internal/

Package settingsapi serves the /api/v1/admin/settings/smtp surface: the stored SMTP configuration (#631), the send-test action, and the test recipient's notification opt-out status (#1022).

Package accessgate refuses portal requests from callers whose roles map to no persona.

Package attachhttp exposes prompt resource attachments (#1013) over REST for both operator surfaces: the portal (a prompt author manages the materials on their own prompts) and the admin API (any prompt).

Package datahubapi serves the portal's DataHub Catalog and Context Docs REST surface (#718): browse/search/read over DataHub connections plus catalog metadata edits and context-document CRUD, gated per-persona.

Package gatewayhttp exposes the apigateway toolkit's invoke operation over plain REST so non-MCP HTTP clients (e.g.

Package health provides readiness state tracking and HTTP health check handlers.

Package httpauth is the HTTP-level authentication gate for the MCP transports: it extracts a bearer token or API key from the request, authenticates it, and refuses an unauthenticated caller with the challenge the transport expects before any MCP framing is parsed.

Package mentionhttp serves the people surfaces of the portal API: the known-users directory behind the share picker (#614), the audience-scoped candidate list behind the @-mention picker, and the caller's mentions inbox (#627).

Package sources provides concrete enrichment Source adapters for the platform's built-in toolkits (Trino, DataHub).

Package versionhttp exposes prompt version history, draft review actions, audit-derived usage stats (#1009), and prompt collection management (#1010) over REST.

Package assetindex is the saved-asset consumer of the shared indexjobs framework (#550).

Package branding owns the resolved-once brand assets behind one Handle: the brand logo SVG, the brand URL, and the implementor logo SVG.

Package browserauth builds the browser-facing authentication stack for the portal and admin web UI: the OIDC login/callback flow and the cookie authenticator, held together behind one Session handle.

Package cfgmap holds typed accessors for reading values out of the map[string]any config blobs the platform loads from YAML/JSON.

Package collectionindex is the curated-collection consumer of the shared indexjobs framework (#550).

Package completionlayer implements the MCP completion/complete handler for the platform: argument autocompletion for prompt arguments and resource-template variables.

Package connauth assembles the connection-OAuth token lifecycle behind one Handle: the unified connection_oauth_tokens store (pkg/connoauth), the durable connection_auth_events store together with its nil-safe writer and daily 90-day prune routine (pkg/authevents), and the background token-refresh loop.

Package connbackfill seeds connection_instances with a credential-free row for every file-configured connection, so knowledge-page references of the form mcp:connection:(kind,name) — which FK to connection_instances — resolve for connections defined only in platform.yaml.

Package connscope answers, for discovery surfaces, the question the authorizer answers for tool calls: may this caller's persona reach this connection?

Package connsource maps connections to their DataHub URN components (platform name and catalog mapping), with forward and reverse lookups.

Package dedup holds the session-level metadata deduplication config, split out of pkg/platform to keep that package under its size budget (#594).

Package exportadapters adapts the platform's portal stores to the export interfaces consumed by the trino and api-gateway toolkits.

Package iam builds the platform's authentication and authorization identity layer: the authenticator chain (NewIdentity) and the persona authorizer (NewAuthorizer).

Package indexqueue assembles the shared background embedding queue (pkg/indexjobs) behind one Handle: the Postgres store, the Source/Sink registry, the worker/reaper/reconciler, the optional retention sweep and LISTEN/NOTIFY adapter, and every enabled consumer (api-catalog, tools, memory, prompts, portal assets/collections/knowledge-pages, managed resources).

Package knowledgelayer assembles the knowledge-capture layer behind one Handle: the insight store (the memory-backed adapter over memory_records when a memory store is present, else the legacy Postgres store), the changeset store and DataHub writer that back apply_knowledge, and the capture_insight / apply_knowledge toolkit itself.

Package knowledgepageindex is the knowledge-page consumer of the shared indexjobs framework (#633).

Package listchanged provides a debounced, broadcaster-backed notifier that publishes a single MCP "*/list_changed" notification for a runtime-mutable entity set (prompts, managed resources) to every connected SSE long-poll subscriber, cross-replica via the session broadcaster's LISTEN/NOTIFY channel.

Package mcpapps provides MCP Apps support for interactive UI components.

Package memoryindex is the memory consumer of the shared indexjobs framework (#507).

Package memorylayer assembles the memory layer behind one Handle: the Postgres-backed memory store, the embedding provider that powers vector search, the memory_manage / memory_capture toolkit (with its recall-first checker), the memory↔enrichment middleware adapter, and the background staleness watcher.

Package mwchain validates an ordered middleware chain against declared ordering dependencies.

Package notifydelivery assembles the email-notification substrate (pkg/notification) into one startable handle: the settings, preference, and queue stores, the trigger-side enqueuer, and the send worker with its LISTEN/NOTIFY wakeup adapter.

Package oauthserver assembles the OAuth 2.1 authorization server and its storage behind one Handle: storage selection (Postgres when a database is present, else in-memory), bcrypt-hashed pre-registration of configured clients, the server itself, its authorization-state cleanup, and metrics wiring.

Package obs owns the platform's observability layer: the metrics recorder, its /metrics HTTP listener, and the (independently-gated) OTel tracer.

Package portalstore assembles the asset-portal store layer behind one Handle: the five Postgres stores (asset, share, version, collection, thread), the knowledge-page store, the S3 blob backend, and the save/manage-asset toolkit built on top of them.

Package promptindex is the prompt-library consumer of the shared indexjobs framework (#557, epic #525 phase 4).

Package promptlayer assembles the prompt subsystem behind one Handle: the Postgres-backed prompt store, the file-based tuning prompt manager, the name-keyed prompt-metadata registry (promptInfos), and every behavior that registers, serves, and manages prompts — the static/workflow/database registration path, the per-viewer dynamic-serving path behind the prompts/list visibility middleware, and the manage_prompt tool.

Package reflexivecapture wires reflexive knowledge activation (#635) into the platform: it observes Trino query errors and mints a "misconception + fix" correction memory when a later related query succeeds in the same session.

Package resourceaudit records reads of managed-resource content as audit events and stamps the durable last-read time on the resource row.

Package resourceindex is the managed-resource consumer of the shared indexjobs framework (#1012).

Package resourcelayer assembles the managed-resources layer behind one Handle: the Postgres-backed resource store for human-uploaded reference material, the S3 blob client that holds the file bytes, and the MCP-server registration that makes each resource visible in the SDK's native resources/list.

Package routepolicy builds the api-gateway's per-route authorization policy: it resolves a caller's roles and checks a (connection, method, path) tuple against the persona authorizer's APIRoutes rules.

Package searchfed assembles the universal, topology-free search federation behind one Handle: the knowledge.Router that federates every searchable source a caller can access, and the search toolkit that exposes it as the one discovery entry point (#645).

Package sessionsync assembles the session / cross-replica-sync layer behind one Handle: the externalized session store (memory or postgres), the per-session enrichment-dedup cache, the client-facing MCP notification broadcaster, and the dedicated cross-replica reload bus (its own broadcaster channel plus the publish/subscribe machinery).

Package toolkitcfg resolves typed per-toolkit connection configuration out of the platform's raw toolkits config (map[string]any decoded from YAML/JSON).

Package toolratelimit wires the per-user tool-call rate limiter (#929) into the platform: an MCP receiving middleware that refuses authenticated tools/call requests exceeding a generous per-identity token-bucket limit before they reach the handler, audit pipeline, or upstream.

Package userdir assembles the known-users directory (#614) behind one Handle: the Postgres-backed user store and the *user.Directory that wraps it with throttled, asynchronous upserts of authenticated people.

Package utilconn seeds the built-in "util" API-gateway connection (issue #1005): a handler=internal connection whose operations are served in-process (internal/platform/utilhandler) and discovered through the same catalog path as any other api connection.

Package utilhandler implements the built-in "util" connection's in-process operations (issue #1005).

Package publicviewer holds the embedded assets of the portal's public share pages: the two HTML templates, their Content-Security-Policy, and the default brand mark.

Package sharecache decides how a response served behind a portal share token may be cached.

Package viewerlimit rate-limits the portal's public share viewer.