svg_conform 0.2.4 → 0.2.7

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-bad-png.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png;base64,bm90IGEgcG5n"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-empty-png.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png;base64,"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-malformed-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png;base64,%%%not-base64"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-malformed-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png,%GZ"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/data-unsupported-type.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:text/html;base64,PHA+eDwvcD4="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/file-like-fragment.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <use href="file:///etc/passwd#id"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/http.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="http://example.com/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/https.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="https://example.com/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/interaction.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <rect width="1" height="1" onclick="f()"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/protocol-relative.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="//example.com/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/relative-file-fragment.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <use href="other.svg#id"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/relative-file.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="images/a.png"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/script.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <script>alert(1)</script>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/svg-data-excessive-nesting.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxpbWFnZSBocmVmPSJkYXRhOmltYWdlL3N2Zyt4bWw7YmFzZTY0LFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanhwYldGblpTQm9jbVZtUFNKa1lYUmhPbWx0WVdkbEwzTjJaeXQ0Yld3N1ltRnpaVFkwTEZCSVRqSmFlVUkwWWxkNGRXTjZNR2xoU0ZJd1kwUnZka3d6WkROa2VUVXpUWGsxZG1OdFkzWk5ha0YzVFVNNWVtUnRZMmxRYW5od1lsZEdibHBUUW05amJWWnRVRk5LYTFsWVVtaFBiV3gwV1Zka2JFd3pUakphZVhRMFlsZDNOMWx0Um5wYVZGa3dURVpDU1ZScVNtRmxWVWt3V1d4a05HUlhUalpOUjJ4b1UwWkpkMWt3VW5aa2EzZDZXa1JPYTJWVVZYcFVXR3N4WkcxT2RGa3pXazVoYTBZelZGVk5OV1Z0VW5SWk1teFJZVzVvZDFsc1pFZGliSEJVVVcwNWFtSldXblJWUms1TFlURnNXVlZ0YUZCaVYzZ3dWMVprYTJKRmQzcFVha3BoWlZoUk1GbHNaRE5PTVd4MFVtNXdZVlpHYTNkVVJWcERVMVpTY1ZOdFJteFdWV3QzVjFkNGEwNUhVbGhVYWxwT1VqSjRiMVV3V2twa01XdDNWVzVhYTJFelpEWlhhMUpQWVRKV1ZWWlljRlZYUjNONFdrY3hUMlJHYTNwWGF6Vm9ZVEJaZWxaR1ZrNU9WMVowVlc1U1drMXRlRXRWTUZwM1pERmtjMkZIZEZKTmEydzJWMjV3YzFOdFJuSlNiVFZWVmxVMVExcFZWbk5TVmtwWVlrWkdhR0p0WnpGV01uaHJWREF4Um1KRmJHRlRSVXBvVlRCYVMyUnNWa2RVYTNCc1VsZDRkMVZYTURWWlZsbDVaVWhXV2xaWGFGTlVNVlp6WTFaS1dHSkZNV3hoYkVVd1ZrVlNUMVF3TVhOalJGcFBVa1JDY0ZSSWJ6QlBSWGQ2VkdwS1lXVnFVVGxKYVRnclVFTTVlbVJ0WXlzaUx6NDhMM04yWno0PSIvPjwvc3ZnPg=="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/svg-data-malformed-xml.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2Zz48Zz48L3N2Zz4="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/svg-data-nested-external.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj48aW1hZ2UgeGxpbms6aHJlZj0iaHR0cDovL2V4YW1wbGUuY29tL2EucG5nIi8+PC9zdmc+"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/urn.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="urn:example:a"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/invalid/xml-stylesheet.svg

@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="other.css"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <rect width="1" height="1"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/jpeg-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2Q=="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/jpeg-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/jpeg,%FF%D8%FF%E0%00%10%4A%46%49%46%00%01%01%00%00%01%00%01%00%00%FF%D9"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/png-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4z8AAAAMBAQDJ/pLvAAAAAElFTkSuQmCC"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/png-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/png,%89%50%4E%47%0D%0A%1A%0A%00%00%00%0D%49%48%44%52%00%00%00%01%00%00%00%01%08%02%00%00%00%90%77%53%DE%00%00%00%0C%49%44%41%54%78%9C%63%F8%CF%C0%00%00%03%01%01%00%C9%FE%92%EF%00%00%00%00%49%45%4E%44%AE%42%60%82"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/same-document-fragment.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <defs><linearGradient id="g"/><rect id="r" width="1" height="1"/></defs><use href="#r"/><use xlink:href="#r"/><rect width="1" height="1" fill="url(#g)" style="stroke:url(#g)"/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/svg-base64.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxIDEiPjxyZWN0IHdpZHRoPSIxIiBoZWlnaHQ9IjEiLz48L3N2Zz4="/>
+</svg>

data/spec/fixtures/profiles/svg_2_secure_static/valid/svg-percent.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 10 10">
+  <image width="1" height="1" href="data:image/svg+xml;charset=utf-8,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 1 1%22%3E%3Crect width=%221%22 height=%221%22/%3E%3C/svg%3E"/>
+</svg>

data/spec/fixtures/quality_metrics/aliases.yml

@@ -0,0 +1,7 @@
+remediable_types: &violation_types
+  - :reference_violation
+severity_levels:
+  critical:
+    violation_types: *violation_types
+    default_weight: 5
+    max_penalty: 20

data/spec/svg_conform/commands/check_command_spec.rb

@@ -29,7 +29,7 @@ RSpec.describe SvgConform::Commands::Check do
       options = { profile: "svg_1_2_rfc", format: "table" }
       command = described_class.new(tempfile.path, options)
 
-      expect { command.execute }.to output(/SVG Validation Report/).to_stdout
+      expect { command.execute }.to output(/profile svg_1_2_rfc\nVALID|profile svg_1_2_rfc\nINVALID/).to_stdout
         .and raise_error(SystemExit)
 
       tempfile.unlink
@@ -43,7 +43,7 @@ RSpec.describe SvgConform::Commands::Check do
       options = { profile: "svg_1_2_rfc", format: "table" }
       command = described_class.new(tempfile.path, options)
 
-      expect { command.execute }.to output(/Validation Errors/).to_stdout
+      expect { command.execute }.to output(/INVALID: .*\n\nerror  /).to_stdout
         .and raise_error(SystemExit)
 
       tempfile.unlink
@@ -77,6 +77,26 @@ RSpec.describe SvgConform::Commands::Check do
       tempfile.unlink
     end
 
+    it "renders JSON from the canonical report, keeping the info diagnostic" do
+      fixture = File.expand_path("../../fixtures/diagnostics/external-reference-info.svg",
+                                 __dir__)
+      options = { profile: "svg_1_2_rfc", format: "json" }
+      command = described_class.new(fixture, options)
+
+      expect { command.execute }
+        .to output(/"infos": 1.*"requirement_id": "link_validation".*"severity": "info"|"severity": "info".*"requirement_id": "link_validation"/m)
+        .to_stdout.and raise_error(SystemExit) { |e| expect(e.status).to eq(0) }
+    end
+
+    it "renders the info diagnostic in the human (table) format" do
+      fixture = File.expand_path("../../fixtures/diagnostics/external-reference-info.svg",
+                                 __dir__)
+      command = described_class.new(fixture, { profile: "svg_1_2_rfc", format: "table" })
+
+      expect { command.execute }.to output(/info  link_validation/).to_stdout
+        .and raise_error(SystemExit)
+    end
+
     it "handles missing files gracefully" do
       options = { profile: "svg_1_2_rfc", format: "table" }
       command = described_class.new("nonexistent.svg", options)

data/spec/svg_conform/commands/profiles_command_spec.rb

@@ -16,5 +16,23 @@ RSpec.describe SvgConform::Commands::Profiles do
 
       expect { command.execute }.to output(/Available SVG Profiles/).to_stdout
     end
+
+    it "lists the SVG 1.1 Full static profile (name is truncated by the table)" do
+      command = described_class.new({})
+
+      expect { command.execute }.to output(/svg_1_1_full_.*SVG 1.1 Full/m).to_stdout
+    end
+
+    it "shows the svg_1_1_full_static requirements in verbose mode" do
+      command = described_class.new({ verbose: true })
+
+      expect { command.execute }
+        .to output(/Profile: svg_1_1_full_static.*Svg11DocumentRequirement/m).to_stdout
+    end
+
+    it "lists the opt-in svg_2_secure_static profile" do
+      expect { described_class.new({}).execute }
+        .to output(/svg_2_secure/).to_stdout
+    end
   end
 end

data/spec/svg_conform/conformance_report_spec.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe SvgConform::ConformanceReport do
+  let(:invalid_svg) { '<svg xmlns="http://www.w3.org/2000/svg"><rect width="5" height="5" fill="red"/></svg>' }
+  let(:result) { SvgConform::Validator.new.validate(invalid_svg, profile: :svg_1_2_rfc) }
+
+  describe ".from_svg_conform_result" do
+    it "does not include info diagnostics in the legacy channels" do
+      info = SvgConform::Validator.new.validate_file(
+        File.expand_path("../fixtures/diagnostics/external-reference-info.svg", __dir__),
+        profile: :svg_1_2_rfc,
+      )
+      report = described_class.from_svg_conform_result("i.svg", info)
+
+      expect(report.valid).to be(true)
+      expect(report.errors.total_count).to eq(0)
+      expect(report.warnings.total_count).to eq(0)
+    end
+
+    it "still accepts use_svgcheck_mapping" do
+      report = described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc,
+                                                                        use_svgcheck_mapping: true)
+
+      expect(report).to be_a(described_class)
+    end
+
+    context "with lens_core installed" do
+      before do
+        unless SvgConform.lens_core_available?
+          skip "the optional lens_core gem is not installed"
+        end
+      end
+
+      it "keeps its signature and legacy shape, projected from the canonical report" do
+        report = described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc)
+        canonical = result.to_lens_core_report
+
+        expect(report.tool).to eq("svg_conform")
+        expect(report.filename).to eq("t.svg")
+        expect(report.valid).to eq(canonical.valid)
+        expect(report.errors.total_count).to eq(canonical.summary["errors"])
+        expect(report.warnings.total_count).to eq(canonical.summary["warnings"])
+        expect(report.errors.issues.map(&:message))
+          .to eq(canonical.diagnostics.select(&:error?).map(&:message))
+        expect(report.errors.by_requirement.values.sum).to eq(report.errors.total_count)
+        expect(report.to_yaml).to include("errors:", "total_count:", "by_requirement:")
+      end
+
+      it "does not mutate the canonical report" do
+        before = result.to_lens_core_report.to_h
+        described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc,
+                                                                 use_svgcheck_mapping: true)
+
+        expect(result.to_lens_core_report.to_h).to eq(before)
+      end
+    end
+
+    context "without lens_core" do
+      before do
+        if SvgConform.lens_core_available?
+          skip "lens_core is installed; the direct projection is not in effect"
+        end
+      end
+
+      it "projects the validation result directly" do
+        report = described_class.from_svg_conform_result("t.svg", result, profile: :svg_1_2_rfc)
+
+        expect(report.tool).to eq("svg_conform")
+        expect(report.filename).to eq("t.svg")
+        expect(report.valid).to be(false)
+        expect(report.errors.total_count).to eq(result.errors.length)
+        expect(report.errors.by_requirement.values.sum).to eq(report.errors.total_count)
+        expect(report.errors.issues.map(&:requirement_id).sort)
+          .to eq(result.errors.map(&:requirement_id).sort)
+        expect(report.to_yaml).to include("errors:", "total_count:", "by_requirement:")
+      end
+    end
+  end
+
+  describe ".from_svgcheck_result" do
+    it "remains callable and reports valid for empty output" do
+      report = described_class.from_svgcheck_result("t.svg", "")
+
+      expect(report.tool).to eq("svgcheck")
+      expect(report.valid).to be(true)
+    end
+  end
+end

data/spec/svg_conform/diagnostics/lens_core_adapter_spec.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe SvgConform::Diagnostics::LensCoreAdapter do
+  let(:requirement) do
+    SvgConform::Requirements::ViewboxRequiredRequirement.new(
+      id: "viewbox_required", description: "d",
+      citation_uri: "https://example.com/spec#viewbox",
+      citation_label: "Spec viewBox"
+    )
+  end
+  let(:profile) do
+    SvgConform::Profile.new(
+      name: "demo", specification_uri: "https://example.com/spec",
+      specification_label: "Demo Spec", requirements: [requirement]
+    )
+  end
+  let(:node) { Struct.new(:line, :column, :name).new(3, 5, "svg") }
+  let(:context) { SvgConform::ValidationContext.new(nil, profile) }
+  let(:result) { SvgConform::ValidationResult.new(nil, profile, context) }
+
+  def add_all(data: {})
+    context.add_error(node: node, message: "bad error", requirement_id: "viewbox_required",
+                      data: data)
+    context.add_error(node: node, message: "bad validity", requirement_id: "id_reference",
+                      severity: :validity_error)
+    context.add_warning(rule: Struct.new(:id).new("warn_rule"), node: node, message: "a warning")
+    context.add_notice(rule: nil, node: node, message: "an info", requirement_id: "some_notice")
+  end
+
+  describe ".call" do
+    it "maps all four channels to one schema-valid report in channel order" do
+      add_all
+      report = described_class.call(result, filename: "f.svg")
+
+      expect(report).to be_a(LensCore::Report)
+      expect(report.valid).to be(false)
+      expect(report.summary).to eq("errors" => 2, "warnings" => 1, "infos" => 1)
+      expect(report.diagnostics.map { |d| [d.severity, d.requirement_id] }).to eq(
+        [%w[error viewbox_required], %w[error id_reference],
+         %w[warning warn_rule], %w[info some_notice]],
+      )
+      expect(report.diagnostics[1].kind).to eq("validity")
+      expect(report.diagnostics[3].kind).to eq("notice")
+      expect(report.extensions["file"]).to eq("f.svg")
+
+      reparsed = LensCore::Parsers::Json.parse(LensCore::Renderers::Json.render(report))
+      expect(reparsed).to eq(report)
+    end
+
+    it "keeps validity based on errors and validity errors only" do
+      context.add_warning(rule: "w", node: node, message: "w")
+      context.add_notice(rule: nil, node: node, message: "i", requirement_id: "x")
+
+      expect(described_class.call(result).valid).to be(true)
+    end
+
+    it "carries location, remediation fields and explicit IDs" do
+      add_all
+      error = described_class.call(result).diagnostics.first
+
+      expect(error.location.line).to eq(3)
+      expect(error.location.column).to eq(5)
+      expect(error.remediation).to eq("Add missing viewBox attribute")
+      expect(error.context).to include("element" => "svg", "fixable" => false,
+                                       "remediation_type" => "add")
+    end
+
+    it "maps source-level line and column data to an XML location" do
+      context.add_error(node: nil, message: "css", requirement_id: "viewbox_required",
+                        data: { line: 7, column: 2 })
+      context.add_error(node: nil, message: "bad", requirement_id: "viewbox_required",
+                        data: { line: 0, column: "x" })
+      context.add_error(node: node, message: "node", requirement_id: "viewbox_required",
+                        data: { line: 99 })
+      first, second, third = described_class.call(result).diagnostics
+
+      expect(first.location.to_h).to include("line" => 7, "column" => 2)
+      expect(second.location).to be_nil
+      expect(third.location.line).to eq(3)
+    end
+
+    it "turns profile and requirement citations into LensCore citations" do
+      add_all
+      report = described_class.call(result)
+
+      expect(report.profile.citations.map(&:to_h)).to eq(
+        [{ "uri" => "https://example.com/spec", "label" => "Demo Spec" }],
+      )
+      expect(report.diagnostics.first.citations.map(&:uri)).to eq(["https://example.com/spec#viewbox"])
+      expect(report.diagnostics[2].citations).to eq([])
+    end
+
+    it "only includes a timestamp when supplied" do
+      add_all
+      expect(described_class.call(result).timestamp).to be_nil
+      expect(described_class.call(result, timestamp: "2026-10-23T00:00:00Z").to_h["timestamp"])
+        .to eq("2026-10-23T00:00:00Z")
+    end
+
+    it "normalizes symbols in issue data to JSON primitives" do
+      add_all(data: { attribute: :fill, nested: [1, { ok: true }] })
+      data = described_class.call(result).diagnostics.first.context["data"]
+
+      expect(data).to eq("attribute" => "fill", "nested" => [1, { "ok" => true }])
+    end
+
+    it "fails deterministically for JSON-unsafe issue data" do
+      add_all(data: { thing: Object.new })
+
+      expect { described_class.call(result) }
+        .to raise_error(SvgConform::Diagnostics::UnsupportedContextError,
+                        /unsupported value of type Object at data\.thing/)
+    end
+  end
+
+  describe "profile loading" do
+    it "keeps citations through YAML loading" do
+      loaded = SvgConform::Profile.from_yaml(<<~YAML)
+        name: yaml_demo
+        specification_uri: https://example.com/s
+        specification_label: S
+        requirements:
+          - id: viewbox_required
+            type: ViewboxRequiredRequirement
+            citation_uri: https://example.com/s#v
+            citation_label: V
+      YAML
+
+      expect(loaded.specification_uri).to eq("https://example.com/s")
+      expect(loaded.get_requirement("viewbox_required").citation_uri).to eq("https://example.com/s#v")
+      expect(loaded.get_requirement("viewbox_required").citation_label).to eq("V")
+    end
+  end
+end

data/spec/svg_conform/gemspec_spec.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "svg_conform.gemspec" do # rubocop:disable RSpec/DescribeClass
+  let(:specification) { Gem::Specification.load("svg_conform.gemspec") }
+
+  it "does not gate installation on the unpublished lens_core gem" do
+    # lens_core is optional: the canonical diagnostics renderer rides it
+    # when installed, and the plain structural serializers answer when
+    # not. A runtime dependency on the unpublished gem made 0.2.5
+    # uninstallable for every consumer.
+    expect(specification.runtime_dependencies.map(&:name)).not_to include("lens_core")
+    expect(File.read("lib/svg_conform.rb")).to include("rescue LoadError")
+  end
+
+  it "declares yeptris as a runtime dependency" do
+    dependency = specification.runtime_dependencies.find { |d| d.name == "yeptris" }
+
+    expect(dependency).not_to be_nil
+    expect(dependency.requirement).to eq(Gem::Requirement.new("~> 0.6.36"))
+  end
+
+  it "loads the Psych-compatible yeptris API" do
+    require "yeptris/psych"
+
+    expect(defined?(Yeptris::Psych)).to be_truthy
+  end
+
+  it "exposes the lens_core availability probe" do
+    expect(SvgConform).to respond_to(:lens_core_available?)
+    expect(SvgConform.lens_core_available?).to be_truthy.or be_falsey
+  end
+end

data/spec/svg_conform/profiles/metanorma_profile_spec.rb

@@ -2,6 +2,11 @@
 
 require "spec_helper"
 
+# Container elements take the clip-path and mask presentation attributes
+# per SVG (metanorma-pdfa#106).
+METANORMA_PROFILE_CONTAINER_TAGS = %w[g a defs].freeze
+METANORMA_PROFILE_CLIP_ATTRIBUTES = %w[clip-path mask].freeze
+
 RSpec.describe "Metanorma Profile" do
   let(:metanorma_profile_path) { "config/profiles/metanorma.yml" }
 
@@ -59,4 +64,47 @@ RSpec.describe "Metanorma Profile" do
       expect(result).to respond_to(:valid?)
     end
   end
+
+  describe "clip-path and mask on container elements" do
+    # SVG applies the clip-path and mask properties to container elements and
+    # graphics elements alike; rejecting them on containers rejects
+    # schema-valid documents (metanorma-pdfa#106).
+    let(:profile) { SvgConform::Profile.load_from_file(metanorma_profile_path) }
+    let(:validator) { SvgConform::Validator.new(mode: :sax) }
+
+    def svg_with_clip_assets(inner)
+      <<~SVG
+        <svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny" viewBox="0 0 100 100">
+          <defs>
+            <clipPath id="clip1">
+              <rect x="0" y="0" width="50" height="50"/>
+            </clipPath>
+            <mask id="mask1">
+              <rect x="0" y="0" width="50" height="50" fill="white"/>
+            </mask>
+          </defs>
+          #{inner}
+        </svg>
+      SVG
+    end
+
+    METANORMA_PROFILE_CONTAINER_TAGS.each do |tag|
+      METANORMA_PROFILE_CLIP_ATTRIBUTES.each do |attribute|
+        it "allows #{attribute} on #{tag}" do
+          svg = svg_with_clip_assets(
+            "<#{tag} #{attribute}=\"url(##{attribute == 'clip-path' ? 'clip1' : 'mask1'})\">" \
+            "<rect x=\"10\" y=\"10\" width=\"30\" height=\"30\" fill=\"red\"/>" \
+            "</#{tag}>",
+          )
+
+          result = validator.validate(svg, profile: profile)
+          attribute_errors = result.errors.select do |e|
+            e.message.include?("'#{attribute}'")
+          end
+          expect(attribute_errors).to be_empty
+          expect(result).to be_valid
+        end
+      end
+    end
+  end
 end