Directories
¶
| Path | Synopsis |
|---|---|
|
Package ansi strips ANSI terminal escape sequences from captured command output, for the surfaces that cannot render them (the outcome-classification regex and the GitHub check-run markdown).
|
Package ansi strips ANSI terminal escape sequences from captured command output, for the surfaces that cannot render them (the outcome-classification regex and the GitHub check-run markdown). |
|
Package api provides primitives to interact with the openapi HTTP API.
|
Package api provides primitives to interact with the openapi HTTP API. |
|
Package approval defines the approval-gate backend abstraction.
|
Package approval defines the approval-gate backend abstraction. |
|
gcppam
Package gcppam implements the approval.Backend over GCP Privileged Access Manager (PAM).
|
Package gcppam implements the approval.Backend over GCP Privileged Access Manager (PAM). |
|
Package claims is the pure event-sourced domain core for the apply-lock claim ledger.
|
Package claims is the pure event-sourced domain core for the apply-lock claim ledger. |
|
Package classify applies an ordered list of rules to a parsed stack and returns the set of matching categories.
|
Package classify applies an ordered list of rules to a parsed stack and returns the set of matching categories. |
|
Package codes is the closed registry of stable, machine-readable problem codes.
|
Package codes is the closed registry of stable, machine-readable problem codes. |
|
Package config loads and validates the HCL policy file (.tfstackplan.hcl), resolving classification presets+rules into a single ordered rule list while preserving source declaration order.
|
Package config loads and validates the HCL policy file (.tfstackplan.hcl), resolving classification presets+rules into a single ordered rule list while preserving source declaration order. |
|
Package differ turns a single attribute's before/after values into an ordered list of render variants (preferred → minimal).
|
Package differ turns a single attribute's before/after values into an ordered list of render variants (preferred → minimal). |
|
Package domain holds the canonical value types shared across the render pipeline, the runner→server wire protocol, and persistence.
|
Package domain holds the canonical value types shared across the render pipeline, the runner→server wire protocol, and persistence. |
|
Package events defines the typed, versioned protocol the CI runner speaks to the server: the lifecycle of a multi-stack Terraform execution (init → phase → per-stack updates → finalize) plus the apply-time gate exchange.
|
Package events defines the typed, versioned protocol the CI runner speaks to the server: the lifecycle of a multi-stack Terraform execution (init → phase → per-stack updates → finalize) plus the apply-time gate exchange. |
|
Package eventsourcing is a generic, domain-agnostic decider host over store.EventStore: Load (snapshot + replay-tail via Evolve) and Append (encode + optimistic append + snapshot), parameterized per aggregate by a Decider value.
|
Package eventsourcing is a generic, domain-agnostic decider host over store.EventStore: Load (snapshot + replay-tail via Evolve) and Append (encode + optimistic append + snapshot), parameterized per aggregate by a Decider value. |
|
Package execution is the pure event-sourced domain core for one execution's lifecycle (init → phase → per-stack ticks → terminal).
|
Package execution is the pure event-sourced domain core for one execution's lifecycle (init → phase → per-stack ticks → terminal). |
|
Package executor abstracts the CI muscle the control plane drives: serve receives the webhooks and asks a Backend to start/cancel/probe builds.
|
Package executor abstracts the CI muscle the control plane drives: serve receives the webhooks and asks a Backend to start/cancel/probe builds. |
|
Package fit deterministically reduces a model.Report so its rendered size fits a byte budget, degrading the largest attribute diffs first, then falling back through a report-level terminal cascade.
|
Package fit deterministically reduces a model.Report so its rendered size fits a byte budget, degrading the largest attribute diffs first, then falling back through a report-level terminal cascade. |
|
Package gauth obtains Google-signed OIDC ID tokens for authenticating to the tfstackplan control plane, replacing the shared-secret HS256 scheme.
|
Package gauth obtains Google-signed OIDC ID tokens for authenticating to the tfstackplan control plane, replacing the shared-secret HS256 scheme. |
|
gauthtest
Package gauthtest provides a fake Google OIDC issuer for offline tests of the gauth mint/verify paths — no network, no credentials, no test users.
|
Package gauthtest provides a fake Google OIDC issuer for offline tests of the gauth mint/verify paths — no network, no credentials, no test users. |
|
Package links resolves URL templates with {placeholder} substitution.
|
Package links resolves URL templates with {placeholder} substitution. |
|
Package model holds the shared, budget-agnostic intermediate types that flow through the gather → fit → render pipeline.
|
Package model holds the shared, budget-agnostic intermediate types that flow through the gather → fit → render pipeline. |
|
Package moveset loads the optional --state-moves manifest: per stack, the addresses being moved IN by an external cross-state move (infra's state-mover).
|
Package moveset loads the optional --state-moves manifest: per stack, the addresses being moved IN by an external cross-state move (infra's state-mover). |
|
Package plan parses a Terraform plan JSON document into a RawStack: reduced action counts plus the set of affected attributes for each change action.
|
Package plan parses a Terraform plan JSON document into a RawStack: reduced action counts plus the set of affected attributes for each change action. |
|
Package plandir discovers per-stack Terraform plan JSON files under a single directory.
|
Package plandir discovers per-stack Terraform plan JSON files under a single directory. |
|
Package reconcile is the pure functional core for the server's gate/grant and execution-lifecycle state.
|
Package reconcile is the pure functional core for the server's gate/grant and execution-lifecycle state. |
|
Package render turns a (possibly fit-reduced) model.Report into the final markdown document.
|
Package render turns a (possibly fit-reduced) model.Report into the final markdown document. |
|
Package runner is the CI-side driver: it invokes the same terramate scripts a human runs, captures per-stack output, renders + classifies in-process, and reports progress to the control-plane server over the typed events protocol.
|
Package runner is the CI-side driver: it invokes the same terramate scripts a human runs, captures per-stack output, renders + classifies in-process, and reports progress to the control-plane server over the typed events protocol. |
|
Package server is the control-plane HTTP service: it records multi-stack Terraform executions, drives one GitHub check run per environment, and projects approval-gate state — all as a pure function of its SQLite store.
|
Package server is the control-plane HTTP service: it records multi-stack Terraform executions, drives one GitHub check run per environment, and projects approval-gate state — all as a pure function of its SQLite store. |
|
Package source indexes a stack's Terraform source so a plan resource can be linked to the file:line where it is declared.
|
Package source indexes a stack's Terraform source so a plan resource can be linked to the file:line where it is declared. |
|
Package statemove validates declared Terraform resource moves against plan data and generates/maintains the native `moved {}` shim files that effect them (SP1: within one stack).
|
Package statemove validates declared Terraform resource moves against plan data and generates/maintains the native `moved {}` shim files that effect them (SP1: within one stack). |
|
Package store is the server's SQLite persistence layer: executions, their stack/edge subgraph, and per-(class,target) approval gate state.
|
Package store is the server's SQLite persistence layer: executions, their stack/edge subgraph, and per-(class,target) approval gate state. |
|
migrations
Package migrations embeds the goose SQL migrations for the server store.
|
Package migrations embeds the goose SQL migrations for the server store. |
|
Package ui is the central UI service: a single pane of glass over the tier serves.
|
Package ui is the central UI service: a single pane of glass over the tier serves. |
|
Package uiapi holds the generated OpenAPI artifacts for the central UI's backend API (api/ui.openapi.yaml): the std-http router and models.
|
Package uiapi holds the generated OpenAPI artifacts for the central UI's backend API (api/ui.openapi.yaml): the std-http router and models. |
|
Package uniqueness implements the per-environment value-duplication engine: flattening per-env input maps to dot-paths, classifying which leaves look like identifiers, detecting duplicates and cross-env token leakage, and evaluating both against reviewed `allow` exceptions.
|
Package uniqueness implements the per-environment value-duplication engine: flattening per-env input maps to dot-paths, classifying which leaves look like identifiers, detecting duplicates and cross-env token leakage, and evaluating both against reviewed `allow` exceptions. |
Click to show internal directories.
Click to hide internal directories.