internal/

Package auth holds the constant-time token comparison used to validate the call secret from X-Susan-Permit against the value registered by the connected client.

Package clock provides a Now() abstraction so production code can use the standard time package and tests can inject deterministic time.

Package connect parses the susan:// connect string a box uses to join a relay:

Package exec runs a single shell command in its own process group, captures combined stdout+stderr up to a byte cap, and propagates timeout/kill semantics.

Package ids generates the ephemeral identifiers used by lazysusan:

Package install renders the /get install script.

Package limits implements the rate, miss, unauth, and WS flood limiters.

Package logging provides a tiny JSON-line logger.

Package protocol defines the WebSocket frame types and a few shared close codes used between susan and tray.

Package router holds the in-memory id -> *ClientConn map and the per-conn busy/respCh state machine.