backend

Package agentsession owns the internal credential-broker contract shared by bex-api and the isolated SSH gateway's Pod-bound Git smart-HTTP proxy.

Package agentsessions owns the tenant-facing lifecycle of cloud coding-agent sessions from ADR047 D3.

Package agentsessionticket is the signed handoff from bex-api to the coming isolated gateway attach path (ADR047 D3).

Package api is the composition root of bex-api: it wires the feature services (apps, logs, metrics, apikeys, postgres) behind one auth gate and assembles the three transports as SINGLE artifacts — one REST router, one GraphQL schema, one MCP registry.

Package apikeys is the machine-credential feature: OAuth2 clients (client_credentials grant) in the platform's Hydra.

Package apps is the App-lifecycle feature: the list/get read side and the restart/suspend/resume write side, projected as Render's "service" shape.

Package audit is the audit-log feature (w4/m10): a read verb over the audit_events control-plane table (internal/store) plus the retention sweep that bounds both ordinary events and SSH-session audit metadata.

Package authz is the production authorization checker: OpenFGA over its HTTP API, satisfying core.Checker.

Package billing is the Stripe Billing export seam (ADR040): a backend-only sidecar ships sealed usage_hourly rows as meter events, then the same client reads Stripe's current invoice preview and finalized invoice history.

Package cliauth adapts the official Render CLI's fixed OAuth wire protocol to Hydra.

Package core is the leaf kernel every bex-api feature package imports: the shared Base (apiserver-thin client + namespace + clock + authorization gate), the caller Identity, the cross-feature error sentinels, and the HTTP/cache primitives the Ory-bound clients share.

Package datastorelogs holds the direct-pod log read path shared by the managed datastore features.

Package deploys is the deploy-history feature (w2/m5): every rollout of a store-managed App is a row in lego/backend/internal/store, listable and triggerable over REST/GraphQL/MCP under Render's names (list_deploys / get_deploy / POST .../deploys) — the poll-loop a Render-trained agent already knows how to run.

Package drivergrant signs one-shot, action-bound calls from the trusted SSH gateway to an in-sandbox agent driver.

Package egressquery owns the Prometheus metric vocabulary and PromQL used to compose tenant outbound bytes.

Package email composes the bex-sent transactional emails (workspace invites, deploy notifications, webhook failure notices) into BOTH a plain-text body and a branded HTML body from one Message, so the two renderings can never drift.

Package envgroups is the environment-groups feature (Render's /v1/env-groups): a named, reusable set of env vars + secret files that can be linked to many services at once.

Package environments implements named environments — a subset of a project's services (e.g.

Package events is the per-service activity feed (w3/m7): Render's GET /services/{id}/events, composed from the durable control-plane facts bex already needs for deploy history, audit, and observed transitions.

Package eventvocab owns Render event names shared by independent event projections.

Package github is bex-api's GitHub App integration (docs/ADR026-github-integration.md): a small client that signs the app JWT, mints short-lived installation tokens, and lists an installation's repositories — plus the workspace-connection service verbs over the control-plane store.

Package gqlutil holds the presentation helpers the feature GraphQL fragments share: a typed resolver adapter and the common id argument.

Package hmacticket is the signed-token envelope every bex ticket flavor shares.

Package id is the one place bex mints and validates typed resource ids (docs/ADR020-identifiers.md — the ADR).

Package jobs implements Render's one-off jobs surface (GET/POST /v1/services/{id}/jobs, GET/POST .../jobs/{jobId}/cancel).

Package keyvalue is the managed key-value (Valkey / Redis-compatible) feature over the KeyValue CR, mirroring Render's /v1/key-value API.

Package logs is the logs feature: the aggregated read (MCP list_logs), the richer filtered query (REST/GraphQL), and the live tail (SSE).

Package mailer is the bex-api SMTP sender — the transport behind the members feature's invite emails (and any future bex-sent mail).

Package mcputil is the shared MCP tool-registration seam, the MCP counterpart to gqlutil: every feature registers its tools through AddTool so a single place decides what a tool's error looks like on the wire.

Package members is the workspace team-membership feature (w4/m12): invite a teammate by email, list and change roles, remove members — Render's workspace Members settings.

Package metrics is the metrics feature: one Service the REST + GraphQL + MCP adapters share, reaching its backends through injected sources so the domain stays clientset-free.

Package notifications is the deploy-notification feature (w3/m9, w3/005): email a workspace's members when one of its services' deploys starts, succeeds, or fails, matching Render's /notification-settings surface.

Package push defines the provider-neutral mobile push boundary and the Expo Push Service adapter.

access.go is the managed-Postgres access & connection surface: the external endpoint's IP allowlist (Render's ipAllowList) and additional Postgres login roles (Render's /postgres/{id}/users).

Package pricing is bex's price sheet: per-unit USD rates derived from Render's captured public pricing (docs/render-artifacts/pricing.md) at a fixed discount — 30% off workspace-plan fees, compute/Postgres/KeyValue/ build-minute/Postgres storage lines, 90% off bandwidth.

Package projects implements named project groupings for services within a workspace (w1/m31).

Package proxyproto lets the SSH gateway recover the real client address of a connection Traefik's `ssh` entrypoint forwards, instead of recording Traefik's own pod IP into ssh_sessions.remote_address (w4/029.md #10).

Package registrycreds is the registry-credentials feature (w2/m14): a workspace's stored credentials for a private external image registry (Docker Hub, GHCR, GitLab Container Registry, ECR, etc.), so an existing-image service can pull from a non-public, non-Zot source — closing bex's only-public-or-internal-Zot image-source limitation (docs/ADR018-render-parity.md, "Registry credentials").

Package resourcemeta holds the neutral, cross-feature contract for the Render metadata projected by REST adapters.

Package rollout records the deploy-history row a spec patch owes the user.

Package sandbox is the bex-api feature for hosted agent sandboxes (pillar 5, re-opened ADR042/w3/m32).

Package sandboxexec mints and verifies the short-lived ticket that authorizes one `render ea sandbox exec` command (w3/m33, docs/render-artifacts/ea-sandbox.md).

Package secrets is the tenant env-vars + secret-files feature: a service's environment variables and mounted secret files, both stored in OpenBao (docs/ADR013-secrets.md) and materialized into per-app Kubernetes Secrets the App consumes — env vars via envFrom ("<name>-env"), files via a projected /etc/secrets volume ("<name>-files").

Package serve is the shared HTTP serve/shutdown lifecycle for the backend binaries (w1/m30 + w1/m52).

Package sessionegress renders the fail-closed Cilium policy for one managed coding-agent session.

Package shellticket mints and verifies the short-lived exec ticket that authorizes a Browser Web Shell session (docs/ADR035-ssh.md § Browser Web Shell).

Package snapshotticket signs the `snapshotKey` a disk-snapshot listing hands out and a restore hands back (docs/ADR082-persistent-disks.md D5).

Package sshgateway is the shared kernel of the isolated SSH gateway process, which is deployed separately from bex-api so only this process and ServiceAccount receive pods/exec permission.

Package agentattach is the agent-session conversation transport of the isolated SSH gateway (ADR047 D9, w3/m43).

Package agentcred is the Pod-bound Git smart-HTTP proxy of the isolated SSH gateway (ADR047 D2).

Package dbrole single-sources the SSH gateway's least-privilege Postgres role surface: the grant DDL both the production script (scripts/ssh-gateway-db-role.sh) and the CI least-privilege proof (dbrole_integration_test.go) consume.

Package gatewaytest holds the shared test fakes for the sshgateway feature packages (root native SSH, webshell) so the fakes cannot drift between the suites.

Package modelproxy is the Pod-bound credential-injecting model proxy of the isolated SSH gateway (ADR062).

Package nativessh is the native SSH transport of the isolated gateway: it authenticates registered public keys, authorizes their identities against a requested App, and bridges SSH session channels to the Kubernetes pods/exec API through the shared sshgateway kernel.

Package sandboxsse is the sandbox-exec transport of the isolated SSH gateway (w3/m33, docs/render-artifacts/ea-sandbox.md §exec).

Package webshell is the Browser Web Shell transport of the isolated SSH gateway (docs/ADR035-ssh.md § Browser Web Shell).

Package sshkeys manages identity-scoped SSH public keys.

Package store is the bex control plane: the Postgres-backed source of truth for the product's business entities (tenants, apps, domains + their mappings to Ory and Stripe) and the minimal API over them.

Package usage is the metering feature (w8/m1–m2, retention m4): an hourly pipeline that rolls Prometheus cAdvisor/Traefik data and build-Job durations into durable usage_hourly rows (internal/store), keyed per workspace.

Package webhooks is the outbound event webhooks feature (w3/m11): a workspace registers a destination URL + an event-type subscription, and bex pushes signed, thin-payload notifications when those transitions happen — Render's /webhooks direction (Render → you), closing bex's inbound-only webhook asymmetry (docs/ADR018-render-parity.md § Platform events & integrations).

Package workspaces is the workspace-lifecycle feature: create / rename / delete a workspace and list the caller's workspaces, projected as Render's "owner" shape.