internal/

Package catalog is bumper's embedded advisory corpus: ~2,600 security best-practice records harvested from four Apache-2.0 sources (Trivy/tfsec, Checkov, KICS, Prowler), normalized to a common envelope.

Package deps implements bumper's dependency guardrail: it parses lockfiles entirely locally and talks to the hosted Advisor (advisor.bumper.sh) over REST.

Package engine evaluates a compiled rule set against normalized plan changes and returns ranked findings.

Package enrich translates deterministic findings into plain English by shelling out to a locally-installed, already-authenticated AI CLI (claude, gemini, ...).

Package plan normalizes `terraform show -json` output into a shape that is convenient for rule evaluation.

Package report renders engine findings as text or JSON.

Package rules loads bumper's declarative rule set.

Package safety implements bumper's enforcement layer: verifying a saved Terraform plan (binding a passing scan to the exact plan file by sha256) and guarding `terraform apply`/`destroy` as a Claude Code PreToolUse hook, so an agent cannot apply a plan nobody verified.

Package search is bumper's unified, cross-corpus rule search.

Package setup implements `bumper init`: wiring bumper into a coding agent (Claude Code or Augment).

Package skills serves bumper's agent skills — playbooks that teach a coding agent to drive bumper's plan gate, dependency guardrail, and Advisor.

Package style is bumper's plain-output color palette — the terminal counterpart of the web app's <Terminal> components.

Package tui is bumper's optional interactive terminal UI — the "hazard console".