render

type DepResult struct {
	Name        string
	OutDir      string
	Manifests   []File
	Secrets     []File
	PackageRoot string // where the dep's source tree was materialized
}

type DepsOptions struct {
	// Lock is the resolved dependency tree, typically read from
	// <work-dir>/out/spec/lock.yaml.
	Lock *api.Lock

	// ParentInputs carries the parent's namespace. Used as the default
	// namespace for dependencies whose lock entry does not provide one.
	ParentInputs *api.Inputs

	// WorkDir is the parent's working directory. Vendor cache lives at
	// <WorkDir>/out/vendor/<name>@<version>/, dep render outputs go to
	// <WorkDir>/out/<dep-name>/.
	WorkDir string

	// Fetcher resolves a locked dep's ref+digest to a local package root.
	// If nil, DefaultFetcher is used.
	Fetcher Fetcher

	// TransformerBinary is propagated to each per-dep Render call. Defaults
	// to os.Executable() inside Render when empty.
	TransformerBinary string
}

type Fetcher func(ctx context.Context, ref, digest, destDir string) (string, error)

type File struct {
	// Filename is the recommended filename within out/manifests/ (or
	// out/secrets/ when Sensitive).
	Filename string
	// Slug is the recommended ConfigHub Unit slug for upload.
	Slug string
	// Body is the YAML body of the resource.
	Body []byte
	// Kind / Name / Namespace / APIVersion are sniffed from the doc, used
	// for the manifest index.
	APIVersion string
	Kind       string
	Name       string
	Namespace  string
	// Sensitive marks resources that must never be uploaded as Units.
	// Currently set for any v1/Secret. Routed to out/secrets/ instead of
	// out/manifests/ and skipped by `installer upload`.
	Sensitive bool
}

type Options struct {
	Loaded    *ipkg.Loaded
	Selection *api.Selection
	Inputs    *api.Inputs
	// Facts is the parsed facts.yaml. Nil when the package has no collector
	// or the wizard has not been re-run after one was added.
	Facts *api.Facts
	// TransformerBinary is the absolute path baked into the
	// out/compose/installer-transformer wrapper script. Defaults to
	// os.Executable() — the binary currently running Render. Tests inject a
	// freshly-built installer binary so the go test binary (which doesn't
	// implement the `transformer` subcommand) isn't invoked by kustomize.
	TransformerBinary string
}

type Result struct {
	// OutDir is the directory written to (out/manifests + out/secrets + out/spec
	// + out/compose underneath).
	OutDir string
	// Manifests is the per-resource non-sensitive output, ordered by Slug.
	Manifests []File
	// Secrets is the per-resource sensitive output (Kubernetes Secrets),
	// written to out/secrets/ and never uploaded as Units.
	Secrets []File
	// Chain is the resolved FunctionChain that was executed (also persisted
	// to spec/ and to compose/chain.yaml).
	Chain *api.FunctionChain
}