Module form 

Phase B, the forms half: makeover_layout::Field rendered to HTML.

Why this emits strings

Both webview apps build their markup as strings and hand it to innerHTML: goingson’s renderFormField returns a template literal that fifteen call sites interpolate into larger literals, and Balanced Breakfast’s builds nodes but appends them into the same string-built forms. Returning nodes would rewrite the surrounding templates as well, which makes it a migration rather than an adoption. So: strings, and the escaping comes with them.

Why one escaper is enough here

goingson carries four escapers and 543 call sites that must pick between them, because escapeHtml is built on textContent serialization and textContent refuses to encode ". That is what makes it unsound in an attribute, and it is the whole reason the choice exists. Its escape.js records the finding as the CHRONIC-XSS seal, and its test suite has a gate keeping the unsafe one off the namespace.

escape here is not built on that, so it encodes the quote along with everything else, which makes one function sound in both sinks. The four-way choice does not move into Rust: it disappears. Nothing in this module hands an unescaped value to the output except through Markup, which a caller has to name.

What the description does not carry

One thing: the current value, which arrives in Filling. The placeholder and a select’s options are not renderer state: the first is user-facing text sitting with label and hint, and the second is needed by every renderer, so both are read off Field.

The value stays, and it is not a leftover. A webview reads it back out of the DOM, an immediate-mode renderer writes through a &mut, and a terminal keeps an edit buffer; a description carrying it would have to carry a way to write it back, at which point it is a form model.

Structs

Filling

Everything about the field that the description does not carry.

Markup

A string that is already markup, and is emitted without escaping.

Enums

Value

What the field currently holds.

Constants

FIELD_CLASSES

Every class this module can put in markup.

FIELD_STATE_CLASSES

The state classes a field carries, which take no prefix.

Functions

escape

Encode the five characters that let a value stop being a value.

escape_into

Encode the five characters that let a value stop being a value, into a buffer the caller already has.

field_html

One field, as the group the app drops into its form.

field_html_into

One field, written into a buffer the caller already has.

field_html_placed

One field, saying where each of its options landed.