gedcomkit 0.1.9__tar.gz → 0.1.10__tar.gz

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/CHANGELOG.md

@@ -5,6 +5,42 @@ format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 the project uses semantic versioning within the usual pre-1.0 compatibility
 rules.
 
+## [0.1.10] - 2026-09-27
+
+### Added
+
+- `Node::fit_line_limit`, `Document::fit_line_limit` (the same, addressed by
+  a record's cross-reference identifier), and the `MAX_LINE_LENGTH` constant
+  for GEDCOM 5.5.1's 255-byte line, for a caller to fit an edited record to
+  a pre-7.0 document's line limit just before serializing:
+  `set_logical_value` only ever splits a payload across `CONT` at the
+  newlines it is given, so a long edited line was otherwise written over
+  length. Only nodes with no verbatim source line are touched, checked
+  recursively, so a node no caller reached into keeps its exact bytes; a
+  pointer payload is never split either. The line is measured with a
+  2-byte terminator reserve — wider than `wrap_long_lines`' 1 byte — because
+  this is meant for a caller whose own pipeline may keep a source file's
+  `\r\n` terminator rather than always writing `\n`. Bound in both language
+  bindings as `fit_line_limit` (Python) and `fitLineLimit` (WASM), mirroring
+  `wrap_long_lines`/`wrapLongLines`.
+
+### Fixed
+
+- `Document::next_xref` matched its prefix case-sensitively, so in a file
+  using lowercase identifiers (`@i1@`) `next_xref("I")` minted `@I1@` —
+  which `Document::record`'s case-insensitive lookup resolves to the
+  existing `@i1@`, silently colliding with it. The prefix match is now
+  case-insensitive, and the returned identifier is checked against every
+  existing xref case-insensitively and advanced past any collision. Its
+  doc comment claimed "the lowest unused" identifier while returning one
+  past the highest; the comment now says that.
+- The same method minted `highest + 1` with unchecked arithmetic: a hostile
+  or fuzzed file carrying `@I18446744073709551615@` (`u64::MAX`) made it
+  panic in a debug build and wrap around to `@I0@` in release. Arithmetic
+  is now checked throughout, and once the series above the high-water mark
+  is exhausted, `next_xref` falls back to the lowest unused number instead
+  of overflowing.
+
 ## [0.1.9] - 2026-09-27
 
 ### Fixed

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/Cargo.lock

@@ -35,7 +35,7 @@ dependencies = [
 
 [[package]]
 name = "gedcomkit"
-version = "0.1.9"
+version = "0.1.10"
 dependencies = [
  "flate2",
  "serde",

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/Cargo.toml

@@ -3,7 +3,7 @@
 # was checked on crates.io, npm, and PyPI before the initial release.
 [package]
 name = "gedcomkit"
-version = "0.1.9"
+version = "0.1.10"
 description = "A byte-preserving GEDCOM document model: decoding, parsing, readings, version conversion, plausibility checks, and the GEDZIP container, for GEDCOM 5.5 through 7.x."
 edition = "2024"
 # The true minimum, not the workspace's toolchain: a parser library is a leaf

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gedcomkit
-Version: 0.1.9
+Version: 0.1.10
 Classifier: Development Status :: 3 - Alpha
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/bindings/gedcomkit-py/Cargo.lock

@@ -35,7 +35,7 @@ dependencies = [
 
 [[package]]
 name = "gedcomkit"
-version = "0.1.9"
+version = "0.1.10"
 dependencies = [
  "flate2",
  "serde",
@@ -43,7 +43,7 @@ dependencies = [
 
 [[package]]
 name = "gedcomkit-py"
-version = "0.1.9"
+version = "0.1.10"
 dependencies = [
  "gedcomkit",
  "pyo3",

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/bindings/gedcomkit-py/Cargo.toml

@@ -2,7 +2,7 @@
 # abi3 keeps it to one wheel per platform across Python versions.
 [package]
 name = "gedcomkit-py"
-version = "0.1.9"
+version = "0.1.10"
 description = "Python bindings for gedcomkit: an archival-grade GEDCOM library — byte-preserving round-trip, encoding detection, GEDCOM 5.5 through 7.x, GEDZIP."
 edition = "2024"
 rust-version = "1.88"

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/bindings/gedcomkit-py/src/lib.rs

@@ -167,6 +167,26 @@ impl Gedcom {
         wrapped.iter().map(|line| to_py(py, line)).collect()
     }
 
+    /// Fits one record inside a 5.5.x document's line limit
+    /// (`max_line_bytes`, terminator included; 255 is GEDCOM 5.5.1's limit)
+    /// by inserting `CONC` lines, addressed by cross-reference identifier.
+    /// Call this on a record just edited with `set_logical_value`, since
+    /// that only ever splits a payload at the newlines it is given. Returns
+    /// whether anything changed; a node still carrying its original,
+    /// unedited line is never touched. Raises `KeyError` when no record
+    /// answers to `xref`.
+    #[pyo3(signature = (xref, max_line_bytes = 255))]
+    fn fit_line_limit(&mut self, xref: &str, max_line_bytes: usize) -> PyResult<bool> {
+        let changed = self
+            .document
+            .fit_line_limit(xref, max_line_bytes)
+            .map_err(|_| PyKeyError::new_err(xref.to_owned()))?;
+        if changed {
+            self.graph = None;
+        }
+        Ok(changed)
+    }
+
     /// What decoding decided, one line — show it before accepting an import.
     #[getter]
     fn encoding(&self) -> String {

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/src/build.rs

@@ -186,6 +186,222 @@ pub struct WrappedLine {
 /// The fewest bytes a line limit may leave for level, tag, and payload.
 const SMALLEST_LINE_LIMIT: usize = 32;
 
+/// GEDCOM 5.5.1's line length limit, in bytes.
+///
+/// The specification: "The total length of a GEDCOM line, including level
+/// number, cross-reference number, tag, value, delimiters, and terminator,
+/// must not exceed 255 (wide) characters." GEDCOM 7.0 removed `CONC` and
+/// every length limit, so this only matters for a document that declares
+/// 5.5.x. Pass it to [`Node::fit_line_limit`] or
+/// [`Document::wrap_long_lines`] — the two reserve a different number of
+/// bytes for the line terminator; see [`Node::fit_line_limit`]'s own
+/// documentation for why.
+pub const MAX_LINE_LENGTH: usize = 255;
+
+/// Bytes [`Node::fit_line_limit`] reserves for the line terminator when
+/// measuring whether a line fits: exactly 2, for a `\r\n` (CRLF)
+/// terminator. [`Document::wrap_long_lines`] reserves only 1, for the
+/// `\n` this crate's own writer emits; `fit_line_limit` reserves the wider
+/// CRLF instead because callers of this function may hand the result to a
+/// pipeline that preserves the source file's own terminator — CRLF
+/// included — rather than always writing LF. A line this leaves alone is
+/// therefore safe under either terminator convention.
+const TERMINATOR_RESERVE: usize = 2;
+
+/// The bytes a line spends before its payload, payload delimiter included:
+/// level, a space, the identifier and a space when there is one, the tag,
+/// and the space that introduces the payload.
+fn segment_prefix_bytes(level: usize, xref: Option<&str>, tag: &str) -> usize {
+    level.to_string().len() + 1 + xref.map_or(0, |xref| xref.len() + 1) + tag.len() + 1
+}
+
+/// Fits one payload segment — a node's own line plus the `CONC` lines that
+/// continue it without a newline — inside `max_line` bytes, the way
+/// [`Node::fit_line_limit`] documents. `old_concs` is that segment's
+/// existing trailing `CONC` children (already removed from the tree by the
+/// caller); the return value is what should replace them.
+///
+/// Left alone, unconditionally: a segment whose head carries a verbatim
+/// source line (its line is fixed, not ours to move text out of), a
+/// segment with a verbatim `CONC` in it (same reason), a pointer payload
+/// (pointers are short; splitting one would corrupt it), and a segment that
+/// already fits. Otherwise every byte of the segment's folded text — the
+/// head's value followed by each old `CONC`'s value, exactly as
+/// [`Node::logical_value`] would fold them — is recut with [`cut`] and
+/// redistributed, which is what guarantees the fold-after-split round trip.
+fn resplit_segment(
+    level: usize,
+    xref: Option<&str>,
+    tag: &str,
+    verbatim: Option<&str>,
+    value: &mut Option<String>,
+    old_concs: Vec<Node>,
+    max_line: usize,
+) -> (Vec<Node>, bool) {
+    if verbatim.is_some() || old_concs.iter().any(|conc| conc.verbatim.is_some()) {
+        return (old_concs, false);
+    }
+    if value.as_deref().is_some_and(is_xref) {
+        return (old_concs, false);
+    }
+
+    let head_budget =
+        max_line.checked_sub(TERMINATOR_RESERVE + segment_prefix_bytes(level, xref, tag));
+    let conc_budget =
+        max_line.checked_sub(TERMINATOR_RESERVE + segment_prefix_bytes(level + 1, None, "CONC"));
+    // Four bytes is the widest UTF-8 character: less and a cut may not be
+    // able to make progress, so the line is left as it is.
+    let (Some(head_budget), Some(conc_budget)) = (head_budget, conc_budget) else {
+        return (old_concs, false);
+    };
+    if head_budget < 4 || conc_budget < 4 {
+        return (old_concs, false);
+    }
+
+    let head_fits = value.as_deref().map_or(0, str::len) <= head_budget;
+    let concs_fit = old_concs
+        .iter()
+        .all(|conc| conc.value.as_deref().map_or(0, str::len) <= conc_budget);
+    if head_fits && concs_fit {
+        return (old_concs, false);
+    }
+
+    let mut text = value.clone().unwrap_or_default();
+    for conc in &old_concs {
+        text.push_str(conc.value.as_deref().unwrap_or_default());
+    }
+
+    let mut pieces = cut(&text, head_budget, conc_budget).into_iter();
+    let head_piece = pieces.next().unwrap_or_default();
+    *value = (!head_piece.is_empty()).then(|| head_piece.to_owned());
+    let new_concs = pieces
+        .map(|piece| Node::with_value("CONC", piece))
+        .collect();
+    (new_concs, true)
+}
+
+impl Node {
+    /// Fits this node and its substructures inside a 5.5.x document's line
+    /// limit — [`MAX_LINE_LENGTH`] for the specification's own 255 bytes —
+    /// by inserting `CONC` lines. Returns whether anything changed.
+    ///
+    /// Call this on the records a caller edited in a pre-7.0 document, just
+    /// before serializing: [`Node::set_logical_value`] only ever splits a
+    /// payload across `CONT` at the newlines it is given, so an edited note
+    /// with one long paragraph is otherwise written as a single over-long
+    /// line. `level` is the nesting level this node is rendered at — the
+    /// same number [`Node::at`]'s caller already tracks, since a node does
+    /// not store its own level (see the type's own documentation).
+    ///
+    /// Only nodes with no verbatim source line are touched, checked at
+    /// every node this walks into, recursively: a node still carrying its
+    /// verbatim line — meaning a caller never reached into it — is left
+    /// exactly as it was, whether or not its rendered line is over length.
+    /// That is what keeps this additive next to the byte-preservation
+    /// guarantee: it only ever rewrites a node through the same setters an
+    /// editing caller already surrendered the node's verbatim line to use.
+    /// A payload read as a pointer ([`Node::pointer`]) is never split
+    /// either — pointers are well under any real line limit, and cutting
+    /// one would corrupt it.
+    ///
+    /// A too-long line becomes its payload's head plus `CONC` children
+    /// inserted right after whatever `CONC` lines already continued that
+    /// same line (so an existing, already-fitting split is preserved in
+    /// place rather than reordered); a too-long `CONT` line is split the
+    /// same way, into that `CONT` followed by its own new `CONC` siblings.
+    /// Every cut lands on a UTF-8 character boundary and, whenever the
+    /// payload has one within the limit, on a byte with a non-space
+    /// character on each side, since GEDCOM 5.5.1 warns that a line broken
+    /// beside a space loses that space on re-joining. Failing that — a run
+    /// of spaces wider than the limit, say — the cut falls back to the
+    /// latest legal byte boundary instead, which is documented behavior of
+    /// [`cut`] this call reuses, not a special case here.
+    ///
+    /// The rendered line is measured in UTF-8 bytes, including level,
+    /// optional cross-reference, tag, delimiters, and a terminator reserved
+    /// at 2 bytes — a `\r\n` (CRLF) terminator, not the single-byte `\n`
+    /// this crate's own writer emits. That is deliberately wider than
+    /// [`Document::wrap_long_lines`]'s 1-byte reserve: this function exists
+    /// for a caller that fits one edited record before handing the document
+    /// on to something that may write it with the source file's own
+    /// terminator, CRLF included, so a line this leaves alone is safe under
+    /// either convention.
+    ///
+    /// ```
+    /// use gedcomkit::{Node, build::MAX_LINE_LENGTH};
+    ///
+    /// let mut note = Node::record("@N1@", "NOTE");
+    /// note.set_logical_value(&"word ".repeat(80));
+    /// let changed = note.fit_line_limit(0, MAX_LINE_LENGTH);
+    /// assert!(changed);
+    /// assert_eq!(note.logical_value(), "word ".repeat(80));
+    /// ```
+    pub fn fit_line_limit(&mut self, level: usize, max_line: usize) -> bool {
+        fit_node(self, level, max_line)
+    }
+}
+
+fn fit_node(node: &mut Node, level: usize, max_line: usize) -> bool {
+    let run_len = node
+        .children
+        .iter()
+        .take_while(|child| matches!(child.tag.as_str(), "CONT" | "CONC"))
+        .count();
+    let mut run: Vec<Node> = node.children.drain(0..run_len).collect();
+    let self_conc_end = run
+        .iter()
+        .position(|child| child.tag == "CONT")
+        .unwrap_or(run.len());
+    let self_concs: Vec<Node> = run.drain(0..self_conc_end).collect();
+
+    let xref = node.xref.clone();
+    let tag = node.tag.clone();
+    let verbatim = node.verbatim.clone();
+    let (mut output, mut changed) = resplit_segment(
+        level,
+        xref.as_deref(),
+        &tag,
+        verbatim.as_deref(),
+        &mut node.value,
+        self_concs,
+        max_line,
+    );
+    if changed {
+        node.verbatim = None;
+    }
+
+    let mut segments = run.into_iter().peekable();
+    while let Some(mut cont) = segments.next() {
+        let mut concs = Vec::new();
+        while segments.peek().is_some_and(|next| next.tag == "CONC") {
+            concs.push(segments.next().expect("peeked"));
+        }
+        let cont_verbatim = cont.verbatim.clone();
+        let (new_concs, seg_changed) = resplit_segment(
+            level + 1,
+            None,
+            "CONT",
+            cont_verbatim.as_deref(),
+            &mut cont.value,
+            concs,
+            max_line,
+        );
+        if seg_changed {
+            cont.verbatim = None;
+        }
+        changed |= seg_changed;
+        output.push(cont);
+        output.extend(new_concs);
+    }
+
+    let inserted = output.len();
+    node.children.splice(0..0, output);
+    for child in node.children.iter_mut().skip(inserted) {
+        changed |= fit_node(child, level + 1, max_line);
+    }
+    changed
+}
+
 impl Document {
     /// Adds substructures after the existing ones of the structure at `path`
     /// in `record` — a header's `DATE` and `SUBM`, say, which
@@ -301,6 +517,14 @@ impl Document {
     /// specification's warning, since some readers strip the space at the
     /// end of a line and lose it from the joined value.
     ///
+    /// The terminator is reserved at 1 byte here, matching the single `\n`
+    /// this crate's own writer emits ([`Document::to_text`],
+    /// [`Document::to_bytes`]) — this function measures the document it is
+    /// about to write out itself. [`Node::fit_line_limit`] reserves 2 bytes
+    /// instead, for a caller that fits one record ahead of writing the
+    /// document through something else that may keep the source file's own
+    /// terminator, CRLF included.
+    ///
     /// This rewrites what it touches, so it is an explicit operation with a
     /// report rather than something writing does: a structure that fits is
     /// left exactly as it is, and one that does not has its payload's
@@ -354,6 +578,37 @@ impl Document {
         }
         Ok(wrapped)
     }
+
+    /// [`Node::fit_line_limit`] for one record, addressed by cross-reference
+    /// identifier — the `Document`-level entry point for it, the way
+    /// [`Document::record_mut`] is for reaching a record to edit it in the
+    /// first place. Records sit at level 0, so unlike [`Node::fit_line_limit`]
+    /// there is no level for the caller to track. Returns whether anything
+    /// changed.
+    ///
+    /// ```
+    /// use gedcomkit::{Document, Node, build::MAX_LINE_LENGTH};
+    ///
+    /// let mut document = Document::new_v551("EXAMPLE");
+    /// let mut note = Node::record("@N1@", "NOTE");
+    /// note.set_logical_value(&"word ".repeat(80));
+    /// document.append_records(vec![note])?;
+    ///
+    /// assert!(document.fit_line_limit("@N1@", MAX_LINE_LENGTH)?);
+    /// assert!(document.to_text().lines().all(|line| line.len() < MAX_LINE_LENGTH));
+    /// # Ok::<(), gedcomkit::GedcomError>(())
+    /// ```
+    ///
+    /// # Errors
+    ///
+    /// A [`GedcomErrorKind::Structure`] error when no record answers to
+    /// `xref`.
+    pub fn fit_line_limit(&mut self, xref: &str, max_line: usize) -> Result<bool, GedcomError> {
+        let record = self
+            .record_mut(xref)
+            .ok_or_else(|| fault(0, GedcomErrorKind::Structure, format!("no record {xref}")))?;
+        Ok(record.fit_line_limit(0, max_line))
+    }
 }
 
 fn wrap_node(
@@ -708,4 +963,175 @@ mod tests {
             assert!(!piece.ends_with(' '), "{piece:?}");
         }
     }
+
+    fn fits(node: &Node, max_line: usize) -> bool {
+        Document {
+            records: vec![node.clone()],
+        }
+        .to_text()
+        .lines()
+        .all(|line| line.len() < max_line)
+    }
+
+    #[test]
+    fn fit_line_limit_splits_a_long_edited_ascii_payload() {
+        let mut note = Node::record("@N1@", "NOTE");
+        let text = "word ".repeat(80);
+        note.set_logical_value(&text);
+        assert!(note.verbatim().is_none(), "an edited node has no verbatim");
+
+        assert!(note.fit_line_limit(0, MAX_LINE_LENGTH));
+        assert_eq!(note.logical_value(), text, "fold(split(x)) == x");
+        assert!(fits(&note, MAX_LINE_LENGTH));
+        assert!(
+            note.all("CONC").count() > 0,
+            "the overflow became CONC children"
+        );
+        // A second pass has nothing left to do.
+        assert!(!note.fit_line_limit(0, MAX_LINE_LENGTH));
+    }
+
+    #[test]
+    fn fit_line_limit_splits_multibyte_text_on_character_boundaries() {
+        let mut note = Node::record("@N1@", "NOTE");
+        let text = "Pointe-Claire, Île de Montréal, Québec ".repeat(12);
+        note.set_logical_value(text.trim_end());
+
+        assert!(note.fit_line_limit(0, 80));
+        assert_eq!(note.logical_value(), text.trim_end());
+        assert!(fits(&note, 80));
+        assert!(note.all("CONC").count() > 0);
+    }
+
+    #[test]
+    fn fit_line_limit_handles_a_space_at_every_candidate_boundary() {
+        let mut note = Node::record("@N1@", "NOTE");
+        // Every legal cut point in `x x x ...` has a space on at least one
+        // side of it, exercising the fallback in `best_cut`.
+        let text = "x ".repeat(200);
+        note.set_logical_value(text.trim_end());
+
+        assert!(note.fit_line_limit(0, 40));
+        assert_eq!(note.logical_value(), text.trim_end());
+        assert!(fits(&note, 40));
+    }
+
+    #[test]
+    fn fit_line_limit_splits_an_over_long_cont_line_in_place() {
+        let mut note = Node::record("@N1@", "NOTE");
+        let long_second_line = "b".repeat(80);
+        let logical = format!("short first line\n{long_second_line}\nlast line");
+        note.set_logical_value(&logical);
+        note.push(Node::with_value("SOUR", "@S1@"));
+
+        assert!(note.fit_line_limit(0, 40));
+        assert_eq!(note.logical_value(), logical);
+        assert!(fits(&note, 40));
+        // The CONT run still comes before the untouched substructure that
+        // followed it.
+        assert_eq!(note.children.last().map(Node::tag), Some("SOUR"));
+        let tags: Vec<&str> = note.children.iter().map(Node::tag).collect();
+        assert_eq!(tags.last(), Some(&"SOUR"));
+        assert_eq!(tags.iter().filter(|tag| **tag == "CONT").count(), 2);
+        assert!(tags.contains(&"CONC"));
+    }
+
+    #[test]
+    fn fit_line_limit_never_splits_a_pointer_payload() {
+        let long_pointer = format!("@{}@", "I".repeat(300));
+        let mut record = Node::record("@F1@", "FAM");
+        record.push(Node::with_value("HUSB", long_pointer.clone()));
+
+        let husb = record.first_mut("HUSB").expect("HUSB");
+        assert!(husb.pointer().is_some());
+        assert!(!husb.fit_line_limit(1, MAX_LINE_LENGTH));
+        assert_eq!(husb.value(), Some(long_pointer.as_str()));
+        assert!(husb.all("CONC").next().is_none());
+    }
+
+    #[test]
+    fn fit_line_limit_never_touches_a_node_still_carrying_its_verbatim_line() {
+        // The double space between the level and the xref is not what
+        // canonical rendering would produce, so the parser keeps this
+        // line's exact bytes — the mark of a node no caller has reached
+        // into yet.
+        let long = "y".repeat(300);
+        let input = format!("0 HEAD\n0  @N1@ NOTE {long}\n0 TRLR\n");
+        let mut document = Document::parse(&input).expect("parses");
+        let note = document.record_mut("@N1@").expect("note");
+        assert!(note.verbatim().is_some(), "kept because of the odd spacing");
+
+        let before = note.clone();
+        assert!(!note.fit_line_limit(0, MAX_LINE_LENGTH));
+        assert_eq!(*note, before, "an untouched node is not rewritten");
+        assert_eq!(document.to_text(), input);
+    }
+
+    #[test]
+    fn fit_line_limit_recurses_past_an_untouched_verbatim_child() {
+        // The record itself has no verbatim (it was appended fresh), but
+        // its NOTE child is a kept verbatim line the caller never reached
+        // into — that child must be left exactly as it was even though the
+        // record around it is being fitted.
+        let long = "z".repeat(300);
+        let odd_note = format!("0  NOTE  {long}\n");
+        let reparsed = Document::parse(&format!("0 HEAD\n{odd_note}0 TRLR\n"))
+            .expect("parses")
+            .records
+            .remove(1);
+        assert!(reparsed.verbatim().is_some());
+
+        let mut record = Node::record("@I1@", "INDI");
+        record.push(reparsed.clone());
+        let mut edited_name = Node::with_value("NAME", "x".repeat(300));
+        edited_name.set_logical_value(&"x".repeat(300));
+        record.push(edited_name);
+
+        assert!(record.fit_line_limit(0, MAX_LINE_LENGTH));
+        assert_eq!(
+            record.children[0], reparsed,
+            "the verbatim child is untouched"
+        );
+        assert!(
+            record.children[1].all("CONC").count() > 0,
+            "the edited sibling was still fitted"
+        );
+    }
+
+    #[test]
+    fn fit_line_limit_covers_a_record_with_an_xref() {
+        let mut record = Node::record("@I123456@", "INDI");
+        record.push(Node::with_value("NOTE", "n".repeat(260)));
+
+        assert!(record.fit_line_limit(0, MAX_LINE_LENGTH));
+        assert!(fits(&record, MAX_LINE_LENGTH));
+        let note = record.first("NOTE").expect("note");
+        assert_eq!(note.logical_value(), "n".repeat(260));
+    }
+
+    #[test]
+    fn document_fit_line_limit_reaches_one_record_by_xref() {
+        let mut document = Document::new_v551("TEST");
+        let mut note = Node::record("@N1@", "NOTE");
+        note.set_logical_value(&"word ".repeat(80));
+        document.append_records(vec![note]).expect("appended");
+
+        assert!(
+            document
+                .fit_line_limit("@N1@", MAX_LINE_LENGTH)
+                .expect("record exists")
+        );
+        assert!(
+            document
+                .to_text()
+                .lines()
+                .all(|line| line.len() < MAX_LINE_LENGTH)
+        );
+
+        let missing = document.fit_line_limit("@N9@", MAX_LINE_LENGTH);
+        assert_eq!(
+            missing.expect_err("no such record").kind(),
+            GedcomErrorKind::Structure
+        );
+    }
 }

{gedcomkit-0.1.9 → gedcomkit-0.1.10}/src/lib.rs

@@ -884,22 +884,64 @@ impl Document {
             .is_some_and(|major| major >= 7)
     }
 
-    /// The lowest unused cross-reference identifier with this prefix, in the
-    /// `@I123@` style every producer uses.
+    /// One past the highest existing cross-reference identifier with this
+    /// prefix, in the `@I123@` style every producer uses — or, when that
+    /// would overflow `u64` (a hostile or fuzzed file can carry
+    /// `@I18446744073709551615@`, `u64::MAX`), the lowest unused number
+    /// instead. Arithmetic is checked throughout, so a file at or near the
+    /// top of the `u64` range is handled, never panics, and never wraps.
+    ///
+    /// The prefix match is case-insensitive, the same way [`Document::record`]
+    /// resolves identifiers: a file numbering its records `@i1@`, `@i2@` would
+    /// otherwise let `next_xref("I")` mint `@I1@`, which `record` treats as
+    /// the same identifier as the existing `@i1@`. The returned identifier is
+    /// also checked against every existing xref case-insensitively and
+    /// advanced past any collision, so the result is always genuinely unused
+    /// even when the file mixes padding or case within one prefix (an
+    /// `@I01@` alongside an `@I1@`, say).
     #[must_use]
     pub fn next_xref(&self, prefix: &str) -> String {
+        let prefix_upper = prefix.to_ascii_uppercase();
         let mut highest = 0u64;
         for record in &self.records {
             let Some(xref) = &record.xref else { continue };
-            let inner = xref.trim_matches('@');
-            let Some(digits) = inner.strip_prefix(prefix) else {
+            let inner = xref.trim_matches('@').to_ascii_uppercase();
+            let Some(digits) = inner.strip_prefix(prefix_upper.as_str()) else {
                 continue;
             };
             if let Ok(number) = digits.parse::<u64>() {
                 highest = highest.max(number);
             }
         }
-        format!("@{prefix}{}@", highest + 1)
+        // Every existing identifier, uppercased, built once: a collision
+        // check through `Document::record` is a scan of the whole document
+        // per candidate, which a hostile file can turn quadratic.
+        let taken: HashSet<String> = self
+            .records
+            .iter()
+            .filter_map(|record| record.xref.as_ref())
+            .map(|xref| xref.to_ascii_uppercase())
+            .collect();
+        let unused = |number: u64| {
+            let xref = format!("@{prefix}{number}@");
+            (!taken.contains(&xref.to_ascii_uppercase())).then_some(xref)
+        };
+        // Above the high-water mark, skipping any case-insensitive collision.
+        // At most `taken.len()` candidates can collide, so this ends.
+        let mut candidate = highest.checked_add(1);
+        while let Some(number) = candidate {
+            if let Some(xref) = unused(number) {
+                return xref;
+            }
+            candidate = number.checked_add(1);
+        }
+        // The series above the high-water mark is exhausted — `highest` was
+        // `u64::MAX`, or every candidate up to it collided. The lowest unused
+        // number exists among the first `taken.len() + 1`, so this finds it
+        // without overflowing.
+        (1..=u64::MAX)
+            .find_map(unused)
+            .unwrap_or_else(|| format!("@{prefix}0@"))
     }
 
     /// Every pointer in the document whose target is not a record, reported as
@@ -1256,6 +1298,68 @@ mod tests {
         assert_eq!(document.next_xref("S"), "@S1@");
     }
 
+    #[test]
+    fn next_xref_matches_a_lowercase_files_prefix_case_insensitively() {
+        let document = Document::parse("0 HEAD\n0 @i1@ INDI\n0 TRLR\n").expect("parse");
+
+        let minted = document.next_xref("I");
+        assert_eq!(minted, "@I2@");
+        assert!(
+            document.record(&minted).is_none(),
+            "a freshly minted xref must not already resolve to a record"
+        );
+    }
+
+    #[test]
+    fn next_xref_treats_mixed_case_prefixes_as_the_same_series() {
+        let document = Document::parse("0 HEAD\n0 @I1@ INDI\n0 @i5@ INDI\n0 @I3@ INDI\n0 TRLR\n")
+            .expect("parse");
+
+        assert_eq!(document.next_xref("I"), "@I6@");
+        assert_eq!(document.next_xref("i"), "@i6@");
+    }
+
+    #[test]
+    fn next_xref_skips_past_a_case_insensitive_collision() {
+        // @I1@ and @i1@ both exist as distinct source lines (a malformed but
+        // real-world file), so the numeric high-water mark alone is not
+        // enough: candidate @I1@ would resolve back to the existing @i1@ via
+        // `Document::record`'s case-insensitive lookup, and @i1@ likewise.
+        let document = Document::parse(
+            "0 HEAD\n0 @I1@ INDI\n1 NAME First\n0 @i1@ INDI\n1 NAME Second\n0 TRLR\n",
+        )
+        .expect("parse");
+
+        let minted = document.next_xref("I");
+        assert!(document.record(&minted).is_none());
+        assert_eq!(minted, "@I2@");
+    }
+
+    #[test]
+    fn next_xref_falls_back_to_the_lowest_unused_number_past_u64_max() {
+        // A hostile or fuzzed file can carry `@I{u64::MAX}@`; `highest + 1`
+        // would panic in debug and wrap in release. next_xref must do
+        // neither, and must still return a genuinely unused identifier.
+        let document =
+            Document::parse(&format!("0 HEAD\n0 @I{}@ INDI\n0 TRLR\n", u64::MAX)).expect("parse");
+
+        let minted = document.next_xref("I");
+        assert_eq!(minted, "@I1@", "falls back to the lowest unused number");
+        assert!(document.record(&minted).is_none());
+    }
+
+    #[test]
+    fn next_xref_at_u64_max_minus_one_advances_to_u64_max_without_overflow() {
+        // One below the top of the range: `highest + 1` is exactly
+        // `u64::MAX`, which must not overflow computing it or checking it.
+        let document = Document::parse(&format!("0 HEAD\n0 @I{}@ INDI\n0 TRLR\n", u64::MAX - 1))
+            .expect("parse");
+
+        let minted = document.next_xref("I");
+        assert_eq!(minted, format!("@I{}@", u64::MAX));
+        assert!(document.record(&minted).is_none());
+    }
+
     #[test]
     fn version_is_read_from_the_header() {
         let five = Document::parse("0 HEAD\n1 GEDC\n2 VERS 5.5.1\n0 TRLR\n").expect("parse 5.5.1");