internal/

Package branding owns the resolved-once brand assets behind one Handle: the brand logo SVG, the brand URL, and the implementor logo SVG.

Package browserauth builds the browser-facing authentication stack for the portal and admin web UI: the OIDC login/callback flow and the cookie authenticator, held together behind one Session handle.

Package cfgmap holds typed accessors for reading values out of the map[string]any config blobs the platform loads from YAML/JSON.

Package completionlayer implements the MCP completion/complete handler for the platform: argument autocompletion for prompt arguments and resource-template variables.

Package connauth assembles the connection-OAuth token lifecycle behind one Handle: the unified connection_oauth_tokens store (pkg/connoauth), the durable connection_auth_events store together with its nil-safe writer and daily 90-day prune routine (pkg/authevents), and the background token-refresh loop.

Package connsource maps connections to their DataHub URN components (platform name and catalog mapping), with forward and reverse lookups.

Package dedup holds the session-level metadata deduplication config, split out of pkg/platform to keep that package under its size budget (#594).

Package exportadapters adapts the platform's portal stores to the export interfaces consumed by the trino and api-gateway toolkits.

Package iam builds the platform's authentication and authorization identity layer: the authenticator chain (NewIdentity) and the persona authorizer (NewAuthorizer).

Package indexqueue assembles the shared background embedding queue (pkg/indexjobs) behind one Handle: the Postgres store, the Source/Sink registry, the worker/reaper/reconciler, the optional retention sweep and LISTEN/NOTIFY adapter, and every enabled consumer (api-catalog, tools, memory, prompts, portal assets/collections/knowledge-pages).

Package knowledgelayer assembles the knowledge-capture layer behind one Handle: the insight store (the memory-backed adapter over memory_records when a memory store is present, else the legacy Postgres store), the changeset store and DataHub writer that back apply_knowledge, and the capture_insight / apply_knowledge toolkit itself.

Package listchanged provides a debounced, broadcaster-backed notifier that publishes a single MCP "*/list_changed" notification for a runtime-mutable entity set (prompts, managed resources) to every connected SSE long-poll subscriber, cross-replica via the session broadcaster's LISTEN/NOTIFY channel.

Package memorylayer assembles the memory layer behind one Handle: the Postgres-backed memory store, the embedding provider that powers vector search, the memory_manage / memory_capture toolkit (with its recall-first checker), the memory↔enrichment middleware adapter, and the background staleness watcher.

Package mwchain validates an ordered middleware chain against declared ordering dependencies.

Package oauthserver assembles the OAuth 2.1 authorization server and its storage behind one Handle: storage selection (Postgres when a database is present, else in-memory), bcrypt-hashed pre-registration of configured clients, the server itself, its authorization-state cleanup, and metrics wiring.

Package obs owns the platform's observability layer: the metrics recorder, its /metrics HTTP listener, and the (independently-gated) OTel tracer.

Package portalstore assembles the asset-portal store layer behind one Handle: the five Postgres stores (asset, share, version, collection, thread), the knowledge-page store, the S3 blob backend, and the save/manage-artifact toolkit built on top of them.

Package promptlayer assembles the prompt subsystem behind one Handle: the Postgres-backed prompt store, the file-based tuning prompt manager, the name-keyed prompt-metadata registry (promptInfos), and every behavior that registers, serves, and manages prompts — the static/workflow/database registration path, the per-viewer dynamic-serving path behind the prompts/list visibility middleware, and the manage_prompt tool.

Package reflexivecapture wires reflexive knowledge activation (#635) into the platform: it observes Trino query errors and mints a "misconception + fix" correction memory when a later related query succeeds in the same session.

Package resourcelayer assembles the managed-resources layer behind one Handle: the Postgres-backed resource store for human-uploaded reference material, the S3 blob client that holds the file bytes, and the MCP-server registration that makes each resource visible in the SDK's native resources/list.

Package routepolicy builds the api-gateway's per-route authorization policy: it resolves a caller's roles and checks a (connection, method, path) tuple against the persona authorizer's APIRoutes rules.

Package searchfed assembles the universal, topology-free search federation behind one Handle: the knowledge.Router that federates every searchable source a caller can access, and the search toolkit that exposes it as the one discovery entry point (#645).

Package sessionsync assembles the session / cross-replica-sync layer behind one Handle: the externalized session store (memory or postgres), the per-session enrichment-dedup cache, the client-facing MCP notification broadcaster, and the dedicated cross-replica reload bus (its own broadcaster channel plus the publish/subscribe machinery).

Package toolkitcfg resolves typed per-toolkit connection configuration out of the platform's raw toolkits config (map[string]any decoded from YAML/JSON).

Package toolratelimit wires the per-user tool-call rate limiter (#929) into the platform: an MCP receiving middleware that refuses authenticated tools/call requests exceeding a generous per-identity token-bucket limit before they reach the handler, audit pipeline, or upstream.

Package userdir assembles the known-users directory (#614) behind one Handle: the Postgres-backed user store and the *user.Directory that wraps it with throttled, asynchronous upserts of authenticated people.