internal/

Package enforcement provides the concrete Enforcement and Activator implementations that compose the safety subsystems (policy, rate limiting, dry-run, truncation, bootstrap) into the MCP server's pluggable interfaces.

Package jsonmergepatch is a hand-rolled, stdlib-only implementation of JSON Merge Patch (RFC 7396).

Package jsonpatch implements RFC 6902 JSON Patch: a sequence of add, remove, replace operations that transforms one JSON document into another.

Package jsonschema is a tiny stdlib-only JSON-schema validator scoped to the keyword subset that the Clockify MCP server's Tier 1 + Tier 2 tool input schemas actually use.

Package logging provides a stdlib-only slog.Handler decorator that scrubs sensitive values from log attributes before they reach the underlying handler.

Package metrics provides a stdlib-only Prometheus text exposition format encoder.

Package runtime wires the clockify-mcp process: it loads the config-derived dependencies (policy, rate limit, dedupe, dry-run, truncation, bootstrap) and owns transport dispatch.

Package testharness wires the real MCP dispatch path (auth → enforcement pipeline → tool handler → Clockify client) against a fake Clockify upstream so tests can assert policy, auth, and idempotency properties end-to-end without bypassing the layers that enforce them.

Package tracing is the stdlib-only tracing facade.