These are the reusable library components that power gtb applications — modular, testable and strictly typed.
Read the Package column carefully: it names two different kinds of thing.
pkg/… — a package in this repository, versioned with GTB and covered by its
API stability policy.
go/… — a standalone module with its own repository, release cadence and
documentation microsite. GTB consumes it like any other dependency and is not the
authority on its API; the pages here describe how GTB wires it, and each links out
to the module for the API itself.
Many components began life in pkg/ and were later extracted. The
migration guides record what moved and when.
Structured CLI output (text/JSON/YAML/CSV/TSV/Markdown), tables, spinners, progress and the JSON envelope behind one Renderer façade — now a standalone module; GTB wires it in via the opt-in go/output/cobra subpackage.
Framework-free Conventional-Commits changelog generation (via go-git) and parsing, now a standalone module; GTB wires it into the changelog command, the generator tool, and self-update.
Storage-mode taxonomy for user-supplied secrets (API keys, VCS tokens), shared by the setup wizard, config masking, doctor checks, and runtime resolvers.
The single validated entry point for opening URLs — enforces a scheme allowlist, URL-length bound, and control-character rejection before invoking the OS handler.
These packages were extracted into the standalone, independently-versioned signing module (v0.1.0); go-tool-base now consumes them as dependencies. The sign and keys command builders were likewise extracted into go/signing-cli, so go-tool-base and the standalone sigillum CLI share one command surface. The gtb CLI behaviour is unchanged — only the Go import paths moved.
Backend registry letting gtb keys mint and downstream tools target arbitrary HSM/KMS/keyring back-ends through a single CLI-agnostic Backend interface.
The shareable sign / keys Cobra command builders, props-decoupled behind a narrow Logger seam so both go-tool-base (which re-attaches them, unchanged) and the standalone sigillum CLI compose them without a module cycle. Backends are registered by the host binary.