovdb interface shares: the local API writes it, the CLI prints it (as JSON with --json, or as the "Couldn't …/Why/What you can do" problem pattern otherwise), and later the TUI and web console render it.

Package localserver is the HTTP side of the local OVDB server: the hardening middleware chain, the local API (/api/local/v1/…), the landing page, and the openvaultdb-go data API (/v1/…) mounted behind them.

Package parity is the capability registry: per row of the capability matrix in spec/features/configuration-parity, the CLI command, TUI screen, web route and local API endpoints that implement it, and the documented exceptions for the cells that are missing on purpose.

Package paths resolves where ovdb keeps its configuration, runtime state and data, and creates those directories owner-only — but only the ones it creates itself.

Package preview is the single switch for ovdb's unreleased onboarding surface.

Package redact removes credentials from text before it leaves the server process: error reasons, status, mounts.json and server.log lines.

Package runtime owns the local OVDB server's process lifecycle and the files in the runtime directory: server.json, the instance secret, the home lock and server.log.

Package setup holds the onboarding and configuration services: the documents the local API returns and the pure reads that build the same documents from state files when no server is running.