mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-11-06 18:52:36 +00:00
ddeca878dff1ea6cc2fa55adb2db84513eecda1f
1194
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
    
|
9f04acccef |
M10: OCR engines, confidence, preprocessing and a review workflow (#977)
* M10.20: plan Unicode text for OCR output in Type3 faces (fonts, edit) OCR output used to flatten every character beyond WinAnsi to a silent `?`. This adds the two pieces that let the OCR layers write the recognized words as they are; the OCR code that uses them follows in M10.21. pdfcraft-fonts - `TextPlan::for_words` maps each word to the standard Helvetica when WinAnsi covers it, else to Type3 fonts drawn from the craft-fonts faces (the Japanese document face first, then the rest of the build input). Characters no face has a glyph for are counted (`missing`), never dropped silently. At most 240 characters per font and 2400 per plan, so one hostile word cannot balloon. - Which face has which character is asked once per (face, character) for a plan, not once per word. - `face_has`, `craft_glyph`, `win_ansi_char`, `fits_win_ansi` are public for it. pdfcraft-edit - `add_type3_fonts` / `stamp_with_fonts` register a plan's fonts on a page under a free `PCOcr`, `PCOcr1`, ... name, build each font once and share the object with later pages. A shared face is registered under a free name on a later page that already has a font of the name it was given first, instead of replacing that page's own font. - The fonts carry real advances and a ToUnicode CMap, so extraction reads the text back. pdfcraft-redact - A test shows a hand-built Type3 text layer (the shape the OCR output writes) is redacted like any other text and the verifier passes. Tests: pdfcraft-fonts 62 passed, pdfcraft-edit 129 passed, pdfcraft-redact 33 passed; clippy -D warnings clean on the three crates. The name-reuse and the redaction tests build their fonts by hand, so they run without the craft-fonts build input; the tests that plan real faces skip without it and were not run in this commit's own check. * M12: give the hostile-XFA open test more room on a loaded machine The test opens a form whose calculate script sets a value 50 000 times, against the one-second budget of an unasked script and a five-second wall-clock bound on the open. Both sit close to what a machine running several suites at once can take, so the test can fail without anything being wrong. It now runs 20 000 iterations (the total is 19999) and allows 30 seconds, which still fails for a script that hangs or is not capped. Test-only; unrelated to the OCR work in this series, so it is a commit of its own. Tests: both hostile_xfa tests in pdfcraft-engine pass. * M10.21: pluggable OCR engines, preprocessing, review sessions and the OCR tools (ocr, engine, create, automation) Scan & OCR gets a second engine, optional raster clean-up, a review step before anything is applied, editable output and a batch mode, headlessly first: the interface for them follows in M10.22. pdfcraft-ocr - A `Recognizer` trait with two engines: the built-in ocrs (moved out of lib.rs) and the installed tesseract program, run as a fenced external process: fixed argv, allow-listed language codes, a private temp directory (mode 0700 on Unix), 120 s timeout, 64 MiB output cap, 50 000-word reading cap. A location from PDFCRAFT_TESSERACT is validated (absolute, existing, executable) and an invalid one fails closed instead of falling back to the PATH. `--list-langs` and `--version` are read from stdout or, for older versions, stderr. - Strategies: PrimaryOnly, ConfidenceWeighted (the second engine joins when the first reading's mean is under 70 or unknown) and a ROVER merge (higher confidence wins per word; against an ocrs word of unknown confidence a tesseract word wins only at 70 or more; capped at 100 M comparisons; a failing partner degrades to the primary with a note). - Preprocessing: opt-in auto-rotate, deskew, denoise and binarize on the RGBA raster, each with an exact inverse so word boxes map back to the scan. The 300 dpi normalization the steps are calibrated for runs only when a step is on: with every step off the render is read as rendered, as before. (Enlarging a 72 dpi render 4x on its own made the models read "due: €250" as "ue: ?250".) `OcrImage` is validated by construction (side and 64 MP area caps, checked before any buffer is allocated, including by the resize). - Confidence bands (High >= 90, Medium 70-89, Low < 70) drive review. pdfcraft-engine, pdfcraft-create - `OcrSettings` gains engine, strategy, the four steps, output mode, region, the skip flags and the low-confidence threshold; Automatic reads confidence weighted unless a strategy is chosen. - A recognition is a session: the document guard refuses a stale result with its reason, pages can be applied one at a time (the guard is taken again after each applied page), and applying is one undoable step. A per-language dictionary (a plain-text file: words added from any document stay on disk after it closes). - Output is searchable (an invisible layer) or a NEW editable document of visible text at the recognized boxes (`create::from_contents`); words beyond WinAnsi use the Type3 faces of M10.20 in both, with the shared plan across pages. - Engine discovery never blocks the interface: results are cached, a stale answer is shown while a background probe retries, and the models search and `--version` are cached. Batch: pages or files that already have text are skipped unless forced, and inputs sharing a file name are found up front. pdfcraft-automation - ocr_recognize (engine, strategy, steps, region, output mode), ocr_words (with a retained review handle), ocr_review_apply, ocr_dictionary, ocr_status and ocr_recognize_files. The editable `out` must be a new file inside --root and is refused for a searchable run (it used to be ignored), two batch inputs of one file name are refused before anything is read, and the batch folder is checked for existing outputs. pdfcraft-ui-egui - Only what the new API needs: the Recognize Text dialog reads with `recognizers(&settings)`. `ocr.correct` is registered with its label in every catalog; the screen itself is M10.22. Tests: pdfcraft-ocr 78 passed; pdfcraft-create passed; pdfcraft-engine and pdfcraft-automation 450 passed and 1 failed (the automation lib 17, automation.rs 157, hostile_args 2 among them); pdfcraft-ui-egui lib + ocr + control tests 391 passed; clippy -D warnings clean on the five crates. The one failure is in a test this commit does not change: recognize_text_makes_a_scanned_page_searchable fails where the models are installed (they read "quick" as "auick" at that render size); the roadmap on main already records it. The real tesseract binary ran in tesseract::tests::recognize_runs_the_installed_binary (tesseract 5.4.0, PATH). * M10.22: OCR Verify screen, the Recognize Text options and the interface catalogs (ui-egui) Scan & OCR ▸ Correct recognized text: a full-window screen where a recognition is reviewed before anything is applied, plus the dialog and batch options for the engines of M10.21. OCR Verify screen - Four panes: the page list, the source page with confidence-coloured word boxes (click to select, drag to draw a region), the recognized text, and a zoom plus word inspector. Corrections commit on Enter (an empty commit removes the word), Remove/Restore, "+ Dictionary" (a per-language file in the preferences folder, so a word added from a document stays on disk after it closes), per-word and per-page Verified, F8 / Shift+F8 walk the low-confidence words, Ctrl+T marks the page reviewed, Ctrl+Tab moves the pane focus, and review edits undo within the panel. - Re-OCR of the whole page or a drawn region. A region re-read moves the review marks of the words it keeps to their new positions and selects the first new word; a whole-page re-read clears that page's marks (and the undo brings them back). The region outline is scaled onto the pane, not mapped through user space again, so it is right on rotated and cropped pages. - Accept / Reject per page or whole. Pages accepted one at a time each apply once (the document guard is taken again after each applied page; an edit made elsewhere in between is still refused with its reason), and Accept in searchable mode is one undoable step. Editable mode writes a NEW `<name>_ocr.pdf` through a save dialog and never the source. A real Cancel keeps the pages already read. - The engine and strategy menus disable a choice that cannot run and say why; the check never waits on a process (a background probe fills a cache), and choosing Automatic moves "Primary only" to Confidence weighted. Recognize Text dialog and batch - Engine, strategy, the four clean-up steps and the skip flags are remembered with the other choices (a saved Automatic without a strategy reads confidence weighted). The batch refuses two inputs of one file name and existing outputs before reading anything, notes low-confidence pages at the settings' threshold, and its toast has a Cancel (the file in flight finishes). Catalogs and attribution - The 90 new interface strings are in all 21 catalogs (the Lithuanian ones were written without native review, and the Bulgarian ones avoid U+045D, which the bundled monospace face lacks). ATTRIBUTION.toml carries the new hashes, a note on the Lithuanian entries and the README screenshot; ATTRIBUTION.md is regenerated. - README: a screenshot of the Verify screen, taken with `cargo xtask screenshots` from a synthetic scan (`shot --ocr-verify on`) built from allowed assets; the page reads it with the real engines. Tests: pdfcraft-ui-egui lib 373 passed (1 ignored: the Windows hinting measurement probe), tests ocr 6, control 46, fonts 9; clippy -D warnings clean on the engine, ui-egui, pdfcraft and xtask packages; `cargo xtask assets` ok. The review state machine has unit tests for every fix above; each was seen failing with its fix reverted. * M10.23: parity entries, roadmap and localization notes for the OCR workflow Records what M10.20-M10.22 ship, and what they do not. parity/acrobat-features.toml - Status changes against main: ocr.rotation-detection and ocr.deskew planned -> shipped (the opt-in steps of M10.21, with their tests); ocr.correct-recognized- text and ocr.ocr-engines planned -> partial. Other Area I entries get their evidence and notes brought up to date. - ocr.correct-recognized-text: the evidence includes the one-page-at-a-time accept and the region re-read tests; the notes say what the headless tools cover (ocr_words with a retained review, ocr_review_apply through the same stale- document guard, ocr_dictionary) and what is still UI-only (suggestions, per-word Verified marks, region re-reads). - ocr.ocr-engines stays partial rather than shipped: part of its evidence is conditional (the real-binary test runs only where tesseract is installed and skips elsewhere, and the process-level tests are Unix-only). It cites the tests that always run (location validation and the fail-closed rule, --list-langs parsing from stdout or stderr, the merge rules, the default strategy) and says which part is not proven everywhere. - `cargo xtask parity`: area I 32.7% -> 44.2% weighted (5 -> 7 shipped, 7 -> 9 partial); overall 52.8% -> 53.0% shipped and 58.2% -> 58.5% weighted. ROADMAP.md - One progress-log entry (2026-10-13, newest first) and the banner line. It says the catalogs are 21 with the Lithuanian additions not natively reviewed, that the end-to-end redaction test of the Type3 layer needs the craft-fonts build input, and that recognize_text_makes_a_scanned_page_searchable still fails where the models are installed, as main's log already records. docs/localization.md, docs/localization-parity.md - The Lithuanian entry count (2,578 -> 2,668) and the counts of the other catalogs that carry entry counts are re-measured with the 90 new entries; the Lithuanian OCR entries are marked as not natively reviewed. Checked: `cargo xtask parity` (numbers above, evidence tests exist) and `cargo xtask assets` pass on this tree. * M10.24: ocr: apply a late result only to the document it was read from The Recognize Text dialog closes on Go, so the document can be edited, or have text redacted, while a long run is still reading. The result was applied without the stale check the tools and the Verify screen use, so words read before a redaction could be written back as invisible text. The run now keeps its guard and applies through the checked path. Accept with the editable output in the Verify screen had the same gap (Exit keeps the review open): it now refuses when the document changed since the review started. Both new tests fail with their guard switched off. * M10.25: ocr: ocr_dictionary takes dictionary file names only Updating sorts, lower-cases and rewrites the file it is given, so pointed at .env or a README it would corrupt it. The tool now accepts only ocr-dictionary-<language>.txt style names, for reading as well as writing. The size-limit test used a file name the rule now refuses first, so it renamed its fixture to keep testing the size limit. The new test fails with the rule switched off. * M10.26: pt-BR: keep (s) on the word counts and say mecanismo for engine Two review fixes from a native speaker: the two word(s) lines had lost their (s), so a count of 1 read as 1 palavras, and engine was translated both as motor and mecanismo. Mecanismo is the Brazilian word for a software engine and two lines already used it, so the other six now match. * M10: fit the rebased OCR workflow to current main's structure * Fix OCR workflow issues from the review Honor the Recognize dialog's editable-output choice: its result opens in the review screen (whose Accept writes the editable document) instead of an invisible layer. Make page acceptance idempotent: a second Accept entire page never appends the OCR layer twice and keeps later corrections. Move page and region re-OCR onto a worker thread with a status line and a cancel that discards the reading. Skip the Tesseract probe for jobs that name their engines. Bound Tesseract's stderr while the child runs, not only after it exits. Surface the editable output's substitution notes in the tools' and the run's results. Also repair the OCR batch tool against the current structure: inputs are held to the read root again, and a batch whose inputs share an output name is refused before the output folder is created, compared the way the default filesystem compares names; and the editable writer test's word stays inside the fixture's pages. * Apply pre-review fixes to the OCR workflow Hold the automation OCR tools to the document's copying permission, as the other text tools are: the recognized text is left out of the results when copying is forbidden, and the paths that carry the words out of the document (the editable output, the review word list) are refused. Mark the ocr_dictionary tool as overwriting its path. Close the searchable layer's graphics state around its invisible text so the rendering mode cannot leak into later content. Read the OCR user dictionary folder from the portable data folder in portable mode, like the recovery store does. Resolve the attribution manifest's leftover conflict markers and regenerate the generated attribution. Describe the review flow, the searchable layer's Type3 fonts and the parity evidence references accurately, and drop an undeclared copy of the recovery module. * OCR: reject readings that exceed the word limit Assisted-by: OpenAI Codex * OCR: new documents go through the page tree builder main added Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * OCR: review notes and lints The editable output refuses a file created during recognition. ocr_words takes skip_text_pages and force_ocr. Automatic OCR checks the engine it will use. The stderr test stays below the kill cap, and a failed --ocr-verify shot exits with an error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * OCR: restore the Verify screenshot attribution, follow the moved constants The merge dropped the screenshot row with the translation rows. The model filename constants live in ocrs.rs now, so the license check reads them there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Attribution: the Verify screenshot entry goes after the header comment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Attribution: the screenshot row in the table follows the manifest order Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: eliets2 <287273517+eliets2@users.noreply.github.com> Co-authored-by: FredApps <FredApps@users.noreply.github.com> Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
b3a90f07f3 |
Parity: titles and the PDF/X row say only what is implemented (#6300)
* Parity: titles and the PDF/X row say only what is implemented * Parity: the PDF/X row says removal matches the pdfxid: prefix only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: eliets2 <287273517+eliets2@users.noreply.github.com> Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
eliets2andeliets2
|
ae893c1517 |
M13 batch: correct parity status and scope the no-replace sentence (#6299)
Co-authored-by: eliets2 <287273517+eliets2@users.noreply.github.com> |
||
|
496e37d72b |
M5: text boxes and typed text take an oval or a circle for their border (#4543)
* Fill & Sign: a Border control for typed text, and a border colour of its own Rebased onto main as one commit: main's Fill & Sign text colour (#2444) runs through the same places as the border (the open box, typed(), the page input, the toolbar and the preferences), so every step of the branch met it again. Text colour and border now travel together as TypedLook (typed_with), which keeps typed() and the new function under Clippy's argument limit; a border without its own colour takes the text's. Make Current Properties Default on typed text also keeps its colour for new text now. The branch's commits, in order: - Typewriter text: a border change grows its box on every side, so the text keeps its place - Fill & Sign: a Border control for typed text and dates - Parity: the typewriter border's evidence - i18n: the Border label in every catalog, recorded in ATTRIBUTION.toml - Text boxes, typewriter text and callouts: a border colour of their own - Fill & Sign: the toolbar follows the selected text; a Border colour button - fill_sign_add and comment_edit take `border_color` - Parity: the border colour and the toolbar following the selection - i18n: Border colour and Same as text in every catalog, recorded in ATTRIBUTION.toml - Typed text's border: /Border's width is read, a non-finite border colour refused, a saved Same as text restored - Fill & Sign: the toolbar changes only the selected text; Make Current Properties Default keeps new text's border - Review: Make Properties Default gives a text box's or callout's tool its border colour - i18n: the new labels in the Persian catalog, recorded in ATTRIBUTION.toml - Review: a test that dragging the Font size control resizes the selected text to where the drag ends - Rebase: the typed text's border in main's annot and comments modules (Style's border colour, exports), and craft_ui's ComboBox Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * M5: text boxes and typed text take an oval or a circle for their border Rebased onto #4146's new head as one commit (see there: main's Fill & Sign text colour runs through the same places). The border shape goes into TypedLook's border with the width and colour; a circle around typed text still takes the snug box. The branch's commits, in order: - Text boxes and typed text take an oval or a circle for their border - A circle goes snug around its text - Review: fill_sign_add takes an oval or a circle only with a border - Review: a circle made on a quarter-turned page is sized from the text as shown - Review: Border ▸ None takes an oval or a circle away with the line - Review: the Border colour button shows the selected text box's own colour - i18n: Border shape in the Persian catalog, recorded in ATTRIBUTION.toml - Review: Border ▸ None on a circled text is one undo step - Rebase: the border shape in main's annot, engine and comments modules; craft_ui's ComboBox; Fill & Sign's border controls in a function of their own (main's complexity limit) - Review: Thickness 0 in Comment Properties takes an oval or a circle away, as Border ▸ None does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Open the Font size popup first in the drag test: main moved the size into a popup * Border shape per selected comment, and split the oval/circle border out of draw_free_text (clippy cognitive complexity) * Re-run CI (the push of the main merge did not start it) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: FredApps <FredApps@users.noreply.github.com> |
||
|
|
0839c1e761 |
Fill & Sign: a Border control for typed text, and a border colour of its own (#4146)
* Fill & Sign: a Border control for typed text, and a border colour of its own Rebased onto main as one commit: main's Fill & Sign text colour (#2444) runs through the same places as the border (the open box, typed(), the page input, the toolbar and the preferences), so every step of the branch met it again. Text colour and border now travel together as TypedLook (typed_with), which keeps typed() and the new function under Clippy's argument limit; a border without its own colour takes the text's. Make Current Properties Default on typed text also keeps its colour for new text now. The branch's commits, in order: - Typewriter text: a border change grows its box on every side, so the text keeps its place - Fill & Sign: a Border control for typed text and dates - Parity: the typewriter border's evidence - i18n: the Border label in every catalog, recorded in ATTRIBUTION.toml - Text boxes, typewriter text and callouts: a border colour of their own - Fill & Sign: the toolbar follows the selected text; a Border colour button - fill_sign_add and comment_edit take `border_color` - Parity: the border colour and the toolbar following the selection - i18n: Border colour and Same as text in every catalog, recorded in ATTRIBUTION.toml - Typed text's border: /Border's width is read, a non-finite border colour refused, a saved Same as text restored - Fill & Sign: the toolbar changes only the selected text; Make Current Properties Default keeps new text's border - Review: Make Properties Default gives a text box's or callout's tool its border colour - i18n: the new labels in the Persian catalog, recorded in ATTRIBUTION.toml - Review: a test that dragging the Font size control resizes the selected text to where the drag ends - Rebase: the typed text's border in main's annot and comments modules (Style's border colour, exports), and craft_ui's ComboBox Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Open the Font size popup first in the drag test: main moved the size into a popup --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: FredApps <FredApps@users.noreply.github.com> |
||
|
|
42bc4f117d |
M5: copy and paste comments between documents, select several, finish connected lines from the menu (#3484)
Comments copy and paste, within and between documents. ⌘C with comments selected (and no text
selected) copies them, each with its replies, as XFDF: into the app's clipboard (every tab and
window) and as text onto the system clipboard. ⌘V, Edit ▸ Paste comments or the page's context
menu pastes them onto the current page at their own positions, as new comments under names of
their own, so nothing is replaced and pasting twice gives two sets; the copies are selected.
XFDF with comments from the system clipboard pastes too, so comments travel between processes.
pdfcraft_xfdf::export_xfdf_comments writes a selection with its replies; import_comments takes
a target page and a name prefix and imports copies (the usual import still replaces same names).
Engine: Edit::PasteComments { xfdf, page } (one undo step, comment permission) and
Session::export_comments. Tools: comments_copy (read-only) and comments_paste.
Several comments select at once: ⌘-click (Ctrl on Windows and Linux) or ⇧-click adds one or
takes it out, on the page and in the Comments panel; the one clicked last has the handles.
Delete removes them all as one step, a drag moves them together, the context menu copies them.
Connected lines, polygons and clouds finish from the right-click menu's Complete (with Undo last
point and Cancel drawing), as other editors do, besides Enter and a double-click.
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
|
||
|
|
c3c36f77cf |
M5: a comment's text, border or line, and fill each at an opacity of its own (#4542)
* A comment's text, border or line, and fill each at an opacity of its own
Comment Properties showed one opacity for a whole comment, so a text box's
see-through background took its text and border with it, and a rectangle
marking an area on a plan couldn't have an opaque line over a faint fill.
Now a text box, typewriter text or callout has a Text, Border and Fill
opacity, a rectangle, oval, polygon or cloud a Line and Fill opacity (a part
not drawn is greyed); everything else keeps one Opacity.
The line's stays /CA, the fill's is /ca (PDF 2.0's opacity for what is
filled) and the text's /PCTextOpacity, each only where it differs from the
one it would follow, and the appearance draws them with /GS0 (strokes at the
line's, fills at the fill's) and /GS1 for the text, so every viewer shows
them. The quick bar's Opacity and StyleAnnotation's set the whole comment's.
Engine: Style::{fill_opacity, text_opacity}, Edit::PartOpacity,
annot::{set_part_opacity, appearance::part_opacity}, Props::{fill_opacity,
text_opacity}. Make Properties Default and the settings carry the parts.
Headless: comment_add / comment_edit fill_opacity, text_opacity; comment_list
reports opacity, fill_opacity, text_opacity. Four labels in every catalog
(AI-assisted translations from English, noted in ATTRIBUTION.toml).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review: the text's opacity slider shows what the text is drawn at; comment_list skips replies' properties; ui-parity's change record
A text box without fill and border whose text kept an opacity of its own showed the border's
in its Text opacity slider; it now shows the text's, and a change sets the whole comment's.
The opacity sliders are named by their labels. comment_list reads a comment's properties only
for comments, not for every reply.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Rebase: comment_list tells replies by is_reply, as main now threads them
main threads replies by their /IRT reference (#4061); the opacity fields skip a reply the
same way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review: a text-only text box made default gives the tool its text's opacity
With neither a border nor a fill, a text box's text is the whole comment:
Comment Properties shows its drawn opacity (the text's own, when set), and a
change there sets the whole comment's. Make Properties Default, and the
context menu's Make Current Properties Default, stored /CA instead, so a
text box whose text was at 50 % gave the tool 100 %. The default is now the
text's drawn opacity in that case.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Rebase: the part opacities in main's annot layout (Style's fields, the text box drawing's parts, set_part_opacity exported)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Rebase: main's new comment test builds a Style with the part opacities
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
|
||
|
|
983e2f2ad6 |
M3: → / ← scroll a page wider than the window before turning it (#4540)
* → / ← scroll a page wider than the window sideways before turning it On a plan zoomed in, the arrow keys turned the page (#185) and never showed its other side: the view moved sideways only by the scroll bar, the wheel or the Hand. Now → / ← scroll a line that way while there is more of the page, and turn the page at its edge, as ↓ / ↑ do in single-page view. ⌘→ / ⌘← turn it at once; a page that fits across turns as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Review: → / ← read the current page's or spread's edges, not the widest page's; ui-parity's change record In continuous view the content is as wide as the widest page, so on a narrower current page that shows whole → scrolled toward the wide page's edge instead of turning. The edges are now the current page's (or spread's) as drawn, or the content's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Review: a spread's second page off screen still counts for → / ← The row's edges came from the pages' screen transforms, and a page gets one only while it meets the window. With a zoomed two-page spread scrolled so its second page was still wholly to the right of the window, the row ended with the first page, so the next → turned the spread instead of scrolling to the second page. The edges are now taken from the layout rectangles of every page in the row, placed as the drawn pages are. A TwoUp case in the viewer tests zooms a spread until its page gap sits at the window's right edge and checks that → scrolls on rather than turning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Review: → / ← read the row after continuous view has moved the current page In continuous view the current page is updated while the pages are laid out, after the row's extent was taken, so the edges could describe the previous row and the next → or ← turn the page instead of scrolling the page that had just become current. The row is now read after that update. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Review: a page turned by → / ← at its edge starts at the edge the reader comes from Turning at a wide page's right edge with →, the next page kept the horizontal scroll (the same column, as other jumps keep it), so an equally wide page opened at its right edge and the next → turned again without showing its left side; ← had the same in reverse. When plain → or ← turns the page, a page or spread wider than the window now starts at its left (after →) or right (after ←). ⌘→ / ⌘←, Page Down / Page Up and every other jump keep the column. The sideways-arrow test now goes across two wide pages both ways: → scrolls the next page from its left edge, ← turns back to the previous page shown from its right edge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Rebase: the sideways arrow keys through main's PageEnv, PageOut and GlideCx, and shown_row with its layout Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: FredApps <FredApps@users.noreply.github.com> Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> |
||
|
|
96fe832e12 |
M5: Shift holds lines level or plumb while drawing (ortho) (#4285)
* M5: Shift holds lines level or plumb while drawing (ortho) With Shift held, a new line or arrow runs level or plumb from where it starts, whichever is nearer to the pointer (a CAD drawing's ortho mode), and each new side of connected lines, a polygon or a cloud is held the same way from the corner before, rubber band included. Dragging an end or corner of a drawn one with Shift is held the same way; it turned to 45° steps before. The measuring tools keep their 45° steps. measure::snap::ortho next to constrain; comment_add takes `ortho` for line, arrow, polygon, cloud and polyline. Parity comment.draw-ortho. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Ortho: over the first corner the rubber band shows the closing side, Shift or not From review: a click there closes the polygon or cloud to its first corner, while the preview with Shift held showed a level or plumb side. The click and the preview now share one rule (closes_at). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Rebase: Shift is read where main's split put the drawing input, and the ortho helpers are imported there Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Rebase: Shift holds a drawn line, not a freehand stroke (a hunk had landed in the wrong branch) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Ortho: the parity note names the closing side's exception; the test's doc comment is back above its test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> |
||
|
FredApps
|
419b267ee5 |
Merge pull request #5125 from huppiflupp/feat/scan-clean
M10: Enhance scanned file cleans scanned pages in place |
||
|
ohagmannandClaude Opus 5.5
|
04cee34bfe |
M5: a double-click on a comment card's text edits it (#4544)
* A double-click on a comment card's text edits it On the selected card in the Comments panel only the header took the double-click: the text is a selectable label, so a double-click there selected a word and the editor stayed closed (a tester's report). It now opens the editor too; dragging over the text still selects it for copying. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Tests: the double-clicked card's editor is drawn too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Review: the double-click test also starts from a card that isn't selected It selected the card before any input, so it never covered what the change is for in the Comments panel as one uses it: a first click on the text of an unselected card selects it, the second edits it. The test now runs both ways. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
ohagmannandClaude Opus 5.5
|
8d569066b8 |
M5: Escape leaves a Fill & Sign tool, as it leaves a comment tool (#4539)
* Escape leaves a Fill & Sign tool, as it leaves a comment tool The first Escape closes the open type box, the next one goes back to Select; Fill & Sign's Text tool otherwise opened a box at every click with no way out by the keyboard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Fill & Sign: a new text box deselects, so two presses of Escape close it and leave the tool Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
FredApps
|
2f2d69be17 |
M10: merge main into feat/scan-clean; classify mixed scan pages in one pass
Merge origin/main. Conflicts: docs/changelog headers keep both histories; edit/run.rs keeps EnhanceScan beside main's run_edit_page_image; optimize images.rs keeps main's scaled() and the crate-visible jpeg(); the German strings in ui-egui/src/i18n/de.tsv go with that file, which main moved to craft-i18n. decode_samples now takes main's ImageBudget; a scan clean-up run shares one sized by the file. Review (CodeRabbit, scan_clean.rs): a page whose own images and a scan-holding Form only together cover it now cleans the images and reports the Form; a page whose images alone cover it reports its Form too. New regression fails on the old classification. |
||
  
|
863af864a7 |
M1: respect generations in PDF object references and full saves (#1143)
* M1: respect generations in COS object references and full saves Resolve stale references to null instead of replacement objects with the same number. Validate complete identities in writer readers, indirect stream lengths and catalog checks, and keep generation-aware length caches. Cover cache reuse, edit overlays, snapshots, incremental and packed/classic full saves, and stream lengths with synthetic regressions and independent hayro checks. Co-Authored-By: Codex <noreply@openai.com> * M0: clarify refreshed CI roadmap note Co-authored-by: OpenAI Codex <noreply@openai.com> * M1: repair contradictory xref generation references Address maintainer feedback on the existing PR. Preserve upstream work and document the tested scope and remaining validation limits. * M1: cover repaired generations and freed-slot round trips Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M1: document generation repair and bounded diagnostics Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M1: record generation repair regression evidence Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M1: document bounded COS generation repair Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M1: record generation repair parity evidence Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * fix(cos): preserve repaired generations through preflight and saves Keep accepted xref/header aliases across repair-aware edits and snapshots, canonicalize full-save identities, and retain bounded generation diagnostics from older revisions. Add COS, writer/encryption, and real preflight regression coverage. * test(preflight): assert repaired aliases share saved identity Address the review nitpick by comparing reopened HeaderImage and RowImage references after damaged full saves, for classic/packed output and edited/restored snapshots. Focused preflight regression and rustfmt check pass. * M14: update certificate dependencies for RustSec advisories Bump rustls-webpki to0.103.16 and webpki-root-certs to1.0.10. Preserve all other locked packages and dependency lists, manifests, Git pins, and advisory policy. --------- Co-authored-by: MMexicann <MMexicann@users.noreply.github.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: FredApps <FredApps@users.noreply.github.com> |
||
|
FredApps
|
15c505d1c6 |
Merge pull request #3858 from Kronbii/fix/scan-image-resampling
M2: scans stay sharp at screen size and smooth when zoomed (area-average shrink, bilinear enlarge) |
||
|
FredApps
|
84e85c1ff3 |
Merge pull request #5758 from hasannadeem/feat/update-check-preference
M14: Preferences can turn off the update check at start (#5737, #5460) |
||
|
FredApps
|
f3dc867651 |
Merge remote-tracking branch 'origin/main' into w
# Conflicts: # vendor/README.md |
||
|
FredApps
|
697a02e2ef |
Merge storytold/main into feat/model3d-render
# Conflicts: # crates/automation/src/lib.rs # crates/automation/tests/it/main.rs |
||
|
FredApps
|
8f8842e3ab |
Merge pull request #5396 from KenM76/fix/ocr-edit-under-scan
fix(edit): an edited OCR phrase under its scan image is drawn on top (#3973) |
||
|
FredApps
|
60894af44d |
Merge pull request #6125 from KenM76/feat/bookmark-clipboard
feat(ui): cut, copy and paste bookmark subtrees (#3994) |
||
|
FredApps
|
9070431ed3 |
Merge pull request #5250 from KenM76/fix/cleared-max-len-stays-cleared
fix(forms): clearing a field's length limit leaves it with none, not its parent field's |
||
|
FredApps
|
3788af11d3 |
Merge pull request #5808 from KenM76/feat/3d-embed
M12: add a 3D model (U3D or PRC) to a page with a poster (#1297) |
||
|
FredApps
|
8d7eb74ff7 | Merge remote-tracking branch 'upstream/main' into pk-6125m | ||
|
FredApps
|
61b80cb646 |
Merge pull request #6115 from KenM76/feat/outline-io
feat(organize): export, import and copy bookmark trees (#6018) |
||
|
d579f26de3 |
M11: JBIG2 images share a symbol dictionary, up to 16 at a time (optimize.mono-compression) (#5910)
* M11: JBIG2 images share a symbol dictionary, up to 16 at a time With Monochrome Images set to JBIG2, Optimize stored each image's letters in a symbol dictionary of its own, so a document of N pages carried its font's shapes N times. Now up to 16 images the run stores as JBIG2 share one dictionary in a /JBIG2Globals stream, holding the marks found in more than one of them; each image's text regions refer to it first, then to a dictionary of its own for the marks only it repeats. An image is stored that way when it comes out smaller, and a group only when what its images save is more than the globals take. - filters: encode_jbig2_shared codes a group: the globals are a symbol dictionary segment numbered 0 and associated with no page (7.2.6); each page numbers its segments from 1, as a segment refers only to lower numbers (7.2.5), and the shared symbols' IDs come first, as the dictionaries are referred to in that order (Table 31, SBSYMS). At most 16,383 shared marks, those in the most images, so a page keeps room for its own under the decoder's 32,767. - optimize: the run holds the 1-bit samples of the images it stores as JBIG2 (16 at most, 64 MiB at most) and stores them again sharing, weighing each with the longest reference the globals could have. Eight pages of 10 pt text rendered at 300 dpi take 41% less in Helvetica and 42% in Times than coded alone, 10% in Courier, and 46% in Helvetica at 600 dpi; groups of 2, 4, 16 and 32 save 19%, 33%, 45% and 47%. Redacting one image stores the others of its group again without the dictionary, so 16 keeps that to 15 images. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: test what the mutants found untested in shared JBIG2 dictionaries - filters: the group goes through encode_jbig2_shared, which refuses it for an image the encoder refuses; two marks in common are enough to share; past the 65,536 distinct marks a group holds, a mark first seen later isn't shared while those held count every image. - optimize: optimizing again keeps both the shared pages and the pages coded alone as they are; under Retain, averaged JBIG2 pages share nothing; a last group of two shares. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: only images redaction can store again share a JBIG2 dictionary Redacting one image of a group stores the others again without the dictionary, which can hold the shapes of marks under the area, and refuses the redaction for one it can't: it takes image masks and images of one component as its own reading counts them (no DeviceN, the family named directly), and at most 64 Mi pixels. Optimize took DeviceN of one colourant and up to 80 million pixels, so such an image in a group made any redaction of the others fail, where before it was coded alone and the same redaction worked (the Consumers review). Only an image mask or a DeviceGray image named directly, of at most 2^26 pixels, now joins a group; others are coded alone. An engine test optimizes three pages, two DeviceGray and one DeviceN, and redacts the first: the DeviceN page stays alone, the second is stored again, and no image names the dictionary after a save. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: optimize and redaction share one limit on the images redaction stores again The second Consumers review: Optimize's limit on images that share a JBIG2 dictionary copied redaction's private 64 Mi, with nothing tying the two, so a lower one in redaction would bring back refused redactions with no test going red. Both now read pdfcraft_cos::MAX_REDACTED_IMAGE_PIXELS. The engine test adds an image mask, the other kind that shares, so a redaction that stopped storing either kind again fails it. doc_optimize's description, the README, the parity note and ROADMAP say which images share (named directly). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: a JBIG2 group is coded before its samples would pass the limit CodeRabbit on #5910: hold added an image to the group and then checked SHARED_BYTES, so a group could pass the 64 MiB it is documented to stay within by its last image, which can itself be up to 64 MiB (an image that shares has at most 2^26 pixels, and as its rows are whole bytes, at most that many bytes; a 1-pixel-wide one takes them all). hold_in codes the group first when an image would take it past the limit, and after when it has 16 images; with room for 10 bytes, images of 4 go two to a group, where the old order made one of 12. CodeRabbit's follow-up too: the 18-image test decodes every image and compares it with its samples, across the boundary between the groups. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * optimize: count the globals' object framing; filters: test the shared coder's size limit - A JBIG2 group shares a dictionary only when it saves more than the globals' dictionary and data plus NEW_OBJECT (96 bytes: the object's framing, its xref entry, and an encrypted file's IV and padding), so a group that saves less than that no longer makes the file larger. - encode_jbig2_shared is Unsupported for an image taller than the decoder takes and codes one at the bound. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * filters: drop the unused rows binding in encode_shared page() no longer takes the rows since #5511. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * filters: the shared coder's at-bound test says what it returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> |
||
|
|
9203e4a6be |
M1: encryption reads every legal form: crypt filters by reference, a stream's own filter on screen, and full saves that keep /Encrypt (#5548)
* M1: a crypt filter selected by reference is used A stream can name its own crypt filter, and every part of that can be indirect. cos read only the direct forms, and took anything else for no name, which is /Identity. So a stream selecting a filter by reference was saved in the clear in a file meant to be encrypted, and in a file from elsewhere its ciphertext was read as data. The /Encrypt dictionary's /StmF, /StrF, /EFF, /CFM, /Filter, /EncryptMetadata and a filter's /Length had the same fault, and /StmF by reference left every stream undecrypted. A stream's /Type and a signature dictionary's are read through references too. transform now reads these from the document, so a full save encrypts before it renumbers: the references in what it reads have to be the document's. Dropping a crypt filter that new protection doesn't define comes before the walk, so what it copies out of a reference is encrypted too. Loading can re-enter here, and LoadGuard ends a cycle, which reads as absent. A chain longer than any decoder takes names no filter: its entries would be followed for every stream sharing it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M2: a stream with a crypt filter of its own is drawn The renderer decrypted every stream with the document's filter and then failed on /Crypt as a filter it couldn't decode, so a stream naming its own filter read as nothing, however it was spelled, and a page whose content was such a stream stayed blank. It now uses the filter the stream names, /Identity without one, and /Crypt is nothing further to decode (hayro-syntax patch 30). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: tests for a crypt filter's place among the others A lone parameter dictionary is the first filter's, so /Crypt behind another filter has no name of its own, and an array too short for /Crypt's entry stays as it is when the filter is dropped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: encryption reads every legal form, and a full save keeps them From a review of the crypt filter fix. The renderer read a stream's own filter from the form /DecodeParms had to match the form of /Filter, so [/Crypt] with a lone dictionary, an everyday spelling, read as /Identity and the page stayed blank. Parameters are now taken in either form, which also gives [/FlateDecode] its predictor. It also refused a V4 file without /StmF or /StrF, which are optional, and used a /CF entry named /Identity, which is never one. A chain past what cos decodes names no filter there, so it names none here either (hayro-syntax patch 30). A full save lost what a direct /Encrypt refers to, and kept its references under the old numbers, so nothing in the file read afterwards. /O or /U given by reference were decrypted and encrypted again under a new number, so the file it wrote no longer opened. What /Encrypt and /ID refer to now stays as stored. /ID by reference, which has to be direct, is read, and written direct. A signature dictionary is known by a /ByteRange given by reference, and a null or dangling /Type or /Subtype is an absent one. References to references are followed in Document::resolve, so /Name by way of two no longer saves a stream in the clear. New protection drops every /Crypt in a chain. An object stream's /DecodeParms can be given by reference. Reading what decides how an object is treated can load more objects, each doing the same, which a file could make a tree that doubles with every level once the cache lets go of it. What is loaded for one of these no longer follows its own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: what a read follows is bounded by a budget, and nothing shared is copied per stream From a review of the fixes before this, all in them. A flag that kept what is loaded for a selector from following its own stopped the fan-out, but a legal file lost object stream members to it: read first through a selector, an object stream with parameters by reference was kept undecoded, and a full save wrote nulls without saying so. A budget replaces it: one read or write of an object, with all it loads on the way, follows up to 32 references, which is more than any object needs when all of it is by reference. Past that they read as absent, so a file's ladder of selectors still stops, and nothing a real file holds is lost. Finding out whether a dictionary is a signature's loaded objects for every dictionary of an object, and a load that fails takes a scan of the file, so one read could hang. Only a dictionary with a direct string /Contents is asked now, and the budget bounds those. /ID written direct copied every entry, so a 1 MB file naming a large string thousands of times ran out of memory: it is at most two strings now. Dropping a crypt filter copied a shared /DecodeParms or /Filter into every stream, 1 GB from a 1 MB file: of what's shared only filter names and the parameters decoders read are copied now, through Document::with_direct_parms. The renderer skips /Crypt in a chain instead of copying the data for each entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: only an object itself follows references, and a failed scan is remembered From a review of the budget. Following a reference while walking deep inside an object added that depth again for each object loaded, which overflowed a 2 MiB stack on a file under 10 KB and took the process with it, past any catch_unwind. References are now followed for the object itself and never for what is nested in it. A stream can't be nested, and a signature dictionary nested in another object reads as it says directly, as it did before this PR. walk is back to following nothing. A reference that fails to load scans the file, and nothing remembered that, so a 1 MB file took minutes to save. What a scan didn't find is kept for the document: the file doesn't change. Filter names copied out of a shared chain are bounded, since a name can be any length. /ID keeps each entry in its place, or the key made from the first entry changes. direct_id's comment was on another function. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: tests with no deadline a busy machine can reach Wide margins on the two that time what they guard. A test of dictionaries nested in an object goes: nothing nested follows a reference now, which the small-stack test covers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: a crypt filter past what a read may follow is the document's own Past the budget a reference reads as absent, and a crypt filter with no /Name is /Identity, so a stream that selected one by reference had its ciphertext read as data. What can't be told takes the document's filter, as a /Filter that can't be read does. Found by CodeRabbit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: a read refused, not a budget full, is what leaves a crypt filter unknown My last commit took a read that used up all it may follow for one that was refused, so an /Identity stream read at exactly 32 follows was decrypted to garbage. Refused reads are counted now, and only one on the way to this stream's /Name says anything about it. Found by CodeRabbit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M1: a save keeps the handler, the key and the permissions Under every algorithm and by either kind of save, `/Encrypt`, `/ID`, the file key and the permissions come back as they were. No test held that. `/ID` by reference is held through an incremental save too, which leaves it as it was. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * cos: encrypt an edited or added object whatever /Encrypt names stored_as_is now also requires the object to be unedited, so an edit of an object /Encrypt or /ID refers to, or a new object given a number they name, is encrypted on both saves. encryption_members skips numbers with no object behind them and streams, which those dictionaries never hold. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> |
||
 KenM76andClaude Opus 5.5
|
6cb3dbe8cc |
Merge feat/outline-io and origin/main into feat/bookmark-clipboard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
|
PiohrunandClaude Opus 5.5
|
bc7c60bb41 |
M11: JBIG2 encodes only what its decoder takes: Optimize no longer stores large images PdfCraft can't draw (#5511)
* M11: JBIG2 encodes only what its decoder takes: Optimize no longer loses large images encode_jbig2 took rows of up to 2^20 samples and any number of them, while hayro-jbig2, which draws and reads these streams, takes 65,535 on a side and 2^28 samples. The optimizer doesn't read back what it stores, so with Monochrome Images on JBIG2, any 1-bit image with a side of 65,536 or more was replaced by a stream that draws nothing: 65,536 × 16 went from 37,875 dark pixels to none, and was reported as recompressed. The encoder now refuses what the decoder can't read, so such an image stays as it is. Symbol coding's limit of 2^24 rows can't be reached any more, so it goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: the JBIG2 boundary test checks a pixel It counted rows, which a page decoded blank would pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: the encoder's bound on samples is MAX_JBIG2_PIXELS, the decoder's main brought decode_jbig2 and its public MAX_JBIG2_PIXELS into this crate, 2^28 like this branch's private MAX_JBIG2_SAMPLES and for the same reason. One constant now bounds both, so the encoder can't drift past what the decoder reads. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: an image too large for JBIG2 isn't stored as JBIG2, as the notes say The parity note said such an image stays as it is. A 1-bit one does unless it is averaged, but one packed from more bits may become 1-bit Flate. The note now says it isn't stored as JBIG2 and cites an_image_too_large_for_the_jbig2_decoder_stays_as_it_is, and the optimizer README lists the bound under Not yet. MAX_JBIG2_PIXELS is the most the decoder takes, not about that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: the optimizer's own size limit, and tests for what JBIG2 can't take The optimizer leaves images over 80 million pixels alone whatever the settings, and nothing said so; the README and parity note say it now, and that JBIG2's 2^28 in all is past it, so from Optimize the side bound is the one that applies. The note says what the image step does: it leaves a 1-bit image past the bound as it is unless it is averaged, and may store one packed from more bits as 1-bit Flate. what_is_too_large_for_jbig2_is_stored_another_way tests those two cases: eight-bit grey of black and white at 65,536 wide becomes 1-bit Flate, and a 1-bit image at 600 ppi averaged to 70,000 wide does too. At 65,535 and 35,000 both become JBIG2. The symbol cap's comment says why hayro-jbig2 refuses 32,768 symbols: it caps new and exported symbols together at 65,535, and a plan exports every symbol it codes. Measured: 32,767 decode, 32,768, 40,000 and 65,535 are refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: the 80-million-pixel limit is the image steps', tested on both sides The README and parity note said images over 80 million pixels are left alone whatever the settings, but Clean Up still Flates an unfiltered or LZW one. They now say the image steps leave them alone, and the note cites group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit for it. (The last commit said the note also gives 2^28 as past that limit; only the README does.) what_is_too_large_for_jbig2_is_stored_another_way covered the width bound only: it now runs tall images too, packed and averaged, and checks the averaged ones are one bit and half the size both ways. The older test uses the same bars() fixture, and its comment says such a stream drew nothing in PdfCraft, not that the picture was lost: Poppler and Ghostscript draw it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: the JBIG2 stored at the decoder's bound reads back, and grey keeps the pixel limit - The optimize test at 65,535 on a side decoded nothing it stored: it checked the filter only, and the coding stored there is symbols, not the generic coding the filters test reads back. It now decodes the stored stream and compares it with the bars. - The README's 80-million-pixel sentence covers the colour and grey steps too, and only the 1-bit step had a test. A grey image of 10,000 × 8,000 at 600 ppi is resampled; a row more stays as it is. - The filters README names decode_jbig2_within, with its work, as main renamed decode_jbig2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY * M11: the filters README names #5569's other renames too The README named decode_jbig2_within but still decode_ccitt, which #5569 made private behind decode_ccitt_within, and gave Document::decoded_image as both decoders' caller, which is test-only now: ImageBudget::decode calls them, as lib.rs's doc says. The ccitt.rs test line keeps decode_ccitt, which those tests call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmsdeUCdTaD72jkDw2pJKY --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
KenM76andClaude Opus 5.5
|
c16c6b5716 |
M4: cut, copy and paste bookmark subtrees (#3994)
The Bookmarks panel's item menu gets Cut, Copy and Paste, and Bookmark options gets Paste bookmarks (to the end of the outline, which is how you paste into a document without one). The clipboard lives in the app (`PdfCraftApp::bookmark_clipboard`), like the Organize Pages clipboard, so it works across tabs and on the web build. - Copy reads the subtree with `outline_tree`; a copy cut at the listing depth says so. - Cut copies first and deletes only if the copy succeeded: one undo step. - Paste is one `ImportBookmarks` edit after the bookmark it was asked on, at its level. A bookmark whose page the document lacks keeps its place without a destination, and a notice counts them (plural forms through `trn`). Parity: new `organize.bookmark-clipboard` entry with what is missing (shortcuts, system clipboard, multi-select, page-ordered insertion). Test: cut_copy_and_paste_a_bookmark_subtree_within_and_between_documents. Reverting copy, cut, paste, the paste's parent, the one-step undo or the notice each fails it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
 kronbiiandClaude Opus 5.5
|
c5065554a1 |
M2: shrink masked images a row at a time; keep near-1:1 scans sharp
Review of #3858 (aiongg): - An area-shrunk image with a soft mask, a stencil's ink included, built its full-resolution RGBA before shrinking. A 10718 x 13701 stencil at page size peaked at 1.16 GB (587 MB of RGBA). It is now premultiplied a source row at a time as it is averaged, and the shrink works a target row at a time, so it peaks at 1.03 GB, as the nearest-neighbour path did. Same bytes; about 5% slower per shrink. - An image whose f32 scale passed 1 only by rounding was smoothed bilinearly and blurred by half a pixel at a half-pixel offset. It is now smoothed only above 1.01. - A shrunk /ImageMask stencil keeping its thin strokes (#4800) is now tested. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
kronbiiandClaude Opus 5.5
|
ff227b770c |
M2: area-average shrunk scans and smooth enlarged ones
Scanned pages looked thin and broken at screen size. An image that does not ask for /Interpolate (most scans) was pre-shrunk with nearest-neighbour since about one sample in ten and dropped most strokes of its text, and the nearest sampler then read the shrunk raster again at a fractional offset. - Shrinking (vendored hayro patch 21): non-interpolated images outside Type 3 glyphs are area-averaged (area_shrink: each device pixel the coverage-weighted mean of the samples it covers, 16.16 fixed point whose weights sum to exactly one, premultiplied when masked) to their snapped device rectangle and drawn 1:1. /Interpolate governs smoothing when an image is enlarged (ISO 32000-2 8.9.5.3); averaging adds nothing between samples and drops none. PicScale's Box/Area filters were not usable: shrinking, they average a window four target pixels wide. - Enlarging (patch 28): an image of page-scan size (512+ samples on its shorter side) is drawn bilinearly when enlarged, so a zoomed scan has no staircase edges; icons, QR codes and pixel art keep their hard pixels. - A snapped image whose shrink failed keeps the full transform instead of being drawn at its source size (latent in the interpolated path too). Measured on a 13-page 300 dpi scan at 96, 120 and 192 dpi: every rendered sample is within 1 of the exact area average (it was up to 255 off, 17-23% of samples by more than 1). Bilinear zoom costs nothing measurable (four 1024 px tiles at 400%: 50 ms, nearest 48 ms; bicubic was 267 ms). Review fixes: - a tile snaps a shrunk image's half-pixel edges where the whole page does - a scan shrunk one way is smoothed the way it is stretched - a smaller soft mask doesn't let transparent colour through the area shrink Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
KenM76andClaude Opus 5.5
|
801976a574 |
feat(organize): export, import and copy bookmark trees (#6018)
bookmark_export returns an outline, or one bookmark's subtree, as JSON: titles, nesting, open state, colour, bold/italic and destinations as page plus view in PDF user space (ISO 32000-2 12.3.2.2), optionally written to a file. bookmark_import takes it back, inline or from that file, under any bookmark at any position or in place of the outline, as one undoable edit; bookmark_copy does the same from another open document by page number. A bookmark whose page the target lacks keeps its place without a destination and is reported in `unmapped`. Every node is checked before anything is written (title, page, colour, view type and arity, 33 levels, 100,000 bookmarks), and the error names the node. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
 Hasan
|
1c4ef83491 |
M14: decide the update check at start once, on the first frame (#5737)
Review of #5758: with the preference off, the startup request stayed pending, so turning the preference on later in the session sent a network request at once. The request is now consumed on the first poll whatever the preference says, and a later change waits for the next start. |
||
|
Hasan
|
36d24eae6e |
M14: Preferences can turn off the update check at start (#5737, #5460)
The desktop app asks for a newer release on its first frame, and nothing could stop it, though the README says PdfCraft works offline. A preference, on by default so nothing changes for anyone who leaves it, keeps the app off the network until Help ▸ Check for updates is chosen. It has its own settings key: check_updates_at_start was an opt-in, off unless chosen, so settings written then would turn this off unasked. |
||
|
KenM76andClaude Opus 5.5
|
fb05b733f9 |
M12: model_render, and a 3D reference's stream under /3D
A 3D reference dictionary holds the shared stream under /3D (ISO 32000-2 §13.6.3), not /3DD; it is followed once, and the caller refuses anything that is not a stream, so a chain or cycle of references ends. The tool is renamed model_render, since MCP tool names here are lowercase letters and underscores only, and to match model_add. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
|
KenM76andClaude Opus 5.5
|
ae1b28cf1d |
M12: model3d_render, a 3D annotation's PRC model drawn to a PNG
pdfcraft-annot reads a page's 3D annotations and the model each shows: the /3DD stream, or the stream a /3DRef names (at most four deep, so a cycle ends), decoded within 256 MB and typed PRC or U3D by /Subtype. pdfcraft-engine exposes both on Document. The automation tool model3d_render picks a page's Nth 3D model, parses PRC with pdfcraft-prc, assembles and frames it with pdfcraft-prc-render from a chosen direction (default an isometric-style view, Z up), and returns the image as a PNG. U3D gives an error until a decoder lands. parity misc.3d-view moves to partial. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
|
KenM76andClaude Opus 5.5
|
ace92f3f2f |
Merge origin/main
Tests only: both sides added tests at the same place; both kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
 AdrianTM
|
0d3f57e120 |
M5: keep Fill & Sign editing on Enter and preserve line breaks (#5850) (#5954)
* M5: keep Fill & Sign editing on Enter and preserve line breaks (#5850) * M5: preserve typewriter whitespace through readers and edits (#5850) * M5: retain direct-subtype comment listing for Fill & Sign fix (#5850) |
||
 
|
3709926f39 |
Continue Bates numbering across ordered PDFs (#5953)
* feat: add multi-file Bates numbering * fix(automation): doc_bates_multi rejects a malformed start_number and >> in prefix or suffix, accepts a range ending at u64::MAX, and counts only staged outputs Addresses CodeRabbit's quick-win notes. Parity is partial until a GUI dialog exists. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Brandon Thomas <echelon@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
 Hasan N.
|
1849b38c5a |
M2: a soft hyphen a substitute font lacks draws its hyphen (#5888) (#5896)
Windows exporters map the hyphen of an Arial they don't embed to U+00AD in /ToUnicode. The CFF standard substitute has no soft hyphen, so the CID was taken as its glyph index and drew an unrelated glyph (an Ë, or ! in bold). ISO 32000-2 Annex D.2 calls the soft hyphen typographically the same as the hyphen, as patch (30) already reads WinAnsi 0xAD: draw the substitute's hyphen. The text keeps U+00AD. |
||
|
KenM76andClaude Opus 5.5
|
342524e130 |
Merge origin/main into feat/3d-embed
Resolves the ROADMAP.md progress-log conflict by keeping both lines, newest first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
 Harsh VermaandFredApps
|
01ba3ac9d1 |
Feat/unify hotbar quick tools (Fixes #5890) (#5909)
* feat(ui): unify quick bar and hotbar and refresh settings dialog (#5890) * style(ui): compact hotbar tools customization menu * fix(ui): keep hotbar settings visible when docked to sides and address review findings - Add placed bool to Hotbar to distinguish explicitly placed [0.0, 0.0] from default floating margin offset - Check !a.locked before applying quick bar color edits to annotations - In non-full-side docked vertical layout, scroll tools within available height so settings button remains visible in compact windows - Remove max_width(cell) on vertical full-side scroll area to avoid clipping wider controls - Restore outer vertical scrolling with max_height on Hotbar tools picker window - Add test verifying docked hotbar in compact windows keeps settings button visible, and assert controls do not overlap * feat(ui): close hotbar settings menu when clicking outside or pressing Escape - Detect pointer clicks outside the settings menu window bounds and dismiss the menu automatically - Keep settings button click behavior to allow opening and keeping the menu open - Support Escape key to dismiss the settings menu - Add integration test verifying clicking outside on canvas or on another tool dismisses the menu * style(ui): restore hotbar settings dialog design to match concept mockup * fix(ui): cap hotbar tools picker width to viewport on narrow screens * fix(ui): anchor hotbar tools picker to rendered bar edges to avoid overlap * fix(ui): keep upgraded hotbars in the margin and label the settings controls (#5890) Preferences written before this change have no `placed` key, so every existing user's untouched floating, horizontal, top-centre hotbar would have jumped out of the margin. Such a bar now takes the new default; any spot the user chose, including the top-left corner, is kept. The side picker reuses the Preferences segmented pill control, so its options are themed, reachable as radio buttons by label and visible to the translation scan. The layout switch now carries its label and enabled state. --------- Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> |
||
|
KenM76andClaude Opus 5.5
|
3d106d7e1e |
Merge origin/main into feat/3d-embed
Resolves the ROADMAP.md progress-log conflict by keeping both lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
|
5cb65ff0ee |
feat(ui-egui): Preferences can invert the middle-button drag (#5790) (#5817)
Add a saved preference, invert_middle_drag (off by default), that reverses the direction of the middle-button pan and of the latched auto-scroll. It changes only the direction, not which of the two a platform uses, so it composes with the Windows auto-scroll work. Reachable as Preferences > Invert middle-button drag and headlessly through ui.set invert_middle_drag. Parity "Automatic scrolling" notes updated; status unchanged. Tests: a unit test of both paths with the switch on and off (dead zone kept), a settings round-trip test, and an end-to-end control-channel drag. Each fails with its fix reverted. Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 Co-authored-by: KenM76 <KenM76> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Hasan N.
|
bf0f3c9f77 |
M10: macOS print jobs name their title and owner (#5743) (#5757)
* M10: macOS print jobs name their title and owner (#5743) lp sends no com.apple.print.JobInfo.* attributes, and Kyocera's macOS filter crashes without PMJobName and PMJobOwner, so the job stops with cups-filter-crashed and nothing prints. Both go to lp as job options, in the form lp_args passes on: printable ASCII, up to 64 bytes. * M10: keep macOS job metadata as the name CUPS should send (#5743) Review of #5757, checked against this Mac's libcups in memory: - `'` and `\` were consumed as quoting and `{` opened a collection, and a bare true/false became a boolean, so a filter reading PMJobName got nothing or the wrong type. They now become `_`, or the fallback. - CUPS keeps the last of a repeated option, ignoring case, so the defaults replaced a value a doc_print caller had set. They are now added only for a key the job leaves out. - Nothing proved the job info reached the spooler. A test now runs both submit paths against a stand-in `lp` on PATH. |
||
 
|
cb405f207e |
fix(optimize): make pictures under a stencil mask smaller (#5847)
* fix(optimize): make pictures under a stencil mask smaller An image with any /Mask was skipped by the colour and grey settings. That is right for a colour-key mask, which names sample values that resampling and JPEG would change. A stencil mask is an image of its own, with its own resolution (ISO 32000-2 8.9.6.3), so the picture can change under it and the mask stays as it is. Some exporters put one on every picture, even where it hides nothing, so whole drawing sets of pictures were left at full size. A mask that can't be read as a stencil, such as a reference to nothing, still leaves its picture alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(optimize): only a mask that says /ImageMask true counts as a stencil A stream /Mask without /ImageMask true let its picture be replaced, although a mask that isn't a stencil is meant to leave its picture alone. It now does. The stencil test also checks that the hole still shows what's behind it. The first pixel all round is left out, because the coarser picture blends into it a little (at most 26 of 255 in this test). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(optimize): draw a coloured page behind the stencil test's picture On a white page, a hole painted white looks the same as an open hole, so the check on the hole couldn't tell them apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: quincy-jc <184324679+quincy-jc@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
KenM76andClaude Opus 5.5
|
16ffab9b03 |
M12: add a 3D model (U3D or PRC) to a page with a poster (#1297)
A new `model_add` automation tool and `Edit::AddModel3d` embed a U3D or
PRC file as a 3D annotation (ISO 32000-2 13.6.2) in a chosen rectangle:
- The model goes into a Flate-compressed 3D stream (13.6.3) with /Type /3D
and /Subtype U3D or PRC, read from the file's header (`U3D` and a zero
byte, or `PRC`); anything else is refused before the document changes.
Models over 256 MiB (MAX_MODEL_BYTES) are refused. model_add checks the
file's size (from the file system) and its header before reading the
rest, so a large file that is not a model is never loaded; the path goes
through the read root, and `read_model` joins the helpers the
file-access test knows take a resolved path.
- /3DD references the stream, so the annotation has its own instance.
- /3DA states /A: click (XA, the standard's default and the tool's),
page_open (PO) or page_visible (PV).
- /AP /N is the poster readers print and show before activation: a chosen
image or PDF page fitted inside the box keeping its shape and centred (the
custom-stamp picture path: `mark_source`, `fit_picture`, and the stamp's
placement matrix now shared as `appearance::picture_place`), or, with no
picture, a light frame labelled "3D model". It is drawn in user space and
not counter-rotated, so on a page with /Rotate it turns with the page, as
the model does.
- /Contents carries the name (the file stem by default) as the alternate
description (12.5.2).
- A document older than the model needs gets /Version in its catalog
(7.7.2): 1.6 for U3D, 1.7 for PRC, as the optimizer does for JBIG2.
Adobe's extension level for PRC in 1.7 is not written.
- The 3D rectangle has its own MAX_MODEL_SIDE (14400 pt).
The edit is undoable ("Add 3D model"), needs the comments permission and
rebuilds only the comments view. A new parity entry, misc.3d-add, is
partial: no poster rendered from the model, no views (/VA, /3DV), no
replacing the poster, no UI command, no /Extensions. misc.3d-view is
unchanged. ROADMAP.md progress log line.
Adapted from pdfcer (MIT, same author), commit 1ca5ece, rewritten to this
repository's types and rules.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9
|
||
|
KenM76andClaude Opus 5.5
|
d69d5cc832 |
Merge origin/main into fix/ocr-edit-under-scan
Conflicts: images.rs (main folded image_transform_scope into image_scopes; kept only painted_over) and text/interp.rs (gs arm now reads params via dict_in_place, then records the soft-mask anchor). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqmHYx8FiWM5PcsoiErgp9 |
||
|
FredApps
|
4ffe5908c8 |
Merge origin/main into feat/jbig2-run-allowance
# Conflicts: # vendor/README.md |
||
|
|
d3384340a6 |
M7: make page-mark replacement transactional (#5657) (#5704)
* M7: make page-mark replacement transactional (#5657) * ROADMAP: drop the header line (the log entry stays) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Brandon Thomas <echelon@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |