Module template 

The parsed form of a declared command and its parameter substitution.

A declared command is parsed ONCE, at registration, into a fixed argv whose elements are either literal text or a named parameter reference. Substitution then replaces a reference with a parameter’s value as one whole argv element.

A parameter is written {{name}}, in one syntax, read the same way in every quoting region. There is no second spelling and no escape, because $ carries no meaning here for an escape to protect.

That structure is the security property, not a convenience. A parameter value never re-enters a parser, so it cannot introduce a word boundary, a quote, a pipe, a redirect, a ;, or a $(…). A value of ; rm -rf / is passed to the program as the single literal argument ; rm -rf /. There is no shell between the declaration and execve, so there is nothing for a value to escape into. Splicing values into a command STRING and handing it to sh -c would make every parameter an injection site; this crate never does that.

Structs

CommandTemplate

A declared command parsed into an executable argv with named holes.

Enums

SubstitutionError

A value supplied for a parameter could not be rendered into an argument.

TemplateError

A declared command could not be parsed into an executable argv.