These libraries provide the OpenCrane API process with transport and external-I/O seams. They keep HTTP, OIDC, Kubernetes identity, and remote-service mechanics outside durable backend domains while remaining grouped with the server code that composes them.
| Package | What it owns |
|---|---|
api |
Kubernetes API constants and error normalisation. |
agent-sandbox |
SandboxClaim realization and exact Pod-to-lease verification. |
auth |
OIDC login, sessions, and request-principal resolution. |
workload-identity |
Kubernetes TokenReview and bounded workload identities. |
history-store |
KurrentDB-backed append-only stream history. |
http |
Express transport plumbing. |
memory-gateway-client |
Authenticated memory reads with fail-closed writes. |
mcp-remote-client |
Bounded HTTPS transport for MCP discovery, tool listing and admitted tool calls. |
oci-registry |
Imports checked OCI images into one configured registry repository by digest. |
organization-membership-gateway |
Projected-token-authenticated HTTPS transport to Fleet membership and billing. |
prisma-unit-of-work |
The shared transaction envelope: explicit isolation and bounded retry of proven rollbacks. |
workflows |
Engine-neutral saved workflow tasks, guardrails, scheduling helpers, adapters, and test support. |
inbound request ──► http ──► auth ──► backend domain route
│
api ───────────┤
workload identity ─► workload routes
These packages carry type:lib, layer:infra, and a bounded scope:* tag. They may use models,
contracts, utilities, observability, and explicitly allowed server/infra peers, but never import a
backend domain or app entrypoint. Public imports use @opencrane/backend/server/infra/<library>.
- Parent index: server
- Backend index: backend
- Cross-cutting telemetry: observability
- Server business capabilities: backend/server