[huangjeff5]

Replaces the Rust handlebarrz extension with a pure-Python dotpromptz-handlebars package (imported as dotpromptz_handlebars).

# before
from handlebarrz import Handlebars

hb = Handlebars()
# (Required Rust toolchain, sccache, and compiled binary wheels)

# after
from dotpromptz_handlebars import Handlebars

hb = Handlebars()
render = hb.compile('Hello {{user.name}}!')
output = render({'user': {'name': 'Alice'}})
# => Hello Alice!

Decisions

• Already-published dotpromptz 0.1.x still imports handlebarrz: pip install dotpromptz==0.1.6 depends on dotpromptz-handlebars>=0.1.8 without an upper bound, and those releases do from handlebarrz import Handlebars. The 0.2.0 wheel still includes that module so legacy installs keep working. Remove this compatibility shim in a future stable release (e.g. 1.0.0) after users have had sufficient time to upgrade to dotpromptz>=0.2.0.
• {} enters {{#if}} and {{#with}}: In Handlebars.js, {} is truthy and enters conditional blocks, while None, False, 0, "", and [] take else. We chose JS truthiness because a Dotprompt template must produce byte-for-byte identical output across TypeScript, Dart, and Python.
• Spec fidelity over Python stringification idioms: Handlebars stringifies objects as [object Object], lists as 1,2, and floats like 1.0 as 1. We preserve this behavior so prompt rendering is portable across SDKs; structured data in prompts should use {{json var}}.
• Context callables raise ValueError: Context payloads cannot supply executable callables. Dynamic logic must be explicitly registered via register_helper() to eliminate arbitrary template execution vulnerabilities.
• The json helper raises TypeError: Non-serializable inputs passed to {{json var}} now raise TypeError instead of ValueError, matching Python standard library json.dumps() semantics.
• Workflow hardening in python.yml and rust.yml: Deleting python/handlebarrz removed the need for Rust toolchains in python.yml and eliminated the python/handlebarrz/** path trigger in rust.yml. Touching these workflows triggered the repository's mandatory zizmor scanner, which blocks CI on unpinned action tags and known vulnerabilities (tj-actions/changed-files). Both workflows were hardened with immutable commit SHA action pins and least-privilege permissions so CI remains green.
• Clippy pedantic lint in completions.rs: The workspace enables -D clippy::pedantic. Newer Rust toolchains in GitHub Actions enforce clippy::assert_is_empty, which fails CI on assert!(!output.is_empty()). Updating the test assertion to assert_ne!(output, Vec::<u8>::new()) was required to keep the workspace Clippy check green.

[pavelgj]

A few comments/questions