README
¶
Sphericon
Open-core marketing automation you can run yourself.
Documentation ·
Releases ·
Self-hosting
About
Sphericon helps a business know its audience and talk to it at the right moment: it collects who your contacts are and what they do on your site or in your product, groups them into segments, and sends them email. Everything lives in your own workspace on your own infrastructure, so the customer data stays yours. It is a self-hostable alternative to tools like Drip, without the lock-in.
Features
- Contacts and events — one profile per person, built from imports, the API and the tracking snippet on your site.
- Segments and tags — audiences defined by rules over contacts, tags and events.
- Broadcasts — one-off email to a segment, with per-broadcast stats.
- Automations — sequences triggered by what a contact does, with waits and emails.
- Transactional email — send single messages through the API.
- Deliverability built in — unsubscribes, bounces and spam complaints are honored automatically, mail is signed with your own DKIM key and sent with one-click unsubscribe, so you never write to someone who asked you to stop.
- API and webhooks — a workspace-scoped API with scoped tokens, and webhooks for what happens next.
- Agent-ready — an MCP server lets an AI agent draft campaigns; sending stays opt-in per token.
- Privacy tools — GDPR export and erasure.
- Multi-user workspaces — owners, admins and members, with two-factor sign-in.
Getting started
One program and one database: a Go binary (or Docker image) with the web app, the tracker and the migrations built in, plus PostgreSQL. No Redis, no object storage, no separate worker.
With Docker Compose, which runs PostgreSQL, the migrations and the app together:
# 1. Download the Compose file and the example environment
curl -fsSLO https://raw.githubusercontent.com/getsphericon/sphericon/main/compose.yaml
curl -fsSL https://raw.githubusercontent.com/getsphericon/sphericon/main/compose.env.example -o .env
# 2. Fill in .env: POSTGRES_PASSWORD, SPHERICON_JWT_SECRET (openssl rand -hex 32) and
# SPHERICON_ENCRYPTION_KEY (docker run --rm ghcr.io/getsphericon/sphericon:latest genkey)
# 3. Start it
docker compose up -d
Then put a reverse proxy with HTTPS in front of port 3000 and open it to create your account. The full guide covers HTTPS, the first run, plain Docker, the single binary and Kubernetes (Helm): self-hosting. Every environment variable is in configuration.
Images are published to ghcr.io/getsphericon/sphericon (linux amd64/arm64) on every release,
and release archives for linux and darwin are attached to each
GitHub Release.
Tech stack
Go (ogen, ent, river, watermill) and PostgreSQL on the backend; React, Vite and Mantine on the frontend; TypeSpec as the single source of truth for the API contracts.
Contributing
Setup with a single prerequisite (mise), the code generation pipeline,
dev accounts and the pull request rules are in CONTRIBUTING.md. Architecture
and conventions are in AGENTS.md, the domain language in
GLOSSARY.md.
License
Sphericon is open-core. The core is licensed under the GNU AGPL-3.0
(LICENSE); the Enterprise features under ee/ are commercial and
source-available (ee/LICENSE). See LICENSING.md for the
boundary. Contributions need a signed CLA.
Security
To report a vulnerability, see SECURITY.md.
Documentation
¶
Overview ¶
Package sphericon holds repository-root assets that Go code embeds.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ExternalOpenAPI []byte
ExternalOpenAPI is the generated external (/api) OpenAPI document. The MCP surface (internal/mcpserver) projects its tools from it, so the tool list can never drift from the contract (ADR 0016).
View Source
var MigrationsFS embed.FS
MigrationsFS holds the committed migration files (goose format, diffed from the ent schema). Consumed by cmd/server. Written by `mise run db:generate`, never by hand.
View Source
var TelemetryOpenAPI []byte
TelemetryOpenAPI is the generated Telemetry report OpenAPI document (ADR 0032), the published contract every built report is validated against (internal/telemetryschema).
Functions ¶
This section is empty.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
contractcopy
command
Command contractcopy fails when Go, TypeScript or a fixture repeats an enum, a limit or a scope that a TypeSpec declaration already holds (rule 6, docs/standards/review-rules.md).
|
Command contractcopy fails when Go, TypeScript or a fixture repeats an enum, a limit or a scope that a TypeSpec declaration already holds (rule 6, docs/standards/review-rules.md). |
|
db
command
Command db runs the development database tasks: it creates and drops this checkout's database, writes the next goose migration from the ent schema and writes the migration for river's schema.
|
Command db runs the development database tasks: it creates and drops this checkout's database, writes the next goose migration from the ent schema and writes the migration for river's schema. |
|
fixturegen
command
Command fixturegen writes the fixture catalog (internal/fixtures/catalog_gen.go) from the annotated rows of fixtures/*.yml.
|
Command fixturegen writes the fixture catalog (internal/fixtures/catalog_gen.go) from the annotated rows of fixtures/*.yml. |
|
prcheck
command
Command prcheck checks what a pull request body must say beyond its code: how an AI tool was used (the "AI assistance" section of the pull request template) and why each `contract-copy:` marker the change adds is justified (a `Contract-Copy:` line per file).
|
Command prcheck checks what a pull request body must say beyond its code: how an AI tool was used (the "AI assistance" section of the pull request template) and why each `contract-copy:` marker the change adds is justified (a `Contract-Copy:` line per file). |
|
scopegen
command
Command scopegen writes the Service operation-to-scopes map (ee/staff/service_scopes_gen.go) from the scopes the TypeSpec contract declares on each operation.
|
Command scopegen writes the Service operation-to-scopes map (ee/staff/service_scopes_gen.go) from the scopes the TypeSpec contract declares on each operation. |
|
seed
command
Command seed loads the committed fixtures into the development database.
|
Command seed loads the committed fixtures into the development database. |
|
server
command
Command sphericon is the one binary: the server, and the commands an operator runs against an Instance (migrate, doctor, upgrade, user, workspace, staff, preset and the others).
|
Command sphericon is the one binary: the server, and the commands an operator runs against an Instance (migrate, doctor, upgrade, user, workspace, staff, preset and the others). |
|
upgradecheck
command
Command upgradecheck enforces the Upgrade rules of ADR 0033 in CI: a destructive migration needs a breaking pull request, and a breaking pull request or commit needs an `Upgrade:` line in its `BREAKING CHANGE:` footer that says what a Self-hoster does.
|
Command upgradecheck enforces the Upgrade rules of ADR 0033 in CI: a destructive migration needs a breaking pull request, and a breaking pull request or commit needs an `Upgrade:` line in its `BREAKING CHANGE:` footer that says what a Self-hoster does. |
|
Package config loads and validates the Instance's configuration from the process environment, with the .env files layered under it.
|
Package config loads and validates the Instance's configuration from the process environment, with the .env files layered under it. |
|
Package ent is the generated ORM: the entities, their builders and the scoped client (ADR 0017) that entc writes from ent/schema.
|
Package ent is the generated ORM: the entities, their builders and the scoped client (ADR 0017) that entc writes from ent/schema. |
|
schema
Package schema holds the ent schemas: the tables, columns, constraints, indexes and mixins of the data model, from which ent, the scoped client and the migrations are generated.
|
Package schema holds the ent schemas: the tables, columns, constraints, indexes and mixins of the data model, from which ent, the scoped client and the migrations are generated. |
|
gen
|
|
|
collect
Code generated by ogen, DO NOT EDIT.
|
Code generated by ogen, DO NOT EDIT. |
|
external
Code generated by ogen, DO NOT EDIT.
|
Code generated by ogen, DO NOT EDIT. |
|
service
Code generated by ogen, DO NOT EDIT.
|
Code generated by ogen, DO NOT EDIT. |
|
site
Code generated by ogen, DO NOT EDIT.
|
Code generated by ogen, DO NOT EDIT. |
|
staff
Code generated by ogen, DO NOT EDIT.
|
Code generated by ogen, DO NOT EDIT. |
|
internal
|
|
|
abusewatch
Package abusewatch is the read seam between the /site API and the Enterprise abuse detector (ADR 0026): core knows only this interface and ee implements it, so neither imports the other.
|
Package abusewatch is the read seam between the /site API and the Enterprise abuse detector (ADR 0026): core knows only this interface and ee implements it, so neither imports the other. |
|
accountlink
Package accountlink mints the Account link token: a short-lived, asymmetrically signed proof of who a Workspace Owner is, handed to an external account page.
|
Package accountlink mints the Account link token: a short-lived, asymmetrically signed proof of who a Workspace Owner is, handed to an external account page. |
|
accounts
Package accounts is the raw-client home for what the scoped client cannot express (ADR 0017): actors whose Workspace is not known up front.
|
Package accounts is the raw-client home for what the scoped client cannot express (ADR 0017): actors whose Workspace is not known up front. |
|
aggregates
Package aggregates holds the ent aggregate functions the report modules share.
|
Package aggregates holds the ent aggregate functions the report modules share. |
|
analytics
Package analytics computes the dashboard's Overview: contacts, Engagement rates, automations and the daily time series (GLOSSARY "Engagement rates").
|
Package analytics computes the dashboard's Overview: contacts, Engagement rates, automations and the daily time series (GLOSSARY "Engagement rates"). |
|
api/auth
Package auth holds the security handlers of the API surfaces (session cookie, API token, collect key), the session issuer and the cookies the sign-in flows set.
|
Package auth holds the security handlers of the API surfaces (session cookie, API token, collect key), the session issuer and the cookies the sign-in flows set. |
|
api/collect
Package collect implements the /collect surface: tracking ingestion from customer sites, authenticated by the collect key.
|
Package collect implements the /collect surface: tracking ingestion from customer sites, authenticated by the collect key. |
|
api/external
Package external implements the /api surface: the public API, authenticated by a Workspace's bearer API token.
|
Package external implements the /api surface: the public API, authenticated by a Workspace's bearer API token. |
|
api/external/resources
Package resources holds goverter-generated mappers from ent entities to external API resources, plus the custom conversions goverter cannot infer.
|
Package resources holds goverter-generated mappers from ent entities to external API resources, plus the custom conversions goverter cannot infer. |
|
api/site
Package site implements the /site surface: the API of the frontend SPA, authenticated by the session cookie.
|
Package site implements the /site surface: the API of the frontend SPA, authenticated by the session cookie. |
|
api/site/resources
Package resources holds goverter-generated mappers from ent entities to site API resources (the ogen *Resource DTOs), plus the custom conversions goverter cannot infer on its own.
|
Package resources holds goverter-generated mappers from ent entities to site API resources (the ogen *Resource DTOs), plus the custom conversions goverter cannot infer on its own. |
|
apitokens
Package apitokens owns minting and revoking workspace API tokens.
|
Package apitokens owns minting and revoking workspace API tokens. |
|
app
Package app composes the application: it registers every singleton in the dependency container and starts and stops the servers, the event router and the job workers.
|
Package app composes the application: it registers every singleton in the dependency container and starts and stops the servers, the event router and the job workers. |
|
auditapi
Package auditapi holds what the /site and /api read surfaces of the Audit log share (ADR 0022): cursor and page-size handling, and the customer-facing view of an entry, so the two handler packages map one shape and cannot diverge on masking.
|
Package auditapi holds what the /site and /api read surfaces of the Audit log share (ADR 0022): cursor and page-size handling, and the customer-facing view of an entry, so the two handler packages map one shape and cannot diverge on masking. |
|
authtoken
Package authtoken mints and verifies the short-lived, purpose-scoped tokens behind the self-service account flows: password reset, email verification, and email change.
|
Package authtoken mints and verifies the short-lived, purpose-scoped tokens behind the self-service account flows: password reset, email verification, and email change. |
|
automations
Package automations is the one place an Automation's steps are stored, validated and its lifecycle changed (ADR 0016).
|
Package automations is the one place an Automation's steps are stored, validated and its lifecycle changed (ADR 0016). |
|
brandkit
Package brandkit holds a Workspace's Brand kit (GLOSSARY "Brand kit", ADR 0040): its colors, fonts, logo, button style and footer, as data.
|
Package brandkit holds a Workspace's Brand kit (GLOSSARY "Brand kit", ADR 0040): its colors, fonts, logo, button style and footer, as data. |
|
broadcasts
Package broadcasts owns the Broadcast send/schedule state machine (ADR 0016): draft -> scheduled -> sending and clearing a schedule; the claim and the send job it needs are one transaction.
|
Package broadcasts owns the Broadcast send/schedule state machine (ADR 0016): draft -> scheduled -> sending and clearing a schedule; the claim and the send job it needs are one transaction. |
|
buildinfo
Package buildinfo names the build: version, commit and build time.
|
Package buildinfo names the build: version, commit and build time. |
|
capturedmessages
Package capturedmessages is the store of Captured messages (ADR 0058): what a Test inbox kept instead of sending it out.
|
Package capturedmessages is the store of Captured messages (ADR 0058): what a Test inbox kept instead of sending it out. |
|
changelog
Package changelog reads the `Upgrade:` entries out of release-please's CHANGELOG.md, where they sit in the `BREAKING CHANGES` section (release-please renders the text of a `BREAKING CHANGE:` footer and no other footer): what a Self-hoster must do for a release (ADR 0034).
|
Package changelog reads the `Upgrade:` entries out of release-please's CHANGELOG.md, where they sit in the `BREAKING CHANGES` section (release-please renders the text of a `BREAKING CHANGE:` footer and no other footer): what a Self-hoster must do for a release (ADR 0034). |
|
cleanup
Package cleanup is for the errors of releasing something after the work is done: closing a connection, shutting a server down, removing a temporary file.
|
Package cleanup is for the errors of releasing something after the work is done: closing a connection, shutting a server down, removing a temporary file. |
|
clientip
Package clientip carries the best-effort client address of a request through the context, so ogen handlers (which never see the *http.Request) can record it as proof, e.g.
|
Package clientip carries the best-effort client address of a request through the context, so ogen handlers (which never see the *http.Request) can record it as proof, e.g. |
|
condition
Package condition is the Condition: the typed tree of tests on a Contact (the API contract's tree, ADR 0029, ADR 0054), its validation and its compiler to a Contact predicate.
|
Package condition is the Condition: the typed tree of tests on a Contact (the API contract's tree, ADR 0029, ADR 0054), its validation and its compiler to a Contact predicate. |
|
consent
Package consent holds the use-case modules that change a destination's consent state.
|
Package consent holds the use-case modules that change a destination's consent state. |
|
contactexport
Package contactexport is the subject-access Data export of one Contact (GDPR Art.
|
Package contactexport is the subject-access Data export of one Contact (GDPR Art. |
|
contacts
Package contacts is the one place a Contact is created, updated or upserted (ADR 0016).
|
Package contacts is the one place a Contact is created, updated or upserted (ADR 0016). |
|
contractcopy
Package contractcopy is rule 6 ("knowledge has one place") for the values a TypeSpec contract declares: it reads the generated openapi/*.openapi.json for its enums and numeric limits and reports a hand-written Go or TypeScript copy of them, and a fixture scope the contract does not declare.
|
Package contractcopy is rule 6 ("knowledge has one place") for the values a TypeSpec contract declares: it reads the generated openapi/*.openapi.json for its enums and numeric limits and reports a hand-written Go or TypeScript copy of them, and a fixture scope the contract does not declare. |
|
convert
Package convert holds small generic adapters between the ogen-generated Opt*/OptNil* option types and the plain Go pointers that ent setters expect.
|
Package convert holds small generic adapters between the ogen-generated Opt*/OptNil* option types and the plain Go pointers that ent setters expect. |
|
credentials
Package credentials generates, hashes and verifies the secrets the application issues or accepts: passwords, API tokens, service credentials and recovery codes.
|
Package credentials generates, hashes and verifies the secrets the application issues or accepts: passwords, API tokens, service credentials and recovery codes. |
|
db
Package db opens the database and guards its schema: the connection pools, the goose migrations and the checks that a Major upgrade did not skip a release.
|
Package db opens the database and guards its schema: the connection pools, the goose migrations and the checks that a Major upgrade did not skip a release. |
|
dkimstate
Package dkimstate is the one definition of "a Sending domain is verified" (ADR 0010).
|
Package dkimstate is the one definition of "a Sending domain is verified" (ADR 0010). |
|
dnstest
Package dnstest runs an in-process DNS server for tests, so code that resolves names goes through a real *net.Resolver (NXDOMAIN, SERVFAIL, multi-string TXT) instead of a hand-built stub.
|
Package dnstest runs an in-process DNS server for tests, so code that resolves names goes through a real *net.Resolver (NXDOMAIN, SERVFAIL, multi-string TXT) instead of a hand-built stub. |
|
doctor
Package doctor is `sphericon doctor`: it reads the same configuration as the server and judges an Instance from the outside, one Check per thing a Self-hoster can get wrong, each failure with the fix.
|
Package doctor is `sphericon doctor`: it reads the same configuration as the server and judges an Instance from the outside, one Check per thing a Self-hoster can get wrong, each failure with the fix. |
|
domainverify
Package domainverify is the module behind the Sending domain verification jobs (ADR 0010, ADR 0038): the live DKIM check and what it decides (the verified moments, the loss of verification, the Owners' notice of it), and the Tracking domain check and what it decides (a host another Workspace holds, a stale answer, a state that went back a step and its notice).
|
Package domainverify is the module behind the Sending domain verification jobs (ADR 0010, ADR 0038): the live DKIM check and what it decides (the verified moments, the loss of verification, the Owners' notice of it), and the Tracking domain check and what it decides (a host another Workspace holds, a stale answer, a state that went back a step and its notice). |
|
eligibility
Package eligibility derives whether a message on a channel from a sending source may reach a destination (ADR 0001, 0013).
|
Package eligibility derives whether a message on a channel from a sending source may reach a destination (ADR 0001, 0013). |
|
emailcase
Package emailcase keeps account addresses lower-cased: the email of a User and of an Invitation, so one address is one row whatever case it was typed in, the unique index on users.email holds case-insensitively, and an Invitation matches the User it names.
|
Package emailcase keeps account addresses lower-cased: the email of a User and of an Invitation, so one address is one row whatever case it was typed in, the unique index on users.email holds case-insensitively, and an Invitation matches the User it names. |
|
emaildoc
Package emaildoc turns an editor document into email-ready HTML, with limits: a document in, HTML or an error out (ADR 0040).
|
Package emaildoc turns an editor document into email-ready HTML, with limits: a document in, HTML or an error out (ADR 0040). |
|
emailrender
Package emailrender renders broadcast/template email content.
|
Package emailrender renders broadcast/template email content. |
|
erasure
Package erasure is the one place a Contact's personal data is erased (GDPR Art.
|
Package erasure is the one place a Contact's personal data is erased (GDPR Art. |
|
eventlog
Package eventlog is the one place a customer's Events enter and are summarized (ADR 0016, use-case modules).
|
Package eventlog is the one place a customer's Events enter and are summarized (ADR 0016, use-case modules). |
|
events
Package events is the internal domain-event system: a domain event is published once, inside the same transaction that commits the state change (transactional outbox), and fanned out to independent subscribers over watermill.
|
Package events is the internal domain-event system: a domain event is published once, inside the same transaction that commits the state change (transactional outbox), and fanned out to independent subscribers over watermill. |
|
exportstream
Package exportstream is what every Export stream shares (ADR 0045, GLOSSARY: Export stream): the opaque (updated_at, id) cursor, the keyset query predicates, the page size, the NDJSON page encoder and the check of an encoded row against the TypeSpec row schema.
|
Package exportstream is what every Export stream shares (ADR 0045, GLOSSARY: Export stream): the opaque (updated_at, id) cursor, the keyset query predicates, the page size, the NDJSON page encoder and the check of an encoded row against the TypeSpec row schema. |
|
fixtures
Package fixtures holds shared helpers for loading the committed YAML fixtures in fixtures/*.yml.
|
Package fixtures holds shared helpers for loading the committed YAML fixtures in fixtures/*.yml. |
|
fixtures/fixturegen
Package fixturegen builds the fixture catalog: named Go constants for the anchor rows of the committed YAML fixtures.
|
Package fixturegen builds the fixture catalog: named Go constants for the anchor rows of the committed YAML fixtures. |
|
holds
Package holds reads Staff holds (ADR 0009): the reversible freezes a service sets on a Workspace's outbound sending.
|
Package holds reads Staff holds (ADR 0009): the reversible freezes a service sets on a Workspace's outbound sending. |
|
httpcall
Package httpcall is the outbound HTTP call both an Automation's HTTP step (ADR 0039) and a Rule's HTTP Action (ADR 0054) describe: a URL, request headers, a Liquid JSON body and an optional signing secret.
|
Package httpcall is the outbound HTTP call both an Automation's HTTP step (ADR 0039) and a Rule's HTTP Action (ADR 0054) describe: a URL, request headers, a Liquid JSON body and an optional signing secret. |
|
i18n
Package i18n localizes sphericon's own system-generated text — the platform (transactional) emails and the API validation messages.
|
Package i18n localizes sphericon's own system-generated text — the platform (transactional) emails and the API validation messages. |
|
instance
Package instance owns the Instance's own state (ADR 0032): the one row that no Workspace owns (its random Instance id, the Telemetry report setting, the acknowledged notice) and the rule of who decides about it.
|
Package instance owns the Instance's own state (ADR 0032): the one row that no Workspace owns (its random Instance id, the Telemetry report setting, the acknowledged notice) and the rule of who decides about it. |
|
integrations
Package integrations is the use-case module for a Workspace's sending-provider Integrations: config validation, credential sealing, the default-per-channel rule and the redacted read view.
|
Package integrations is the use-case module for a Workspace's sending-provider Integrations: config validation, credential sealing, the default-per-channel rule and the redacted read view. |
|
inuse
Package inuse is the one shape of a refused removal (ADR 0049): a row that live work still uses is not removed, and the refusal names the users.
|
Package inuse is the one shape of a refused removal (ADR 0049): a row that live work still uses is not removed, and the refusal names the users. |
|
jobkind
Package jobkind names the river job kinds that hold personal data in their arguments, with the argument each is purged by.
|
Package jobkind names the river job kinds that hold personal data in their arguments, with the argument each is purged by. |
|
jobs
Package jobs is the river-backed (Postgres) async job queue.
|
Package jobs is the river-backed (Postgres) async job queue. |
|
joindomains
Package joindomains is the module for a Workspace's Join domains: a domain an Owner proves control of with a DNS TXT record so that, in a later step, Users with an address on it can join the Workspace.
|
Package joindomains is the module for a Workspace's Join domains: a domain an Owner proves control of with a DNS TXT record so that, in a later step, Users with an address on it can join the Workspace. |
|
lifecycle
Package lifecycle is the one way an entity's states are declared (ADR 0046): a thin constructor over github.com/qmuntal/stateless with external storage.
|
Package lifecycle is the one way an entity's states are declared (ADR 0046): a thin constructor over github.com/qmuntal/stateless with external storage. |
|
linkclicks
Package linkclicks counts the clicks of the emails of one Broadcast or Automation, or of the whole Workspace, by link.
|
Package linkclicks counts the clicks of the emails of one Broadcast or Automation, or of the whole Workspace, by link. |
|
liveuse
Package liveuse finds the live work that uses a row a removal is about to take away (ADR 0049), for the modules that cannot import internal/automations (it reaches them through outbound).
|
Package liveuse finds the live work that uses a row a removal is about to take away (ADR 0049), for the modules that cannot import internal/automations (it reaches them through outbound). |
|
logging
Package logging builds the application's structured logger (log/slog) and carries a per-request correlation id through context.
|
Package logging builds the application's structured logger (log/slog) and carries a per-request correlation id through context. |
|
login
Package login is the first step of signing in (ADR 0020), shared by every surface that signs a person in with an address and a password: it normalizes the address once, consults the throttle (ADR 0025), looks the account up and checks the password against a decoy hash when there is none, applies the verification gate (ADR 0030), counts a failure and mints the second-factor challenge.
|
Package login is the first step of signing in (ADR 0020), shared by every surface that signs a person in with an address and a password: it normalizes the address once, consults the throttle (ADR 0025), looks the account up and checks the password against a decoy hash when there is none, applies the verification gate (ADR 0030), counts a failure and mints the second-factor challenge. |
|
machine
Package machine tells an open or click made by software from one made by a person (ADR 0053, GLOSSARY: Machine engagement).
|
Package machine tells an open or click made by software from one made by a person (ADR 0053, GLOSSARY: Machine engagement). |
|
mcpserver
Package mcpserver mounts the MCP surface at /mcp (ADR 0016).
|
Package mcpserver mounts the MCP surface at /mcp (ADR 0016). |
|
messaging
Package messaging is the channel-agnostic management layer for workspace sending providers.
|
Package messaging is the channel-agnostic management layer for workspace sending providers. |
|
messaging/inbox
Package inbox implements the Test inbox provider (ADR 0058): it delivers nothing outside and keeps each message it is sent as a Captured message through the Capturer the catalog hands its builder.
|
Package inbox implements the Test inbox provider (ADR 0058): it delivers nothing outside and keeps each message it is sent as a Captured message through the Capturer the catalog hands its builder. |
|
messaging/registry
Package registry assembles the default provider catalog.
|
Package registry assembles the default provider catalog. |
|
messaging/ses
Package ses implements the Amazon SES email provider.
|
Package ses implements the Amazon SES email provider. |
|
messaging/smtp
Package smtp implements the SMTP email provider on top of wneessen/go-mail.
|
Package smtp implements the SMTP email provider on top of wneessen/go-mail. |
|
narrow
Package narrow converts Go's int and int64 to the int32 the API contracts use for counts and page numbers.
|
Package narrow converts Go's int and int64 to the int32 the API contracts use for counts and page numbers. |
|
oauthserver
Package oauthserver is the OAuth 2.1 authorization server for MCP connectors (ADR 0016, phase 2): discovery documents (RFC 9728, RFC 8414), dynamic client registration (RFC 7591), the PKCE authorization-code flow and the token endpoint.
|
Package oauthserver is the OAuth 2.1 authorization server for MCP connectors (ADR 0016, phase 2): discovery documents (RFC 9728, RFC 8414), dynamic client registration (RFC 7591), the PKCE authorization-code flow and the token endpoint. |
|
otpcode
Package otpcode is the TOTP arithmetic shared by every second step (a User's Second factor, ADR 0020, and a Staff member's TOTP, ADR 0026): new keys with their QR code, and matching a submitted code against a secret at a clock.
|
Package otpcode is the TOTP arithmetic shared by every second step (a User's Second factor, ADR 0020, and a Staff member's TOTP, ADR 0026): new keys with their QR code, and matching a submitted code against a secret at a clock. |
|
outbound
Package outbound is the one place an email leaves sphericon on a Workspace's behalf (ADR 0015).
|
Package outbound is the one place an email leaves sphericon on a Workspace's behalf (ADR 0015). |
|
ownernotice
Package ownernotice is the one seam of the modules that tell the Owners of a Workspace something (Join domains, Sending domains, webhooks, suspension): a Notify delivers a rendered notice, and Tell and TellBestEffort render one from its i18n key and data.
|
Package ownernotice is the one seam of the modules that tell the Owners of a Workspace something (Join domains, Sending domains, webhooks, suspension): a Notify delivers a rendered notice, and Tell and TellBestEffort render one from its i18n key and data. |
|
pagination
Package pagination is the one page shape of every module List.
|
Package pagination is the one page shape of every module List. |
|
paths
Package paths names the URL prefixes more than one package must agree on: the composition root mounts a surface under its prefix, the surface's own server strips it, and the cookie and rate-limit rules of that surface key on it.
|
Package paths names the URL prefixes more than one package must agree on: the composition root mounts a surface under its prefix, the surface's own server strips it, and the cookie and rate-limit rules of that surface key on it. |
|
postgres
Package postgres holds the two server-level statements the rest of the code needs and ent cannot express: the transaction-scoped advisory lock and the server version.
|
Package postgres holds the two server-level statements the rest of the code needs and ent cannot express: the transaction-scoped advisory lock and the server version. |
|
preset
Package preset is the Preset engine (ADR 0037): a Preset describes one provider's inbound callbacks, how a request is verified and how its payload becomes Delivery notices.
|
Package preset is the Preset engine (ADR 0037): a Preset describes one provider's inbound callbacks, how a request is verified and how its payload becomes Delivery notices. |
|
ratelimit
Package ratelimit is the in-binary request limiter (ADR 0025).
|
Package ratelimit is the in-binary request limiter (ADR 0025). |
|
rekey
Package rekey re-encrypts every secret stored in the database under the primary key of the encryption keyset, so a key an operator rotated away from can be retired.
|
Package rekey re-encrypts every secret stored in the database under the primary key of the encryption keyset, so a key an operator rotated away from can be retired. |
|
reportday
Package reportday is the Report day of ADR 0057: a calendar day in the Workspace time zone.
|
Package reportday is the Report day of ADR 0057: a calendar day in the Workspace time zone. |
|
reputation
Package reputation computes the deliverability rates of ADR 0011: complaint rate (over delivered mail since ADR 0053) and bounce rate (over sent) per (Workspace, Sending domain) over a trailing window.
|
Package reputation computes the deliverability rates of ADR 0011: complaint rate (over delivered mail since ADR 0053) and bounce rate (over sent) per (Workspace, Sending domain) over a trailing window. |
|
rules
Package rules is the Rule module (ADR 0054): a stateless reaction to an Event.
|
Package rules is the Rule module (ADR 0054): a stateless reaction to an Event. |
|
scopegen
Package scopegen writes the Service operation-to-scopes map (ee/staff/service_scopes_gen.go) from the `x-required-scopes` extension each operation of openapi/service.openapi.json declares in TypeSpec.
|
Package scopegen writes the Service operation-to-scopes map (ee/staff/service_scopes_gen.go) from the `x-required-scopes` extension each operation of openapi/service.openapi.json declares in TypeSpec. |
|
secondfactor
Package secondfactor is a User's TOTP Second factor and Recovery codes (ADR 0020).
|
Package secondfactor is a User's TOTP Second factor and Recovery codes (ADR 0020). |
|
secrets
Package secrets provides authenticated encryption for credentials stored at rest (e.g.
|
Package secrets provides authenticated encryption for credentials stored at rest (e.g. |
|
segments
Package segments is the Segment domain module: named Conditions on Contacts, with the rows they select and the live work that uses them.
|
Package segments is the Segment domain module: named Conditions on Contacts, with the rows they select and the live work that uses them. |
|
sending
Package sending owns the workspace Sending-domain authentication primitives (ADR 0010): per-domain DKIM keypair generation, the DNS records a user publishes, and DKIM DNS verification.
|
Package sending owns the workspace Sending-domain authentication primitives (ADR 0010): per-domain DKIM keypair generation, the DNS records a user publishes, and DKIM DNS verification. |
|
sendingdomains
Package sendingdomains is the use-case module for a Workspace's Sending domains (ADR 0010): domain validation, DKIM keypair minting and sealing, the selector change rule, and triggering a live verification.
|
Package sendingdomains is the use-case module for a Workspace's Sending domains (ADR 0010): domain validation, DKIM keypair minting and sealing, the selector change rule, and triggering a live verification. |
|
sendlimit
Package sendlimit enforces an Integration's Send rate limit (ADR 0023): two token buckets, per-second and rolling 24 hours, whose state is one send_limiters row per Integration in Postgres (no Redis).
|
Package sendlimit enforces an Integration's Send rate limit (ADR 0023): two token buckets, per-second and rolling 24 hours, whose state is one send_limiters row per Integration in Postgres (no Redis). |
|
server
Package server composes the HTTP handler: the ogen servers of every surface, the public endpoints (tracking links, hooks, health), the SPA and the middleware around them.
|
Package server composes the HTTP handler: the ogen servers of every surface, the public endpoints (tracking links, hooks, health), the SPA and the middleware around them. |
|
setupchecklist
Package setupchecklist reads the Workspace's Setup checklist (GLOSSARY "Setup checklist"): five steps, each read off rows the Workspace already has, never ticked by hand.
|
Package setupchecklist reads the Workspace's Setup checklist (GLOSSARY "Setup checklist"): five steps, each read off rows the Workspace already has, never ticked by hand. |
|
sidelistener
Package sidelistener is an opt-in HTTP listener beside the public port (ADR 0018): the metrics listener and the internal listener of the Staff member's service endpoints (ADR 0026) are both one.
|
Package sidelistener is an opt-in HTTP listener beside the public port (ADR 0018): the metrics listener and the internal listener of the Staff member's service endpoints (ADR 0026) are both one. |
|
signin
Package signin is the Sign-in provider registry and the OAuth/OIDC round trip of a provider sign-in (ADR 0048).
|
Package signin is the Sign-in provider registry and the OAuth/OIDC round trip of a provider sign-in (ADR 0048). |
|
signupsurvey
Package signupsurvey is the Sign-up survey: four questions a User who signed up in public answers once, stored on the Instance and read only by a Staff member.
|
Package signupsurvey is the Sign-up survey: four questions a User who signed up in public answers once, stored on the Instance and read only by a Staff member. |
|
stepping
Package stepping walks an Enrollment through its Automation's steps: one operation executes one step of one Enrollment, moves it and queues the job of the next step in the same transaction.
|
Package stepping walks an Enrollment through its Automation's steps: one operation executes one step of one Enrollment, moves it and queues the job of the next step in the same transaction. |
|
suppression
Package suppression is the one place Suppression rows are written, listed and removed (ADR 0015, GLOSSARY "Suppression"): the hard, global do-not-send registry keyed by (channel, destination).
|
Package suppression is the one place Suppression rows are written, listed and removed (ADR 0015, GLOSSARY "Suppression"): the hard, global do-not-send registry keyed by (channel, destination). |
|
suspension
Package suspension owns what it means for a Workspace to be suspended, and the notice its Owners get.
|
Package suspension owns what it means for a Workspace to be suspended, and the notice its Owners get. |
|
tags
Package tags is the one place a Contact's Tags are listed, applied and removed (ADR 0016).
|
Package tags is the one place a Contact's Tags are listed, applied and removed (ADR 0016). |
|
telemetry
Package telemetry wires OpenTelemetry traces, metrics and logs for the process.
|
Package telemetry wires OpenTelemetry traces, metrics and logs for the process. |
|
telemetryschema
Package telemetryschema checks a Telemetry report against the published OpenAPI contract (ADR 0032), so the documented payload is the real payload.
|
Package telemetryschema checks a Telemetry report against the published OpenAPI contract (ADR 0032), so the documented payload is the real payload. |
|
templates
Package templates is the one place an email Template is listed, read, written and deleted.
|
Package templates is the one place an email Template is listed, read, written and deleted. |
|
testhelper
Package testhelper is the test harness: it builds the application over a per-process database with the committed fixtures loaded, and hands tests typed actors for each API surface.
|
Package testhelper is the test harness: it builds the application over a per-process database with the committed fixtures loaded, and hands tests typed actors for each API surface. |
|
testhelper/metricstest
Package metricstest scrapes the real /metrics handler for tests and reads its Prometheus exposition.
|
Package metricstest scrapes the real /metrics handler for tests and reads its Prometheus exposition. |
|
tracking
Package tracking mints and verifies the per-message tokens used by the email open/click/unsubscribe endpoints, and rewrites an email's HTML to route links through the click tracker and embed the open pixel + unsubscribe footer.
|
Package tracking mints and verifies the per-message tokens used by the email open/click/unsubscribe endpoints, and rewrites an email's HTML to route links through the click tracker and embed the open pixel + unsubscribe footer. |
|
trackingdomain
Package trackingdomain verifies a Sending domain's Tracking domain (ADR 0038): a live DNS check that track.<domain> is a CNAME to the Instance's edge host, and the state that check keeps (pending -> dns_verified), and the HTTPS probe that moves a verified host to serving.
|
Package trackingdomain verifies a Sending domain's Tracking domain (ADR 0038): a live DNS check that track.<domain> is a CNAME to the Instance's edge host, and the state that check keeps (pending -> dns_verified), and the HTTPS probe that moves a verified host to serving. |
|
trackinghostlog
Package trackinghostlog writes the change log behind the service read of Tracking domain hosts (ADR 0038).
|
Package trackinghostlog writes the change log behind the service read of Tracking domain hosts (ADR 0038). |
|
transactional
Package transactional is the Transactional send operation (ADR 0005): a single-recipient email rendered from a referenced Template with per-call variables.
|
Package transactional is the Transactional send operation (ADR 0005): a single-recipient email rendered from a referenced Template with per-call variables. |
|
upgrade
Package upgrade replaces a bare-binary Instance's binary with a newer release without stopping it (ADR 0033, ADR 0034): it verifies the archive, unpacks the new binary next to the old one, runs the new binary's `migrate` while the old one still serves, and only then swaps the file atomically, keeping the old one as `.old`.
|
Package upgrade replaces a bare-binary Instance's binary with a newer release without stopping it (ADR 0033, ADR 0034): it verifies the archive, unpacks the new binary next to the old one, runs the new binary's `migrate` while the old one still serves, and only then swaps the file atomically, keeping the old one as `.old`. |
|
validation
Package validation checks request fields beyond what the API contract states: ogen has already decoded the body and applied the contract's constraints, and a handler copies the fields it checks further into a local struct tagged for go-playground/validator.
|
Package validation checks request fields beyond what the API contract states: ogen has already decoded the body and applied the contract's constraints, and a handler copies the fields it checks further into a local struct tagged for go-playground/validator. |
|
visitors
Package visitors resolves the anonymous visitors of a customer site to Contacts: it tells which Contact a tracked visitor id is, once an identify call has linked them.
|
Package visitors resolves the anonymous visitors of a customer site to Contacts: it tells which Contact a tracked visitor id is, once an identify call has linked them. |
|
webhook
Package webhook delivers domain events to customer-configured HTTP endpoints.
|
Package webhook delivers domain events to customer-configured HTTP endpoints. |
|
webhooks
Package webhooks is the one place a Workspace's Webhook endpoints are created, updated, read, listed and deleted.
|
Package webhooks is the one place a Workspace's Webhook endpoints are created, updated, read, listed and deleted. |
|
workspacedeletion
Package workspacedeletion owns the Workspace deletion cycle (ADR 0043): deleting a Workspace, restoring it inside its window, the window and erase date, and the move to erased.
|
Package workspacedeletion owns the Workspace deletion cycle (ADR 0043): deleting a Workspace, restoring it inside its window, the window and erase date, and the move to erased. |
|
workspacefeed
Package workspacefeed keeps the change position behind the service feed of Workspaces (ADR 0009).
|
Package workspacefeed keeps the change position behind the service feed of Workspaces (ADR 0009). |
|
workspaceid
Package workspaceid makes the Workspace id (ADR 0043): 8 random base62 characters, the one address a Workspace has.
|
Package workspaceid makes the Workspace id (ADR 0043): 8 random base62 characters, the one address a Workspace has. |
Click to show internal directories.
Click to hide internal directories.