internal/

Schema indirection (authkit issue 69).

Package errmodel is the one error model every AuthKit package speaks (ak#290): a Code, an Error carrying that code plus its HTTP status, an optional offending param, machine metadata and a cause, and the catalog that fixes each code's status and message.

Package netguard is the single outbound-network policy for AuthKit: the private/reserved address list, the resolve-then-dial SSRF guard, and the timeout-bounded HTTP client every package uses for fetches it does not fully control (JWKS, application documents, IdP endpoints).

Package passkeytest is a software WebAuthn authenticator for passkey integration tests: it answers real registration and assertion ceremonies with a P-256 key, so tests exercise the production ceremony code paths.

Package siws implements Sign In With Solana (SIWS) authentication.

Package testclock is a settable clock for tests that would otherwise sleep through a TTL, grace window or rate-limit window.

Package testdb owns AuthKit's Postgres integration-test harness.