internal/

Package deploysource implements the bridge side of add-coolify-hosting's artifact bridge (tasks 4.1-4.3): pack the mission's working source tree and upload it to the platform's deploys/ R2 namespace via the same two-phase protocol previews use (declare -> presigned PUTs -> complete).

Package fingerprint derives the machine hint sent at pairing time (machine-model-ia D3).

Package instancelock gives a bridge process exclusive ownership of one machine on this machine.

Package machinekey implements the machine-bound signing key (bridge-abuse-hardening 4b, design D7).

Package markdown provides lightweight markdown format boundary detection for streaming content splitting.

Package preview implements the bridge side of add-preview-hosting: after a workflow task's git branch merges into main, optionally build the merged repo as a static site and upload the output to the platform's preview hosting service (tasks 4.1-4.5).

Package replay defines the recorded-session script format used by the bridge replay test suite (OpenSpec add-replay-testing).

Package serverproof verifies the control plane's identity before the bridge sends it any credential (bridge-abuse-hardening 5e.1, bridge half).

Package utf8safe turns arbitrary-size read chunks into strings that never split a UTF-8 rune (fix-seed-audit-blockers S5: PTY output arrives in 4096 byte reads, and a 3-byte CJK rune landing across the boundary became two U+FFFD replacement chars in the web terminal).