platform/

Package apikeystore persists the database-managed API keys the platform loads alongside the keys declared in configuration.

Package assetindex is the saved-asset consumer of the shared indexjobs framework (#550).

Package auditwiring assembles the layer that hangs off the audit log.

Package branding owns the resolved brand assets behind one Handle: the brand logo, the brand URL, and the implementor logo.

Package browserauth builds the browser-facing authentication stack for the portal and admin web UI: the OIDC login/callback flow and the cookie authenticator, held together behind one Session handle.

Package callindex is the call-catalog consumer of the shared indexjobs framework (#507, #1321).

Package callrecord is the catalog of what the platform's data calls actually did: every SQL query and API invocation as a record with a purpose, a target, and a fate (issue #1321).

Package cfgmap holds typed accessors for reading values out of the map[string]any config blobs the platform loads from YAML/JSON.

Package collectionindex is the curated-collection consumer of the shared indexjobs framework (#550).

Package completionlayer implements the MCP completion/complete handler for the platform: argument autocompletion for prompt arguments and resource-template variables.

Package configenv expands ${VAR} and ${VAR:-default} placeholders in a configuration document before it is parsed.

Package connauth assembles the connection-OAuth token lifecycle behind one Handle: the unified connection_oauth_tokens store (pkg/connoauth), the durable connection_auth_events store together with its nil-safe writer and daily 90-day prune routine (pkg/authevents), and the background token-refresh loop.

Package connbackfill seeds connection_instances with a credential-free row for every file-configured connection, so knowledge-page references of the form mcp:connection:(kind,name) — which FK to connection_instances — resolve for connections defined only in platform.yaml.

Package connreach answers, in the deployment's own terms, which connections one caller's authority reaches.

Package connscope answers, for discovery surfaces, the question the authorizer answers for tool calls: may this caller's persona reach this connection?

Package connsource maps connections to their DataHub URN components (platform name and catalog mapping), with forward and reverse lookups.

Package datasetindex is the catalog-dataset consumer of the shared indexjobs framework (#1131).

Package dedup holds the session-level metadata deduplication config, split out of pkg/platform to keep that package under its size budget (#594).

Package exportadapters adapts the platform's portal stores to the export interfaces consumed by the trino and api-gateway toolkits.

Package iam builds the platform's authentication and authorization identity layer: the authenticator chain (NewIdentity), the persona authorizer (NewAuthorizer), and the role-to-persona membership resolver (PersonasForRoles) that persona-scoped surfaces read a caller's memberships through.

Package indexqueue assembles the shared background embedding queue (pkg/indexjobs) behind one Handle: the Postgres store, the Source/Sink registry, the worker/reaper/reconciler, the optional retention sweep and LISTEN/NOTIFY adapter, and every enabled consumer (api-catalog, tools, memory, prompts, portal assets/collections/knowledge-pages, managed resources, managed scripts, catalog datasets).

Package knowledgebuiltin ships the platform's own knowledge pages: the rationale behind the advanced features that is not readable from tool schemas (the managed-script dialect and its gotchas, export identity, the semi-dynamic dashboard pattern, provenance and the capture loop), embedded in the binary and reconciled into the knowledge-page store at startup (#1390), so a release that changes them updates every deployment on its next start.

Package knowledgelayer assembles the knowledge-capture layer behind one Handle: the insight store (the memory-backed adapter over memory_records when a memory store is present, else the legacy Postgres store), the changeset store and DataHub writer that back apply_knowledge, and the capture_insight / apply_knowledge toolkit itself.

Package knowledgepageindex is the knowledge-page consumer of the shared indexjobs framework (#633).

Package listchanged provides a debounced, broadcaster-backed notifier that publishes a single MCP "*/list_changed" notification for a runtime-mutable entity set (prompts, managed resources) to every connected SSE long-poll subscriber, cross-replica via the session broadcaster's LISTEN/NOTIFY channel.

Package mcpapps provides MCP Apps support for interactive UI components.

Package memoryindex is the memory consumer of the shared indexjobs framework (#507).

Package memorylayer assembles the memory layer behind one Handle: the Postgres-backed memory store, the embedding provider that powers vector search, the memory_manage / memory_capture toolkit (with its recall-first checker), the memory↔enrichment middleware adapter, and the background staleness watcher.

Package mwchain validates an ordered middleware chain against declared ordering dependencies.

Package notices assembles the per-user session-start briefing that platform_info carries (#1278).

Package notifydelivery assembles the email-notification substrate into one startable handle: the settings, preference, and queue stores, the trigger-side enqueuer, the renderer and SMTP sender, and the send worker with its LISTEN/NOTIFY wakeup adapter.

Package oauthserver assembles the OAuth 2.1 authorization server and its storage behind one Handle: storage selection (Postgres when a database is present, else in-memory), bcrypt-hashed pre-registration of configured clients, the server itself, its authorization-state cleanup, and metrics wiring.

Package obs owns the platform's observability layer: the metrics recorder, its /metrics HTTP listener, and the (independently-gated) OTel tracer.

Package personacfg holds the YAML shape of a persona definition and the one conversion from it to the runtime persona the authorizer evaluates.

Package portalcfg resolves the defaults of the portal config block: the deployment brand, the portal title composed from it, the asset size cap, and the asset storage location.

Package portalstore assembles the asset-portal store layer behind one Handle: the five Postgres stores (asset, share, version, collection, thread), the knowledge-page store, the S3 blob backend, and the save/manage-asset toolkit built on top of them.

Package promptindex is the prompt-library consumer of the shared indexjobs framework (#557, epic #525 phase 4).

Package promptlayer assembles the prompt subsystem behind one Handle: the Postgres-backed prompt store, the file-based tuning prompt manager, the name-keyed prompt-metadata registry (promptInfos), and every behavior that registers, serves, and manages prompts — the static/workflow/database registration path, the per-viewer dynamic-serving path behind the prompts/list visibility middleware, and the manage_prompt tool.

Package provenance answers, at the moment an asset is written, which calls produced it.

Package reflexivecapture wires reflexive knowledge activation (#635) into the platform: it observes Trino query errors and mints a "misconception + fix" correction memory when a later related query succeeds in the same session.

Package resourceaudit records what happens to a managed resource as audit events: reads of its content, which also stamp the durable last-read time on the resource row, and the move that refiles it in another library.

Package resourceindex is the managed-resource consumer of the shared indexjobs framework (#1012).

Package resourcelayer assembles the managed-resources layer behind one Handle: the Postgres-backed resource store for human-uploaded reference material, the S3 blob client that holds the file bytes, and the MCP-server registration that makes each resource visible in the SDK's native resources/list.

Package resourcewrite lets something other than a browser write a managed resource (#1487).

Package reviewalert pushes an operator alert when a review queue crosses its staleness threshold (#803, extended to managed scripts by #1287).

Package routepolicy builds the api-gateway's per-route authorization policy: it resolves a caller's roles and checks a (connection, method, path) tuple against the persona authorizer's APIRoutes rules.

Package scriptdraft executes a managed script's draft under the identity of the person asking for it.

Package scriptexec executes managed scripts: the run worker that claims due runs off the queue, the per-run script principal it executes them under, and the writer that turns a script's output into a portal asset.

Package scriptindex is the managed-script consumer of the shared indexjobs framework (#1370).

Package scriptlayer is the MCP surface of the managed-script feature: the manage_script tool and everything it needs to resolve, authorize, edit, validate, and dry-run a script.

Package scriptrun is the managed-script execution engine: an embedded Starlark interpreter, the curated host stdlib scripts are allowed to call, and the static validator the authoring loop answers with.

Package scriptstore is the PostgreSQL implementation of the managed-script store contract (pkg/script).

Package searchfed assembles the universal, topology-free search federation behind one Handle: the knowledge.Router that federates every searchable source a caller can access, and the search toolkit that exposes it as the one discovery entry point (#645).

Package sessionsync assembles the session / cross-replica-sync layer behind one Handle: the externalized session store (memory or postgres), the per-session enrichment-dedup cache, the client-facing MCP notification broadcaster, and the dedicated cross-replica reload bus (its own broadcaster channel plus the publish/subscribe machinery).

Package sessionview is the read model for a platform session: the thing an operator lists, opens, and reads after the fact.

Package tableregister makes a file already in object storage readable as a table, without copying it and without giving anything a write tool.

Package toolargs owns the platform-facade seam for the arguments the PLATFORM puts on a tool rather than the toolkit: the session handle (#792) and the call's purpose (#1317).

Package toolkitcfg resolves typed per-toolkit connection configuration out of the platform's raw toolkits config (map[string]any decoded from YAML/JSON).

Package toolratelimit wires the per-user tool-call rate limiter (#929) into the platform: an MCP receiving middleware that refuses authenticated tools/call requests exceeding a generous per-identity token-bucket limit before they reach the handler, audit pipeline, or upstream.

Package userdir assembles the known-users directory (#614) behind one Handle: the Postgres-backed user store and the *user.Directory that wraps it with throttled, asynchronous upserts of authenticated people.

Package utilconn seeds the built-in "util" API-gateway connection (issue #1005): a handler=internal connection whose operations are served in-process (internal/platform/utilhandler) and discovered through the same catalog path as any other api connection.

Package utilhandler implements the built-in "util" connection's in-process operations (issue #1005).