Module render 

Tera template rendering for *.tera files.

Output goes to the same directory as the source .tera file (e.g. home/.gitconfig.tera → home/.gitconfig). When manage_gitignore is true, the rendered files are listed in a # >>> yui rendered ... <<< managed section of .gitignore so they aren’t committed.

Conditional render (both honored, AND’d together when both present):

• file-header: {# yui:when EXPR #} as the first Tera comment in the .tera file. Tera comments are stripped from output, so the header never bleeds into the rendered file.
• config rule: [[render.rule]] match = "<glob>", when = "<expr>" — the glob is matched against the path relative to the source root.

Drift policy: if the rendered file already exists with content that diverges from what the template would produce now, we DO NOT overwrite it as a side effect of rendering. Each divergence is recorded as a DivergedEntry (with both paths, the fresh body, and best-effort mtimes) so callers can resolve it however they want — apply walks the list and prompts the user per entry, render --check bails as the CI gate.

Structs

DivergedEntry

A render-drift case: the on-disk rendered file’s content differs from what the template would produce now. Carries the template path, the rendered path, the fresh output (so callers can apply it without re-rendering), and best-effort mtimes that the apply prompt uses to pick a sensible default choice.

RenderReport

Functions

add_to_managed_section

Additively merge plaintext_abs_path into yui’s managed .gitignore section, preserving every other entry already there. Used by yui secret encrypt to close the window where a freshly written plaintext sibling would be visible to git add until the next apply rewrites the full managed block (issue #71).

render_all

render_to_string

Render a single template and return the body it would produce right now, or Ok(None) if {# yui:when … #} / a config rule when would skip it for the current host. Used by yui diff to compute what the rendered file should contain so the drift can be diffed against what’s actually on disk.

report_managed_paths

Every *.tera output path the report knows about — written / unchanged / diverged. The apply orchestrator unions this with the secret pipeline’s plaintext outputs to drive a single write_managed_section call (rather than render writing one list of paths and secrets immediately overwriting it with a different one). PR #57 review.

write_managed_section

Write or replace yui’s managed .gitignore section in the repo root, listing every absolute path the apply pipeline produced as a sibling-without-suffix (rendered .tera outputs AND decrypted .age outputs share this section). The block is delimited by # >>> yui rendered (auto-managed) >>> / # <<< yui rendered (auto-managed) <<< so successive runs idempotently rewrite it without disturbing user content above or below.