internal/

Package admin serves the local-only web console for operating a running bridge instance — adding/removing library roots, pairing/revoking client devices, and surfacing scan + uptime stats.

Package advertise enumerates every network endpoint a running bridge is reachable at — LAN IPv4 / IPv6, mDNS hostname, Tailscale interface — so /v1/health can self-report the full list to iOS clients, and the admin pairing QR can bake alternates into `bridge://pair?urls=...`.

Package api implements the HTTP/2 handlers for the v1 wire protocol (see PROTOCOL.md at the repo root).

Package auth manages bearer tokens: generation, hashed storage, and request-time validation.

Package backup snapshots and restores the bridge's state directory.

Package config loads and validates bridge.yaml (library roots, listen address, TLS paths, scan interval).

Package doctor runs environment preflight checks for `bridge init` and `bridge doctor`.

Package dsn builds SQLite URI DSN strings that safely encode filesystem paths containing URL-reserved characters (?, #, %) across POSIX and Windows.

Package enrich looks up external metadata (MusicBrainz, Cover Art Archive) for tracks that are missing MBIDs or artwork, then updates the manifest store.

Package fs resolves client-supplied relative paths against a configured library root and rejects traversal (`..`, absolute paths, symlink escapes).

Package logging owns the bridge's structured-logging entry point.

Package lrucache implements a small bounded LRU cache safe for concurrent use.

Package manifest owns the library index: the SQLite-backed store, per- format tag extractors (FLAC / DSF / ALAC / WAV / MP3), and the filesystem scanner that drives them.

Package mdns advertises the bridge on the local network as _onebit-bridge._tcp.local.

Package packaging renders service-manager unit files (launchd plist on darwin, systemd user unit on linux) and installs them where the user's service manager expects to find them.

Package pairing implements the in-memory state machine for the admin-approval pairing flow.

Package supervision answers a single runtime question: "if this process calls os.Exit(0), will something relaunch us?"

Package tailscale wraps the small surface area of the Tailscale CLI the bridge needs for HTTPS auto-pilot: detecting whether Tailscale is installed and what the local node's MagicDNS name is, and minting an HTTPS certificate via `tailscale cert`.

Package tls mints a self-signed certificate on first run and loads existing cert/key material on subsequent runs.

Package transcode owns offline PCM-upscaling: building sox(1) invocations, choosing variant identifiers + sidecar paths, and the worker pool the CLI subcommand and (in Phase 2.5) the HTTP `POST /v1/upscale` handler share.

Package tsnet wraps the upstream tailscale.com/tsnet library so the bridge can run as its own embedded tailnet node — no external `tailscaled` daemon, no CLI shell-out, no on-disk Let's Encrypt cert files.

Package updater polls the GitHub Releases API for newer 1-bit-bridge builds and drives the full self-update lifecycle: poll → download → SHA-256 verify (always) → platform signature verify (macOS Apple codesign + Team-ID; Linux/Windows currently TLS-of-checksums.txt only, see verify_other.go for the seam where Sigstore / minisign / SignPath would land) → swap (atomic rename on Unix; live rename + caller-driven restart on Windows, see swap_windows.go — note this is NOT the MoveFileEx/MOVEFILE_DELAY_UNTIL_REBOOT "pending rename" mechanism) → arm rollback marker.

Package version exports the server build version and the wire protocol version.