internal/

Package admin is the server-rendered admin UI: html/template pages from backend/web, htmx for interactivity, the same session cookie and stores as the JSON API.

Package adminpath holds the rules for the per-install admin address: its format, how strong it is, the list of addresses scanners try, and (in generate.go) the random generator.

Package agents is the single source of truth for known AI crawlers and assistants: who they are, what they are for, and (in later phases) how to verify them.

Package analytics keeps the only first-party analytics Hatamoto needs: pageviews and AI-assistant referrals, rolled up per day.

Package auth provides authentication and authorization functionality.

Package author is the legacy authors table, kept for rollback.

Package backup produces and manages owner-run backups: one tar per backup holding the core dump, one dump per plugin schema, the portability export and a manifest.

Package budgetfile compares measured sizes against a committed baseline.

Package builder is the page_doc v2 model: a tree of layout nodes with a validator, pure edit ops, a closed style vocabulary and v1 section conversion.

Package cache is the in-process cache for rendered HTML, sitemaps and site data.

Package config provides application configuration loading from environment variables.

Package database provides PostgreSQL connection management with multi-tenant RLS support.

Package email provides email sending functionality for the application.

Package entity provides a schema-driven JSON-LD generator that reads x-schema-org-type and x-schema-org-property annotations from JSON Schema definitions to produce structured data conforming to Schema.org vocabulary.

Package form provides domain models and repository interfaces for form management.

Package hooks is the host-side engine behind the SDK's typed actions and filters (see pkg/sdk/hooks.go).

Package httpx is the thin layer over net/http.ServeMux that gives the server prefixed, middleware-carrying route groups and a record of every registered pattern (for the route-table test and `hatamoto routes`).

Package importjob runs the WordPress import of the admin wizard: a scan and an import as background jobs on the server's process, their state in hatamoto_import_runs so a restarted server can resume them, and the source credential sealed at rest until the run completes.

Package installstats is the opt-in, anonymous install stats sender.

Package mailsettings stores the SMTP settings an owner saves in the admin.

Package mcpserver is the Model Context Protocol endpoint (/mcp): the tools an AI agent uses to draft, publish and inspect a site.

Package media provides media file management functionality.

Package menu provides domain models and repository interfaces for menu management.

Package middleware provides HTTP middleware for the API server.

Package packages implements the .hmp package format (a zip holding a plugin or a theme), its zip-safety rules, ed25519 signing, the signed registry index and the Postgres store plus manager that installs, activates and removes packages while the server runs.

Package permtext holds the plain-English wording for plugin permissions, shared by the admin install prompt, the public plugin directory and the static registry page.

Package person is the read model of people: every human and every byline is an entity of the builtin `person` content type.

Package pluginhost connects the WASM plugin runtime (internal/wasmhost) to the rest of the core: it loads plugins from a directory, maps their exports onto the hooks engine, and keeps the settings store and the adapters that turn core events into SDK hook payloads.

Package portability writes and reads the full-site archive behind `hatamoto export` and `hatamoto import` (format described in docs/EXPORT.md).

Package recovery keeps the unsaved work of an editor or builder session on the server: one copy per (user, entity), so a closed tab or another browser can offer it back.

Package release defines the signed release formats: the release record (one per version, signed by an offline release key) and the channel manifest (the list of releases a channel offers, signed by the CI manifest key), and verifies them.

Package render renders the public site from layered html/template themes.

Package safefetch is the outbound-network guard shared by plugin http.fetch and the WordPress importer: it resolves a host itself, refuses private, loopback, link-local, metadata and other non-public addresses, and connects to the checked IP literal so DNS cannot answer differently between the check and the connect (rebinding).

Package secretbox seals small secrets (such as API keys) at rest with AES-256-GCM, keyed from the server's secret in a caller-chosen domain.

Package sectiontemplate provides domain models and data operations for section templates.

Package server provides infrastructure initialization.

Package session is the server-side session store for admin logins.

Package siteconfig reads the singleton site configuration row (hatamoto_site_config).

Package spam holds the site-wide spam protection settings and the checks the public form handlers run on every submission.

Package supervisor runs the hatamoto server as a child process, picks which binary it runs from $HATAMOTO_DATA/releases, health-gates every switch and rolls back on its own.

Package taxonomy implements the Phase-2 Hatamoto first-class taxonomy system: tags and categories as a proper many-to-many model that works across every entity schema (not just blog posts), backed by the hatamoto_terms and hatamoto_entity_terms tables introduced in migration 113.

Package testutil holds the small assertion helpers shared by tests, so they stay on the stdlib testing package.

Package updater is the on-box update agent: it reads the signed channel manifest, picks a target under policy, and stages it for the supervisor.

Package urlpattern implements the URL pattern mini-language used for per-schema public routing: parsing, rendering an entity to a path, matching a path back to its variables, and a Router that resolves a path to the schemas that may serve it.

Package user provides user domain models and repository interfaces.

Package wasmhost runs Hatamoto plugins: Extism (wazero) modules built from standard Go (or any Extism PDK language) with a hard sandbox.

Package webhook sends signed outgoing webhooks.

Package wpimport imports a WordPress site into Hatamoto from its REST API or a WXR export: scan report, runner (settings, terms, authors, media, pages, posts, custom post types, menus, redirects, link rewrite) and URL audit.