cli

module

v1.1.6 Latest Latest Go to latest Published: Jun 10, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/nself-org/cli

Links

Open Source Insights

README ¶

ɳSelf CLI

Self-hosted backend in 5 minutes

Complete, production-ready backend stack — PostgreSQL, GraphQL API, Authentication, and Nginx — launched from a single command. Extend with 138 plugins (29 free, 109 paid). MIT licensed core, forever.

v1.1.2 is out. Plugin signing canonical scheme, nself audit scan rule pack, license cache hardening, doctor --deep expansion. Release notes

brew install nself-org/nself/nself

Quick Start · The Stack · Plugins · Pricing · Docs

What is ɳSelf?

ɳSelf is a self-hosted backend platform that gives you the equivalent of a commercial Backend-as-a-Service on your own infrastructure. Run it locally, on a VPS, in Kubernetes, or on any cloud provider.

You get Postgres, Hasura GraphQL, nHost Auth, and Nginx as the always-on core. Add optional services like Redis, MinIO, and Search when you need them. Extend everything with plugins — 29 free MIT plugins and 109 paid plugins covering AI, messaging, media processing, billing, and more.

The nself CLI is a single Go binary. No runtime dependencies beyond Docker.

Quick Start

# Install (macOS)
brew install nself-org/nself/nself

# Install (Linux / WSL2)
curl -fsSL https://install.nself.org | bash

# Create a project and start the stack
mkdir my-backend && cd my-backend
nself init
nself build
nself start

Your backend is running:

GraphQL API: https://api.local.nself.org
Auth: https://auth.local.nself.org
Storage: https://storage.local.nself.org
Admin UI: http://localhost:3021

All *.local.nself.org domains resolve to 127.0.0.1. Automatic SSL — no browser warnings.

The Stack

ɳSelf organizes services into three tiers. This ordering matters everywhere: Core first, Optional second, Plugins last.

Core Services (always on — 4 services)

These four services start with every nself start and cannot be disabled. They are the permanent foundation.

Service	Role
PostgreSQL	Primary database (pgvector, PostGIS, TimescaleDB)
Hasura	Instant GraphQL API with permissions, subscriptions, and metadata
Auth (nHost)	JWT-based authentication — 13 OAuth providers (Google, GitHub, Microsoft, etc.)
Nginx	Reverse proxy and SSL terminator — the only external-facing process

All internal services bind to 127.0.0.1. Nginx is the only external-facing process.

Optional Services (enable per project — 6 services)

These services are first-class and CLI-managed. Toggle them in .env and rebuild.

Service	Toggle	Role
Redis	`REDIS_ENABLED=true`	Caching, sessions, queues
MinIO	`MINIO_ENABLED=true`	S3-compatible object storage
Search	`MEILISEARCH_ENABLED=true`	Full-text search (MeiliSearch)
Email	`MAIL_ENABLED=true`	Email service — 16+ providers (SendGrid, SES, Mailgun, Postfix, and more)
Functions	`FUNCTIONS_ENABLED=true`	Serverless runtime
Admin	`NSELF_ADMIN_ENABLED=true`	Local GUI companion at `localhost:3021`

nself service list          # see all available services and their status
nself service enable redis  # enable a service
nself build && nself restart

Plugins (drop-in expansions)

Plugins are the extension layer — install what you need, remove what you don't.

29 free MIT plugins — no license key required
109 paid plugins — require a membership key (starting at $0.99/mo)

nself plugin install monitoring    # free: Prometheus + Grafana + Loki
nself plugin install search        # free: MeiliSearch full-text search
nself plugin install cron          # free: scheduled job execution

nself license set nself_pro_xxxxx
nself plugin install ai            # paid: multi-provider LLM gateway
nself plugin install livekit       # paid: live video and audio
nself plugin install claw          # paid: AI assistant backend

See Plugins for the full inventory.

Key Features

Complete backend in under 5 minutes on any machine with Docker
47 CLI commands — full control from the terminal over every service and operation
Core services always-on; optional services enable with one line in .env
138 plugins extend the stack without touching core config
Multi-tenancy, row-level security, and org management built in
Stripe/Paddle billing integration included
White-label support — custom domains, branding, email templates
Monitoring bundle (Prometheus, Grafana, Loki, Tempo, and 6 more) via the monitoring plugin
Automated SSL via Let's Encrypt in production; trusted local certs in dev
Security hardening runs automatically on install, update, deploy, and daily — always free
Multi-environment support: local, staging, and production from one install
40+ custom service templates (Express, FastAPI, NestJS, Gin, Rust, gRPC, and more)
One-command migration from Supabase, Nhost, or Firebase

Installation

macOS (Homebrew)

brew install nself-org/nself/nself

Linux

curl -fsSL https://install.nself.org | bash

Windows

WSL2 is required. Once WSL2 is set up, use the Linux installer above inside your WSL2 terminal.

The installer auto-detects existing installations, checks for Docker, downloads the binary to ~/.nself/bin, and adds nself to your PATH.

Docker

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.nself:/root/.nself nself/nself-cli nself version

Build from source

git clone https://github.com/nself-org/cli
cd cli
make build
make install  # copies nself to /usr/local/bin

Requires Go 1.22+ and GNU make.

Secure install (recommended for CI and production)

The installer always fetches checksums.txt from the same GitHub release and verifies the SHA-256 of the downloaded tarball before extracting. Installation aborts loudly on any mismatch.

For the most paranoid setups, pin the expected SHA-256 in your shell or CI config:

# Obtain the expected checksum for a specific release:
curl -fsSL https://github.com/nself-org/cli/releases/download/v1.1.2/checksums.txt

# Install with a pinned version and pinned SHA-256:
NSELF_VERSION=v1.1.2 \
NSELF_INSTALL_PIN_SHA256=<sha256-from-checksums.txt> \
curl -fsSL https://install.nself.org | bash

This defends against a compromised release page: even if the tarball at the release URL is replaced, the pinned SHA will not match and the install fails.

Update

nself update    # detects your install method and updates in place

5-Minute Tutorial

# 1. Install
# macOS:  brew install nself-org/nself/nself
# Linux:  curl -fsSL https://install.nself.org | bash

# 2. Create a project
mkdir my-backend && cd my-backend

# 3. Initialize with defaults (or use --wizard for interactive setup)
nself init

# 4. Generate Docker configs from your .env
nself build

# 5. Start the stack
nself start

# 6. Check everything is healthy
nself status
nself urls

Your core backend is running. Add optional services:

# Enable Redis and full-text search
nself service enable redis
nself service enable search
nself build && nself restart

# Install a free plugin
nself plugin install monitoring  # Prometheus + Grafana + Loki

# Set a pro license and install an AI plugin
nself license set nself_pro_xxxxxx
nself plugin install ai
nself build && nself restart

CLI Command Reference

ɳSelf provides 47 top-level commands organized by domain. Full reference: docs.nself.org/cli.

Stack lifecycle

nself init          Initialize a new nSelf project
nself build         Generate Docker configs from .env
nself start         Boot the stack (alias: nself up)
nself stop          Stop the stack (alias: nself down)
nself restart       Smart restart with change detection
nself reset         Stop, remove volumes, clean generated files

Services and config

nself service       Manage optional services (list, enable, disable)
nself config        Manage project configuration (show, get, set, validate)
nself env           Multi-environment management (use, list, diff, copy)
nself promote       Promote environment to another (staging to prod)

Plugins and licensing

nself plugin        Plugin management (install, remove, update, list, status, marketplace)
nself license       License key management (set, show, validate, clear)

Database

nself db            Database operations:
                      migrate (up/down/status/create)
                      seed, backup, restore, shell, drop, reset
                      rls, pitr, pgbouncer, audit, soft-delete, fk-index, fixtures

Security and operations

nself security      Security audit, setup, scan, and status
nself secrets       Encrypted secret management (age encryption)
nself backup        Backup operations (create, list, restore, verify, prune)
nself ssl           SSL certificate management (status, renew, setup, add)
nself doctor        System diagnostics with auto-repair (--deep for full hardening checks)
nself health        Health checks (check, watch, history)

Monitoring and observability

nself status        Service health status (--deep for extended probes)
nself logs          View and filter service logs
nself urls          List all service URLs
nself monitor       Monitoring stack management
nself alerts        Manage Prometheus alert rules and silences
nself watchdog      Self-healing container watchdog with circuit breaker

Infrastructure

nself deploy        Deploy to environment
nself tenant        Tenant management (create, upgrade, suspend, destroy, audit)
nself admin         Open the Admin UI (start, connect)
nself dr            Disaster recovery (drill, promote-standby, rollback, fence)
nself waf           Web Application Firewall (enable, mode, report)

Run nself help <command> for subcommand details.

Comparison

	ɳSelf	Supabase	Nhost	Coolify	Firebase
Fully self-hosted	Yes	Limited	Limited	Yes	No
MIT licensed core	Yes	Partial	Partial	Apache 2.0	No
Multi-tenancy built-in	Yes	No	No	No	No
Built-in billing integration	Yes	No	No	No	No
White-label support	Yes	No	No	No	No
Setup time	~5 min	30+ min	30+ min	15+ min	N/A
Plugin ecosystem	138 total (29 free + 109 pro)	Limited	Limited	App templates	No
Deploy anywhere	Yes	Cloud-first	Cloud-first	Yes	No
Data ownership	Full	Shared	Shared	Full	No

Pricing

The nself CLI and 29 free MIT plugins are fully FOSS. Free forever, including commercial use. Pro plugins require a membership key.

Tier	Monthly	Annual	What's included
Free	$0	$0	Core CLI + 29 free MIT plugins
Bundle	$0.99/mo	$9.99/yr	All 109 pro plugins (ɳChat, ɳClaw, ɳSentry, ɳTV, ɳFamily, or ClawDE)
ɳSelf+	$3.99/mo	$39.99/yr	All 6 bundles + all apps + priority support
ɳCloud	custom	custom	Managed hosting + ɳSelf+ license + cloud-exclusive features

Annual pricing saves ~17% vs monthly. See nself.org/pricing for current offers and migration from prior tiers.

nself license set nself_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
nself plugin install ai

Plugins

Free plugins (29 — MIT, no key required)

Install any free plugin with nself plugin install <name>:

Plugin	Category	What it does
`backup`	Infrastructure	Automated PostgreSQL backup with pruning and cloud storage
`cron`	Automation	Scheduled job execution with HTTP callbacks
`feature-flags`	Infrastructure	Feature flag management with targeting rules
`github`	Development	GitHub repository, issue, and workflow integration
`jobs`	Infrastructure	PostgreSQL-backed background job queue
`monitoring`	Infrastructure	Full observability stack: Prometheus, Grafana, Loki, and 7 more services
`notify`	Communication	Email (SMTP) and webhook notifications
`search`	Infrastructure	Full-text search (PostgreSQL FTS + MeiliSearch)
`stripe`	Commerce	Stripe payment data sync and webhooks
`webhooks`	Communication	Outbound webhook delivery with retry and HMAC signing
+ 15 more	Various	content-acquisition, content-progress, donorbox, github-runner, invitations, link-preview, mdns, notifications, paypal, shopify, subtitle-manager, tokens, torrent-manager, vpn, webhooks

Full inventory: nself.org/plugins

Pro plugins (109 — license-gated, starting at $0.99/mo)

nself license set nself_pro_xxxxxx
nself plugin install <name>
nself build

Categories include AI and intelligence, real-time communication, media processing, billing, compliance, content management, multi-tenancy, and more. Notable plugins:

ai — multi-provider LLM gateway (OpenAI, Anthropic, Cohere, local models)
claw — AI personal assistant backend with infinite memory (pgvector + ltree)
livekit — live video and audio rooms
chat — real-time messaging
media-processing — encoding, transcoding, thumbnail generation
streaming — HLS/DASH adaptive streaming
compliance — GDPR, CCPA, HIPAA, SOC 2, PCI-DSS coverage
auth — WebAuthn/passkeys, TOTP 2FA, magic links, device-code flow

Pro plugins are source-available. License validated server-side via ping.nself.org. Revoked keys render plugins inert on next build.

Companion Products

ɳSelf powers six open-source apps. Each is an MIT Flutter app you self-host:

App	Bundle	Price	What it does
ɳTasks	Free	$0	Task management — free, no paid plugins ever
nChat	nChat	$0.99/mo	Messaging with live video, bots, and moderation
ɳClaw	ɳClaw	$0.99/mo	AI personal assistant with self-organizing memory
nTV	nTV	$0.99/mo	Media server and player (6 platforms)
nFamily	nFamily	$0.99/mo	Private family social hub (planned)
ClawDE	ClawDE+	$1.99/mo	AI development environment (desktop + mobile)

Each app's backend is powered by the nself CLI + the matching plugin bundle.

Configuration

Config lives in .env.dev (team defaults), .env.staging, and .env.prod. nself build reads the active env file and generates docker-compose.yml and Nginx config.

Never hand-edit docker-compose.yml — it is generated and will be overwritten on the next build.

nself config show        # show current config
nself config set KEY VALUE
nself config validate    # validate before building

Env file priority (low to high)

.env.dev — team defaults (checked in)
.env.staging — staging shared config (checked in)
.env.prod — production shared config (checked in)
.env.secrets — production secrets (not checked in)
.env — local overrides (not checked in, highest priority)

Custom services (40+ templates)

Add your own services via CS_N slots:

CS_1=api:fastapi:3001     # Python FastAPI
CS_2=worker:bullmq-ts:3002  # TypeScript BullMQ
CS_3=grpc:grpc:3003       # gRPC service

Templates: JavaScript/TypeScript (19), Python (7), Go (4), Rust, Java, C#, Elixir, and more.

Production Deployment

# Copy project to server
rsync -az --exclude .volumes/ ./ user@server:/opt/myapp/

# On the server
nself start --env prod
nself status
nself health check

Security hardening runs automatically on every deploy. No license required.

Requirements

	Minimum	Recommended
Docker	24+	latest
macOS	12 (Monterey)	14+
Linux	Ubuntu 20.04 / Debian 11	Ubuntu 22.04+
RAM	2 GB	4 GB
Disk	5 GB	10 GB

Docs and Community

docs.nself.org — complete documentation
nself.org — project home, pricing, plugins catalog
GitHub Discussions — community Q&A
GitHub Issues — bug reports

Contributing

The CLI is written in Go (1.22+). See Contributing for the full guide.

Quick setup:

git clone https://github.com/nself-org/cli
cd cli
make build   # produces ./nself
make test    # go test -mod=vendor ./...

Tests live in internal/ alongside the packages they test. Coverage target: 70% on cmd/commands/ and internal/. Integration tests gate on INTEGRATION=1 and require Docker.

License

MIT, free for personal and commercial use. See LICENSE.

The 109 pro plugins are source-available under a separate commercial license. Compiled binaries are distributed through ping.nself.org after license validation.

ɳSelf CLI v1.1.2 · nself.org · GitHub

Get Started · Documentation · Pricing

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
aistudio Package aistudio implements the `nself ai-studio` command subtree.	Package aistudio implements the `nself ai-studio` command subtree.
commands P88 Sprint 05: `nself ai chat` — quick chat for verification.	P88 Sprint 05: `nself ai chat` — quick chat for verification.
nself command
nself-backup-archive command nself-backup-archive is a helper binary used as PostgreSQL's archive_command.	nself-backup-archive is a helper binary used as PostgreSQL's archive_command.
internal
admin Package admin provides admin dashboard support: audit logging, ACL, multi-project management, and remote connect helpers.	Package admin provides admin dashboard support: audit logging, ACL, multi-project management, and remote connect helpers.
aiprofile Package aiprofile implements AI_PROFILE enforcement, budget caps, feature flags, per-tier timeouts, and rate-limit coordination.	Package aiprofile implements AI_PROFILE enforcement, budget caps, feature flags, per-tier timeouts, and rate-limit coordination.
alerts Package alerts manages Prometheus alert rules and Alertmanager routing for nSelf.	Package alerts manages Prometheus alert rules and Alertmanager routing for nSelf.
apidocs Package apidocs generates an OpenAPI 3.1 spec from the Hasura introspection result and any registered plugin REST routes.	Package apidocs generates an OpenAPI 3.1 spec from the Hasura introspection result and any registered plugin REST routes.
audit
auth Package auth — HTTP client for nSelf auth server operations.	Package auth — HTTP client for nSelf auth server operations.
backup Package backup provides path validation helpers for backup operations.	Package backup provides path validation helpers for backup operations.
backup/destinations Package destinations implements remote backup destination drivers for nSelf's PITR (Point-in-Time Recovery) system.	Package destinations implements remote backup destination drivers for nSelf's PITR (Point-in-Time Recovery) system.
backup/pitr Package pitr implements point-in-time recovery via pg_basebackup and WAL archiving.	Package pitr implements point-in-time recovery via pg_basebackup and WAL archiving.
build Package build — alertmanager.go: Build-pipeline integration for the Alertmanager routing config, with ɳSentry-aware receiver + route generation.	Package build — alertmanager.go: Build-pipeline integration for the Alertmanager routing config, with ɳSentry-aware receiver + route generation.
bundle Package bundle implements the canonical nSelf paid plugin bundle catalog plus install/remove orchestration with license validation, version pinning, and atomic rollback on failure (S2.T03/T04/T22).	Package bundle implements the canonical nSelf paid plugin bundle catalog plus install/remove orchestration with license validation, version pinning, and atomic rollback on failure (S2.T03/T04/T22).
claw
cmdlog
compose Package compose: service toggle helper.	Package compose: service toggle helper.
compose/monitoring Package monitoring — alert rule and Alertmanager config generators.	Package monitoring — alert rule and Alertmanager config generators.
config Package config — user-level telemetry preference management.	Package config — user-level telemetry preference management.
confirm
controlplane Package controlplane implements the shared control-plane core consumed by both the nSelf CLI and the nSelf Admin companion.	Package controlplane implements the shared control-plane core consumed by both the nSelf CLI and the nSelf Admin companion.
controlplane/sim Package sim provides a multi-server Docker sshd simulation harness for integration-testing the control-plane pipeline without touching live hosts.	Package sim provides a multi-server Docker sshd simulation harness for integration-testing the control-plane pipeline without touching live hosts.
cost Package cost implements per-service cost alerting for nSelf AI and media plugins.	Package cost implements per-service cost alerting for nSelf AI and media plugins.
database Package database — drill.go: high-level DR drill orchestration.	Package database — drill.go: high-level DR drill orchestration.
deploy Package deploy provides deployment management for the nSelf CLI.	Package deploy provides deployment management for the nSelf CLI.
deploy/bluegreen Package bluegreen implements zero-downtime blue/green and canary deploys for the nSelf CLI (B47 + B48).	Package bluegreen implements zero-downtime blue/green and canary deploys for the nSelf CLI (B47 + B48).
deprecation Package deprecation — G4: sunset date computation for per-plugin API entries.	Package deprecation — G4: sunset date computation for per-plugin API entries.
dlq Package dlq provides helpers for nself dlq replay.	Package dlq provides helpers for nself dlq replay.
docker
doctor S77-T08: doctor --deep check for orphaned Hasura remote schemas.	S77-T08: doctor --deep check for orphaned Hasura remote schemas.
dogfood Package dogfood implements the nSelf dogfood audit system for production health verification.	Package dogfood implements the nSelf dogfood audit system for production health verification.
domain Package domain provides DNS propagation polling and nginx server block generation for custom domain provisioning.	Package domain provides DNS propagation polling and nginx server block generation for custom domain provisioning.
dr Package dr provides disaster recovery operations: drills, standby promotion, rollback, and split-brain fencing.	Package dr provides disaster recovery operations: drills, standby promotion, rollback, and split-brain fencing.
embedded Package embedded provides the wasmtime + pglite embedded-PostgreSQL path for nSelf stacks that run without an external Postgres container.	Package embedded provides the wasmtime + pglite embedded-PostgreSQL path for nSelf stacks that run without an external Postgres container.
env Package env implements multi-environment management for nSelf projects.	Package env implements multi-environment management for nSelf projects.
errors Package errors provides the canonical error catalog for the nSelf CLI.	Package errors provides the canonical error catalog for the nSelf CLI.
errs Package errs defines sentinel errors for the nself CLI.	Package errs defines sentinel errors for the nself CLI.
featureflags Package featureflags provides a built-in, file-backed feature flag registry for the nSelf CLI binary.	Package featureflags provides a built-in, file-backed feature flag registry for the nSelf CLI binary.
federation Package federation implements GraphQL Federation support for multi-service nSelf deployments.	Package federation implements GraphQL Federation support for multi-service nSelf deployments.
flags Package flags provides a thin REST client over the nself feature-flags plugin (port 3305, nginx-proxied).	Package flags provides a thin REST client over the nself feature-flags plugin (port 3305, nginx-proxied).
gdpr Package gdpr provides GDPR data portability (Art.	Package gdpr provides GDPR data portability (Art.
generate Package generate provides the schema codegen engine for nself generate.	Package generate provides the schema codegen engine for nself generate.
health Package health provides health checking utilities for nSelf services.	Package health provides health checking utilities for nSelf services.
httptimeout Package httptimeout provides timeout-bounded *http.Client values per scope.	Package httptimeout provides timeout-bounded *http.Client values per scope.
infra Package infra provides a thin wrapper around the Terraform CLI for provisioning nSelf infrastructure via provider-specific modules (B51/B52).	Package infra provides a thin wrapper around the Terraform CLI for provisioning nSelf infrastructure via provider-specific modules (B51/B52).
installer Package installer provides automated installation of Ollama and related local-LLM infrastructure for nSelf Block A (Zero-Config AI).	Package installer provides automated installation of Ollama and related local-LLM infrastructure for nSelf Block A (Zero-Config AI).
installmeta Package installmeta persists install-time metadata to ~/.nself/install-meta.json.	Package installmeta persists install-time metadata to ~/.nself/install-meta.json.
k8s Package k8s provides a thin wrapper around the Helm CLI for managing nSelf Helm chart deployments (B50).	Package k8s provides a thin wrapper around the Helm CLI for managing nSelf Helm chart deployments (B50).
license Package license — banner.go provides warning banner text for grace period states.	Package license — banner.go provides warning banner text for grace period states.
lifecycle
mail Package mail provides an HTTP client for the ping_api /mail/* endpoints.	Package mail provides an HTTP client for the ping_api /mail/* endpoints.
maintenance Package maintenance — daily Hasura metadata backup cron registration.	Package maintenance — daily Hasura metadata backup cron registration.
metrics Package metrics emits Prometheus-compatible metrics written to a textfile collector directory for node_exporter to scrape.	Package metrics emits Prometheus-compatible metrics written to a textfile collector directory for node_exporter to scrape.
migrate Package migrate provides migration helpers for legacy nSelf project layouts.	Package migrate provides migration helpers for legacy nSelf project layouts.
migrate/firebase Package firebase implements the Firebase → nSelf migration scaffold.	Package firebase implements the Firebase → nSelf migration scaffold.
migrate/supabase Package supabase implements the Supabase → nSelf migration pipeline.	Package supabase implements the Supabase → nSelf migration pipeline.
migration
migrationai Package migrationai provides AST-based schema delta detection and AI-assisted SQL migration generation for nSelf projects.	Package migrationai provides AST-based schema delta detection and AI-assisted SQL migration generation for nSelf projects.
model Package model detects which plugin distribution model is in effect for a given plugin in the current project: Model A (Docker compose-managed, source under plugins-pro-src/) or Model B (single-binary, installed under ~/.nself/plugins/<name>/).	Package model detects which plugin distribution model is in effect for a given plugin in the current project: Model A (Docker compose-managed, source under plugins-pro-src/) or Model B (single-binary, installed under ~/.nself/plugins/<name>/).
monitoring Package monitoring handles Grafana dashboard provisioning for nself monitoring plugin.	Package monitoring handles Grafana dashboard provisioning for nself monitoring plugin.
nginx Package nginx provides Nginx configuration generation and management for the nSelf CLI.	Package nginx provides Nginx configuration generation and management for the nSelf CLI.
oauth Package oauth provides manual OAuth token refresh helpers.	Package oauth provides manual OAuth token refresh helpers.
observability Package observability provides shared Prometheus metrics and OpenTelemetry tracing helpers for all nSelf Go services.	Package observability provides shared Prometheus metrics and OpenTelemetry tracing helpers for all nSelf Go services.
onboarding Package onboarding implements the 6-stage onboarding funnel check for nself doctor --install-check.	Package onboarding implements the 6-stage onboarding funnel check for nself doctor --install-check.
plugin Package plugin — lifecycle audit helpers.	Package plugin — lifecycle audit helpers.
plugin/lifecycle Package lifecycle provides the dormant-plugin state machine for the nSelf plugin license lifecycle.	Package lifecycle provides the dormant-plugin state machine for the nSelf plugin license lifecycle.
plugin/scaffold Package scaffold provides the canonical plugin scaffolding logic shared between the nself CLI (plugin new command) and the standalone new-plugin binary in plugin-sdk-go/devkit.	Package scaffold provides the canonical plugin scaffolding logic shared between the nself CLI (plugin new command) and the standalone new-plugin binary in plugin-sdk-go/devkit.
plugin/verify
ports Package ports provides port-holder identification utilities for the nSelf CLI.	Package ports provides port-holder identification utilities for the nSelf CLI.
postgres
promote Package promote implements staging-to-production promotion with diff preview and rollback.	Package promote implements staging-to-production promotion with diff preview and rollback.
queue Package queue provides CLI integration for the pg-boss queue/jobs plugin.	Package queue provides CLI integration for the pg-boss queue/jobs plugin.
recover
region Package region implements multi-region awareness for nSelf deployments (B49).	Package region implements multi-region awareness for nSelf deployments (B49).
runbook Package runbook implements the SRE runbook library and claw-ops auto-execution engine.	Package runbook implements the SRE runbook library and claw-ops auto-execution engine.
runtime Package runtime detects the local container runtime (Docker, OrbStack, Podman) and reports its name, binary path, version, and enterprise-mode hint.	Package runtime detects the local container runtime (Docker, OrbStack, Podman) and reports its name, binary path, version, and enterprise-mode hint.
scaffold Package scaffold provides CS_N custom service scaffolding for nself projects.	Package scaffold provides CS_N custom service scaffolding for nself projects.
search Package search provides MeiliSearch integration helpers for the nSelf CLI.	Package search provides MeiliSearch integration helpers for the nSelf CLI.
secrets Package secrets — rotation scheduling, dual-key windows, and expiry alerts.	Package secrets — rotation scheduling, dual-key windows, and expiry alerts.
security
seed Package seed implements the DB seeding fixtures system for nSelf projects.	Package seed implements the DB seeding fixtures system for nSelf projects.
service Package service provides lifecycle management for individual nSelf optional services (start, stop, restart, ps, update, scale).	Package service provides lifecycle management for individual nSelf optional services (start, stop, restart, ps, update, scale).
setup Package setup — .env.ai generator for P88 Zero-Config AI (Sprint 01, T-01-09).	Package setup — .env.ai generator for P88 Zero-Config AI (Sprint 01, T-01-09).
soak Package soak provides helpers for nself soak abort --rollback.	Package soak provides helpers for nself soak abort --rollback.
ssl
telemetry Package telemetry — opt-in anonymous CLI telemetry client (S65.T01 / Q07).	Package telemetry — opt-in anonymous CLI telemetry client (S65.T01 / Q07).
templates/clone Package clone provides embedded app-clone templates for nself init --template.	Package clone provides embedded app-clone templates for nself init --template.
tenant Package tenant manages multi-tenant lifecycle operations for a self-hosted nSelf deployment.	Package tenant manages multi-tenant lifecycle operations for a self-hosted nSelf deployment.
trust
truststate
ui
upgrade Package upgrade implements release channel selection and version resolution for the `nself upgrade` command.	Package upgrade implements release channel selection and version resolution for the `nself upgrade` command.
ux Package ux provides user-experience primitives for structured CLI error display.	Package ux provides user-experience primitives for structured CLI error display.
version
watchdog Package watchdog implements self-healing container monitoring with circuit breaker.	Package watchdog implements self-healing container monitoring with circuit breaker.
webhook Package webhook provides HMAC-SHA256 signing and dispatch for nSelf webhook deliveries.	Package webhook provides HMAC-SHA256 signing and dispatch for nSelf webhook deliveries.
tools
endpoint-auth-checker command Package main — allowlist.go Known-safe auth middleware names and exempt route patterns.	Package main — allowlist.go Known-safe auth middleware names and exempt route patterns.