- A link that fails puts the realm's timers back as they were before its
own script ran, and turns no layer: timers it set are dropped, timers it
cleared come back (timers::save/restore in Realm::run_job).
- In a read-only document a link's requests still apply when its field
changes can't; the outcome carries the read-only error.
- app.openDoc during a calculation (calculateNow) is noted on the console
and not queued, as for a field script running on its own.
- Link script streams are decoded once per stream, whatever their source
length, and /Filter [] reads as the raw source.
- The web build sets the view's zoom, page and highlight before a link
script runs, as the desktop does.
Since Rust 1.100, clippy's needless_bool refused program_is_executable on Windows: with the
#[cfg(unix)] block gone it read if ... { return false; } true, and the Windows gate failed on
every main commit since 13 Nov 09:38. The check is now one expression with the platform part
in has_execute_permission; behaviour is unchanged on every platform.
* fix(optimize): a destination name given by reference is copied once however many dictionaries name it
* fix(optimize): aliases of one destination-name object are copied once
home_recent_context_menu_reveals_the_target_without_opening_or_removing_it
never set run_inline, so reveal_path checked the missing file on a
pdfcraft-reveal worker thread while the test waited a fixed three frames
before asserting the "The file no longer exists" toast. On a loaded runner
the worker can report after those frames and the assertion fails. Set
run_inline, as the reveal unit test in tab_context.rs already does.
* fix(ui): Recognize Text's settings scroll in a short window, its buttons stay in reach (#6599)
On a small screen or at a large display scale the dialog was taller than the window: it was
centred with its title and its Cancel / Recognize text row off the screen, and nothing scrolled.
The four settings groups (Pages, Settings, Skip, Output folder) now sit in a vertical scroll area
capped to the window's height, as Preferences does (#3557). The title, the engine notice and the
button row stay outside it, so they are always on screen; when the settings fit, nothing changes.
The test opens the dialog in 400 to 700 pt windows and checks the title and both buttons are on
screen, and that the last group scrolls in between the title and the buttons while they stay put.
Without the fix it fails at 400 pt with the title at y = -267.
* contributors: credit asadosteaksnl as Kas
* fix(ui): Recognize Text's settings scroll in as little as 40 pt, so its buttons fit the smallest window (#6599)
A 120 pt floor still pushed the dialog off a window shorter than about 340 pt: at 173 pt (the
smallest window, 520 pt, at the largest interface size, 300%) the title sat at y = -32. The test
now checks 173, 208 and 260 pt windows too, as the Preferences layout test does.
* test(ui): the short-window Recognize Text test clicks Cancel and checks a 640 pt wide window (#6599)
Cancel being on screen isn't proof it can be clicked: the test now clicks it at every height and checks the dialog closes. The window is 640 pt across, a 1280-pixel screen at 200%, and every control is checked to fit across as well as down.
* test(ui): the Recognize Text title stays put while the settings scroll (#6599)
* Revert "contributors: credit asadosteaksnl as Kas"
This reverts commit 52470f66a7.
* docs(ui): document the Recognize Text dialog's body (#6599)
* test(ui): the Recognize Text test also covers tall windows where nothing scrolls (#6599)
The dialog is about 935 pt tall, so it scrolls up to a 900 pt window; at 1100 pt everything fits. Both now run, so the test also pins the case where the settings fit and the layout is unchanged.
---------
Co-authored-by: asadosteaksnl <353856209+asadosteaksnl@users.noreply.github.com>
Main now has page actions, timers and layers (#6985) and shared text
allowances for inspection (#6015). Conflicts:
- render/inspect/annotations.rs: main's collect_link (which notes
JavaScript even when the link isn't listed) takes this branch's link
script budget and its once-only warning; push_link is gone.
- automation form_tools.rs, js tests.rs, docs/acroform-script-workflows.md:
both sides added at the same place; both kept.
Adapted to main: the link runner's Job gets `timer: None`, and, as a
button's script does, the document's layers and the fields as page
actions and timers show them (live_state).
After the edit ran, a batch can still fail the redaction checks: a
deleted marked page alongside added pages, or text still shown under a
mark. Both returned without discard_edit_callbacks, so globals (and now
timers) the batch's field scripts left stayed in the document's realm
while the document rolled back. Every other refusal after the edit
already discards them.
Test: a_batch_a_redaction_check_refuses_discards_callback_globals. A
keystroke script sets a global, and a batch that sets the field and
deletes the marked page while adding one is refused. Without the fix the
global is still there ("number" for "undefined").
vendor/README.md conflicted: main took hayro-interpret patch 104 (RGB
colours in isolated DeviceCMYK groups). This branch's viewer overrides
become patches 105 (annotation_overrides) and 106 (appearance_overrides)
in the README, in vendor/hayro-interpret/src/interpret/mod.rs, in the
raster test and in docs/acroform-script-workflows.md.
* feat(a11y): auto-tag Apply tags headings by size and weight
Apply now chooses H1-H6 or P per text object instead of P for all.
The body style is the half-point size showing the most characters (bold
when most of those are bold). A short object (at most 3 lines, 200
characters, with a letter) is a heading when it is 1.15x the body, or
bold at 0.9x the body over a regular body in at most 2 lines. Heading
styles rank across the document, larger and bolder first, capped at H6,
and a level never skips past the one before it so heading-nesting
passes.
Size is Tf x Tm x CTM with q/Q tracked; bold is Metrics.bold. Text in
render mode 3 (an OCR layer) is not counted. Font metrics are measured
once per font object per document, at most 256 fonts.
AutoTagResult gains a headings count. Parity, gaps, roadmap and the
apply tool's note say headings are tagged.
Fixes#7062.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(a11y): rank heading styles by map and skip clip-only text
Look up each heading style's rank in a map built once after sorting,
so ranking is linear in the number of text objects. Text in render
mode 7 (clip only) paints nothing, so it is excluded from heading
evidence like mode 3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* prc: rebuild compressed tessellations whose normals are recalculated
A TESS_3D_Compressed (WD 7.8.9.7) was read to its end but never rebuilt,
so prc-render drew nothing for it. Rebuild the form whose normals are
recalculated, with three edge statuses per triangle, into a Mesh grouped
by face and styled by each face's line attribute.
The walk (tess/compressed.rs) takes a seed, then one apex per triangle,
from a reference or the next point in the frame of the edge it continues
across (WD 7.8.9.2), with the WD 12.3 Length, Unitize and MakeOrthoRep
arithmetic bit for bit. Arrays that do not fit, or an edge shared by more
than two triangles, leave the tessellation Compressed. Every triangle,
style and face range is charged to the element allowance first.
Stored-normals meshes, the one-status-per-triangle form, the planar bend
check, the best-fit search and partial salvage are later PRs.
Adapted from pdfcer (MIT, same author) at 0a249a73.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: charge rebuilt compressed meshes after they fit; model_render test
The rebuilt triangles, their styles and the face ranges are now charged
to the element allowance once the arrays fit and before the face ranges
are made. Arrays the walk cannot fit stay Compressed and spend nothing,
so they no longer fail the file over a face count they never use.
Tests:
- a_rebuilt_compressed_mesh_is_charged_its_triangles_and_faces pins the
exact charge (4 triangles x 3 elements + 2 faces);
- arrays_that_do_not_fit_spend_no_triangles_or_faces;
- rebuilt_triangles_are_grouped_by_face_with_their_styles, a direct
by_face test with out-of-order faces, empty faces and styles;
- model_render's a_compressed_prc_model_is_rebuilt_and_drawn, end to end
from a PDF, cited in misc.3d-view; its hex fixture is the prc-render
builder's output, kept so by the_automation_fixture_is_the_compressed_triangle.
The walk's working tables are documented as bounded by the triangle
count rather than charged. The module docs now say the arithmetic
matches the WD pseudocode as read and that the traversal rules are
inferred, not WD text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: charge compressed styles and face ranges before making them
A rebuilt compressed mesh's per-triangle styles were built before the
budget was charged, and also when the normals were stored and the mesh
was read past. The face attributes are now kept as read, and the styles
are built only for a rebuilt mesh, after the charge.
Each face range is a Range<usize>, two budget elements on 64-bit
targets, so it is charged at its size, not as one element.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: bound the compressed rebuild walk by the allowance left
The walk's vertices, triangles, edge counts, edge log and stack were
allocated before anything was charged, and could hold several times the
decoded arrays. The walk now gets the elements the reader has left and
stops once its arrays, by length, would hold more; the tessellation then
stays compressed, as when its arrays do not fit the walk.
A face whose line attribute is 0 but whose behaviour is not now styles
its triangles, so the behaviour bits are kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: say the rebuild walk is bounded by the allowance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: cap the rebuild walk's first reservation by its limit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(render): an RGB colour in an isolated DeviceCMYK group blends in CMYK, as its ink
Part of #4887. An isolated DeviceCMYK group blended in CMYK only when every
colour in it had process tints (DeviceCMYK, DeviceGray); one RGB fill sent
the whole group back to RGB blending.
Vendored hayro-interpret patch (104): Color::ink_tints gives DeviceRGB,
CalRGB, Lab and three-component ICCBased colours the ink that draws back to
them through the bundled CMYK profile (new cmyk_inverse module: black
0.4*k0^2 + 0.6*k0^8 with k0 = 1 - max(r, g, b), matched to Acrobat on
synthetic pages; then cyan, magenta and yellow by at most 12 Newton steps
against the profile; one-entry per-thread cache). ICCBased CMYK still has no
tints.
Test an_rgb_colour_in_an_isolated_cmyk_group_blends_as_its_ink: 50% grey
under Difference with black within 10 levels of Acrobat's 137 112 106;
in-gamut colours draw as themselves; red within 8 of Acrobat's 238 32 37.
With the additive arms reverted the grey draws 93 97 96 and it fails.
#5228's control now uses an RGB image, which still has no tints.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(render): an RGB colour with a non-finite component has no CMYK ink
`to_rgba` turns a non-finite component into some finite colour, so the
inverse could not see it and gave that colour's ink. `ink_from_srgb` now
declines such a colour and the group draws it as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A whole-unit nudge measured in the larger unit could exceed a step of the last unit (1 km - 0.9 mm showed as 1 km 0 m). A compound Y in units other than X's was relabelled with X's unit and lost its CYX when written back.
Scale::read refused number format arrays of more than one unit (feet and inches) and the /F, /T formats, so measuring inside an Acrobat-calibrated viewport failed and such saved measurements were listed as unsupported. Read them into Scale::formats, label readings with them (whole units, then the rest as decimals, a fraction, rounded or cut off; a last unit that rounds up carries) and write them back when a measurement is added with that scale. Single-unit decimal scales read and label exactly as before.
* Print: app-managed colour converts printed pictures into a printer profile (#6269)
doc_print takes color_management (printer, the default, or app). With app,
color_profile (an ICC file or an installed profile's name), rendering_intent
and black_point_compensation convert each rendered page picture from sRGB
into the printer's RGB or grey profile before it is sent. app prints the
pages as pictures; CMYK and non-destination profiles are refused.
print_color_profiles lists the installed RGB and grey profiles.
The conversion is craft-cms at craft-print's rev, in pdfcraft_print::colour,
hooked into print_raster::rasterize. Raster carries the colour and is Clone
rather than Copy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Print colour: look for installed profiles inside the read root when confined
With automation roots, print_color_profiles and doc_print's color_profile
name lookup read the system's colour folders, outside the roots. They now
look in the read root instead (as text_font_files does), check each file
against it before reading it, and are refused without read authority.
Under --root they look in the root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* automation: keep colour profile discovery inside --root, links followed
Under --root alone, print_color_profiles and the color_profile name
lookup listed the root's .icc files without checking each against the
root, so a link inside it could read a profile outside. Each discovered
file now goes through the same --root resolution as any other read
(links followed) before it is opened.
colour_profile_links_out_of_the_root_are_not_read makes such a link and
checks it is neither listed nor found by name; it fails without the
check (the link is listed).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* print: as_chunks for the grey fill; area print keeps managed colour
Clippy 1.99 (`chunks_exact_to_as_chunks`) flags the constant-width
`chunks_exact_mut(4)` in the grey conversion; use `as_chunks_mut::<4>()`.
main's print-area path built `Raster` without the new `colour` field;
build it through `PrintDraft::raster()` so a printed area is colour
managed like a printed page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Lock craft-cms at the craft-libs commit craft-print now uses
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(print): read only regular files as printer profiles, and no more than the cap
A FIFO or device named `.icc`/`.icm` in a profile folder was listed and
read, and opening a FIFO for reading waits for a writer. The listing now
keeps regular files only (links followed), `PrinterProfile::read` refuses
anything else before opening it, and the read goes through a limit one
byte past `MAX_PROFILE_BYTES`, so a file that grew after it was measured
is refused rather than read whole.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
FlexArrayIter::next::<T> stepped over a lone-sign slot before finding that
null is not a T, so a caller that then read the slot as another type got
the item after it. The slot is now passed only when null is a T, as a value
of another type is left in place. The sign-token tests also require the
lone-sign fixtures to parse and check raw_iter's null slots directly.
The three script-refusal tests built on reset_order_session save, run a
refused edit or script, save again and compare the bytes. Each save stamps
/ModDate from the system clock, so the comparison failed whenever the two
saves fell in different seconds. The helper now pins the session clock with
Session::with_clock, as session_with and the other byte-comparing tests do.
The fields of a document are kept with the state they were read from
(pdfcraft_cos::ReadState), and a document that still reads as that state
gets a copy instead of a new walk. One value edit read them four times
on an AcroForm (fill, recalculate, refresh, display) and seven on a
laid-out XFA form (plus the data sync twice and the scripts), mostly with
nothing changed in between; it now walks them once, and twice on an XFA
form (once more after its data is written).
* fix(flatpak): allow release checks and self-update helpers
* test: keep Flatpak permission parsing within strict Clippy rules
* chore: bump version to 0.21.1 for the Flatpak update fix
* fix(redact): remove a stroked path by the box its stroke paints
Path redaction tested a path's construction box against the marks. A
horizontal or vertical stroke has a zero-area box, which overlaps
nothing, so its drawing commands stayed beneath the overlay; a wide
stroke whose points lie beside a mark but whose ink reaches into it
stayed too.
The interpreter now tracks the line width, miter limit and join style
(`w`, `M`, `j`, and `LW`, `ML`, `LJ` through `gs`) and, for a stroking
operator, grows the box by half the width (at least one unit), times
the miter limit when the path has mitred joins, scaled by the CTM's
largest stretch, before the hit test. The bound is conservative: a
stroke near a mark may now go where before it stayed.
* address review: pad hairlines by half a unit, rectangles for their corners, square caps by sqrt 2
* review: test a kept clip against the path as constructed
* address review: a line state set between a path and its stroke no longer lets the stroke skip the redaction test
* address review: line-state operators read the operand before the operator
* fix(forms,xfa): find every password field before a save skips scrubbing it
The quick Password-flag check in pdfcraft-forms stopped silently at its
depth limit, and visited the tree in an order where a field the full
field walk reaches could be cut off on a long branch first. It now
answers true (read every field) whenever it cannot look as far as the
field walk, and also walks below fields adopted from page widgets.
XFA password classification walked AcroForm fields only 32 levels deep,
shallower than editing and dataset synchronization, and read the
datasets packet of an XFA array without the prefixes its preamble
declares, so a typed password could stay in the saved datasets. It now
walks as deep as the field walk, refuses to clear (and so to save) when
the tree is deeper than it can check, and reads the packet the way the
datasets writer does.
* address review: check every page widget's /Parent chain for the password flag
* address review: password scan follows the parents of nameless /Fields entries; field-walk completeness checked before the datasets packet is read
* address review: the field walk's completeness is decided after every root; the subtree scan starts at the last dictionary of the parent chain
* address review: a skipped visit does not replace the reach a field was classified with
A lone + or ++ passes the first pass, which skips it as a number, but no
number is read from it (ISO 32000-2 7.3.3). Dict::entries and Dict's Debug
unwrapped the failed read and panicked, Array::raw_iter did too, and
Array::iter stopped there and dropped the items after it.
Vendor patch (46): a dictionary leaves such an entry out, as Dict::get
already did (7.3.7), and an array reads it as null in its slot (7.3.9). A
typed read still ends at it, as at any value of another type.
Parallel unit tests in one process shared the process-wide count of live
document script workers, so unrelated tests together reached the 16-worker
cap and failed at random with "document script worker limit reached".
Under cfg(test) each test thread now has its own count against the same cap;
a permit releases the count it was taken from. The production cap and its
process-wide count are unchanged.
* fix(edit,a11y): font aliases share the metrics built for their font
Text extraction and heading extraction built and kept font metrics per resource name, so
many names for one font object each held a copy of its Unicode and width tables.
* fmt
* address review: font metrics are cached by the object at the end of the reference chain
* fix(engine): run the renderer redaction check on redactions applied inside a batch
* Resolve redaction marks by page object and measure the edited document
The renderer check looked marks up by the page index they had when they
were drawn, so a MovePages later in the same batch pointed them at another
page's text, and it measured glyphs with page geometry from before the edit.
Each mark now carries the page object it was placed on, and the geometry is
read back from the document as the batch wrote it.
* review: skip marks whose page the batch deleted
* review: group marks by page once and refuse an ambiguous page tree
* address review: refuse a batch that deletes a marked page while adding pages
* merge main, keep both
* address review: a batch that applies redactions and then copies a page is refused
* fix(js): bound array text, month parsing, name registration and list work
- strings() (field value and colour setters, resetForm) copied every array
entry into its own String with no total: one long string listed a million
times was copied a million times. The copies together are now held to the
run's MAX_PAYLOAD byte budget.
- FormCalc parse_date copied and lowercased the rest of the text for every
month token of the picture, quadratic in both; it reads at most the longest
month name now.
- XFA global registration checked each child name against a Vec of every
name defined so far, quadratic in a wide form; it is a HashSet.
- FormCalc gather charged one step for a whole collection and list_push
charged nothing for a duplicate it dropped, so .all on same-named siblings
did quadratic work for one step a pair; every node visited costs a step.
- add_instance reserved only the new root's SOM before copying a subtree;
the copy's nodes, names and SOMs are charged to the byte budget first.
* address review: gather charges each call; check an array entry's length before copying it
* Hold an array entry to its widest escaped size before copying it
The pre-copy check compared the payload budget against a JS string's UTF-16
length, which is shorter than the escaped UTF-8 form it is copied to: a
string of quotes or non-ASCII text could allocate up to six times the
budget before the post-check rejected it.
The check now uses the widest escaped width, so the copy cannot exceed the
budget it is checked against.
* review: measure an array entry's escaped width before refusing it
* address review: count an array entry's escaped width without copying it
* address review: charge retained field text and colours to a run-wide budget
* fmt
* fmt
* merge main, keep both
Dylan M. Taylor
FredApps
FredApps
Richard Buschbeck
asadosteaksnlandasadosteaksnl
mtlcl410andClaude Opus 5.5
jonathanwxh-cell
vangel76andClaude Sonnet 5.5