Module preprocessing 

Preprocessing pipeline — transforms source files before handler dispatch.

Preprocessors expand files whose version-controlled source differs from the deployed artifact (templates, plists, encrypted secrets). The preprocessing phase runs before handler dispatch, producing virtual entries that downstream handlers (symlink, shell, path, install, homebrew) consume transparently.

See docs/proposals/preprocessing-pipeline.lex for the full design.

Re-exports

pub use pipeline::PreprocessMode;

Modules

age

age whole-file preprocessor — decrypts *.age files at deploy time.

baseline

Per-file baseline cache for the preprocessing pipeline.

conflict

Dodot conflict markers — used by reverse-merge to flag ambiguous edits.

divergence

Drift detection for preprocessor outputs (the 4-state matrix).

gpg

gpg whole-file preprocessor — decrypts *.gpg (and optionally *.asc) files at deploy time.

identity

Identity preprocessor — passes content through unchanged.

no_reverse

Per-file no_reverse opt-out for the template reverse-merge.

pipeline

Preprocessing pipeline — partitions, expands, and merges entries.

reverse_merge

Reverse-merge engine — propagates deployed-file edits back to the template source.

template

Template preprocessor — renders Jinja2-style templates via MiniJinja through burgertocow’s Tracker.

unarchive

Unarchive preprocessor — extracts tar.gz archives.

Structs

ExpandedFile

A single file produced by a preprocessor’s expansion.

PreprocessorRegistry

Registry of available preprocessors.

SecretLineRange

One entry in a per-render secrets sidecar — a span of lines whose content was produced by a secret(...) call, paired with the reference that produced it.

Enums

TransformType

The safety model for a preprocessor’s transformation.

Traits

Preprocessor

The core preprocessor abstraction.

Functions

build_secret_registry

Construct a crate::secret::SecretRegistry from the per-provider [secret.providers.*] config blocks. Each enabled provider is constructed with the shared CommandRunner (so tests can inject a mock runner) and registered. Returns None if no provider is enabled — the secrets layer treats that case as “secrets feature fully off” and templates with secret(...) calls fail loudly.

default_registry

The default registry used on the normal execution path.