### Example: Authorized rendering with sensitive inline environment values

Source: https://docs.rs/podman-lens/latest/podman_lens/render/fn.render_deployment_with_authorization.html

Complete example showing how to create a deployment plan with a sensitive inline environment value, render it without authorization (which is denied), and then render with authorization to produce a version 2 artifact that includes the protected value. The example also verifies that the Debug output remains redacted.

```rust
use podman_lens::{
    ContainerIntent, DeploymentEnvironmentValue, DeploymentIntent, DeploymentResource,
    DeploymentResourceId, EnvironmentAssignment, EnvironmentName, ExternalPrecondition,
    ObservedApiVersion, ObservedPodmanVersion, ResourceKind,
    SensitiveInlineEnvironmentValue, SensitiveInlineRenderAuthorization, TargetProfile,
    artifact::{deployment_v1, deployment_v2}, plan_deployment, render_deployment,
    render_deployment_with_authorization,
};

let target = TargetProfile::new(
    ObservedPodmanVersion::parse("6.1.0")?,
    ObservedApiVersion::parse("6.1.0")?,
)?;
let image = DeploymentResourceId::new(ResourceKind::Image, "registry.example.invalid/app:1")?;
let mut container = ContainerIntent::new(
    DeploymentResourceId::new(ResourceKind::Container, "application")?,
    image.clone(),
)?;
container.settings_mut().add_environment(EnvironmentAssignment::new(
    EnvironmentName::new("MODE")?,
    DeploymentEnvironmentValue::SensitiveInline(
        SensitiveInlineEnvironmentValue::new("protected-example-canary")?,
    ),
))?;
let mut intent = DeploymentIntent::new(target);
intent.add_resource(DeploymentResource::ExternalPrecondition(
    ExternalPrecondition::new(image)?,
));
intent.add_resource(DeploymentResource::Container(container));
let planned = plan_deployment(&intent);
let plan = planned.plan().expect("complete semantic plan");
let denied = render_deployment(plan);
assert_eq!(denied.findings()[0].field(), Some("environment.sensitive_inline"));
assert!(denied.rendering().is_none());

let authorized = render_deployment_with_authorization(
    plan,
    SensitiveInlineRenderAuthorization::new(),
);
let rendering = authorized.rendering().expect("authorized inert rendering");
assert!(serde_json::to_string(&deployment_v1::deployment(rendering)).is_err());
let artifact = deployment_v2::deployment(rendering);
assert!(artifact.contains_protected_inline_environment());
let artifact_bytes = serde_json::to_string(&artifact)?;
assert!(artifact_bytes.contains("protected-example-canary"));
assert!(!format!("{authorized:?}").contains("protected-example-canary"));
```

--------------------------------

### StartupDependency::predecessor

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.StartupDependency.html

Returns the container that must start first.

```APIDOC
## StartupDependency::predecessor

### Description
Returns the container that must start first.

### Method
`pub fn predecessor(&self) -> &DeploymentResourceId`

### Returns
`&DeploymentResourceId` - The predecessor container.
```

--------------------------------

### start_ip

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.NativeNetworkLeaseRange.html

Returns the optional inclusive lease-range start address or its observation state.

```APIDOC
## start_ip

### Description
Returns the optional inclusive lease-range start address or its observation state.

### Method
pub const fn start_ip(&self) -> &ObservationField<IpAddr>

### Parameters
- **self** (&Self) - The reference to the NativeNetworkLeaseRange instance.

### Returns
- **&ObservationField<IpAddr>** - A reference to the observation field containing the start IP address or its observation state.

```

--------------------------------

### Acquire inventory and discover resource graph with ReadOnlyUnixTransport

Source: https://docs.rs/podman-lens/latest/podman_lens/

Creates a read-only Unix transport for a caller-supplied socket, acquires an inventory with redacted options, and discovers a resource graph. The transport rejects every method except GET before opening the socket. The example uses a current-thread Tokio runtime and asserts that the graph has no requested roots.

```rust
use podman_lens::{
    AcquisitionOptions, DiscoveryRequest, ReadOnlyUnixTransport,
    ReadOnlyUnixTransportTimeouts, TransportLimits, UnixConnection, acquire_inventory,
    discover,
};

let transport = ReadOnlyUnixTransport::new(
    UnixConnection::new("/run/user/1000/podman/podman.sock")?,
    TransportLimits::default(),
    ReadOnlyUnixTransportTimeouts::default(),
)?;
let runtime = tokio::runtime::Builder::new_current_thread().enable_all().build()?;
let graph = runtime.block_on(async {
    let inventory = acquire_inventory(&transport, AcquisitionOptions::redacted()).await?;
    let mut request = DiscoveryRequest::new();
    request.select_all();
    discover(&inventory, &request)
})?;
assert!(graph.requested_roots().is_empty());
```

--------------------------------

### StartupDependency::dependent

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.StartupDependency.html

Returns the container that starts later.

```APIDOC
## StartupDependency::dependent

### Description
Returns the container that starts later.

### Method
`pub fn dependent(&self) -> &DeploymentResourceId`

### Returns
`&DeploymentResourceId` - The dependent container.
```

--------------------------------

### DeploymentIntent::startup_dependencies

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.DeploymentIntent.html

Returns explicit semantic start-order edges in caller-supplied order.

```APIDOC
## DeploymentIntent::startup_dependencies

### Description
Returns explicit semantic start-order edges in caller-supplied order.

### Method
`pub fn startup_dependencies(&self) -> &[StartupDependency]`

### Returns
- `&[StartupDependency]` - A slice of the startup dependencies.
```

--------------------------------

### NativeStartupHealthCheckObservation::command

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.NativeStartupHealthCheckObservation.html

Returns protected startup-command evidence or its field state.

```APIDOC
## NativeStartupHealthCheckObservation::command

### Description
Returns protected startup-command evidence or its field state.

### Method
`pub fn command(&self) -> &ObservationField<NativeHealthCommand>`

### Parameters
- `self` - Reference to the observation struct.

### Returns
- `&ObservationField<NativeHealthCommand>` - The startup-command evidence or its field state.

```

--------------------------------

### probe_libpod_service

Source: https://docs.rs/podman-lens/latest/podman_lens/probe/fn.probe_libpod_service.html

Performs the fixed, read-only Libpod version probe. Sends GET /libpod/_ping and GET /v4.0.0/libpod/version (or versioned Podman 3 endpoint) in order, without retries. Returns a ServiceObservation or a redacted diagnostic error.

```APIDOC
## Function probe_libpod_service

### Description
Performs the fixed, read-only Libpod version probe. The probe sends exactly these requests, in this order, and never retries:
1. `GET /libpod/_ping`
2. `GET /v4.0.0/libpod/version` for API 4+ or a versioned Podman 3 Libpod endpoint matching the service's advertised API version.

### Signature
```rust
pub async fn probe_libpod_service(
    transport: &dyn LibpodTransport,
) -> PodmanLensResult<ServiceObservation>
```

### Parameters
- **transport** (`&dyn LibpodTransport`) - The caller-provided transport used to acquire the responses.

### Returns
- **PodmanLensResult<ServiceObservation>** - A result containing a `ServiceObservation` on success, or a redacted diagnostic error when either response is malformed, outside reviewed compatibility evidence, or cannot be acquired by the transport.

### Errors
Returns a redacted diagnostic when either response is malformed, outside reviewed compatibility evidence, or cannot be acquired by the caller-provided transport.

### Requests Sent
1. `GET /libpod/_ping`
2. `GET /v4.0.0/libpod/version` (or versioned Podman 3 endpoint)

### Notes
- The probe is read-only and never retries.
- The exact versioned endpoint depends on the service's advertised API version.
```

--------------------------------

### DeploymentIntent::add_startup_dependency

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.DeploymentIntent.html

Adds one explicit semantic container-start ordering edge.

```APIDOC
## DeploymentIntent::add_startup_dependency

### Description
Adds one explicit semantic container-start ordering edge.

### Method
`pub fn add_startup_dependency(&mut self, dependency: StartupDependency)`

### Parameters
- `dependency` (StartupDependency) - Required - The startup dependency edge to add.
```

--------------------------------

### ConfiguredHealthCheck::set_start_period

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ConfiguredHealthCheck.html

Sets the start period for the health check once.

```APIDOC
## ConfiguredHealthCheck::set_start_period

### Description
Sets the start period for the health check once.

### Method
Setter

### Signature
pub fn set_start_period(&mut self, value: HealthStartPeriod) -> PodmanLensResult<()>

### Parameters
- **value** (HealthStartPeriod) - Required - The start period value to set.

### Returns
- **PodmanLensResult<()>** - Result indicating success or failure.
```

--------------------------------

### Plan and render a deployment offline with podman_lens

Source: https://docs.rs/podman-lens/latest/podman_lens/

Creates a TargetProfile for Podman 6.1.0, builds a DeploymentIntent with a single image resource, plans it, and renders the plan. Asserts the plan has one operation, the CLI program is 'podman', and the rendered deployment schema version is 1. Uses the deployment_v1 artifact module.

```rust
use podman_lens::{
    DeploymentIntent, DeploymentResource, DeploymentResourceId, ImageIntent, ImagePullPolicy,
    ImageSource, ObservedApiVersion, ObservedPodmanVersion, ResourceKind, TargetProfile,
    artifact::deployment_v1, plan_deployment, render_deployment,
};

let target = TargetProfile::new(
    ObservedPodmanVersion::parse("6.1.0")?,
    ObservedApiVersion::parse("6.1.0")?,
)?;
let image = DeploymentResourceId::new(ResourceKind::Image, "application-image")?;
let mut intent = DeploymentIntent::new(target);
intent.add_resource(DeploymentResource::Image(ImageIntent::new(
    image,
    ImageSource::new("registry.example.invalid/team/application:1")?,
    ImagePullPolicy::Missing,
)?));
let planned = plan_deployment(&intent);
let plan = planned.plan().expect("reviewed intent produces a complete plan");
let rendered = render_deployment(plan);
let rendering = rendered.rendering().expect("reviewed target renders exactly");
assert_eq!(plan.operations().len(), 1);
assert_eq!(rendering.operations()[0].cli().program(), "podman");
assert_eq!(deployment_v1::deployment(rendering).schema_version(), 1);
```

--------------------------------

### pub fn startup_health(&self) -> Option<&StartupHealthCheck>

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns startup health behavior.

```APIDOC
## startup_health

### Description
Returns startup health behavior.

### Method
startup_health

### Signature
pub fn startup_health(&self) -> Option<&StartupHealthCheck>

### Returns
Option<&StartupHealthCheck> - The startup health check if set, otherwise None.
```

--------------------------------

### ConfiguredHealthCheck::start_period

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ConfiguredHealthCheck.html

Returns the start period for the health check, if set.

```APIDOC
## ConfiguredHealthCheck::start_period

### Description
Returns the start period for the health check, if set.

### Method
Getter

### Signature
pub const fn start_period(&self) -> Option<HealthStartPeriod>

### Returns
- **Option<HealthStartPeriod>** - The start period value, or None if not set.
```

--------------------------------

### HealthStartPeriod::nanoseconds

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.HealthStartPeriod.html

Returns the value of the health start period in nanoseconds as an i64.

```APIDOC
## HealthStartPeriod::nanoseconds

### Description
Returns the duration of the health start period in nanoseconds.

### Method
`pub const fn nanoseconds(&self) -> i64`

### Parameters
- **self** - The `HealthStartPeriod` instance.

### Return Value
- **i64** - The duration in nanoseconds.

### Example
```rust
let ns = period.nanoseconds();
```
```

--------------------------------

### entrypoint

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.ContainerSettings.html

Returns the optional entrypoint.

```APIDOC
## entrypoint

### Description
Returns the optional entrypoint.

### Method
entrypoint

### Signature
pub fn entrypoint(&self) -> Option<&ArgumentArray>

### Returns
Option<&ArgumentArray> - The optional entrypoint.
```

--------------------------------

### BindMount::new

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.BindMount.html

Creates one normalized host-path bind mount with the given source, destination, and access mode.

```APIDOC
## BindMount::new

### Description
Creates one normalized host-path bind mount.

### Signature
```rust
pub const fn new(
    source: AbsoluteContainerPath,
    destination: AbsoluteContainerPath,
    access: MountAccess,
) -> Self
```

### Parameters
- **source** (AbsoluteContainerPath) - Required - The normalized absolute host source path.
- **destination** (AbsoluteContainerPath) - Required - The normalized container destination path.
- **access** (MountAccess) - Required - The declared access mode.

### Returns
- **Self** - A new BindMount instance.
```

--------------------------------

### NativeStartupHealthCheckObservation::start_period

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.NativeStartupHealthCheckObservation.html

Returns the effective native start period, including zero.

```APIDOC
## NativeStartupHealthCheckObservation::start_period

### Description
Returns the effective native start period, including zero.

### Method
`pub fn start_period(&self) -> &ObservationField<i64>`

### Parameters
- `self` - Reference to the observation struct.

### Returns
- `&ObservationField<i64>` - The effective native start period.

```

--------------------------------

### LinuxCapability::new

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.LinuxCapability.html

Creates an exact reviewed prefix-free capability name. Returns an error for CAP_-prefixed, unknown, or legacy spellings.

```APIDOC
## LinuxCapability::new

### Description
Creates an exact reviewed prefix-free capability name. Returns an error for `CAP_`-prefixed, unknown, or legacy spellings.

### Method
`pub fn new(value: &str) -> PodmanLensResult<Self>`

### Parameters
- `value` (&str) - Required - The capability name to create.

### Errors
Returns `PLN0034` for `CAP_`-prefixed, unknown, or legacy spellings.

### Returns
`PodmanLensResult<Self>` - A result containing the new `LinuxCapability` or an error.
```

--------------------------------

### pub fn namespaces(&self) -> &ContainerNamespaceSettings

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns namespace settings.

```APIDOC
## namespaces

### Description
Returns namespace settings.

### Method
namespaces

### Signature
pub fn namespaces(&self) -> &ContainerNamespaceSettings

### Returns
&ContainerNamespaceSettings - A reference to the namespace settings.
```

--------------------------------

### NetworkSubnet::range

Source: https://docs.rs/podman-lens/latest/podman_lens/networking/struct.NetworkSubnet.html

Returns the optional allocation range as a tuple of start and end addresses.

```APIDOC
## NetworkSubnet::range

### Description
Returns the optional allocation range.

### Method
`pub const fn range(&self) -> Option<(IpAddr, IpAddr)>`

### Returns
- **Option<(IpAddr, IpAddr)>** - The range as a tuple (start, end) if set, otherwise None.

```

--------------------------------

### acquire_inventory

Source: https://docs.rs/podman-lens/latest/podman_lens/inventory/fn.acquire_inventory.html

Probes and then acquires all supported native Podman resource kinds. The request sequence is deterministic: the fixed M1 probe precedes container, pod, network, volume, image, and secret lists; every successfully listed stable ID is then inspected in list order. Only bodyless GET requests are generated. Secret metadata inspection never requests a payload endpoint, and unexpected SecretData fields are discarded with PLN0018. A failed list makes only its section unavailable. A disappeared or malformed inspect response produces a partial record and does not hide unrelated observations. Returns the fixed probe diagnostic when no reviewed Libpod service can be observed. Individual list and inspect failures are retained in the returned inventory instead.

```APIDOC
## Function: acquire_inventory

### Description
Probes and then acquires all supported native Podman resource kinds. The request sequence is deterministic: the fixed M1 probe precedes container, pod, network, volume, image, and secret lists; every successfully listed stable ID is then inspected in list order. Only bodyless `GET` requests are generated. Secret metadata inspection never requests a payload endpoint, and unexpected `SecretData` fields are discarded with `PLN0018`.

### Signature
```rust
pub async fn acquire_inventory(
    transport: &dyn LibpodTransport,
    options: AcquisitionOptions,
) -> PodmanLensResult<ResourceInventory>
```

### Parameters
- **transport** (`&dyn LibpodTransport`) - The transport used to communicate with the Libpod service.
- **options** (`AcquisitionOptions`) - Options controlling the acquisition process.

### Returns
- **PodmanLensResult<ResourceInventory>** - A result containing the acquired resource inventory, or an error.

### Errors
Returns the fixed probe diagnostic when no reviewed Libpod service can be observed. Individual list and inspect failures are retained in the returned inventory instead.

### Behavior
- The request sequence is deterministic: the fixed M1 probe precedes container, pod, network, volume, image, and secret lists.
- Every successfully listed stable ID is then inspected in list order.
- Only bodyless `GET` requests are generated.
- Secret metadata inspection never requests a payload endpoint.
- Unexpected `SecretData` fields are discarded with `PLN0018`.
- A failed list makes only its section unavailable.
- A disappeared or malformed inspect response produces a partial record and does not hide unrelated observations.
```

--------------------------------

### DiscoveryRequest::select_all

Source: https://docs.rs/podman-lens/latest/podman_lens/discovery/struct.DiscoveryRequest.html

Selects every eligible application root in the inventory.

```APIDOC
## DiscoveryRequest::select_all

### Description
Selects every eligible application root in the inventory.

### Method
`pub fn select_all(&mut self)`

### Parameters
None.

### Returns
- `()` - No return value.

```

--------------------------------

### pub fn set_startup_health(&mut self, value: StartupHealthCheck) -> PodmanLensResult<()>

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Sets startup health behavior, rejecting duplicate or conflicting assignments.

```APIDOC
## set_startup_health

### Description
Sets startup health behavior, rejecting duplicate or conflicting assignments.

### Method
set_startup_health

### Signature
pub fn set_startup_health(&mut self, value: StartupHealthCheck) -> PodmanLensResult<()>

### Parameters
- **value** (StartupHealthCheck) - Required - The startup health check to set.

### Returns
PodmanLensResult<()> - Ok if the startup health check was set successfully, or an error if duplicate or conflicting assignments are detected.
```

--------------------------------

### plan_deployment

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/fn.plan_deployment.html

Validates explicit typed intent and returns its deterministic semantic deployment plan. The plan never contains a shell fragment, HTTP request, or Podman secret payload. It may retain typed caller-declared public and protected inline environment intent so rendering can make a separate output decision. Diagnostics, Debug, and observational snapshots stay redacted. render_deployment rejects protected inline and unresolved external environment values by default. Only render_deployment_with_authorization can include protected inline values in inert output after an explicit SensitiveInlineRenderAuthorization; external values remain unresolved and block a complete rendering. Every operation is ordered after its declared prerequisites. M6 renders supported operations as exact CLI arguments and Libpod API requests.

```APIDOC
## Function: plan_deployment

### Description
Validates explicit typed intent and returns its deterministic semantic deployment plan. The plan never contains a shell fragment, HTTP request, or Podman secret payload. It may retain typed caller-declared public and protected inline environment intent so rendering can make a separate output decision. Diagnostics, Debug, and observational snapshots stay redacted. `render_deployment` rejects protected inline and unresolved external environment values by default. Only `render_deployment_with_authorization` can include protected inline values in inert output after an explicit `SensitiveInlineRenderAuthorization`; external values remain unresolved and block a complete rendering. Every operation is ordered after its declared prerequisites. M6 renders supported operations as exact CLI arguments and Libpod API requests.

### Signature
```rust
pub fn plan_deployment(intent: &DeploymentIntent) -> PlanningOutcome
```

### Parameters
- **intent** (`&DeploymentIntent`) - The explicit typed deployment intent to validate and plan.

### Returns
- **PlanningOutcome** - The deterministic semantic deployment plan, including findings for invalid intent, duplicate or conflicting declarations, missing prerequisites, unsupported combinations, cycles, sensitive payloads, bad image or external-precondition declarations, pod membership, and same-pod start ordering (PLN0034–PLN0044).

### Findings
- **PLN0034–PLN0044** - Used for invalid intent, duplicate or conflicting declarations, missing prerequisites, unsupported combinations, cycles, sensitive payloads, bad image or external-precondition declarations, pod membership, and same-pod start ordering.
```

--------------------------------

### render_deployment

Source: https://docs.rs/podman-lens/latest/podman_lens/render/fn.render_deployment.html

Renders a validated semantic plan into non-executable CLI and Libpod descriptions. It requires the plan's engine and API versions to be semantically identical and listed in the renderer evidence.

```APIDOC
## Function render_deployment

### Description
Renders a validated semantic plan into non-executable CLI and Libpod descriptions. M6-A accepts only targets whose engine and API versions are semantically identical and exactly listed in its immutable renderer evidence. Existing M5 target validation permits a broader API relation; per-field wire evidence is required before that relation can be rendered.

### Signature
```rust
pub fn render_deployment(plan: &DeploymentPlan) -> RenderingOutcome
```

### Parameters
- **plan** (&DeploymentPlan) - Required - The validated semantic plan to render.

### Returns
- **RenderingOutcome** - The result of rendering the plan into CLI and Libpod descriptions.

### Constraints
- The plan's engine and API versions must be semantically identical and exactly listed in the renderer evidence.
- Per-field wire evidence is required for broader API relations.
```

--------------------------------

### ContainerObservation::entrypoint

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.ContainerObservation.html

Returns the configured entrypoint or its observation state.

```APIDOC
## ContainerObservation::entrypoint

### Description
Returns the configured entrypoint or its observation state.

### Method
entrypoint

### Signature
pub fn entrypoint(&self) -> &ObservationField<ConfiguredContainerEntrypoint>

### Parameters
None

### Returns
- **&ObservationField<ConfiguredContainerEntrypoint>** - The configured entrypoint or its observation state.
```

--------------------------------

### pub fn logging(&self) -> &LoggingSettings

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns logging settings.

```APIDOC
## logging

### Description
Returns logging settings.

### Method
logging

### Signature
pub fn logging(&self) -> &LoggingSettings

### Returns
&LoggingSettings - A reference to the logging settings.
```

--------------------------------

### DeploymentArtifact::from_rendering

Source: https://docs.rs/podman-lens/latest/podman_lens/artifact/deployment_v2/struct.DeploymentArtifact.html

Builds a v2 artifact from a complete inert rendering.

```APIDOC
## DeploymentArtifact::from_rendering

### Description
Builds a v2 artifact from a complete inert rendering.

### Method
Associated function

### Signature
pub fn from_rendering(source: &DeploymentRendering) -> Self

### Parameters
- **source** (&DeploymentRendering) - Required - The complete inert rendering to build the artifact from.

### Returns
- **Self** - A new DeploymentArtifact instance.
```

--------------------------------

### DeploymentArtifact::from_rendering

Source: https://docs.rs/podman-lens/latest/podman_lens/artifact/deployment_v1/struct.DeploymentArtifact.html

Builds a v1 artifact wrapper from a DeploymentRendering reference. Protected rendering bytes are not copied into the wrapper.

```APIDOC
## DeploymentArtifact::from_rendering

### Description
Builds a v1 artifact wrapper from a DeploymentRendering reference. Protected rendering bytes are not copied into the wrapper.

### Method
from_rendering

### Signature
pub fn from_rendering(source: &DeploymentRendering) -> Self

### Parameters
- **source** (&DeploymentRendering) - Required - The deployment rendering to wrap.

### Returns
- **Self** - A new DeploymentArtifact instance.

```

--------------------------------

### StartupHealthCheck::new

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.StartupHealthCheck.html

Creates a new StartupHealthCheck instance from a HealthCommand.

```APIDOC
## StartupHealthCheck::new

### Description
Creates startup health behavior from a command.

### Method
`pub const fn new(command: HealthCommand) -> Self`

### Parameters
- **command** (HealthCommand) - Required - The health command to use.

### Returns
- **Self** - A new StartupHealthCheck instance.
```

--------------------------------

### DeploymentPlan::connection

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.DeploymentPlan.html

Returns the optional non-sensitive output connection reference.

```APIDOC
## DeploymentPlan::connection

### Description
Returns the optional non-sensitive output connection reference.

### Method
pub fn connection(&self) -> Option<&DeploymentConnectionReference>

### Parameters
None

### Returns
- `Option<&DeploymentConnectionReference>` - The optional connection reference.
```

--------------------------------

### pub fn security(&self) -> &SecuritySettings

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns security settings.

```APIDOC
## security

### Description
Returns security settings.

### Method
security

### Signature
pub fn security(&self) -> &SecuritySettings

### Returns
&SecuritySettings - A reference to the security settings.
```

--------------------------------

### DeploymentRendering::shell_script

Source: https://docs.rs/podman-lens/latest/podman_lens/render/struct.DeploymentRendering.html

Generates a review-only POSIX sh script from the stored CLI argument arrays.

```APIDOC
## DeploymentRendering::shell_script

### Description
Generates a review-only POSIX `sh` script from the stored CLI argument arrays. The library never executes the script. It deliberately has no command substitution, glob expansion, or `eval`; it contains only the displayed Podman invocations. Each deferred secret requires a caller-provided regular file path in deterministic `PODMAN_LENS_SECRET_INPUT_<n>` order. The script can contain explicitly authorized protected environment values.

### Method
`pub fn shell_script(&self) -> String`

### Parameters
None.

### Returns
- `String` - The generated shell script as a string.
```

--------------------------------

### pub fn namespaces_mut(&mut self) -> &mut ContainerNamespaceSettings

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns mutable namespace settings.

```APIDOC
## namespaces_mut

### Description
Returns mutable namespace settings.

### Method
namespaces_mut

### Signature
pub fn namespaces_mut(&mut self) -> &mut ContainerNamespaceSettings

### Returns
&mut ContainerNamespaceSettings - A mutable reference to the namespace settings.
```

--------------------------------

### ContainerUser::new

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.ContainerUser.html

Creates a user setting from a safe runtime spelling. Returns an error for empty, oversized, unsafe, or malformed component lists.

```APIDOC
## ContainerUser::new

### Description
Creates a user setting from a safe runtime spelling. Returns an error for empty, oversized, unsafe, or malformed component lists.

### Method
Constructor

### Signature
pub fn new(value: impl Into<String>) -> PodmanLensResult<Self>

### Parameters
- **value** (impl Into<String>) - Required - The user or user:group spelling to validate.

### Errors
Returns `PLN0034` for an empty, oversized, unsafe, or malformed component list. Exactly one nonempty user or UID component is required; one nonempty group or GID component may follow after a single colon.

### Returns
- **PodmanLensResult<Self>** - The validated ContainerUser instance.
```

--------------------------------

### ConfiguredContainerEntrypoint::arguments

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.ConfiguredContainerEntrypoint.html

Returns the declared entrypoint arguments in their native order.

```APIDOC
## arguments

### Description
Returns the declared entrypoint arguments in their native order.

### Method
arguments

### Signature
pub fn arguments(&self) -> &[String]

### Parameters
None

### Returns
- **&[String]** - The declared entrypoint arguments in their native order.

```

--------------------------------

### Rlimit::new

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.Rlimit.html

Creates one rlimit. Finite soft limits must not exceed finite hard limits.

```APIDOC
## Rlimit::new

### Description
Creates one rlimit. Finite soft limits must not exceed finite hard limits.

### Method
`pub fn new(kind: RlimitKind, soft: RlimitValue, hard: RlimitValue) -> PodmanLensResult<Self>`

### Parameters
- `kind` (RlimitKind) - Required - The kind of rlimit.
- `soft` (RlimitValue) - Required - The soft limit value.
- `hard` (RlimitValue) - Required - The hard limit value.

### Returns
- `PodmanLensResult<Self>` - The result containing the new Rlimit instance or an error.
```

--------------------------------

### discover

Source: https://docs.rs/podman-lens/latest/podman_lens/discovery/index.html

Builds deterministic resource groups from an already acquired native inventory.

```APIDOC
## discover

### Description
Builds deterministic resource groups from an already acquired native inventory.

### Function Signature
`discover()`

### Parameters
No parameters documented.

### Returns
Resource groups (type not specified in source).

```

--------------------------------

### StartupHealthCheck::command

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.StartupHealthCheck.html

Returns the declared startup command.

```APIDOC
## StartupHealthCheck::command

### Description
Returns the declared startup command.

### Method
`pub const fn command(&self) -> &HealthCommand`

### Returns
- **&HealthCommand** - A reference to the health command.
```

--------------------------------

### StartupDependency::new

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.StartupDependency.html

Creates a strict start-order edge from a predecessor container to a dependent container. Returns an error unless both identities are containers.

```APIDOC
## StartupDependency::new

### Description
Creates a strict start-order edge from `predecessor` to `dependent`.

### Method
`pub fn new(predecessor: DeploymentResourceId, dependent: DeploymentResourceId) -> PodmanLensResult<Self>`

### Parameters
- **predecessor** (DeploymentResourceId) - Required - The container that must start first.
- **dependent** (DeploymentResourceId) - Required - The container that starts later.

### Errors
Returns `PLN0034` unless both identities are containers.

### Returns
`PodmanLensResult<Self>` - A new `StartupDependency` instance.
```

--------------------------------

### ContainerObservation::startup_health_check

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.ContainerObservation.html

Returns effective startup-health inspect evidence or its observation state. This may include an image default and is not authored deployment intent.

```APIDOC
## ContainerObservation::startup_health_check

### Description
Returns effective startup-health inspect evidence or its observation state. This may include an image default and is not authored deployment intent.

### Method
startup_health_check

### Signature
pub fn startup_health_check(&self) -> &ObservationField<NativeStartupHealthCheckObservation>

### Parameters
None

### Returns
- **&ObservationField<NativeStartupHealthCheckObservation>** - Effective startup-health inspect evidence or its observation state.
```

--------------------------------

### PortMapping::new

Source: https://docs.rs/podman-lens/latest/podman_lens/networking/struct.PortMapping.html

Creates a new PortMapping instance with the given host IP, host port, container port, and protocol. Returns an error if either port is zero.

```APIDOC
## PortMapping::new

### Description
Creates one nonzero port mapping. Returns `PLN0034` error when either port is zero.

### Method
`pub fn new(host_ip: Option<IpAddr>, host_port: u16, container_port: u16, protocol: PortProtocol) -> PodmanLensResult<Self>`

### Parameters
- **host_ip** (Option<IpAddr>) - Optional - The optional declared host bind address.
- **host_port** (u16) - Required - The host port.
- **container_port** (u16) - Required - The container port.
- **protocol** (PortProtocol) - Required - The protocol.

### Errors
Returns `PLN0034` when either port is zero.

### Returns
`PodmanLensResult<Self>` - A result containing the new `PortMapping` instance or an error.
```

--------------------------------

### BindMount::source

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.BindMount.html

Returns the normalized absolute host source path.

```APIDOC
## BindMount::source

### Description
Returns the normalized absolute host source path.

### Signature
```rust
pub fn source(&self) -> &AbsoluteContainerPath
```

### Parameters
- **self** (&BindMount) - Required - The BindMount instance.

### Returns
- **&AbsoluteContainerPath** - The normalized absolute host source path.
```

--------------------------------

### RenderingFinding::message

Source: https://docs.rs/podman-lens/latest/podman_lens/render/struct.RenderingFinding.html

Returns the redacted rule explanation as a static string.

```APIDOC
## `pub const fn message(&self) -> &'static str`

### Description
Returns the redacted rule explanation.

### Method
`message`

### Signature
`pub const fn message(&self) -> &'static str`

### Parameters
- `self` (reference) - Required - The RenderingFinding instance.

### Returns
- `&'static str` - The redacted rule explanation.
```

--------------------------------

### create_net_ns

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.NativeNetworkingObservation.html

Returns the configured container network-namespace creation gate.

```APIDOC
## create_net_ns

### Description
Returns the configured container network-namespace creation gate.

### Method
create_net_ns

### Signature
pub fn create_net_ns(&self) -> &ObservationField<bool>

### Parameters
None

### Returns
- **&ObservationField<bool>** - The configured container network-namespace creation gate.
```

--------------------------------

### DeploymentIntent::resources

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.DeploymentIntent.html

Returns typed resources in caller-supplied order.

```APIDOC
## DeploymentIntent::resources

### Description
Returns typed resources in caller-supplied order.

### Method
`pub fn resources(&self) -> &[DeploymentResource]`

### Returns
- `&[DeploymentResource]` - A slice of the resources.
```

--------------------------------

### DeploymentRendering::external_preconditions

Source: https://docs.rs/podman-lens/latest/podman_lens/render/struct.DeploymentRendering.html

Returns explicit external prerequisites preserved from the semantic plan.

```APIDOC
## DeploymentRendering::external_preconditions

### Description
Returns explicit external prerequisites preserved from the semantic plan.

### Method
`pub fn external_preconditions(&self) -> &[ExternalPrecondition]`

### Parameters
None.

### Returns
- `&[ExternalPrecondition]` - A slice of external preconditions.
```

--------------------------------

### TmpfsMount::new

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.TmpfsMount.html

Creates a new TmpfsMount instance with the given destination and access mode.

```APIDOC
## TmpfsMount::new

### Description
Creates a new tmpfs mount with the specified destination and access mode.

### Signature
```rust
pub const fn new(
    destination: AbsoluteContainerPath,
    access: MountAccess,
) -> Self
```

### Parameters
- **destination** (AbsoluteContainerPath) - Required - The normalized container destination path.
- **access** (MountAccess) - Required - The declared access mode.

### Returns
- **Self** - A new TmpfsMount instance.
```

--------------------------------

### PodIntent::networks

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.PodIntent.html

Returns declared network prerequisites in input order.

```APIDOC
## PodIntent::networks

### Description
Returns declared network prerequisites in input order.

### Method
`pub fn networks(&self) -> &[NetworkAttachment]`

### Returns
`&[NetworkAttachment]` - Slice of network attachments.
```

--------------------------------

### pub fn deployment(source: &DeploymentRendering) -> DeploymentArtifact

Source: https://docs.rs/podman-lens/latest/podman_lens/artifact/deployment_v2/fn.deployment.html

Returns a version 2 deployment artifact. The serialized bytes may contain protected inline environment values when the source rendering includes them. The explicit sensitivity indicator is derived from actual rendered values, not simply from the caller's authorization grant.

```APIDOC
## pub fn deployment(source: &DeploymentRendering) -> DeploymentArtifact

### Description
Returns a version 2 deployment artifact. The serialized bytes may contain protected inline environment values when the source rendering includes them. The explicit sensitivity indicator is derived from actual rendered values, not simply from the caller's authorization grant.

### Function Signature
pub fn deployment(source: &DeploymentRendering) -> DeploymentArtifact

### Parameters
- **source** (&DeploymentRendering) - Required - The rendering source used to generate the deployment artifact.

### Returns
- **DeploymentArtifact** - The version 2 deployment artifact.
```

--------------------------------

### pub fn security_mut(&mut self) -> &mut SecuritySettings

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns mutable security settings.

```APIDOC
## security_mut

### Description
Returns mutable security settings.

### Method
security_mut

### Signature
pub fn security_mut(&mut self) -> &mut SecuritySettings

### Returns
&mut SecuritySettings - A mutable reference to the security settings.
```

--------------------------------

### render_deployment_with_authorization

Source: https://docs.rs/podman-lens/latest/podman_lens/render/index.html

Renders a plan after an explicit caller decision to include protected inline environment values in inert output.

```APIDOC
## render_deployment_with_authorization

### Description
Renders a plan after an explicit caller decision to include protected inline environment values in inert output. This does not resolve external values or execute the rendering.

### Function Signature
render_deployment_with_authorization(plan, authorization) -> DeploymentRendering

### Parameters
- **plan** (validated M5 deployment plan) - Required - The validated semantic plan to render.
- **authorization** (SensitiveInlineRenderAuthorization) - Required - Explicit permission to place caller-supplied protected inline environment values in inert Podman renderings.

### Returns
- **DeploymentRendering** - Complete rendering of the validated M5 deployment plan.

### Notes
- This function does not resolve external values or execute the rendering.
- The authorization covers every protected inline value in one plan; it does not authorize unresolved external values, acquisition, execution, or deployment.
```

--------------------------------

### discover

Source: https://docs.rs/podman-lens/latest/podman_lens/discovery/fn.discover.html

Builds deterministic resource groups from an already acquired native inventory. Returns a resource graph or a diagnostic error.

```APIDOC
## Function: discover

### Description
Builds deterministic resource groups from an already acquired native inventory. A dependency edge always points from dependent to prerequisite. Networks, volumes, images, and secrets remain prerequisites and never join consumers merely because they are shared. Reverse consumer traversal occurs only for an explicitly selected shared resource or an exact network name-or-ID boundary override.

### Signature
```rust
pub fn discover(
    inventory: &ResourceInventory,
    request: &DiscoveryRequest,
) -> Result<ResourceGraph, Diagnostic>
```

### Parameters
- **inventory** (`&ResourceInventory`) - The already acquired native inventory.
- **request** (`&DiscoveryRequest`) - The discovery request specifying roots or select_all.

### Return Value
- **Result<ResourceGraph, Diagnostic>** - On success, returns a `ResourceGraph`; on failure, returns a `Diagnostic`.

### Errors
- Returns `PLN0027` when neither explicit roots nor `select_all` are present in the request.

```

--------------------------------

### From<BindMount> for MountIntent

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/enum.MountIntent.html

Converts a BindMount into a MountIntent.

```APIDOC
## From<BindMount> for MountIntent

### Description
Converts a BindMount into a MountIntent.

### Method
`fn from(mount: BindMount) -> Self`

### Parameters
- `mount` (BindMount) - The bind mount to convert.

### Returns
- `Self` - The resulting MountIntent.

```

--------------------------------

### servers

Source: https://docs.rs/podman-lens/latest/podman_lens/networking/struct.DnsConfiguration.html

Returns servers in declaration order.

```APIDOC
## servers

### Description
Returns the DNS servers in declaration order.

### Method
servers

### Signature
pub fn servers(&self) -> &[IpAddr]

### Return Value
&[IpAddr] - A slice of IP addresses representing the servers.
```

--------------------------------

### ContainerIntent::networks

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.ContainerIntent.html

Returns direct network prerequisites.

```APIDOC
## ContainerIntent::networks

### Description
Returns direct network prerequisites.

### Method
`pub fn networks(&self) -> &[NetworkAttachment]`

### Returns
`&[NetworkAttachment]` - The direct network prerequisites.
```

--------------------------------

### set_entrypoint

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.ContainerSettings.html

Assigns one entrypoint array, rejecting repeated or conflicting assignments. Returns PLN0035 for an identical repeat and PLN0038 for a conflict.

```APIDOC
## set_entrypoint

### Description
Assigns one entrypoint array, rejecting repeated or conflicting assignments.

### Method
set_entrypoint

### Signature
pub fn set_entrypoint(&mut self, entrypoint: ArgumentArray) -> PodmanLensResult<()>

### Parameters
- **entrypoint** (ArgumentArray) - Required - The entrypoint array to assign.

### Errors
- **PLN0035** - Returned for an identical repeat.
- **PLN0038** - Returned for a conflict.

### Returns
PodmanLensResult<()> - Ok on success, or an error as described.
```

--------------------------------

### driver

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.LoggingSettings.html

Returns the selected driver.

```APIDOC
## driver

### Description
Returns the selected driver.

### Method
pub const fn driver(&self) -> Option<LogDriver>

### Returns
- **Option<LogDriver>** - The selected driver, if any.

```

--------------------------------

### EnvironmentAssignment::new

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.EnvironmentAssignment.html

Creates a new EnvironmentAssignment instance with the given environment name and deployment environment value.

```APIDOC
## EnvironmentAssignment::new

### Description
Creates one typed environment assignment.

### Method
`pub const fn new(name: EnvironmentName, value: DeploymentEnvironmentValue) -> Self`

### Parameters
- `name` (EnvironmentName) - Required - The environment variable name.
- `value` (DeploymentEnvironmentValue) - Required - The typed value source.

### Returns
- `Self` - A new EnvironmentAssignment instance.

### Example
```rust
let assignment = EnvironmentAssignment::new(name, value);
```
```

--------------------------------

### ContainerWorkdir::new

Source: https://docs.rs/podman-lens/latest/podman_lens/settings/struct.ContainerWorkdir.html

Creates a new ContainerWorkdir from a normalized absolute container path.

```APIDOC
## ContainerWorkdir::new

### Description
Creates a working directory from one normalized absolute container path.

### Method
`pub const fn new(path: AbsoluteContainerPath) -> Self`

### Parameters
- **path** (`AbsoluteContainerPath`) - Required - The normalized absolute container path.

### Returns
- `Self` - A new `ContainerWorkdir` instance.

```

--------------------------------

### pub fn resources(&self) -> &ContainerResourceControls

Source: https://docs.rs/podman-lens/latest/podman_lens/runtime/struct.ContainerRuntimeSettings.html

Returns resource controls.

```APIDOC
## resources

### Description
Returns resource controls.

### Method
resources

### Signature
pub fn resources(&self) -> &ContainerResourceControls

### Returns
&ContainerResourceControls - A reference to the resource controls.
```

--------------------------------

### options

Source: https://docs.rs/podman-lens/latest/podman_lens/networking/struct.DnsConfiguration.html

Returns resolver options in declaration order.

```APIDOC
## options

### Description
Returns the DNS resolver options in declaration order.

### Method
options

### Signature
pub fn options(&self) -> &[String]

### Return Value
&[String] - A slice of strings representing the resolver options.
```

--------------------------------

### DeploymentIntent::connection

Source: https://docs.rs/podman-lens/latest/podman_lens/deployment/struct.DeploymentIntent.html

Returns the optional non-sensitive output connection reference.

```APIDOC
## DeploymentIntent::connection

### Description
Returns the optional non-sensitive output connection reference.

### Method
`pub fn connection(&self) -> Option<&DeploymentConnectionReference>`

### Returns
- `Option<&DeploymentConnectionReference>` - The connection reference if set, otherwise `None`.
```

--------------------------------

### render_deployment_with_authorization

Source: https://docs.rs/podman-lens/latest/podman_lens/render/fn.render_deployment_with_authorization.html

Renders a plan after an explicit caller decision to include protected inline environment values in inert output. This does not resolve external values or execute the rendering. All protected inline environment values in the plan are included.

```APIDOC
## Function render_deployment_with_authorization

### Description
Renders a plan after an explicit caller decision to include protected inline environment values in inert output. This does not resolve external values or execute the rendering. All protected inline environment values in `plan` are included. Callers must keep resulting version 2 artifact bytes private and avoid logging them; version 1 refuses them before writing bytes. `Debug` stays redacted.

### Signature
```rust
pub fn render_deployment_with_authorization(
    plan: &DeploymentPlan,
    _authorization: SensitiveInlineRenderAuthorization,
) -> RenderingOutcome
```

### Parameters
- **plan** (`&DeploymentPlan`) - The deployment plan to render.
- **_authorization** (`SensitiveInlineRenderAuthorization`) - An authorization token indicating the caller's explicit decision to include protected inline environment values.

### Returns
- **RenderingOutcome** - The result of the rendering, which may contain findings and an optional rendering.

### Example
```rust
use podman_lens::{
    ContainerIntent, DeploymentEnvironmentValue, DeploymentIntent, DeploymentResource,
    DeploymentResourceId, EnvironmentAssignment, EnvironmentName, ExternalPrecondition,
    ObservedApiVersion, ObservedPodmanVersion, ResourceKind,
    SensitiveInlineEnvironmentValue, SensitiveInlineRenderAuthorization, TargetProfile,
    artifact::{deployment_v1, deployment_v2}, plan_deployment, render_deployment,
    render_deployment_with_authorization,
};

let target = TargetProfile::new(
    ObservedPodmanVersion::parse("6.1.0")?,
    ObservedApiVersion::parse("6.1.0")?,
)?;
let image = DeploymentResourceId::new(ResourceKind::Image, "registry.example.invalid/app:1")?;
let mut container = ContainerIntent::new(
    DeploymentResourceId::new(ResourceKind::Container, "application")?,
    image.clone(),
)?;
container.settings_mut().add_environment(EnvironmentAssignment::new(
    EnvironmentName::new("MODE")?,
    DeploymentEnvironmentValue::SensitiveInline(
        SensitiveInlineEnvironmentValue::new("protected-example-canary")?,
    ),
))?;
let mut intent = DeploymentIntent::new(target);
intent.add_resource(DeploymentResource::ExternalPrecondition(
    ExternalPrecondition::new(image)?,
));
intent.add_resource(DeploymentResource::Container(container));
let planned = plan_deployment(&intent);
let plan = planned.plan().expect("complete semantic plan");
let denied = render_deployment(plan);
assert_eq!(denied.findings()[0].field(), Some("environment.sensitive_inline"));
assert!(denied.rendering().is_none());

let authorized = render_deployment_with_authorization(
    plan,
    SensitiveInlineRenderAuthorization::new(),
);
let rendering = authorized.rendering().expect("authorized inert rendering");
assert!(serde_json::to_string(&deployment_v1::deployment(rendering)).is_err());
let artifact = deployment_v2::deployment(rendering);
assert!(artifact.contains_protected_inline_environment());
let artifact_bytes = serde_json::to_string(&artifact)?;
assert!(artifact_bytes.contains("protected-example-canary"));
assert!(!format!("{authorized:?}").contains("protected-example-canary"));
```
```

--------------------------------

### pub const fn is_empty(&self) -> bool

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.NativeOpaqueNetworkOptions.html

Returns whether no opaque options were observed.

```APIDOC
## pub const fn is_empty(&self) -> bool

### Description
Returns whether no opaque options were observed.

### Method
is_empty

### Signature
pub const fn is_empty(&self) -> bool

### Parameters
None

### Returns
- **bool** - `true` if there are no opaque options, `false` otherwise.
```

--------------------------------

### NativeStartupHealthCheckObservation::successes

Source: https://docs.rs/podman-lens/latest/podman_lens/observation/struct.NativeStartupHealthCheckObservation.html

Returns the effective native startup success threshold, including zero.

```APIDOC
## NativeStartupHealthCheckObservation::successes

### Description
Returns the effective native startup success threshold, including zero.

### Method
`pub fn successes(&self) -> &ObservationField<u64>`

### Parameters
- `self` - Reference to the observation struct.

### Returns
- `&ObservationField<u64>` - The effective native startup success threshold.

```