internal/

Package agentauth is the auth.md agent-identity layer (api-v1-redesign §5 / Slice 5b).

Package apiserver builds the process HTTP handler: the typed Huma /v1 surface (internal/httpapi) wrapping the legacy gorilla/mux fallback.

Package approvaltoken signs and verifies the short-lived HMAC tokens embedded in HITL notification-email magic links.

Package delivery implements outbound delivery feedback (decision 9 / Slice 4b): the async delivery lifecycle SES reports per message and per recipient, plus a per-tenant suppression list.

Package dkim wraps github.com/emersion/go-msgauth/dkim for the per-domain signing path.

Package hitlnotify sends the approval notification email that fires whenever a new outbound message enters pending_review.

Package hitlworker runs the periodic sweep that finalizes pending_review holds whose TTL has elapsed.

Package httpapi is the e2a v1 HTTP contract layer, built on Huma + chi.

Package idempotency implements the storage backing the Idempotency-Key header on the outbound send endpoints.

Package inboundpolicy evaluates a per-agent inbound trust policy (api-v1-redesign decision 10 / Slice 7).

Package limits enforces per-user resource caps at the agent-create, domain-register, and message-send paths.

Package loopback delivers agent-to-self messages without touching the upstream SMTP relay.

Package mailfrom defines the custom MAIL FROM subdomain convention shared by sender-identity provisioning (which configures it in SES and emits its DNS records) and the outbound sender (which uses it as the aligned Return-Path).

Package mailparse produces the "parsed view" of a raw RFC 5322 message — inbound mail and the retained copy of sent outbound mail (decision 9 / Slice 4b-3).

Package oauth wires the e2a authorization server using ory/fosite as the protocol layer.

Package piguard ("prompt-injection guard") is the content-screening seam for inbound and outbound agent email.

Package selftest defines the e2a critical-path self-test: a small battery of scenarios that exercise the real product paths (liveness, authenticated read, the inbound SMTP→webhook round-trip with HMAC verification, and a self-send loopback) against a running instance.

Package senderidentity manages the per-domain SES sending identity that lets outbound mail use the agent's OWN address as the From header (decision 4 / Slice 4).

Package telemetry defines the metrics interface for the e2a backend.

Package webhookpub publishes events from the e2a core (relay, outbound sender, HITL flow) to subscribers registered via the new /v1/webhooks resource.