These are the reusable library components that power gtb applications, modular, testable and strictly typed.
Read the Package column carefully: it names two different kinds of thing.
pkg/…: a package in this repository, versioned with GTB and covered by its
API stability policy.
go/…: a standalone module with its own repository, release cadence and
documentation microsite. GTB consumes it like any other dependency and is not the
authority on its API; the pages here describe how GTB wires it, and each links out
to the module for the API itself.
Many components began life in pkg/ and were later extracted. The
migration guides record what moved and when.
GTB's use of the extracted feature core: declaration at init into a registry, an immutable snapshot, a resolved set on the root, and the evaluator seam for dynamic flags.
Structured CLI output (text/JSON/YAML/CSV/TSV/Markdown), tables, spinners, progress and the JSON envelope behind one Renderer façade. GTB consumes it directly across its built-in commands via the opt-in go/output/cobra subpackage; there is no GTB-side adapter.
Framework-free Conventional-Commits changelog generation (via go-git) and parsing, now a standalone module; GTB wires it into the changelog command, the generator tool, and self-update.
Framework-free project-root detection: a marker-file walk over an injected afero.Fs. GTB's generator commands (regenerate, generate, remove) use it to resolve the project root when run from a subdirectory.
Storage-mode taxonomy for user-supplied secrets (API keys, VCS tokens), shared by the setup wizard, config masking, doctor checks, and runtime resolvers.
The single validated entry point for opening URLs: enforces a scheme allowlist, URL-length bound, and control-character rejection before invoking the OS handler.
These packages were extracted into the standalone, independently-versioned signing module (v0.1.0); go-tool-base now consumes them as dependencies. The sign and keys command builders were likewise extracted into go/signing-cli, so go-tool-base and the standalone sigillum CLI share one command surface. The gtb CLI behaviour is unchanged, only the Go import paths moved.
Backend registry letting gtb keys mint and downstream tools target arbitrary HSM/KMS/keyring back-ends through a single CLI-agnostic Backend interface.
The shareable sign / keys Cobra command builders, props-decoupled behind a narrow Logger seam so both go-tool-base (which re-attaches them, unchanged) and the standalone sigillum CLI compose them without a module cycle. Backends are registered by the host binary.
Opt-in credential verification (API-key, JWT/OIDC, mTLS) and a minimal authorization seam. go/transport/http and go/transport/grpc wrap its verifiers as AuthMiddleware/AuthInterceptor; GTB does not wire this itself.
Serve an OpenAPI spec and an embedded Stoplight Elements docs site from one Register call: a standalone companion module to go/transport. GTB itself does not consume this; it is a downstream-facing feature for tools built on GTB.