internal/

Package appenv turns an app's stored environment variables into the "KEY=VALUE" slices the runtime injects at start time.

Package autoscale provides a provider-agnostic replica autoscale controller.

Package autoscalespec holds the pure, I/O-free validation for a declared per-app autoscale policy.

Package backup implements first-class snapshot and restore of all ShinyHub durable state: the database, deployed app bundles, and per-app data dirs.

Package bundle defines the single source of truth for which files may appear inside a deploy bundle.

Package bundletoken mints and verifies short-lived capability tokens that authorise a single fetch of one content-addressed bundle.

Package data implements the persistent per-app storage area exposed via `PUT/DELETE/GET /api/apps/:slug/data[/*path]` and the `shinyhub data` CLI.

Package dbtest provides an env-aware store constructor for tests.

Package deployfail defines the stable vocabulary and classifier for why a deploy attempt failed.

Package fargate provides a process.Runtime backend that runs each app replica as an AWS ECS task on the Fargate launch type.

Package fleet implements the pure, I/O-free core of the fleet reconcile layer: manifest parsing, source-form classification, and the desired-vs- observed diff.

Package history keeps a short, in-memory time series of per-app resource metrics (CPU, memory, sessions, instance count) for the dashboard's "Trends" view.

Package httproute propagates a matched HTTP route pattern through a request context as an immutable string.

Package identity derives per-app identity keys, sanitizes group lists for header transport, and mints the signed identity token the proxy forwards to app processes.

Package leader elects a single owner control-plane instance via a fenced, DB-backed lease.

Package localrun provides the foreground app runner for `shinyhub run`.

Package logging wires a process-wide slog.Logger based on env config.

Package metrics exposes Prometheus instrumentation for the ShinyHub server process itself - HTTP request counts/latency for the control-plane API, the Go runtime and process collectors, and build/version + uptime gauges.

Package proxytrust centralises the trust gate that controls whether X-Forwarded-* request headers are honoured.

Package sandbox applies best-effort, unprivileged process isolation to native app processes.

Package schedulespec defines schedule validation rules shared between the HTTP API and the deploy-manifest application path.

Package secrets encrypts and decrypts small values (env var secrets) using AES-256-GCM with a key derived from the server's auth secret via HKDF-SHA256.

Package servertrace adds optional OpenTelemetry tracing for the ShinyHub server process itself - spans for the control-plane API request handling, exported to the same OTLP endpoint the managed apps use.

Package slug holds the canonical slug-validation regex shared by the API server, CLI, and any future surface that needs to validate or display the rules.

Package storage owns ShinyHub's on-disk and pluggable storage concerns: the on-disk lifecycle helpers shared by the API and CLI (the slug-keyed convention for per-app directories, one under Storage.AppsDir for code and one under Storage.AppDataDir for persistent data), plus the DataVolume abstraction that provisions per-app mutable data on a single host's local disk (or, in a later phase, a shared backend).

Package tracing implements lightweight W3C-trace-context propagation through the reverse proxy and a per-app ring buffer of recent slow/error proxy spans for the UI's Traces tab.

Package upgrade wraps github.com/cloudflare/tableflip behind a small interface so ShinyHub can perform zero-downtime, listener-preserving restarts (SIGHUP handoff) and unit-test the wiring with a fake.

internal/worker/ca.go