internal/

Package authletas wires authlet into memory-system: UserResolver, AS construction, JWKS/PRM handlers, and dual-auth middleware.

Package authletstore is memory-system's GORM-backed implementation of authlet/pkg/storage; tables match internal/migrations/<ts>_authlet_tables.sql.

Package authz is a Zanzibar-style relationship-based authorization engine: relation tuples (object#relation@subject) evaluated against a fixed, non-user-editable namespace by a recursive Check.

Package authzseed populates the RBAC engine's relation tuples out-of-band: pure constructors (single source of truth) + idempotent Backfill/BootstrapAdmins writers.

Package cleanup runs the server-side near-duplicate scanner and its Telegram notifier: on a fixed interval, walk every tenant, upsert pending queue entries.

Package panicguard provides a deferred recover for long-lived background goroutines.

Package retention holds the pure time-window math for the retention sweep (sweep in internal/cleanup, SQL in internal/repository) — unit-testable without a DB.

Package staleness decides whether a section's content is withheld: verified older than its doc_type threshold AND making claims that rot (code paths, symbols).

Package version is the single source of truth for the server version, used by the MCP server identity and the /~/version endpoint.