internal/

Package detection evaluates versioned, declarative detection rules.

Package googleworkspacedirectorysync pulls the Google Workspace user directory and upserts it into saas_identities.

Package googleworkspaceoauthsync pulls Google Workspace per-user OAuth grants and upserts them into security_assets (type=OAUTH_APP, labels including 'shadow-it') and oauth_app_grants.

Package googleworkspacepoller pulls Google Workspace audit activities from the Google Admin Reports API and enqueues them into ingestion_jobs so the existing rule evaluators (internal/ingestionworker) can produce findings.

Package observability owns the small durable receipts used by operators to distinguish a healthy empty sweep from a worker that never reached a terminal state.