internal/

Package backoff is the saturating exponential used wherever the framework waits and retries.

Package cachekey holds the grammar shared by every layer that builds a cache key namespace: the separator, the prefix rules, and the join that assembles a prefix from its segments.

Package clienttls turns declarative client-side TLS material — PEM from a file path or a base64-encoded value — into a *tls.Config.

Package configdecode holds mapstructure decode hooks shared by the go-bricks config and migration packages, so the decode guards have a single source of truth inside the module.

Package keymaterial hosts the file-or-value key loading and DER parsing mechanism shared by the keystore module and internal/sealcli, through which the seal-payload and seal-event CLIs reach it.

Package leasescope carries a unit-of-work "lease scope" through context.Context.

Package ledgererr bounds the diagnostic text a ledger writes to its error column.

Package pathutil hosts the URL-path helpers shared by route registration and tenant resolution.

Package publishdoor is the one link-time seam through which framework internals outside package messaging — the outbox relay — hand raw bytes to an AMQP client.

Package racedetect reports whether the binary was built with -race, so the allocation-stability guards (testing.AllocsPerRun) can skip under a detector that inflates their counts.

Package reflection provides internal utility functions for reflection operations in the go-bricks framework.

Package resourcepool implements the ADR-032 keyed pool of leasable, refcounted, LRU-capped, idle-evicted resources, backing the cache, database, and messaging managers.

Package saferender renders decode and validation failures without echoing the input that caused them.

Package sealcli hosts the flag, key and payload plumbing the sealing CLIs share: the four key-source flags with their help text, the exactly-one-of-per-pair refusal keymaterial deliberately leaves to its callers, and the size-capped file-or-stdin payload read.

Package secretfile hosts the error-hygiene guards shared by every code path that reads key material from an operator-named file.

Package sqlid validates SQL identifiers (table names) before they are interpolated into DDL/DML, guarding against SQL identifier injection.

Package streamruntime is the one link-time seam for the native streams lane.

Package tenantstore provides the lazy, tenant-keyed store cache shared by the inbox and outbox modules.

Package testutil provides shared constants for testing across go-bricks.

Package validation constructs the framework's shared go-playground validator instance.