internal/

Package auth owns the application's authentication primitives: bcrypt password hashing, CSRF token generation, and the session lifecycle (create / lookup / touch / destroy).

Package clickhouse opens the application's ClickHouse connection pools (admin + readonly) and exposes a golang-migrate driver constructor.

Package idgen is the single source of truth for ID generation across the app.

Package ingest implements the analytics write path: POST /api/v1/ingest/events → validated batch → in-memory channel → flusher → ClickHouse events_raw_v1.

Package maintenance sweeps expired rows out of operational Postgres tables that would otherwise grow monotonically: oauth_codes, oauth_access_tokens, and sessions.

Package mcp exposes the analytics read surface (query + schema) as Model Context Protocol tools behind a single /mcp endpoint.

Package migrate is the shared migration runner used by both Postgres and ClickHouse.

Package oauth implements a hand-rolled OAuth 2.1 authorization server for the analytics API + MCP surfaces.

Package postgres opens the application's Postgres connection pool and exposes a golang-migrate driver constructor for use by internal/migrate.

Package query owns the analytics read path.

Package static owns the embedded static-asset filesystem.

Package testhelpers provides shared testcontainers-go setup for PG and CH used by per-package integration tests and the e2e boot test.

templ: version: v0.3.1020

Package web wires the application's HTTP surface.