Go Package Map

A quick-reference map of every Go package in api/internal/. For the architectural layering and how these fit together, see architecture; for Clean Architecture mapping see clean-architecture.

WitWiki is a modular monolith: the domain (wiki) defines interfaces; interface adapters (mcp, httpapi, auth, oauth) translate transports; frameworks & drivers (storage, blobstore, db, kms, email) implement the outer edges.

Domain & persistence

  • wiki — Core domain. Page{Path, Title, Content, Metadata, ...}, LogEntry, the WikiStore interface, Service (UpsertPage auto-extracts [[wikilinks]] and refreshes the link graph), versioning, lint, and ParseWikilinks. All business logic lives here.
  • storage — PostgresStore, the Postgres implementation of wiki.WikiStore (list/search via websearch_to_tsquery, prefix LIKE, transactional ReplaceLinks, Lint).
  • blobstore — S3Store + MemStore implementing BlobStore for encrypted wiki/source blobs.
  • db — pgx connection pool and the migration runner (schema_migrations, NNNN_*.sql).
  • embedding — Vector embeddings for pages (migration 0017), feeding vector search.
  • search — Hybrid search combining FTS (tsvector, migration 0018) and vector results.

Transports & adapters

  • mcp — MCP server over Streamable HTTP at /mcp; also fronts the per-org external-connector gateway. Thin adapter over wiki.Service.
  • httpapi — REST handlers under /api; thin adapter over wiki.Service. No business logic.
  • auth — Bearer-key middleware, JWT sessions, CORS, RBAC, and the RequireRole middleware.
  • oauth — WitWiki's own OAuth 2.0 Authorization Server: DCR, /authorize, token exchange, PKCE (migration 0009; tables oauth_clients, oauth_auth_codes).

Tenancy, identity & commerce

  • org — Multi-tenancy, RBAC roles, member invites (migration 0007), and cross-org project transfers (migration 0020).
  • user — User identity, sessions, password/MFA.
  • billing — Stripe subscriptions, PlanLimits, and quota enforcement (migrations 0021–0023).
  • activation — Activation milestones (a key's first agent call, a project's first edit) and the scan that turns them into outreach drafts for a human to approve.
  • outbound — Outbound email as a ledger: suppressions, exactly-once sends, one-click unsubscribe.
  • connectors — Read-only connector layer for Linear/Notion/Slack (migration 0025); credentials KMS-encrypted, tools namespaced per provider, surfaced via the per-org MCP gateway.

Cross-cutting

  • audit — Append-only, SHA-256 hash-chained audit trail (migration 0012); server-side events on org CRUD, billing, security, and MCP writes. Detects edited, deleted and reordered entries; truncation of the tail needs an external anchor.
  • kms — Per-org encryption keys (migration 0014); AWS KMS in prod, Vault locally.
  • email — Transactional email (invites, billing) behind a provider abstraction; SendGrid in prod, Mailpit locally — see email-service.
  • collab — Who has a page open and what just changed on it: presence and live page events over Postgres LISTEN/NOTIFY, so every API machine sees the same room.
  • metrics — The Prometheus exposition: requests and latency by route, MCP tool outcomes, the connection pool, the collab hub, the Go runtime.
  • ratelimit — Per-client-IP token bucket on the API surface.
  • openapi — The served OpenAPI document and the interactive docs page.
  • version — The build's semver, reported on /healthz.
  • admin — Admin/operational endpoints.
  • config — Loads runtime configuration from environment variables.

26 packages as of 2026-09-06. See also architecture · mcp-tools · index.