internal/

Package authorityapi serves the built-in authority HTTP API.

Package authorityclient calls the authority API.

Package authorization authorizes control operations and builds stable request hashes.

Package benchworkload contains the publisher and visitor workloads shared by local runtime tests and deployed benchmarks.

Package certificates uses ACME to issue route and relay transport certificates.

Package clientauth handles CLI login and coordinates control-session refresh.

Package clientstate stores local client data and tunnel snapshots.

Package clioutput renders stable human-readable CLI diagrams.

Package config defines the versioned YAML and JSON configuration format.

Package controlapi serves the control API and authorizes route operations.

Package controlclient calls the tnl control API.

Package controlstate stores persistent control state in PostgreSQL and changes that state in transactions.

Package controltls configures automatic public TLS for the control API.

Package credentials creates and validates typed credentials.

Code generated by scripts/generate-diagnostic-codes.ts.

Package dnscontroller applies persistent DNS changes requested by control.

Package filelock acquires user-owned, mode-0600 regular lock files on Unix.

Package httpclient contains shared HTTP client policy for internal clients.

Package httpjson reads and writes size-limited JSON.

Package ingress routes TLS connections by exact SNI hostname without terminating their TLS.

Package ingressapi serves control's private API for ingress processes.

Package localproxy forwards one public hostname to one local HTTP target.

Package muxsession carries multiplexed byte streams over supported transports.

Package naming defines public-hostname rules used by control and ingress.

Package observability provides process and service metrics without depending on one metrics provider.

Package oidcauth implements OIDC authentication and CLI login flows.

Package opaqueid creates and validates opaque 128-bit identifiers.

Package problemtype defines canonical API problem type URIs.

Package projectconfig finds, loads, and validates project configuration.

Package projectmeta validates and writes browser-safe project metadata.

Package proxyproto implements tnl's strict PROXY protocol v2 boundary.

Package publicurlusage defines public URL usage data that can be combined across reports.

Package publicurlusageworker finishes and sends stored public URL usage reports.

Package publisher publishes one local service through a public URL.

Package relayapi serves control's private API for relay processes.

Package routebackend defines how ingress opens a visitor stream to a publisher.

Package router reads a size-limited TLS ClientHello and preserves every byte so the connection can replay it.

Package serviceapi provides HTTP helpers for the private service APIs.

Package sqlite manages client SQLite connections and migrations.

Package storagekey encrypts recoverable secrets stored by control.

Package streamcopy copies bytes in both directions and preserves half-closes.

Package tlschallenge manages publisher-local TLS challenge keys and certificates.

Package tnldconfig loads and validates tnld process configuration.

Package tunnel runs tunnelv1 sessions over supported transports.