style(changelog): order the development fixed entries by component

Assisted-by: GLM 5.3

.gitea/workflows/test.yml

@@ -30,6 +30,14 @@ env:
   GOFLAGS: -p=1
   GOMAXPROCS: "2"
 
+# A superseded run of the same ref is cancelled instead of queueing behind one
+# that no longer matters. Verified on this Gitea on 2026-09-17: a queued run
+# whose ref moved on is cancelled before it ever reaches the runner, while a
+# run already dispatched there runs to completion.
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: fedora
@@ -91,10 +99,12 @@ jobs:
         # output has to be captured into a variable.
         env:
           GOBIN: ${{ gitea.workspace }}/bin
-        run: go install github.com/toml-lang/toml-test/cmd/toml-test@v1.6.0
+        run: go install github.com/toml-lang/toml-test/v2/cmd/toml-test@v2.2.0
 
       - name: Build the decoder
         run: go build -o bin/interpres-decode ./cmd/interpres-decode
 
       - name: Compliance suite
-        run: bin/toml-test bin/interpres-decode
+        # interpres implements TOML 1.0 and 1.1; the mode is pinned so an upstream
+        # default change cannot silently move the corpus.
+        run: bin/toml-test test -decoder=bin/interpres-decode -toml=1.1

CHANGELOG.md

@@ -9,7 +9,108 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
--
+- TOML 1.1 support, on by default: date-times and times without seconds
+  (`07:32`, `1979-05-27T07:32`, normalised to full seconds on output), the
+  `\e` and `\xHH` escape sequences, and multi-line inline tables with
+  comments and trailing commas. The compliance suite runs in TOML 1.1 mode:
+  214 valid and 467 invalid cases, zero failures. Every TOML 1.0 document
+  parses exactly as before.
+- `interpres-decode -validate [file ...]`: a validate mode beside the
+  toml-test adapter. It parses each named file, or stdin when none are named,
+  prints one line per invalid document to stderr, and exits 0 when all are
+  valid, 1 when one is not, and 2 on a usage or read failure. Install it with
+  `go install .../cmd/interpres-decode@latest`; releases still ship no
+  binaries.
+- `DecodeError` and `EncodeError`: decode and encode failures are wrapped in
+  typed errors carrying the key path, read with `errors.AsType` instead of
+  parsing the message text. The rendered messages keep their shape; the only
+  visible change is that an encode failure on a top-level field no longer
+  gains a meaningless leading dot in its path.
+- `omitzero` and `omitempty` tag options on encode: `toml:"name,omitzero"`
+  skips a field whose value is the zero value of its type (a type with an
+  `IsZero() bool` method decides through the method), and
+  `toml:"name,omitempty"` skips a nil or empty slice, array, or map. The
+  decoder ignores both options.
+
+### Changed
+
+- The compliance suite is [toml-test](https://github.com/toml-lang/toml-test)
+  v2.2.0, run in TOML 1.0 mode. The new corpus holds 205 valid and 474 invalid
+  cases (v1.6.0 had 185 and 371), and it caught the two documents the parser
+  still accepted, fixed below.
+- The flattened struct layout the decoder consults is cached per struct type
+  and shared with the encoder, which now resolves duplicate field keys with
+  it. Strict decoding of an array of tables of structs runs about a quarter
+  faster; marshalling structs gained the same layout without measurable cost.
+- The parser scans the input bytes in place instead of building a `[]rune`
+  copy of the document: every character that drives the grammar is ASCII and
+  the input is validated UTF-8 up front, so the conversion pass and its four
+  bytes per rune were pure overhead. Parsing a large array-of-tables document
+  runs about a fifth faster and allocates about half the memory.
+- Numeric tokens without underscores skip the normalising rebuild: digits are
+  validated in place in `joinDigits`, and a float whose token is already
+  clean goes to `strconv.ParseFloat` directly. One allocation per integer
+  atom and two per float atom disappear.
+
+### Fixed
+
+- A `MarshalTOML` result of `nil` with a nil error fails the marshal with
+  `MarshalTOML returned a nil value`. The field silently vanished before, and
+  inside a value array the nil result reached reflection as a zero value and
+  panicked.
+- Strict decoding reports the smallest unknown key. Several unknown keys in
+  one table made the message depend on Go's random map iteration order, so
+  the same document reported different keys across runs.
+- Decoding into a struct that embeds a pointer to itself terminates. The
+  schema walk recursed through the embedded type forever, so such a
+  `Unmarshal` call hung the process; the walk now tracks the struct types on
+  the current path and stops when one repeats.
+- An array-of-tables header whose path runs through an inline table
+  (`a = {b = {}}` followed by `[[a.b.c]]`) is rejected. The frozen-inline-table
+  check covered `[table]` headers and dotted keys but not the intermediate
+  steps of an array-of-tables header, so such a document silently extended the
+  inline table.
+- A new element of an array of tables starts a fresh scope for dotted-key paths
+  and nested arrays of tables: `[[a]]`, `b.c = 1`, `[[a]]`, `[a.b]` parses, as
+  the TOML examples in the spec shape it. The records of the previous element
+  falsely rejected the same paths in the next one.
+- `Marshal` emits exactly one key when two struct fields resolve to the same
+  TOML name, picking the field the decoder would fill (the shallower one, the
+  later declaration at equal depth). Such a struct previously marshalled into
+  a duplicate key, and the output never re-parsed, breaking the round-trip
+  guarantee.
+- `Marshal` returns an error for a table header key or an inline-table key that
+  is not valid UTF-8, the way scalar keys already did, instead of silently
+  emitting corrupt TOML (a header that lost its key, an inline table with a
+  missing key).
+- `UseLiteralMultiline` falls back to the escaped basic string when the value
+  cannot be carried verbatim by the literal form: a run of three single quotes,
+  a control character, or a lone carriage return. Such values previously
+  produced output that did not re-parse.
+- A `[]any` holding only tables marshals in the value-array form with inline
+  tables, keeping the type `Parse` produces for such an array. It previously
+  took the `[[header]]` form, so a round-trip changed the value's type from
+  `[]any` to `[]map[string]any`.
+- Decoding into a `uint` destination checks the type's platform width instead
+  of only the fixed widths, so a 32-bit `uint` no longer truncates silently;
+  decoding a finite float beyond the `float32` range is an overflow error
+  instead of a silent infinity.
+- Struct fields that resolve to one key at equal depth decode through the
+  field declared later, matching the documented rule; the first one won before.
+- A float with an exponent marker but no digits (`1e`, `0.0E`) is rejected;
+  the exponent requires at least one digit.
+- A date-time offset outside 00:00 through 23:59 is rejected; such offsets
+  were accepted and silently rolled over (`+00:60` decoded as `+01:00`).
+- Untagged embedded fields now decode symmetrically with encode: an embedded
+  struct receives its keys inline (a nil embedded pointer struct is
+  allocated), an embedded map catches the keys no field claims, and a name
+  clash resolves in favour of the shallower field. A struct with an untagged
+  embedded field previously decoded with all inline keys dropped and did not
+  round-trip.
+- `Marshal` re-emits arrays that mix tables with scalars: the table elements
+  render as inline tables inside the value array. A tree that `Parse` accepts
+  from such a document previously failed with
+  `cannot encode map[string]interface {}`.
 
 ## [1.0.0] - 2026-08-20
 

CONTRIBUTING.md

@@ -1,10 +1,29 @@
 # Contributing
 
-Thanks for contributing to **interpres**.
+Contributions to **interpres** are governed by the Contributor terms
+below; submitting one means you accept them.
+
+## Contributor terms
+
+1. This project belongs to its owner alone. The owner decides what is
+   accepted, in what form and when; the decision is final and needs no
+   justification.
+2. By submitting a contribution you assign to Petr Balvín
+   <opensource@petrbalvin.org> all present and future copyright and
+   related rights in it, worldwide, for the full term of the rights,
+   with the right to relicense and sublicense without restriction,
+   including under proprietary terms.
+3. Where that assignment is not effective, it counts as a perpetual,
+   irrevocable, royalty-free licence with the same scope.
+4. To the fullest extent permitted by law, you waive any right of
+   attribution and integrity in the contribution. The project names no
+   contributors and keeps no credits list.
+5. By submitting you represent that the work is yours and that you
+   hold the rights to assign it as above.
 
 ## Development setup
 
-Requirements: Go 1.27.0, the version `go.mod` declares, and
+Requirements: Go 1.27.1, the version `go.mod` declares, and
 [just](https://github.com/casey/just) for the recipes.
 
 ```sh

README.md

@@ -1,17 +1,18 @@
 # interpres
 
-A TOML 1.0 parser and encoder for Go, written with the standard library alone.
-`interpres` (Latin for *interpreter*) gives zero-dependency programs an
-`encoding/json`-style API for reading and writing TOML, and passes the entire
-official [toml-test](https://github.com/toml-lang/toml-test) suite: 185 valid
-and 371 invalid cases, zero failures.
+A TOML 1.0 and 1.1 parser and encoder for Go, written with the standard
+library alone. `interpres` (Latin for *interpreter*) gives zero-dependency
+programs an `encoding/json`-style API for reading and writing TOML, and passes
+the entire official [toml-test](https://github.com/toml-lang/toml-test) suite:
+214 valid and 467 invalid cases, zero failures.
 
 ## Features
 
-- **Full TOML 1.0**: bare, quoted and dotted keys; tables and arrays of tables;
-  basic and literal strings including multiline; integers in the four radixes
-  with `_` separators; floats with exponents, `inf` and `nan`; booleans; the
-  four date-time kinds; arrays and inline tables.
+- **Full TOML 1.0 and 1.1**: bare, quoted and dotted keys; tables and arrays of
+  tables; basic and literal strings including multiline, with the 1.1 `\e` and
+  `\xHH` escapes; integers in the four radixes with `_` separators; floats with
+  exponents, `inf` and `nan`; booleans; the four date-time kinds, seconds
+  optional as of 1.1; arrays and inline tables, multi-line as of 1.1.
 - **Decoding and encoding**: `Parse` for an untyped tree, `Unmarshal` and
   `Marshal` for structs and maps, mirroring `encoding/json`.
 - **Strict decoding**: `NewDecoder().DisallowUnknownFields()` rejects keys that
@@ -31,7 +32,7 @@ As a library:
 go get sourcedock.dev/petrbalvin/interpres
 ```
 
-Requires Go 1.27.0 or newer. The module imports only the standard library.
+Requires Go 1.27.1 or newer. The module imports only the standard library.
 
 ## Quick start
 
@@ -160,7 +161,7 @@ See [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for the full workflow, and
 
 - [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md): components and data flow
 - [docs/API.md](docs/API.md): the API reference, decoding and encoding rules
-- [docs/CLI.md](docs/CLI.md): the interpres-decode toml-test adapter
+- [docs/CLI.md](docs/CLI.md): the interpres-decode toml-test adapter and validator
 
 ## Licence
 

bench_test.go

@@ -0,0 +1,129 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: MIT
+
+package interpres
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+)
+
+// benchDoc is a representative configuration document: every scalar kind, an
+// inline table, sub-tables, and an array of tables.
+var benchDoc = []byte(`title = "benchmark configuration"
+replicas = 3
+ratio = 0.75
+enabled = true
+when = 2026-09-17T12:00:00Z
+local = 2026-09-17T12:00:00
+tags = ["alpha", "beta", "gamma"]
+limits = { cpu = 4, memory = 1024 }
+
+[server]
+host = "localhost"
+port = 8080
+hosts = ["a.example", "b.example"]
+
+[server.tls]
+enabled = true
+cert = "/etc/cert.pem"
+
+[[items]]
+name = "first"
+weight = 10
+flags = ["x", "y"]
+
+[[items]]
+name = "second"
+weight = 20
+flags = ["z"]
+`)
+
+// longDoc is generated once so the large-input benchmarks measure parsing,
+// not document construction. Roughly 2000 array-of-tables entries.
+var longDoc = func() []byte {
+	var b strings.Builder
+	b.WriteString("title = \"long\"\n")
+	for i := range 2000 {
+		fmt.Fprintf(&b, "[[entry]]\nname = \"entry-%d\"\nweight = %d\nwhen = 2026-09-17T12:00:00Z\nratio = 0.5\ntags = [\"a\", \"b\", \"c\"]\n\n", i, i)
+	}
+	return []byte(b.String())
+}()
+
+type benchTLS struct {
+	Enabled bool   `toml:"enabled"`
+	Cert    string `toml:"cert"`
+}
+
+type benchServer struct {
+	Host  string   `toml:"host"`
+	Port  int      `toml:"port"`
+	Hosts []string `toml:"hosts"`
+	TLS   benchTLS `toml:"tls"`
+}
+
+type benchItem struct {
+	Name   string   `toml:"name"`
+	Weight int      `toml:"weight"`
+	Flags  []string `toml:"flags"`
+}
+
+type benchConfig struct {
+	Title    string         `toml:"title"`
+	Replicas int            `toml:"replicas"`
+	Ratio    float64        `toml:"ratio"`
+	Enabled  bool           `toml:"enabled"`
+	When     time.Time      `toml:"when"`
+	Local    LocalDateTime  `toml:"local"`
+	Tags     []string       `toml:"tags"`
+	Limits   map[string]any `toml:"limits"`
+	Server   benchServer    `toml:"server"`
+	Items    []benchItem    `toml:"items"`
+}
+
+func BenchmarkParse(b *testing.B) {
+	b.ReportAllocs()
+	b.SetBytes(int64(len(benchDoc)))
+	for b.Loop() {
+		if _, err := Parse(benchDoc); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkMarshal(b *testing.B) {
+	tree, err := Parse(benchDoc)
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.ReportAllocs()
+	b.SetBytes(int64(len(benchDoc)))
+	for b.Loop() {
+		if _, err := Marshal(tree); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkStrictDecode(b *testing.B) {
+	dec := NewDecoder().DisallowUnknownFields()
+	b.ReportAllocs()
+	for b.Loop() {
+		var cfg benchConfig
+		if err := dec.Decode(benchDoc, &cfg); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkParseLong(b *testing.B) {
+	b.ReportAllocs()
+	b.SetBytes(int64(len(longDoc)))
+	for b.Loop() {
+		if _, err := Parse(longDoc); err != nil {
+			b.Fatal(err)
+		}
+	}
+}

cmd/interpres-decode/main.go

@@ -1,17 +1,23 @@
 // Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
 // SPDX-License-Identifier: MIT
 
-// Command interpres-decode reads a TOML document from standard input and writes
-// the toml-test "tagged JSON" representation to standard output.
+// Command interpres-decode is the toml-test harness adapter and a TOML
+// validator. Without flags it reads a TOML document from standard input and
+// writes the toml-test "tagged JSON" representation to standard output. With
+// -validate it checks the named documents, or standard input when none are
+// named, and exits non-zero on the first invalid one:
 //
-// It exits non-zero on a parse error, which is how the toml-test harness checks
-// that invalid documents are rejected. Run the official suite against it with:
+//	interpres-decode -validate config.toml
+//
+// Run the official suite against the adapter with:
 //
 //	toml-test ./interpres-decode
 package main
 
 import (
 	"encoding/json"
+	"errors"
+	"flag"
 	"fmt"
 	"io"
 	"math"
@@ -23,13 +29,29 @@ import (
 )
 
 func main() {
-	os.Exit(Run(os.Stdin, os.Stdout, os.Stderr))
+	os.Exit(Run(os.Args[1:], os.Stdin, os.Stdout, os.Stderr))
 }
 
-// Run reads a TOML document from stdin, emits the toml-test tagged-JSON form
-// on stdout, and returns the process exit code (0 success, 1 parse error,
-// 2 I/O, encoding, or unsupported-value error).
-func Run(stdin io.Reader, stdout, stderr io.Writer) int {
+// Run runs the command line and returns the process exit code: 0 success,
+// 1 an invalid document, 2 a usage, reading, encoding, or
+// unsupported-value error.
+func Run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("interpres-decode", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	validate := fs.Bool("validate", false, "validate the documents instead of emitting tagged JSON")
+	if err := fs.Parse(args); err != nil {
+		if errors.Is(err, flag.ErrHelp) {
+			return 0
+		}
+		return 2
+	}
+	if *validate {
+		return validatePaths(fs.Args(), stdin, stderr)
+	}
+	if fs.NArg() > 0 {
+		fmt.Fprintln(stderr, "interpres-decode: the adapter mode takes no arguments; name files with -validate")
+		return 2
+	}
 	data, err := io.ReadAll(stdin)
 	if err != nil {
 		fmt.Fprintln(stderr, "read stdin:", err)
@@ -54,6 +76,39 @@ func Run(stdin io.Reader, stdout, stderr io.Writer) int {
 	return 0
 }
 
+// validatePaths parses every named file, or standard input when none are
+// named, and reports each invalid document on stderr. It returns 0 when all
+// documents parse, 1 when one does not, and 2 on a usage or read failure.
+func validatePaths(paths []string, stdin io.Reader, stderr io.Writer) int {
+	if len(paths) == 0 {
+		paths = []string{"-"}
+	}
+	valid := true
+	for _, p := range paths {
+		name := p
+		var data []byte
+		var err error
+		if p == "-" {
+			data, err = io.ReadAll(stdin)
+			name = "<stdin>"
+		} else {
+			data, err = os.ReadFile(p)
+		}
+		if err != nil {
+			fmt.Fprintf(stderr, "interpres-decode: %s: %v\n", name, err)
+			return 2
+		}
+		if _, err := interpres.Parse(data); err != nil {
+			fmt.Fprintf(stderr, "%s: %v\n", name, err)
+			valid = false
+		}
+	}
+	if !valid {
+		return 1
+	}
+	return 0
+}
+
 // tag converts an interpres value into its toml-test tagged-JSON form. Tables
 // become JSON objects and arrays become JSON arrays; scalars are wrapped in a
 // {"type", "value"} object. An error is returned for value types the encoder

cmd/interpres-decode/main_test.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"errors"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -20,7 +21,7 @@ func TestRunParsesValidTOML(t *testing.T) {
 port = 8080
 enabled = true
 `))
-	if code := Run(in, &stdout, &stderr); code != 0 {
+	if code := Run(nil, in, &stdout, &stderr); code != 0 {
 		t.Fatalf("Run returned %d, stderr = %q", code, stderr.String())
 	}
 	var got map[string]any
@@ -41,7 +42,7 @@ enabled = true
 func TestRunRejectsInvalidInput(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	in := bytes.NewReader([]byte("v = \n"))
-	code := Run(in, &stdout, &stderr)
+	code := Run(nil, in, &stdout, &stderr)
 	if code != 1 {
 		t.Errorf("Run returned %d, want 1 (parse error); stderr = %q", code, stderr.String())
 	}
@@ -52,7 +53,7 @@ func TestRunRejectsInvalidInput(t *testing.T) {
 
 func TestRunReadErrorReturnsTwo(t *testing.T) {
 	var stdout, stderr bytes.Buffer
-	code := Run(errorReader{}, &stdout, &stderr)
+	code := Run(nil, errorReader{}, &stdout, &stderr)
 	if code != 2 {
 		t.Errorf("Run returned %d, want 2 (read error); stderr = %q", code, stderr.String())
 	}
@@ -70,7 +71,7 @@ func TestRunEncodeErrorReturnsTwo(t *testing.T) {
 	var stderr bytes.Buffer
 	w := errorWriter{}
 	in := bytes.NewReader([]byte(`k = "v"` + "\n"))
-	code := Run(in, w, &stderr)
+	code := Run(nil, in, w, &stderr)
 	if code != 2 {
 		t.Errorf("Run returned %d, want 2 (encode error); stderr = %q", code, stderr.String())
 	}
@@ -210,3 +211,75 @@ func TestTaggedHelper(t *testing.T) {
 		t.Errorf("tagged = %#v", got)
 	}
 }
+
+func TestValidateStdinAcceptsValidDocument(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	in := bytes.NewReader([]byte("title = \"ok\"\n"))
+	if code := Run([]string{"-validate"}, in, &stdout, &stderr); code != 0 {
+		t.Fatalf("Run returned %d, stderr = %q", code, stderr.String())
+	}
+	if stdout.Len() != 0 || stderr.Len() != 0 {
+		t.Fatalf("validate should be quiet on success, stdout %q stderr %q", stdout.String(), stderr.String())
+	}
+}
+
+func TestValidateStdinRejectsInvalidDocument(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	in := bytes.NewReader([]byte("title = \"unterminated\n"))
+	if code := Run([]string{"-validate"}, in, &stdout, &stderr); code != 1 {
+		t.Fatalf("Run returned %d, want 1; stderr = %q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "<stdin>") || !strings.Contains(stderr.String(), "line 1") {
+		t.Fatalf("stderr = %q, want the name and the line", stderr.String())
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout should stay empty, got %q", stdout.String())
+	}
+}
+
+func TestValidateFiles(t *testing.T) {
+	dir := t.TempDir()
+	good := dir + "/good.toml"
+	bad := dir + "/bad.toml"
+	if err := os.WriteFile(good, []byte("a = 1\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(bad, []byte("a =\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := Run([]string{"-validate", good}, nil, &stdout, &stderr); code != 0 {
+		t.Fatalf("one valid file: Run returned %d, stderr = %q", code, stderr.String())
+	}
+	if code := Run([]string{"-validate", good, bad}, nil, &stdout, &stderr); code != 1 {
+		t.Fatalf("valid plus invalid: Run returned %d, want 1; stderr = %q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), bad) || !strings.Contains(stderr.String(), "line 1") {
+		t.Fatalf("stderr = %q, want the file name and the line", stderr.String())
+	}
+}
+
+func TestValidateMissingFileReturnsTwo(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if code := Run([]string{"-validate", "no-such-file.toml"}, nil, &stdout, &stderr); code != 2 {
+		t.Fatalf("Run returned %d, want 2; stderr = %q", code, stderr.String())
+	}
+}
+
+func TestAdapterModeRejectsPositionalArgument(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	in := bytes.NewReader([]byte("a = 1\n"))
+	if code := Run([]string{"file.toml"}, in, &stdout, &stderr); code != 2 {
+		t.Fatalf("Run returned %d, want 2; stderr = %q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "-validate") {
+		t.Fatalf("stderr = %q, want it to point at -validate", stderr.String())
+	}
+}
+
+func TestUnknownFlagReturnsTwo(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if code := Run([]string{"-nope"}, nil, &stdout, &stderr); code != 2 {
+		t.Fatalf("Run returned %d, want 2; stderr = %q", code, stderr.String())
+	}
+}

datetime.go

@@ -6,6 +6,7 @@ package interpres
 import (
 	"fmt"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -58,26 +59,39 @@ var (
 		"2006-01-02T15:04:05Z07:00",
 		"2006-01-02 15:04:05.999999999Z07:00",
 		"2006-01-02 15:04:05Z07:00",
+		// TOML 1.1 makes the seconds optional.
+		"2006-01-02T15:04Z07:00",
+		"2006-01-02 15:04Z07:00",
 	}
 	localDateTimeLayouts = []string{
 		"2006-01-02T15:04:05.999999999",
 		"2006-01-02T15:04:05",
 		"2006-01-02 15:04:05.999999999",
 		"2006-01-02 15:04:05",
+		"2006-01-02T15:04",
+		"2006-01-02 15:04",
 	}
 	localTimeLayouts = []string{
 		"15:04:05.999999999",
 		"15:04:05",
+		"15:04",
 	}
 )
 
-// dateTimeShape enforces the strict TOML grammar (two-digit components) that
-// time.Parse would otherwise accept loosely (e.g. a single-digit hour).
+// dateTimeShape enforces the strict TOML grammar (two-digit components,
+// seconds optional since 1.1, a fraction only after seconds) that time.Parse
+// would otherwise accept loosely (e.g. a single-digit hour).
 var dateTimeShape = regexp.MustCompile(
-	`^\d{4}-\d{2}-\d{2}([Tt ]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?)?$` +
-		`|^\d{2}:\d{2}:\d{2}(\.\d+)?$`,
+	`^\d{4}-\d{2}-\d{2}([Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?([Zz]|[+-]\d{2}:\d{2})?)?$` +
+		`|^\d{2}:\d{2}(:\d{2}(\.\d+)?)?$`,
 )
 
+// offsetBounds extracts the numeric offset of a date-time. The ABNF bounds it
+// to 00:00 through 23:59, but time.Parse accepts values outside that range
+// and rolls them over (for example "+00:60" becomes "+01:00"), so the bounds
+// are enforced here.
+var offsetBounds = regexp.MustCompile(`([+-])(\d{2}):(\d{2})$`)
+
 // parseDateTime classifies and parses a bare token as a TOML date-time value.
 // It returns the decoded value (time.Time, LocalDateTime, LocalDate, or
 // LocalTime) and whether the token was a date-time at all.
@@ -91,6 +105,13 @@ func parseDateTime(tok string) (any, bool) {
 	if !dateTimeShape.MatchString(tok) {
 		return nil, false
 	}
+	if m := offsetBounds.FindStringSubmatch(tok); m != nil {
+		hour, _ := strconv.Atoi(m[2])
+		minute, _ := strconv.Atoi(m[3])
+		if hour > 23 || minute > 59 {
+			return nil, false
+		}
+	}
 	// The ABNF accepts lowercase "t"/"z"; time.Parse only matches uppercase.
 	norm := strings.ToUpper(tok)
 	for _, layout := range offsetDateTimeLayouts {

decode.go

@@ -5,9 +5,10 @@ package interpres
 
 import (
 	"fmt"
-	"math"
 	"reflect"
+	"slices"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -105,17 +106,45 @@ func (d *decoder) assignTable(tbl map[string]any, dst reflect.Value) error {
 }
 
 func (d *decoder) assignStruct(tbl map[string]any, dst reflect.Value) error {
-	fields := structFields(dst.Type())
-	for key, val := range tbl {
-		field, ok := fields[strings.ToLower(key)]
-		if !ok {
+	schema := cachedStructSchema(dst.Type())
 	if d.disallowUnknown {
-				return fmt.Errorf("interpres: unknown field %q for %s", key, dst.Type())
+		// Map iteration order is random, so pick the unknown key to report
+		// deterministically: the smallest one.
+		unknown := ""
+		for key := range tbl {
+			if _, ok := schema.byName[strings.ToLower(key)]; ok {
+				continue
+			}
+			if unknown == "" || key < unknown {
+				unknown = key
+			}
+		}
+		if unknown != "" {
+			return fmt.Errorf("interpres: unknown field %q for %s", unknown, dst.Type())
+		}
+	}
+	for key, val := range tbl {
+		field, ok := schema.byName[strings.ToLower(key)]
+		if !ok {
+			if schema.embedMaps != nil {
+				// Leftover keys land in an untagged embedded map, the inverse
+				// of the encoder inlining that map's entries.
+				mv, err := fieldByIndex(dst, schema.embedMaps[0])
+				if err != nil {
+					return newDecodeError(key, err)
+				}
+				if err := d.assignMap(map[string]any{key: val}, mv); err != nil {
+					return newDecodeError(key, err)
+				}
 			}
 			continue
 		}
-		if err := d.assign(val, dst.Field(field)); err != nil {
-			return fmt.Errorf("%s: %w", key, err)
+		fv, err := fieldByIndex(dst, field.index)
+		if err != nil {
+			return newDecodeError(key, err)
+		}
+		if err := d.assign(val, fv); err != nil {
+			return newDecodeError(key, err)
 		}
 	}
 	return nil
@@ -132,7 +161,7 @@ func (d *decoder) assignMap(tbl map[string]any, dst reflect.Value) error {
 	for key, val := range tbl {
 		elem := reflect.New(elemType).Elem()
 		if err := d.assign(val, elem); err != nil {
-			return fmt.Errorf("%s: %w", key, err)
+			return newDecodeError(key, err)
 		}
 		dst.SetMapIndex(reflect.ValueOf(key), elem)
 	}
@@ -146,7 +175,7 @@ func (d *decoder) assignSlice(items []any, dst reflect.Value) error {
 	out := reflect.MakeSlice(dst.Type(), len(items), len(items))
 	for i, item := range items {
 		if err := d.assign(item, out.Index(i)); err != nil {
-			return fmt.Errorf("[%d]: %w", i, err)
+			return newDecodeError(fmt.Sprintf("[%d]", i), err)
 		}
 	}
 	dst.Set(out)
@@ -160,7 +189,7 @@ func (d *decoder) assignTableSlice(items []map[string]any, dst reflect.Value) er
 	out := reflect.MakeSlice(dst.Type(), len(items), len(items))
 	for i, item := range items {
 		if err := d.assign(item, out.Index(i)); err != nil {
-			return fmt.Errorf("[%d]: %w", i, err)
+			return newDecodeError(fmt.Sprintf("[%d]", i), err)
 		}
 	}
 	dst.Set(out)
@@ -188,21 +217,21 @@ func setInt(dst reflect.Value, v int64) error {
 		if v < 0 {
 			return fmt.Errorf("interpres: cannot assign negative %d to %s", v, dst.Type())
 		}
-		var max uint64
-		switch dst.Kind() {
-		case reflect.Uint8:
-			max = math.MaxUint8
-		case reflect.Uint16:
-			max = math.MaxUint16
-		case reflect.Uint32:
-			max = math.MaxUint32
-		}
-		if max != 0 && uint64(v) > max {
+		// OverflowUint knows every width, uint included on platforms where it
+		// is narrower than uint64; SetUint would silently truncate instead.
+		if dst.OverflowUint(uint64(v)) {
 			return fmt.Errorf("interpres: integer %d overflows %s", v, dst.Type())
 		}
 		dst.SetUint(uint64(v))
 	case reflect.Float32, reflect.Float64:
-		dst.SetFloat(float64(v))
+		// A finite value beyond the float32 range would silently become ±Inf;
+		// infinities and NaN themselves pass through. An int64 never
+		// overflows either float width.
+		f := float64(v)
+		if dst.OverflowFloat(f) {
+			return fmt.Errorf("interpres: integer %d overflows %s", v, dst.Type())
+		}
+		dst.SetFloat(f)
 	default:
 		return fmt.Errorf("interpres: cannot assign integer to %s", dst.Type())
 	}
@@ -212,6 +241,9 @@ func setInt(dst reflect.Value, v int64) error {
 func setFloat(dst reflect.Value, v float64) error {
 	switch dst.Kind() {
 	case reflect.Float32, reflect.Float64:
+		if dst.OverflowFloat(v) {
+			return fmt.Errorf("interpres: float %g overflows %s", v, dst.Type())
+		}
 		dst.SetFloat(v)
 		return nil
 	default:
@@ -219,26 +251,118 @@ func setFloat(dst reflect.Value, v float64) error {
 	}
 }
 
-// structFields builds a lower-cased lookup of field name → field index for the
-// exported fields of t, honouring `toml:"name"` tags.
-func structFields(t reflect.Type) map[string]int {
-	fields := make(map[string]int, t.NumField())
+// structFieldLoc locates one destination field by its index path from the
+// struct root and by the depth the field sits at, which breaks name clashes
+// in favour of the shallower field.
+type structFieldLoc struct {
+	index []int
+	depth int
+}
+
+// structSchema flattens the exported fields of t for decode, mirroring the
+// encoder: an untagged embedded struct is inlined, so its own fields match
+// keys of the same table, and an untagged embedded map is recorded in
+// embedMaps (first declaration first) as the destination for leftover keys.
+// When two fields resolve to one name, the shallower wins, then the later
+// declaration.
+type structSchema struct {
+	byName    map[string]structFieldLoc
+	embedMaps [][]int
+}
+
+// structSchemaCache holds one schema per struct type. A schema is immutable
+// once published, so concurrent callers only race to build an identical value,
+// the same trade-off encoding/json's field cache makes. The cache grows with
+// the number of distinct types decoded or encoded, never per document.
+var structSchemaCache sync.Map // reflect.Type -> structSchema
+
+func cachedStructSchema(t reflect.Type) structSchema {
+	if s, ok := structSchemaCache.Load(t); ok {
+		return s.(structSchema)
+	}
+	s := newStructSchema(t)
+	actual, _ := structSchemaCache.LoadOrStore(t, s)
+	return actual.(structSchema)
+}
+
+func newStructSchema(t reflect.Type) structSchema {
+	s := structSchema{byName: make(map[string]structFieldLoc, t.NumField())}
+	// A struct may embed a pointer to itself, which is legal Go, so the walk
+	// tracks the struct types on the current path and stops when one repeats;
+	// without the guard the recursion never terminates. A self-promoted key
+	// always loses to the shallower original, so skipping it changes nothing.
+	visiting := map[reflect.Type]bool{}
+	var walk func(t reflect.Type, prefix []int, depth int)
+	walk = func(t reflect.Type, prefix []int, depth int) {
+		visiting[t] = true
+		defer delete(visiting, t)
 		for i := range t.NumField() {
 			f := t.Field(i)
 			if f.PkgPath != "" { // unexported
 				continue
 			}
-		name := f.Name
+			path := append(append([]int{}, prefix...), i)
+			name := ""
 			if tag, ok := f.Tag.Lookup("toml"); ok {
-			tag = strings.Split(tag, ",")[0]
-			if tag == "-" {
+				name, _, _ = strings.Cut(tag, ",")
+				if name == "-" {
 					continue
 				}
-			if tag != "" {
-				name = tag
+			}
+			if f.Anonymous && name == "" {
+				ft := f.Type
+				for ft.Kind() == reflect.Pointer {
+					ft = ft.Elem()
+				}
+				switch {
+				case ft.Kind() == reflect.Struct && !isScalarStruct(ft):
+					if !visiting[ft] {
+						walk(ft, path, depth+1)
+					}
+					continue
+				case ft.Kind() == reflect.Map && ft.Key().Kind() == reflect.String:
+					s.embedMaps = append(s.embedMaps, path)
+					continue
+				}
+				name = f.Name
+			}
+			if name == "" {
+				name = f.Name
+			}
+			key := strings.ToLower(name)
+			if existing, ok := s.byName[key]; !ok || depth <= existing.depth {
+				s.byName[key] = structFieldLoc{index: path, depth: depth}
 			}
 		}
-		fields[strings.ToLower(name)] = i
 	}
-	return fields
+	walk(t, nil, 0)
+	return s
+}
+
+// ownsKey reports whether the field at path is the one that resolves key.
+// The encoder consults it to emit exactly the field the decoder would fill,
+// so a struct with two fields mapping to one key does not marshal into a
+// duplicate TOML key.
+func (s structSchema) ownsKey(key string, path []int) bool {
+	loc, ok := s.byName[key]
+	return ok && slices.Equal(loc.index, path)
+}
+
+// fieldByIndex walks an index path from a struct value, allocating nil
+// pointers along the way so a key can reach through an embedded pointer
+// struct. Every field on the path is exported, so each step is settable.
+func fieldByIndex(v reflect.Value, path []int) (reflect.Value, error) {
+	for i, x := range path {
+		v = v.Field(x)
+		if i < len(path)-1 && v.Kind() == reflect.Pointer {
+			if v.IsNil() {
+				if !v.CanSet() {
+					return reflect.Value{}, fmt.Errorf("cannot allocate nil embedded pointer")
+				}
+				v.Set(reflect.New(v.Type().Elem()))
+			}
+			v = v.Elem()
+		}
+	}
+	return v, nil
 }

decode_test.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"math"
+	"slices"
 	"strings"
 	"testing"
 )
@@ -222,6 +223,33 @@ func TestUnmarshalIntToUint64FitsMaxInt64(t *testing.T) {
 	}
 }
 
+func TestUnmarshalFloat32Overflow(t *testing.T) {
+	// A finite float64 beyond the float32 range must not decode silently as
+	// an infinity.
+	type C struct {
+		X float32 `toml:"x"`
+	}
+	var c C
+	err := Unmarshal([]byte("x = 1e300\n"), &c)
+	if err == nil {
+		t.Fatal("expected overflow error for float32")
+	}
+	if !strings.Contains(err.Error(), "overflow") {
+		t.Errorf("err = %v, want substring 'overflow'", err.Error())
+	}
+	// Infinities themselves pass through, and in-range values are untouched.
+	var ok C
+	if err := Unmarshal([]byte("x = inf\n"), &ok); err != nil {
+		t.Fatalf("inf should decode into float32, got %v", err)
+	}
+	if !math.IsInf(float64(ok.X), 1) {
+		t.Errorf("X = %v, want +Inf", ok.X)
+	}
+	if err := Unmarshal([]byte("x = 1.5\n"), &ok); err != nil || ok.X != 1.5 {
+		t.Fatalf("1.5 should decode into float32, got %v (X=%v)", err, ok.X)
+	}
+}
+
 func TestUnmarshalNegativeIntToUint(t *testing.T) {
 	type C struct {
 		X uint8 `toml:"x"`
@@ -494,3 +522,206 @@ field = "y"
 		t.Errorf("Field = %q, want \"y\"", cfg.R.Field)
 	}
 }
+
+// --- embedded field symmetry -----------------------------------------------
+
+type RoundTripBase struct {
+	ID   int    `toml:"id"`
+	Name string `toml:"name"`
+}
+
+type RoundTripDerived struct {
+	RoundTripBase
+	X string `toml:"x"`
+}
+
+func TestUnmarshalEmbeddedStructRoundTrip(t *testing.T) {
+	orig := RoundTripDerived{ID: 1, Name: "b", X: "x"}
+	out, err := Marshal(orig)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	var back RoundTripDerived
+	if err := Unmarshal(out, &back); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if back != orig {
+		t.Fatalf("round-trip mismatch:\nwas: %+v\nnow: %+v", orig, back)
+	}
+}
+
+type RoundTripPtrCfg struct {
+	*RoundTripBase
+	X string `toml:"x"`
+}
+
+func TestUnmarshalEmbeddedPointerStruct(t *testing.T) {
+	var cfg RoundTripPtrCfg
+	if err := Unmarshal([]byte("id = 7\nname = \"n\"\nx = \"x\"\n"), &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if cfg.RoundTripBase == nil || cfg.ID != 7 || cfg.Name != "n" || cfg.X != "x" {
+		t.Fatalf("decoded: %+v", cfg)
+	}
+}
+
+// A struct embedding a pointer to itself is legal Go; decoding into it must
+// terminate. The schema walk used to recurse through the embedded type
+// forever.
+func TestUnmarshalSelfEmbeddedPointerStructTerminates(t *testing.T) {
+	type SelfLink struct {
+		*SelfLink
+		X int    `toml:"x"`
+		Y string `toml:"y"`
+	}
+	var n SelfLink
+	if err := Unmarshal([]byte("x = 1\ny = \"s\"\n"), &n); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if n.X != 1 || n.Y != "s" {
+		t.Fatalf("decoded: %+v", n)
+	}
+
+	// A nil self pointer on the encode side stays skippable, as any nil
+	// embedded pointer is.
+	out, err := Marshal(SelfLink{X: 2})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if want := "x = 2\ny = \"\"\n"; string(out) != want {
+		t.Errorf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
+type RoundTripExtra map[string]int
+
+type RoundTripMapCfg struct {
+	RoundTripExtra
+	X string `toml:"x"`
+}
+
+func TestUnmarshalEmbeddedMap(t *testing.T) {
+	var cfg RoundTripMapCfg
+	if err := Unmarshal([]byte("alpha = 1\nx = \"x\"\n"), &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if cfg.RoundTripExtra["alpha"] != 1 || cfg.X != "x" {
+		t.Fatalf("decoded: %+v", cfg)
+	}
+
+	orig := RoundTripMapCfg{RoundTripExtra: RoundTripExtra{"a": 1}, X: "x"}
+	out, err := Marshal(orig)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	var back RoundTripMapCfg
+	if err := Unmarshal(out, &back); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if back.X != "x" || back.RoundTripExtra["a"] != 1 {
+		t.Fatalf("round-trip mismatch: %+v", back)
+	}
+}
+
+func TestUnmarshalEmbeddedNameClashShallowerWins(t *testing.T) {
+	type Inner struct {
+		Name string `toml:"name"`
+		Deep string `toml:"deep"`
+	}
+	type Outer struct {
+		Inner
+		Name string `toml:"name"`
+	}
+	var v Outer
+	if err := Unmarshal([]byte("name = \"outer\"\ndeep = \"d\"\n"), &v); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if v.Name != "outer" || v.Deep != "d" {
+		t.Fatalf("decoded: %+v", v)
+	}
+}
+
+func TestUnmarshalNameClashEqualDepthLaterWins(t *testing.T) {
+	// At equal depth the field declared later resolves the name, matching the
+	// documented rule.
+	type C struct {
+		First  string `toml:"v"`
+		Second int    `toml:"v"`
+	}
+	var c C
+	if err := Unmarshal([]byte("v = 1\n"), &c); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if c.Second != 1 {
+		t.Fatalf("decoded: %+v, want the later field to take the value", c)
+	}
+}
+
+func TestUnmarshalUnknownKeyWithoutEmbeddedMap(t *testing.T) {
+	var cfg RoundTripDerived
+	if err := Unmarshal([]byte("rogue = 1\n"), &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if cfg.ID != 0 || cfg.X != "" {
+		t.Fatalf("decoded: %+v", cfg)
+	}
+}
+
+func TestUnmarshalStrictEmbeddedMapStaysStrict(t *testing.T) {
+	type Cfg struct {
+		RoundTripExtra
+		Name string `toml:"name"`
+	}
+	dec := NewDecoder().DisallowUnknownFields()
+	err := dec.Decode([]byte("name = \"n\"\nrogue = 1\n"), &Cfg{})
+	if err == nil || !strings.Contains(err.Error(), "unknown field") {
+		t.Fatalf("expected unknown field error, got: %v", err)
+	}
+}
+
+func TestDecodeErrorCarriesPath(t *testing.T) {
+	type Item struct {
+		Name   string `toml:"name"`
+		Weight uint8  `toml:"weight"`
+	}
+	type Cfg struct {
+		Tags  []string `toml:"tags"`
+		Items []Item   `toml:"items"`
+	}
+	var cfg Cfg
+	err := Unmarshal([]byte("[[items]]\nname = \"a\"\nweight = 300\n"), &cfg)
+	if err == nil {
+		t.Fatal("expected an overflow error")
+	}
+	de, ok := errors.AsType[*DecodeError](err)
+	if !ok {
+		t.Fatalf("expected a *DecodeError, got %T: %v", err, err)
+	}
+	want := []string{"items", "[0]", "weight"}
+	if !slices.Equal(de.Path, want) {
+		t.Fatalf("Path = %v, want %v", de.Path, want)
+	}
+	if de.Err == nil || !strings.Contains(de.Err.Error(), "overflows uint8") {
+		t.Fatalf("Err = %v", de.Err)
+	}
+	// The rendered message keeps its shape: segments joined with ": ".
+	wantMsg := "items: [0]: weight: interpres: integer 300 overflows uint8"
+	if err.Error() != wantMsg {
+		t.Fatalf("message = %q, want %q", err.Error(), wantMsg)
+	}
+}
+
+func TestDecodeErrorOnMapDestination(t *testing.T) {
+	var m map[string]uint8
+	err := Unmarshal([]byte("count = -1\n"), &m)
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+	de, ok := errors.AsType[*DecodeError](err)
+	if !ok {
+		t.Fatalf("expected a *DecodeError, got %T: %v", err, err)
+	}
+	if !slices.Equal(de.Path, []string{"count"}) {
+		t.Fatalf("Path = %v", de.Path)
+	}
+}

docs/API.md

@@ -46,7 +46,7 @@ The cancellable variant of `Unmarshal`.
 ### `func Marshal(v any) ([]byte, error)`
 
 Encodes a `struct` or `map[string]V` value, or a non-nil pointer to one, into a
-TOML 1.0 document. The emission rules are in the [Encoding](#encoding) section
+TOML document. The emission rules are in the [Encoding](#encoding) section
 below. Equivalent to `MarshalContext(context.Background(), v)`.
 
 ```go
@@ -100,16 +100,23 @@ For a struct destination, a TOML key matches a field as follows:
 1. The `toml:"name"` tag, using the part before any comma. The literal `-`
    excludes the field.
 2. Without a tag, the lower-cased field name.
-3. The key itself is lower-cased before lookup, so the match is
+3. An anonymous (embedded) field without a tag is inlined: the decoder walks
+   into the embedded struct and matches its own fields against the same keys,
+   mirroring how the encoder flattens it. A nil embedded pointer struct is
+   allocated on demand. An untagged embedded map receives the keys no field
+   claims.
+4. The key itself is lower-cased before lookup, so the match is
    case-insensitive on both sides: `DATABASEURL` matches a field named
    `DatabaseUrl`.
 
 The match is exact after lower-casing. No separator is inserted, so a TOML key
 `database_url` does not match a field named `DatabaseUrl`; tag such a field
-(`toml:"database_url"`) or use the lower-cased name as the key. When two fields
-resolve to the same name, the one declared later wins.
+(`toml:"database_url"`) or use the lower-cased name as the key. When two
+fields resolve to the same name, the shallower one wins; at equal depth, the
+one declared later wins.
 
-Unknown keys are ignored by default; see [Strict decoding](#strict-decoding).
+Unknown keys are ignored by default, landing in an untagged embedded map when
+the struct has one; [Strict decoding](#strict-decoding) rejects them instead.
 
 ### Numeric conversion
 
@@ -119,8 +126,8 @@ The decoder converts to the destination type with explicit overflow checks:
 | Destination kind | Rule |
 |---|---|
 | `int`, `int8`, `int16`, `int32`, `int64` | the `int64` value must not overflow the destination |
-| `uint`, `uint8`, `uint16`, `uint32`, `uint64` | the value must be non-negative; `uint8`, `uint16` and `uint32` enforce their own maxima; `uint64` accepts any non-negative `int64` |
-| `float32`, `float64` | copied verbatim; an integer also coerces, so TOML `5` decodes into `5.0` |
+| `uint`, `uint8`, `uint16`, `uint32`, `uint64` | the value must be non-negative and must not overflow the destination's own width, `uint` on a 32-bit platform included; `uint64` accepts any non-negative `int64` |
+| `float32`, `float64` | copied verbatim, except that a finite value beyond the `float32` range is an overflow error rather than a silent infinity; an integer also coerces, so TOML `5` decodes into `5.0` |
 | `bool`, `string` | exact kind match only, no coercion across kinds |
 | `time.Time` | offset date-times only; no implicit conversion to or from the local variants |
 
@@ -179,7 +186,8 @@ A typo such as `database_urls` then fails with
 `interpres: unknown field "database_urls" for main.Config` instead of a silent
 default-zero run. Strictness applies to every struct the decode reaches, at any
 depth, including struct elements inside slices; map destinations accept every
-key by nature.
+key by nature. When several keys are unknown, the message names the smallest
+one, so it does not depend on map iteration order.
 
 ### Cancellation
 
@@ -233,10 +241,33 @@ Keys that match `[A-Za-z0-9_-]+` are emitted bare, all others quoted. A
 `map[string]V` emits its keys in sorted order for deterministic output, and a
 nil map emits nothing.
 
-Note the asymmetry: the encoder inlines untagged embedded structs, while the
-decoder expects them under their lower-cased type name. A struct with an
-untagged embedded struct therefore does not round-trip through `Unmarshal` into
-the same type.
+### Tag options
+
+The part of a `toml` tag after the first comma carries options. Both options
+shape emission only; the decoder ignores them.
+
+- `omitzero` skips the field when its value is the zero value of its type. A
+  type with an `IsZero() bool` method (time.Time among them) decides through
+  that method, so a zero `time.Time` or an all-zero struct disappears from
+  the output.
+- `omitempty` skips the field when it holds an empty collection: a nil or
+  empty slice or array, or a nil or empty map. Strings and other scalars are
+  not covered by `omitempty`; use `omitzero` for those.
+
+```go
+type Config struct {
+	Host    string    `toml:"host,omitzero"`
+	Started time.Time `toml:"started,omitzero"`
+	Tags    []string  `toml:"tags,omitempty"`
+}
+```
+
+Options combine after the name: `toml:"name,omitempty,omitzero"` is valid, and
+an unknown option is ignored.
+
+Untagged embedded fields round-trip: the decoder inlines embedded structs and
+routes unclaimed keys into an embedded map exactly where the encoder flattened
+them.
 
 ### Group-by-kind layout
 
@@ -279,7 +310,10 @@ The returned value is encoded as if it had been passed in place of the
 receiver, so it may be a scalar, a slice, an array of tables, or another
 struct or map, including the `Marshaler` result of another type; the encoder
 recurses. An error returned from `MarshalTOML` fails the marshal wrapped with
-the key path, for example `interpres: server.port: bad timestamp`.
+the key path, for example `interpres: server.port: bad timestamp`. A result
+of `nil` with a nil error fails the same way with
+`MarshalTOML returned a nil value`: nil has no TOML representation, so
+dropping the field silently is not an option.
 
 ```go
 type Port int
@@ -289,6 +323,23 @@ func (p Port) MarshalTOML() (any, error) {
 }
 ```
 
+### Arrays
+
+An array whose every element is a table (`[]struct`, `[]map[string]V`, after
+pointer dereference) emits as an array of tables. TOML also lets one array mix
+tables with scalars; such an array emits as a plain value array, with the
+table elements rendered as inline tables:
+
+```go
+tree, _ := interpres.Parse([]byte(`arr = [1, {a = 2}, "x"]`))
+out, _ := interpres.Marshal(tree) // arr = [1, {a = 2}, "x"]
+```
+
+A `[]any` holding only tables keeps the value-array form as well, because that
+is the shape `Parse` gives a value array of inline tables; emitting it as
+`[[headers]]` would re-parse as `[]map[string]any` and change the value's type
+across a round-trip.
+
 ### Empty arrays
 
 A nil slice is always omitted. An empty (length 0) array of tables is always
@@ -309,7 +360,10 @@ out, err := interpres.NewEncoder().UseLiteralMultiline(80).Marshal(cfg)
 ```
 
 Single-line strings keep the basic form regardless of the threshold, and a
-threshold of `0` or less disables the option.
+threshold of `0` or less disables the option. A string the literal form cannot
+carry verbatim (an embedded run of three single quotes, a control character
+other than tab, or a carriage return outside a CRLF pair) also keeps the basic
+form, so the output always re-parses to the same value.
 
 ### Cancellation
 
@@ -362,6 +416,27 @@ if se, ok := errors.AsType[*interpres.SyntaxError](err); ok {
 }
 ```
 
+### `type DecodeError struct{ Path []string; Err error }`
+
+Wraps a decoding failure with the key path at which it happened. `Path` lists
+one segment per level from the document root, the outermost key first: a key
+contributes its name, an array element its bracketed index, so the path of the
+`weight` field in the first item reads `["items", "[0]", "weight"]`. The
+rendered message is unchanged by the type; read the fields instead of parsing
+the message:
+
+```go
+if de, ok := errors.AsType[*interpres.DecodeError](err); ok {
+	fmt.Println(de.Path, de.Err)
+}
+```
+
+### `type EncodeError struct{ Path string; Err error }`
+
+Wraps an encoding failure with the key path of the value that failed, in the
+document's own notation: `server.ports[2]`. Read it with `errors.AsType` the
+same way.
+
 ### `type Decoder`
 
 Configurable strictness for decoding, constructed with `NewDecoder`. Set up
@@ -418,11 +493,14 @@ types are produced by `Parse` and accepted by `Marshal`.
 The entry points return:
 
 - `*SyntaxError` for a malformed document, with the 1-based line
-- a plain error for everything else: a non-pointer decode target, a type
-  mismatch, an overflow, a marshal policy violation, a cancelled context
+- `*DecodeError` for a decoding failure, with the key path in `Path`
+- `*EncodeError` for an encoding failure, with the key path in `Path`
+- a plain error for the rest: a non-pointer decode target, a cancelled
+  context, a key that is not valid UTF-8
 
-Decode and encode failures are wrapped with the key path or element index using
-`fmt.Errorf`, so `errors.Is` and `errors.AsType` see through them.
+Decode and encode failures carry the key path or element index in the typed
+wrappers above, so `errors.Is` and `errors.AsType` see through them and the
+path reads from a field instead of the message text.
 
 ## Notes
 

docs/ARCHITECTURE.md

@@ -6,9 +6,9 @@ source tree; nothing is aspirational.
 ## Overview
 
 interpres is one public library package, one command, and one example. The
-library implements the whole of TOML 1.0, decoding and encoding, in the
+library implements the whole of TOML 1.0 and 1.1, decoding and encoding, in the
 standard library alone; the command wraps the parser for the toml-test
-compliance harness, against which it stands at 185 valid and 371 invalid cases
+compliance harness, against which it stands at 214 valid and 467 invalid cases
 with zero failures; the example demonstrates the API.
 
 ```mermaid
@@ -43,7 +43,7 @@ Inside the library package, one file owns one concern:
 
 | File | Responsibility |
 |---|---|
-| `parser.go` | The recursive-descent parser. Produces the `map[string]any` tree and enforces the structural rules of TOML 1.0 (table redefinitions, dotted keys, arrays of tables). Reports a 1-based line on failure. |
+| `parser.go` | The recursive-descent parser. Produces the `map[string]any` tree and enforces the structural rules of TOML 1.0 and 1.1 (table redefinitions, dotted keys, arrays of tables, multi-line inline tables). Reports a 1-based line on failure. |
 | `number.go` | Strict numeric tokens: integers in the four radixes with `_` separators, and floats including `inf` and `nan`. Rejects leading zeros, misplaced underscores and malformed fractions. |
 | `datetime.go` | The three local date-time wrapper types and `parseDateTime`, which classifies a token into the four date-time kinds under the strict TOML grammar. |
 | `decode.go` | Maps the parsed tree onto Go values by reflection: struct fields, maps, slices, scalar conversion with overflow checks, `Unmarshaler` dispatch. |
@@ -101,9 +101,15 @@ sequenceDiagram
   setter methods are not, and must finish before the value is shared.
 - The parser is allocated per `ParseContext` call; nothing is cached between
   documents.
+- The one piece of shared state is the struct-schema cache in `decode.go`: a
+  `sync.Map` keyed by `reflect.Type`, holding the flattened field layout the
+  decoder and the encoder both consult. A schema is immutable once published,
+  so concurrent callers only race to build an identical value, the same
+  trade-off `encoding/json`'s field cache makes. The cache grows with the
+  number of distinct struct types, never with document size.
 - The date-time wrappers are values, not pointers, and are immutable in use.
-- Nothing in the library starts goroutines or holds locks; concurrency safety
-  comes from having no shared mutable state.
+- Nothing in the library starts goroutines; apart from the schema cache above,
+  which never mutates a published entry, there is no shared mutable state.
 
 ## Dependencies
 

docs/CLI.md

@@ -1,26 +1,45 @@
 # Command line
 
-The reference below is taken from the program itself. `interpres-decode` is the
-toml-test harness adapter, not a general-purpose tool: it takes no flags and no
-arguments, reads one TOML document from stdin, and writes the toml-test
-tagged-JSON form to stdout.
+The reference below is taken from the program itself. `interpres-decode` is
+the toml-test harness adapter, and it also validates documents. Install it
+with Go itself, no release assets involved:
+
+```sh
+go install sourcedock.dev/petrbalvin/interpres/cmd/interpres-decode@latest
+```
 
 ## Synopsis
 
 ```sh
-interpres-decode < document.toml
+interpres-decode [flags]
+interpres-decode -validate [file ...]
 ```
 
-Build it with `just build`, which compiles it into `bin/interpres-decode`, or
-run it straight from the module directory with `just run`.
+Without `-validate` the program is the toml-test adapter: it takes no
+arguments, reads one TOML document from stdin, and writes the toml-test
+tagged-JSON form to stdout. Build it locally with `just build`, which
+compiles it into `bin/interpres-decode`, or run it straight from the module
+directory with `just run`.
+
+With `-validate` the program parses each named file instead, or stdin when no
+file is named, and prints one line per invalid document to stderr. It is
+quiet on valid documents, which is the shape a CI step wants. The `-` name
+means stdin.
+
+## Flags
+
+| Flag | Effect |
+|---|---|
+| `-validate` | validate the documents instead of emitting tagged JSON |
+| `-h` | print the usage |
 
 ## Exit codes
 
 | Code | Meaning |
 |---|---|
-| `0` | the document parsed, tagged JSON written to stdout |
-| `1` | parse error, the document is malformed; the message goes to stderr |
-| `2` | reading stdin failed, or a value has no tagged representation |
+| `0` | adapter: the document parsed and the tagged JSON was written; validate: every document parsed |
+| `1` | adapter: parse error; validate: at least one document is invalid |
+| `2` | a usage error, a read failure, or a value with no tagged representation |
 
 ## Wire format
 
@@ -59,13 +78,28 @@ port = 9090
 ' | ./bin/interpres-decode
 ```
 
-The output is the equivalent value tree as one JSON object. Run the official
-compliance suite against the binary:
+The output is the equivalent value tree as one JSON object. Validate the
+TOML files of another repository in CI:
+
+```sh
+interpres-decode -validate config.toml deploy/example.toml
+```
+
+An invalid document reports the file and the library's line number:
+
+```sh
+$ interpres-decode -validate bad.toml
+bad.toml: interpres: line 1: expected a value
+$ echo $?
+1
+```
+
+Run the official compliance suite against the adapter:
 
 ```sh
 just toml-test
 ```
 
 That recipe needs the `toml-test` binary on `PATH`, installed with
-`go install github.com/toml-lang/toml-test/cmd/toml-test@v1.6.0`. The full
+`go install github.com/toml-lang/toml-test/v2/cmd/toml-test@v2.2.0`. The full
 reference for the library itself is [API.md](API.md).

docs/DEVELOPMENT.md

@@ -4,10 +4,10 @@ How to work on interpres.
 
 ## Prerequisites
 
-- Go 1.27.0, the version the `go` directive in `go.mod` declares.
+- Go 1.27.1, the version the `go` directive in `go.mod` declares.
 - [just](https://github.com/casey/just) for the recipes.
 - The `toml-test` binary on `PATH` for the compliance recipe, installed with
-  `go install github.com/toml-lang/toml-test/cmd/toml-test@v1.6.0`.
+  `go install github.com/toml-lang/toml-test/v2/cmd/toml-test@v2.2.0`.
 
 The module has no third-party dependencies, so there is nothing else to fetch.
 

encode.go

@@ -6,7 +6,9 @@ package interpres
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
+	"maps"
 	"math"
 	"reflect"
 	"slices"
@@ -142,6 +144,16 @@ func (d *tomlDoc) partitionedEntries() (scalars []entry, tables []entry, arrays
 // --- reflection walk: struct ---------------------------------------------
 
 func buildStructDoc(v reflect.Value, doc *tomlDoc, ctx string) error {
+	return walkStructDoc(v, doc, ctx, nil, cachedStructSchema(v.Type()))
+}
+
+// walkStructDoc emits the fields of v into doc. prefix is v's index path from
+// the struct whose schema resolves key conflicts; an embedded struct is walked
+// with the outer schema and a longer prefix, so every leaf competes under the
+// decoder's rule: the shallower field wins, the later declaration at equal
+// depth. A field another field shadows is skipped, because emitting both
+// would duplicate the key and the output would not re-parse.
+func walkStructDoc(v reflect.Value, doc *tomlDoc, ctx string, prefix []int, schema structSchema) error {
 	t := v.Type()
 	for i := range t.NumField() {
 		if i%ctxCheckInterval == 0 {
@@ -153,6 +165,7 @@ func buildStructDoc(v reflect.Value, doc *tomlDoc, ctx string) error {
 		if f.PkgPath != "" {
 			continue
 		}
+		path := append(append([]int{}, prefix...), i)
 		if f.Anonymous {
 			tag, _ := f.Tag.Lookup("toml")
 			if tag == "-" {
@@ -167,12 +180,15 @@ func buildStructDoc(v reflect.Value, doc *tomlDoc, ctx string) error {
 				case reflect.Struct:
 					if isScalarStruct(fv.Type()) {
 						name := strings.ToLower(f.Name)
+						if !schema.ownsKey(name, path) {
+							continue
+						}
 						if err := doc.appendScalar(name, fv.Interface(), ctx); err != nil {
 							return err
 						}
 						continue
 					}
-					if err := buildStructDoc(fv, doc, ctx); err != nil {
+					if err := walkStructDoc(fv, doc, ctx, path, schema); err != nil {
 						return err
 					}
 					continue
@@ -188,6 +204,12 @@ func buildStructDoc(v reflect.Value, doc *tomlDoc, ctx string) error {
 		if name == "-" {
 			continue
 		}
+		if !schema.ownsKey(strings.ToLower(name), path) {
+			continue
+		}
+		if fieldOmitted(f, v.Field(i)) {
+			continue
+		}
 		if err := addField(doc, name, v.Field(i), ctx); err != nil {
 			return err
 		}
@@ -195,6 +217,49 @@ func buildStructDoc(v reflect.Value, doc *tomlDoc, ctx string) error {
 	return nil
 }
 
+// isZeroer mirrors encoding/json's omitzero: a type that knows its own zero
+// state decides through that method before reflection is consulted.
+type isZeroer interface{ IsZero() bool }
+
+// fieldOmitted reports whether the field's tag options drop it from the
+// output: omitzero skips the zero value of the field's type, omitempty skips
+// an empty collection (slice, array, or map). The decoder ignores both
+// options; they shape emission only.
+func fieldOmitted(f reflect.StructField, v reflect.Value) bool {
+	tag, ok := f.Tag.Lookup("toml")
+	if !ok {
+		return false
+	}
+	_, opts, _ := strings.Cut(tag, ",")
+	for opts != "" {
+		var opt string
+		opt, opts, _ = strings.Cut(opts, ",")
+		switch opt {
+		case "omitzero":
+			if isZeroValue(v) {
+				return true
+			}
+		case "omitempty":
+			switch v.Kind() {
+			case reflect.Slice, reflect.Array, reflect.Map:
+				if v.Len() == 0 {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+func isZeroValue(v reflect.Value) bool {
+	if v.CanInterface() {
+		if z, ok := v.Interface().(isZeroer); ok {
+			return z.IsZero()
+		}
+	}
+	return v.IsZero()
+}
+
 // fieldName returns the TOML key for a struct field, honouring the `toml`
 // tag (name or `-`) and falling back to a lower-cased field name.
 func fieldName(f reflect.StructField) string {
@@ -235,12 +300,21 @@ func buildMapDoc(v reflect.Value, doc *tomlDoc, ctx string) error {
 
 // --- reflection walk: field dispatch -------------------------------------
 
+// errNilMarshalTOML reports a Marshaler whose method returned a nil value
+// with no error. nil has no TOML representation, so dropping the field
+// silently or panicking on the invalid reflect.Value would both hide the
+// contract violation.
+var errNilMarshalTOML = errors.New("MarshalTOML returned a nil value")
+
 func addField(doc *tomlDoc, name string, v reflect.Value, ctx string) error {
 	if v.CanInterface() {
 		if m, ok := v.Interface().(Marshaler); ok {
 			mv, err := m.MarshalTOML()
 			if err != nil {
-				return fmt.Errorf("interpres: %s.%s: %w", ctx, name, err)
+				return &EncodeError{Path: joinKey(ctx, name), Err: err}
+			}
+			if mv == nil {
+				return &EncodeError{Path: joinKey(ctx, name), Err: errNilMarshalTOML}
 			}
 			v = reflect.ValueOf(mv)
 		}
@@ -313,7 +387,24 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 		return doc.appendScalar(name, []any{}, ctx)
 	}
 
-	if isTableElementValue(v.Index(0)) {
+	// An array keeps the [[header]] form only when every element is a table.
+	// TOML lets one array mix tables with scalars, and that mix renders as a
+	// value array with the table elements written inline.
+	allTables := true
+	for i := range n {
+		if !isTableElementValue(v.Index(i)) {
+			allTables = false
+			break
+		}
+	}
+	// A []any of tables is what Parse produces for a value array of inline
+	// tables; the [[header]] form would re-parse as []map[string]any and so
+	// change the value's Go type across a round-trip. The header form is
+	// reserved for typed table slices.
+	if v.Type().Elem().Kind() == reflect.Interface {
+		allTables = false
+	}
+	if allTables {
 		subs := make([]*tomlDoc, n)
 		for i := range n {
 			if i%ctxCheckInterval == 0 {
@@ -323,13 +414,13 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 			}
 			ev := followPtr(v.Index(i))
 			if !ev.IsValid() {
-				return fmt.Errorf("interpres: %s.%s[%d]: nil element", ctx, name, i)
+				return &EncodeError{Path: fmt.Sprintf("%s[%d]", joinKey(ctx, name), i), Err: errors.New("nil element")}
 			}
 			sub := &tomlDoc{ctx: doc.ctx, opts: doc.opts}
 			switch ev.Kind() {
 			case reflect.Struct:
 				if isScalarStruct(ev.Type()) {
-					return fmt.Errorf("interpres: %s.%s[%d]: heterogeneous array contains scalar", ctx, name, i)
+					return &EncodeError{Path: fmt.Sprintf("%s[%d]", joinKey(ctx, name), i), Err: errors.New("heterogeneous array contains scalar")}
 				}
 				if err := buildStructDoc(ev, sub, joinKey(ctx, fmt.Sprintf("%s[%d]", name, i))); err != nil {
 					return err
@@ -339,7 +430,7 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 					return err
 				}
 			default:
-				return fmt.Errorf("interpres: %s.%s: heterogeneous array, expected table", ctx, name)
+				return &EncodeError{Path: joinKey(ctx, name), Err: errors.New("heterogeneous array, expected table")}
 			}
 			subs[i] = sub
 		}
@@ -347,7 +438,8 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 		return nil
 	}
 
-	// Regular array of scalars.
+	// Value array. Table elements normalise to map[string]any and the emitter
+	// writes them as inline tables.
 	items := make([]any, n)
 	for i := range n {
 		if i%ctxCheckInterval == 0 {
@@ -357,13 +449,16 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 		}
 		ev := followPtr(v.Index(i))
 		if !ev.IsValid() {
-			return fmt.Errorf("interpres: %s.%s[%d]: nil element", ctx, name, i)
+			return &EncodeError{Path: fmt.Sprintf("%s[%d]", joinKey(ctx, name), i), Err: errors.New("nil element")}
 		}
 		if ev.CanInterface() {
 			if m, ok := ev.Interface().(Marshaler); ok {
 				mv, err := m.MarshalTOML()
 				if err != nil {
-					return fmt.Errorf("interpres: %s.%s[%d]: %w", ctx, name, i, err)
+					return &EncodeError{Path: fmt.Sprintf("%s[%d]", joinKey(ctx, name), i), Err: err}
+				}
+				if mv == nil {
+					return &EncodeError{Path: fmt.Sprintf("%s[%d]", joinKey(ctx, name), i), Err: errNilMarshalTOML}
 				}
 				ev = reflect.ValueOf(mv)
 				ev = followPtr(ev)
@@ -371,7 +466,7 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 		}
 		val, err := normaliseValue(ev)
 		if err != nil {
-			return fmt.Errorf("interpres: %s.%s[%d]: %w", ctx, name, i, err)
+			return &EncodeError{Path: fmt.Sprintf("%s[%d]", joinKey(ctx, name), i), Err: err}
 		}
 		items[i] = val
 	}
@@ -382,10 +477,28 @@ func addArrayValue(doc *tomlDoc, name string, v reflect.Value, ctx string) error
 // nested-array representations the emitter understands. Slices and arrays are
 // recursively normalised so that nested arrays (e.g. [][]int) work.
 func normaliseValue(v reflect.Value) (any, error) {
+	// Map and slice elements arrive wrapped in interface{}; look through them.
+	for v.Kind() == reflect.Interface && !v.IsNil() {
+		v = v.Elem()
+	}
+	if v.Kind() == reflect.Interface {
+		return nil, fmt.Errorf("cannot encode nil value")
+	}
 	if v.CanInterface() {
 		if m, ok := v.Interface().(Marshaler); ok {
-			return m.MarshalTOML()
+			mv, err := m.MarshalTOML()
+			if err != nil {
+				return nil, err
 			}
+			if mv == nil {
+				return nil, errNilMarshalTOML
+			}
+			return mv, nil
+		}
+	}
+	// The datetime structs are TOML scalars; the emitter renders each of them.
+	if t := v.Type(); t == timeGoType || isLocalDateType(t) {
+		return v.Interface(), nil
 	}
 	switch v.Kind() {
 	case reflect.String:
@@ -402,6 +515,21 @@ func normaliseValue(v reflect.Value) (any, error) {
 		return int64(u), nil
 	case reflect.Float32, reflect.Float64:
 		return v.Float(), nil
+	case reflect.Map:
+		// A table nested in a value array has no header form, so it renders
+		// inline; the keys normalise to strings for the emitter.
+		if v.Type().Key().Kind() != reflect.String {
+			return nil, fmt.Errorf("map key must be string, got %s", v.Type().Key())
+		}
+		out := make(map[string]any, v.Len())
+		for _, k := range v.MapKeys() {
+			val, err := normaliseValue(v.MapIndex(k))
+			if err != nil {
+				return nil, fmt.Errorf("[%s]: %w", k.String(), err)
+			}
+			out[k.String()] = val
+		}
+		return out, nil
 	case reflect.Slice, reflect.Array:
 		items := make([]any, v.Len())
 		for i := range v.Len() {
@@ -494,7 +622,9 @@ func (e *encoder) emitDoc(doc *tomlDoc, prefix []string) error {
 			path := append(append([]string{}, prefix...), t.key)
 			e.writeBlankLine()
 			e.buf.WriteByte('[')
-			writeKeyPath(&e.buf, path)
+			if err := e.writeKeyPath(path); err != nil {
+				return err
+			}
 			e.buf.WriteString("]\n")
 			if err := e.emitDoc(t.doc, path); err != nil {
 				return err
@@ -505,7 +635,9 @@ func (e *encoder) emitDoc(doc *tomlDoc, prefix []string) error {
 			for _, sub := range a.docs {
 				e.writeBlankLine()
 				e.buf.WriteString("[[")
-				writeKeyPath(&e.buf, path)
+				if err := e.writeKeyPath(path); err != nil {
+					return err
+				}
 				e.buf.WriteString("]]\n")
 				if err := e.emitDoc(sub, path); err != nil {
 					return err
@@ -530,7 +662,9 @@ func (e *encoder) emitDoc(doc *tomlDoc, prefix []string) error {
 			path := append(append([]string{}, prefix...), ent.key)
 			e.writeBlankLine()
 			e.buf.WriteByte('[')
-			writeKeyPath(&e.buf, path)
+			if err := e.writeKeyPath(path); err != nil {
+				return err
+			}
 			e.buf.WriteString("]\n")
 			if err := e.emitDoc(ent.doc, path); err != nil {
 				return err
@@ -540,7 +674,9 @@ func (e *encoder) emitDoc(doc *tomlDoc, prefix []string) error {
 			for _, sub := range ent.docs {
 				e.writeBlankLine()
 				e.buf.WriteString("[[")
-				writeKeyPath(&e.buf, path)
+				if err := e.writeKeyPath(path); err != nil {
+					return err
+				}
 				e.buf.WriteString("]]\n")
 				if err := e.emitDoc(sub, path); err != nil {
 					return err
@@ -552,10 +688,9 @@ func (e *encoder) emitDoc(doc *tomlDoc, prefix []string) error {
 }
 
 func (e *encoder) writeKV(key string, val any) error {
-	if !utf8.ValidString(key) {
-		return fmt.Errorf("interpres: key %q is not valid UTF-8", key)
+	if err := e.writeKey(key); err != nil {
+		return err
 	}
-	e.writeKey(key)
 	e.buf.WriteString(" = ")
 	if err := e.writeValue(val); err != nil {
 		return err
@@ -564,25 +699,30 @@ func (e *encoder) writeKV(key string, val any) error {
 	return nil
 }
 
-func writeKeyPath(buf *bytes.Buffer, path []string) {
+func (e *encoder) writeKeyPath(path []string) error {
 	for i, p := range path {
 		if i > 0 {
-			buf.WriteByte('.')
+			e.buf.WriteByte('.')
 		}
-		if isBareKey(p) {
-			buf.WriteString(p)
-			continue
+		if err := e.writeKey(p); err != nil {
+			return err
 		}
-		writeQuotedString(buf, p)
 	}
+	return nil
 }
 
-func (e *encoder) writeKey(key string) {
+// writeKey writes one key, bare when it qualifies and quoted otherwise. A key
+// that is not valid UTF-8 is an error; writing it anyway would emit corrupt
+// TOML, because the quoted form has no representation for it.
+func (e *encoder) writeKey(key string) error {
 	if isBareKey(key) {
 		e.buf.WriteString(key)
-		return
+		return nil
 	}
-	writeQuotedString(&e.buf, key)
+	if !utf8.ValidString(key) {
+		return fmt.Errorf("interpres: key %q is not valid UTF-8", key)
+	}
+	return writeQuotedString(&e.buf, key)
 }
 
 // writeQuotedString writes s as a TOML basic string (double-quoted) to buf.
@@ -683,6 +823,8 @@ func (e *encoder) writeValue(val any) error {
 		}
 		e.buf.WriteByte(']')
 		return nil
+	case map[string]any:
+		return e.writeInlineTable(v)
 	case nil:
 		return fmt.Errorf("interpres: cannot encode nil value")
 	default:
@@ -690,13 +832,63 @@ func (e *encoder) writeValue(val any) error {
 	}
 }
 
+// writeInlineTable renders m as a TOML inline table with sorted keys, the
+// order buildMapDoc uses for header tables. It backs the table elements of a
+// value array, where the [[header]] form is not available.
+func (e *encoder) writeInlineTable(m map[string]any) error {
+	keys := slices.Sorted(maps.Keys(m))
+	e.buf.WriteByte('{')
+	for i, k := range keys {
+		if i > 0 {
+			e.buf.WriteString(", ")
+		}
+		if err := e.writeKey(k); err != nil {
+			return err
+		}
+		e.buf.WriteString(" = ")
+		if err := e.writeValue(m[k]); err != nil {
+			return err
+		}
+	}
+	e.buf.WriteByte('}')
+	return nil
+}
+
 func (e *encoder) writeStringVal(s string) error {
-	if e.opts.literalMultilineAt > 0 && strings.ContainsRune(s, '\n') && len(s) >= e.opts.literalMultilineAt {
+	if e.opts.literalMultilineAt > 0 && strings.ContainsRune(s, '\n') &&
+		len(s) >= e.opts.literalMultilineAt && canBeLiteralMultiline(s) {
 		return writeLiteralMultilineString(&e.buf, s)
 	}
 	return writeQuotedString(&e.buf, s)
 }
 
+// canBeLiteralMultiline reports whether s can be carried verbatim by the
+// literal ”'...”' form: the form has no escapes, so a run of three single
+// quotes would close the delimiter early, and control characters beyond tab,
+// and a carriage return outside a CRLF pair, have no representation at all.
+// Anything else falls back to the escaped basic string.
+func canBeLiteralMultiline(s string) bool {
+	if strings.Contains(s, "'''") {
+		return false
+	}
+	for i := 0; i < len(s); {
+		r, size := utf8.DecodeRuneInString(s[i:])
+		switch {
+		case r == '\t' || r == '\n':
+		case r == '\r':
+			if !strings.HasPrefix(s[i+size:], "\n") {
+				return false
+			}
+		default:
+			if r < 0x20 || r == 0x7f {
+				return false
+			}
+		}
+		i += size
+	}
+	return true
+}
+
 // writeLiteralMultilineString writes s as a TOML literal multi-line string,
 // surrounded by triple single quotes. The opening delimiter is followed by a
 // newline that the reader trims, so we always include one. The closing
@@ -724,7 +916,8 @@ func (e *encoder) writeFloat(v float64) error {
 	case math.IsInf(v, -1):
 		e.buf.WriteString("-inf")
 	case v == 0:
-		// Normalise negative zero to positive zero (TOML has no -0).
+		// Normalise negative zero to positive zero, the contract the output
+		// rules in the documentation state.
 		e.buf.WriteString("0.0")
 	default:
 		s := strconv.FormatFloat(v, 'g', -1, 64)

encode_test.go

@@ -67,7 +67,7 @@ func TestMarshalFloatSpecials(t *testing.T) {
 }
 
 func TestMarshalFloatNormalizesNegativeZero(t *testing.T) {
-	// TOML has no -0; the emitter must normalise negative zero to "0.0".
+	// The output contract normalises negative zero to "0.0".
 	type Cfg struct {
 		Z float64 `toml:"z"`
 	}
@@ -267,6 +267,38 @@ func TestEncoderUseLiteralMultilineThresholdZero(t *testing.T) {
 	}
 }
 
+func TestEncoderLiteralMultilineFallsBackWhenUnsafe(t *testing.T) {
+	// The literal form carries the value verbatim, so content it cannot
+	// represent must fall back to the escaped basic string instead of
+	// producing output that does not re-parse.
+	cases := []struct {
+		name string
+		in   string
+	}{
+		{"embedded delimiter", "before ''' after\nsecond line"},
+		{"control character", "a\x01b\nsecond"},
+		{"delete character", "a\x7fb\nsecond"},
+		{"lone carriage return", "first\rsecond\nthird"},
+	}
+	for _, c := range cases {
+		out, err := NewEncoder().UseLiteralMultiline(5).Marshal(map[string]any{"s": c.in})
+		if err != nil {
+			t.Fatalf("%s: marshal: %v", c.name, err)
+		}
+		if !bytes.HasPrefix(out, []byte("s = \"")) {
+			t.Errorf("%s: expected the basic quoted form, got:\n%s", c.name, out)
+		}
+		re, err := Parse(out)
+		if err != nil {
+			t.Errorf("%s: re-parse: %v\ndoc:\n%s", c.name, err, out)
+			continue
+		}
+		if re["s"] != c.in {
+			t.Errorf("%s: round-trip changed the value: %q", c.name, re["s"])
+		}
+	}
+}
+
 // marshalerFunc adapts a plain function value to the Marshaler interface.
 // Tests use it to express "this field produces this TOML value" without a
 // dedicated struct definition.
@@ -351,6 +383,75 @@ func TestMarshalerErrorPropagates(t *testing.T) {
 	}
 }
 
+// nilMarshalerFunc is a Marshaler whose method returns nil with no error.
+type nilMarshalerFunc struct{}
+
+func (nilMarshalerFunc) MarshalTOML() (any, error) { return nil, nil }
+
+func TestMarshalRejectsNilMarshalerResult(t *testing.T) {
+	// nil has no TOML representation, so a MarshalTOML result of nil is an
+	// error, not a silently dropped field.
+	_, err := Marshal(struct {
+		F nilMarshalerFunc `toml:"f"`
+	}{})
+	if err == nil {
+		t.Fatal("expected an error for a nil MarshalTOML result")
+	}
+	ee, ok := errors.AsType[*EncodeError](err)
+	if !ok {
+		t.Fatalf("expected an *EncodeError, got %T: %v", err, err)
+	}
+	if ee.Path != "f" {
+		t.Fatalf("Path = %q, want %q", ee.Path, "f")
+	}
+
+	// Inside a value array the nil result used to reach reflection as a zero
+	// Value and panic.
+	_, err = Marshal(map[string]any{"arr": []any{1, nilMarshalerFunc{}}})
+	if err == nil {
+		t.Fatal("expected an error for a nil MarshalTOML result in an array")
+	}
+	if !strings.Contains(err.Error(), "MarshalTOML returned a nil value") {
+		t.Errorf("err = %v, want the nil-result message", err)
+	}
+}
+
+// Two fields that resolve to one TOML key must marshal as one key, resolved
+// the way the decoder resolves it, or the output would carry a duplicate key
+// and never re-parse.
+func TestMarshalDuplicateKeyResolvesToOneField(t *testing.T) {
+	type SameLevel struct {
+		First  int    `toml:"v"`
+		Second string `toml:"v"`
+	}
+	out, err := Marshal(SameLevel{First: 1, Second: "s"})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if want := "v = \"s\"\n"; string(out) != want {
+		t.Errorf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+
+	type Base struct {
+		Name string `toml:"name"`
+	}
+	type Embedded struct {
+		Base
+		Name string `toml:"name"`
+	}
+	out, err = Marshal(Embedded{Base: Base{Name: "inner"}, Name: "outer"})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	// The shallower field wins, matching the decoder.
+	if want := "name = \"outer\"\n"; string(out) != want {
+		t.Errorf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+	if _, err := Parse(out); err != nil {
+		t.Errorf("re-parse: %v\ndoc:\n%s", err, out)
+	}
+}
+
 func TestMarshalEmbeddedScalarStruct(t *testing.T) {
 	// A field declared directly as a scalar-struct type (here LocalDateTime)
 	// must be encoded as a TOML scalar at the parent level, not rendered as
@@ -504,6 +605,109 @@ func TestMarshalNestedArrays(t *testing.T) {
 	}
 }
 
+func TestMarshalMixedArrayWithInlineTable(t *testing.T) {
+	// Parse accepts a mixed array (TOML allows any value kinds in one array),
+	// so Marshal of the parsed tree must re-emit it. The table element has no
+	// header form inside a value array and renders inline.
+	tree, err := Parse([]byte("arr = [1, {a = 2}, \"x\"]\n"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	out, err := Marshal(tree)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	want := "arr = [1, {a = 2}, \"x\"]\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+	re, err := Parse(out)
+	if err != nil {
+		t.Fatalf("re-parse: %v", err)
+	}
+	if !reflect.DeepEqual(tree, re) {
+		t.Fatalf("round-trip changed the tree:\nwas: %#v\nnow: %#v", tree, re)
+	}
+}
+
+// A []any of tables is what Parse produces for a value array of inline
+// tables; it must stay in the value-array form, or the output would re-parse
+// as []map[string]any and the round-trip would change the value's type.
+func TestMarshalValueArrayOfTablesStaysInline(t *testing.T) {
+	for _, doc := range []string{
+		"0=[{}]",
+		"a = [{x = 1}, {x = 2}]\n",
+		"b = [{x = 1}, 2, \"three\"]\n",
+	} {
+		tree, err := Parse([]byte(doc))
+		if err != nil {
+			t.Fatalf("%s: parse: %v", doc, err)
+		}
+		out, err := Marshal(tree)
+		if err != nil {
+			t.Fatalf("%s: marshal: %v", doc, err)
+		}
+		if bytes.HasPrefix(out, []byte("[[")) {
+			t.Errorf("%s: emitted the [[header]] form for a value array:\n%s", doc, out)
+		}
+		re, err := Parse(out)
+		if err != nil {
+			t.Fatalf("%s: re-parse: %v\ndoc:\n%s", doc, err, out)
+		}
+		if !tomlEqual(tree, re) {
+			t.Errorf("%s: round-trip changed the tree:\nwas: %#v\nnow: %#v\ndoc:\n%s", doc, tree, re, out)
+		}
+	}
+}
+
+func TestMarshalNestedInlineTables(t *testing.T) {
+	tree := map[string]any{
+		"mix": []any{
+			int64(1),
+			map[string]any{"deep": map[string]any{"n": int64(0)}, "list": []any{"a", true}},
+			map[string]any{},
+		},
+	}
+	out, err := Marshal(tree)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	want := "mix = [1, {deep = {n = 0}, list = [\"a\", true]}, {}]\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
+func TestMarshalInlineTableWithDatetime(t *testing.T) {
+	when := time.Date(1979, 5, 27, 7, 32, 0, 0, time.UTC)
+	tree := map[string]any{
+		"mix": []any{when, map[string]any{"t": LocalDateTime{when}}},
+	}
+	out, err := Marshal(tree)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	want := "mix = [1979-05-27T07:32:00Z, {t = 1979-05-27T07:32:00}]\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
+func TestMarshalArrayOfTablesStaysHeaderForm(t *testing.T) {
+	tree, err := Parse([]byte("[[items]]\nname = \"a\"\n\n[[items]]\nname = \"b\"\n"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	out, err := Marshal(tree)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	want := "[[items]]\nname = \"a\"\n\n[[items]]\nname = \"b\"\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
 func TestMarshalFloatExponentNoLeadingZero(t *testing.T) {
 	// strconv.FormatFloat with 'g' would produce "1e+06" (leading zero in
 	// exponent). The encoder must strip it so the output is "1e+6".
@@ -675,6 +879,85 @@ func TestMarshalEmbeddedStructAsTable(t *testing.T) {
 	}
 }
 
+func TestMarshalTagOptionOmitZero(t *testing.T) {
+	type Server struct {
+		Host string `toml:"host"`
+	}
+	type Cfg struct {
+		Name   string    `toml:"name,omitzero"`
+		Count  int       `toml:"count,omitzero"`
+		Ratio  float64   `toml:"ratio,omitzero"`
+		When   time.Time `toml:"when,omitzero"`
+		Server Server    `toml:"server,omitzero"`
+		Always string    `toml:"always"`
+	}
+	out, err := Marshal(Cfg{Always: "kept"})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	// Every omitzero field sits at its zero value, so only always is emitted.
+	want := "always = \"kept\"\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+
+	when := time.Date(2026, 9, 17, 12, 0, 0, 0, time.UTC)
+	out, err = Marshal(Cfg{Name: "x", Count: 1, Ratio: 0.5, When: when, Server: Server{Host: "h"}, Always: "kept"})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	want = "name = \"x\"\ncount = 1\nratio = 0.5\nwhen = 2026-09-17T12:00:00Z\nalways = \"kept\"\n\n[server]\nhost = \"h\"\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
+func TestMarshalTagOptionOmitEmpty(t *testing.T) {
+	type Cfg struct {
+		Tags   []string       `toml:"tags,omitempty"`
+		Ports  []int          `toml:"ports,omitempty"`
+		Matrix [][]int        `toml:"matrix,omitempty"`
+		Extra  map[string]any `toml:"extra,omitempty"`
+		Name   string         `toml:"name,omitempty"`
+		Keep   []string       `toml:"keep"`
+	}
+	out, err := Marshal(Cfg{
+		Ports:  []int{},
+		Matrix: [][]int{{1}},
+		Extra:  map[string]any{},
+		Name:   "set",
+		Keep:   []string{},
+	})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	// tags is nil (omitted anyway), ports and extra are empty collections
+	// dropped by omitempty, matrix is populated, name is a string the option
+	// does not cover, keep is empty but carries no option so it emits [].
+	want := "matrix = [[1]]\nname = \"set\"\nkeep = []\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
+func TestMarshalTagOptionOnTaggedEmbeddedStruct(t *testing.T) {
+	type Inner struct {
+		N int `toml:"n"`
+	}
+	type Cfg struct {
+		Inner Inner  `toml:"inner,omitzero"`
+		Name  string `toml:"name"`
+	}
+	out, err := Marshal(Cfg{Name: "x"})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	want := "name = \"x\"\n"
+	if string(out) != want {
+		t.Fatalf("output mismatch:\ngot:  %q\nwant: %q", out, want)
+	}
+}
+
 func TestMarshalMapKeysSorted(t *testing.T) {
 	m := map[string]any{
 		"zeta":  1,
@@ -944,6 +1227,17 @@ func TestMarshalKeyRequiresUTF8(t *testing.T) {
 	if _, err := Marshal(m); err == nil {
 		t.Errorf("expected error for invalid UTF-8 key")
 	}
+	// The check must reach the keys of table headers and of inline tables
+	// nested inside value arrays, not only scalar keys: both write keys
+	// through the same path.
+	nested := map[string]any{"\xff": map[string]any{"k": "v"}}
+	if _, err := Marshal(nested); err == nil {
+		t.Errorf("expected error for invalid UTF-8 table header key")
+	}
+	inline := map[string]any{"mix": []any{1, map[string]any{"\xff": 1}}}
+	if _, err := Marshal(inline); err == nil {
+		t.Errorf("expected error for invalid UTF-8 inline table key")
+	}
 }
 
 func TestMarshalStringRequiresUTF8(t *testing.T) {
@@ -1008,3 +1302,73 @@ type Custom struct {
 }
 
 func (c Custom) MarshalTOML() (any, error) { return c.tag, nil }
+
+// encodeErrBad is a Marshaler whose MarshalTOML always fails.
+type encodeErrBad struct {
+	msg string
+}
+
+func (encodeErrBad) MarshalTOML() (any, error) { return nil, errors.New("bad timestamp") }
+
+func TestEncodeErrorCarriesPath(t *testing.T) {
+	type Inner struct {
+		Port encodeErrBad `toml:"port"`
+	}
+	type Cfg struct {
+		Server Inner `toml:"server"`
+	}
+	_, err := Marshal(Cfg{Server: Inner{Port: encodeErrBad{}}})
+	if err == nil {
+		t.Fatal("expected a marshal error")
+	}
+	ee, ok := errors.AsType[*EncodeError](err)
+	if !ok {
+		t.Fatalf("expected an *EncodeError, got %T: %v", err, err)
+	}
+	if ee.Path != "server.port" {
+		t.Fatalf("Path = %q, want %q", ee.Path, "server.port")
+	}
+	if ee.Err == nil || ee.Err.Error() != "bad timestamp" {
+		t.Fatalf("Err = %v", ee.Err)
+	}
+	if err.Error() != "interpres: server.port: bad timestamp" {
+		t.Fatalf("message = %q", err.Error())
+	}
+}
+
+func TestEncodeErrorTopLevelPathHasNoLeadingDot(t *testing.T) {
+	type Cfg struct {
+		Port encodeErrBad `toml:"port"`
+	}
+	_, err := Marshal(Cfg{})
+	ee, ok := errors.AsType[*EncodeError](err)
+	if !ok {
+		t.Fatalf("expected an *EncodeError, got %T: %v", err, err)
+	}
+	if ee.Path != "port" {
+		t.Fatalf("Path = %q, want %q", ee.Path, "port")
+	}
+	if err.Error() != "interpres: port: bad timestamp" {
+		t.Fatalf("message = %q", err.Error())
+	}
+}
+
+func TestEncodeErrorHeterogeneousArrayPath(t *testing.T) {
+	type Item struct {
+		N int `toml:"n"`
+	}
+	cfg := map[string]any{
+		"items": []any{Item{}, 3},
+	}
+	_, err := Marshal(cfg)
+	if err == nil {
+		t.Fatal("expected a heterogeneous array error")
+	}
+	ee, ok := errors.AsType[*EncodeError](err)
+	if !ok {
+		t.Fatalf("expected an *EncodeError, got %T: %v", err, err)
+	}
+	if ee.Path != "items[0]" {
+		t.Fatalf("Path = %q, want %q", ee.Path, "items[0]")
+	}
+}

fuzz_test.go

@@ -0,0 +1,123 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: MIT
+
+package interpres
+
+import (
+	"math"
+	"reflect"
+	"testing"
+	"time"
+)
+
+// FuzzParse drives the parser with arbitrary input and holds it to the
+// round-trip invariant: every document Parse accepts must survive its own
+// re-emission. Marshal of the parsed tree must succeed, the emitted document
+// must parse again, and the re-parsed tree must equal the original one.
+func FuzzParse(f *testing.F) {
+	seeds := []string{
+		"",
+		"title = \"interpres\"\n",
+		"[server]\nhost = \"localhost\"\nport = 8080\n\n[server.tls]\nenabled = true\n",
+		"[[items]]\nname = \"a\"\n\n[[items]]\nname = \"b\"\n",
+		"inline = { a = 1, b = [2, 3], c = { d = 4 } }\n",
+		"arr = [1, 2.5, \"three\", true, 1979-05-27T07:32:00Z]\n",
+		"mix = [1, {a = 2}, \"x\"]\n",
+		"when = 1979-05-27T07:32:00Z\nlocal = 1979-05-27T07:32:00.999\nd = 1979-05-27\nt = 07:32:00\n",
+		"multi = \"\"\"\nlines\n\"\"\"\nlit = 'literal'\n",
+		"esc = \"\\u0000\\t\\n\\\"\\\\\"\n",
+		"neg = -0.0\nnan = nan\ninf = -inf\nexp = 1e6\n",
+		"\"quoted key\" = 'value'\n'1979-05-27' = 1\na.b.c = { d = \"dotted\" }\n",
+		"hex = 0xFF\noct = 0o755\nbin = 0b1010\nsep = 1_000_000\n",
+		"x = \"unterminated\n",
+		"[a]\n[a]\n",
+		"n = 0x1_0000_0000_0000_0000\n",
+		// TOML 1.1 forms.
+		"t = 13:37\ndt = 1979-05-27T07:32\nodt = 1979-05-27 07:32Z\n",
+		"esc = \"\\e\\x41\\x7f\\x00\"\n",
+		"m = {\n\ta = 1,\n\tb = [1, 2,],\n\tc = { d = 2 },\n} # close\n",
+	}
+	for _, s := range seeds {
+		f.Add([]byte(s))
+	}
+	f.Fuzz(func(t *testing.T, data []byte) {
+		tree, err := Parse(data)
+		if err != nil {
+			return
+		}
+		out, err := Marshal(tree)
+		if err != nil {
+			t.Fatalf("marshal of a parsed tree failed: %v\ntree: %#v", err, tree)
+		}
+		re, err := Parse(out)
+		if err != nil {
+			t.Fatalf("re-parse of the emitted document failed: %v\ndoc:\n%s", err, out)
+		}
+		if !tomlEqual(tree, re) {
+			t.Fatalf("round-trip changed the tree\ninput: %q\ndoc:\n%s\nwas: %#v\nnow: %#v", data, out, tree, re)
+		}
+	})
+}
+
+// tomlEqual reports whether two parsed trees are equal as TOML values. It
+// differs from reflect.DeepEqual where DeepEqual is wrong for this domain:
+// NaN compares equal to itself, date-times compare by their canonical TOML
+// rendering so two parses of one document stay equal, and the local variants
+// compare through their String form, which fully determines the value.
+func tomlEqual(a, b any) bool {
+	switch av := a.(type) {
+	case nil:
+		return b == nil
+	case float64:
+		bv, ok := b.(float64)
+		return ok && (av == bv || (math.IsNaN(av) && math.IsNaN(bv)))
+	case time.Time:
+		bv, ok := b.(time.Time)
+		return ok && av.Format(time.RFC3339Nano) == bv.Format(time.RFC3339Nano)
+	case LocalDateTime:
+		bv, ok := b.(LocalDateTime)
+		return ok && av.String() == bv.String()
+	case LocalDate:
+		bv, ok := b.(LocalDate)
+		return ok && av.String() == bv.String()
+	case LocalTime:
+		bv, ok := b.(LocalTime)
+		return ok && av.String() == bv.String()
+	case []any:
+		bv, ok := b.([]any)
+		if !ok || len(av) != len(bv) {
+			return false
+		}
+		for i := range av {
+			if !tomlEqual(av[i], bv[i]) {
+				return false
+			}
+		}
+		return true
+	case []map[string]any:
+		bv, ok := b.([]map[string]any)
+		if !ok || len(av) != len(bv) {
+			return false
+		}
+		for i := range av {
+			if !tomlEqual(av[i], bv[i]) {
+				return false
+			}
+		}
+		return true
+	case map[string]any:
+		bv, ok := b.(map[string]any)
+		if !ok || len(av) != len(bv) {
+			return false
+		}
+		for k, v := range av {
+			other, ok := bv[k]
+			if !ok || !tomlEqual(v, other) {
+				return false
+			}
+		}
+		return true
+	default:
+		return reflect.DeepEqual(a, b)
+	}
+}

go.mod

@@ -1,3 +1,3 @@
 module sourcedock.dev/petrbalvin/interpres
 
-go 1.27.0
+go 1.27.1

interpres.go

@@ -21,6 +21,7 @@ package interpres
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"unicode/utf8"
 )
@@ -36,6 +37,58 @@ func (e *SyntaxError) Error() string {
 	return fmt.Sprintf("interpres: line %d: %s", e.Line, e.Msg)
 }
 
+// A DecodeError wraps a decoding failure with the key path at which it
+// happened. Path lists one segment per level from the document root, the
+// outermost key first: a key contributes its name and an array element its
+// bracketed index, so the path of the weight field in the first item reads
+// ["items", "[0]", "weight"]. The rendered message is unchanged by the type;
+// read it programmatically with errors.AsType:
+//
+//	if de, ok := errors.AsType[*interpres.DecodeError](err); ok {
+//		fmt.Println(de.Path, de.Err)
+//	}
+type DecodeError struct {
+	// Path is the key path from the document root, outermost key first.
+	Path []string
+	// Err is the failure at that path.
+	Err error
+}
+
+func (e *DecodeError) Error() string { return e.Path[0] + ": " + e.Err.Error() }
+
+// Unwrap returns the failure the path points at.
+func (e *DecodeError) Unwrap() error { return e.Err }
+
+// newDecodeError wraps err with one path segment. The rest of the path comes
+// from the DecodeError err already carries, if any: the decoder wraps each
+// key and index on its way down, so the innermost wrap holds the deepest
+// segments and each outer wrap prepends one.
+func newDecodeError(key string, err error) *DecodeError {
+	path := make([]string, 0, 4)
+	path = append(path, key)
+	if de, ok := errors.AsType[*DecodeError](err); ok {
+		path = append(path, de.Path...)
+	}
+	return &DecodeError{Path: path, Err: err}
+}
+
+// An EncodeError wraps an encoding failure with the key path of the value
+// that failed, in the notation of a TOML document: fields join with dots and
+// an array element carries its bracketed index, so the path of the third
+// port under server reads "server.ports[2]". The rendered message is
+// unchanged by the type; read it programmatically with errors.AsType.
+type EncodeError struct {
+	// Path is the key path of the failing value.
+	Path string
+	// Err is the failure at that path.
+	Err error
+}
+
+func (e *EncodeError) Error() string { return "interpres: " + e.Path + ": " + e.Err.Error() }
+
+// Unwrap returns the failure the path points at.
+func (e *EncodeError) Unwrap() error { return e.Err }
+
 // Parse decodes a TOML document into a nested map[string]any.
 //
 // Values are mapped to Go types as follows: strings to string, integers to
@@ -57,7 +110,9 @@ func ParseContext(ctx context.Context, data []byte) (map[string]any, error) {
 	if !utf8.Valid(data) {
 		return nil, &SyntaxError{Line: 1, Msg: "input is not valid UTF-8"}
 	}
-	p := &parser{src: []rune(string(data)), line: 1, ctx: ctx}
+	// The parser scans data in place; it only reads the buffer, and every
+	// string it stores in the tree is copied out of it.
+	p := &parser{src: data, line: 1, ctx: ctx}
 	return p.parse()
 }
 
@@ -143,20 +198,26 @@ type Unmarshaler interface {
 	UnmarshalTOML(data any) error
 }
 
-// Marshal returns the TOML 1.0 encoding of v.
+// Marshal returns the TOML encoding of v. The output stays within TOML 1.0,
+// so it is valid under both TOML 1.0 and 1.1.
 //
 // Marshal traverses v using reflection and applies the following rules:
 //
 //   - The top-level value must be a struct or a map[string]V. Pointers are
 //     followed; a nil top-level pointer is an error.
 //   - Struct fields are matched by `toml:"name"` tag (case-insensitive
-//     fallback to field name; `-` skips). Anonymous (embedded) fields without
-//     a tag are inlined.
+//     fallback to field name; `-` skips). The tag options `omitzero` (skip
+//     the zero value of the field's type) and `omitempty` (skip an empty
+//     slice, array, or map) drop a field from the output on encode; the
+//     decoder ignores them. Anonymous (embedded) fields without a tag are
+//     inlined.
 //   - Maps use sorted keys for deterministic output.
 //   - Slices and arrays of structs or maps become TOML arrays of tables; a
 //     nil or empty array of tables is omitted (TOML forbids an empty `[[a]]`),
 //     while other empty arrays emit as `key = []`.
-//   - Other slices and arrays become TOML arrays.
+//   - Other slices and arrays become TOML arrays; a table element inside a
+//     value array (for example an inline table in a mixed array) emits as an
+//     inline table.
 //   - Scalars encode as TOML scalars: bool, int64, float64, string, time.Time
 //     (offset date-time), and LocalDateTime/LocalDate/LocalTime (local
 //     variants).

interpres_test.go

@@ -5,6 +5,7 @@ package interpres
 
 import (
 	"math"
+	"strings"
 	"testing"
 	"time"
 )
@@ -316,6 +317,26 @@ func TestDisallowUnknownFields(t *testing.T) {
 	}
 }
 
+func TestDisallowUnknownFieldsReportsSmallestKey(t *testing.T) {
+	// Map iteration order is random, so the reported key must be chosen
+	// deterministically: the smallest unknown key, whichever order the map
+	// iterates in.
+	type C struct {
+		Known string `toml:"known"`
+	}
+	data := []byte("known = \"x\"\nzeta = 1\nalpha = 2\nmu = 3\n")
+	for range 20 {
+		var c C
+		err := NewDecoder().DisallowUnknownFields().Decode(data, &c)
+		if err == nil {
+			t.Fatal("expected error for unknown fields")
+		}
+		if !strings.Contains(err.Error(), `unknown field "alpha"`) {
+			t.Fatalf("err = %v, want the smallest unknown key alpha", err)
+		}
+	}
+}
+
 func TestSkippedFieldTag(t *testing.T) {
 	type C struct {
 		Keep string `toml:"keep"`
@@ -370,6 +391,7 @@ func TestRejectsInvalidNumbers(t *testing.T) {
 		"01", "-01", "00",
 		"1__0", "_1", "1_", "0x_1", "1_.0",
 		"1.", ".5", "1.2.3", "1.e2",
+		"1e", "1e+", "1e-", "0.0E", "0.0e", "1.5e+",
 		"0x", "0o", "0b", "0b2", "0o8", "0xG",
 		"+0x1",
 	} {
@@ -379,6 +401,34 @@ func TestRejectsInvalidNumbers(t *testing.T) {
 	}
 }
 
+func TestParseRejectsOffsetOutOfRange(t *testing.T) {
+	for _, tok := range []string{
+		"1979-05-27T07:32:00+00:60",
+		"1979-05-27T07:32:00-00:99",
+		"1979-05-27T07:32:00+24:00",
+		"1979-05-27T07:32:00+99:99",
+	} {
+		if _, err := Parse([]byte("v = " + tok + "\n")); err == nil {
+			t.Errorf("%q: expected an error, got none", tok)
+		}
+	}
+}
+
+func TestParseAcceptsOffsetBounds(t *testing.T) {
+	tree, err := Parse([]byte("a = 1979-05-27T07:32:00+23:59\nb = 1979-05-27T07:32:00-23:59\n"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	a := tree["a"].(time.Time)
+	if _, offset := a.Zone(); offset != 23*3600+59*60 {
+		t.Fatalf("a offset = %d, want %d", offset, 23*3600+59*60)
+	}
+	b := tree["b"].(time.Time)
+	if _, offset := b.Zone(); offset != -(23*3600 + 59*60) {
+		t.Fatalf("b offset = %d", offset)
+	}
+}
+
 func TestAcceptsNumberEdgeCases(t *testing.T) {
 	cases := map[string]any{
 		"0":           int64(0),
@@ -392,6 +442,10 @@ func TestAcceptsNumberEdgeCases(t *testing.T) {
 		"3.14":        3.14,
 		"6.022e23":    6.022e23,
 		"1e10":        1e10,
+		"1e0":         1.0,
+		"1e06":        1e6,
+		"0e00":        0.0,
+		"2E-3":        2e-3,
 		"-2.5E-3":     -2.5e-3,
 	}
 	for tok, want := range cases {
@@ -458,6 +512,9 @@ func TestRejectsInlineTableExtension(t *testing.T) {
 		"by header":      "a = { b = 1 }\n[a.c]\nx = 2\n",
 		"by dotted key":  "a = { b = 1 }\na.c = 2\n",
 		"header over it": "a = { b = 1 }\n[a]\nx = 2\n",
+		// The frozen check must cover the intermediate steps of an array-of-tables
+		// header, not only the leaf: [[a.b.c]] walks through a and a.b.
+		"by nested array header": "a = { b = {} }\n[[a.b.c]]\nx = 2\n",
 	}
 	for name, doc := range cases {
 		if _, err := Parse([]byte(doc)); err == nil {
@@ -466,6 +523,36 @@ func TestRejectsInlineTableExtension(t *testing.T) {
 	}
 }
 
+// A new element of an array of tables starts a fresh scope: sub-table headers,
+// nested arrays of tables, and dotted-key paths recorded for the previous
+// element must not block the same paths in the next one.
+func TestArrayOfTablesFreshScopePerElement(t *testing.T) {
+	cases := map[string]string{
+		"nested array of tables": "[[a]]\n[[a.b]]\nx = 1\n[[a]]\n[a.b]\ny = 2\n",
+		"dotted key":             "[[a]]\nb.c = 1\n[[a]]\n[a.b]\nd = 2\n",
+	}
+	for name, doc := range cases {
+		tree, err := Parse([]byte(doc))
+		if err != nil {
+			t.Errorf("%s: %v", name, err)
+			continue
+		}
+		elements := tree["a"].([]map[string]any)
+		if len(elements) != 2 {
+			t.Errorf("%s: len(a) = %d, want 2", name, len(elements))
+		}
+	}
+	// Within one element the redefinition rules keep applying.
+	for name, doc := range map[string]string{
+		"header over dotted in one element": "[[a]]\nb.c = 1\n[a.b]\nd = 2\n",
+		"table over nested array":           "[[a]]\n[[a.b]]\n[a.b]\nx = 1\n",
+	} {
+		if _, err := Parse([]byte(doc)); err == nil {
+			t.Errorf("%s: expected an error, got none", name)
+		}
+	}
+}
+
 func TestRejectsSpecInvalid(t *testing.T) {
 	cases := map[string]string{
 		"single-digit hour":       "a = 2023-10-01T1:32:00Z\n",
@@ -474,7 +561,8 @@ func TestRejectsSpecInvalid(t *testing.T) {
 		"dotted over header":      "[a.b]\nx = 1\n[a]\nb.y = 2\n",
 		"table over array":        "[[t]]\n[t]\n",
 		"truncated datetime":      "a = 2026-01-02T\n",
-		"datetime no seconds":     "a = 2026-01-02T07:32\n",
+		// "datetime no seconds" moved to the acceptance tests: TOML 1.1
+		// makes the seconds optional.
 	}
 	for name, doc := range cases {
 		if _, err := Parse([]byte(doc)); err == nil {
@@ -511,3 +599,105 @@ host = "h2"
 		t.Errorf("forms[1].smtp.host = %v", h)
 	}
 }
+
+// --- TOML 1.1 --------------------------------------------------------------
+
+func TestParseAcceptsNoSecondsDatetimes(t *testing.T) {
+	tree, err := Parse([]byte(`t = 13:37
+dt = 1979-05-27T07:32
+odt1 = 1979-05-27 07:32Z
+odt2 = 1979-05-27 07:32-07:00
+`))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if got := tree["t"].(LocalTime).String(); got != "13:37:00" {
+		t.Errorf("t = %q, want %q", got, "13:37:00")
+	}
+	if got := tree["dt"].(LocalDateTime).String(); got != "1979-05-27T07:32:00" {
+		t.Errorf("dt = %q, want %q", got, "1979-05-27T07:32:00")
+	}
+	if got := tree["odt1"].(time.Time).Format(time.RFC3339Nano); got != "1979-05-27T07:32:00Z" {
+		t.Errorf("odt1 = %q", got)
+	}
+	if got := tree["odt2"].(time.Time).Format(time.RFC3339Nano); got != "1979-05-27T07:32:00-07:00" {
+		t.Errorf("odt2 = %q", got)
+	}
+	// The fraction still requires the seconds it belongs to.
+	if _, err := Parse([]byte("a = 07:32.5\n")); err == nil {
+		t.Error("07:32.5: expected an error, got none")
+	}
+}
+
+func TestParseAcceptsEscapeAndHexEscapes(t *testing.T) {
+	tree, err := Parse([]byte(`esc = "\e"
+hex = "\x20\x7f\xf8"
+nul = "\x00"
+multi = """\x68\x65"""
+lit = '\x20'
+`))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if got := tree["esc"].(string); got != "\x1b" {
+		t.Errorf("esc = %q, want the escape character", got)
+	}
+	if got := tree["hex"].(string); got != " \x7f\u00f8" {
+		t.Errorf("hex = %q", got)
+	}
+	if got := tree["nul"].(string); got != "\x00" {
+		t.Errorf("nul = %q", got)
+	}
+	if got := tree["multi"].(string); got != "he" {
+		t.Errorf("multi = %q", got)
+	}
+	// A literal string carries the sequence verbatim.
+	if got := tree["lit"].(string); got != `\x20` {
+		t.Errorf("lit = %q, want the verbatim sequence", got)
+	}
+	// Two digits exactly; a short or non-hex escape is an error.
+	for _, doc := range []string{`a = "\x4"`, `a = "\x"`, `a = "\xgg"`} {
+		if _, err := Parse([]byte(doc)); err == nil {
+			t.Errorf("%s: expected an error, got none", doc)
+		}
+	}
+}
+
+func TestParseAcceptsMultilineInlineTables(t *testing.T) {
+	tree, err := Parse([]byte("tbl = {\n\thello = \"world\",\n\tarr = [1,\n\t\t2,\n\t],\n\tsub = {\n\t\tk = 1,\n\t},\n\tbare = 2}\n"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	tbl := tree["tbl"].(map[string]any)
+	if tbl["hello"] != "world" || tbl["bare"] != int64(2) {
+		t.Fatalf("tbl = %#v", tbl)
+	}
+	if arr := tbl["arr"].([]any); len(arr) != 2 {
+		t.Errorf("arr = %#v", tbl["arr"])
+	}
+	if sub := tbl["sub"].(map[string]any); sub["k"] != int64(1) {
+		t.Errorf("sub = %#v", tbl["sub"])
+	}
+	// Comments inside the table, and a trailing comma at both depths.
+	tree, err = Parse([]byte("m = { # one\n\t# two\n\ta = 1, # three\n\t# four\n}\n"))
+	if err != nil {
+		t.Fatalf("parse with comments: %v", err)
+	}
+	if m := tree["m"].(map[string]any); m["a"] != int64(1) {
+		t.Errorf("m = %#v", m)
+	}
+	// The old single-line shapes keep working, with and without the comma.
+	if _, err := Parse([]byte("a = { b = 1, c = 2 }\n")); err != nil {
+		t.Errorf("single line: %v", err)
+	}
+	// Still rejected: two commas, a missing value, and an unclosed table.
+	for name, doc := range map[string]string{
+		"double comma":  "a = { b = 1,, c = 2 }\n",
+		"missing value": "a = {\n\tb =\n}\n",
+		"unterminated":  "a = { b = 1,\n",
+	} {
+		if _, err := Parse([]byte(doc)); err == nil {
+			t.Errorf("%s: expected an error, got none", name)
+		}
+	}
+}

justfile

@@ -92,9 +92,9 @@ run:
 dev:
     go run -buildvcs=true {{package}}
 
-# Runs the official toml-test compliance suite against the built adapter; toml-test must be on PATH (go install github.com/toml-lang/toml-test/cmd/toml-test@v1.6.0); not standard because no canonical recipe covers a domain compliance suite.
+# Runs the official toml-test compliance suite against the built adapter; toml-test must be on PATH (go install github.com/toml-lang/toml-test/v2/cmd/toml-test@v2.2.0); not standard because no canonical recipe covers a domain compliance suite.
 toml-test: build
-    toml-test bin/interpres-decode
+    toml-test test -decoder=bin/interpres-decode -toml=1.1
 
 # Coverage report as an HTML map from the gate's profile; not standard because the gate needs only the numeric floor, and a browser artefact is exploration, not a gate.
 coverage-html: test

number.go

@@ -74,15 +74,16 @@ func decodeFloat(tok string) (any, error) {
 	sign, s := splitSign(tok)
 
 	mantissa, exp := s, ""
+	hasExp := false
 	if i := strings.IndexAny(s, "eE"); i >= 0 {
-		mantissa, exp = s[:i], s[i+1:]
+		mantissa, exp, hasExp = s[:i], s[i+1:], true
 	}
 
 	intPart, frac, hasDot := mantissa, "", false
 	if i := strings.IndexByte(mantissa, '.'); i >= 0 {
 		intPart, frac, hasDot = mantissa[:i], mantissa[i+1:], true
 	}
-	if !hasDot && exp == "" {
+	if !hasDot && !hasExp {
 		return nil, fmt.Errorf("invalid float %q", tok)
 	}
 
@@ -93,24 +94,43 @@ func decodeFloat(tok string) (any, error) {
 	if err := checkNoLeadingZero(ip); err != nil {
 		return nil, err
 	}
-	build := sign + ip
 
+	fp := ""
 	if hasDot {
-		fp, err := joinDigits(frac, isDecDigit)
-		if err != nil {
+		if fp, err = joinDigits(frac, isDecDigit); err != nil {
 			return nil, err
 		}
+	}
+	// The ABNF requires at least one digit after the exponent marker, so a
+	// trailing e or E is an error even though strconv would accept it. The
+	// digits are a zero-prefixable integer, so leading zeros are fine here
+	// (the corpus holds valid cases such as 1e06 and 0e00).
+	esign, ed := "", ""
+	if hasExp {
+		var digits string
+		esign, digits = splitSign(exp)
+		if ed, err = joinDigits(digits, isDecDigit); err != nil {
+			return nil, err
+		}
+	}
+
+	// The checks above validated the token's shape, and every character a
+	// valid token may carry is one strconv.ParseFloat accepts in place, so
+	// only a token with underscores needs the stripped rebuild.
+	if !strings.ContainsRune(tok, '_') {
+		f, err := strconv.ParseFloat(tok, 64)
+		if err != nil {
+			return nil, fmt.Errorf("invalid float %q", tok)
+		}
+		return f, nil
+	}
+	build := sign + ip
+	if hasDot {
 		build += "." + fp
 	}
-	if exp != "" {
-		esign, edigits := splitSign(exp)
-		ed, err := joinDigits(edigits, isDecDigit)
-		if err != nil {
-			return nil, err
-		}
+	if hasExp {
 		build += "e" + esign + ed
 	}
-
 	f, err := strconv.ParseFloat(build, 64)
 	if err != nil {
 		return nil, fmt.Errorf("invalid float %q", tok)
@@ -120,11 +140,20 @@ func decodeFloat(tok string) (any, error) {
 
 // joinDigits validates that every rune is a digit (per isDigit) and that each
 // underscore sits between two digits, returning the digits with underscores
-// removed.
+// removed. A token without underscores, the common case, is validated in
+// place and returned without a copy.
 func joinDigits(s string, isDigit func(byte) bool) (string, error) {
 	if s == "" {
 		return "", fmt.Errorf("number is missing digits")
 	}
+	if !strings.ContainsRune(s, '_') {
+		for i := range len(s) {
+			if !isDigit(s[i]) {
+				return "", fmt.Errorf("invalid character %q in number", string(s[i]))
+			}
+		}
+		return s, nil
+	}
 	var b strings.Builder
 	for i := range len(s) {
 		c := s[i]

parser.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 )
 
 // ctxCheckInterval is the number of top-level parser iterations between
@@ -16,8 +17,15 @@ import (
 const ctxCheckInterval = 64
 
 // parser is a recursive-descent TOML parser producing a map[string]any tree.
+//
+// The scanner works on bytes, not runes: the input is validated UTF-8 before
+// the parser runs, every character that drives the grammar (quotes,
+// separators, newlines, bare-key characters) is ASCII, and multi-byte runes
+// matter only as string content, where they are decoded on the spot. Holding
+// the source as []rune instead would cost a conversion pass plus four bytes
+// per rune of extra memory before parsing even starts.
 type parser struct {
-	src  []rune
+	src  []byte
 	pos  int
 	line int
 	ctx  context.Context
@@ -85,10 +93,10 @@ func (p *parser) checkCtx() error {
 
 func (p *parser) parseTableHeader() error {
 	array := false
-	p.next() // consume '['
+	p.pos++ // consume '['
 	if !p.eof() && p.peek() == '[' {
 		array = true
-		p.next()
+		p.pos++
 	}
 
 	key, err := p.parseKeyPath()
@@ -100,12 +108,12 @@ func (p *parser) parseTableHeader() error {
 	if p.eof() || p.peek() != ']' {
 		return p.errf("expected ']' to close table header")
 	}
-	p.next()
+	p.pos++
 	if array {
 		if p.eof() || p.peek() != ']' {
 			return p.errf("expected ']]' to close array-of-tables header")
 		}
-		p.next()
+		p.pos++
 	}
 
 	if array {
@@ -171,7 +179,12 @@ func (p *parser) tableAt(key []string) (map[string]any, error) {
 
 func (p *parser) appendArrayTable(key []string) (map[string]any, error) {
 	parent := p.root
+	path := make([]string, 0, len(key))
 	for _, k := range key[:len(key)-1] {
+		path = append(path, k)
+		if p.frozen[pathKey(path)] {
+			return nil, p.errf("cannot extend inline table %q", strings.Join(path, "."))
+		}
 		existing, ok := parent[k]
 		if !ok {
 			next := map[string]any{}
@@ -213,7 +226,7 @@ func (p *parser) parseKeyValue() error {
 	if p.eof() || p.peek() != '=' {
 		return p.errf("expected '=' after key")
 	}
-	p.next()
+	p.pos++
 	p.skipInline()
 
 	val, err := p.parseValue()
@@ -222,7 +235,10 @@ func (p *parser) parseKeyValue() error {
 	}
 
 	dest := p.current
-	abs := append([]string{}, p.currentPath...)
+	// One allocation covers the current section plus the dotted key; a
+	// top-level statement reuses it for the leaf.
+	abs := make([]string, 0, len(p.currentPath)+len(key))
+	abs = append(abs, p.currentPath...)
 	for _, k := range key[:len(key)-1] {
 		abs = append(abs, k)
 		if p.frozen[pathKey(abs)] {
@@ -269,19 +285,18 @@ func (p *parser) freezeInline(path []string, val any) {
 	}
 }
 
-// resetScopeUnder forgets the header and freeze records nested under key, which
-// belong to the previous element of an array of tables.
+// resetScopeUnder forgets the definition records nested under key, which
+// belong to the previous element of an array of tables: headers, frozen
+// inline tables, dotted-key paths, and nested arrays of tables all start
+// fresh in the new element.
 func (p *parser) resetScopeUnder(key []string) {
 	prefix := pathKey(key) + "\x00"
-	for k := range p.headers {
+	for _, m := range []map[string]bool{p.headers, p.frozen, p.dotted, p.arrays} {
+		for k := range m {
 			if strings.HasPrefix(k, prefix) {
-			delete(p.headers, k)
+				delete(m, k)
 			}
 		}
-	for k := range p.frozen {
-		if strings.HasPrefix(k, prefix) {
-			delete(p.frozen, k)
-		}
 	}
 }
 
@@ -297,7 +312,7 @@ func (p *parser) parseKeyPath() ([]string, error) {
 		parts = append(parts, part)
 		p.skipInline()
 		if !p.eof() && p.peek() == '.' {
-			p.next()
+			p.pos++
 			continue
 		}
 		break
@@ -309,7 +324,7 @@ func (p *parser) parseKeyComponent() (string, error) {
 	if p.eof() {
 		return "", p.errf("expected a key")
 	}
-	switch c := p.peek(); c {
+	switch p.peek() {
 	case '"':
 		if p.lookahead(`"""`) {
 			return "", p.errf("multiline strings are not allowed in keys")
@@ -326,13 +341,14 @@ func (p *parser) parseKeyComponent() (string, error) {
 			c := p.peek()
 			if (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
 				(c >= '0' && c <= '9') || c == '_' || c == '-' {
-				p.next()
+				p.pos++
 				continue
 			}
 			break
 		}
 		if p.pos == start {
-			return "", p.errf("invalid key character %q", string(p.peek()))
+			r, _ := utf8.DecodeRune(p.src[p.pos:])
+			return "", p.errf("invalid key character %q", string(r))
 		}
 		return string(p.src[start:p.pos]), nil
 	}
@@ -381,7 +397,7 @@ func (p *parser) parseAtom() (any, error) {
 	// A date may be followed by a space and a time, forming one date-time.
 	if isDateToken(tok) && !p.eof() && p.peek() == ' ' {
 		if next, ok := p.peekAt(1); ok && next >= '0' && next <= '9' {
-			p.next() // consume the separating space
+			p.pos++ // consume the separating space
 			timeStart := p.pos
 			p.scanBareToken()
 			tok = tok + " " + string(p.src[timeStart:p.pos])
@@ -406,7 +422,7 @@ func (p *parser) scanBareToken() {
 			c == ',' || c == ']' || c == '}' || c == '#' {
 			return
 		}
-		p.next()
+		p.pos++
 	}
 }
 
@@ -416,31 +432,32 @@ func (p *parser) parseBasicString() (string, error) {
 	if p.lookahead(`"""`) {
 		return p.parseMultilineString('"', true)
 	}
-	p.next() // opening quote
+	p.pos++ // opening quote
 	var b strings.Builder
 	for {
 		if p.eof() {
 			return "", p.errf("unterminated string")
 		}
-		c := p.next()
+		c := p.peek()
 		switch c {
 		case '"':
+			p.pos++
 			return b.String(), nil
 		case '\n':
 			return "", p.errf("unterminated string")
 		case '\r':
 			return "", p.errf("bare carriage return is not allowed in a string")
 		case '\\':
+			p.pos++
 			r, err := p.readEscape()
 			if err != nil {
 				return "", err
 			}
 			b.WriteRune(r)
 		default:
-			if isControlRune(c) {
-				return "", p.errf("control character U+%04X is not allowed in a string", c)
+			if err := p.writeContentRune(&b); err != nil {
+				return "", err
 			}
-			b.WriteRune(c)
 		}
 	}
 }
@@ -449,38 +466,58 @@ func (p *parser) parseLiteralString() (string, error) {
 	if p.lookahead(`'''`) {
 		return p.parseMultilineString('\'', false)
 	}
-	p.next() // opening quote
+	p.pos++ // opening quote
 	var b strings.Builder
 	for {
 		if p.eof() {
 			return "", p.errf("unterminated literal string")
 		}
-		c := p.next()
-		if c == '\'' {
+		c := p.peek()
+		switch c {
+		case '\'':
+			p.pos++
 			return b.String(), nil
-		}
-		if c == '\n' {
+		case '\n':
 			return "", p.errf("unterminated literal string")
-		}
-		if c == '\r' {
+		case '\r':
 			return "", p.errf("bare carriage return is not allowed in a string")
+		default:
+			if err := p.writeContentRune(&b); err != nil {
+				return "", err
 			}
-		if isControlRune(c) {
-			return "", p.errf("control character U+%04X is not allowed in a string", c)
 		}
-		b.WriteRune(c)
 	}
 }
 
-func (p *parser) parseMultilineString(quote rune, escapes bool) (string, error) {
+// writeContentRune appends the rune at the cursor to b and advances past it.
+// An ASCII byte, which includes every control character the grammar forbids,
+// is checked and written directly; a multi-byte rune is decoded and can never
+// be a control character.
+func (p *parser) writeContentRune(b *strings.Builder) error {
+	c := p.peek()
+	if c < utf8.RuneSelf {
+		if isControlRune(rune(c)) {
+			return p.errf("control character U+%04X is not allowed in a string", c)
+		}
+		p.pos++
+		b.WriteByte(c)
+		return nil
+	}
+	r, size := utf8.DecodeRune(p.src[p.pos:])
+	p.pos += size
+	b.WriteRune(r)
+	return nil
+}
+
+func (p *parser) parseMultilineString(quote byte, escapes bool) (string, error) {
 	p.skipN(3) // opening delimiter
 	// A newline immediately after the opening delimiter is trimmed.
 	if !p.eof() && p.peek() == '\r' {
-		p.next()
+		p.pos++
 	}
 	if !p.eof() && p.peek() == '\n' {
 		p.line++
-		p.next()
+		p.pos++
 	}
 
 	var b strings.Builder
@@ -500,31 +537,32 @@ func (p *parser) parseMultilineString(quote rune, escapes bool) (string, error)
 					return "", p.errf("too many '%c' before the closing delimiter", quote)
 				}
 				for range n - 3 {
-					b.WriteRune(quote)
+					b.WriteByte(quote)
 				}
 				p.skipN(n)
 				return b.String(), nil
 			}
 			for range n {
-				b.WriteRune(quote)
-				p.next()
+				b.WriteByte(quote)
+				p.pos++
 			}
 			continue
 		}
-		c := p.next()
-		if c == '\n' {
+		c := p.peek()
+		switch {
+		case c == '\n':
 			p.line++
-			b.WriteRune(c)
-			continue
-		}
-		if c == '\r' {
-			if !p.eof() && p.peek() == '\n' {
-				b.WriteRune(c)
+			p.pos++
+			b.WriteByte(c)
+		case c == '\r':
+			if p.pos+1 < len(p.src) && p.src[p.pos+1] == '\n' {
+				b.WriteByte(c)
+				p.pos++
 				continue
 			}
 			return "", p.errf("bare carriage return is not allowed in a string")
-		}
-		if escapes && c == '\\' {
+		case escapes && c == '\\':
+			p.pos++
 			// Line-ending backslash trims the following whitespace/newlines.
 			if p.trimLineEndingBackslash() {
 				continue
@@ -534,12 +572,11 @@ func (p *parser) parseMultilineString(quote rune, escapes bool) (string, error)
 				return "", err
 			}
 			b.WriteRune(r)
-			continue
+		default:
+			if err := p.writeContentRune(&b); err != nil {
+				return "", err
 			}
-		if isControlRune(c) {
-			return "", p.errf("control character U+%04X is not allowed in a string", c)
 		}
-		b.WriteRune(c)
 	}
 }
 
@@ -551,7 +588,7 @@ func (p *parser) trimLineEndingBackslash() bool {
 	for !p.eof() {
 		c := p.peek()
 		if c == ' ' || c == '\t' || c == '\r' {
-			p.next()
+			p.pos++
 			continue
 		}
 		if c == '\n' {
@@ -570,11 +607,11 @@ func (p *parser) trimLineEndingBackslash() bool {
 		c := p.peek()
 		if c == '\n' {
 			p.line++
-			p.next()
+			p.pos++
 			continue
 		}
 		if c == ' ' || c == '\t' || c == '\r' {
-			p.next()
+			p.pos++
 			continue
 		}
 		break
@@ -598,16 +635,25 @@ func (p *parser) readEscape() (rune, error) {
 		return '\f', nil
 	case 'r':
 		return '\r', nil
+	case 'e':
+		// TOML 1.1: the escape character.
+		return '\x1b', nil
 	case '"':
 		return '"', nil
 	case '\\':
 		return '\\', nil
+	case 'x':
+		// TOML 1.1: two hex digits, code points 0x00 through 0xFF.
+		return p.readUnicode(2)
 	case 'u':
 		return p.readUnicode(4)
 	case 'U':
 		return p.readUnicode(8)
 	default:
-		return 0, p.errf("invalid escape sequence \\%c", c)
+		// The byte just consumed starts a rune: the backslash before it is a
+		// boundary, and the input is valid UTF-8.
+		r, _ := utf8.DecodeRune(p.src[p.pos-1:])
+		return 0, p.errf("invalid escape sequence \\%c", r)
 	}
 }
 
@@ -630,17 +676,17 @@ func (p *parser) readUnicode(n int) (rune, error) {
 // --- arrays and inline tables ---------------------------------------------
 
 func (p *parser) parseArray() (any, error) {
-	p.next() // '['
+	p.pos++ // '['
 	arr := []any{}
 	for {
-		if err := p.skipArraySpace(); err != nil {
+		if err := p.skipNestedSpace(); err != nil {
 			return nil, err
 		}
 		if p.eof() {
 			return nil, p.errf("unterminated array")
 		}
 		if p.peek() == ']' {
-			p.next()
+			p.pos++
 			return arr, nil
 		}
 		v, err := p.parseValue()
@@ -648,7 +694,7 @@ func (p *parser) parseArray() (any, error) {
 			return nil, err
 		}
 		arr = append(arr, v)
-		if err := p.skipArraySpace(); err != nil {
+		if err := p.skipNestedSpace(); err != nil {
 			return nil, err
 		}
 		if p.eof() {
@@ -656,9 +702,9 @@ func (p *parser) parseArray() (any, error) {
 		}
 		switch p.peek() {
 		case ',':
-			p.next()
+			p.pos++
 		case ']':
-			p.next()
+			p.pos++
 			return arr, nil
 		default:
 			return nil, p.errf("expected ',' or ']' in array")
@@ -667,16 +713,23 @@ func (p *parser) parseArray() (any, error) {
 }
 
 func (p *parser) parseInlineTable() (any, error) {
-	p.next() // '{'
+	p.pos++ // '{'
 	tbl := map[string]any{}
 	assigned := map[string]bool{}
-	p.skipInline()
+	// TOML 1.1 lets an inline table span lines: interior whitespace includes
+	// newlines and comments, and a trailing comma is allowed before the
+	// closing brace.
+	if err := p.skipNestedSpace(); err != nil {
+		return nil, err
+	}
 	if !p.eof() && p.peek() == '}' {
-		p.next()
+		p.pos++
 		return tbl, nil
 	}
 	for {
-		p.skipInline()
+		if err := p.skipNestedSpace(); err != nil {
+			return nil, err
+		}
 		key, err := p.parseKeyPath()
 		if err != nil {
 			return nil, err
@@ -685,7 +738,7 @@ func (p *parser) parseInlineTable() (any, error) {
 		if p.eof() || p.peek() != '=' {
 			return nil, p.errf("expected '=' in inline table")
 		}
-		p.next()
+		p.pos++
 		p.skipInline()
 		val, err := p.parseValue()
 		if err != nil {
@@ -720,15 +773,24 @@ func (p *parser) parseInlineTable() (any, error) {
 		dest[leaf] = val
 		assigned[pathKey(path)] = true
 
-		p.skipInline()
+		if err := p.skipNestedSpace(); err != nil {
+			return nil, err
+		}
 		if p.eof() {
 			return nil, p.errf("unterminated inline table")
 		}
 		switch p.peek() {
 		case ',':
-			p.next()
+			p.pos++
+			if err := p.skipNestedSpace(); err != nil {
+				return nil, err
+			}
+			if !p.eof() && p.peek() == '}' {
+				p.pos++
+				return tbl, nil
+			}
 		case '}':
-			p.next()
+			p.pos++
 			return tbl, nil
 		default:
 			return nil, p.errf("expected ',' or '}' in inline table")
@@ -739,12 +801,12 @@ func (p *parser) parseInlineTable() (any, error) {
 // --- scanning helpers ------------------------------------------------------
 
 func (p *parser) eof() bool  { return p.pos >= len(p.src) }
-func (p *parser) peek() rune { return p.src[p.pos] }
+func (p *parser) peek() byte { return p.src[p.pos] }
 
-// peekAt returns the rune at offset n from the current position and whether the
+// peekAt returns the byte at offset n from the current position and whether the
 // offset is within the source. Use it instead of indexing p.src directly when
 // the offset may sit past the end.
-func (p *parser) peekAt(n int) (rune, bool) {
+func (p *parser) peekAt(n int) (byte, bool) {
 	i := p.pos + n
 	if i < 0 || i >= len(p.src) {
 		return 0, false
@@ -752,7 +814,7 @@ func (p *parser) peekAt(n int) (rune, bool) {
 	return p.src[i], true
 }
 
-func (p *parser) next() rune {
+func (p *parser) next() byte {
 	c := p.src[p.pos]
 	p.pos++
 	return c
@@ -766,49 +828,43 @@ func (p *parser) skipN(n int) {
 
 func (p *parser) match(word string) bool {
 	if p.lookahead(word) {
-		p.skipN(len([]rune(word)))
+		p.skipN(len(word))
 		return true
 	}
 	return false
 }
 
+// lookahead reports whether s follows the cursor. Every lookahead argument in
+// the grammar is ASCII, so comparing bytes is exact.
 func (p *parser) lookahead(s string) bool {
-	r := []rune(s)
-	if p.pos+len(r) > len(p.src) {
-		return false
-	}
-	for i, c := range r {
-		if p.src[p.pos+i] != c {
-			return false
-		}
-	}
-	return true
+	return p.pos+len(s) <= len(p.src) && string(p.src[p.pos:p.pos+len(s)]) == s
 }
 
 // skipInline consumes spaces and tabs only.
 func (p *parser) skipInline() {
 	for !p.eof() {
 		if c := p.peek(); c == ' ' || c == '\t' {
-			p.next()
+			p.pos++
 			continue
 		}
 		break
 	}
 }
 
-// skipArraySpace consumes whitespace, newlines, and comments inside arrays.
-func (p *parser) skipArraySpace() error {
+// skipNestedSpace consumes whitespace, newlines, and comments inside a value
+// container (an array, or an inline table under TOML 1.1).
+func (p *parser) skipNestedSpace() error {
 	for !p.eof() {
 		switch p.peek() {
 		case ' ', '\t':
-			p.next()
+			p.pos++
 		case '\r':
 			if err := p.expectCRLF(); err != nil {
 				return err
 			}
 		case '\n':
 			p.line++
-			p.next()
+			p.pos++
 		case '#':
 			if err := p.skipComment(); err != nil {
 				return err
@@ -825,14 +881,14 @@ func (p *parser) skipBlank() error {
 	for !p.eof() {
 		switch p.peek() {
 		case ' ', '\t':
-			p.next()
+			p.pos++
 		case '\r':
 			if err := p.expectCRLF(); err != nil {
 				return err
 			}
 		case '\n':
 			p.line++
-			p.next()
+			p.pos++
 		case '#':
 			if err := p.skipComment(); err != nil {
 				return err
@@ -845,7 +901,7 @@ func (p *parser) skipBlank() error {
 }
 
 func (p *parser) skipComment() error {
-	p.next() // consume '#'
+	p.pos++ // consume '#'
 	for !p.eof() {
 		c := p.peek()
 		switch {
@@ -857,11 +913,11 @@ func (p *parser) skipComment() error {
 			}
 			return p.errf("bare carriage return is not allowed")
 		case c == '\t':
-			p.next()
+			p.pos++
 		case c < 0x20 || c == 0x7f:
 			return p.errf("control character U+%04X is not allowed in a comment", c)
 		default:
-			p.next()
+			p.pos++
 		}
 	}
 	return nil
@@ -871,7 +927,7 @@ func (p *parser) skipComment() error {
 // line feed; a bare CR is invalid.
 func (p *parser) expectCRLF() error {
 	if p.pos+1 < len(p.src) && p.src[p.pos+1] == '\n' {
-		p.next() // consume CR; the LF is handled by the caller
+		p.pos++ // consume CR; the LF is handled by the caller
 		return nil
 	}
 	return p.errf("bare carriage return is not allowed")
@@ -902,10 +958,11 @@ func (p *parser) expectLineEnd() error {
 	}
 	if p.peek() == '\n' {
 		p.line++
-		p.next()
+		p.pos++
 		return nil
 	}
-	return p.errf("unexpected %q after value", string(p.peek()))
+	r, _ := utf8.DecodeRune(p.src[p.pos:])
+	return p.errf("unexpected %q after value", string(r))
 }
 
 func (p *parser) errf(format string, args ...any) error {

testdata/fuzz/FuzzParse/d0e5d6fc3b865cfa

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("0=[{}]")