internal/

Package authletas wires authlet into memory-system: UserResolver, AS construction, JWKS/PRM handlers, and dual-auth middleware.

Package authletstore is memory-system's GORM-backed implementation of authlet/pkg/storage; tables match internal/migrations/<ts>_authlet_tables.sql.

Package authz is a Zanzibar-style relationship-based authorization engine: relation tuples (object#relation@subject) evaluated against a fixed, non-user-editable namespace by a recursive Check.

Package authzseed populates the RBAC engine's relation tuples out-of-band: pure constructors (single source of truth) + idempotent Backfill/BootstrapAdmins writers.

Package cleanup runs the server-side near-duplicate scanner and its webhook notifier: on the configured interval, walk every tenant, upsert pending entries.

Package globalconfig serves the runtime global config as a lock-free atomic snapshot loaded from the instance_config singleton, shared by the service and server layers.

Package panicguard provides a deferred recover for long-lived background goroutines.

Package pgnotify runs one shared PostgreSQL LISTEN connection and dispatches notifications to per-channel reload functions.

Package staleness decides a section's read-time freshness from age alone: two per-doc_type clocks (a verification-age nudge and an expiration-age withhold) under the tenant staleness mode.

Package version is the single source of truth for the server version, used by the MCP server identity and the /~/version endpoint.