svg_conform 0.2.4 → 0.2.6

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-malformed-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png,%GZ"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-unsupported-type.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:text/html;base64,PHA+eDwvcD4="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/file-like-fragment.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <use href="file:///etc/passwd#id"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/http.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="http://example.com/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/https.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="https://example.com/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/interaction.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <rect width="1" height="1" onclick="f()"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/protocol-relative.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="//example.com/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/relative-file-fragment.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <use href="other.svg#id"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/relative-file.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="images/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/script.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <script>alert(1)</script>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/svg-data-excessive-nesting.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxpbWFnZSBocmVmPSJkYXRhOmltYWdlL3N2Zyt4bWw7YmFzZTY0LFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanhwYldGblpTQm9jbVZtUFNKa1lYUmhPbWx0WVdkbEwzTjJaeXQ0Yld3N1ltRnpaVFkwTEZCSVRqSmFlVUkwWWxkNGRXTjZNR2xoU0ZJd1kwUnZka3d6WkROa2VUVXpUWGsxZG1OdFkzWk5ha0YzVFVNNWVtUnRZMmxRYW5od1lsZEdibHBUUW05amJWWnRVRk5LYTFsWVVtaFBiV3gwV1Zka2JFd3pUakphZVhRMFlsZDNOMWx0Um5wYVZGa3dURVpDU1ZScVNtRmxWVWt3V1d4a05HUlhUalpOUjJ4b1UwWkpkMWt3VW5aa2EzZDZXa1JPYTJWVVZYcFVXR3N4WkcxT2RGa3pXazVoYTBZelZGVk5OV1Z0VW5SWk1teFJZVzVvZDFsc1pFZGliSEJVVVcwNWFtSldXblJWUms1TFlURnNXVlZ0YUZCaVYzZ3dWMVprYTJKRmQzcFVha3BoWlZoUk1GbHNaRE5PTVd4MFVtNXdZVlpHYTNkVVJWcERVMVpTY1ZOdFJteFdWV3QzVjFkNGEwNUhVbGhVYWxwT1VqSjRiMVV3V2twa01XdDNWVzVhYTJFelpEWlhhMUpQWVRKV1ZWWlljRlZYUjNONFdrY3hUMlJHYTNwWGF6Vm9ZVEJaZWxaR1ZrNU9WMVowVlc1U1drMXRlRXRWTUZwM1pERmtjMkZIZEZKTmEydzJWMjV3YzFOdFJuSlNiVFZWVmxVMVExcFZWbk5TVmtwWVlrWkdhR0p0WnpGV01uaHJWREF4Um1KRmJHRlRSVXBvVlRCYVMyUnNWa2RVYTNCc1VsZDRkMVZYTURWWlZsbDVaVWhXV2xaWGFGTlVNVlp6WTFaS1dHSkZNV3hoYkVVd1ZrVlNUMVF3TVhOalJGcFBVa1JDY0ZSSWJ6QlBSWGQ2VkdwS1lXVnFVVGxKYVRnclVFTTVlbVJ0WXlzaUx6NDhMM04yWno0PSIvPjwvc3ZnPg=="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/svg-data-malformed-xml.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2Zz48Zz48L3N2Zz4="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/svg-data-nested-external.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj48aW1hZ2UgeGxpbms6aHJlZj0iaHR0cDovL2V4YW1wbGUuY29tL2EucG5nIi8+PC9zdmc+"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/urn.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="urn:example:a"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/xml-stylesheet.svg

@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="other.css"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <rect width="1" height="1"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/jpeg-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2Q=="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/jpeg-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/jpeg,%FF%D8%FF%E0%00%10%4A%46%49%46%00%01%01%00%00%01%00%01%00%00%FF%D9"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/png-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4z8AAAAMBAQDJ/pLvAAAAAElFTkSuQmCC"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/png-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png,%89%50%4E%47%0D%0A%1A%0A%00%00%00%0D%49%48%44%52%00%00%00%01%00%00%00%01%08%02%00%00%00%90%77%53%DE%00%00%00%0C%49%44%41%54%78%9C%63%F8%CF%C0%00%00%03%01%01%00%C9%FE%92%EF%00%00%00%00%49%45%4E%44%AE%42%60%82"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/same-document-fragment.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <defs><linearGradient id="g"/><rect id="r" width="1" height="1"/></defs><use href="#r"/><use xlink:href="#r"/><rect width="1" height="1" fill="url(#g)" style="stroke:url(#g)"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/svg-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxIDEiPjxyZWN0IHdpZHRoPSIxIiBoZWlnaHQ9IjEiLz48L3N2Zz4="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/svg-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;charset=utf-8,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 1 1%22%3E%3Crect width=%221%22 height=%221%22/%3E%3C/svg%3E"/>
+</svg>

data/spec/svg_conform/commands/check_command_spec.rb

@@ -29,7 +29,7 @@ RSpec.describe SvgConform::Commands::Check do
       options = { profile: "svg_1_2_rfc", format: "table" }
       command = described_class.new(tempfile.path, options)
 
-      expect { command.execute }.to output(/SVG Validation Report/).to_stdout
+      expect { command.execute }.to output(/profile svg_1_2_rfc\nVALID|profile svg_1_2_rfc\nINVALID/).to_stdout
         .and raise_error(SystemExit)
 
       tempfile.unlink
@@ -43,7 +43,7 @@ RSpec.describe SvgConform::Commands::Check do
       options = { profile: "svg_1_2_rfc", format: "table" }
       command = described_class.new(tempfile.path, options)
 
-      expect { command.execute }.to output(/Validation Errors/).to_stdout
+      expect { command.execute }.to output(/INVALID: .*\n\nerror  /).to_stdout
         .and raise_error(SystemExit)
 
       tempfile.unlink
@@ -77,6 +77,26 @@ RSpec.describe SvgConform::Commands::Check do
       tempfile.unlink
     end
 
+    it "renders JSON from the canonical report, keeping the info diagnostic" do
+      fixture = File.expand_path("../../fixtures/diagnostics/external-reference-info.svg",
+                                 __dir__)
+      options = { profile: "svg_1_2_rfc", format: "json" }
+      command = described_class.new(fixture, options)
+
+      expect { command.execute }
+        .to output(/"infos": 1.*"requirement_id": "link_validation".*"severity": "info"|"severity": "info".*"requirement_id": "link_validation"/m)
+        .to_stdout.and raise_error(SystemExit) { |e| expect(e.status).to eq(0) }
+    end
+
+    it "renders the info diagnostic in the human (table) format" do
+      fixture = File.expand_path("../../fixtures/diagnostics/external-reference-info.svg",
+                                 __dir__)
+      command = described_class.new(fixture, { profile: "svg_1_2_rfc", format: "table" })
+
+      expect { command.execute }.to output(/info  link_validation/).to_stdout
+        .and raise_error(SystemExit)
+    end
+
     it "handles missing files gracefully" do
       options = { profile: "svg_1_2_rfc", format: "table" }
       command = described_class.new("nonexistent.svg", options)

data/spec/svg_conform/commands/profiles_command_spec.rb

@@ -16,5 +16,23 @@ RSpec.describe SvgConform::Commands::Profiles do
 
       expect { command.execute }.to output(/Available SVG Profiles/).to_stdout
     end
+
+    it "lists the SVG 1.1 Full static profile (name is truncated by the table)" do
+      command = described_class.new({})
+
+      expect { command.execute }.to output(/svg_1_1_full_.*SVG 1.1 Full/m).to_stdout
+    end
+
+    it "shows the svg_1_1_full_static requirements in verbose mode" do
+      command = described_class.new({ verbose: true })
+
+      expect { command.execute }
+        .to output(/Profile: svg_1_1_full_static.*Svg11DocumentRequirement/m).to_stdout
+    end
+
+    it "lists the opt-in svg_2_secure_static profile" do
+      expect { described_class.new({}).execute }
+        .to output(/svg_2_secure/).to_stdout
+    end
   end
 end

data/spec/svg_conform/conformance_report_spec.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe SvgConform::ConformanceReport do
+  let(:invalid_svg) { '<svg xmlns="http://www.w3.org/2000/svg"><rect width="5" height="5" fill="red"/></svg>' }
+  let(:result) { SvgConform::Validator.new.validate(invalid_svg, profile: :svg_1_2_rfc) }
+
+  describe ".from_svg_conform_result" do
+    it "does not include info diagnostics in the legacy channels" do
+      info = SvgConform::Validator.new.validate_file(
+        File.expand_path("../fixtures/diagnostics/external-reference-info.svg", __dir__),
+        profile: :svg_1_2_rfc,
+      )
+      report = described_class.from_svg_conform_result("i.svg", info)
+
+      expect(report.valid).to be(true)
+      expect(report.errors.total_count).to eq(0)
+      expect(report.warnings.total_count).to eq(0)
+    end
+
+    it "still accepts use_svgcheck_mapping" do
+      report = described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc,
+                                                                        use_svgcheck_mapping: true)
+
+      expect(report).to be_a(described_class)
+    end
+
+    context "with lens_core installed" do
+      before do
+        unless SvgConform.lens_core_available?
+          skip "the optional lens_core gem is not installed"
+        end
+      end
+
+      it "keeps its signature and legacy shape, projected from the canonical report" do
+        report = described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc)
+        canonical = result.to_lens_core_report
+
+        expect(report.tool).to eq("svg_conform")
+        expect(report.filename).to eq("t.svg")
+        expect(report.valid).to eq(canonical.valid)
+        expect(report.errors.total_count).to eq(canonical.summary["errors"])
+        expect(report.warnings.total_count).to eq(canonical.summary["warnings"])
+        expect(report.errors.issues.map(&:message))
+          .to eq(canonical.diagnostics.select(&:error?).map(&:message))
+        expect(report.errors.by_requirement.values.sum).to eq(report.errors.total_count)
+        expect(report.to_yaml).to include("errors:", "total_count:", "by_requirement:")
+      end
+
+      it "does not mutate the canonical report" do
+        before = result.to_lens_core_report.to_h
+        described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc,
+                                                                 use_svgcheck_mapping: true)
+
+        expect(result.to_lens_core_report.to_h).to eq(before)
+      end
+    end
+
+    context "without lens_core" do
+      before do
+        if SvgConform.lens_core_available?
+          skip "lens_core is installed; the direct projection is not in effect"
+        end
+      end
+
+      it "projects the validation result directly" do
+        report = described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc)
+
+        expect(report.tool).to eq("svg_conform")
+        expect(report.filename).to eq("t.svg")
+        expect(report.valid).to be(false)
+        expect(report.errors.total_count).to eq(result.errors.length)
+        expect(report.errors.by_requirement.values.sum).to eq(report.errors.total_count)
+        expect(report.errors.issues.map(&:requirement_id).sort)
+          .to eq(result.errors.map(&:requirement_id).sort)
+        expect(report.to_yaml).to include("errors:", "total_count:", "by_requirement:")
+      end
+    end
+  end
+
+  describe ".from_svgcheck_result" do
+    it "remains callable and reports valid for empty output" do
+      report = described_class.from_svgcheck_result("t.svg", "")
+
+      expect(report.tool).to eq("svgcheck")
+      expect(report.valid).to be(true)
+    end
+  end
+end

data/spec/svg_conform/diagnostics/lens_core_adapter_spec.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe SvgConform::Diagnostics::LensCoreAdapter do
+  let(:requirement) do
+    SvgConform::Requirements::ViewboxRequiredRequirement.new(
+      id: "viewbox_required", description: "d",
+      citation_uri: "https://example.com/spec#viewbox",
+      citation_label: "Spec viewBox"
+    )
+  end
+  let(:profile) do
+    SvgConform::Profile.new(
+      name: "demo", specification_uri: "https://example.com/spec",
+      specification_label: "Demo Spec", requirements: [requirement]
+    )
+  end
+  let(:node) { Struct.new(:line, :column, :name).new(3, 5, "svg") }
+  let(:context) { SvgConform::ValidationContext.new(nil, profile) }
+  let(:result) { SvgConform::ValidationResult.new(nil, profile, context) }
+
+  def add_all(data: {})
+    context.add_error(node: node, message: "bad error", requirement_id: "viewbox_required",
+                      data: data)
+    context.add_error(node: node, message: "bad validity", requirement_id: "id_reference",
+                      severity: :validity_error)
+    context.add_warning(rule: Struct.new(:id).new("warn_rule"), node: node, message: "a warning")
+    context.add_notice(rule: nil, node: node, message: "an info", requirement_id: "some_notice")
+  end
+
+  describe ".call" do
+    it "maps all four channels to one schema-valid report in channel order" do
+      add_all
+      report = described_class.call(result, filename: "f.svg")
+
+      expect(report).to be_a(LensCore::Report)
+      expect(report.valid).to be(false)
+      expect(report.summary).to eq("errors" => 2, "warnings" => 1, "infos" => 1)
+      expect(report.diagnostics.map { |d| [d.severity, d.requirement_id] }).to eq(
+        [%w[error viewbox_required], %w[error id_reference],
+         %w[warning warn_rule], %w[info some_notice]],
+      )
+      expect(report.diagnostics[1].kind).to eq("validity")
+      expect(report.diagnostics[3].kind).to eq("notice")
+      expect(report.extensions["file"]).to eq("f.svg")
+
+      reparsed = LensCore::Parsers::Json.parse(LensCore::Renderers::Json.render(report))
+      expect(reparsed).to eq(report)
+    end
+
+    it "keeps validity based on errors and validity errors only" do
+      context.add_warning(rule: "w", node: node, message: "w")
+      context.add_notice(rule: nil, node: node, message: "i", requirement_id: "x")
+
+      expect(described_class.call(result).valid).to be(true)
+    end
+
+    it "carries location, remediation fields and explicit IDs" do
+      add_all
+      error = described_class.call(result).diagnostics.first
+
+      expect(error.location.line).to eq(3)
+      expect(error.location.column).to eq(5)
+      expect(error.remediation).to eq("Add missing viewBox attribute")
+      expect(error.context).to include("element" => "svg", "fixable" => false,
+                                       "remediation_type" => "add")
+    end
+
+    it "maps source-level line and column data to an XML location" do
+      context.add_error(node: nil, message: "css", requirement_id: "viewbox_required",
+                        data: { line: 7, column: 2 })
+      context.add_error(node: nil, message: "bad", requirement_id: "viewbox_required",
+                        data: { line: 0, column: "x" })
+      context.add_error(node: node, message: "node", requirement_id: "viewbox_required",
+                        data: { line: 99 })
+      first, second, third = described_class.call(result).diagnostics
+
+      expect(first.location.to_h).to include("line" => 7, "column" => 2)
+      expect(second.location).to be_nil
+      expect(third.location.line).to eq(3)
+    end
+
+    it "turns profile and requirement citations into LensCore citations" do
+      add_all
+      report = described_class.call(result)
+
+      expect(report.profile.citations.map(&:to_h)).to eq(
+        [{ "uri" => "https://example.com/spec", "label" => "Demo Spec" }],
+      )
+      expect(report.diagnostics.first.citations.map(&:uri)).to eq(["https://example.com/spec#viewbox"])
+      expect(report.diagnostics[2].citations).to eq([])
+    end
+
+    it "only includes a timestamp when supplied" do
+      add_all
+      expect(described_class.call(result).timestamp).to be_nil
+      expect(described_class.call(result, timestamp: "2026-10-23T00:00:00Z").to_h["timestamp"])
+        .to eq("2026-10-23T00:00:00Z")
+    end
+
+    it "normalizes symbols in issue data to JSON primitives" do
+      add_all(data: { attribute: :fill, nested: [1, { ok: true }] })
+      data = described_class.call(result).diagnostics.first.context["data"]
+
+      expect(data).to eq("attribute" => "fill", "nested" => [1, { "ok" => true }])
+    end
+
+    it "fails deterministically for JSON-unsafe issue data" do
+      add_all(data: { thing: Object.new })
+
+      expect { described_class.call(result) }
+        .to raise_error(SvgConform::Diagnostics::UnsupportedContextError,
+                        /unsupported value of type Object at data\.thing/)
+    end
+  end
+
+  describe "profile loading" do
+    it "keeps citations through YAML loading" do
+      loaded = SvgConform::Profile.from_yaml(<<~YAML)
+        name: yaml_demo
+        specification_uri: https://example.com/s
+        specification_label: S
+        requirements:
+          - id: viewbox_required
+            type: ViewboxRequiredRequirement
+            citation_uri: https://example.com/s#v
+            citation_label: V
+      YAML
+
+      expect(loaded.specification_uri).to eq("https://example.com/s")
+      expect(loaded.get_requirement("viewbox_required").citation_uri).to eq("https://example.com/s#v")
+      expect(loaded.get_requirement("viewbox_required").citation_label).to eq("V")
+    end
+  end
+end

data/spec/svg_conform/gemspec_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "svg_conform.gemspec" do # rubocop:disable RSpec/DescribeClass
+  let(:specification) { Gem::Specification.load("svg_conform.gemspec") }
+
+  it "does not gate installation on the unpublished lens_core gem" do
+    # lens_core is optional: the canonical diagnostics renderer rides it
+    # when installed, and the plain structural serializers answer when
+    # not. A runtime dependency on the unpublished gem made 0.2.5
+    # uninstallable for every consumer.
+    expect(specification.runtime_dependencies.map(&:name)).not_to include("lens_core")
+    expect(File.read("lib/svg_conform.rb")).to include("rescue LoadError")
+  end
+
+  it "exposes the lens_core availability probe" do
+    expect(SvgConform).to respond_to(:lens_core_available?)
+    expect(SvgConform.lens_core_available?).to be_truthy.or be_falsey
+  end
+end

data/spec/svg_conform/profiles/svg_1_1_full_static_profile_spec.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "svg_conform/profile_compiler"
+
+# Path is fixed by the card; the cop expects svg11_ instead of svg_1_1_.
+RSpec.describe "svg_1_1_full_static profile" do # rubocop:disable RSpec/DescribeClass
+  let(:profile) { SvgConform::Profiles.get("svg_1_1_full_static") }
+  let(:fixtures) { File.expand_path("../../fixtures/profiles/svg_1_1_full_static", __dir__) }
+  let(:matrix) do
+    {
+      "svg11.document.xml" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments",
+      "svg11.document.root" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElement",
+      "svg11.document.version" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElementVersionAttribute",
+      "svg11.document.grammar" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments",
+      "svg11.document.css2" => "https://www.w3.org/TR/2008/REC-CSS2-20080411/grammar.html",
+      "svg11.document.xml_stylesheet" => "https://www.w3.org/TR/1999/REC-xml-stylesheet-19990629/",
+      "svg11.processing.script" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers",
+      "svg11.processing.animation" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers",
+      "svg11.processing.interaction" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers",
+    }
+  end
+  let(:invalid_cases) do
+    {
+      "malformed-xml" => "svg11.document.xml",
+      "wrong-namespace" => "svg11.document.root",
+      "wrong-version" => "svg11.document.version",
+      "dtd-content-model" => "svg11.document.grammar",
+      "dtd-attribute" => "svg11.document.grammar",
+      "css-grammar" => "svg11.document.css2",
+      "xml-stylesheet" => "svg11.document.xml_stylesheet",
+      "script" => "svg11.processing.script",
+      "animation" => "svg11.processing.animation",
+      "interaction" => "svg11.processing.interaction",
+    }
+  end
+
+  def fixture(kind, name)
+    File.join(fixtures, kind, "#{name}.svg")
+  end
+
+  def sax_errors(path)
+    SvgConform::SaxDocument.from_file(path).validate_with_profile(profile).errors
+  end
+
+  def dom_errors(path)
+    profile.validate(SvgConform::Document.from_file(path)).errors
+  end
+
+  def ids(errors)
+    errors.map(&:requirement_id).uniq.sort - ["parse_error"]
+  end
+
+  it "is listed, opt-in and does not change the default profile" do
+    expect(SvgConform::Profiles.available_profiles).to include(:svg_1_1_full_static)
+    expect(profile.name).to eq("svg_1_1_full_static")
+    expect(profile.specification_uri)
+      .to eq("https://www.w3.org/TR/2011/REC-SVG11-20110816/")
+    expect(SvgConform::Validator.new.method(:validate).parameters)
+      .to include(%i[key profile])
+    expect(SvgConform::Validator.instance_method(:validate_file)
+      .parameters).to include(%i[key profile])
+    expect(profile.remediations.to_a).to be_empty
+  end
+
+  it "covers the nine stable ids with their normative citations" do
+    declared = profile.requirements.flat_map do |req|
+      req.respond_to?(:categories) ? req.categories.map { |c| [c.id, c.citation] } : [[req.id, req.citation_uri]]
+    end
+    expect(declared.to_h).to eq(matrix)
+  end
+
+  it "builds through the existing class map and compiler" do
+    expect(SvgConform::Profile::REQUIREMENTS_CLASS_MAP)
+      .to include("Svg11DocumentRequirement", "ProcessingFeaturesRequirement")
+    compiled = SvgConform::ProfileCompiler.compile("svg_1_1_full_static")
+    expect(compiled.requirements.map { |req| req.class.name.split("::").last }.uniq)
+      .to eq(%w[Svg11DocumentRequirement ProcessingFeaturesRequirement])
+  end
+
+  %w[minimal-full css xml-stylesheet foreign-metadata].each do |name|
+    it "accepts valid/#{name}.svg identically in DOM and SAX" do
+      path = fixture("valid", name)
+      expect(dom_errors(path)).to be_empty
+      expect(sax_errors(path)).to be_empty
+    end
+  end
+
+  it "rejects each invalid fixture with the expected id in DOM and SAX" do
+    invalid_cases.each do |name, id|
+      path = fixture("invalid", name)
+      sax = ids(sax_errors(path))
+      expect(sax).to include(id), name
+      if name == "malformed-xml"
+        # DOM cannot build a document from malformed XML at all.
+        expect { SvgConform::Document.from_file(path) }
+          .to raise_error(SvgConform::ParseError)
+      else
+        expect(ids(dom_errors(path))).to eq(sax), name
+      end
+    end
+  end
+
+  it "gives every error a normative citation, through issues and LensCore" do
+    invalid_cases.each_key do |name|
+      result = SvgConform::SaxDocument.from_file(fixture("invalid", name)).validate_with_profile(profile)
+      cited = result.errors.reject { |e| e.requirement_id == "parse_error" }
+      expect(cited).not_to be_empty
+      cited.each do |error|
+        expect(matrix.values).to include(error.data[:citation]), "#{name} #{error.requirement_id}"
+      end
+      report = SvgConform::Diagnostics::LensCoreAdapter.call(result)
+      report.diagnostics.each do |diag|
+        next if diag.requirement_id == "parse_error"
+
+        expect(diag.citations.map(&:uri) & matrix.values).not_to be_empty
+      end
+    end
+  end
+
+  it "validates a file input and a string input identically" do
+    path = fixture("invalid", "wrong-version")
+    from_string = SvgConform::SaxDocument.from_content(File.read(path))
+      .validate_with_profile(profile)
+    expect(ids(from_string.errors)).to eq(ids(sax_errors(path)))
+    dom_string = profile.validate(SvgConform::Document.from_content(File.read(path)))
+    expect(ids(dom_string.errors)).to eq(ids(from_string.errors))
+  end
+
+  it "does not claim Tiny or Basic and offers no remediation" do
+    expect(profile.description).not_to match(/tiny|basic/i)
+    expect(profile.remediation_count).to eq(0)
+  end
+
+  it "runs through the CLI check command and prints a JSON report" do
+    command = SvgConform::Commands::Check.new(
+      fixture("valid", "minimal-full"),
+      { profile: "svg_1_1_full_static", format: "json" },
+    )
+    expect do
+      expect { command.execute }.to raise_error(SystemExit) do |error|
+        expect(error.status).to eq(0)
+      end
+    end.to output(/"id": "svg_1_1_full_static".*"valid": true/m).to_stdout
+  end
+end