refactor: deserialize config DSL with Serde

Replace pest with quick-xml and a Serde wire model while preserving XML v3 metadata, projection and redaction. Check the restricted XML syntax and resource limits before recursive deserialization, retain source diagnostics, and add compatibility regressions.

Validated Rust tests, formatting, native and WASM Clippy, release build, browser regressions, format round trips, real TUIC parsing and loopback transport.

Assisted-by: Codex:gpt-6

Author: Itsusinn

Cargo.lock

@@ -89,14 +89,14 @@ BROWSER_CHANNEL=chromium node tests/config-generator/browser.mjs
 
 ## DSL 与维护约定
 
-[Config DSL v3](docs/tools/config-dsl.md) 使用独立的 `config-generator/schema/tuic.xml` 静态描述输入、默认值、枚举、条件、列表、映射及敏感字段，由 pest 解析，不使用 Rust 宏或闭包编写配置描述。Leptos 读取同一份元数据生成表单；通用投影与脱敏在 `dsl.rs`，跨字段 TUIC 校验在 `validation.rs`。新增普通字段时编辑 XML、说明及相关测试。
+[Config DSL v3](docs/tools/config-dsl.md) 使用独立的 `config-generator/schema/tuic.xml` 静态描述输入、默认值、枚举、条件、列表、映射及敏感字段，由 quick-xml + Serde 反序列化，不使用 Rust 宏或闭包编写配置描述。Leptos 读取同一份元数据生成表单；通用投影与脱敏在 `dsl.rs`，跨字段 TUIC 校验在 `validation.rs`。新增普通字段时编辑 XML、说明及相关测试。
 
 | 路径 | 内容 |
 | --- | --- |
 | `Cargo.toml` / `Cargo.lock` | 生成器 Rust workspace 与锁定依赖 |
 | `config-generator/` | 可独立构建的 Rust + Leptos 单页应用 |
 | `config-generator/schema/tuic.xml` | 静态 XML 配置描述，字段、初值、条件与输出的来源 |
-| `config-generator/src/dsl/xml.pest` / `dsl/parser.rs` | pest 语法与描述检查 |
+| `config-generator/src/dsl/xml.rs` / `dsl/wire.rs` / `dsl/parser.rs` | XML 子集检查、Serde 数据模型与语义校验 |
 | `config-generator/src/dsl.rs` | 数据投影、类型检查与脱敏 |
 | `config-generator/src/schema.rs` | 嵌入 XML、缓存解析结果与表单状态绑定 |
 | `config-generator/src/model.rs` | 配置生成入口及三种格式序列化 |

README.md

@@ -9,8 +9,8 @@ serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["preserve_order"] }
 toml = "0.9"
 uuid = "1"
-pest = "2.8"
-pest_derive = "2.8"
+# v3 preserves attribute whitespace; newer XML normalization changes that contract.
+quick-xml = { version = "0.38.4", features = ["serialize"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 leptos = { version = "0.8.20", features = ["csr"] }

config-generator/Cargo.toml

@@ -1,5 +1,7 @@
-//! Static XML configuration descriptions, parsed by pest. No callbacks or scripts.
+//! Static XML configuration descriptions, deserialized with Serde. No callbacks or scripts.
 mod parser;
+mod wire;
+mod xml;
 
 use std::{
 	collections::{BTreeMap, BTreeSet},

config-generator/src/dsl.rs

@@ -1,30 +1,8 @@
-use pest::{Parser, error::LineColLocation, iterators::Pair};
-
 use super::*;
 
-#[derive(pest_derive::Parser)]
-#[grammar = "dsl/xml.pest"]
-struct XmlParser;
-
 pub(super) fn parse(source: &str) -> Result<Document, DslError> {
-	if source.len() > 1_048_576 {
-		return Err(DslError("描述文件超过 1 MiB".into()));
-	}
-	if !source.chars().all(xml_char) {
-		return Err(DslError("描述包含无效 XML 字符".into()));
-	}
-	let mut pairs = XmlParser::parse(Rule::document, source).map_err(|e| {
-		let (line, column) = match e.line_col {
-			LineColLocation::Pos(p) | LineColLocation::Span(p, _) => p,
-		};
-		DslError(format!("{line}:{column} XML 语法错误"))
-	})?;
-	let document = pairs.next().ok_or_else(|| DslError("缺少文档".into()))?;
-	let root_pair = document
-		.into_inner()
-		.find(|p| p.as_rule() == Rule::element)
-		.ok_or_else(|| DslError("缺少根元素".into()))?;
-	let root = element(root_pair, 0)?;
+	let positions = xml::inspect(source)?;
+	let root = wire::deserialize(source, positions)?;
 	if root.tag != "config-dsl" {
 		return Err(root.error("根元素必须为 config-dsl"));
 	}
@@ -124,85 +102,6 @@ pub(super) fn parse(source: &str) -> Result<Document, DslError> {
 	}
 	Ok(doc)
 }
-fn element(pair: Pair<'_, Rule>, depth: usize) -> Result<Element, DslError> {
-	let (line, column) = pair.as_span().start_pos().line_col();
-	if depth > 64 {
-		return Err(DslError(format!("{line}:{column} 元素嵌套超过 64 层")));
-	}
-	let pair = if pair.as_rule() == Rule::element {
-		pair.into_inner().next().ok_or_else(|| DslError("缺少元素".into()))?
-	} else {
-		pair
-	};
-	let mut result = Element {
-		tag: String::new(),
-		attrs: BTreeMap::new(),
-		children: Vec::new(),
-		line,
-		column,
-	};
-	for part in pair.into_inner() {
-		match part.as_rule() {
-			Rule::name => {
-				if result.tag.is_empty() {
-					result.tag = part.as_str().into();
-				} else if result.tag != part.as_str() {
-					return Err(result.error("开始与结束标签不匹配"));
-				}
-			}
-			Rule::attribute => {
-				let mut parts = part.into_inner();
-				let name = parts.next().ok_or_else(|| result.error("缺少属性名"))?;
-				let quoted = parts.next().ok_or_else(|| result.error("缺少属性值"))?;
-				let text = quoted.as_str();
-				let value = decode(&result, &text[1..text.len() - 1])?;
-				if result.attrs.insert(name.as_str().into(), value).is_some() {
-					return Err(result.error("重复属性"));
-				}
-			}
-			Rule::element => result.children.push(element(part, depth + 1)?),
-			_ => {}
-		}
-	}
-	Ok(result)
-}
-fn xml_char(c: char) -> bool {
-	matches!(c as u32, 0x9 | 0xa | 0xd | 0x20..=0xd7ff | 0xe000..=0xfffd | 0x10000..=0x10ffff)
-}
-fn decode(node: &Element, text: &str) -> Result<String, DslError> {
-	let mut result = String::new();
-	let mut rest = text;
-	while let Some(i) = rest.find('&') {
-		result.push_str(&rest[..i]);
-		rest = &rest[i + 1..];
-		let end = rest.find(';').ok_or_else(|| node.error("实体缺少分号"))?;
-		let entity = &rest[..end];
-		let ch = match entity {
-			"amp" => Some('&'),
-			"lt" => Some('<'),
-			"gt" => Some('>'),
-			"quot" => Some('"'),
-			"apos" => Some('\''),
-			_ => {
-				let number = if let Some(hex) = entity.strip_prefix("#x") {
-					u32::from_str_radix(hex, 16).ok()
-				} else {
-					entity.strip_prefix('#').and_then(|n| n.parse::<u32>().ok())
-				};
-				number.and_then(char::from_u32)
-			}
-		}
-		.filter(|c| xml_char(*c))
-		.ok_or_else(|| node.error("不支持的实体或字符引用"))?;
-		result.push(ch);
-		rest = &rest[end + 1..];
-	}
-	result.push_str(rest);
-	if !result.chars().all(xml_char) {
-		return Err(node.error("无效 XML 字符"));
-	}
-	Ok(result)
-}
 fn attrs(node: &Element, allowed: &[&str]) -> Result<(), DslError> {
 	if node.attrs.keys().any(|k| !allowed.contains(&k.as_str())) {
 		return Err(node.error("含有未知属性"));

config-generator/src/dsl/parser.rs

@@ -0,0 +1,147 @@
+//! Serde wire model. Attributes remain lexical strings until semantic validation:
+//! this preserves v3's strict booleans, numeric rules, and empty values.
+use std::{collections::BTreeMap, fmt};
+
+use serde::{
+	Deserialize, Deserializer,
+	de::{self, MapAccess, Visitor},
+};
+
+use super::{DslError, Element};
+
+#[derive(Deserialize)]
+#[serde(rename_all = "kebab-case")]
+enum Node {
+	ConfigDsl(Body),
+	Inputs(Body),
+	Conditions(Body),
+	Values(Body),
+	Outputs(Body),
+	Field(Body),
+	Option(Body),
+	Collection(Body),
+	Condition(Body),
+	Value(Body),
+	All(Body),
+	Any(Body),
+	Not(Body),
+	Use(Body),
+	Eq(Body),
+	Truthy(Body),
+	Ip(Body),
+	Source(Body),
+	Coalesce(Body),
+	Endpoint(Body),
+	Select(Body),
+	Object(Body),
+	List(Body),
+	Record(Body),
+	String(Body),
+	Boolean(Body),
+	Integer(Body),
+	Enum(Body),
+}
+
+// A streaming Serde visitor keeps recursive stack use independent of the number
+// of possible attributes. parser.rs validates permitted attributes per construct.
+struct Body {
+	attrs: BTreeMap<String, String>,
+	children: Vec<Node>,
+}
+
+impl<'de> Deserialize<'de> for Body {
+	fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+		struct BodyVisitor;
+		impl<'de> Visitor<'de> for BodyVisitor {
+			type Value = Body;
+
+			fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+				formatter.write_str("XML attributes and ordered child elements")
+			}
+
+			fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Body, A::Error> {
+				let mut attrs = BTreeMap::new();
+				let mut children = None;
+				while let Some(key) = map.next_key::<String>()? {
+					if let Some(name) = key.strip_prefix('@') {
+						if attrs.insert(name.to_owned(), map.next_value()?).is_some() {
+							return Err(de::Error::custom("duplicate XML attribute"));
+						}
+					} else if key == "$value" && children.is_none() {
+						children = Some(map.next_value()?);
+					} else {
+						return Err(de::Error::custom("unexpected XML content"));
+					}
+				}
+				Ok(Body {
+					attrs,
+					children: children.unwrap_or_default(),
+				})
+			}
+		}
+		// $value asks quick-xml to deserialize heterogeneous children as one sequence.
+		deserializer.deserialize_struct("Body", &["$value"], BodyVisitor)
+	}
+}
+
+impl Node {
+	fn into_element(self, positions: &mut impl Iterator<Item = (usize, usize)>) -> Result<Element, DslError> {
+		let (tag, body) = match self {
+			Self::ConfigDsl(body) => ("config-dsl", body),
+			Self::Inputs(body) => ("inputs", body),
+			Self::Conditions(body) => ("conditions", body),
+			Self::Values(body) => ("values", body),
+			Self::Outputs(body) => ("outputs", body),
+			Self::Field(body) => ("field", body),
+			Self::Option(body) => ("option", body),
+			Self::Collection(body) => ("collection", body),
+			Self::Condition(body) => ("condition", body),
+			Self::Value(body) => ("value", body),
+			Self::All(body) => ("all", body),
+			Self::Any(body) => ("any", body),
+			Self::Not(body) => ("not", body),
+			Self::Use(body) => ("use", body),
+			Self::Eq(body) => ("eq", body),
+			Self::Truthy(body) => ("truthy", body),
+			Self::Ip(body) => ("ip", body),
+			Self::Source(body) => ("source", body),
+			Self::Coalesce(body) => ("coalesce", body),
+			Self::Endpoint(body) => ("endpoint", body),
+			Self::Select(body) => ("select", body),
+			Self::Object(body) => ("object", body),
+			Self::List(body) => ("list", body),
+			Self::Record(body) => ("record", body),
+			Self::String(body) => ("string", body),
+			Self::Boolean(body) => ("boolean", body),
+			Self::Integer(body) => ("integer", body),
+			Self::Enum(body) => ("enum", body),
+		};
+		let (line, column) = positions.next().ok_or_else(|| DslError("缺少 XML 元素位置".into()))?;
+		let attrs = body.attrs;
+		let children = body
+			.children
+			.into_iter()
+			.map(|node| node.into_element(positions))
+			.collect::<Result<_, _>>()?;
+		Ok(Element {
+			tag: tag.into(),
+			attrs,
+			children,
+			line,
+			column,
+		})
+	}
+}
+
+pub(super) fn deserialize(source: &str, positions: Vec<(usize, usize)>) -> Result<Element, DslError> {
+	let mut deserializer = quick_xml::de::Deserializer::from_str(source);
+	let node = Node::deserialize(&mut deserializer).map_err(|_| {
+		// Serde errors may contain attribute values. Only expose a source position.
+		let offset = deserializer.get_ref().get_ref().buffer_position() as usize;
+		let prefix = &source[..offset.min(source.len())];
+		let line = prefix.bytes().filter(|b| *b == b'\n').count() + 1;
+		let column = prefix.rsplit('\n').next().map_or(1, |s| s.chars().count() + 1);
+		DslError(format!("{line}:{column} XML 描述反序列化失败（未知标签、属性或无效结构）"))
+	})?;
+	node.into_element(&mut positions.into_iter())
+}