internal/

Package cli wires the two wgpeer modes to the terminal (spec §2, §6):

Package client implements the unprivileged half of wgpeer (spec §2, §6): it generates the private key locally (never sent anywhere), drives the server over ssh, and assembles the final client config + QR from the response.

Package config loads the TOML configuration for both halves of wgpeer (spec §4): the per-interface server config /etc/wgpeer/<iface>.toml and the client menu ~/.config/wgpeer/client.toml.

Package protocol defines the JSON request/response types exchanged between the wgpeer client and server halves over a single ssh-exec.

Package server implements the privileged half of wgpeer (spec §2): it owns /etc/wireguard/<iface>.conf, mutates peer blocks under an flock with atomic writes, and applies the delta with `wg syncconf`.

Package wgconf is the heart of wgpeer: a small, tolerant reader/writer for a WireGuard .conf where the file is the source of truth for peers (spec §7).

Package wgkey implements native WireGuard key handling: curve25519 keypair generation, preshared-key generation, and the std-base64 encoding wg uses.