- A link that fails puts the realm's timers back as they were before its
own script ran, and turns no layer: timers it set are dropped, timers it
cleared come back (timers::save/restore in Realm::run_job).
- In a read-only document a link's requests still apply when its field
changes can't; the outcome carries the read-only error.
- app.openDoc during a calculation (calculateNow) is noted on the console
and not queued, as for a field script running on its own.
- Link script streams are decoded once per stream, whatever their source
length, and /Filter [] reads as the raw source.
- The web build sets the view's zoom, page and highlight before a link
script runs, as the desktop does.
Since Rust 1.100, clippy's needless_bool refused program_is_executable on Windows: with the
#[cfg(unix)] block gone it read if ... { return false; } true, and the Windows gate failed on
every main commit since 13 Nov 09:38. The check is now one expression with the platform part
in has_execute_permission; behaviour is unchanged on every platform.
* fix(optimize): a destination name given by reference is copied once however many dictionaries name it
* fix(optimize): aliases of one destination-name object are copied once
home_recent_context_menu_reveals_the_target_without_opening_or_removing_it
never set run_inline, so reveal_path checked the missing file on a
pdfcraft-reveal worker thread while the test waited a fixed three frames
before asserting the "The file no longer exists" toast. On a loaded runner
the worker can report after those frames and the assertion fails. Set
run_inline, as the reveal unit test in tab_context.rs already does.
* fix(ui): Recognize Text's settings scroll in a short window, its buttons stay in reach (#6599)
On a small screen or at a large display scale the dialog was taller than the window: it was
centred with its title and its Cancel / Recognize text row off the screen, and nothing scrolled.
The four settings groups (Pages, Settings, Skip, Output folder) now sit in a vertical scroll area
capped to the window's height, as Preferences does (#3557). The title, the engine notice and the
button row stay outside it, so they are always on screen; when the settings fit, nothing changes.
The test opens the dialog in 400 to 700 pt windows and checks the title and both buttons are on
screen, and that the last group scrolls in between the title and the buttons while they stay put.
Without the fix it fails at 400 pt with the title at y = -267.
* contributors: credit asadosteaksnl as Kas
* fix(ui): Recognize Text's settings scroll in as little as 40 pt, so its buttons fit the smallest window (#6599)
A 120 pt floor still pushed the dialog off a window shorter than about 340 pt: at 173 pt (the
smallest window, 520 pt, at the largest interface size, 300%) the title sat at y = -32. The test
now checks 173, 208 and 260 pt windows too, as the Preferences layout test does.
* test(ui): the short-window Recognize Text test clicks Cancel and checks a 640 pt wide window (#6599)
Cancel being on screen isn't proof it can be clicked: the test now clicks it at every height and checks the dialog closes. The window is 640 pt across, a 1280-pixel screen at 200%, and every control is checked to fit across as well as down.
* test(ui): the Recognize Text title stays put while the settings scroll (#6599)
* Revert "contributors: credit asadosteaksnl as Kas"
This reverts commit 52470f66a7.
* docs(ui): document the Recognize Text dialog's body (#6599)
* test(ui): the Recognize Text test also covers tall windows where nothing scrolls (#6599)
The dialog is about 935 pt tall, so it scrolls up to a 900 pt window; at 1100 pt everything fits. Both now run, so the test also pins the case where the settings fit and the layout is unchanged.
---------
Co-authored-by: asadosteaksnl <353856209+asadosteaksnl@users.noreply.github.com>
Main now has page actions, timers and layers (#6985) and shared text
allowances for inspection (#6015). Conflicts:
- render/inspect/annotations.rs: main's collect_link (which notes
JavaScript even when the link isn't listed) takes this branch's link
script budget and its once-only warning; push_link is gone.
- automation form_tools.rs, js tests.rs, docs/acroform-script-workflows.md:
both sides added at the same place; both kept.
Adapted to main: the link runner's Job gets `timer: None`, and, as a
button's script does, the document's layers and the fields as page
actions and timers show them (live_state).
After the edit ran, a batch can still fail the redaction checks: a
deleted marked page alongside added pages, or text still shown under a
mark. Both returned without discard_edit_callbacks, so globals (and now
timers) the batch's field scripts left stayed in the document's realm
while the document rolled back. Every other refusal after the edit
already discards them.
Test: a_batch_a_redaction_check_refuses_discards_callback_globals. A
keystroke script sets a global, and a batch that sets the field and
deletes the marked page while adding one is refused. Without the fix the
global is still there ("number" for "undefined").
vendor/README.md conflicted: main took hayro-interpret patch 104 (RGB
colours in isolated DeviceCMYK groups). This branch's viewer overrides
become patches 105 (annotation_overrides) and 106 (appearance_overrides)
in the README, in vendor/hayro-interpret/src/interpret/mod.rs, in the
raster test and in docs/acroform-script-workflows.md.
* feat(a11y): auto-tag Apply tags headings by size and weight
Apply now chooses H1-H6 or P per text object instead of P for all.
The body style is the half-point size showing the most characters (bold
when most of those are bold). A short object (at most 3 lines, 200
characters, with a letter) is a heading when it is 1.15x the body, or
bold at 0.9x the body over a regular body in at most 2 lines. Heading
styles rank across the document, larger and bolder first, capped at H6,
and a level never skips past the one before it so heading-nesting
passes.
Size is Tf x Tm x CTM with q/Q tracked; bold is Metrics.bold. Text in
render mode 3 (an OCR layer) is not counted. Font metrics are measured
once per font object per document, at most 256 fonts.
AutoTagResult gains a headings count. Parity, gaps, roadmap and the
apply tool's note say headings are tagged.
Fixes#7062.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(a11y): rank heading styles by map and skip clip-only text
Look up each heading style's rank in a map built once after sorting,
so ranking is linear in the number of text objects. Text in render
mode 7 (clip only) paints nothing, so it is excluded from heading
evidence like mode 3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* prc: rebuild compressed tessellations whose normals are recalculated
A TESS_3D_Compressed (WD 7.8.9.7) was read to its end but never rebuilt,
so prc-render drew nothing for it. Rebuild the form whose normals are
recalculated, with three edge statuses per triangle, into a Mesh grouped
by face and styled by each face's line attribute.
The walk (tess/compressed.rs) takes a seed, then one apex per triangle,
from a reference or the next point in the frame of the edge it continues
across (WD 7.8.9.2), with the WD 12.3 Length, Unitize and MakeOrthoRep
arithmetic bit for bit. Arrays that do not fit, or an edge shared by more
than two triangles, leave the tessellation Compressed. Every triangle,
style and face range is charged to the element allowance first.
Stored-normals meshes, the one-status-per-triangle form, the planar bend
check, the best-fit search and partial salvage are later PRs.
Adapted from pdfcer (MIT, same author) at 0a249a73.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: charge rebuilt compressed meshes after they fit; model_render test
The rebuilt triangles, their styles and the face ranges are now charged
to the element allowance once the arrays fit and before the face ranges
are made. Arrays the walk cannot fit stay Compressed and spend nothing,
so they no longer fail the file over a face count they never use.
Tests:
- a_rebuilt_compressed_mesh_is_charged_its_triangles_and_faces pins the
exact charge (4 triangles x 3 elements + 2 faces);
- arrays_that_do_not_fit_spend_no_triangles_or_faces;
- rebuilt_triangles_are_grouped_by_face_with_their_styles, a direct
by_face test with out-of-order faces, empty faces and styles;
- model_render's a_compressed_prc_model_is_rebuilt_and_drawn, end to end
from a PDF, cited in misc.3d-view; its hex fixture is the prc-render
builder's output, kept so by the_automation_fixture_is_the_compressed_triangle.
The walk's working tables are documented as bounded by the triangle
count rather than charged. The module docs now say the arithmetic
matches the WD pseudocode as read and that the traversal rules are
inferred, not WD text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: charge compressed styles and face ranges before making them
A rebuilt compressed mesh's per-triangle styles were built before the
budget was charged, and also when the normals were stored and the mesh
was read past. The face attributes are now kept as read, and the styles
are built only for a rebuilt mesh, after the charge.
Each face range is a Range<usize>, two budget elements on 64-bit
targets, so it is charged at its size, not as one element.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: bound the compressed rebuild walk by the allowance left
The walk's vertices, triangles, edge counts, edge log and stack were
allocated before anything was charged, and could hold several times the
decoded arrays. The walk now gets the elements the reader has left and
stops once its arrays, by length, would hold more; the tessellation then
stays compressed, as when its arrays do not fit the walk.
A face whose line attribute is 0 but whose behaviour is not now styles
its triangles, so the behaviour bits are kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: say the rebuild walk is bounded by the allowance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* prc: cap the rebuild walk's first reservation by its limit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(render): an RGB colour in an isolated DeviceCMYK group blends in CMYK, as its ink
Part of #4887. An isolated DeviceCMYK group blended in CMYK only when every
colour in it had process tints (DeviceCMYK, DeviceGray); one RGB fill sent
the whole group back to RGB blending.
Vendored hayro-interpret patch (104): Color::ink_tints gives DeviceRGB,
CalRGB, Lab and three-component ICCBased colours the ink that draws back to
them through the bundled CMYK profile (new cmyk_inverse module: black
0.4*k0^2 + 0.6*k0^8 with k0 = 1 - max(r, g, b), matched to Acrobat on
synthetic pages; then cyan, magenta and yellow by at most 12 Newton steps
against the profile; one-entry per-thread cache). ICCBased CMYK still has no
tints.
Test an_rgb_colour_in_an_isolated_cmyk_group_blends_as_its_ink: 50% grey
under Difference with black within 10 levels of Acrobat's 137 112 106;
in-gamut colours draw as themselves; red within 8 of Acrobat's 238 32 37.
With the additive arms reverted the grey draws 93 97 96 and it fails.
#5228's control now uses an RGB image, which still has no tints.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(render): an RGB colour with a non-finite component has no CMYK ink
`to_rgba` turns a non-finite component into some finite colour, so the
inverse could not see it and gave that colour's ink. `ink_from_srgb` now
declines such a colour and the group draws it as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A whole-unit nudge measured in the larger unit could exceed a step of the last unit (1 km - 0.9 mm showed as 1 km 0 m). A compound Y in units other than X's was relabelled with X's unit and lost its CYX when written back.
Scale::read refused number format arrays of more than one unit (feet and inches) and the /F, /T formats, so measuring inside an Acrobat-calibrated viewport failed and such saved measurements were listed as unsupported. Read them into Scale::formats, label readings with them (whole units, then the rest as decimals, a fraction, rounded or cut off; a last unit that rounds up carries) and write them back when a measurement is added with that scale. Single-unit decimal scales read and label exactly as before.
* Print: app-managed colour converts printed pictures into a printer profile (#6269)
doc_print takes color_management (printer, the default, or app). With app,
color_profile (an ICC file or an installed profile's name), rendering_intent
and black_point_compensation convert each rendered page picture from sRGB
into the printer's RGB or grey profile before it is sent. app prints the
pages as pictures; CMYK and non-destination profiles are refused.
print_color_profiles lists the installed RGB and grey profiles.
The conversion is craft-cms at craft-print's rev, in pdfcraft_print::colour,
hooked into print_raster::rasterize. Raster carries the colour and is Clone
rather than Copy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Print colour: look for installed profiles inside the read root when confined
With automation roots, print_color_profiles and doc_print's color_profile
name lookup read the system's colour folders, outside the roots. They now
look in the read root instead (as text_font_files does), check each file
against it before reading it, and are refused without read authority.
Under --root they look in the root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* automation: keep colour profile discovery inside --root, links followed
Under --root alone, print_color_profiles and the color_profile name
lookup listed the root's .icc files without checking each against the
root, so a link inside it could read a profile outside. Each discovered
file now goes through the same --root resolution as any other read
(links followed) before it is opened.
colour_profile_links_out_of_the_root_are_not_read makes such a link and
checks it is neither listed nor found by name; it fails without the
check (the link is listed).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* print: as_chunks for the grey fill; area print keeps managed colour
Clippy 1.99 (`chunks_exact_to_as_chunks`) flags the constant-width
`chunks_exact_mut(4)` in the grey conversion; use `as_chunks_mut::<4>()`.
main's print-area path built `Raster` without the new `colour` field;
build it through `PrintDraft::raster()` so a printed area is colour
managed like a printed page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Lock craft-cms at the craft-libs commit craft-print now uses
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(print): read only regular files as printer profiles, and no more than the cap
A FIFO or device named `.icc`/`.icm` in a profile folder was listed and
read, and opening a FIFO for reading waits for a writer. The listing now
keeps regular files only (links followed), `PrinterProfile::read` refuses
anything else before opening it, and the read goes through a limit one
byte past `MAX_PROFILE_BYTES`, so a file that grew after it was measured
is refused rather than read whole.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: KenM76 <KenM76>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
FlexArrayIter::next::<T> stepped over a lone-sign slot before finding that
null is not a T, so a caller that then read the slot as another type got
the item after it. The slot is now passed only when null is a T, as a value
of another type is left in place. The sign-token tests also require the
lone-sign fixtures to parse and check raw_iter's null slots directly.
The three script-refusal tests built on reset_order_session save, run a
refused edit or script, save again and compare the bytes. Each save stamps
/ModDate from the system clock, so the comparison failed whenever the two
saves fell in different seconds. The helper now pins the session clock with
Session::with_clock, as session_with and the other byte-comparing tests do.
The fields of a document are kept with the state they were read from
(pdfcraft_cos::ReadState), and a document that still reads as that state
gets a copy instead of a new walk. One value edit read them four times
on an AcroForm (fill, recalculate, refresh, display) and seven on a
laid-out XFA form (plus the data sync twice and the scripts), mostly with
nothing changed in between; it now walks them once, and twice on an XFA
form (once more after its data is written).
* fix(flatpak): allow release checks and self-update helpers
* test: keep Flatpak permission parsing within strict Clippy rules
* chore: bump version to 0.21.1 for the Flatpak update fix
Dylan M. Taylor
FredApps
FredApps
Richard Buschbeck
asadosteaksnlandasadosteaksnl
mtlcl410andClaude Opus 5.5
jonathanwxh-cell