internal/

Package admin provides admin token authentication and management.

Package adminauth holds the admin authentication HTTP surface shared by the main server and the HA "Front Desk" control plane: the WebAuthn/passkey and TOTP ceremony handlers plus the admin-or-session gate they share.

Package alert delivers outbound notifications for noteworthy gateway events to a user-run, stateless Apprise (apprise-api) container.

Package anthropic translates between the Anthropic Messages API wire format and the OpenAI chat-completions format the proxy pipeline speaks internally.

Package anthropicegress translates between the OpenAI chat-completions wire shape and Anthropic's native Messages shape.

Package api provides HTTP handlers and routing for the admin API.

Package audit records an audit trail of admin actions: one row per mutating request (POST/PUT/PATCH/DELETE) on the authenticated dashboard API.

Package auth provides encryption and decryption for API keys.

Package authcookie carries session auth over hardened cookies for both the dashboard and Front Desk: an HttpOnly session cookie the browser cannot read, plus a readable CSRF cookie echoed back in a header for stateless double-submit verification.

Package clientip resolves the client address of an HTTP request with trusted-proxy awareness: forwarded headers are honored only when the TCP peer is a configured trusted proxy (TRUSTED_PROXIES), so a direct client can never spoof its own address.

Package config provides configuration loading and management from environment variables.

Package ctxkeys defines shared context key constants used across multiple packages (e.g.

Package db provides database connection and migration management.

Package debuglog provides a thin wrapper around log/slog that reads the DEBUG_LOG configuration to set the default log level.

Package egress holds the pieces the vendor dialect translators share.

Package events provides a simple event bus for SSE subscriptions.

Package failover provides failover group management and caching.

Package frontdesk implements the HA "Front Desk" control plane: the member list, control-plane event log, settings, Traefik dynamic-config generation, health/version polling, and the admin UI server.

Package gemini translates between the OpenAI chat-completions wire shape and Google's Gemini generateContent shape.

Package httpx holds the HTTP response helpers shared by the admin surfaces (internal/api, internal/adminauth, internal/frontdesk).

Package jsonfault renders a JSON decode failure as a diagnostic that cannot echo the document it failed on.

Package metrics exposes Model Hotel's Prometheus metrics: a private registry, the request-outcome collectors, a circuit-breaker-state collector, and the HTTP handler that serves the /metrics endpoint.

Package model provides model discovery and caching functionality.

Package netguard provides SSRF defenses for outbound HTTP to admin-configured endpoints that legitimately live on the internal network: OIDC identity providers (e.g.

Package openairesponses translates between the OpenAI chat-completions wire format the gateway speaks and the OpenAI Responses API (/v1/responses).

Package otelexport wires the application's slog pipeline to an OpenTelemetry OTLP log exporter.

Package paramrewrite is the single shared implementation of model-hotel's request/response parameter self-healing: rewriting an OpenAI-style chat completion body for a specific provider (model rename, stream_options and provider-specific injection, universal + learned param stripping, learned param renaming) and parsing upstream 400 bodies to learn which params a provider rejects or wants renamed.

Package provider provides LLM provider discovery and management.

Package pwned checks passwords against the Have I Been Pwned "Pwned Passwords" range API using the k-anonymity model: only the first five hex characters of the password's SHA-1 hash ever leave the process, and the endpoint returns every stored suffix sharing that prefix for the caller to match locally.

Package quota persists cached provider quota/usage snapshots so the dashboard can show fresh numbers on load without an upstream call in the request path.

Package ratelimit provides token-bucket rate limiting middleware.

Package settings provides database-backed settings with caching and change subscriptions.

Package totp manages the single admin TOTP (RFC 6238) second-factor configuration: an AES-GCM encrypted secret plus single-use recovery codes.

Package user implements dashboard user accounts for multi-user support: the users table, argon2id password hashing, and the feature-grant catalog.

Package util provides helper functions for system utilities and Docker integration.

Package virtualkey provides virtual API key authentication and management.

Package webauthn provides WebAuthn/FIDO2 credential storage and authentication for Model Hotel.