Add crate_package_default_visibility to render_config

Allow configuring the default_visibility of individual crate BUILD
packages generated by crate_universe. By default, crate packages use
//visibility:public. Setting crate_package_default_visibility restricts
direct references to crate targets, encouraging consumers to go through
top-level aliases instead.

This is useful in monorepos where visibility control helps enforce
dependency hygiene.

Example usage in render_config():
  render_config(
      crate_package_default_visibility = ["//third_party/rust:__subpackages__"],
  )

Author: Tamas Vajk

crate_universe/private/generate_utils.bzl

@@ -91,18 +91,19 @@ def get_generator(repository_ctx, host_triple):
 
 def render_config(
         build_file_template = "//:BUILD.{name}-{version}.bazel",
-        crate_label_template = "@{repository}__{name}-{version}//:{target}",
         crate_alias_template = "//:{name}-{version}",
+        crate_label_template = "@{repository}__{name}-{version}//:{target}",
+        crate_package_default_visibility = None,
         crate_repository_template = "{repository}__{name}-{version}",
         crates_module_template = "//:{file}",
         default_alias_rule = "alias",
         default_package_name = None,
         generate_cargo_toml_env_vars = True,
+        generate_rules_license_metadata = False,
         generate_target_compatible_with = True,
         platforms_template = "@rules_rust//rust/platform:{triple}",
         regen_command = None,
-        vendor_mode = None,
-        generate_rules_license_metadata = False):
+        vendor_mode = None):
     """Various settings used to configure rendered outputs
 
     The template parameters each support a select number of format keys. A description of each key
@@ -126,6 +127,9 @@ def render_config(
             available format keys are [`{repository}`, `{name}`, `{version}`].
         crate_alias_template (str, optional): The template to use when referring to generated aliases within the external
             repository. The available format keys are [`{repository}`, `{name}`, `{version}`].
+        crate_package_default_visibility (list, optional): The default_visibility for individual crate BUILD packages.
+            If None, defaults to `["//visibility:public"]`. Set to restrict direct references to crate targets so
+            that consumers must use the top-level aliases.
         crates_module_template (str, optional): The pattern to use for the `defs.bzl` and `BUILD.bazel`
             file names used for the crates module. The available format keys are [`{file}`].
         default_alias_rule (str, option): Alias rule to use when generating aliases for all crates.  Acceptable values
@@ -153,6 +157,7 @@ def render_config(
         build_file_template = build_file_template,
         crate_alias_template = crate_alias_template,
         crate_label_template = crate_label_template,
+        crate_package_default_visibility = crate_package_default_visibility,
         crate_repository_template = crate_repository_template,
         crates_module_template = crates_module_template,
         default_alias_rule = parse_alias_rule(default_alias_rule),

crate_universe/src/config.rs

@@ -107,6 +107,11 @@ pub(crate) struct RenderConfig {
     /// Whether to generate cargo_toml_env_vars targets.
     /// This is expected to always be true except for bootstrapping.
     pub(crate) generate_cargo_toml_env_vars: bool,
+
+    /// The default_visibility for individual crate BUILD packages. If None,
+    /// defaults to ["//visibility:public"]. Set to restrict direct references
+    /// to crate targets so that consumers must use the top-level aliases.
+    pub(crate) crate_package_default_visibility: Option<Vec<String>>,
 }
 
 // Default is manually implemented so that the default values match the default
@@ -129,6 +134,7 @@ impl Default for RenderConfig {
             regen_command: String::default(),
             vendor_mode: Option::default(),
             generate_rules_license_metadata: default_generate_rules_license_metadata(),
+            crate_package_default_visibility: None,
         }
     }
 }

crate_universe/src/rendering.rs

@@ -436,7 +436,7 @@ impl Renderer {
                 });
             }
 
-            let package = Package::default_visibility_public(package_metadata);
+            let package = self.crate_package(package_metadata);
             starlark.push(Starlark::Package(package));
 
             starlark.push(Starlark::PackageInfo(starlark::PackageInfo {
@@ -461,7 +461,7 @@ impl Renderer {
             }
         } else {
             // Package visibility.
-            let package = Package::default_visibility_public(BTreeSet::new());
+            let package = self.crate_package(BTreeSet::new());
             starlark.push(Starlark::Package(package));
         }
 
@@ -890,6 +890,22 @@ impl Renderer {
         )
     }
 
+    /// Constructs a `Package` for an individual crate BUILD file, using
+    /// `crate_package_default_visibility` from the render config if set,
+    /// otherwise falling back to `//visibility:public`.
+    fn crate_package(&self, default_package_metadata: BTreeSet<Label>) -> Package {
+        match &self.config.crate_package_default_visibility {
+            Some(visibility) => {
+                let default_visibility = visibility.iter().cloned().collect();
+                Package {
+                    default_package_metadata,
+                    default_visibility,
+                }
+            }
+            None => Package::default_visibility_public(default_package_metadata),
+        }
+    }
+
     fn render_vendor_support_files(
         &self,
         engine: &TemplateEngine,