Marking a tag as an artifact, or a figure as decorative, refused content after a stream damaged
partway, placing each operator by its first operand. A page may split its content between an
operator's operands and its keyword. When a `BDC`'s operands end the stream before one damaged
from its start, or one that doesn't decode, the keyword the page reads is in what wasn't read;
joined without it, those operands and the next tag's read as one `BDC`, and marking rewrote the
stream after the hidden one, the next tag's `BDC` taken out of it.
An operator now counts after damage by its keyword, and one whose operands and keyword lie on
either side of a stream not read whole is refused: that stream may end them itself.
`a_tags_operands_before_a_stream_not_read_whole_are_not_rewritten` (damaged from its start, and
not decoding). A tag entirely after a stream that doesn't decode is still marked: such a stream
holds all of its content, between tokens. `accessibility_mark_tag_artifact`'s description names
content a stream that doesn't decode may hide or change too, not only a damaged one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Since autotagging reads page content through DecodeBudget::decode_strict, the reason it gave for
content that doesn't decode carried that error's own text, so it said twice that the data
couldn't be decoded: "content cannot be decoded strictly: stream data could not be decoded:
FlateDecode: …". It now gives the decoder's reason right after, as main does: "content cannot
be decoded strictly: FlateDecode: …".
Test: autotag_text_says_why_it_cannot_read_a_page now checks the decoder's reason follows the
prefix.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Marking a figure decorative or a tag's content as an artifact refuses content that may be in a
damaged or unreadable content stream, or after the damage. The two errors now say so in one
clause, and that nothing was changed, which holds: both return before touching the document. The
mark-as-artifact tool's description names the case in a few words.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Read through DecodeBudget::decode_strict since cbc3fc221, a stream counts what each of its filter stages decodes against the 16 MiB, as a page's decode allowance does, where main bounded each stage alone. A page of 12 MiB behind ASCIIHex and Flate, with 9.1 MiB between them, was tagged on main and is refused now; the refusal said the decoded content exceeds 16 MiB, which it does not. It now says decoding the content takes more than that.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Content past 16 MiB says so, and content that does not decode strictly says that: autotag_text_says_why_it_cannot_read_a_page. Mutation testing found nothing pinned which message each gets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Autotagging a text-only page rewrites its content, marked, from what it
read. It read each stream through its filters with /DecodeParms only
when direct, so content behind a predictor whose parameters are given
by reference was read with the predictor's tag bytes in it, and written
back so: with eight-byte rows, a \0 every eight bytes split `24 Tf` into
`2 4 Tf` and the text's string, and the tool returned ok. Found by the
consumers review of the CodeRabbit round; inherited from main.
It now reads through DecodeBudget::decode_strict, which reads the
parameters in the document and is strict on damage as before, within
the same 16 MiB. pdfcraft-a11y no longer uses pdfcraft-filters.
Test: autotag_text_reads_content_with_parameters_given_by_reference.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
A page's content streams are read as one stream, so what a stream
damaged partway hides past the damage is unknown to the streams after
it too. A string or comment the damage leaves open runs on into the
next stream, and operators the damage hides can change the graphics
state the later streams draw in. Marking a tag's content as an artifact
took what read as a BDC in a later stream for the tag's own, and could
rewrite bytes inside a string. Moving an image after the damage worked
the move out without a cm the damage may hide.
Now an edit refuses a change to any stream after one damaged partway
(rewritten_contents), and an image isn't arranged into a new stream
placed after one. Marking an artifact or a decorative figure refuses
content that reads as the tag's in a stream after the damage. Edits and
marking before the damage go on as before.
A content stream that doesn't decode at all was read as empty and
whole. A styled edit whose paragraph marker closes past the page's last
operator appended the close to it, so the edit replaced that stream
with one holding only the close. Edits now refuse a change to such a
stream, and still go on around it. Marking an artifact or a decorative
figure whose content isn't found takes it as possibly in such a stream,
as it does for content past the damage, and refuses rather than take it
for absent.
Tests: an_edit_never_rewrites_a_content_stream_damaged_partway (an edit
after the damage refused, one before it made),
text_a_damaged_stream_runs_on_into_is_not_edited,
images_after_a_content_stream_damaged_partway_are_not_moved,
a_content_stream_that_does_not_decode_is_never_written_over,
a_tags_content_after_a_damaged_stream_is_not_rewritten,
a_tags_content_not_found_beside_a_stream_that_does_not_decode_is_not_taken_for_absent,
and a_tags_content_in_a_stream_damaged_partway_is_not_rewritten now
checks the damaged stream itself and marks content before the damage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Since marking a figure decorative or a tag as an artifact refuses content
not found beside a damaged stream, the refusal also covers content that
only may be past the damage. Its message said the content is in a damaged
stream; it now says it is, or may be.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
A tag's content not found before the damage in a damaged stream may be
past it. Marking a figure decorative took it for absent: it succeeded,
took the figure out of the structure tree and left its content tagged.
Marking a tag as an artifact said its content wasn't on the page. Both now
refuse with `Damaged`, as when the content is before the damage, and change
nothing.
Clearing the parent tree read the page's `/StructParents` only when direct,
so with it given by reference (ISO 32000-2 lets it be) the tree went on
pointing the content at the retired tag. It is read through the reference.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
`decode_with_damage` and `decode_contents_with_damage` read a stream's
`/DecodeParms` only when direct, as `Stream::decoded` does, so content behind
a predictor whose parameters, or a number in them, are an indirect object
decoded with the predictor's tag bytes left in, and was taken as whole. Edit
then listed and wrote back the wrong bytes, and pruning dropped an image such
a form draws. ISO 32000-2 lets those values be indirect.
- `decode_with_damage` takes the document and reads the parameters through
it, and so does `decode_contents_with_damage`, and `decode_contents` with
it: printing, accessibility's reading of a page and a page copied as a form
read them too. Code that calls `decode` on a stream itself doesn't yet.
- It reads through `Document::decoding_view`: `with_direct_parms`, but a copy
of the stream holds only its `/Filter` and the parameters, its data shared,
so a stream a page's `/Contents` lists again and again isn't copied whole
for each.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
A stream that doesn't decode at all is not damage to write over: edit and
accessibility keep it as stored and go on with the page's other streams,
and only running past the page's decode allowance refuses. Nothing pinned
either, nor that selecting objects reads a stream of a few MB.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
A Flate stream damaged partway decodes to what came before the damage, and
`DecodeBudget::decode` gave that back as the stream's data: the decoder's
partial flag was dropped in `Stream::decoded_within_counted`. Editing a text
line, a block, an image or an added item in such a stream wrote it again from
that part, so everything after the damage was lost on save, though other
readers may still read it.
- `DecodeBudget::decode_with_damage` decodes as `decode_within` does and says
whether the stream is damaged partway. A missing checksum or end-of-data
marker is no damage, as before.
- Edit reads the page's streams with it (`ContentStream`), and
`rewritten_contents` refuses, before adding anything, a change to a damaged
stream. Changes in the page's other streams go on, and the damaged one stays
as stored.
- Selecting objects (`editable_objects`, moving added items) refuses a page
with a damaged stream, as it refuses one that doesn't decode: what follows
the damage could change every later item's graphics state.
- Marking a tag as an artifact or a figure as decorative refuses when the
tag's content is in a damaged stream (`ArtifactError::Damaged`,
`AltError::Damaged`), and changes nothing, the structure tree included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY
Share the stream-splicing path between mark_decorative and mark_tag_artifact so mark_tag_artifact resolves named property lists in /Resources /Properties, resolves indirect /MCR references in /K, leaves untouched and shared content streams intact, and validates the tag parent before mutating /Contents or /ParentTree.
Inside a text object q/Q save and restore Tm and Tlm too (ISO 32000-2
§9.4.1, as corrected by the PDF Association's erratum,
pdf-association/pdf-issues #368). The renderer's saved state already
holds both. The text-editing interpreter and the heading detector kept
them across Q: text after Q was listed (and, once edited, moved) where
the q ... Q block left the pen, and a word continued after Q was split
("Chap ter One"). Both saved stacks now hold the two matrices.
Tests: pdfcraft-edit and pdfcraft-a11y
tests::q_inside_a_text_object_restores_the_text_matrices. Reverting
the edit fix puts the first case at y = 600, not 700; restoring only Tm
puts the T* case at 586, not 686; reverting the a11y fix reads
"Chap ter One". Each fails its test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9
* chore: resolve SonarCloud maintainability issues
* fix(packaging): use verify_sha256 helper function
* style: cargo fmt
* fix: restore wildcard imports and fix method-reference type errors
Revert the glob-import expansions (they missed SomIndices and left unused
imports), revert char::is_ascii_digit where the iterator yields char by
value, and pass the content slice to prune_doomed_xobjects as &[Vec<u8>].
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep XObject decodability check without binding content in interp
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Dylan Taylor <dylan@craftmaker.dev>
* M12: set a table's Summary and a header cell's Scope (#4103, #4104)
accessibility_set_tag_property takes `summary` (Table tags) and `scope`
(TH tags: Row, Column or Both). Both are Table attributes, written into
the tag's attribute object with /O /Table in /A: an existing one is
edited in place, keeping other attribute objects and their revision
numbers; one reached by reference is copied into the tag's own /A first,
so tags sharing it keep their value; a new one is added when there is
none. Clearing drops the key, an attribute object left with only /O,
and an empty /A. The tag type is checked after the role map.
accessibility_tags lists both. Setting a summary clears the
table-summary finding.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* M12: edit the Table attribute object that holds the value (#4103, #4104)
With more than one /O /Table attribute object in a tag's /A, setting a
summary or scope edited the first one even when a later one held the
key, and clearing left that later value in place (both still read back
as the old value). Setting now edits the object holding the key (else
the first Table object, else a new one), and clearing removes the key
from every Table object holding it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Redaction reads page content and form XObjects strictly (upstream) and
within one page's decode budget (this branch): both now go through
DecodeBudget::decode_strict.
A sequential bfrange stores one destination and builds every covered
glyph's text from all of it, so one huge destination and many repeats of
its codes made text extraction copy megabytes per glyph. Destinations keep
at most 256 UTF-16 units (the format's 512 bytes), and marked-text
extraction stops asking for a glyph's text once its id has all the text it
keeps.
Figure listing decoded and parsed a page's content once per figure on it,
so many small Figure elements pointing at one page multiplied the work.
The figures are grouped by page and one pass gathers the bounds of every
marked-content id they own; what a sequence draws also counts for the
sequences around it, as before.
Marked-text extraction and figure bounds searched the whole marked-content
stack before every operator, so deeply nested unmarked BMC blocks made a page
quadratic. The text stack now holds each level's effective id (its own, else
the enclosing one's), and the bounds pass counts the open sequences that
match.
The checker decoded every /Contents entry and every form a page drew
with a fresh 1 GiB allowance each, so a page repeating one compressed
stream reference produced gigabytes. The two copies of the page-content
helper are one now, and it and the form walk charge a per-page
DecodeBudget.
Treat predefined CJK CMaps and Adobe CID collections as alternative mapping routes. Resolve indirect metadata and reject unknown names and foreign registries without changing ToUnicode handling. Add synthetic checker and read-only automation regressions with red/green evidence.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Document::resolve follows one reference, and an indirect object's value
may itself be a reference (ISO 32000-2 7.3.10): `/Marked 8 0 R` with
object 8 holding `9 0 R` holding `true` is a tagged document. The rule
was left holding a reference and reported it untagged, while the render
inspector -- which follows chains through lopdf's dereference -- read
the same file as tagged. The point of this branch is that the two
readers agree, so the chain is followed here too.
Bounded at 32 references and cycle-safe: a damaged file can point a
reference at itself, and the test covers that case as well as the
two-hop chain. Without the fix the chain case reports
left: Failed, right: Passed
Reported by CodeRabbit on #3686.
Any value in a PDF may be written as an indirect reference, the tagged
flag included: `/MarkInfo << /Marked 9 0 R >>` with object 9 holding
`true` is valid, and veraPDF's corpus has pass files that write it that
way. Both readers of the flag tested the reference itself, so such a
document was reported as untagged:
doc_info "tagged": false
Accessibility Checker "The document isn't marked as tagged
(MarkInfo Marked)"
Both now resolve the value first. On a pair of otherwise identical
tagged pages, one with `/Marked true` and one with `/Marked 8 0 R`:
before direct: tagged true indirect: tagged false
after direct: tagged true indirect: tagged true
and the checker reports the finding for neither.
A document with no flag at all still fails the rule, which the test
asserts alongside, so this does not turn the rule into one that always
passes.
Fixes#3671.
`[(FIRSTARR)] [(LASTARR)] TJ` is malformed (TJ takes one array
operand), but the operator still shows the one immediately before it,
as the renderer, MuPDF and pdftotext agree. Three readers here counted
operands from the front instead and showed the discarded first array:
- crates/edit/src/text.rs (text_lines/text_paragraphs, and the Office
export through reading_lines)
- crates/redact/src/interp.rs (search-based redaction's content
interpreter)
- crates/a11y/src/headings.rs (autotagged heading detection)
So the editor could offer a word the page never draws, a redaction
search could miss it, and a heading could read as text nobody sees.
Take the last array for TJ in all three, matching the `_ =>
op.operands.last()` arm already used for Tj/'/" alongside it.
Added a regression test per crate (`a_tj_with_a_surplus_array_reads_
the_last_one`, `a_tj_surplus_arrays_undrawn_glyphs_are_not_seen_
under_a_mark`, `a_heading_with_a_tj_surplus_array_reads_the_one_the_
page_draws`), confirmed each fails without its fix and passes with it.
cargo test -p pdfcraft-edit (196 passed) -p pdfcraft-redact (81
passed) -p pdfcraft-a11y (44 passed), fmt, clippy -D warnings, xtask
layers and xtask assets all clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Join multiple streams in a page's /Contents array with a space (b' ') rather than a newline (b'\n') in autotag::content_bytes, alt::page_content, and content::page_content so a % comment at the end of one stream continues through the start of the next stream per ISO 32000-2 section 7.8.2.
Update alt::artifact_marked_content to join page content streams with pdfcraft_content::Pieces::join, parse operators across the joined stream, and rewrite only matching BDC spans via Pieces::splice so operators split across stream boundaries and cross-stream comments are preserved.
Fixes#3217
* M12: tag unstructured AcroForm widgets
* i18n: translate form tag command
* i18n: repair form-field label merges
* fix(i18n): refresh translation catalog hashes
* fix(i18n): preserve main translations after rebase
* Merge main; tag a widget listed on several pages once, docs say existing trees are extended
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Merge main; add the Vietnamese catalog entry for Tag form fields
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Keep selected form values and page content through later edits (#1319, #1305, #1324, #1306)
An XFA radio item whose text contains a space was written back as an appearance-state name, so the next layout selected nothing. Replace Pages filled the gap between a split selection. Marking a figure decorative replaced every content stream on the page. Control clicks and drags accepted coordinates that overflow to infinity.
* Move the decorative-figure regression out of pdfcraft-edit
edit and a11y are both layer 4, so a dev-dependency from edit to a11y fails the layer check. The same regression now runs in the engine, which already depends on both.
* Drop pdfcraft-a11y from the edit crate's lockfile entry
* Run a tool after a background open of the file it asked for
A tool chosen with no document opened the picked file on the worker, but only ran when that open finished inside the picker callback. Remember the command on the pending open, and let the command test wait for the worker.
* Wait for background opens in the command tests
Opening a picked file or a recent file finishes on the worker, so a fixed handful of frames can assert before the tab exists.
* Compare batch copies to the PDF that was written
A new text PDF stamps the current second, so a later pdf() call is a different file. The numbered copy and the source must match the bytes that were saved.
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A BDC may name its property list in /Resources /Properties instead of
writing it inline. Marking a figure decorative and placing figures only
matched inline lists, so a figure tagged through a named list kept its
MCID content and parent-tree entry while its element was removed.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* fix(a11y): bookmarks from structure keep the words of glyph-by-glyph headings
Chromium (Skia) draws text one glyph at a time, each moved into place with
its own Td. The marked text of a heading added a space at every Td, TD, T*
and Tm, so New Bookmarks from Structure titled them "C h a p t e r T w o",
and the real spaces between words were lost. On a 20-page tagged guide
printed by Chromium, 25 of 61 titles came out spaced.
mcid_texts now follows the text matrix (and the CTM, q/Q, Tc, Tw, Tz, TL)
and decides word breaks from where the glyphs are: a glyph that starts on
another line, more than 0.2 em after the previous glyph of the same marked
content, or back over more than an em, starts a new word. Kerning and
glyph-by-glyph placement no longer split words.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(a11y): headings set with a negative font size keep their words
The em that decides word breaks was the font size times |Tz|, negative with
a negative font size: every glyph then started a new word, and a heading in
one Tj read "C h a p t e r O n e". The em is now |size x Tz|, and "ahead"
follows the way glyphs advance in text space, backwards when the size or Tz
is negative, so a TJ word space still splits words there as on main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(a11y): keep wrapped headings separate under horizontal scaling
Co-Authored-By: OpenAI Codex <noreply@openai.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
clear_parent_tree walked /Nums with chunks_mut(2) and indexed pair[1], so a
trailing key without a value that matched the page's StructParents panicked
after the page content had already been replaced. Walk whole pairs only and
leave an unpaired key as it is: it maps nothing, so there is nothing to clear.
Claude-Session: https://claude.ai/code/session_01RUNQSPVXx3dDBabRZHAnjz
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Expose tag parent and depth for hierarchy view
* Accessibility: add visual tag properties panel
* Show collapsible tag hierarchy in accessibility panel
* Open checker findings in the matching structure tag
* Translate Tags panel across supported languages
* Tags panel: walk the structure tree once per edit, not every frame
The Tags panel and checker findings that open a tag share a tag list cached per
document and edit generation.
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Accessibility: edit structure tag properties through tools
* Change tag properties: listed in EDIT_LABELS and translated in every catalog; refresh hashes
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Dylan M. Taylor
Grzegorz MartensandClaude Opus 5.5
jonathanwxh-cell
KenM76andClaude Opus 5.5
pat26-dotcomandClaude Opus 5.5
aiongg
Aman MehtarandClaude Code
Hamza
MichaelandClaude Sonnet 5
