internal/

Package command — approve_user.go

Package service provides application services.

Package cli holds the client-side helpers used by the duragraph CLI subcommands (`runs *`, `events tail`).

Package initpkg scaffolds new duragraph projects from embedded templates.

Package watch implements `duragraph dev`'s watch-mode worker supervision (binary-modes.yml § watch_mode).

Package user implements the User aggregate for the platform domain.

Package worker provides the worker domain model for managing remote workers.

Package auth contains the JWT issuance + verification primitives shared by the platform OAuth callback handler (which mints tokens) and the engine's HTTP middleware (which verifies them on every authenticated request).

Package dashboard serves the embedded React dashboard with SPA-style fallback so client-side routes resolve to index.html.

Admin DTOs — request/response shapes for /api/admin/* endpoints.

Package auth implements the platform OAuth login/callback/logout/refresh HTTP endpoints.

Package platform implements the self-service platform HTTP handlers under /api/platform/*.

AdminAuthMiddleware — guards /api/admin/* (and any other admin-only route group) by requiring claims.role == "admin".

Package messaging — tenant_provisioner.go

Package nats — embedded.go

Package postgres — embedded.go

Package debug exposes the stdlib net/http/pprof handlers on a separate localhost-bound listener for contributor profiling.

Package logging configures slog.Default() so the rest of the codebase can call slog.{Info,Warn,Error,Debug} without thinking about output format.