internal/

Package auditapi serves the /api/v1/admin/audit surface: the raw event list, its filter vocabulary and single-event lookup, and the aggregate metrics behind the admin dashboard.

Package catalogapi serves the /api/v1/admin/api-catalogs surface: the OpenAPI spec bundles that api-kind connections reference by catalog_id, and the per-spec embedding job visibility and retry endpoints.

Package connoauthapi serves the admin OAuth-to-upstream surface: starting an authorization-code flow for a connection, receiving the IdP redirect, reporting per-connection token health, and listing the durable auth-event history.

Package notifyapi serves the /api/v1/admin/notifications surface: the delivery history the notification queue leaves behind, and the per-status counts that give an admin an at-a-glance read on whether email is working.

Package settingsapi serves the /api/v1/admin/settings surface: the stored SMTP configuration (#631), the send-test action, the test recipient's notification opt-out status (#1022), and the knowledge review-queue alert threshold (#803).

Package accessgate refuses portal requests from callers whose roles map to no persona.

Package attachhttp exposes prompt resource attachments (#1013) over REST for both operator surfaces: the portal (a prompt author manages the materials on their own prompts) and the admin API (any prompt).

Package datahubapi serves the portal's DataHub Catalog and Context Docs REST surface (#718): browse/search/read over DataHub connections plus catalog metadata edits and context-document CRUD, gated per-persona.

Package gatewayhttp exposes the apigateway toolkit's invoke operation over plain REST so non-MCP HTTP clients (e.g.

Package health provides readiness state tracking and HTTP health check handlers.

Package httpauth is the HTTP-level authentication gate for the MCP transports: it extracts a bearer token or API key from the request, authenticates it, and refuses an unauthenticated caller with the challenge the transport expects before any MCP framing is parsed.

Package mentionhttp serves the people surfaces of the portal API: the known-users directory behind the share picker (#614), the audience-scoped candidate list behind the @-mention picker, and the caller's mentions inbox (#627).

Package notifyhttp serves the self-scoped notification-preference REST endpoints the portal settings page calls.

Package sources provides concrete enrichment Source adapters for the platform's built-in toolkits (Trino, DataHub).

Package unsubhttp serves the no-login unsubscribe endpoint linked from every notification email footer and named by the RFC 8058 List-Unsubscribe header.

Package versionhttp exposes prompt version history, draft review actions, audit-derived usage stats (#1009), and prompt collection management (#1010) over REST.

Package notifyprefs is the persistence layer for per-user notification preferences: the PostgreSQL implementation of notification.PrefsStore, backed by the user_notification_prefs table.

Package notifyqueue is the durable delivery queue: the PostgreSQL implementation of notification.QueueStore over the notifications table, and the LISTEN side of the pg_notify wakeup it fires on every enqueue.

Package notifyrender turns queued notifications into branded multipart emails.

Package notifysend is the transport layer of the notification substrate: it delivers an already-rendered email over SMTP using the admin-configured connection settings.

Package notifyworker drains the notification queue: it claims due rows under a lease, renders them, delivers them over SMTP, and resolves each batch to sent, retried, or failed.

Package assetindex is the saved-asset consumer of the shared indexjobs framework (#550).

Package branding owns the resolved-once brand assets behind one Handle: the brand logo SVG, the brand URL, and the implementor logo SVG.

Package browserauth builds the browser-facing authentication stack for the portal and admin web UI: the OIDC login/callback flow and the cookie authenticator, held together behind one Session handle.

Package cfgmap holds typed accessors for reading values out of the map[string]any config blobs the platform loads from YAML/JSON.

Package collectionindex is the curated-collection consumer of the shared indexjobs framework (#550).

Package completionlayer implements the MCP completion/complete handler for the platform: argument autocompletion for prompt arguments and resource-template variables.

Package connauth assembles the connection-OAuth token lifecycle behind one Handle: the unified connection_oauth_tokens store (pkg/connoauth), the durable connection_auth_events store together with its nil-safe writer and daily 90-day prune routine (pkg/authevents), and the background token-refresh loop.

Package connbackfill seeds connection_instances with a credential-free row for every file-configured connection, so knowledge-page references of the form mcp:connection:(kind,name) — which FK to connection_instances — resolve for connections defined only in platform.yaml.

Package connscope answers, for discovery surfaces, the question the authorizer answers for tool calls: may this caller's persona reach this connection?

Package connsource maps connections to their DataHub URN components (platform name and catalog mapping), with forward and reverse lookups.

Package datasetindex is the catalog-dataset consumer of the shared indexjobs framework (#1131).

Package dedup holds the session-level metadata deduplication config, split out of pkg/platform to keep that package under its size budget (#594).

Package exportadapters adapts the platform's portal stores to the export interfaces consumed by the trino and api-gateway toolkits.

Package iam builds the platform's authentication and authorization identity layer: the authenticator chain (NewIdentity) and the persona authorizer (NewAuthorizer).

Package indexqueue assembles the shared background embedding queue (pkg/indexjobs) behind one Handle: the Postgres store, the Source/Sink registry, the worker/reaper/reconciler, the optional retention sweep and LISTEN/NOTIFY adapter, and every enabled consumer (api-catalog, tools, memory, prompts, portal assets/collections/knowledge-pages, managed resources, catalog datasets).

Package knowledgelayer assembles the knowledge-capture layer behind one Handle: the insight store (the memory-backed adapter over memory_records when a memory store is present, else the legacy Postgres store), the changeset store and DataHub writer that back apply_knowledge, and the capture_insight / apply_knowledge toolkit itself.

Package knowledgepageindex is the knowledge-page consumer of the shared indexjobs framework (#633).

Package listchanged provides a debounced, broadcaster-backed notifier that publishes a single MCP "*/list_changed" notification for a runtime-mutable entity set (prompts, managed resources) to every connected SSE long-poll subscriber, cross-replica via the session broadcaster's LISTEN/NOTIFY channel.

Package mcpapps provides MCP Apps support for interactive UI components.

Package memoryindex is the memory consumer of the shared indexjobs framework (#507).

Package memorylayer assembles the memory layer behind one Handle: the Postgres-backed memory store, the embedding provider that powers vector search, the memory_manage / memory_capture toolkit (with its recall-first checker), the memory↔enrichment middleware adapter, and the background staleness watcher.

Package mwchain validates an ordered middleware chain against declared ordering dependencies.

Package notifydelivery assembles the email-notification substrate into one startable handle: the settings, preference, and queue stores, the trigger-side enqueuer, the renderer and SMTP sender, and the send worker with its LISTEN/NOTIFY wakeup adapter.

Package oauthserver assembles the OAuth 2.1 authorization server and its storage behind one Handle: storage selection (Postgres when a database is present, else in-memory), bcrypt-hashed pre-registration of configured clients, the server itself, its authorization-state cleanup, and metrics wiring.

Package obs owns the platform's observability layer: the metrics recorder, its /metrics HTTP listener, and the (independently-gated) OTel tracer.

Package portalstore assembles the asset-portal store layer behind one Handle: the five Postgres stores (asset, share, version, collection, thread), the knowledge-page store, the S3 blob backend, and the save/manage-asset toolkit built on top of them.

Package promptindex is the prompt-library consumer of the shared indexjobs framework (#557, epic #525 phase 4).

Package promptlayer assembles the prompt subsystem behind one Handle: the Postgres-backed prompt store, the file-based tuning prompt manager, the name-keyed prompt-metadata registry (promptInfos), and every behavior that registers, serves, and manages prompts — the static/workflow/database registration path, the per-viewer dynamic-serving path behind the prompts/list visibility middleware, and the manage_prompt tool.

Package notifystore decorates the shared prompt store so every successful write fires the prompts/list_changed notifier and every scope-widening write clears the attachment guard.

Package reflexivecapture wires reflexive knowledge activation (#635) into the platform: it observes Trino query errors and mints a "misconception + fix" correction memory when a later related query succeeds in the same session.

Package resourceaudit records reads of managed-resource content as audit events and stamps the durable last-read time on the resource row.

Package resourceindex is the managed-resource consumer of the shared indexjobs framework (#1012).

Package resourcelayer assembles the managed-resources layer behind one Handle: the Postgres-backed resource store for human-uploaded reference material, the S3 blob client that holds the file bytes, and the MCP-server registration that makes each resource visible in the SDK's native resources/list.

Package reviewalert pushes an operator alert when the knowledge review queue crosses its staleness threshold (#803).

Package routepolicy builds the api-gateway's per-route authorization policy: it resolves a caller's roles and checks a (connection, method, path) tuple against the persona authorizer's APIRoutes rules.

Package searchfed assembles the universal, topology-free search federation behind one Handle: the knowledge.Router that federates every searchable source a caller can access, and the search toolkit that exposes it as the one discovery entry point (#645).

Package sessionsync assembles the session / cross-replica-sync layer behind one Handle: the externalized session store (memory or postgres), the per-session enrichment-dedup cache, the client-facing MCP notification broadcaster, and the dedicated cross-replica reload bus (its own broadcaster channel plus the publish/subscribe machinery).

Package toolkitcfg resolves typed per-toolkit connection configuration out of the platform's raw toolkits config (map[string]any decoded from YAML/JSON).

Package toolratelimit wires the per-user tool-call rate limiter (#929) into the platform: an MCP receiving middleware that refuses authenticated tools/call requests exceeding a generous per-identity token-bucket limit before they reach the handler, audit pipeline, or upstream.

Package userdir assembles the known-users directory (#614) behind one Handle: the Postgres-backed user store and the *user.Directory that wraps it with throttled, asynchronous upserts of authenticated people.

Package utilconn seeds the built-in "util" API-gateway connection (issue #1005): a handler=internal connection whose operations are served in-process (internal/platform/utilhandler) and discovered through the same catalog path as any other api connection.

Package utilhandler implements the built-in "util" connection's in-process operations (issue #1005).

Package access holds the portal's authorization core: one checker that answers every "may this user see or change this thing" question the portal asks, over assets, collections, prompts, knowledge pages and threads.

Package feedbackapi holds the portal's feedback surface: threads and their events, the activity feed, the practitioner and SME worklists, asset and collection sign-off, validation responses, and capturing a thread as an insight.

Package portaldomain holds the asset portal's domain vocabulary: the persisted entities (assets, versions, shares, collections), the identity a portal request carries, the store contracts over them, and the validation that guards every write door.

Package portalnoop holds the portal's no-database store implementations.

Package portalstore holds the portal's PostgreSQL stores: assets, shares and collections, together with the ranked-search queries over them.

Package portalversions holds the PostgreSQL store for asset version history.

Package publicviewer holds the embedded assets of the portal's public share pages: the two HTML templates, their Content-Security-Policy, and the default brand mark.

Package sharecache decides how a response served behind a portal share token may be cached.

Package viewerlimit rate-limits the portal's public share viewer.