| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Element-per-field; attributes carry identity only and there is no mixed
content, so a consumer's XPath never has to distinguish the two.
Schema validation is an opt-in make check-schema via xmllint, not an
in-suite assertion: validating XSD needs an XML library and the
dependency list is frozen. It prints SKIPPED loudly when xmllint is
absent, because a silent skip reads as a pass. The suite asserts
well-formedness properties directly instead.
This corrects the design spec, which claimed in-test validation.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
view.ml's rank_label field was a byte-for-byte copy of the celebration's
name (names_value cel.Celebration.names), not a localized rank label at
all -- the kernel has no per-language rank names to draw one from, so
there was no honest value to put there. Nothing consumed it: no
template in the plan, no test, no other code referenced it.
Removed from both day_value and padding_cell so the two key sets stay
identical (23 keys each, verified). schema/day-v1.json already
described 23 keys and needed no change -- it now matches the emitted
output exactly.
schema/day-v1.json is a published contract: once a phone subscribes or
a site fetches this, removing a field is a breaking /v2/ change. The
time to remove a field that lies about its own contents is before
anyone can depend on it, not after.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Both consume the VIEW, not the kernel, so every emitter and every
template describe exactly the same fields -- there is one vocabulary,
not five.
CSV is RFC 4180: a field with a comma is quoted. That is live on real
data, not hypothetical -- 'St. Joseph, Spouse of the Bl. Virgin Mary'
would otherwise split into two columns.
JSON is hand-rolled because the dependency list is frozen and escaping
is the only subtlety. Control characters below 0x20 are \u-escaped per
RFC 8259 section 7.
There are no numbers in the view, deliberately: a consumer never has to
guess whether week is 2 or "2".
schema/day-v1.json pins the shape. Once a phone subscribes or a site
fetches this, it is a promise to strangers -- adding a field is minor,
renaming one means /v2/.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Shapes a civil year of resolved days into the value a template renders
against. This layer is why the engine can stay logic-less: a month grid
needs leading blank cells, week bucketing and an in-month test, and a
logic-less template can compute none of it.
Both weeks and days are offered at every level -- the booklet walks
days, the grid walks weeks -- so the two artefacts cannot drift.
Colours are six booleans, not hex: hex bakes a presentation policy into
the engine, and LaTeX, groff and HTML each want a different colour
expression. Asserted: exactly one of the six is true on every day of a
whole year, so a template keying off them can never get none or two.
Padding cells carry every field a real day carries, empty, so a template
never hits a missing key mid-grid.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Every interpolated value is escaped for the template's flavour; the
template's own literal text never is, because that is the author's
markup. There is no raw form, so a template cannot opt out.
Scope is a stack with outward fallback, so a grid template can reach the
year number from inside a week without the view duplicating it into
every cell.
A missing key renders empty -- the one deliberate silence, so a template
survives a rite that does not set every optional field.
Mutation-tested: dropping the Escape.apply call reddens the
data-cannot-escape-flavour case.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
F1: test_no_raw_or_partial_form's first assertion only excluded one
literal shape (Ok [Var ["{name"]]), so it could not actually catch a
future raw/unescaped constructor under a different name. Replace it
with an assertion of the real parse result for {{{name}}}
(Ok [Var ["{name"]; Text "}"]), documented behaviour rather than a
guarantee this test cannot check -- the real guarantee is structural:
node has exactly four constructors and none of them is raw.
F2: {{.}}, {{#}}, {{^}} and {{/}} used to parse to a Var/Section/
Inverted with an empty path, reachable but never designed. This engine
has no "current context" for a bare dot to mean, so a bare-dot or
empty-sigil path is now a parse error at lex time, covering all four
sigil forms via one path helper. The existing "empty tag {{}}" branch
is unchanged and still reachable (a fully empty body is a distinct
case from a sigil with an empty path).
|
| |
|
|
|
|
|
|
|
|
|
| |
Placeholders, sections, inverted sections, comments. Nothing else: no
partials, no lambdas, no expression evaluation, no raw form. A template
is data, never a program, which is what keeps an untrusted template safe.
Errors rather than silence on a malformed template: an unterminated tag,
an unclosed section, a mismatched close and a partial all return Error.
Swallowing '{{name' as text is how a typo becomes invisible missing
output in a printed booklet.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
fold_ics's UTF-8 backoff loop could back `cut` all the way down to
`pos` on 74+ consecutive continuation bytes (0x80-0xBF), producing a
zero-length chunk and recursing on the identical position forever --
not producible by valid UTF-8, whose longest continuation run is 3,
but the kernel's own totality requirement covers arbitrary octet
strings, not only valid ones. When backoff finds no boundary inside
the window, cut hard at the limit instead, so forward progress is
unconditional.
test_fold_never_splits_utf8 previously asserted only that unfolding
reproduced the original bytes, a property folding preserves at any
cut position and therefore blind to a boundary violation. It now also
asserts the named property directly: no continuation chunk may start
with a UTF-8 continuation byte. A new regression test feeds fold_ics
100 consecutive continuation bytes and asserts it terminates with
every line at or under 75 octets.
|
|
|
Six flavours: latex, groff, html, xml, ics, none. Markdown, AsciiDoc and
plain text map to none deliberately -- their metacharacters are
context-dependent and escaping them aggressively produces worse output
than not escaping.
An unrecognised extension returns None rather than falling back to none:
guessing the flavour wrong produces malformed output that looks fine
until it does not.
Folding backs off to a non-continuation byte, so a fold never splits a
UTF-8 sequence -- the failure mode that would corrupt Polish and Latin
names in a published feed.
|
