Directories
¶
| Path | Synopsis |
|---|---|
|
Package agentauth statically analyzes an agent / MCP / on-behalf-of token against the agent-auth invariants in the threat taxonomy (internal/threats, "agent" domain).
|
Package agentauth statically analyzes an agent / MCP / on-behalf-of token against the agent-auth invariants in the threat taxonomy (internal/threats, "agent" domain). |
|
Package api serves the Keyway HTTP API (PRD §12) and the embedded web dashboard.
|
Package api serves the Keyway HTTP API (PRD §12) and the embedded web dashboard. |
|
Package app is Keyway's application (use-case) layer.
|
Package app is Keyway's application (use-case) layer. |
|
Package attack is Keyway's generative, invariant-based JWT attack harness.
|
Package attack is Keyway's generative, invariant-based JWT attack harness. |
|
Package attribution binds contract changes to their cause: a git commit/PR, a Kubernetes deploy, or a Keycloak admin event (PRD §16 OPEN-5).
|
Package attribution binds contract changes to their cause: a git commit/PR, a Kubernetes deploy, or a Keycloak admin event (PRD §16 OPEN-5). |
|
Package blastradius answers "if I make this change, who breaks?" and derives a safe grace period (PRD §10).
|
Package blastradius answers "if I make this change, who breaks?" and derives a safe grace period (PRD §10). |
|
Package cli builds the Keyway command tree, shared by the `keyway` CLI and the `keyway-runner` daemon binaries.
|
Package cli builds the Keyway command tree, shared by the `keyway` CLI and the `keyway-runner` daemon binaries. |
|
Package config loads and validates Keyway runtime configuration from a YAML file and/or environment variables.
|
Package config loads and validates Keyway runtime configuration from a YAML file and/or environment variables. |
|
Package contract assembles the derived contract graph, hashes it canonically, and manages versioning / the baseline flow.
|
Package contract assembles the derived contract graph, hashes it canonically, and manages versioning / the baseline flow. |
|
Package coordination provides the cross-process seams a multi-replica Keyway deployment needs: a shared idempotency store (so a retried write replays the same result on any replica) and a leader gate (so exactly one replica runs the scheduler).
|
Package coordination provides the cross-process seams a multi-replica Keyway deployment needs: a shared idempotency store (so a retried write replays the same result on any replica) and a leader gate (so exactly one replica runs the scheduler). |
|
Package diff compares two contract versions and classifies each field change.
|
Package diff compares two contract versions and classifies each field change. |
|
Package discovery derives the consumer inventory automatically from cluster and config sources.
|
Package discovery derives the consumer inventory automatically from cluster and config sources. |
|
envoy
Package envoy discovers consumers from Envoy jwt_authn provider configuration.
|
Package envoy discovers consumers from Envoy jwt_authn provider configuration. |
|
istio
Package istio discovers consumers from Istio RequestAuthentication resources (confidence 1.0 — declarative and unambiguous).
|
Package istio discovers consumers from Istio RequestAuthentication resources (confidence 1.0 — declarative and unambiguous). |
|
k8s
Package k8s discovers consumers from Kubernetes Services, their backing workloads, and projected service-account token volumes (PRD §7.3).
|
Package k8s discovers consumers from Kubernetes Services, their backing workloads, and projected service-account token volumes (PRD §7.3). |
|
kube
Package kube builds Kubernetes API clients for the in-cluster discovery path.
|
Package kube builds Kubernetes API clients for the in-cluster discovery path. |
|
oidcclient
Package oidcclient discovers consumers from an OIDC provider's client registry (Keycloak).
|
Package oidcclient discovers consumers from an OIDC provider's client registry (Keycloak). |
|
Package issuer defines the issuer adapter interface and provides per-issuer-type implementations (keycloak, k8ssa, generic).
|
Package issuer defines the issuer adapter interface and provides per-issuer-type implementations (keycloak, k8ssa, generic). |
|
generic
Package generic implements issuer.Adapter for a generic OIDC issuer whose signing keys Keyway controls locally.
|
Package generic implements issuer.Adapter for a generic OIDC issuer whose signing keys Keyway controls locally. |
|
k8ssa
Package k8ssa implements issuer.Adapter for Kubernetes service-account token issuers.
|
Package k8ssa implements issuer.Adapter for Kubernetes service-account token issuers. |
|
keycloak
Package keycloak implements issuer.Adapter for Keycloak realms.
|
Package keycloak implements issuer.Adapter for Keycloak realms. |
|
localkeys
Package localkeys manages a set of locally-controlled signing keys and the JOSE operations Keyway performs with them: minting tokens, publishing a JWKS, and running the announce → active → retired key lifecycle used by the canary flow (PRD §4.1, §6, §10).
|
Package localkeys manages a set of locally-controlled signing keys and the JOSE operations Keyway performs with them: minting tokens, publishing a JWKS, and running the announce → active → retired key lifecycle used by the canary flow (PRD §4.1, §6, §10). |
|
oidc
Package oidc provides OIDC discovery and JWKS fetching over HTTP, shared by issuer adapters that read an issuer's published metadata.
|
Package oidc provides OIDC discovery and JWKS fetching over HTTP, shared by issuer adapters that read an issuer's published metadata. |
|
Package issuerregistry builds and holds live issuer adapters, the runtime home of Keyway-operated signing keys and canary state.
|
Package issuerregistry builds and holds live issuer adapters, the runtime home of Keyway-operated signing keys and canary state. |
|
Package keystore persists Keyway-operated signing keys so canary state survives a daemon restart (KI-09).
|
Package keystore persists Keyway-operated signing keys so canary state survives a daemon restart (KI-09). |
|
Package libdefaults ships Keyway's library-behavior database and looks up known JWKS behavior by library name and version.
|
Package libdefaults ships Keyway's library-behavior database and looks up known JWKS behavior by library name and version. |
|
Package model holds Keyway's core domain types.
|
Package model holds Keyway's core domain types. |
|
Package notify delivers change events to external sinks (Slack, webhooks).
|
Package notify delivers change events to external sinks (Slack, webhooks). |
|
Package ports holds the small shared interfaces (hexagonal "ports") that would otherwise be duplicated across domain packages only to dodge an import cycle.
|
Package ports holds the small shared interfaces (hexagonal "ports") that would otherwise be duplicated across domain packages only to dodge an import cycle. |
|
Package probe mints synthetic tokens and verifies consumer behavior against real staging endpoints (PRD §6).
|
Package probe mints synthetic tokens and verifies consumer behavior against real staging endpoints (PRD §6). |
|
Package store defines the persistence interface for Keyway and provides implementations (see store/postgres).
|
Package store defines the persistence interface for Keyway and provides implementations (see store/postgres). |
|
memory
Package memory is an in-memory store.Store implementation.
|
Package memory is an in-memory store.Store implementation. |
|
open
Package open is the store composition helper: it turns a DSN into a store.Store, so callers depend on the persistence interface rather than a concrete backend.
|
Package open is the store composition helper: it turns a DSN into a store.Store, so callers depend on the persistence interface rather than a concrete backend. |
|
postgres
Package postgres implements store.Store on PostgreSQL via pgx (PRD §2).
|
Package postgres implements store.Store on PostgreSQL via pgx (PRD §2). |
|
Package threats is Keyway's JWT/JWKS/OIDC threat taxonomy — the *denominator* against which detection coverage is measured.
|
Package threats is Keyway's JWT/JWKS/OIDC threat taxonomy — the *denominator* against which detection coverage is measured. |
|
Package version exposes build metadata injected at link time via -ldflags.
|
Package version exposes build metadata injected at link time via -ldflags. |
Click to show internal directories.
Click to hide internal directories.