Platform-level roles (app_system_users.role).

WSEvent is a full state snapshot pushed to WebSocket clients on every update. Each push contains the complete current state of the agent's reply, so t

wsEventMsg wraps a WSEvent as a Bubble Tea message so it can be delivered to the Model's Update function via the event loop.

AuthFunc extracts and verifies (userID, workspaceID) from an incoming WebSocket upgrade request. A non-nil error rejects the connection. Implementatio

Bus sends a payload to exactly one WebSocket connection. Implementations may be remote (push via a managed gateway HTTP API) or local (write to a *we

Bus holds live WebSocket connections and implements wsbus.Bus. gorilla/websocket requires callers to serialize writes on a single connection, so every

Bus pushes WebSocket payloads via AWS API Gateway's @connections HTTP side channel. Lambda cannot hold a persistent socket itself, so all pushes go th

CharLimits controls truncation for each prompt section.

Client talks to two astroclaw endpoints: the API Gateway base URL for short CRUD calls, and an optional reply URL for the Reply Lambda's Function URL

Credential is the decrypted form of a stored credential.

CredentialMetadata is what List endpoints return: no plaintext, no ciphertext, just the user-facing metadata.

DataKeyProvisioner provisions an encryption data key for a newly created workspace or user, so the passwords app can later encrypt credentials scoped

DuckDuckGoProvider searches via DuckDuckGo's HTML endpoint. No API key required. Free but subject to rate limiting and bot detection.

Event and Result follow the CloudFormation Custom Resource protocol. CDK's Provider framework invokes this Lambda on stack Create, Update, and Delete.

KeyManager encrypts and decrypts byte slices using a master key that is managed by a cloud provider (e.g. AWS KMS) and never leaves it. We only use it

LoginResponse is the body of a successful POST /login.

MemorySaveTool saves durable facts to persistent memory. The store, agentID, userID, and sessionID are injected when the tool is created, typically pe

MemoryStore is the interface that MemorySaveTool needs to persist memories.

MemoryStoreAdapter wraps notes.Service to satisfy tool.MemoryStore interface.

Message represents a single message in the conversation history. Role determines the message type and how each Provider translates it: - "System": Sy

Params describes the input parameters used by the Argon2id algorithm. The Memory and Iterations parameters control the computational cost of hashing t

PromptConfig holds the configurable parts of the system prompt. The caller reads these from the database and passes them in.