@pikku/addon-console 0.12.43 → 0.12.44

package/dist/.pikku/addon/secrets/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/secrets` resolves here.

package/dist/.pikku/addon/secrets/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/secrets` resolves here.

package/dist/.pikku/addon/secrets/pikku-secret-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 export { defineSecret } from '@pikku/core/secret';
 //# sourceMappingURL=pikku-secret-types.gen.d.ts.map

package/dist/.pikku/addon/secrets/pikku-secret-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 export { defineSecret } from '@pikku/core/secret';
 //# sourceMappingURL=pikku-secret-types.gen.js.map

package/dist/.pikku/addon/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/addon/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 /**

package/dist/.pikku/addon/services/pikku-meta-service.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export declare class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/addon/services/pikku-meta-service.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/addon/setup/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/addon/setup/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/addon/setup/pikku-addon-setup-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Addon package types for pikkuAddonConfig and pikkuAddonServices

package/dist/.pikku/addon/setup/pikku-addon-setup-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Addon package types for pikkuAddonConfig and pikkuAddonServices

package/dist/.pikku/addon/setup/pikku-setup-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/addon/setup/pikku-setup-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/addon/trigger/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/addon/trigger/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/addon/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/addon/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/addon/variables/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/addon/variables/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/addon/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 export { defineVariable } from '@pikku/core/variable';
 //# sourceMappingURL=pikku-variable-types.gen.d.ts.map

package/dist/.pikku/addon/variables/pikku-variable-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 export { defineVariable } from '@pikku/core/variable';
 //# sourceMappingURL=pikku-variable-types.gen.js.map

package/dist/.pikku/addon/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/addon/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/addon/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/addon/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/addon/workflow/pikku-scenario-step-map.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Scenario step map: the names `scenario.given/when/then` accepts, with

package/dist/.pikku/addon/workflow/pikku-workflow-map.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 /**
  * Workflow type map with input/output types for each workflow

package/dist/.pikku/addon/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/addon/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/addon/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { pikkuState } from '@pikku/core/state';
 const workflowsMeta = {};

package/dist/.pikku/addon/workflow/pikku-workflow-wirings.gen.d.ts

@@ -1,5 +1,5 @@
 export {};
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 //# sourceMappingURL=pikku-workflow-wirings.gen.d.ts.map

package/dist/.pikku/addon/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 export {};
 /**
- * This file was generated by @pikku/cli@0.12.107
+ * This file was generated by @pikku/cli@0.12.109
  */
 //# sourceMappingURL=pikku-workflow-wirings.gen.js.map

package/dist/src/functions/render-email-preview.function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-email-preview.function.d.ts","sourceRoot":"","sources":["../../../src/functions/render-email-preview.function.ts"],"names":[],"mappings":"AASA,KAAK,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;AAClE,KAAK,kBAAkB,GACrB,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;AAE3D,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,eAAO,MAAM,kBAAkB,8eAsF7B,CAAA"}
+{"version":3,"file":"render-email-preview.function.d.ts","sourceRoot":"","sources":["../../../src/functions/render-email-preview.function.ts"],"names":[],"mappings":"AAQA,KAAK,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;AAClE,KAAK,kBAAkB,GACrB,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;AAE3D,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,eAAO,MAAM,kBAAkB,8eA4F7B,CAAA"}

package/dist/src/functions/render-email-preview.function.js

@@ -1,6 +1,6 @@
 import { pikkuFunc } from '#pikku/addon/function';
 import { NotFoundError } from '#pikku/addon/error';
-import { getNestedValue, renderTemplate, renderPartial, } from './render-email-template.utils.js';
+import { getNestedValue, renderTemplate, } from './render-email-template.utils.js';
 export const renderEmailPreview = pikkuFunc({
     title: 'Render Email Preview',
     description: 'Renders an email template preview from emailTemplatesDir using a locale and variable payload.',
@@ -24,34 +24,23 @@ export const renderEmailPreview = pikkuFunc({
             t: assets.strings,
             appName,
         };
-        const subject = renderTemplate(assets.subject, baseContext).trim();
-        const htmlWithPartials = assets.html.replace(/\{\{\s*>\s*([a-zA-Z0-9-_/.]+)\s*\}\}/g, (_match, partialName) => `@@PARTIAL:${String(partialName).trim()}@@`);
-        let htmlBody = renderTemplate(htmlWithPartials, {
+        const subject = renderTemplate(assets.subject, baseContext, assets.partials, false).trim();
+        const htmlBody = renderTemplate(assets.html, {
             ...baseContext,
             subject,
-        });
-        const partialMatches = [...htmlBody.matchAll(/@@PARTIAL:([^@]+)@@/g)];
-        for (const match of partialMatches) {
-            if (!match[1])
-                continue;
-            const rendered = renderPartial(match[1], assets.partials, {
-                ...baseContext,
-                subject,
-            });
-            htmlBody = htmlBody.replace(match[0], rendered);
-        }
+        }, assets.partials, true);
         const html = assets.layout
             ? renderTemplate(assets.layout, {
                 ...baseContext,
                 subject,
                 content: htmlBody,
-            })
+            }, assets.partials, true)
             : htmlBody;
         const text = assets.text
             ? renderTemplate(assets.text, {
                 ...baseContext,
                 subject,
-            }).trim()
+            }, assets.partials, false).trim()
             : undefined;
         return {
             name: input.templateName,

package/dist/src/functions/render-email-preview.function.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-email-preview.function.js","sourceRoot":"","sources":["../../../src/functions/render-email-preview.function.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EACL,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,kCAAkC,CAAA;AAyBzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAGzC;IACA,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,+FAA+F;IACjG,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,CAAC,2BAA2B,CAAC;IACrC,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,CAAA;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAC7B,CAAA;QAE/B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC,2BAA2B,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAE3E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,sBAAsB,CACrD,KAAK,CAAC,YAAY,EAClB,MAAM,CACP,CAAA;QAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;QAC1D,MAAM,OAAO,GACX,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI;YACP,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,CAAC,EAAE,MAAM,CAAC,OAAO;YACjB,OAAO;SACR,CAAA;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAA;QAClE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAC1C,uCAAuC,EACvC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,CACrE,CAAA;QAED,IAAI,QAAQ,GAAG,cAAc,CAAC,gBAAgB,EAAE;YAC9C,GAAG,WAAW;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAA;QACrE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,SAAQ;YACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACxD,GAAG,WAAW;gBACd,OAAO;aACR,CAAC,CAAA;YACF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;YACxB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC5B,GAAG,WAAW;gBACd,OAAO;gBACP,OAAO,EAAE,QAAQ;aAClB,CAAC;YACJ,CAAC,CAAC,QAAQ,CAAA;QAEZ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;YACtB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC1B,GAAG,WAAW;gBACd,OAAO;aACR,CAAC,CAAC,IAAI,EAAE;YACX,CAAC,CAAC,SAAS,CAAA;QAEb,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,MAAM;YACN,OAAO;YACP,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,IAAI,EAAE;YACrD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}
+{"version":3,"file":"render-email-preview.function.js","sourceRoot":"","sources":["../../../src/functions/render-email-preview.function.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EACL,cAAc,EACd,cAAc,GACf,MAAM,kCAAkC,CAAA;AAyBzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAGzC;IACA,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,+FAA+F;IACjG,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,CAAC,2BAA2B,CAAC;IACrC,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,CAAA;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAC7B,CAAA;QAE/B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC,2BAA2B,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAE3E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,sBAAsB,CACrD,KAAK,CAAC,YAAY,EAClB,MAAM,CACP,CAAA;QAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;QAC1D,MAAM,OAAO,GACX,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI;YACP,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,CAAC,EAAE,MAAM,CAAC,OAAO;YACjB,OAAO;SACR,CAAA;QAED,MAAM,OAAO,GAAG,cAAc,CAC5B,MAAM,CAAC,OAAO,EACd,WAAW,EACX,MAAM,CAAC,QAAQ,EACf,KAAK,CACN,CAAC,IAAI,EAAE,CAAA;QAER,MAAM,QAAQ,GAAG,cAAc,CAC7B,MAAM,CAAC,IAAI,EACX;YACE,GAAG,WAAW;YACd,OAAO;SACR,EACD,MAAM,CAAC,QAAQ,EACf,IAAI,CACL,CAAA;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;YACxB,CAAC,CAAC,cAAc,CACZ,MAAM,CAAC,MAAM,EACb;gBACE,GAAG,WAAW;gBACd,OAAO;gBACP,OAAO,EAAE,QAAQ;aAClB,EACD,MAAM,CAAC,QAAQ,EACf,IAAI,CACL;YACH,CAAC,CAAC,QAAQ,CAAA;QAEZ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;YACtB,CAAC,CAAC,cAAc,CACZ,MAAM,CAAC,IAAI,EACX;gBACE,GAAG,WAAW;gBACd,OAAO;aACR,EACD,MAAM,CAAC,QAAQ,EACf,KAAK,CACN,CAAC,IAAI,EAAE;YACV,CAAC,CAAC,SAAS,CAAA;QAEb,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,MAAM;YACN,OAAO;YACP,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,IAAI,EAAE;YACrD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/src/functions/render-email-template.utils.d.ts

@@ -1,5 +1,10 @@
+export declare function escapeHtml(value: string): string;
 export declare function getNestedValue(source: Record<string, unknown>, path: string): string;
-export declare function applyTemplate(source: string, context: Record<string, unknown>): string;
-export declare function renderTemplate(source: string, context: Record<string, unknown>): string;
-export declare function renderPartial(name: string, partials: Record<string, string>, context: Record<string, unknown>): string;
+export declare function expandPartials(source: string, partials: Record<string, string>, depth?: number): string;
+/**
+ * A single substitution pass — the replacement text is never rescanned, so a
+ * caller-supplied value can never be reinterpreted as a template.
+ */
+export declare function substitute(source: string, context: Record<string, unknown>, escape: boolean): string;
+export declare function renderTemplate(source: string, context: Record<string, unknown>, partials: Record<string, string>, escape: boolean): string;
 //# sourceMappingURL=render-email-template.utils.d.ts.map

package/dist/src/functions/render-email-template.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-email-template.utils.d.ts","sourceRoot":"","sources":["../../../src/functions/render-email-template.utils.ts"],"names":[],"mappings":"AAAA,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,GACX,MAAM,CAYR;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAWR;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAQR;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAGR"}
+{"version":3,"file":"render-email-template.utils.d.ts","sourceRoot":"","sources":["../../../src/functions/render-email-template.utils.ts"],"names":[],"mappings":"AAyBA,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,GACX,MAAM,CAYR;AAWD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,KAAK,SAAI,GACR,MAAM,CASR;AA0BD;;;GAGG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,EAAE,OAAO,GACd,MAAM,CAYR;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,MAAM,EAAE,OAAO,GACd,MAAM,CAOR"}

package/dist/src/functions/render-email-template.utils.js

@@ -1,3 +1,26 @@
+const HTML_ESCAPES = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+};
+/**
+ * Matches the raw `{{{ value }}}` form before the escaped `{{ value }}` form, so
+ * the opt-in escape hatch is never mistaken for a normal substitution.
+ */
+const TEMPLATE_TOKEN = /\{\{\{\s*([^{}]+?)\s*\}\}\}|\{\{\s*([^}]+?)\s*\}\}/g;
+const PARTIAL_TOKEN = /\{\{\s*>\s*([a-zA-Z0-9-_/.]+)\s*\}\}/g;
+const MAX_TEMPLATE_DEPTH = 5;
+/**
+ * theme.json and the locale files ship with the templates, so they are treated
+ * as template-author input: expanded before caller data and allowed to contain
+ * their own placeholders. Everything else is caller-supplied.
+ */
+const TRUSTED_ROOTS = ['theme', 't'];
+export function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char] ?? char);
+}
 export function getNestedValue(source, path) {
     const segments = path.split('.');
     let current = source;
@@ -11,30 +34,61 @@ export function getNestedValue(source, path) {
         ? String(current)
         : '';
 }
-export function applyTemplate(source, context) {
-    return source.replace(/\{\{\s*([^}]+?)\s*\}\}/g, (_match, rawKey) => {
-        const key = String(rawKey).trim();
-        if (key === 'content') {
-            return typeof context.content === 'string' ? context.content : '';
-        }
-        if (key.startsWith('>')) {
-            return '';
-        }
-        return getNestedValue(context, key);
+function isTrustedKey(key) {
+    return TRUSTED_ROOTS.includes(String(key.split('.')[0]));
+}
+function readToken(rawTriple, rawDouble) {
+    const raw = typeof rawTriple === 'string';
+    return { raw, key: String(raw ? rawTriple : rawDouble).trim() };
+}
+export function expandPartials(source, partials, depth = 0) {
+    if (depth >= MAX_TEMPLATE_DEPTH)
+        return source;
+    let found = false;
+    const expanded = source.replace(PARTIAL_TOKEN, (_match, partialName) => {
+        found = true;
+        const partial = partials[String(partialName).trim()];
+        return typeof partial === 'string' ? partial : '';
     });
+    return found ? expandPartials(expanded, partials, depth + 1) : expanded;
 }
-export function renderTemplate(source, context) {
+function expandTrusted(source, context, escape) {
     let rendered = source;
-    for (let i = 0; i < 5; i += 1) {
-        const next = applyTemplate(rendered, context);
-        if (next === rendered)
+    for (let i = 0; i < MAX_TEMPLATE_DEPTH; i += 1) {
+        let found = false;
+        const next = rendered.replace(TEMPLATE_TOKEN, (match, rawTriple, rawDouble) => {
+            const { raw, key } = readToken(rawTriple, rawDouble);
+            if (!isTrustedKey(key))
+                return match;
+            found = true;
+            const value = getNestedValue(context, key);
+            return raw || !escape ? value : escapeHtml(value);
+        });
+        if (!found || next === rendered)
             break;
         rendered = next;
     }
     return rendered;
 }
-export function renderPartial(name, partials, context) {
-    const partial = partials[name];
-    return partial ? renderTemplate(partial, context) : '';
+/**
+ * A single substitution pass — the replacement text is never rescanned, so a
+ * caller-supplied value can never be reinterpreted as a template.
+ */
+export function substitute(source, context, escape) {
+    return source.replace(TEMPLATE_TOKEN, (_match, rawTriple, rawDouble) => {
+        const { raw, key } = readToken(rawTriple, rawDouble);
+        if (key === 'content') {
+            return typeof context.content === 'string' ? context.content : '';
+        }
+        if (key.startsWith('>')) {
+            return '';
+        }
+        const value = getNestedValue(context, key);
+        return raw || !escape ? value : escapeHtml(value);
+    });
+}
+export function renderTemplate(source, context, partials, escape) {
+    const composed = expandTrusted(expandPartials(source, partials), context, escape);
+    return substitute(composed, context, escape);
 }
 //# sourceMappingURL=render-email-template.utils.js.map

package/dist/src/functions/render-email-template.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-email-template.utils.js","sourceRoot":"","sources":["../../../src/functions/render-email-template.utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAC5B,MAA+B,EAC/B,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACjB,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,OAAgC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAgC;IAEhC,IAAI,QAAQ,GAAG,MAAM,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAK;QAC5B,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,QAAgC,EAChC,OAAgC;IAEhC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACxD,CAAC"}
+{"version":3,"file":"render-email-template.utils.js","sourceRoot":"","sources":["../../../src/functions/render-email-template.utils.ts"],"names":[],"mappings":"AAAA,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAA;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,qDAAqD,CAAA;AAE5E,MAAM,aAAa,GAAG,uCAAuC,CAAA;AAE7D,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B;;;;GAIG;AACH,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AAEpC,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAA+B,EAC/B,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACjB,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,SAAkB,EAAE,SAAkB;IACvD,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAA;IACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,QAAgC,EAChC,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,IAAI,kBAAkB;QAAE,OAAO,MAAM,CAAA;IAC9C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QACrE,KAAK,GAAG,IAAI,CAAA;QACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACzE,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,OAAgC,EAChC,MAAe;IAEf,IAAI,QAAQ,GAAG,MAAM,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAC3B,cAAc,EACd,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;YAC9B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACpD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpC,KAAK,GAAG,IAAI,CAAA;YACZ,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YAC1C,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACnD,CAAC,CACF,CAAA;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAK;QACtC,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,OAAgC,EAChC,MAAe;IAEf,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;QACrE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACpD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1C,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAgC,EAChC,QAAgC,EAChC,MAAe;IAEf,MAAM,QAAQ,GAAG,aAAa,CAC5B,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAChC,OAAO,EACP,MAAM,CACP,CAAA;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;AAC9C,CAAC"}

package/dist/src/functions/render-email-template.utils.test.js

@@ -1,6 +1,6 @@
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { getNestedValue, applyTemplate, renderTemplate, renderPartial, } from './render-email-template.utils.js';
+import { escapeHtml, expandPartials, getNestedValue, renderTemplate, substitute, } from './render-email-template.utils.js';
 describe('getNestedValue', () => {
     test('returns top-level string value', () => {
         assert.equal(getNestedValue({ name: 'Alice' }, 'name'), 'Alice');
@@ -21,45 +21,78 @@ describe('getNestedValue', () => {
         assert.equal(getNestedValue({ count: 42 }, 'count'), '42');
     });
 });
-describe('applyTemplate', () => {
+describe('escapeHtml', () => {
+    test('escapes the five html-significant characters', () => {
+        assert.equal(escapeHtml(`<a href="x" title='y'>&</a>`), '&lt;a href=&quot;x&quot; title=&#39;y&#39;&gt;&amp;&lt;/a&gt;');
+    });
+});
+describe('substitute', () => {
     test('replaces simple placeholder', () => {
-        assert.equal(applyTemplate('Hello {{ name }}!', { name: 'Bob' }), 'Hello Bob!');
+        assert.equal(substitute('Hello {{ name }}!', { name: 'Bob' }, false), 'Hello Bob!');
+    });
+    test('escapes the value when rendering html', () => {
+        assert.equal(substitute('<p>{{ name }}</p>', { name: '<b>Bob</b>' }, true), '<p>&lt;b&gt;Bob&lt;/b&gt;</p>');
+    });
+    test('leaves the value raw when rendering plain text', () => {
+        assert.equal(substitute('{{ name }}', { name: 'Ada & Bob' }, false), 'Ada & Bob');
     });
-    test('replaces {{content}} with context.content string', () => {
-        assert.equal(applyTemplate('Body: {{ content }}', { content: '<p>Hi</p>' }), 'Body: <p>Hi</p>');
+    test('renders the triple-brace form raw even in html', () => {
+        assert.equal(substitute('<p>{{{ name }}}</p>', { name: '<b>Bob</b>' }, true), '<p><b>Bob</b></p>');
+    });
+    test('replaces {{content}} with context.content string, unescaped', () => {
+        assert.equal(substitute('Body: {{ content }}', { content: '<p>Hi</p>' }, true), 'Body: <p>Hi</p>');
     });
     test('replaces {{content}} with empty string when not a string', () => {
-        assert.equal(applyTemplate('{{ content }}', { content: 123 }), '');
+        assert.equal(substitute('{{ content }}', { content: 123 }, true), '');
     });
     test('strips partial tags (> prefix)', () => {
-        assert.equal(applyTemplate('{{ > header }}', {}), '');
+        assert.equal(substitute('{{ > header }}', {}, true), '');
     });
     test('returns empty string for missing placeholder', () => {
-        assert.equal(applyTemplate('{{ missing }}', {}), '');
+        assert.equal(substitute('{{ missing }}', {}, true), '');
     });
     test('resolves dot-path placeholders', () => {
-        assert.equal(applyTemplate('{{ user.name }}', { user: { name: 'Carol' } }), 'Carol');
+        assert.equal(substitute('{{ user.name }}', { user: { name: 'Carol' } }, true), 'Carol');
+    });
+    test('does not rescan the substituted value', () => {
+        assert.equal(substitute('{{ a }}', { a: '{{ b }}', b: 'leaked' }, false), '{{ b }}');
     });
 });
-describe('renderTemplate', () => {
-    test('resolves single pass', () => {
-        assert.equal(renderTemplate('Hi {{ name }}', { name: 'Dave' }), 'Hi Dave');
+describe('expandPartials', () => {
+    test('inlines a known partial', () => {
+        assert.equal(expandPartials('{{> header }}', { header: '<h1>{{ title }}</h1>' }), '<h1>{{ title }}</h1>');
     });
-    test('resolves transitive placeholders up to 5 passes', () => {
-        const ctx = { greeting: 'Hi {{ name }}', name: 'Eve' };
-        assert.equal(renderTemplate('{{ greeting }}', ctx), 'Hi Eve');
+    test('inlines nested partials', () => {
+        assert.equal(expandPartials('{{> a }}', { a: 'A{{> b }}', b: 'B' }), 'AB');
     });
-    test('stops early when no more changes', () => {
-        assert.equal(renderTemplate('static', {}), 'static');
+    test('drops an unknown partial', () => {
+        assert.equal(expandPartials('x{{> missing }}y', {}), 'xy');
     });
 });
-describe('renderPartial', () => {
-    test('renders a known partial with context', () => {
-        const partials = { header: '<h1>{{ title }}</h1>' };
-        assert.equal(renderPartial('header', partials, { title: 'Welcome' }), '<h1>Welcome</h1>');
+describe('renderTemplate', () => {
+    test('resolves a caller variable in one pass', () => {
+        assert.equal(renderTemplate('Hi {{ name }}', { name: 'Dave' }, {}, false), 'Hi Dave');
+    });
+    test('expands a locale string that itself references a caller variable', () => {
+        const ctx = { t: { greeting: 'Hi {{ name }}' }, name: 'Eve' };
+        assert.equal(renderTemplate('{{ t.greeting }}', ctx, {}, false), 'Hi Eve');
+    });
+    test('never expands a caller value as a template', () => {
+        const ctx = { t: { note: 'secret' }, name: '{{ t.note }}' };
+        assert.equal(renderTemplate('{{ name }}', ctx, {}, false), '{{ t.note }}');
+    });
+    test('escapes a theme value landing in an attribute', () => {
+        const ctx = { theme: { fonts: { body: '"Segoe UI", sans-serif' } } };
+        assert.equal(renderTemplate('<p style="font-family:{{theme.fonts.body}};">', ctx, {}, true), '<p style="font-family:&quot;Segoe UI&quot;, sans-serif;">');
     });
-    test('returns empty string for unknown partial', () => {
-        assert.equal(renderPartial('missing', {}, {}), '');
+    test('renders partials before substitution', () => {
+        assert.equal(renderTemplate('{{> header }}', { title: 'Welcome' }, { header: '<h1>{{ title }}</h1>' }, true), '<h1>Welcome</h1>');
+    });
+    test('a caller value cannot forge a partial include', () => {
+        assert.equal(renderTemplate('{{ name }}', { name: '{{> header }}' }, { header: 'LEAKED' }, false), '{{> header }}');
+    });
+    test('stops early when no more changes', () => {
+        assert.equal(renderTemplate('static', {}, {}, true), 'static');
     });
 });
 //# sourceMappingURL=render-email-template.utils.test.js.map