internal/

Package auth enforces the gateway's bearer token/API key allow-list on every ingress HTTP request, per spec.md §5.4 and the FEATURE-019 acceptance criterion: a request without a valid token is rejected before it ever reaches MCP session handling, let alone a backend.

Package config loads and validates mcp-resile.yaml, per spec.md §7.

Package egress opens and drives MCP client sessions toward backend servers over HTTP, per spec.md §3.3.

Package ingress builds the gateway's client-facing MCP server and serves it over Streamable HTTP, per spec.md §3.2.

Package logging builds the gateway's structured slog.Logger from telemetry.logging: config (spec.md §7), per the FEATURE-021 acceptance criterion: every request logs at info with tool name, backend, outcome, and latency as structured fields; errors log at warn/error with the mapped JSON-RPC code.

Package metrics implements FEATURE-020's Prometheus /metrics endpoint: request count/latency by tool, circuit breaker state transitions, rate-limit rejections, and retry counts.

Package policy resolves a tool name to the policy that governs it, per spec.md §7 and the FEATURE-010 acceptance criterion: a tool name resolves to exactly one matching policy (or a documented default) before dispatch.

Package proxy wires the ingress MCP server to one or more egress backends, merging tools/list across them and routing tools/call by namespace prefix, per spec.md §5.1, and dispatching each tools/call through resile's resilience primitives per the policy governing it (FEATURE-010 onward).

Package version holds the build-time version string for mcp-resile.