internal/

Package adminruntime vendors the public @w17/admin-runtime SPA framework into a consuming project.

Package authstore owns w17ctl's machine-local credential store — `~/.w17/auth.yaml`.

Package autosync resolves the dev-DB workflow mode + the active initiative for a project.

Package consoleui serves w17ctl's local web app — a human-facing view and controller over the dev-machine-local project registry (devconfig), each project's lock, and the local Docker daemon.

Package containerdump takes a snapshot of a store whose client tools live where the store does — inside its container.

Package core holds the cross-cutting infrastructure every w17ctl command relies on: project-root discovery, lock loading, the proto tree reader, console-address resolution + dialing, and the shared output writer.

Package devconfig owns w17ctl's dev-machine-local state — `~/.w17/config.yaml`.

Package docker holds the local docker-compose shell-out primitives the stack / project / migrate commands drive.

Package egress checks the project's egress clients (`<proto root>/clients/<name>/`) against the console — the one check `w17ctl verify` (the release gate) and `w17ctl codegen` (before it compiles them) share.

Package gofmtc formats the Go the console generated, on the machine that asked for it.

Package guidestamp records and reads the w17ctl version that wrote a project's AGENTS.md.

Package localtarget derives the localhost DSN for a project's PUBLISHED dev store connections — the zero-flag, zero-env resolution shared by `stack build`, `db snapshot`, and `fixtures apply` so a developer never hand-sets a W17_TARGET_* env for a LOCAL store.

Package lockfile is the thin client's OFFLINE lock reader: a minimal, w17ctl-owned view of the routing fields the deploy path needs to read from w17/lock.yaml WITHOUT a console round-trip.

Package migdecisions reads and writes the decision files under w17/migrate-decisions/ — how a NEEDS_CONFIRM finding is decided in a pull request instead of on somebody's command line.

Package pluginfetch materialises one plugin, at one published version, out of a git repository.

Package pluginrender turns a plugin's AUTHOR tree into its PUBLISHED form.

Package protoscan finds the proto files an IR build needs, by reading what they declare rather than by convention.

Package reconcile is the branch-switch reconcile of the dev DB lifecycle.

Package remote holds the small, shared primitives for w17ctl's remote dev-stack mode: parsing an SSH destination and turning it into the argv fragments that rsync, the remote docker-compose runner, and the tunnel supervisor all need.

Package remotecompose runs `docker compose` on a remote docker host over SSH in remote-stack mode.

Package remotesnap implements TRUE remote-side dev-DB snapshots for remote-stack mode: pg_dump / pg_restore run INSIDE the remote postgres container via `docker compose exec`, and the dump files live on the server under `<remote_path>/.snapshots/<project>`.

Package remotesync builds and runs the one-shot rsync that pushes a project's tree to a remote docker host in remote-stack mode Local is the sole authority — the transfer is strictly one-way local→remote, with `--delete` so a file codegen removed locally is removed remote too (else it lingers and gets baked into the image).

Package schema is the thin client's IR-compile seam: it gathers a project's proto file set + entry roots and calls the console's CompileIR RPC (the loader, the IR build and plugin staging all run server-side).

Package sdkupdate implements `w17ctl sdk update` — moving a project onto a new public sdk/go version.

Package snapstore is the on-disk home for branch-scoped DB snapshots in the dev DB lifecycle.

Package storageclient is the thin client's spine over the GENERATED console-v2 storage services (Initiative/Snapshot/Review/Approval/ Environment/Checkpoint Query+Mutation).

Package tunnel opens the SSH local-forwards that make a remote stack feel local: docker publishes each port on the REMOTE host, and w17ctl runs `ssh -N -L <local>:127.0.0.1:<remote>` so `localhost:<port>` behaves identically.

Package ui implements `w17ctl ui` — the local web app launcher.

Package updatecheck answers "is anything this project runs on behind?" — the client (w17ctl), the SDK the project pins, and every installed plugin — and sorts each answer into REQUIRED or AVAILABLE.

Package verify implements the `w17ctl verify` drift hook — the counterpart to codegen.