Module render 

Tera template rendering for *.tera files.

Output goes to the same directory as the source .tera file (e.g. home/.gitconfig.tera → home/.gitconfig). When manage_gitignore is true, the rendered files are listed in a # >>> yui rendered ... <<< managed section of .gitignore so they aren’t committed.

Conditional render (both honored, AND’d together when both present):

• file-header: {# yui:when EXPR #} as the first Tera comment in the .tera file. Tera comments are stripped from output, so the header never bleeds into the rendered file.
• config rule: [[render.rule]] match = "<glob>", when = "<expr>" — the glob is matched against the path relative to the source root.

Drift policy: if the rendered file already exists with content that diverges from what the template would produce now, we DO NOT overwrite it. The user has likely edited the rendered file in place and needs to reflect that change back into the .tera first. The divergence is reported in RenderReport::diverged; --check treats it as fatal.

Structs

RenderReport

Functions

add_to_managed_section

Additively merge plaintext_abs_path into yui’s managed .gitignore section, preserving every other entry already there. Used by yui secret encrypt to close the window where a freshly written plaintext sibling would be visible to git add until the next apply rewrites the full managed block (issue #71).

render_all

render_to_string

Render a single template and return the body it would produce right now, or Ok(None) if {# yui:when … #} / a config rule when would skip it for the current host. Used by yui diff to compute what the rendered file should contain so the drift can be diffed against what’s actually on disk.

report_managed_paths

Every *.tera output path the report knows about — written / unchanged / diverged. The apply orchestrator unions this with the secret pipeline’s plaintext outputs to drive a single write_managed_section call (rather than render writing one list of paths and secrets immediately overwriting it with a different one). PR #57 review.

write_managed_section

Write or replace yui’s managed .gitignore section in the repo root, listing every absolute path the apply pipeline produced as a sibling-without-suffix (rendered .tera outputs AND decrypted .age outputs share this section). The block is delimited by # >>> yui rendered (auto-managed) >>> / # <<< yui rendered (auto-managed) <<< so successive runs idempotently rewrite it without disturbing user content above or below.