internal/

Package adminui serves the admin web interface under /_ui/.

Package appconfig keeps a realm's app configuration: the values admins and functions set over the declared defaults, with optimistic concurrency, an audited history and rollback.

Package auth holds backd's identity model: users, their sign-in identities and password handling.

Package cron parses five-field cron expressions and computes their schedule, in UTC or in a time zone.

Package egress runs backd's egress role: the only way a function process reaches the network.

Package email holds what backd knows about the emails it asks a realm's delivery function to send: the kinds, the templates (loaded from <realm>/email/ into memory at startup and rendered per message), and the shape of the message handed to the function.

Package executor runs server-side functions: `backd executor` is a supervisor that runs each invocation in its own Deno process, with only the function's permissions and limits, and returns its output.

Package functions builds server-side functions: `backd functions build` bundles each function of a database's Deno project into one file with `deno bundle`, and records the bundles in a manifest that startup checks.

Package httpapi is backd's HTTP layer: routing, middleware, error envelope, the generic document handlers and the /_auth endpoints.

Package imaging turns one image into resized copies, safely: pure Go (no cgo, no external library), the pixel count checked from the header before anything is decoded, the orientation flag applied, a time limit per image, and output that never carries metadata.

Package jsonnum converts json.Number values into concrete Go numbers.

Package metrics is backd's Prometheus instrumentation (design/metrics.md).

Package mongodb holds everything MongoDB-specific: the $jsonSchema validator translation, the repository implementation and the provisioner.

Package oauth talks to external identity providers (Google, Microsoft, Apple): the authorize URL, the code exchange, the verification of ID tokens and Apple's client secret.

Package openapigen derives an OpenAPI 3.1 document for one realm from the generic contract (api/openapi.yaml) and the realm's loaded config: its collections with their schemas and features, its enabled authentication methods, its functions, and what its clients can reach.

Package push holds what backd knows about push notification messages that doesn't depend on the realm's settings or its store: the templates they are written from, the portable message and its validation, and the payloads each provider receives (design: design/push-notifications.md §6).

Package pushsend holds backd's built-in push senders: FCM (HTTP v1), APNs (HTTP/2, token authentication) and Web Push (VAPID, RFC 8291).

Package query parses and checks the list query language (where, order_by) against a collection's schema, producing backend-neutral storage conditions.

Package registry loads the realm/database/collection tree from CONFIG_DIR into an immutable, validated registry used by routing, validation and provisioning.

Package rules checks and compiles a collection's rules (the `rules:` section of its collection.yaml): expr-lang expressions deciding, per operation, whether a caller may act on a whole document.

Package rulestest runs the fixtures of `backd rules test`: it decides who may read, create, update and delete which documents of a collection, with the collection's real rules (the `rules:` of its collection.yaml) and schema.json and no database, and compares the decisions with what the fixture expects.

Package settings reads backd's runtime configuration from environment variables.

Package storage defines the backend-neutral data access contract.

Package templates writes commented starter files for realms and databases into CONFIG_DIR (`backd template`).

Package typegen turns a realm's loaded config into TypeScript types: documents, queries, functions, configuration, templates and roles.