internal/

Package ansi strips ANSI terminal escape sequences from captured command output, for the surfaces that cannot render them (the outcome-classification regex and the GitHub check-run markdown).

Package approval defines the approval-gate backend abstraction.

Package claims is the pure event-sourced domain core for the apply-lock claim ledger.

Package classify applies an ordered list of rules to a parsed stack and returns the set of matching categories.

Package codes is the closed registry of stable, machine-readable problem codes.

Package config loads and validates the HCL policy file (.tfstackplan.hcl), resolving classification presets+rules into a single ordered rule list while preserving source declaration order.

Package differ turns a single attribute's before/after values into an ordered list of render variants (preferred → minimal).

Package domain holds the canonical value types shared across the render pipeline, the runner→server wire protocol, and persistence.

Package events defines the typed, versioned protocol the CI runner speaks to the server: the lifecycle of a multi-stack Terraform execution (init → phase → per-stack updates → finalize) plus the apply-time gate exchange.

Package eventsourcing is a generic, domain-agnostic decider host over store.EventStore: Load (snapshot + replay-tail via Evolve) and Append (encode + optimistic append + snapshot), parameterized per aggregate by a Decider value.

Package fit deterministically reduces a model.Report so its rendered size fits a byte budget, degrading the largest attribute diffs first, then falling back through a report-level terminal cascade.

Package jwtutil provides minimal HS256 JWT creation and validation for internal auth (API bearer tokens and view-link tokens).

Package links resolves URL templates with {placeholder} substitution.

Package model holds the shared, budget-agnostic intermediate types that flow through the gather → fit → render pipeline.

Package plan parses a Terraform plan JSON document into a RawStack: reduced action counts plus the set of affected attributes for each change action.

Package plandir discovers per-stack Terraform plan JSON files under a single directory.

Package presets provides built-in named classification rule bundles that a repo can opt into without hand-writing regexes.

Package reconcile is the pure functional core for the server's gate/grant and execution-lifecycle state.

Package render turns a (possibly fit-reduced) model.Report into the final markdown document.

Package runner is the CI-side driver: it invokes the same terramate scripts a human runs, captures per-stack output, renders + classifies in-process, and reports progress to the control-plane server over the typed events protocol.

Package server is the control-plane HTTP service: it records multi-stack Terraform executions, drives one GitHub check run per environment, and projects approval-gate state — all as a pure function of its SQLite store.

Package source indexes a stack's Terraform source so a plan resource can be linked to the file:line where it is declared.

Package statemove validates declared Terraform resource moves against plan data and generates/maintains the native `moved {}` shim files that effect them (SP1: within one stack).

Package statemoves loads the optional --state-moves manifest: per stack, the addresses being moved IN by an external cross-state move (infra's state-mover).

Package store is the server's SQLite persistence layer: executions, their stack/edge subgraph, and per-(class,target) approval gate state.