Native menu test: judge idle frames while the global generations hold still

key_equivalents_run_through_the_normal_shortcut_path_once failed about one
full ui-egui run in four ("the menus weren't read again", 5 vs 4). Each
app mirrors its shortcut overrides into a process-wide store every frame,
bumping shortcut_editor::GENERATION, and the plug-in registry's revision is
process-wide too. Tests running alongside with other shortcuts flip them,
which rightly makes the menus read again. The test now checks two idle
frames during which those generations held still (trying up to 50 times),
so it still fails if idle frames re-read the menus on their own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/affinity-corpus.yml

@@ -0,0 +1,37 @@
+name: Affinity 3 corpus
+
+on:
+  push:
+    branches: [main]
+    paths: ["crates/**", "xtask/**", "Cargo.toml", "Cargo.lock", ".github/workflows/affinity-corpus.yml"]
+  pull_request:
+    paths: ["crates/**", "xtask/**", "Cargo.toml", "Cargo.lock", ".github/workflows/affinity-corpus.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: affinity-corpus-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  affinity3:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      AFFINITY_CORPUS_REQUIRED: "1"
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.95"
+      - name: Fetch pinned and checksum-verified corpus
+        run: cargo xtask corpus --affinity
+      - name: Parse every file and freeze actual Affinity 3 feature retention
+        run: cargo test -p vectorcraft-affinity --all-features -- --nocapture
+      - name: Check every artboard, native save, SVG, PDF and PSD exports
+        run: cargo test -p vectorcraft-engine --test affinity_artboards --test affinity_text --test affinity_corpus -- --nocapture

.github/workflows/packaging-lint.yml

@@ -46,7 +46,7 @@ jobs:
           }
       - name: XML, desktop entry, AppStream, Flatpak manifest
         run: |
-          xmllint --noout packaging/windows/vectorcraft.wxs packaging/macos/*.plist* packaging/linux/*.xml*
+          xmllint --noout packaging/windows/vectorcraft.wxs packaging/windows/vectorcraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
           # Windows Installer needs Icon ids ending in .ico or .exe, or shortcuts show a blank icon.
           if grep -oE '<Icon Id="[^"]*"' packaging/windows/vectorcraft.wxs | grep -vE '\.(ico|exe)"$'; then
             echo "::error::Icon Id must end in .ico or .exe"; exit 1

.github/workflows/release.yml

@@ -150,7 +150,9 @@ jobs:
         run: cargo xtask version set "$VECTORCRAFT_VERSION"
       - name: Install WiX
         shell: pwsh
-        run: dotnet tool install --global wix --version 5.0.2
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build, sign, package
         shell: pwsh
         env:

.github/workflows/windows-arm64.yml

@@ -45,7 +45,9 @@ jobs:
           key: windows-arm64-package
       - name: Install WiX
         shell: pwsh
-        run: dotnet tool install --global wix --version 5.0.2
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build and package (unsigned)
         shell: pwsh
         env:

Cargo.lock

@@ -4341,6 +4341,7 @@ version = "0.7.0"
 dependencies = [
  "crc32fast",
  "flate2",
+ "image",
  "proptest",
  "ruzstd",
 ]

README.md

@@ -190,7 +190,7 @@ For the experimental, unsupported 64-bit Windows 7 build, see [Windows 7 instruc
 VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) covers what ships today, the
 milestones, and honest time-to-parity estimates.
 
-**Where we are (2026-10-07):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
+**Where we are (2026-10-09):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
 files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package).
@@ -198,9 +198,11 @@ Affinity documents (`.af` from Affinity 3, `.afdesign`, `.afpub` and, by their c
 and place natively: layers, groups, artboards and pages, curves and shapes, fills, gradients and strokes, clipping
 and masks, text and images, with what didn't come in (effects, adjustments, brushes, master pages…) listed in the
 import warning; a file whose native data can't be read opens as its embedded preview, saying why. VectorCraft
-doesn't write Affinity files. [Scope and limits](crates/affinity/README.md).
+doesn't write Affinity files. Current `.af` validation includes 33 pinned files, native save/reload
+and every-board SVG/PDF/PSD export, with fixes for Affinity 3 artboards, source-backed JPEGs and text runs.
+[Scope and limits](crates/affinity/README.md); [source audit and remaining gaps](docs/affinity-validation.md).
 The interface
-speaks English, Japanese, Traditional and Simplified Chinese, Spanish, French, Italian and Russian (and Czech and Brazilian Portuguese in the menus).
+speaks English, Japanese, Traditional and Simplified Chinese, Spanish, French, Italian, Russian and Ukrainian (and Czech and Brazilian Portuguese in the menus).
 The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.
 

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-09 (after placed documents (File › Place of a `.vectorcraft` file, linked), M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG windoLine truncated
+_Last updated: 2026-10-09 (after placed documents (File › Place of a `.vectorcraft` file, linked), M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG windoLine truncated
 
 ## Where we are
 
@@ -38,7 +38,7 @@ since 2026-10-01.
 | **Large missing subsystems** | 0–20% | 3D & Materials (0%), Photoshop-style raster effects and the Effect Gallery (~4 of ~56 filters), SVG Filters, CJK composition (vertical type with kinsoku, tate-chu-yoko and the font's vertical metrics; ruby, mojikumi and proportional vertical metrics open), Variables (data merge), scripting |
 | **Interaction fidelity:** modifiers, cursors, small behaviours | ~30–40% | The dedicated pass hasn't started, and there has been no side-by-side session with Illustrator yet. A power user notices this first |
 | **Look & feel** | ~75–80% | Measured against Illustrator 2026 screenshots (2026-10-02); the panels added since haven't been re-measured |
-| **File interop** | ~85% | SVG/SVGZ, PDF and PDF-compatible `.ai`, EPS, DXF, EMF/WMF, raster formats, PSD export, Place and Links, Package, Print, clipboard flavours. Affinity documents (Affinity 1–3) open natively as editable art, checked against Affinity's own thumbnails of 22 pinned public files; Affinity export is missing and effects, adjustments and brushes don't import. Affinity isn't an Illustrator feature, so this doesn't raise the parity score. The editing copy inside an Illustrator EPS or `.ai` is read for layers, hidden objects and hidden type (see Out of scope for what it doesn't read yet); DWG has no open spec |
+| **File interop** | ~85% | SVG/SVGZ, PDF and PDF-compatible `.ai`, EPS, DXF, EMF/WMF, raster formats, PSD export, Place and Links, Package, Print, clipboard flavours. Affinity documents (Affinity 1–3) open natively as editable art, checked against 51 pinned public files (33 current `.af`), with selected saved-thumbnail comparisons and every-board native/SVG/PDF/PSD checks for current files; Affinity export is missing and effects, adjustments and brushes don't import. Affinity isn't an Illustrator feature, so this doesn't raise the parity score. The editing copy inside an Illustrator EPS or `.ai` is read for its structure: layers, groups, names, hidden objects and type, colours, gradients, transparency, images and every artboard (see Out of scope for what it doesn't read yet); DWG has no open spec |
 | **Bundled content:** brush, symbol, style and swatch libraries | ~30% | Ours are original and generated in code, and far fewer than Illustrator ships; brush and symbol libraries are still missing |
 | **Performance** | unverified | Multithreaded, off-thread rendering and caches are in place. The last budget run (2026-10-01, loaded machine) measured 290 ms for a 50k-path fit against a 16 ms budget. Re-run `vectorcraft-cli perf` on an idle machine |
 | **Robustness** | good, new | ~2,840 tests, property tests, no panics in shipped code (lints, the `guard` safety net, import fuzzing), Data Recovery. Missing: a corpus of real-world files, Windows/Linux/browser QA |
@@ -74,8 +74,8 @@ Ordered by how much each gap blocks someone from switching. Sizes are one-agent
 7. **Views and windows:** multiple windows and arrange, Consolidate All Windows, video
    rulers. 15–25 h.
 8. **Hardening at scale:** a corpus of real-world SVG/PDF/EPS files, Affinity files from more versions and platforms
-   (the native reader is checked against 22 public files' own thumbnails; synthetic one-feature oracles saved by
-   Affinity itself are still missing), idle-machine perf budgets, Windows, Linux and
+   (51 pinned files now include 28 original Affinity 3.2.3 feature probes; large interacting documents,
+   complex typography and independently paired `.af`/PSD renders reopened in Affinity remain missing), idle-machine perf budgets, Windows, Linux and
    browser QA, pen tablets on Wayland and pen pressure beyond Windows (winit 0.31's tablet input, #491), accessibility, packaging. 50–80 h.
 
 ### Where we're going
@@ -107,7 +107,7 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - Tool flyouts tear off: dragging or clicking the tear-off bar on a flyout's right side (or releasing the long press over it) floats its group as a strip of tool buttons, moved by the same bar and put back in the toolbar by the × at its top (`window.floatTools`). While a group floats, the presses that would open its flyout raise the strip instead. Floating strips are kept with the preferences and in user workspaces. Not done: turning a strip vertical, docking it.
   - Panels undock (#495): a dock tab, a panel icon or a popped-out panel's title dragged out of the dock floats that panel inside the window, and the strip right of the dock's tabs floats the whole tabbed group. A floating group moves by its title bar, a tab dragged out of it floats on its own, and dropped on another group's title bar or tabs it stacks with that group; dropped on the dock, which lights up under the pointer, its panels go back where they live (the tabbed group or the icon column), as its × and the panel menus' Float Panel / Dock Panel do (`window.panel.float`, `window.panel.dock`). The Tools panel floats by its title bar and docks again on the window's left edge. Floating panels and the Tools panel's position are kept with the preferences and in user workspaces, and clamped into a smaller window. Not done: panels in separate OS windows, docking a panel into a dock group it doesn't belong to, reordering tabs by dragging, collapsing a floating group to icons, resizing floating panels.
   - The dock's double arrow collapses Properties, Layers and Libraries to icons at the top of the icon column, popping out like the other icon panels, and expands them again (`window.collapseDock`, kept with the preferences and in saved workspaces). The icon column's own arrow (expanding the icon panels into a full column) is not done.
-  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish, French, Italian and Russian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
+  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish, French, Italian, Russian and Ukrainian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
   - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool. Native menus explicitly end tracking on command selection, outside window presses and Escape; menu updates wait until tracking ends, and a dismissing press never starts a canvas gesture (M14.8).
   - The macOS menu bar is built from the in-window menus (one model, `native_menu`) and laid out as a Mac app's: the VectorCraft menu holds About, Settings ▸ (each Preferences page, General… ⌘K), Language ▸, Appearance ▸ (UI brightness), Services, Hide VectorCraft ⌃⌘H (⌘H stays Hide Edges), Hide Others, Show All and Quit; Window gains Minimize ⌃⌘M, Zoom and Bring All to Front, and Help the system's search field. Its key equivalents go back to egui as key presses, so user shortcuts, focused text fields and the Type tool's input method behave as in the window, and nothing fires twice; enabled, check marks and labels update in place. `--in-window-menus` or `VECTORCRAFT_IN_WINDOW_MENUS=1` keeps the menus in the window; `ui.inspect` reports `nativeMenuBar`.
   - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats. The DMG opens on a designed Finder window, VectorCraft.app beside the `Applications` link over a background with the app icon (#493).
@@ -126,7 +126,7 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - **Shaper:** uneven squares and rectangles become live rectangles even when drawing begins mid-edge. Recognition uses uniformly spaced samples and closed-loop corners, fits rectangle edges/angles rather than requiring a nearly perfect bounding-box fill, and includes the pointer-release position. Rectangles/squares and ellipses snap to 45° steps, hexagons to 90°, and triangles point up or down; lines keep their free angle even with Shift. Shaper Groups retain the live originals, merge regions with the gesture-origin fill, punch fills independently from strokes, remove boundaries on exiting scribbles and trim protruding stroke pieces. Source moves/resizes re-evaluate the result in the same undo step; double-click enters construction editing. Native save/reopen, face recoloring, Release and Expand are covered. The construction-mode widget and finer gesture heuristics remain.
   - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso. A Shift-drag marquee toggles what it reaches: objects with the Selection tool, anchors with Direct and Group Selection (#483); the Lasso adds with Shift and subtracts with Alt. Dragging a path segment with Direct Selection bends it when it's curved (its anchors stay) and moves its two anchors when it's straight, one undo step; the fill, Shift or Alt still pick the whole path (Alt-drag copies it).
   - **Saved selections:** Select ▸ Save Selection… asks for a name and keeps the selection in the document (saved with the file, undoable, up to 25); each one is listed at the bottom of the Select menu and a click selects its objects again; Edit Selection… lists them to rename or delete, applied together on OK. A file's saved selections are capped and checked against its objects when it opens. Not yet: Update Selection and the Layers panel's saved-selection menu.
-  - **Drawing:** Pen, Curvature, anchor tools, Pencil, Paintbrush, Blob Brush, Smooth, Path Eraser, Join. Direction handles dragged with Direct Selection or the Anchor Point tool snap to smart guides, and Shift keeps them at 45° steps from their anchor. Every point a drawing tool places snaps to Smart Guides through one snapper (#506): the Pen's and Curvature tool's anchors, the Pencil's ends, the shape tools' start and dragged corner or radius (Rectangle, Rounded Rectangle, Ellipse, Polygon, Star, Line Segment, Arc, Spiral, the grids), the Type tool's click and frame, a new artboard's corners.
+  - **Drawing:** Pen, Curvature, anchor tools, Pencil, Paintbrush, Blob Brush, Smooth, Path Eraser, Join. Direction handles dragged with Direct Selection or the Anchor Point tool snap to smart guides, and Shift keeps them at 45° steps from their anchor. The Pen continues any open path from the end clicked, and while drawing, a click on an end of another open path joins the two into one (#776). Every point a drawing tool places snaps to Smart Guides through one snapper (#506): the Pen's and Curvature tool's anchors, the Pencil's ends, the shape tools' start and dragged corner or radius (Rectangle, Rounded Rectangle, Ellipse, Polygon, Star, Line Segment, Arc, Spiral, the grids), the Type tool's click and frame, a new artboard's corners.
   - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers).
   - **Cutting:** Eraser, Scissors, Knife, Mirror & Cut, Line Cut and Rectangle Cut (real geometry, compound paths keep their holes).
   - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres; Alt-click opens the tool's dialog, and a drag with Alt down at the release, from the press or pressed mid-drag, transforms a copy), Reshape, Free Transform (free and perspective distort and shear, switched by the keys held during a handle drag).
@@ -134,22 +134,22 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. A press on the first anchor of the path being drawn closes it whatever the drag then does: the drag shapes the closing curve (symmetric handles, Alt breaks them) and the release closes the path wherever it ends (#501). Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead. Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as the Anchor Point tool, with its convert cursor: dragging a handle moves it alone, clicking a smooth anchor makes it a corner, dragging an anchor pulls out new symmetric handles, dragging a segment reshapes it; drawing then goes on. Cmd (Ctrl) held drags with the selection tool chosen last, Direct Selection until one is (handles, anchors and segments of the path being drawn or another), and the Pen then goes on drawing its path while that stays selected; the pointer shows that tool's while Cmd is held. The same holds for agents (`pointer_gesture` with `mods.cmd`), as the borrowing now lives in the engine (#494).
   - **Path editing (#494):** the handles shown are the handles that drag: Direct Selection drags those of a path selected as a whole (as the Pen leaves it), the Anchor Point tool and Pen+Alt no longer grab handles that Show handles when multiple anchors are selected hides, a handle shorter than the tolerance leaves its anchor to be picked, and the anchor tools pick within Selection & Anchor Display › Tolerance. A dragged segment keeps a smooth anchor at either end smooth. With Direct Selection, the Pen, the Curvature and the anchor tools, a path selected as a whole shows all its anchors selected, and the Control bar and the Properties panel offer Convert (corner, smooth) for them too; Remove and Cut wait for anchors direct-selected (#504). A handle drag gathers its snap targets once per drag (it took 21 ms per pointer move on a 20,000-path document, now 1 ms; `vectorcraft-cli perf` measures handle and segment drags on a 5,000-anchor path).
   - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type.
-  - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446; Object › Artboards › Rearrange All Artboards lays them out in a grid by row or by column, in one row or one column, left to right or right to left, from the menu, the Artboards panel or Properties' Rearrange All, #681), Measure, Type, Hand, Zoom, Rotate View.
+  - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446; Object › Artboards › Rearrange All Artboards lays them out in a grid by row or by column, in one row or one column, left to right or right to left, from the menu, the Artboards panel or Properties' Rearrange All, #681; Scale Artwork with Artboard, in the Control bar and Properties beside Move Artwork with Artboard, resizes the artboard proportionally with the art fully inside it and its guides, strokes and corners per the Scale preferences, #602), Measure, Type, Hand, Zoom, Rotate View.
   - **Editing type:** double-clicking type with a selection tool switches to the Type tool with the caret where it was clicked.
   - **Temporary tools:** Cmd with any other tool drags with the selection tool used last (Selection, Direct Selection or Group Selection). Held Space pans and Cmd+Space zooms (Cmd+Alt+Space out) whatever the tool.
   - **Panel drag and drop:** art dragged off the canvas onto the Symbols panel becomes a symbol, onto the Swatches panel a pattern swatch and onto the Brushes panel an Art brush; a symbol dragged onto the canvas places an instance where it is dropped, and a brush dragged onto a path is applied to it.
   - **Tool double-clicks:** double-clicking a tool's button opens its options: Hand fits the artboard in the window, Zoom shows 100 %, Rotate, Scale, Reflect and Shear open their Object › Transform dialogs, the Selection, Direct Selection and Group Selection tools the Move dialog (Enter opens these seven tools' dialogs too), Gradient, Eyedropper, Blend and the Liquify tools their panels or options, and the Pencil, Paintbrush, Smooth, Blob Brush and Eraser tools their Tool Options (Fidelity, fill, the tolerances, the brush size).
 - **Layers panel:** every layer, sublayer, group and object is a clickable row at any depth: a click highlights it and makes its layer current (new art goes there), Shift-click a range, Ctrl/Cmd-click toggles. Sublayers are no longer treated as objects: clicks, marquees, Select All and the Select menu take the art inside them, and each sublayer selects in its own colour. Selection squares on rows with selected art (click selects a row's art, Shift adds or removes; dragging the square moves the selection to another row, Alt copies), the eye and lock on every row with drag-down-the-column (one undo step), Ctrl/Cmd-click an eye for per-layer Outline, Alt-click an eye or lock to hide or lock the other layers (again: show or unlock them all), triangles with Alt to open or close everything inside, drag and drop rows above, below or into layers and groups with a drop line (Alt copies) and a dimmed copy of the row under the pointer (dropped on the trash rows are deleted, on New Layer duplicated, as in Illustrator), inline rename, Delete key on highlighted rows. Buttons and the full panel menu: New Layer/Sublayer (Alt: options, Ctrl: on top), Duplicate, Delete, Options for Selection, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New Layer, Release to Layers (Sequence and Build), Reverse Order, Template, Hide/Outline/Lock Others and Show/Preview/Unlock All, Paste Remembers Layers, Panel Options (row size, thumbnails per kind, Show Layers Only). Layer Options: name, colour (presets, each with a chip of its colour, or custom), Template, Lock, Show, Print, Preview (outline drawing and clicking) and Dim Images to %. Every operation is a command (`layer.move`, `layer.highlight`, `layer.merge`…) with validation against cycles and invalid nesting. A document opens with only its top-level layers open; the rows left open are saved in the native file (nothing is written for the default) and reopen that way. Only the rows scrolled into view are laid out, from a row list made once per change: a layer of 5,000 groups of 10 paths, all open, draws the panel in 0.4 ms a frame instead of about 29 s (#638).
-- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles with the Selection or Free Transform tool, Shift and Alt too: the dragged corner or side lands on the other objects' anchors and centres ("anchor", "center") or lines up with their edges and centres (a line and "align"); with Smart Guides › Spacing Guides, a moved selection that lines up with nothing along an axis lands as far from its neighbour as two other objects of its row or column are apart, or halfway between its two neighbours, the equal gaps marked; the Rotate, Scale, Shear and Reflect tools drag from the anchor they grab and snap the pointer the same way, so a corner dragged onto another object's anchor scales exactly onto it, #482; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H; drawn points, #506: hovering shows where the press goes, the point lands on the other objects' anchors, centres and paths ("anchor", "center", "path") or lines up with their anchors, edges and centres ("align"), the Pen's on the path being drawn too, near a construction guide through the anchor before it on that guide (Preferences › Smart Guides › Construction Guides and Angles), and with Shift kept to its 45° step or a square's diagonal it slides along that way into line; the targets are gathered once per document state, from the art in the window, and the anchors, centres and lines near the pointer are found by bisection, so hovering never rescans the document), guides dragged out of the rulers (#451: they snap as moved guides do, Shift to the ruler's ticks; with the Artboard tool they are artboard guides, which run across their artboard only and move, copy and delete with it, `guide.add {artboard}`) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the edges, centres (so the sides' midpoints) and anchors of the art and the artboards, or with Smart Guides off Snap to Point pulls it onto anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), a right-click on either ruler or the origin box to pick the document's units (the current one checked; `document.setUnits`, one undo step, #528), and Draw Normal / Behind / Inside modes.
+- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles with the Selection or Free Transform tool, Shift and Alt too: the dragged corner or side lands on the other objects' anchors and centres ("anchor", "center") or lines up with their edges and centres (a line and "align"); with Smart Guides › Spacing Guides, a moved selection that lines up with nothing along an axis lands as far from its neighbour as two other objects of its row or column are apart, or halfway between its two neighbours, the equal gaps marked; with View › Snap to Grid on, a moved selection lands on the grid instead, by whichever of its edges or its centre is nearest a gridline on each axis, #740; the Rotate, Scale, Shear and Reflect tools drag from the anchor they grab and snap the pointer the same way, so a corner dragged onto another object's anchor scales exactly onto it, #482; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H; drawn points, #506: hovering shows where the press goes, the point lands on the other objects' anchors, centres and paths ("anchor", "center", "path") or lines up with their anchors, edges and centres ("align"), the Pen's on the path being drawn too, near a construction guide through the anchor before it on that guide (Preferences › Smart Guides › Construction Guides and Angles), and with Shift kept to its 45° step or a square's diagonal it slides along that way into line; the targets are gathered once per document state, from the art in the window, and the anchors, centres and lines near the pointer are found by bisection, so hovering never rescans the document), guides dragged out of the rulers (#451: they snap as moved guides do, Shift to the ruler's ticks; with the Artboard tool they are artboard guides, which run across their artboard only and move, copy and delete with it, `guide.add {artboard}`) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the edges, centres (so the sides' midpoints) and anchors of the art and the artboards, or with Smart Guides off Snap to Point pulls it onto anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), a right-click on either ruler or the origin box to pick the document's units (the current one checked; `document.setUnits`, one undo step, #528), and Draw Normal / Behind / Inside modes.
 - **Views:** the status bar's artboard navigator (first, previous, next, last; `view.goToArtboard`) goes to an artboard and fits it, and Fit Artboard in Window and Actual Size show the navigator's artboard. The Artboards panel highlights that active artboard: clicking a row makes it active (the Artboard tool's too, while it is chosen) as does clicking an artboard with the Artboard tool, double-clicking its number also fits it in the window and double-clicking its name renames it. Duplicate Artboards, or a row dragged onto New Artboard, copies the artboard with its art (#446). Escape leaves Presentation Mode, F from it goes back to Normal Screen Mode, and the screen mode isn't saved with the preferences: the app always starts in Normal Screen Mode with its menus and panels (#472). View › Pixel Preview shows the art as the document pixels it rasterizes to, one per point and hard-edged when magnified, turning with a rotated view (it used to draw the smooth vectors, with only the pixel grid over them).
 - **Geometry and effects:**
   - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected. With anchors selected, the Control bar and the Properties panel also convert them to corner or smooth (`path.convertAnchors`), connect end points (Join) and cut the path at them (`path.cutAtAnchors`, also on the task bar and the context menu): a closed path opens there and an open one becomes one path per piece, each cut leaving one of its two coincident anchors selected so a drag pulls the path apart.
   - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
-- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), paragraph attributes per paragraph (alignment, indents, spacing, hyphenation, hanging punctuation, tab stops, paragraph style, direction, mojikumi and leading model; the Paragraph, Tabs and Paragraph Styles panels act on the paragraphs the Type tool's selection or caret touches, Return continues the paragraph's style, threads and SVG keep them), Area Type Options (rows/columns/inset/first baseline, vertical Align Top/Center/Bottom/Justify per row/column, reflowing non-rectangular frames and text wrap), threaded text across any closed shapes, Fit Headline, the Every-line Composer for justified and ragged text (paragraph-wide breaks for an even rag, Single-line per object from the Paragraph panel menu or `text.setFormat {composer}`). Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. Auto Size: the frame height follows the text after every edit, in the same undo step (rectangular frames of horizontal type in one row; columns get the least height that holds them; a height set by hand or threading turns it off), and the "Auto Size New Area Type" preference gives it to new area type. Shrink Text to Fit (beyond Illustrator): overflowing area type scales its sizes, leading and baseline shifts down by the largest factor (in 0.1 pt steps of the first run, down to a minimum percentage) that fits, at layout time so every export sees it. `text.areaOptions` and `document.inspect` report overflow and the shrink factor. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Beyond Illustrator: inline graphics (`text.insertInline`, Type ▸ Insert Inline Symbol) set a document symbol in a run of type as one character that flows, wraps and justifies like a glyph (InDesign-style inline objects, e.g. mana symbols in card rules text): sized to a multiple of the font size, centred on the cap height, opening up tall lines, following Redefine Symbol; a character of its run's size for Character Alignment and Top-to-Top leading, placed by the bidi reordering in right-to-left text (a neutral U+FFFC); drawn on the canvas, kept as live text plus a `<use>` in SVG and as vector art in PDF; Backspace removes it whole. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
-- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale), French (every `fr-*` locale), Italian (every `it-*` locale) and Russian (every `ru-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish, French, Italian and Russian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish, French, Italian and Russian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku applies to horizontal and vertical Japanese (Paragraph panel › Kinsoku Set, `text.setFormat {kinsoku}`: Hard, the default, keeps closing marks, iteration marks, the prolonged sound mark and small kana off the line start and opening brackets off its end; Soft lets 々, ー and small kana start a line as JLREQ's level 3 rules do; None turns it off), and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a line flush with its start (a paragraph's first line at its first-line indent, JIS X 4051's principle in JLREQ 3.1.5), and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline, the em box top/right, centre or bottom/left, or the ICF (ideographic character face) top/right or bottom/left, from the font's BASE table or, without one, the average ink box of some ideographs and kana; Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), paragraph attributes per paragraph (alignment, indents, spacing, hyphenation, hanging punctuation, tab stops, paragraph style, direction, mojikumi and leading model; the Paragraph, Tabs and Paragraph Styles panels act on the paragraphs the Type tool's selection or caret touches, Return continues the paragraph's style, threads and SVG keep them), Area Type Options (rows/columns/inset/first baseline, vertical Align Top/Center/Bottom/Justify per row/column, reflowing non-rectangular frames and text wrap), threaded text across any closed shapes, Fit Headline, the Every-line Composer for justified and ragged text (paragraph-wide breaks for an even rag, Single-line per object from the Paragraph panel menu or `text.setFormat {composer}`). Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. Auto Size: the frame height follows the text after every edit, in the same undo step (rectangular frames of horizontal type in one row; columns get the least height that holds them; a height set by hand or threading turns it off), and the "Auto Size New Area Type" preference gives it to new area type. Shrink Text to Fit (beyond Illustrator): overflowing area type scales its sizes, leading and baseline shifts down by the largest factor (in 0.1 pt steps of the first run, down to a minimum percentage) that fits, at layout time so every export sees it. `text.areaOptions` and `document.inspect` report overflow and the shrink factor. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Beyond Illustrator: inline graphics (`text.insertInline`, Type ▸ Insert Inline Symbol) set a document symbol in a run of type as one character that flows, wraps and justifies like a glyph (InDesign-style inline objects, e.g. mana symbols in card rules text): sized to a multiple of the font size, centred on the cap height, opening up tall lines, following Redefine Symbol; a character of its run's size for Character Alignment and Top-to-Top leading, placed by the bidi reordering in right-to-left text (a neutral U+FFFC); drawn on the canvas, kept as live text plus a `<use>` in SVG and as vector art in PDF; Backspace removes it whole. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458). Type › Bold and Italic (beyond Illustrator, as page layout apps have them; Cmd+Shift+B / Cmd+Shift+I while the Type tool edits text) switch the selected type to its family's own Bold or Italic face and back, keeping its width (a Narrow face stays Narrow); a family without that face says so (#724).
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale), French (every `fr-*` locale), Italian (every `it-*` locale) Russian (every `ru-*` locale) and Ukrainian (every `uk-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish, French, Italian, Russian and Ukrainian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish, French, Italian, Russian and Ukrainian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku applies to horizontal and vertical Japanese (Paragraph panel › Kinsoku Set, `text.setFormat {kinsoku}`: Hard, the default, keeps closing marks, iteration marks, the prolonged sound mark and small kana off the line start and opening brackets off its end; Soft lets 々, ー and small kana start a line as JLREQ's level 3 rules do; None turns it off), and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a line flush with its start (a paragraph's first line at its first-line indent, JIS X 4051's principle in JLREQ 3.1.5), and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline, the em box top/right, centre or bottom/left, or the ICF (ideographic character face) top/right or bottom/left, from the font's BASE table or, without one, the average ink box of some ideographs and kana; Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
 - **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
 - **Image Trace Flat Logo mode:** a fourth mode beside Black and White, Grayscale and Color, for flat-colour logos. Each pixel is read as a blend of the logo's colours (found automatically or named), the blend is interpolated smoothly and every outline is placed where two colours are equally present, so edges are accurate to a fraction of a pixel. Outlines are then cleaned: corners the blur rounded are put back, near-straight runs and near-circular arcs become exact lines and arcs, the rest is fitted with as few Béziers as the tolerance allows, touching colours overlap by a hair so no gap opens, and an outline that strays from the raw contour is fitted plainly instead. Gradients and photos are refused with advice to use Color. *Measured* (a local experiment, not run in CI): a flat-colour logo's vector original was rendered down to a soft 199 × 100 px transparent PNG, traced, and the result compared with the original at 1600 px wide. The built-in colour presets (6 Colors, 16 Colors, High Fidelity Photo, Low Fidelity Photo) had a mean edge error of 2.5 to 3.4 px and region overlap of 0.88 to 0.91; Flat Logo had 0.78 px and 0.966 (0.48 px and 0.975 from a crisp source), in about 0.1 s. Limits: flat-colour art only; needle-thin sharp tips are shortened by about 1.7 source pixels because the blur erases them; it works at no more than 1024 px on the long side (larger images are averaged down first); only one logo family has been scored against a vector original.
-- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets, colour layers traced in parallel; a trace past two million anchor points or an image over 64 megapixels is refused with advice rather than running out of memory, and a selection too large to outline shows its bounds (#525); Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image (`object.cropImage {trim: true}` cuts an image to its pixels that aren't fully transparent, pixel for pixel) and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), View, the Image Trace panel and Expand, plus Release in Properties; the five View modes (Tracing Result, with Outlines, Outlines, Outlines with Source Image, Source Image) redraw a trace on screen without tracing again, are saved with it and `imageTrace.setView` sets them, while exports and Expand keep the result; the panel's Advanced section is a header that stays open or closed as it was left (part of #641); Color mode's Palette: Limited, Full Tone (as many colours as the tones need, Less … More), Automatic (flat art with its own colours, else Full Tone; a heuristic) and Document Library (the most used colours of the document's swatches or a swatch library, filled with the swatch colours as they are), part of #641; Advanced › Create: Fills and/or Strokes, where lines up to the Stroke width trace as stroked centre lines (distance transform, thinning, a skeleton graph with spurs pruned, curve fitting; one width per line; without Fills, wider areas become stroked outlines), part of #641), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
+- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets, colour layers traced in parallel; a trace past two million anchor points or an image over 64 megapixels is refused with advice rather than running out of memory, and a selection too large to outline shows its bounds (#525); Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image (a crop box on the image, starting on its part over the artboard, dragged by its handles or inside it, the outside dimmed, with X/Y/W/H, Apply and Cancel in the Control bar, Enter and Escape, #734; `object.cropImage {rect}` for agents, `{trim: true}` cuts an image to its pixels that aren't fully transparent, pixel for pixel) and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), View, the Image Trace panel and Expand, plus Release in Properties; the five View modes (Tracing Result, with Outlines, Outlines, Outlines with Source Image, Source Image) redraw a trace on screen without tracing again, are saved with it and `imageTrace.setView` sets them, while exports and Expand keep the result; the panel's Advanced section is a header that stays open or closed as it was left (part of #641); Color mode's Palette: Limited, Full Tone (as many colours as the tones need, Less … More), Automatic (flat art with its own colours, else Full Tone; a heuristic) and Document Library (the most used colours of the document's swatches or a swatch library, filled with the swatch colours as they are), part of #641; Advanced › Create: Fills and/or Strokes, where lines up to the Stroke width trace as stroked centre lines (distance transform, thinning, a skeleton graph with spurs pruned, curve fitting; one width per line; without Fills, wider areas become stroked outlines), part of #641), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
 - **Paint and appearance (M3):**
   - **Swatches:** names follow the colour model and are unique; Swatch Options (process/spot, Global, Gray/RGB/HSB/CMYK/Web, live preview); editing a global or spot swatch recolours every linked fill, stroke and text run in one undo step; multi-select and delete with confirmation; New Swatch and New Color Group dialogs (a group from the selected artwork's colours); swatches in colour groups convert, separate and count like any other. The Swatches panel selects ranges and whole groups, has a find field, and drags swatches to reorder, regroup or paint art; Add Used Colors, Select All Unused, Merge, Ungroup and Sort by Kind; a CMYK document keeps applied colours in CMYK. Swatch libraries: nine generated colour libraries and five gradient libraries in a library panel, saved as `.vcswatches`, `.gpl` or CSS, and loaded from `.vcswatches`, `.gpl` and swatch exchange (`.ase`) files (RGB, CMYK, Lab and Gray; global, spot and process; groups). Tints of global and spot colours ("Name 40%") stay linked and separate as a percentage of their plate. Spot colours can be defined in Lab (Spot Colors options). A built-in [Registration] swatch prints on every plate.
   - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers (the Properties panel has the Control bar's Fill and Stroke chips, Stroke link and weight spinner, with nothing selected too), panels have Illustrator's Window menu keys (Align Shift+F7, Transform Shift+F8, Pathfinder Cmd+Shift+F9, Layers F7, Character Cmd+T…; every panel can be given one in Edit › Keyboard Shortcuts), and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). An ICC CMYK profile converts straight into the RGB working space (not through sRGB, so a wider space such as Wide Gamut RGB keeps colours sRGB can't hold) with the colour settings' black-point compensation, on the canvas and in RGB exports alike. Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
@@ -165,8 +165,8 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **Files (M4):**
   - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export. The desktop app writes its warnings and errors (graphics adapter, a lost graphics device, panics the guard recovered from) to standard error and to `logs/vectorcraft.log` next to the preferences, the two previous runs kept and each file capped at 16 MiB, so a launch without a terminal still leaves something to attach to a bug report (#465).
   - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420; hidden objects written hidden on Save and `convert`, and `data-*` attributes kept as the objects' own data: #522; top-level groups open as layers named from `data-name`, else the id, also when one more group (a transform on all the art, a `<switch>`) wraps them, hidden ones hidden, and a file whose art sits loose under a root `<svg>` with an id (or `data-name`), as one-layer exports write it, opens with its one layer named from it; nested groups stay groups, except the sublayers VectorCraft writes, marked `data-vc-layer`, and Inkscape sublayers, which open as sublayers in their layer's colour: #372); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320). A masked CMYK image (`/SMask`, `/Mask` or a colour key) keeps its inks too, its alpha coming in as a greyscale opacity mask.
-  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
-  - Affinity documents in (AF.1–AF.3): `.af` (Affinity 3) and `.afdesign`/`.afphoto`/`.afpub` (Affinity 1 and 2, container versions 8–12) open and place as editable art: layers and sublayers, groups (pass-through or isolated), artboards (with their names and backgrounds) and Publisher pages side by side, curves with live corners, parametric shapes (rectangles with corner radii, ellipses, polygons, stars, pies, triangles, trapezoids), compound shapes, solid/linear/elliptical gradient fills and strokes (weight, dashes, alignment, scale-with-object), clipping by nesting, vector and pixel masks, artistic and frame text with fonts, sizes, tracking, leading and alignment, placed images (their original JPEG/PNG) and pixel layers (8/16-bit RGB, CMYK), opacity, visibility, locking and blend modes, at the document's resolution in points. Effects, adjustments, brushes and pressure profiles, transparency gradients, master pages, symbol instances (imported as their cached picture), special shapes (cloud, heart, cog…, imported as ellipses) and Affinity-only blend modes are named in the import warning. A file whose native data can't be read opens as its embedded preview with the reason, and that preview can't be placed. Save never writes back over the Affinity file and there is no Affinity export. 22 public CC0/MIT/Apache-2.0 files, pinned and sha256-verified (`cargo xtask corpus --affinity`), must render within a few levels of the thumbnails Affinity saved in them; [scope, provenance and limits](crates/affinity/README.md).
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). PDF export writes type as real, searchable text in embedded subset fonts by default, as Illustrator's PDF presets do (Convert Text to Outlines is an option; printer's marks stay shapes), so text-heavy PDFs stay small (#733). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
+  - Affinity documents in (AF.1–AF.4): `.af` (Affinity 3) and `.afdesign`/`.afphoto`/`.afpub` (Affinity 1 and 2, container versions 8–12) open and place as editable art: layers and sublayers, groups (pass-through or isolated), artboards (with their names and backgrounds) and Publisher pages side by side, curves with live corners, parametric shapes (rectangles with corner radii, ellipses, polygons, stars, pies, triangles, trapezoids), compound shapes, solid/linear/elliptical gradient fills and strokes (weight, dashes, alignment, scale-with-object), clipping by nesting, vector and pixel masks, artistic and frame text with fonts, sizes, tracking, leading and alignment, placed images (their original JPEG/PNG) and pixel layers (8/16-bit RGB, CMYK), opacity, visibility, locking and blend modes, at the document's resolution in points. Effects, adjustments, brushes and pressure profiles, transparency gradients, master pages, symbol instances (imported as their cached picture), special shapes (cloud, heart, cog…, imported as ellipses) and Affinity-only blend modes are named in the import warning. A file whose native data can't be read opens as its embedded preview with the reason, and that preview can't be placed. Save never writes back over the Affinity file and there is no Affinity export. AF.4 adds Affinity 3 artboard recognition and actual-outline clipping, source-backed JPEG/PNG raster tiles, Unicode text-run recovery, stored fallback/exact installed fonts, OpenType feature flags and compound-geometry limits. 51 public CC0/MIT/Apache-2.0 files (33 current `.af`), pinned and sha256-verified (`cargo xtask corpus --affinity`), test native retention and every-board native/SVG/PDF/PSD output for current files; selected files compare their saved thumbnails. No Affinity reopen or independent paired PSD oracle was available; [source audit and complex-font gaps](docs/affinity-validation.md); [scope, provenance and limits](crates/affinity/README.md).
   - Placed documents: File › Place of a `.vectorcraft` file links to it by default (`file.place`'s `link`): one locked object showing an artboard of the document (or its art's bounds), read the way placing it without Link reads it, its symbols, patterns and images kept apart from the document's; without Link (or from bytes, not a file) it is an editable copy as before. It stays vectors in every output (SVG, PDF, EPS, EMF, DXF), and so do placed documents inside it, read from their own files up to 8 levels deep (documents that place each other stop there). On screen they draw from bitmaps cached per file and zoom step, shared by every copy and made in the background (a placeholder until ready), so a sheet of them redraws in about a millisecond; exports and prints draw them exactly. Like linked images, a save keeps only a preview of each (JPEG when opaque) unless Include Linked Files; output, and zooming past the preview, read the file again, falling back to the preview with a warning when it is gone or changed. Saves for older versions write them as plain art. Links check, update, relink, Update Links on open, Link Info (the artboard's size), Placement Options, Break Link (also Embed, Object › Expand: the editable copy placing without Link gives, its resources joining the document), Edit Original (the document in a new tab) and the Links panel cover them; saving a document updates the open documents that place it. The native format (v4) keeps data of 8 KB or more after the JSON instead of base64 in it.
   - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); on Linux the Paste menu checks the clipboard off the UI thread, so an X11 owner that never answers can't freeze the window (#510); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
@@ -181,10 +181,10 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 | M1 | Selection, transform, layers, MCP (common command tools, strict keys, session resources and version-aware result hints) | ✅ mostly done (transform reference point snaps to anchors/centres; rotated objects keep a rotated bounding box and their angle; Free Transform, Scale and Reflect along a rotated box pending) | 4–6 |
 | M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging and per-corner radii and kinds landed, on any path's corners; Shaper rough-shape recognition and orientation steps, the remaining Pen modifier nuances; Shaper Groups with editable sources and separate fill/stroke edits landed; construction widget/refinements pending) | 12–18 |
 | M3 | Paint & appearance (swatches, color, gradient, stroke, appearance, transparency, styles) | ✅ done (M3.7–M3.98): swatches, groups, libraries, tints, Lab spots and Registration; Color Picker, Color panel, Color Guide, Color Themes, Edit Colors and Recolor Artwork; gradients that follow every transform, the annotator, linked stops, freeform gradients, focal points, gradients on strokes and Expand; stroke geometry, arrowheads, dashes fitted to corners, stroke on type, width profiles and the Width tool, Scale Strokes and preview bounds; Appearance targeting, container appearance, target circles, Expand Appearance; knockout, isolation, blend accuracy, CMYK blending, overprint, Attributes, masks and clipping, Flatten Transparency; graphic styles, links and libraries. Left: freeform and mixed spot/process gradients export as stops or process colours to SVG/PDF; confirm the Scale Strokes & Effects default | 4–8 |
-| M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info; AF.1–AF.3 add Affinity import (native layers, artboards, vectors, text and images from Affinity 1–3 files; the embedded preview only as a warned fallback). Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, Affinity export, polish | 3–6 (existing scope; Affinity export unestimated) |
+| M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info; AF.1–AF.4 add Affinity import (native layers, artboards, vectors, text and images from Affinity 1–3 files; the embedded preview only as a warned fallback; AF.4 expands current `.af` fixtures and every-board round-trip validation). Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, Affinity export, polish | 3–6 (existing scope; Affinity export unestimated) |
 | M5 | Performance | 🟡 background render + caches + MT done; `vectorcraft-cli bench` and `vectorcraft-cli perf` (budget suite); file format v2 opens 3× faster (50k paths: 722 → 244 ms); raster effects (glows, shadows, blur, feather) no longer force the whole frame single-threaded (filtered offscreen per effect, verified equal to the single-threaded reference); effect-heavy demos need a clean-machine benchmark; dirty-region rendering, GPU backend spike pending | 15–25 |
 | M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
-| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, per-paragraph paragraph attributes, Area Type Options (with Width/Height, Auto Size and Shrink Text to Fit; overflow reported to agents and vertical Align), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, inline symbols in text (beyond parity), Hebrew/Arabic bidirectional text, Paragraph Direction, Every-line/Single-line Composer per object (ragged text too) done; tab leaders, spell check, vertical type pending | 45–60 |
+| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, per-paragraph paragraph attributes, Area Type Options (with Width/Height, Auto Size and Shrink Text to Fit; overflow reported to agents and vertical Align), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel (Above Text floats it over the selected text, its ruler at the canvas zoom so stops line up with the columns, #729), inline symbols in text (beyond parity), Hebrew/Arabic bidirectional text, Paragraph Direction, Every-line/Single-line Composer per object (ragged text too) done; tab leaders, spell check, vertical type pending | 45–60 |
 | M8 | Transform & distort (Puppet Warp, Liquify tools, Envelopes, Blends, Perspective Grid) | ✅ done (M8.1–M8.20 on 2026-10-06, fidelity pass): Liquify Tool Options with one shared brush, pen pressure, hold-to-apply, a safe scope and incremental strokes; tool options that last; Puppet Warp rotation, multi-select, Control bar and a rest-shape session that follows Undo; Width tool on compound paths; Envelope dialogs with preview, Reset with Warp/Mesh, full Envelope Options, type/images/symbols/appearance/gradients/patterns distorted on canvas and in every export, warps that keep their frame, Edit Contents, mesh handles and Control bar; Blend Options, anchor-targeted Blend tool, editable spine, keys picked on the canvas, faithful interpolation and knockout; Perspective Grid with Define Grid, presets, lock/snap/rulers, widgets, the 1–4 plane switch, movable planes, Perspective Selection scale/copy/perpendicular/Transform Again, and type and symbols truly projected with Edit Text. Left: Anti-Alias and Preserve Shape output, warp-envelope point editing, brush interpolation in blends, Free Transform/Scale/Reflect along a rotated box | 2–4 |
 | M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder and Color Adjustments; SVG Filters, Document Raster Effects Settings, 3D pending | 86–135 |
 | M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
@@ -222,16 +222,16 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Type core | 9 | 80% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); Hyphenation… and Justification… options (Every-line Composer for justified and ragged text, per object, is done; it is tuned by eye, not yet compared side by side with Illustrator; mixed type sizes in a paragraph still break single-line), Optical Margin Alignment, paragraph spacing limit for vertically justified area type, hidden characters, paragraph attributes in the Type tool's copy and paste (the characters keep their styles, the paragraphs take the destination's), mixed-value display in the Paragraph panel for a selection across differing paragraphs, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 14–19 |
 | Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), custom kinsoku sets (beyond Hard, Soft and None) and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support (beyond parity, not scored: inline symbols in text) | 20–28 |
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 88% | symbol libraries (original), dynamic symbols, envelope Anti-Alias/Preserve Shape output and warp point editing, brush interpolation in blends (M8 fidelity pass done) | 5–8 |
-| Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (an on-canvas crop box), per-feature stroke/fill choice and varying widths in Image Trace's Create Strokes (Vector Halftone and the Image Trace View modes, Palette and Create Strokes are done) | 6–10 |
+| Image Trace, graphs, image tools | 3 | 72% | graph Design/Column/Marker, Create Object Mosaic, per-feature stroke/fill choice and varying widths in Image Trace's Create Strokes (Vector Halftone and the Image Trace View modes, Palette and Create Strokes are done) | 6–10 |
 | Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard preset polish (Rearrange All Artboards, Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
 | View & navigation | 3 | 70% | New View/Edit Views, multiple windows/arrange, Snap to Pixel/Glyph (print tiling is done) | 9–14 |
-| Guides, grids, smart guides, snapping, rulers | 3 | 85% | global/video rulers, Spacing Guides' distance readouts and spacing for resized or drawn art, Smart Guides' angle and distance readouts while drawing, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451; the drawing tools snapping, with Construction Guides, #506; Spacing Guides for moves, #394) | 2–4 |
-| File formats | 6 | 85% | Affinity export, and the rest of Affinity import (effects, adjustments, brushes, master pages, live symbol instances), DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers, presets and Affinity import are done | 6–10 (existing scope; Affinity export unestimated) |
+| Guides, grids, smart guides, snapping, rulers | 3 | 85% | global/video rulers, Spacing Guides' distance readouts and spacing for resized or drawn art, Smart Guides' angle and distance readouts while drawing, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451; the drawing tools snapping, with Construction Guides, #506; Spacing Guides for moves, #394; moves snapping to the grid, #740) | 2–4 |
+| File formats | 6 | 85% | Affinity export, and the rest of Affinity import (effects, adjustments, brushes, master pages, live symbol instances), DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the rest of Illustrator's editing data (area type and type on a path, appearances and live effects, symbols, pattern fills, brushes, placed files: #637), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers, presets and Affinity import are done | 6–10 (existing scope; Affinity export unestimated) |
 | Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
 | Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
 | Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
 | UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | macOS native menu dismissal fixed (M14.8); remaining: Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 20 Preferences options stored but not yet acted on (#394: Spacing Guides, Show Font Names in English, Highlight Alternate Glyphs, Display Print Size, Open Documents As Tabs, Real-time Drawing, hyphenation, Appearance of Black, devices…) | 14–22 |
-| Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done; placed VectorCraft documents are done (linked by default, vectors in every output, previews, Break Link, Expand, Edit Original, refresh on save) | 5–8 |
+| Libraries, Links, Package | 2 | 80% | the Libraries panel is local only (no cloud by design: libraries are files on this machine) and has no shared libraries, linked graphics or gradients and patterns as items yet; its graphics, colours and text styles are done (#745); Links and Package are done; placed VectorCraft documents are done (linked by default, vectors in every output, previews, Break Link, Expand, Edit Original, refresh on save) | 2–3 |
 | **Feature parity** | **103** | **~75%** | | **~210–330** |
 | Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |
 | Hardening (big-file corpus, fuzzing, cross-platform and browser QA, accessibility, packaging) | | | | 50–80 |
@@ -250,7 +250,7 @@ lossless SVG/PDF export of live effects with SVG filters, a documented JSON form
 command, gesture and dialog drivable by agents (MCP, CLI, control channel).
 
 ## Out of scope (by design or by law)
-- **Native `.ai` private data, beyond layer structure:** the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams) is not documented as a whole. We read only the part that is the legacy Illustrator file format: layers (names, order, colour, hidden), nested layers, groups, compound paths, clipping groups, hidden objects, and plain path/colour operators. It was worked out from files the contributors have the right to use; Adobe's published specification of that format was not used. Its Zstandard wrapper is the public [RFC 8878](https://www.rfc-editor.org/rfc/rfc8878) and the ASCII85 wrapper is PostScript Level 2's. Everything else in it (the app's private `%_` comments, its binary text document, live effects, brushes, gradients, images) is not read: such a file comes in as its page, with a warning, as before. Type that shows comes from the page, which draws it; type that doesn't (hidden layers and objects, art off the page) is made from the file's text document (characters, font, size, colour, alignment and where it is, for point type: the keys were checked against the page's own type in the owner's files and are used only where they matched), and area type and type on a path in it are left out with a note. A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Each check is a render comparison against the page, which rejects the layers if they differ by more than 5%. The importer was built from public documentation and from files users own, used locally and never committed; no Adobe software was run. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+- **Native `.ai` private data, beyond its structure:** the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths, clipping groups and layer clipping, object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours), linear and radial gradients, opacity, blend modes, isolation and knockout, embedded images with their alpha channel, guides, and every artboard where it is. An object with several fills or strokes, effects or a brush comes in as its drawn look (a group named after it). Type that shows comes from the page, which draws it, into its text object's place (no group around it); type that doesn't (hidden layers and objects, art off the page) is made from the file's text document (characters, font, size, colour, alignment and where it is, for point type), and area type and type on a path in it are left out with a note. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type made from the text document and other type left out with a note. Symbols, pattern fills, placed files and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike); the page is used when they differ by more than 5%. A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 - **Adobe cloud services** (Libraries sync, Adobe Fonts, Firefly/generative): these are pluggable provider APIs, not built in.
 - **Adobe's bundled assets** (swatch/brush/symbol libraries, presets, icons): ours are original.
 

apps/vectorcraft/src/main.rs

@@ -489,6 +489,12 @@ fn main() -> std::process::ExitCode {
                 app.session.swatch_libraries.set_user_dir(swatches);
                 let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
                 app.session.style_libraries.set_user_dir(styles);
+                // So do the Libraries panel's libraries; runs without preferences (agents' test
+                // runs) keep theirs for the session only, never touching the user's.
+                if prefs_enabled() {
+                    let libraries = prefs_path().and_then(|p| Some(p.parent()?.join("Libraries").to_string_lossy().to_string()));
+                    app.session.libraries.set_dir(libraries);
+                }
                 // Data Recovery copies live next to the preferences too (none for runs without
                 // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
                 if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {

contributors/people.toml

@@ -35,3 +35,8 @@ sync_github_name = true
 [people.dotCooCoo]
 real_name = "Robert Lee"
 sync_github_name = true
+
+[people.AutoHenry]
+real_name = "Hal Goff"
+display_name = "Hal Goff, HG Studio"
+sync_github_name = false

crates/affinity/Cargo.toml

@@ -16,6 +16,7 @@ synth = []
 [dependencies]
 crc32fast = { workspace = true }
 flate2 = { workspace = true }
+image = { workspace = true }
 ruzstd = "0.9"
 
 [dev-dependencies]

crates/affinity/README.md

@@ -11,7 +11,7 @@ Affinity files.
 | Affinity | VectorCraft |
 |---|---|
 | Pages, Publisher spreads (one or two pages) | artboards, spreads side by side |
-| Artboards (`ShpN` with `ABEn`), with name, background fill, any transform | artboards plus a clip group with the background |
+| Artboards (legacy `ABEn` or Affinity 3 `phrp`/`aprp`), with name, paint and any transform | artboards plus a clip group with the actual vector outline, background and stroke |
 | Layers (`Scop`), groups (`Grup`), pass-through or isolated | layers and sublayers, groups |
 | Curves (`PCrv`): cubic subpaths, closed flags, live corners (`CnrD`) | paths (multi-subpath curves fill even-odd) |
 | Rectangles with corner radii (relative or absolute), ellipses, polygons (smooth too), stars, square stars, pies, triangles, trapezoids | paths |
@@ -23,9 +23,9 @@ Affinity files.
 | Linear, elliptical and radial gradients with Affinity's midpoint bias | gradients (the bias as the midpoint where the blend is half way) |
 | Strokes: weight, scale with object, dash pattern and phase, alignment, miter limit, behind the fill | stroke appearance |
 | Fill layers (`FRst`) | filled rectangles |
-| Artistic and frame text: characters, font family/weight/style, size, tracking, fixed leading, colour, paragraph alignment, first baseline | point type and area type |
+| Artistic and frame text: Unicode scalar-indexed runs, stored fallback font, family/weight/style, boolean OpenType features, all caps, size, tracking, fixed leading, colour, paragraph alignment, first baseline | point type and area type |
 | Placed images (`ImgN`): the original JPEG/PNG embedded in the file | embedded images |
-| Pixel layers (`Rstr`): RGBA 8/16-bit and CMYK 8-bit tiles, cropped to their content | embedded PNG images |
+| Pixel layers (`Rstr`): RGBA 8/16-bit and CMYK 8-bit tiles, cropped to their content; source-backed RGBA8 JPEG/PNG tiles with matching dimensions and zero origin | embedded PNG images |
 | Embedded documents and symbols (`EmbN`) | the picture Affinity cached of them |
 | Opacity, visibility, lock, names, the blend modes VectorCraft has | the same |
 
@@ -35,7 +35,7 @@ transparency gradients, fill opacity, bitmap fills, master pages, conical gradie
 special shapes (cloud, heart, cog, callouts, arrows…, imported as their bounding ellipse), corner
 types other than round, stars with rounded points, several fills or strokes on one object (the
 active one is used), outlined or scaled text, text fields such as page numbers, frames with
-columns or a curved outline, grey/Lab/32-bit pixels, CMYK pixels (converted to RGB without the
+columns or a curved outline, paragraph indents/spacing, mixed paragraph alignments, unsupported font selectors, grey/Lab/32-bit pixels, CMYK pixels (converted to RGB without the
 document's profile) and Affinity-only blend modes (Add, Linear Light… as Normal).
 
 When the native document can't be read at all, the engine opens the embedded PNG preview instead,
@@ -78,19 +78,32 @@ of CC0 sample files.
 * **Read-only.** Nothing is written in Affinity's format; export waits until someone can check
   written files in Affinity itself.
 
-The same reader is shared, as an independent copy, with PhotoCraft's `photocraft-affinity`.
+The reader also has an independent copy in PhotoCraft's `photocraft-affinity`.
 
 ## Validation
 
 * Unit tests on synthetic containers built by the `synth` feature (stored, zlib and zstd entries,
   checksums, budgets, cycles, hostile streams, every truncation) and property tests of random
   mutations.
-* `cargo xtask corpus --affinity` fetches 22 public CC0/MIT/Apache-2.0 documents, including the
-  four Affinity 3 `.af` files of [samuel-etver/vector-art](https://github.com/samuel-etver/vector-art)
-  (CC0), at pinned commits, each checked against `xtask/affinity-corpus.sha256`. `tests/real_files.rs`
-  parses them; `engine/tests/affinity_corpus.rs` renders each one and compares it with the
-  thumbnail Affinity saved in it (mean difference 0–4.4 of 255 at the thumbnail's size, with a
-  ceiling per file).
+* `cargo xtask corpus --affinity` fetches 51 public CC0/MIT/Apache-2.0 documents at pinned
+  commits, SHA-256 verified against `xtask/affinity-corpus.sha256`, with upstream license notices.
+  Of these, 33 are current `.af`: four CC0 vector illustrations and 28 original Affinity 3.2.3
+  feature probes plus one separately identified derived regression input from
+  [SethRobinson/Patchy](https://github.com/SethRobinson/Patchy). Only document data and provenance
+  notices were inspected, never that project's importer or authoring scripts.
+* `tests/real_files.rs` parses every file and freezes the modeled features of all 33 current
+  `.af` files. Native raster tests compare decoded pixels with independent embedded images;
+  text tests assert Unicode run boundaries, fallback fonts and feature retention.
+* `engine/tests/affinity_corpus.rs` requires editable native import, exact `.vectorcraft`
+  save/reload, and SVG/PDF/PSD export of every board in all 33 current files. It checks SVG/PDF
+  dimensions and reimport, and independently decodes PSD merged pixels using the published
+  specification. These are VectorCraft consistency checks, not independent Affinity PSD oracles.
+  Saved-thumbnail comparisons cover the existing 22 documents plus nine new representative
+  fixtures, checking every board; unsupported effects and text layout are not claimed visually
+  faithful. The Affinity corpus workflow requires the files, so missing fixtures cannot silently
+  pass CI. Run locally with `AFFINITY_CORPUS_REQUIRED=1` for the same strict gate.
+* Synthetic engine regressions cover nested, rotated and curved artboards, negative origins,
+  multiple spreads and resolution conversion, alongside text recovery and native save/export.
 * `engine/tests/import_fuzz.rs` mutates a synthetic native document's stream and archive and checks
   that whatever opens also renders and exports; `fuzz/` has `cargo-fuzz` targets for the whole
   reader (`container`) and the object stream (`stream`):
@@ -100,6 +113,10 @@ The same reader is shared, as an independent copy, with PhotoCraft's `photocraft
   cargo +nightly fuzz run stream -- -max_total_time=600
   ```
 
+The source audit, licensing decisions and remaining complex-document/font cases are recorded in
+[affinity-validation.md](../../docs/affinity-validation.md). Reopening VectorCraft's exports in
+Affinity remains an independent validation step that hasn't been done.
+
 What has not been verified: files from Affinity builds or platforms outside the public set, files
 written by other applications, rotated or skewed images against Affinity's render, mask polarity
 against a render with and without the mask, and anything listed as a warning above. The `synth`
@@ -113,8 +130,14 @@ default (`Limits`), a 64 MiB zstd window, 4096 saved revisions, array lengths no
 bytes left, 16 777 216 decoded values per document stream (fields and array elements together, counted before
 anything is allocated: a value takes about 40 bytes in memory however few it took in the file; the largest of
 those 189 public documents uses 3.3 million), 384 levels of object nesting, 128 levels of layers, 500 000 layers, four million curve
-nodes per curve, 64 megapixels per pixel layer (cropped to its content first) and 1024 gradient
-stops. Every archive entry's CRC-32 and size must match. Malformed input returns an `Error`; the
+nodes per curve; compound outlines also cap recursion at 128 levels, operand visits at 100 000
+and cumulative geometry work at four million, rejecting cycles and partial results on limits.
+Pie sweeps normalize finite angles in constant time. Pixel layers are limited to 64 megapixels
+(cropped to their content first); gradients to 1024 stops. Text collection is bounded to a
+million characters per node before allocation, with a cumulative 16 MiB budget for owned font
+names, features and gradient stops. Exhaustion warns and uses default attributes for remaining
+text, preserving its characters.
+Every archive entry's CRC-32 and size must match. Malformed input returns an `Error`; the
 crate has no panics outside tests.
 
 ## Privacy

crates/affinity/src/container.rs

@@ -337,7 +337,7 @@ fn unpredict(b: &mut [u8], compression: u8) -> Result<(), Error> {
         (0x40, _) => byte_delta(b),
         (0x80, false) => {
             let mut prev = 0u16;
-            for pair in b.chunks_exact_mut(2) {
+            for pair in b.as_chunks_mut::<2>().0.iter_mut() {
                 let v = u16::from_le_bytes([pair[0], pair[1]]).wrapping_add(prev);
                 pair.copy_from_slice(&v.to_le_bytes());
                 prev = v;
@@ -349,7 +349,7 @@ fn unpredict(b: &mut [u8], compression: u8) -> Result<(), Error> {
             if b.len() == 0x10000 {
                 let planes = b.to_vec();
                 let (hi, lo) = planes.split_at(0x8000);
-                for (i, out) in b.chunks_exact_mut(4).enumerate() {
+                for (i, out) in b.as_chunks_mut::<4>().0.iter_mut().enumerate() {
                     let (Some(h), Some(l)) = (hi.get(2 * i..2 * i + 2), lo.get(2 * i..2 * i + 2)) else {
                         return Err(Error::Malformed("tile size"));
                     };

crates/affinity/src/geometry.rs

@@ -6,15 +6,77 @@ use crate::stream::{ObjId, Tag, Value};
 
 /// Nodes per curve object.
 const MAX_NODES: usize = 4_000_000;
+/// A shared-object stream is bounded, but a compound graph can expand exponentially. Count
+/// each visit and each curve record / generated contour / transformed segment across the whole
+/// outline, including repeated references. Match the document reader's nesting limit.
+const MAX_OUTLINE_DEPTH: usize = 128;
+const MAX_OUTLINE_VISITS: usize = 100_000;
+
+struct OutlineBudget {
+    active: Vec<ObjId>,
+    visits: usize,
+    work: usize,
+    failed: bool,
+}
+
+impl OutlineBudget {
+    fn fail(&mut self, r: &mut Reader, warning: &'static str) -> Option<()> {
+        if !self.failed {
+            r.warn(warning);
+        }
+        self.failed = true;
+        None
+    }
+
+    fn spend(&mut self, r: &mut Reader, work: usize) -> Option<()> {
+        if work > self.work {
+            return self.fail(r, "compound outlines exceeding the geometry work limit");
+        }
+        self.work -= work;
+        Some(())
+    }
+
+    fn path(&mut self, r: &mut Reader, path: &Path) -> Option<()> {
+        for subpath in &path.subpaths {
+            self.spend(r, 1)?;
+            self.spend(r, subpath.segments.len())?;
+        }
+        Some(())
+    }
+}
 
 /// The node-space outline of a curve, shape or compound node, and whether it fills even-odd.
 /// Instances (master-page or symbol copies) take the geometry of their master.
 pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> Option<(Path, bool)> {
+    let mut budget = OutlineBudget { active: Vec::new(), visits: MAX_OUTLINE_VISITS, work: MAX_NODES, failed: false };
+    bounded_outline(r, id, class, world, &mut budget)
+}
+
+fn bounded_outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine, budget: &mut OutlineBudget) -> Option<(Path, bool)> {
+    if budget.active.contains(&id) {
+        budget.fail(r, "a compound outline that contains itself")?;
+    }
+    if budget.active.len() >= MAX_OUTLINE_DEPTH {
+        budget.fail(r, "compound outlines nested deeper than 128 levels")?;
+    }
+    if budget.visits == 0 {
+        budget.fail(r, "compound outlines exceeding the operand visit limit")?;
+    }
+    budget.visits -= 1;
+    budget.active.push(id);
+    let result = outline_inner(r, id, class, world, budget);
+    // The popped value is our own stack marker, and is no longer needed.
+    let _ = budget.active.pop();
+    result
+}
+
+fn outline_inner(r: &mut Reader, id: ObjId, class: Tag, world: Affine, budget: &mut OutlineBudget) -> Option<(Path, bool)> {
     let s = r.s;
     match &class.0.to_be_bytes() {
         b"PCrv" | b"TxtC" => {
             let crvs = s.obj(id, b"Crvs").or_else(|| s.obj(id, b"MCrM").and_then(|m| s.obj(m, b"Crvs")))?;
-            let path = curves(r, crvs)?;
+            let path = curves(r, crvs, budget)?;
+            budget.path(r, &path)?;
             let multi = path.subpaths.len() > 1;
             Some((path, multi))
         }
@@ -29,8 +91,24 @@ pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> O
                 if s.enumeration(c, b"ComO").is_some_and(|(op, _)| op != 0 && op != 2) {
                     r.warn("compound shapes that intersect or exclude (imported as add)");
                 }
-                if let Some((p, _)) = outline(r, c, class, local.then(world)) {
-                    path.subpaths.extend(p.transformed(local).subpaths);
+                let child_world = local.then(world);
+                if !child_world.is_finite() {
+                    budget.fail(r, "a compound operand with an invalid transform")?;
+                }
+                if let Some((mut p, _)) = bounded_outline(r, c, class, child_world, budget) {
+                    // Charge before transforming or extending. Transform the owned path in place
+                    // so nested compounds do not make an additional copy of every contour.
+                    budget.path(r, &p)?;
+                    for subpath in &mut p.subpaths {
+                        subpath.start = local.apply(subpath.start);
+                        for segment in &mut subpath.segments {
+                            *segment = segment.map(|point| local.apply(point));
+                        }
+                    }
+                    path.subpaths.extend(p.subpaths);
+                } else if budget.failed {
+                    // Never present a partial compound as complete after a cycle or budget limit.
+                    return None;
                 }
             }
             Some((path, true))
@@ -44,7 +122,9 @@ pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> O
                 }
             };
             let b = s.floats::<4>(box_owner, b"ShpB")?;
-            crate::shapes::shape(r, shape, b, world).map(|p| (p, false))
+            let path = crate::shapes::shape(r, shape, b, world)?;
+            budget.path(r, &path)?;
+            Some((path, false))
         }
     }
 }
@@ -53,7 +133,7 @@ pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> O
 /// A record is (f64 x, f64 y, u8 kind, u8 role): role 0 is an anchor, 1 the out-handle of the
 /// anchor before it, 2 the in-handle of the anchor after it. A closed subpath repeats its first
 /// anchor at the end. `CnrD` live corners are rounded on the stored polyline.
-pub(crate) fn curves(r: &mut Reader, crvs: ObjId) -> Option<Path> {
+fn curves(r: &mut Reader, crvs: ObjId, budget: &mut OutlineBudget) -> Option<Path> {
     let s = r.s;
     let data = s.obj(crvs, b"Data")?;
     let mut fields = s.positional(data);
@@ -62,6 +142,7 @@ pub(crate) fn curves(r: &mut Reader, crvs: ObjId) -> Option<Path> {
         Value::UInt(n) => usize::try_from(*n).ok()?,
         _ => return None,
     };
+    budget.spend(r, count)?;
     let corners = s.obj(crvs, b"CnrD").and_then(|c| corner_radii(s.positional(c).collect()));
     let mut path = Path::default();
     let mut seen = 0usize;
@@ -73,9 +154,9 @@ pub(crate) fn curves(r: &mut Reader, crvs: ObjId) -> Option<Path> {
         let Value::Array(records) = fields.next()? else { return None };
         seen = seen.checked_add(records.len())?;
         if seen > MAX_NODES {
-            r.warn("curves with more than four million nodes");
-            return None;
+            budget.fail(r, "curves with more than four million nodes")?;
         }
+        budget.spend(r, records.len())?;
         let anchors = anchors(records)?;
         let radii = if index == 0 { corners.as_ref() } else { None };
         if let Some(sp) = subpath(&anchors, closed, radii) {

crates/affinity/src/model.rs

@@ -172,6 +172,9 @@ pub struct TextRun {
     /// CSS weight (400 regular, 700 bold).
     pub weight: i64,
     pub italic: bool,
+    /// Boolean OpenType feature overrides, as tags or `-tag` for disabled features.
+    pub features: Vec<String>,
+    pub all_caps: bool,
     /// Font size in document pixels, before the node's transform.
     pub size: f64,
     /// Tracking in em.
@@ -223,10 +226,16 @@ pub enum Kind {
     /// Layer container (`Scop`).
     Layer,
     Group,
-    /// Artboard: a rectangle that clips its children; `background` paints behind them.
+    /// Artboard: an export rectangle and vector outline that clips its children.
+    /// `background` paints behind them, and `strokes` over them.
     Artboard {
         rect: Rect,
+        /// Actual clipping outline in document pixels. The artboard's export rectangle is its
+        /// bounding box, but a rotated or non-rectangular board still clips to this outline.
+        path: Path,
+        even_odd: bool,
         background: Vec<Paint>,
+        strokes: Vec<Stroke>,
     },
     /// Curve, parametric shape or compound shape: an outline with its fills and strokes.
     /// Children of a shape are clipped by its outline (painted over its fills, under its strokes).
@@ -436,7 +445,10 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
             b"Scop" => Kind::Layer,
             b"Grup" => Kind::Group,
             b"PCrv" | b"ShpN" | b"Comp" | b"SNEN" | b"SNRR" | b"ShRN" => {
-                if class == Tag::of(b"ShpN") && s.bool(id, b"ABEn") == Some(true) {
+                // Affinity 3.2.3's two-board public fixture marks board shapes with an `aprp`
+                // property object in `phrp`, while older documents use `ABEn`. Ordinary shapes
+                // in that fixture have neither. See the pinned corpus and validation audit.
+                if s.bool(id, b"ABEn") == Some(true) || s.obj(id, b"phrp").is_some_and(|p| s.is(p, b"aprp")) {
                     return Ok(self.artboard(id, world));
                 }
                 let Some((local, even_odd)) = crate::geometry::outline(self, id, class, world) else {
@@ -523,12 +535,15 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
 
     fn artboard(&mut self, id: ObjId, world: Affine) -> Kind {
         let s = self.s;
-        let b = s.floats::<4>(id, b"ShpB").map(rect).unwrap_or(Rect { x0: 0.0, y0: 0.0, x1: 0.0, y1: 0.0 });
+        let Some(b) = s.floats::<4>(id, b"ShpB").map(rect).filter(|b| b.x1 > b.x0 && b.y1 > b.y0) else {
+            self.warn("an artboard without valid bounds (its children are kept without clipping)");
+            return Kind::Unsupported;
+        };
         let corners =
             [Point { x: b.x0, y: b.y0 }, Point { x: b.x1, y: b.y0 }, Point { x: b.x1, y: b.y1 }, Point { x: b.x0, y: b.y1 }].map(|p| world.apply(p));
         let [a, b2, c, d, ..] = world.0;
         if b2.abs() > 1e-9 || c.abs() > 1e-9 || a <= 0.0 || d <= 0.0 {
-            self.warn("a rotated or flipped artboard (imported at its bounding box)");
+            self.warn("a rotated or flipped artboard (export bounds are its bounding box; artwork keeps its outline)");
         }
         let xs = corners.map(|p| p.x);
         let ys = corners.map(|p| p.y);
@@ -538,8 +553,17 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
             x1: xs.iter().copied().fold(f64::NEG_INFINITY, f64::max),
             y1: ys.iter().copied().fold(f64::NEG_INFINITY, f64::max),
         };
-        let background = paint::fills(self, id, world, b"BFFl");
-        Kind::Artboard { rect, background }
+        if ![rect.x0, rect.y0, rect.x1, rect.y1].iter().all(|v| v.is_finite()) || rect.x1 <= rect.x0 || rect.y1 <= rect.y0 {
+            self.warn("an artboard with an invalid transformed size (its children are kept without clipping)");
+            return Kind::Unsupported;
+        }
+        let class = s.class(id).unwrap_or(Tag::of(b"ShpN"));
+        let (path, even_odd) = crate::geometry::outline(self, id, class, world).unwrap_or_else(|| {
+            self.warn("an artboard whose outline could not be read (clipped to its rectangle)");
+            (Path { subpaths: vec![crate::shapes::rectangle(b.x0, b.y0, b.x1, b.y1)] }, false)
+        });
+        let (background, strokes) = paint::node_paint(self, id, world);
+        Kind::Artboard { rect, path: path.transformed(world), even_odd, background, strokes }
     }
 }
 

crates/affinity/src/paint.rs

@@ -129,7 +129,7 @@ const MAX_STOPS: usize = 1024;
 fn floats(v: &Value) -> Option<Vec<f64>> {
     match v {
         Value::Floats(f) => Some(f.clone()),
-        Value::Bytes(b) if b.len() % 4 == 0 => Some(b.chunks_exact(4).map(|c| f64::from(f32::from_le_bytes([c[0], c[1], c[2], c[3]]))).collect()),
+        Value::Bytes(b) if b.len() % 4 == 0 => Some(b.as_chunks::<4>().0.iter().map(|c| f64::from(f32::from_le_bytes(*c))).collect()),
         _ => None,
     }
 }

crates/affinity/src/preview.rs

@@ -94,11 +94,8 @@ pub fn preview(bytes: &[u8]) -> Result<Preview<'_>, Error> {
                 }
                 image_data = true;
             }
-            b"IEND" => {
-                if !image_data {
-                    return Err(Error::Malformed("PNG has no image data"));
-                }
-            }
+            b"IEND" if !image_data => return Err(Error::Malformed("PNG has no image data")),
+            b"IEND" => {}
             _ if kind.first().is_some_and(u8::is_ascii_uppercase) => {
                 return Err(Error::Unsupported("unknown critical PNG chunk"));
             }

crates/affinity/src/raster.rs

@@ -13,6 +13,11 @@ const MAX_PIXELS: u64 = 64 << 20;
 const TILE: usize = 256;
 const TILE_BYTES: usize = TILE * TILE;
 
+struct CachedPixels {
+    tiles: HashMap<String, Vec<u8>>,
+    source: Option<(usize, Vec<u8>)>,
+}
+
 pub(crate) fn node_image(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
     let s = r.s;
     let Some(bitmap) = s.obj(id, b"Bitm") else {
@@ -53,7 +58,9 @@ pub(crate) fn node_image(r: &mut Reader, id: ObjId, world: Affine) -> Result<Opt
             )
         })
         .unwrap_or((0, 0, width, height));
-    if s.field(bitmap, b"Bckg").is_some() && has_tiles && !s.is(id, b"ImgN") {
+    let source_tiles_only =
+        (1..=4).all(|c| matches!(s.field(bitmap, &tag(b"Sta", c)), Some(Value::Array(a)) if !a.is_empty() && a.iter().all(|v| *v == Value::UInt(5))));
+    if s.field(bitmap, b"Bckg").is_some() && has_tiles && !source_tiles_only && !s.is(id, b"ImgN") {
         r.warn("edited placed images use their stored pixels");
     }
     decode(r, bitmap, crop, world)
@@ -118,7 +125,27 @@ fn decode(r: &mut Reader, bitmap: ObjId, crop: (u32, u32, u32, u32), world: Affi
         }
     };
     let mut planes = Vec::with_capacity(channels);
-    let mut cache = HashMap::new();
+    // Current .af documents can keep level-zero tiles in their embedded JPEG/PNG instead of
+    // duplicating the pixels. State 5 is checked in the public Patchy embedded-jpeg fixture.
+    // Support only the observed, same-size RGBA8 image with a zero bitmap origin; other
+    // representations still receive the existing loss warning rather than guessing a mapping.
+    let needs_source = (1..=channels).any(|c| matches!(s.field(bitmap, &tag(b"Sta", c)), Some(Value::Array(a)) if a.contains(&Value::UInt(5))));
+    let source = if needs_source && format == Some(0) && s.int(bitmap, b"LInf") == Some(0) && s.int(bitmap, b"TInf") == Some(0) {
+        if let Some(name) = s.entry(bitmap, b"Bckg") {
+            let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+            let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+            match original(r, name).and_then(|bytes| source_pixels(&bytes, width, height)) {
+                Ok(pixels) => Some((width as usize, pixels)),
+                Err(Error::Limit(e)) => return Err(Error::Limit(e)),
+                Err(_) => None,
+            }
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+    let mut cache = CachedPixels { tiles: HashMap::new(), source };
     for c in 1..=channels {
         planes.push(plane(r, bitmap, c, bps, (x0, y0, w, h), &mut cache)?);
     }
@@ -131,7 +158,7 @@ fn decode(r: &mut Reader, bitmap: ObjId, crop: (u32, u32, u32, u32), world: Affi
             f64::from(p.get(i).copied().unwrap_or(0)) / 255.0
         }
     };
-    for (i, px) in rgba.chunks_exact_mut(4).enumerate() {
+    for (i, px) in rgba.as_chunks_mut::<4>().0.iter_mut().enumerate() {
         let v: Vec<f64> = planes.iter().map(|p| sample(p, i)).collect();
         let (r2, g, b, a) = if channels == 1 {
             (v[0], v[0], v[0], 1.0)
@@ -158,6 +185,39 @@ fn original(r: &mut Reader, name: &str) -> Result<Vec<u8>, Error> {
     }
 }
 
+/// Decode the source under the same pixel budget as tiled layers, checking its actual
+/// dimensions before allocating decoded pixels. Only JPEG and PNG sources are supported.
+fn source_pixels(bytes: &[u8], width: u32, height: u32) -> Result<Vec<u8>, Error> {
+    use image::{ImageFormat, ImageReader};
+    use std::io::Cursor;
+
+    if u64::from(width) * u64::from(height) > MAX_PIXELS {
+        return Err(Error::Limit("embedded image pixels"));
+    }
+    let mut reader = ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(|_| Error::Malformed("embedded image format"))?;
+    if !matches!(reader.format(), Some(ImageFormat::Jpeg | ImageFormat::Png)) {
+        return Err(Error::Unsupported("embedded source pixel format"));
+    }
+    let dimensions = ImageReader::new(Cursor::new(bytes))
+        .with_guessed_format()
+        .map_err(|_| Error::Malformed("embedded image format"))?
+        .into_dimensions()
+        .map_err(|_| Error::Malformed("embedded image dimensions"))?;
+    if dimensions != (width, height) || width == 0 || height == 0 {
+        return Err(Error::Malformed("embedded source and bitmap dimensions differ"));
+    }
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(width);
+    limits.max_image_height = Some(height);
+    limits.max_alloc = Some(MAX_PIXELS * 8);
+    reader.limits(limits);
+    let decoded = reader.decode().map_err(|e| match e {
+        image::ImageError::Limits(_) => Error::Limit("embedded image decoding"),
+        _ => Error::Malformed("embedded image decoding"),
+    })?;
+    Ok(decoded.into_rgba8().into_raw())
+}
+
 fn tag(prefix: &[u8; 3], c: usize) -> [u8; 4] {
     [prefix[0], prefix[1], prefix[2], b'0' + c as u8]
 }
@@ -169,8 +229,9 @@ fn plane(
     c: usize,
     bps: usize,
     (x0, y0, w, h): (u32, u32, u32, u32),
-    cache: &mut HashMap<String, Vec<u8>>,
+    cache: &mut CachedPixels,
 ) -> Result<Vec<u8>, Error> {
+    let CachedPixels { tiles: cache, source } = cache;
     let s = r.s;
     let width = s.int(bitmap, b"BmpW").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
     let height = s.int(bitmap, b"BmpH").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
@@ -219,6 +280,13 @@ fn plane(
                 None
             }
             5 => {
+                if let Some((source_width, pixels)) = source.as_ref() {
+                    let (ox, oy) = (tx * TILE, ty * TILE);
+                    copy(&mut out, row, (bx0, py0, bx1, py1), (ox, oy), |x, y| {
+                        pixels.get(((oy + y) * source_width + ox + x) * 4 + c - 1).copied().unwrap_or(0)
+                    });
+                    continue;
+                }
                 r.warn("pixel layers drawn from an embedded image (left empty)");
                 None
             }
@@ -241,3 +309,106 @@ fn copy(out: &mut [u8], row: usize, (bx0, py0, bx1, py1): (usize, usize, usize,
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::model::Kind;
+    use crate::synth::{self, F, Method, tag};
+
+    fn png() -> Vec<u8> {
+        let pixels = image::RgbaImage::from_fn(300, 2, |x, y| image::Rgba([(x % 251) as u8, (y * 31) as u8, 77, 255]));
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        pixels.write_to(&mut bytes, image::ImageFormat::Png).unwrap();
+        bytes.into_inner()
+    }
+
+    /// An original synthetic mixed source/cache bitmap. It exercises reader recovery,
+    /// not a claim that Affinity itself accepts the synthetic container.
+    fn fixture(source: &[u8], origin: i32) -> Vec<u8> {
+        let mut bitmap = vec![
+            (tag(b"Frmt"), F::Enum(0, 0)),
+            (tag(b"BmpW"), F::I32(300)),
+            (tag(b"BmpH"), F::I32(2)),
+            (tag(b"LInf"), F::I32(origin)),
+            (tag(b"TInf"), F::I32(0)),
+            (tag(b"Bckg"), F::Entry("c/1".into())),
+        ];
+        for c in 1..=4 {
+            bitmap.push((tag(&super::tag(b"TWi", c)), F::I32(2)));
+            bitmap.push((tag(&super::tag(b"THi", c)), F::I32(1)));
+            bitmap.push((tag(&super::tag(b"Sta", c)), F::U8s(vec![5, 4])));
+            bitmap.push((
+                tag(&super::tag(b"Idx", c)),
+                F::Shared(vec![F::Def(c as u32, vec![tag(b"Blck")], vec![(tag(b"Data"), F::Entry(format!("d/{c}")))])]),
+            ));
+        }
+        let mut crop = vec![0x17];
+        crop.extend(tag(b"BitR").0.to_le_bytes());
+        crop.extend([250i32, 0, 270, 2].into_iter().flat_map(i32::to_le_bytes));
+        let raster = F::Def(
+            10,
+            vec![tag(b"Rstr")],
+            vec![
+                (tag(b"Bitm"), F::Obj(tag(b"DyBm"), bitmap)),
+                (tag(b"BitR"), F::Raw(crop)),
+                (tag(b"Xfrm"), F::F64s(vec![0.0, -2.0, 10.0, 2.0, 0.0, 20.0])),
+            ],
+        );
+        let spread = F::Def(11, vec![tag(b"Sprd")], vec![(tag(b"Chld"), F::Shared(vec![raster]))]);
+        let doc = synth::stream(&[(tag(b"DocR"), F::Obj(tag(b"DocN"), vec![(tag(b"Chld"), F::Shared(vec![spread]))]))]);
+        let mut blob = vec![0x2d];
+        blob.extend(tag(b"Data").0.to_le_bytes());
+        blob.extend((source.len() as u32).to_le_bytes());
+        blob.extend(source);
+        let block = synth::stream(&[(tag(b"Data"), F::Raw(blob))]);
+        let tiles: Vec<_> = [200u8, 10, 30, 255].into_iter().map(|v| vec![v; TILE_BYTES]).collect();
+        synth::container(
+            &[
+                ("doc.dat", &doc, Method::Zlib),
+                ("c/1", &block, Method::Zlib),
+                ("d/1", &tiles[0], Method::Zlib),
+                ("d/2", &tiles[1], Method::Zlib),
+                ("d/3", &tiles[2], Method::Zlib),
+                ("d/4", &tiles[3], Method::Zlib),
+            ],
+            None,
+        )
+    }
+
+    #[test]
+    fn source_tiles_and_cached_edits_survive_crop_rotation_and_tile_boundaries() {
+        let doc = crate::read(&fixture(&png(), 0), crate::Limits::default()).unwrap();
+        assert_eq!(doc.warnings, ["edited placed images use their stored pixels"]);
+        let Kind::Image(image) = &doc.spreads[0].nodes[0].kind else { panic!() };
+        assert_eq!((image.width, image.height), (20, 2));
+        assert_eq!(image.transform, Affine([0.0, 2.0, -2.0, 0.0, 10.0, 520.0]));
+        let Pixels::Rgba8(pixels) = &image.pixels else { panic!() };
+        for y in 0..2 {
+            for x in 0..20 {
+                let expected = if x + 250 < 256 { [((x + 250) % 251) as u8, (y * 31) as u8, 77, 255] } else { [200, 10, 30, 255] };
+                assert_eq!(&pixels[(y * 20 + x) * 4..(y * 20 + x + 1) * 4], &expected);
+            }
+        }
+    }
+
+    #[test]
+    fn unreadable_sources_and_unknown_origins_preserve_cached_edits_and_warn() {
+        for bytes in [fixture(b"invalid image", 0), fixture(&png(), 1)] {
+            let doc = crate::read(&bytes, crate::Limits::default()).unwrap();
+            assert!(doc.warnings.iter().any(|w| w == "pixel layers drawn from an embedded image (left empty) (4×)"));
+            let Kind::Image(image) = &doc.spreads[0].nodes[0].kind else { panic!() };
+            let Pixels::Rgba8(pixels) = &image.pixels else { panic!() };
+            assert_eq!(&pixels[..4], &[0, 0, 0, 0]);
+            assert_eq!(&pixels[6 * 4..7 * 4], &[200, 10, 30, 255]);
+        }
+    }
+
+    #[test]
+    fn embedded_source_dimensions_and_pixel_budget_are_checked_before_decode() {
+        let bytes = png();
+        assert!(matches!(source_pixels(&bytes, 299, 2), Err(Error::Malformed(_))));
+        assert!(matches!(source_pixels(&bytes, u32::MAX, u32::MAX), Err(Error::Limit(_))));
+        assert_eq!(source_pixels(&bytes, 300, 2).unwrap().len(), 300 * 2 * 4);
+    }
+}

crates/affinity/src/shapes.rs

@@ -115,13 +115,21 @@ pub(crate) fn shape(r: &mut Reader, shape: ObjId, b: [f64; 4], world: Affine) ->
             }))?
         }
         b"ShPi" => {
-            let start = num(r, shape, b"AngS").unwrap_or(0.0);
-            let mut end = num(r, shape, b"AngE").unwrap_or(TAU);
-            while end < start {
-                end += TAU;
-            }
+            let raw_start = num(r, shape, b"AngS").unwrap_or(0.0);
+            let raw_end = num(r, shape, b"AngE").unwrap_or(TAU);
+            // Normalize in constant time. Repeatedly adding TAU can hang on finite values
+            // large enough that floating-point addition no longer changes the endpoint.
+            let start = raw_start.rem_euclid(TAU);
+            let delta = raw_end - raw_start;
+            let sweep = if raw_end >= raw_start {
+                delta.min(TAU)
+            } else if delta.is_finite() {
+                delta.rem_euclid(TAU)
+            } else {
+                (raw_end.rem_euclid(TAU) - start).rem_euclid(TAU)
+            };
             let inner = num(r, shape, b"IRad").unwrap_or(0.0).clamp(0.0, 1.0);
-            pie(cx, cy, rx, ry, start, end.min(start + TAU), inner)
+            pie(cx, cy, rx, ry, start, start + sweep, inner)
         }
         b"ShpT" => {
             let p = num(r, shape, b"Pos ").unwrap_or(0.5);

crates/affinity/src/text.rs

@@ -3,11 +3,13 @@
 //! OpenType features) is left to the importing application.
 
 use crate::model::{Affine, Align, Point, Reader, Text, TextRun, rect};
-use crate::paint::{self, Paint};
+use crate::paint::{self, Color, Paint};
 use crate::stream::{ObjId, Value};
 
 /// Characters read per text node (stories are split into blocks; this caps hostile ones).
 const MAX_CHARS: usize = 1 << 20;
+/// Shared character attributes must not amplify into unbounded font/feature/gradient data.
+const MAX_ATTRIBUTE_BYTES: usize = 16 << 20;
 
 pub(crate) fn read(r: &mut Reader, id: ObjId, world: Affine) -> Option<Text> {
     let s = r.s;
@@ -19,46 +21,76 @@ pub(crate) fn read(r: &mut Reader, id: ObjId, world: Affine) -> Option<Text> {
     let mut align = None;
     let mut total = 0usize;
     let mut placeholders = false;
+    let mut attribute_budget = Some(MAX_ATTRIBUTE_BYTES);
     for block in s.objs(story, b"Blok") {
-        let glyphs = s.obj(block, b"Glyp")?;
-        let chars: Vec<char> = match s.str(glyphs, b"Utf8") {
-            Some(t) => t.chars().collect(),
+        let Some(glyphs) = s.obj(block, b"Glyp") else {
+            r.warn("a text block without readable characters (left out)");
+            continue;
+        };
+        // Bound collection itself, including placeholders, before allocating the character buffer.
+        let budget = MAX_CHARS - total;
+
+        let mut chars: Vec<char> = match s.str(glyphs, b"Utf8") {
+            Some(t) => t.chars().take(budget + 1).collect(),
             None => {
                 // Inline objects (page numbers, anchors) each take one index before the segment text.
+                let segments = s.objs(glyphs, b"Mixd");
+                if segments.is_empty() {
+                    r.warn("a text block without readable characters (left out)");
+                    continue;
+                }
                 let mut v = Vec::new();
-                for seg in s.objs(glyphs, b"Mixd") {
+                for seg in segments {
                     let inline = s.objs(seg, b"Glys").len();
-                    v.extend(std::iter::repeat_n('\u{FFFC}', inline));
+                    v.extend(std::iter::repeat_n('\u{FFFC}', inline.min(budget + 1 - v.len())));
                     placeholders |= inline > 0;
-                    v.extend(s.str(seg, b"Utf8").unwrap_or_default().chars());
+                    v.extend(s.str(seg, b"Utf8").unwrap_or_default().chars().take(budget + 1 - v.len()));
+                    if v.len() > budget {
+                        break;
+                    }
                 }
                 v
             }
         };
-        total = total.checked_add(chars.len())?;
-        if total > MAX_CHARS {
+        let truncated = chars.len() > budget;
+        if truncated {
+            chars.truncate(budget);
             r.warn("text longer than a million characters (truncated)");
-            break;
         }
+        total += chars.len();
         let mut start = 0usize;
         for run in s.obj(block, b"GAtt").map(|g| s.objs(g, b"Runs")).unwrap_or_default() {
-            let end = usize::try_from(s.int(run, b"Indx")?).ok()?.min(chars.len());
+            let Some(index) = s.int(run, b"Indx").and_then(|v| usize::try_from(v).ok()) else {
+                r.warn("invalid text attribute range (bounded; unassigned characters use defaults)");
+                continue;
+            };
+            let end = index.min(chars.len());
+            if index > chars.len() || end < start {
+                r.warn("invalid text attribute range (bounded; unassigned characters use defaults)");
+            }
             if end <= start {
                 continue;
             }
-            let text: String = chars.get(start..end)?.iter().filter(|c| **c != '\0' && **c != '\u{FFFC}').collect();
+            let text = characters(&chars, start, end);
             start = end;
-            let Some(attrs) = s.obj(run, b"Item") else { continue };
-            if !text.is_empty() {
-                runs.push(run_attrs(r, attrs, text, world));
+            push_run(r, &mut runs, s.obj(run, b"Item"), text, world, &mut attribute_budget);
+        }
+        if start < chars.len() {
+            let text = characters(&chars, start, chars.len());
+            push_run(r, &mut runs, None, text, world, &mut attribute_budget);
+        }
+        for paragraph in s.obj(block, b"PAtt").map(|p| s.objs(p, b"Runs")).unwrap_or_default() {
+            if let Some(attrs) = s.obj(paragraph, b"Item") {
+                let paragraph = paragraph_align(r, attrs);
+                match align {
+                    None => align = Some(paragraph),
+                    Some(first) if first != paragraph => r.warn("mixed paragraph alignments (the first alignment is used)"),
+                    _ => {}
+                }
             }
         }
-        if align.is_none() {
-            align = s
-                .obj(block, b"PAtt")
-                .and_then(|p| s.objs(p, b"Runs").first().copied())
-                .and_then(|run| s.obj(run, b"Item"))
-                .map(|p| paragraph_align(r, p));
+        if truncated {
+            break;
         }
     }
     if placeholders {
@@ -82,6 +114,39 @@ pub(crate) fn read(r: &mut Reader, id: ObjId, world: Affine) -> Option<Text> {
     Some(Text { runs, align, anchor: Point { x: anchor_x, y: first_baseline }, frame: if artistic { None } else { Some(bounds) }, transform: world })
 }
 
+fn characters(chars: &[char], start: usize, end: usize) -> String {
+    chars.get(start..end).unwrap_or_default().iter().filter(|c| **c != '\0' && **c != '\u{FFFC}').collect()
+}
+
+fn push_run(r: &mut Reader, runs: &mut Vec<TextRun>, attrs: Option<ObjId>, text: String, world: Affine, attribute_budget: &mut Option<usize>) {
+    if text.is_empty() {
+        return;
+    }
+    let run = match attrs {
+        Some(attrs) if attribute_budget.is_some() => run_attrs(r, attrs, text, world, attribute_budget),
+        _ => {
+            // This is a recovery policy, not an assertion about unspecified Affinity attributes.
+            if attrs.is_none() {
+                r.warn("text without character attributes (characters preserved with default attributes)");
+            }
+            TextRun {
+                text,
+                postscript: String::new(),
+                family: String::new(),
+                weight: 400,
+                italic: false,
+                features: Vec::new(),
+                all_caps: false,
+                size: 12.0 * r.dpi / 72.0,
+                tracking: 0.0,
+                leading: None,
+                fill: Paint::Solid(Color::Gray { v: 0.0, a: 1.0 }),
+            }
+        }
+    };
+    runs.push(run);
+}
+
 fn slot<T: Copy>(v: Option<&Value>, i: usize, f: impl Fn(&Value) -> Option<T>) -> Option<T> {
     match v? {
         Value::Array(a) => a.get(i).and_then(f),
@@ -104,7 +169,7 @@ fn int(v: &Value) -> Option<i64> {
     }
 }
 
-fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine) -> TextRun {
+fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine, attribute_budget: &mut Option<usize>) -> TextRun {
     let s = r.s;
     let doubles = s.field(attrs, b"Doub");
     let ints = s.field(attrs, b"Ints");
@@ -112,24 +177,67 @@ fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine) -> TextR
     let tracking = slot(doubles, 4, float).unwrap_or(0.0);
     let leading = (slot(ints, 4, int) == Some(1)).then(|| slot(doubles, 13, float)).flatten().filter(|v| *v > 0.0);
     let objects = match s.field(attrs, b"Objs") {
-        Some(Value::Array(a)) => a.iter().map(|v| if let Value::Obj(o) = v { *o } else { None }).collect(),
+        Some(Value::Array(a)) => a.iter().take(8).map(|v| if let Value::Obj(o) = v { *o } else { None }).collect(),
         _ => Vec::new(),
     };
-    let fill = objects.first().copied().flatten().and_then(|f| paint::descriptor(r, f, world)).unwrap_or(Paint::None);
-    if objects.get(1).copied().flatten().and_then(|f| paint::descriptor(r, f, world)).is_some_and(|p| p != Paint::None) {
+    let mut fill = match objects.first().copied().flatten().and_then(|f| paint::descriptor(r, f, world)) {
+        Some(fill) => fill,
+        None => {
+            r.warn("text without readable fill attributes (default black used)");
+            Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })
+        }
+    };
+    // A single descriptor decode is bounded by paint::MAX_STOPS. Charge its owned stop data
+    // before keeping it; subsequent runs skip attribute decoding once the budget is exhausted.
+    if let Paint::Gradient(gradient) = &fill {
+        let bytes = gradient.stops.len().saturating_mul(std::mem::size_of::<paint::Stop>());
+        if !charge_attributes(r, attribute_budget, bytes) {
+            fill = Paint::Solid(Color::Gray { v: 0.0, a: 1.0 });
+        }
+    }
+    if attribute_budget.is_some() && objects.get(1).copied().flatten().and_then(|f| paint::descriptor(r, f, world)).is_some_and(|p| p != Paint::None)
+    {
         r.warn("outlined (stroked) text");
     }
     if slot(doubles, 10, float).is_some_and(|h| (h - 1.0).abs() > 1e-3) {
         r.warn("horizontally scaled text");
     }
-    let font = s.obj(attrs, b"DFnt");
-    let get = |tag: &[u8; 4]| font.and_then(|f| s.str(f, tag)).unwrap_or_default().to_string();
+    // A resolved font is populated on the emoji run of the public Affinity 3 text-runs file
+    // (Courier New requested, Segoe UI Emoji stored in RFnt). Empty RFnt records are common.
+    // Source: https://github.com/SethRobinson/Patchy/tree/de84eab550758b30fa062e479f5778cce7693b73/test-fixtures/af
+    let requested = s.obj(attrs, b"DFnt");
+    let resolved =
+        s.obj(attrs, b"RFnt").filter(|f| !s.str(*f, b"Famy").unwrap_or_default().is_empty() || !s.str(*f, b"Post").unwrap_or_default().is_empty());
+    let font = resolved.or(requested);
+    if let Some(resolved) = resolved {
+        let differs = [b"Famy", b"Post"]
+            .iter()
+            .any(|tag| s.str(resolved, tag).unwrap_or_default() != requested.and_then(|f| s.str(f, tag)).unwrap_or_default());
+        if differs {
+            r.warn("text uses a stored fallback font (imported with that font)");
+        }
+    }
+    if font.and_then(|f| s.int(f, b"Widh")).is_some_and(|w| w != 5) {
+        r.warn("font width variants (exact face depends on the installed PostScript font)");
+    }
+    let postscript = metadata_string(r, attribute_budget, font.and_then(|f| s.str(f, b"Post")).unwrap_or_default());
+    let family = metadata_string(r, attribute_budget, font.and_then(|f| s.str(f, b"Famy")).unwrap_or_default());
+    let (features, all_caps) = font_features(r, objects.get(7).copied().flatten(), attribute_budget);
+    let weight = font.and_then(|f| s.int(f, b"Wegt")).unwrap_or(400);
+    let weight = if (1..=1000).contains(&weight) {
+        weight
+    } else {
+        r.warn("invalid font weight (imported as regular)");
+        400
+    };
     TextRun {
         text,
-        postscript: get(b"Post"),
-        family: get(b"Famy"),
-        weight: font.and_then(|f| s.int(f, b"Wegt")).unwrap_or(400),
+        postscript,
+        family,
+        weight,
         italic: font.and_then(|f| s.bool(f, b"Ital")).unwrap_or(false),
+        features,
+        all_caps,
         size,
         tracking,
         leading,
@@ -137,7 +245,70 @@ fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine) -> TextR
     }
 }
 
+fn charge_attributes(r: &mut Reader, budget: &mut Option<usize>, bytes: usize) -> bool {
+    let Some(remaining) = *budget else { return false };
+    match remaining.checked_sub(bytes) {
+        Some(remaining) => {
+            *budget = Some(remaining);
+            true
+        }
+        None => {
+            *budget = None;
+            r.warn("text attribute budget exceeded (excess font names, features and gradients left out)");
+            false
+        }
+    }
+}
+
+fn metadata_string(r: &mut Reader, budget: &mut Option<usize>, value: &str) -> String {
+    let bytes = value.len().saturating_add(std::mem::size_of::<String>());
+    if value.is_empty() || !charge_attributes(r, budget, bytes) { String::new() } else { value.to_owned() }
+}
+
+/// The public Affinity 3 caps fixture stores `smcp` and the private `CAP\x01` selector in
+/// OtAt/Setn. Only the observed all-caps selector and boolean OpenType tags are mapped; other
+/// values are reported, never guessed. Standard tag syntax: https://learn.microsoft.com/en-us/typography/opentype/spec/featuretags
+fn font_features(r: &mut Reader, attrs: Option<ObjId>, attribute_budget: &mut Option<usize>) -> (Vec<String>, bool) {
+    let mut features = Vec::new();
+    let mut all_caps = false;
+    if attribute_budget.is_none() {
+        return (features, all_caps);
+    }
+    let s = r.s;
+    let Some(Value::Array(settings)) = attrs.and_then(|a| s.field(a, b"Setn")) else { return (features, all_caps) };
+    for (index, setting) in settings.iter().take(257).enumerate() {
+        if index == 256 {
+            r.warn("more than 256 text feature settings (truncated)");
+            break;
+        }
+        let Value::Obj(Some(setting)) = setting else {
+            r.warn("unreadable text feature settings (imported with defaults)");
+            continue;
+        };
+        let setting = *setting;
+        let tag = s.int(setting, b"Feat").and_then(|v| u32::try_from(v).ok()).map(u32::to_be_bytes);
+        let value = r.s.int(setting, b"Valu");
+        match (tag, value) {
+            (Some([b'C', b'A', b'P', 1]), Some(0 | 1)) => all_caps = value == Some(1),
+            (Some(tag), Some(value @ (0 | 1))) if tag.iter().all(u8::is_ascii_alphanumeric) => {
+                if !charge_attributes(r, attribute_budget, std::mem::size_of::<String>() + if value == 0 { 5 } else { 4 }) {
+                    break;
+                }
+                let name = String::from_utf8_lossy(&tag);
+                features.push(if value == 0 { format!("-{name}") } else { name.into_owned() });
+            }
+            _ => r.warn("text feature selectors or non-boolean OpenType settings (imported with defaults)"),
+        }
+    }
+    (features, all_caps)
+}
+
 fn paragraph_align(r: &mut Reader, p: ObjId) -> Align {
+    // Nonzero offsets in these slots are present in the public text-indent and text-para-spacing
+    // fixtures. Their layout is not represented by this importer; retain text and report the gap.
+    if (1..=6).any(|i| slot(r.s.field(p, b"Doub"), i, float).is_some_and(|v| v.abs() > 1e-9)) {
+        r.warn("paragraph indents or spacing (imported with defaults)");
+    }
     match slot(r.s.field(p, b"Ints"), 0, int) {
         Some(1) => Align::Center,
         Some(2) => Align::Right,

crates/affinity/tests/outline_limits.rs

@@ -0,0 +1,168 @@
+//! Original synthetic graph tests for bounded `.af` outline expansion. These model the reader's
+//! accepted schema, without using Affinity software, third-party parser code or external assets.
+#![cfg(feature = "synth")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use vectorcraft_affinity::{
+    Document, Limits,
+    model::{Kind, Path, Point},
+    synth::{self, F, Method, tag},
+};
+
+fn compound(id: u32, children: Vec<F>) -> F {
+    F::Def(id, vec![tag(b"Comp")], vec![(tag(b"Chld"), F::Shared(children))])
+}
+
+fn shape(id: u32, class: &[u8; 4], parameters: Vec<(vectorcraft_affinity::stream::Tag, F)>) -> F {
+    F::Def(
+        id,
+        vec![tag(b"ShpN")],
+        vec![(tag(b"ShpB"), F::F64s(vec![0.0, 0.0, 10.0, 20.0])), (tag(b"Shpe"), F::Def(id + 10_000, vec![tag(class)], parameters))],
+    )
+}
+
+fn read(definitions: Vec<F>, top: u32) -> Document {
+    let data = synth::stream(&[
+        (tag(b"Defs"), F::Shared(definitions)),
+        (
+            tag(b"DocR"),
+            F::Def(
+                1,
+                vec![tag(b"DocN")],
+                vec![(
+                    tag(b"Chld"),
+                    F::Shared(vec![F::Def(
+                        2,
+                        vec![tag(b"Sprd")],
+                        vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 400.0, 300.0])), (tag(b"Chld"), F::Shared(vec![F::Ref(top)]))],
+                    )]),
+                )],
+            ),
+        ),
+    ]);
+    let bytes = synth::container(&[("doc.dat", &data, Method::Zlib)], None);
+    vectorcraft_affinity::read(&bytes, Limits::default()).unwrap()
+}
+
+fn path(document: &Document) -> &Path {
+    match &document.spreads[0].nodes[0].kind {
+        Kind::Shape { path, .. } => path,
+        other => panic!("expected shape, got {other:?}"),
+    }
+}
+
+fn rejected(document: &Document, warning: &str) {
+    assert!(matches!(document.spreads[0].nodes[0].kind, Kind::Unsupported));
+    assert!(document.warnings.iter().any(|value| value.contains(warning)), "{:?}", document.warnings);
+}
+
+#[test]
+fn self_cycle_and_mutual_cycle_discard_the_entire_compound() {
+    // A valid first operand ensures a malformed later operand cannot leave a plausible partial path.
+    let rectangle = shape(100, b"ShNR", vec![]);
+    let self_cycle = compound(101, vec![F::Ref(100), F::Ref(101)]);
+    rejected(&read(vec![rectangle.clone(), self_cycle], 101), "compound outline that contains itself");
+    let mutual_cycle = compound(101, vec![F::Ref(100), compound(102, vec![F::Ref(101)])]);
+    rejected(&read(vec![rectangle, mutual_cycle], 101), "compound outline that contains itself");
+}
+
+#[test]
+fn deep_reference_chain_is_bounded_independently_of_stream_nesting() {
+    let mut definitions = vec![shape(100, b"ShNR", vec![])];
+    for id in 101..=250 {
+        definitions.push(compound(id, vec![F::Ref(id - 1)]));
+    }
+    rejected(&read(definitions, 250), "compound outlines nested deeper than 128 levels");
+}
+
+#[test]
+fn outline_at_the_depth_limit_is_still_imported() {
+    let mut definitions = vec![shape(100, b"ShNR", vec![])];
+    for id in 101..=227 {
+        definitions.push(compound(id, vec![F::Ref(id - 1)]));
+    }
+    let document = read(definitions, 227);
+    assert!(document.warnings.is_empty(), "{:?}", document.warnings);
+    assert_eq!(path(&document).subpaths.len(), 1);
+    assert_eq!(path(&document).subpaths[0].segments.len(), 3);
+}
+
+#[test]
+fn excessive_declared_curve_count_is_rejected_before_expansion() {
+    let curve = F::Def(
+        100,
+        vec![tag(b"PCrv")],
+        vec![(tag(b"Crvs"), F::Def(101, vec![tag(b"PCvD")], vec![(tag(b"Data"), F::Pos(vec![F::U8(0), F::U32(u32::MAX)]))]))],
+    );
+    rejected(&read(vec![curve], 100), "compound outlines exceeding the geometry work limit");
+}
+
+#[test]
+fn empty_shared_fanout_cannot_bypass_the_operand_visit_limit() {
+    // Only 21 on-disk objects, but an unbounded traversal would visit over two million operands.
+    let mut definitions = vec![compound(100, vec![])];
+    for id in 101..=120 {
+        definitions.push(compound(id, vec![F::Ref(id - 1), F::Ref(id - 1)]));
+    }
+    rejected(&read(definitions, 120), "compound outlines exceeding the operand visit limit");
+}
+
+#[test]
+fn shared_large_operands_are_charged_for_cumulative_geometry_work() {
+    // A small reference graph expands a 20,000-segment star. Count work across every reuse and
+    // transform, rather than permitting each individual operand's allocation limit repeatedly.
+    let mut definitions = vec![shape(100, b"ShSt", vec![(tag(b"Pnts"), F::I32(10_000))])];
+    for id in 101..=112 {
+        definitions.push(compound(id, vec![F::Ref(id - 1), F::Ref(id - 1)]));
+    }
+    rejected(&read(definitions, 112), "compound outlines exceeding the geometry work limit");
+}
+
+#[test]
+fn ordinary_nested_compound_preserves_repeated_operands_and_transforms() {
+    let mut rectangle = shape(100, b"ShNR", vec![]);
+    if let F::Def(_, _, fields) = &mut rectangle {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 3.0, 0.0, 1.0, 7.0])));
+    }
+    let inner = compound(101, vec![F::Ref(100), F::Ref(100)]);
+    let mut outer = compound(102, vec![F::Ref(101)]);
+    if let F::Def(_, _, fields) = &mut outer {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 100.0, 0.0, 1.0, 200.0])));
+    }
+    let document = read(vec![rectangle, inner, outer], 102);
+    assert!(document.warnings.is_empty(), "{:?}", document.warnings);
+    let path = path(&document);
+    assert_eq!(path.subpaths.len(), 2);
+    assert_eq!(path.subpaths[0], path.subpaths[1]);
+    assert_eq!(path.subpaths[0].start, Point { x: 103.0, y: 207.0 });
+    assert_eq!(path.subpaths[0].segments.last().unwrap()[2], Point { x: 103.0, y: 227.0 });
+}
+
+#[test]
+fn overflowing_compound_transform_is_reported_before_processing_geometry() {
+    let mut child = shape(100, b"ShNR", vec![]);
+    if let F::Def(_, _, fields) = &mut child {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0e308, 0.0, 0.0, 0.0, 1.0, 0.0])));
+    }
+    let mut outer = compound(101, vec![F::Ref(100)]);
+    if let F::Def(_, _, fields) = &mut outer {
+        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0e308, 0.0, 0.0, 0.0, 1.0, 0.0])));
+    }
+    rejected(&read(vec![child, outer], 101), "compound operand with an invalid transform");
+}
+
+#[test]
+fn pie_angles_with_huge_finite_values_do_not_loop_or_emit_nonfinite_points() {
+    let document = read(vec![shape(100, b"ShPi", vec![(tag(b"AngS"), F::F64(1.0e308)), (tag(b"AngE"), F::F64(-1.0e308))])], 100);
+    for subpath in &path(&document).subpaths {
+        assert!(subpath.start.x.is_finite() && subpath.start.y.is_finite());
+        assert!(subpath.segments.len() <= 20);
+        assert!(subpath.segments.iter().flatten().all(|point| point.x.is_finite() && point.y.is_finite()));
+    }
+}
+
+#[test]
+fn wrapped_pie_angles_keep_the_same_geometry_as_the_positive_span() {
+    let make = |end| read(vec![shape(100, b"ShPi", vec![(tag(b"AngS"), F::F64(0.0)), (tag(b"AngE"), F::F64(end))])], 100);
+    assert_eq!(path(&make(-std::f64::consts::FRAC_PI_2)), path(&make(3.0 * std::f64::consts::FRAC_PI_2)));
+}

crates/affinity/tests/raster.rs

@@ -0,0 +1,116 @@
+//! Pixel retention on current Affinity 3 documents published under MIT by Patchy.
+//! Assertions use this reader's archive/stream and the original embedded image bytes;
+//! no third-party Affinity parser, source code or application is used as an oracle.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use vectorcraft_affinity::{
+    Archive, Limits,
+    model::{Affine, Document, Image, Kind, Node, Pixels},
+    stream,
+};
+
+#[path = "support/corpus.rs"]
+mod corpus;
+
+fn images(nodes: &[Node], out: &mut Vec<Image>) {
+    for node in nodes {
+        if let Kind::Image(image) = &node.kind {
+            out.push(image.clone());
+        }
+        images(&node.children, out);
+    }
+}
+
+fn read_fixture(name: &str) -> Option<(Vec<u8>, Document, Vec<Image>)> {
+    let dir = corpus::pinned()?;
+    let bytes = std::fs::read(dir.join(name)).unwrap();
+    let doc = vectorcraft_affinity::read(&bytes, Limits::default()).unwrap();
+    assert!(doc.saved_by.as_deref().unwrap().starts_with("Affinity 3."));
+    let mut out = Vec::new();
+    for spread in &doc.spreads {
+        images(&spread.nodes, &mut out);
+    }
+    Some((bytes, doc, out))
+}
+
+fn source(bytes: &[u8]) -> Vec<u8> {
+    let mut archive = Archive::open(bytes, Limits::default()).unwrap();
+    let doc = stream::parse(&archive.read("doc.dat").unwrap()).unwrap();
+    let bitmap =
+        doc.objects.iter().enumerate().find(|(_, o)| o.class == stream::Tag::of(b"DyBm") && o.get(stream::Tag::of(b"Bckg")).is_some()).unwrap().0;
+    let name = doc.entry(bitmap, b"Bckg").unwrap();
+    let block = stream::parse(&archive.read(name).unwrap()).unwrap();
+    block.bytes(block.root, b"Data").unwrap().to_vec()
+}
+
+#[test]
+fn source_backed_tiles_retain_the_embedded_jpeg_pixels() {
+    let Some((bytes, doc, images)) = read_fixture("patchy-embedded-jpeg.af") else { return };
+    assert!(doc.warnings.is_empty(), "{:?}", doc.warnings);
+    assert_eq!(images.len(), 1);
+    let image = &images[0];
+    assert_eq!((image.width, image.height), (400, 300));
+    assert_eq!(image.transform, Affine::IDENTITY);
+    let Pixels::Rgba8(pixels) = &image.pixels else { panic!("expected retained level-zero pixels") };
+    let expected = image::load_from_memory(&source(&bytes)).unwrap().into_rgba8();
+    assert_eq!(pixels.as_slice(), expected.as_raw());
+    assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 255));
+    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[0] != p[1]));
+}
+
+#[test]
+fn lazy_placed_images_keep_the_original_encoded_bytes() {
+    let Some((bytes, doc, images)) = read_fixture("patchy-lazy-placed.af") else { return };
+    assert!(doc.warnings.is_empty());
+    assert_eq!(images.len(), 1);
+    assert_eq!((images[0].width, images[0].height), (400, 300));
+    assert_eq!(images[0].transform, Affine::IDENTITY);
+    assert_eq!(images[0].pixels, Pixels::Encoded(source(&bytes)));
+}
+
+#[test]
+fn eight_and_sixteen_bit_channels_retain_the_same_pixel_pattern() {
+    let Some((_, doc8, images8)) = read_fixture("patchy-rgba8.af") else { return };
+    let (_, doc16, images16) = read_fixture("patchy-rgba16.af").unwrap();
+    assert!(doc8.warnings.is_empty());
+    assert!(doc16.warnings.is_empty());
+    assert_eq!(images8.len(), 1);
+    assert_eq!(images16, images8);
+    assert_eq!((images8[0].width, images8[0].height), (64, 48));
+    let Pixels::Rgba8(pixels) = &images8[0].pixels else { panic!() };
+    assert_eq!(pixels.len(), 64 * 48 * 4);
+    assert_eq!(&pixels[..4], &[0, 0, 0, 128]);
+    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] < 255));
+    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[0] != p[1]));
+    // Frozen pixel-retention baseline, including every alpha sample. It is not a render oracle.
+    assert_eq!(crc32fast::hash(pixels), 0xc8ee4dc1);
+}
+
+#[test]
+fn rotated_scaled_pixels_keep_the_full_affine_transform() {
+    let Some((_, doc, images)) = read_fixture("patchy-transform.af") else { return };
+    assert!(doc.warnings.is_empty());
+    assert_eq!(images.len(), 1);
+    assert_eq!((images[0].width, images[0].height), (80, 60));
+    let expected = [1.1742158910592235, 0.4286222593193142, -0.4286222593193142, 1.1742158910592235, 60.0, 40.0];
+    for (actual, expected) in images[0].transform.0.into_iter().zip(expected) {
+        assert!((actual - expected).abs() < 1e-12);
+    }
+    let Pixels::Rgba8(pixels) = &images[0].pixels else { panic!() };
+    assert_eq!(pixels.len(), 80 * 60 * 4);
+    assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 255));
+    assert_eq!(crc32fast::hash(pixels), 0x3720a442);
+}
+
+#[test]
+fn cmyk_and_lab_losses_are_reported() {
+    let Some((_, cmyk, images)) = read_fixture("patchy-cmyk.af") else { return };
+    assert_eq!(images.len(), 1);
+    assert_eq!((images[0].width, images[0].height), (64, 48));
+    let Pixels::Rgba8(pixels) = &images[0].pixels else { panic!() };
+    assert_eq!(crc32fast::hash(pixels), 0x5872bb76);
+    assert_eq!(cmyk.warnings, ["CMYK pixel layers (converted to RGB without the document's colour profile)"]);
+    let (_, lab, images) = read_fixture("patchy-lab.af").unwrap();
+    assert!(images.is_empty());
+    assert_eq!(lab.warnings, ["pixel layers in grey, Lab or 32-bit formats"]);
+}

crates/affinity/tests/real_files.rs

@@ -1,28 +1,32 @@
 //! Public Affinity documents: the pinned set `cargo xtask corpus --affinity` fetches into
 //! `corpus/affinity`, or any folder of `.af`/`.afdesign`/`.afphoto`/`.afpub` files named by
-//! `AFFINITY_SAMPLES` (searched recursively). Without either, these tests do nothing.
+//! `AFFINITY_SAMPLES` (searched recursively). CI requires a complete, checksum-verified pinned
+//! corpus via `AFFINITY_CORPUS_REQUIRED=1`; ordinary local runs may skip an absent corpus.
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 use std::path::{Path, PathBuf};
 
 use vectorcraft_affinity::{Archive, Limits, stream};
 
+#[path = "support/corpus.rs"]
+mod corpus;
+#[path = "support/features.rs"]
+mod features;
+
 fn files(dir: &Path, out: &mut Vec<PathBuf>) {
     for e in std::fs::read_dir(dir).into_iter().flatten().flatten() {
         let p = e.path();
         if p.is_dir() {
             files(&p, out);
-        } else if p.extension().and_then(|e| e.to_str()).is_some_and(|e| ["af", "afdesign", "afphoto", "afpub", "aftemplate"].contains(&e))
-            && std::fs::read(&p).is_ok_and(|b| b.starts_with(vectorcraft_affinity::MAGIC))
-        {
+        } else if p.extension().and_then(|e| e.to_str()).is_some_and(|e| ["af", "afdesign", "afphoto", "afpub", "aftemplate"].contains(&e)) {
             out.push(p);
         }
     }
 }
 
 fn samples() -> Option<PathBuf> {
-    let pinned = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
-    std::env::var_os("AFFINITY_SAMPLES").map(PathBuf::from).or_else(|| pinned.join("SOURCES.md").exists().then_some(pinned))
+    let pinned = corpus::pinned();
+    std::env::var_os("AFFINITY_SAMPLES").map(PathBuf::from).or(pinned)
 }
 
 #[test]
@@ -52,6 +56,7 @@ fn public_documents_map_to_the_model() {
     let Some(dir) = samples() else { return };
     let mut paths = Vec::new();
     files(&dir, &mut paths);
+    assert!(!paths.is_empty(), "no Affinity documents under {dir:?}");
     let mut warnings = std::collections::BTreeMap::<String, usize>::new();
     let mut failures = Vec::new();
     let (mut nodes, mut docs) = (0usize, 0usize);
@@ -60,9 +65,6 @@ fn public_documents_map_to_the_model() {
     }
     for p in &paths {
         let bytes = std::fs::read(p).unwrap();
-        if !bytes.starts_with(vectorcraft_affinity::MAGIC) {
-            continue;
-        }
         match vectorcraft_affinity::read(&bytes, Limits::default()) {
             Ok(d) => {
                 docs += 1;
@@ -81,3 +83,33 @@ fn public_documents_map_to_the_model() {
     }
     assert!(failures.is_empty(), "{}", failures.join("\n"));
 }
+
+/// Measured structural baselines for actual Affinity 3 files. Unlike a parse-success test,
+/// this detects disappearing nodes, curves, runs, font names, artboards and loss warnings.
+/// It does not claim that an unsupported feature is faithfully rendered.
+#[test]
+fn affinity3_feature_retention_matches_pinned_signatures() {
+    let Some(dir) = corpus::pinned() else { return };
+    let expected = include_str!("support/affinity3-signatures.txt");
+    let mut checked = std::collections::BTreeSet::new();
+    for line in expected.lines().filter(|l| !l.starts_with('#') && !l.is_empty()) {
+        let (name, signature) = line.split_once('\t').expect("signature row must have a tab");
+        assert!(checked.insert(name), "duplicate fixture {name}");
+        let bytes = std::fs::read(dir.join(name)).unwrap();
+        let doc = vectorcraft_affinity::read(&bytes, Limits::default()).unwrap();
+        assert_eq!(
+            features::signature(&doc),
+            signature,
+            "{name}: imported feature retention changed; review the pinned input and warning changes before updating this baseline"
+        );
+        assert!(
+            doc.saved_by.as_deref().is_some_and(|v| v.starts_with("Affinity 3.")),
+            "{name}: expected an actual Affinity 3 document, got {:?}",
+            doc.saved_by
+        );
+    }
+    let manifest = include_str!("../../../xtask/affinity-corpus.sha256");
+    let af_names: std::collections::BTreeSet<_> =
+        manifest.lines().filter_map(|l| l.split_once("  ")).map(|(_, n)| n).filter(|n| n.ends_with(".af")).collect();
+    assert_eq!(checked, af_names, "every pinned .af file needs a reviewed structural baseline");
+}

crates/affinity/tests/support/affinity3-signatures.txt

@@ -0,0 +1,33 @@
+affinity3-mexican-guy.af	dpi=300;spreads=1;model_crc32=df3c417b;counts={"depth": 8, "fills": 169, "gradients": 0, "groups": 23, "nodes": 283, "opacity": 1, "segments": 1491, "shapes": 260, "strokes": 114, "subpaths": 264};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (114×)", "layer effects (shadows, glows, outlines, bevels…) (156×)"]
+affinity3-mexican-man.af	dpi=300;spreads=1;model_crc32=d0387de4;counts={"depth": 7, "fills": 277, "gradients": 2, "groups": 29, "nodes": 903, "segments": 3225, "shapes": 874, "strokes": 559, "subpaths": 881};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (545×)", "layer effects (shadows, glows, outlines, bevels…) (245×)"]
+affinity3-mexican-woman.af	dpi=300;spreads=1;model_crc32=b966f693;counts={"depth": 9, "fills": 527, "gradients": 0, "groups": 28, "nodes": 595, "segments": 3562, "shapes": 567, "strokes": 60, "subpaths": 570};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (54×)", "layer effects (shadows, glows, outlines, bevels…) (278×)"]
+affinity3-playing-cards.af	dpi=300;spreads=1;model_crc32=ac448123;counts={"depth": 5, "fills": 363, "gradients": 0, "groups": 758, "nodes": 1350, "segments": 4864, "shapes": 592, "strokes": 288, "subpaths": 656};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes)", "layer effects (shadows, glows, outlines, bevels…) (339×)"]
+patchy-adjust-curves.af	dpi=72;spreads=1;model_crc32=10a37502;counts={"depth": 1, "images": 1, "nodes": 2, "unsupported": 1};boards=[];fonts={};warnings=["adjustment layers"]
+patchy-adjust-hsl.af	dpi=72;spreads=1;model_crc32=c65409b4;counts={"depth": 1, "images": 1, "nodes": 2, "unsupported": 1};boards=[];fonts={};warnings=["adjustment layers"]
+patchy-artboards.af	dpi=72;spreads=1;model_crc32=f1ae5644;counts={"artboards": 2, "depth": 2, "fills": 2, "gradients": 0, "nodes": 4, "segments": 7, "shapes": 2, "strokes": 0, "subpaths": 2};boards=["board-a:0.0000,0.0000,80.0000,60.0000", "board-b:100.0000,10.0000,160.0000,70.0000"];fonts={};warnings=[]
+patchy-blend-affinity.af	dpi=72;spreads=1;model_crc32=f6691ff9;counts={"depth": 2, "fills": 8, "gradients": 0, "images": 1, "layers": 1, "nodes": 10, "segments": 24, "shapes": 8, "strokes": 0, "subpaths": 8};boards=[];fonts={};warnings=["an unknown blend mode (imported as Normal) (2×)"]
+patchy-cmyk.af	dpi=72;spreads=1;model_crc32=5145b5a1;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=["CMYK pixel layers (converted to RGB without the document's colour profile)"]
+patchy-dpi300.af	dpi=300;spreads=1;model_crc32=0c23e7c8;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-embedded-jpeg.af	dpi=72;spreads=1;model_crc32=090c674b;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-fx-blur.af	dpi=72;spreads=1;model_crc32=3f1b8b44;counts={"depth": 1, "images": 2, "nodes": 2};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (2×)"]
+patchy-fx-gradient.af	dpi=72;spreads=1;model_crc32=e868c992;counts={"depth": 1, "images": 3, "nodes": 3};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (3×)"]
+patchy-fx.af	dpi=72;spreads=1;model_crc32=5a1c34ac;counts={"depth": 1, "images": 5, "nodes": 5};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (5×)"]
+patchy-group.af	dpi=72;spreads=1;model_crc32=c217ab38;counts={"depth": 2, "images": 3, "layers": 1, "nodes": 4};boards=[];fonts={};warnings=[]
+patchy-incremental-chain.af	dpi=72;spreads=1;model_crc32=63ad778e;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…)"]
+patchy-lab.af	dpi=72;spreads=1;model_crc32=01e8a926;counts={"depth": 1, "nodes": 1, "unsupported": 1};boards=[];fonts={};warnings=["pixel layers in grey, Lab or 32-bit formats"]
+patchy-lazy-placed.af	dpi=72;spreads=1;model_crc32=9ce9937e;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-live-filter.af	dpi=72;spreads=1;model_crc32=30c5f8ee;counts={"depth": 2, "fills": 2, "gradients": 0, "nodes": 4, "segments": 6, "shapes": 2, "strokes": 0, "subpaths": 2, "unsupported": 2};boards=[];fonts={};warnings=["adjustment layers", "unknown layers"]
+patchy-rgba16.af	dpi=72;spreads=1;model_crc32=1bb23571;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-rgba8.af	dpi=72;spreads=1;model_crc32=1bb23571;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-shapes-2.af	dpi=72;spreads=1;model_crc32=7828d3cd;counts={"depth": 1, "fills": 12, "gradients": 0, "nodes": 12, "segments": 62, "shapes": 12, "strokes": 0, "subpaths": 12};boards=[];fonts={};warnings=["cloud, heart, cog, callout, arrow, tear and other special shapes (imported as their bounding ellipse) (9×)"]
+patchy-shapes.af	dpi=72;spreads=1;model_crc32=e127e129;counts={"depth": 1, "fills": 4, "gradients": 0, "nodes": 4, "segments": 29, "shapes": 4, "strokes": 0, "subpaths": 4};boards=[];fonts={};warnings=["rectangles with straight, concave or other corner types (imported with round corners)"]
+patchy-text-artistic.af	dpi=72;spreads=1;model_crc32=b6137f6e;counts={"depth": 1, "nodes": 1, "text_chars": 5, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialMT:400:false"};warnings=[]
+patchy-text-caps.af	dpi=72;spreads=1;model_crc32=b5527e72;counts={"depth": 1, "nodes": 2, "text_chars": 21, "text_runs": 2, "texts": 2};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font) (2×)"]
+patchy-text-frame.af	dpi=72;spreads=1;model_crc32=7a2cd32d;counts={"depth": 1, "nodes": 1, "text_chars": 11, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialMT:400:false"};warnings=["paragraph indents or spacing (imported with defaults)"]
+patchy-text-indent.af	dpi=72;spreads=1;model_crc32=30ee834c;counts={"depth": 1, "nodes": 2, "text_chars": 104, "text_runs": 2, "texts": 2};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font) (2×)", "paragraph indents or spacing (imported with defaults) (2×)"]
+patchy-text-para-spacing.af	dpi=72;spreads=1;model_crc32=3d580ad2;counts={"depth": 1, "nodes": 1, "text_chars": 13, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)", "paragraph indents or spacing (imported with defaults)"]
+patchy-text-rotated.af	dpi=72;spreads=1;model_crc32=ad77772a;counts={"depth": 1, "nodes": 1, "text_chars": 7, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)"]
+patchy-text-runs.af	dpi=72;spreads=1;model_crc32=a8da3052;counts={"depth": 1, "nodes": 1, "text_chars": 7, "text_runs": 5, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false", "Courier New:CourierNewPSMT:400:false", "Segoe UI Emoji:SegoeUIEmoji:400:false", "Times New Roman:TimesNewRomanPSMT:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)", "paragraph indents or spacing (imported with defaults)", "text uses a stored fallback font (imported with that font)"]
+patchy-transform.af	dpi=72;spreads=1;model_crc32=f8807611;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
+patchy-vector-mask.af	dpi=72;spreads=1;model_crc32=1851fd90;counts={"depth": 1, "fills": 2, "gradients": 0, "nodes": 2, "segments": 7, "shapes": 2, "strokes": 0, "subpaths": 2, "vector_masks": 1};boards=[];fonts={};warnings=["unknown layers attached to other layers (imported without them)"]
+patchy-vector.af	dpi=72;spreads=1;model_crc32=b89a91d3;counts={"depth": 1, "fills": 3, "gradients": 0, "nodes": 4, "segments": 17, "shapes": 4, "strokes": 2, "subpaths": 5};boards=[];fonts={};warnings=[]

crates/affinity/tests/support/corpus.rs

@@ -0,0 +1,30 @@
+//! Shared pinned corpus gate: an installed corpus must be complete and unmodified.
+#![allow(dead_code)]
+
+use std::path::PathBuf;
+
+#[path = "../../../../xtask/src/sha256.rs"]
+mod sha256;
+
+pub fn pinned() -> Option<PathBuf> {
+    // This helper is compiled in both affinity and engine integration tests.
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
+    let required = std::env::var_os("AFFINITY_CORPUS_REQUIRED").is_some_and(|v| v != "0");
+    if !dir.exists() {
+        assert!(!required, "required Affinity corpus absent: run `cargo xtask corpus --affinity`");
+        eprintln!("Affinity corpus absent: run `cargo xtask corpus --affinity` (CI sets AFFINITY_CORPUS_REQUIRED=1)");
+        return None;
+    }
+    assert!(dir.join("SOURCES.md").is_file(), "incomplete Affinity corpus: missing SOURCES.md; run `cargo xtask corpus --affinity`");
+    let manifest = include_str!("../../../../xtask/affinity-corpus.sha256");
+    let mut count = 0;
+    for line in manifest.lines().filter(|l| !l.trim().is_empty()) {
+        let (digest, name) = line.split_once("  ").expect("malformed pinned Affinity SHA256 manifest");
+        assert_eq!(digest.len(), 64, "invalid SHA256 for {name}");
+        let bytes = std::fs::read(dir.join(name)).unwrap_or_else(|e| panic!("missing pinned Affinity file {name}: {e}"));
+        assert_eq!(sha256::hex(&bytes), digest, "{name}: pinned corpus modified; run `cargo xtask corpus --affinity`");
+        count += 1;
+    }
+    assert!(count >= 4, "pinned Affinity manifest must include the four Affinity 3 .af fixtures");
+    Some(dir)
+}

crates/affinity/tests/support/features.rs

@@ -0,0 +1,63 @@
+//! Structural regression signatures, measured from the pinned files through our own reader.
+//! These freeze feature retention; they are not independent visual or compatibility oracles.
+//! The model CRC covers every decoded field via its Debug representation (including paths,
+//! paint, masks, image pixels and text runs). A deliberate reader/Debug change needs review;
+//! input authenticity is independently checked with SHA256 by the corpus gate.
+use std::collections::{BTreeMap, BTreeSet};
+use vectorcraft_affinity::model::{Document, Kind, Node};
+use vectorcraft_affinity::paint::Paint;
+
+pub fn signature(doc: &Document) -> String {
+    fn visit(nodes: &[Node], counts: &mut BTreeMap<&'static str, usize>, fonts: &mut BTreeSet<String>, boards: &mut Vec<String>, depth: usize) {
+        for n in nodes {
+            *counts.entry("nodes").or_default() += 1;
+            counts.entry("depth").and_modify(|v| *v = (*v).max(depth)).or_insert(depth);
+            let key = match &n.kind {
+                Kind::Layer => "layers",
+                Kind::Group => "groups",
+                Kind::Artboard { rect, .. } => {
+                    boards.push(format!("{}:{:.4},{:.4},{:.4},{:.4}", n.name, rect.x0, rect.y0, rect.x1, rect.y1));
+                    "artboards"
+                }
+                Kind::Shape { path, fills, strokes, .. } => {
+                    *counts.entry("subpaths").or_default() += path.subpaths.len();
+                    *counts.entry("segments").or_default() += path.subpaths.iter().map(|p| p.segments.len()).sum::<usize>();
+                    *counts.entry("fills").or_default() += fills.len();
+                    *counts.entry("strokes").or_default() += strokes.len();
+                    *counts.entry("gradients").or_default() += fills.iter().filter(|p| matches!(p, Paint::Gradient(_))).count();
+                    "shapes"
+                }
+                Kind::Text(t) => {
+                    *counts.entry("text_runs").or_default() += t.runs.len();
+                    *counts.entry("text_chars").or_default() += t.runs.iter().map(|r| r.text.chars().count()).sum::<usize>();
+                    for r in &t.runs {
+                        fonts.insert(format!("{}:{}:{}:{}", r.family, r.postscript, r.weight, r.italic));
+                    }
+                    "texts"
+                }
+                Kind::Image(_) => "images",
+                Kind::Unsupported => "unsupported",
+            };
+            *counts.entry(key).or_default() += 1;
+            for (key, yes) in
+                [("hidden", !n.visible), ("vector_masks", n.mask.is_some()), ("pixel_masks", n.pixel_mask.is_some()), ("opacity", n.opacity < 1.0)]
+            {
+                if yes {
+                    *counts.entry(key).or_default() += 1;
+                }
+            }
+            visit(&n.children, counts, fonts, boards, depth + 1);
+        }
+    }
+    let (mut counts, mut fonts, mut boards) = (BTreeMap::new(), BTreeSet::new(), Vec::new());
+    for spread in &doc.spreads {
+        visit(&spread.nodes, &mut counts, &mut fonts, &mut boards, 1);
+    }
+    let model_crc32 = crc32fast::hash(format!("{:?}", doc.spreads).as_bytes());
+    format!(
+        "dpi={};spreads={};model_crc32={model_crc32:08x};counts={counts:?};boards={boards:?};fonts={fonts:?};warnings={:?}",
+        doc.dpi,
+        doc.spreads.len(),
+        doc.warnings
+    )
+}

crates/affinity/tests/support/text_fixture.rs

@@ -0,0 +1,170 @@
+//! Original synthetic reader fixtures, shared by native and engine regression tests.
+//! These describe the reader's existing schema; no Affinity software or third-party parser was
+//! used to create them. They prove recovery/mapping behavior, not Affinity's layout or exporter.
+#![allow(dead_code)]
+
+use vectorcraft_affinity::synth::{self, F, Method, tag};
+
+pub fn array_f64(field: &[u8; 4], values: &[f64]) -> F {
+    let mut bytes = vec![0x8a];
+    bytes.extend(tag(field).0.to_le_bytes());
+    bytes.extend((values.len() as u32).to_le_bytes());
+    bytes.extend(values.iter().flat_map(|v| v.to_le_bytes()));
+    F::Raw(bytes)
+}
+
+pub fn array_i32(field: &[u8; 4], values: &[i32]) -> F {
+    let mut bytes = vec![0x87];
+    bytes.extend(tag(field).0.to_le_bytes());
+    bytes.extend((values.len() as u32).to_le_bytes());
+    bytes.extend(values.iter().flat_map(|v| v.to_le_bytes()));
+    F::Raw(bytes)
+}
+
+pub fn solid(alpha: f32) -> F {
+    F::Obj(
+        tag(b"FilS"),
+        vec![(
+            tag(b"Colr"),
+            F::Obj(tag(b"RGBA"), vec![(tag(b"_col"), F::Struct([0.2f32, 0.4, 0.6, alpha].iter().flat_map(|v| v.to_le_bytes()).collect()))]),
+        )],
+    )
+}
+
+pub fn attrs(family: &str, postscript: &str, weight: i32, italic: bool, size: f64) -> F {
+    let mut doubles = vec![0.0; 14];
+    doubles[0] = size;
+    doubles[4] = 0.025;
+    doubles[10] = 1.0;
+    doubles[13] = 30.0;
+    F::Obj(
+        tag(b"GAtt"),
+        vec![
+            (
+                tag(b"DFnt"),
+                F::Obj(
+                    tag(b"Font"),
+                    vec![
+                        (tag(b"Famy"), F::Str(family.into())),
+                        (tag(b"Post"), F::Str(postscript.into())),
+                        (tag(b"Wegt"), F::I32(weight)),
+                        (tag(b"Ital"), F::Bool(italic)),
+                    ],
+                ),
+            ),
+            (tag(b"Doub"), array_f64(b"Doub", &doubles)),
+            (tag(b"Ints"), array_i32(b"Ints", &[0, 0, 0, 0, 1])),
+            (tag(b"Objs"), F::Shared(vec![solid(1.0)])),
+        ],
+    )
+}
+
+pub fn run(end: i32, attrs: Option<F>) -> Vec<(vectorcraft_affinity::stream::Tag, F)> {
+    let mut fields = vec![(tag(b"Indx"), F::I32(end))];
+    if let Some(attrs) = attrs {
+        fields.push((tag(b"Item"), attrs));
+    }
+    fields
+}
+
+pub fn block(glyphs: F, runs: Vec<Vec<(vectorcraft_affinity::stream::Tag, F)>>, alignments: &[i32]) -> F {
+    F::Obj(
+        tag(b"StBl"),
+        vec![
+            (tag(b"Glyp"), glyphs),
+            (tag(b"GAtt"), F::Obj(tag(b"GlAS"), vec![(tag(b"Runs"), F::Objs(tag(b"GlAR"), runs))])),
+            (
+                tag(b"PAtt"),
+                F::Obj(
+                    tag(b"PaAS"),
+                    vec![(
+                        tag(b"Runs"),
+                        F::Objs(
+                            tag(b"PaAR"),
+                            alignments
+                                .iter()
+                                .map(|a| vec![(tag(b"Item"), F::Obj(tag(b"PAtt"), vec![(tag(b"Ints"), array_i32(b"Ints", &[*a]))]))])
+                                .collect(),
+                        ),
+                    )],
+                ),
+            ),
+        ],
+    )
+}
+
+pub fn utf8(text: &str) -> F {
+    F::Obj(tag(b"GStr"), vec![(tag(b"Utf8"), F::Str(text.into()))])
+}
+
+pub fn document(blocks: Vec<F>, frame: bool, dpi: f64, transform: [f64; 6]) -> Vec<u8> {
+    let text = F::Obj(
+        tag(if frame { b"TxtF" } else { b"TxtA" }),
+        vec![
+            (tag(b"StSt"), F::Obj(tag(b"Stry"), vec![(tag(b"Blok"), F::Shared(blocks))])),
+            (
+                tag(b"TxtH"),
+                F::Obj(
+                    tag(if frame { b"FrFr" } else { b"ArFr" }),
+                    vec![(tag(b"FrmB"), F::F64s(vec![10.0, 20.0, 210.0, 120.0])), (tag(b"ArtV"), F::F64(18.0))],
+                ),
+            ),
+            (tag(b"Xfrm"), F::F64s(transform.to_vec())),
+        ],
+    );
+    let mut root = vec![
+        (tag(b"UVCn"), F::Obj(tag(b"UVCn"), vec![(tag(b"UPPI"), F::F64(dpi))])),
+        (
+            tag(b"DocR"),
+            F::Obj(
+                tag(b"DocN"),
+                vec![(
+                    tag(b"Chld"),
+                    F::Shared(vec![F::Obj(
+                        tag(b"Sprd"),
+                        vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 400.0, 300.0])), (tag(b"Chld"), F::Shared(vec![text]))],
+                    )]),
+                )],
+            ),
+        ),
+    ];
+    let mut next_id = 1000;
+    for (_, value) in &mut root {
+        shared_objects(value, &mut next_id);
+    }
+    let stream = synth::stream(&root);
+    synth::container(&[("doc.dat", &stream, Method::Zlib)], None)
+}
+
+pub const IDENTITY: [f64; 6] = [1.0, 0.0, 0.0, 0.0, 1.0, 0.0];
+
+// Shared arrays require definitions/references, whereas inline fields use Obj. Give the original
+// fixture objects independent shared IDs without making the fixture descriptions noisy.
+fn shared_objects(value: &mut F, next_id: &mut u32) {
+    match value {
+        F::Shared(items) => {
+            for item in items {
+                if let F::Obj(class, fields) = item {
+                    let class = *class;
+                    let fields = std::mem::take(fields);
+                    *next_id += 1;
+                    *item = F::Def(*next_id, vec![class], fields);
+                }
+                shared_objects(item, next_id);
+            }
+        }
+        F::Obj(_, fields) | F::Def(_, _, fields) => {
+            for (_, value) in fields {
+                shared_objects(value, next_id);
+            }
+        }
+        F::Objs(_, items) => {
+            for fields in items {
+                for (_, value) in fields {
+                    shared_objects(value, next_id);
+                }
+            }
+        }
+        _ => {}
+    }
+}

crates/affinity/tests/text.rs

@@ -0,0 +1,322 @@
+//! Synthetic `.af` version-12 text regression oracles; see support/text_fixture.rs for provenance.
+//! Unicode ranges below test the scalar-index contract corroborated by the pinned Affinity 3
+//! mixed-run fixture. Broad complex typography still needs independent visual validation.
+#![cfg(feature = "synth")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+mod support {
+    pub mod corpus;
+    pub mod text_fixture;
+}
+use support::text_fixture::*;
+use vectorcraft_affinity::{
+    Document, Limits,
+    model::{Align, Kind, Text},
+    paint::{Color, Paint},
+    synth::{F, tag},
+};
+
+fn read(blocks: Vec<F>) -> Document {
+    vectorcraft_affinity::read(&document(blocks, false, 96.0, IDENTITY), Limits::default()).unwrap()
+}
+fn text(d: &Document) -> &Text {
+    match &d.spreads[0].nodes[0].kind {
+        Kind::Text(t) => t,
+        other => panic!("expected text, got {other:?}"),
+    }
+}
+fn content(t: &Text) -> String {
+    t.runs.iter().map(|r| r.text.as_str()).collect()
+}
+fn warning(d: &Document, needle: &str) -> bool {
+    d.warnings.iter().any(|w| w.contains(needle))
+}
+
+#[test]
+fn mixed_fonts_keep_unicode_and_attribute_boundaries() {
+    let d = read(vec![block(
+        utf8("Aé😀e\u{301}אב日本\u{2028}x\u{2029}\0"),
+        vec![
+            run(3, Some(attrs("Family One", "FamilyOne-Regular", 400, false, 16.0))),
+            run(9, Some(attrs("Family Two", "FamilyTwo-BoldItalic", 700, true, 24.0))),
+            run(13, Some(attrs("Family Three", "FamilyThree-Light", 300, false, 20.0))),
+        ],
+        &[1],
+    )]);
+    let t = text(&d);
+    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["Aé😀", "e\u{301}אב日本", "\u{2028}x\u{2029}"]);
+    assert_eq!(content(t), "Aé😀e\u{301}אב日本\u{2028}x\u{2029}");
+    assert_eq!(
+        (t.runs[1].family.as_str(), t.runs[1].postscript.as_str(), t.runs[1].weight, t.runs[1].italic),
+        ("Family Two", "FamilyTwo-BoldItalic", 700, true)
+    );
+    assert_eq!((t.runs[1].size, t.runs[1].tracking, t.runs[1].leading), (24.0, 0.025, Some(30.0)));
+    assert!(matches!(t.runs[1].fill, Paint::Solid(Color::Rgb { a: 1.0, .. })));
+    assert_eq!(t.align, Align::Center);
+    assert_eq!((t.anchor.x, t.anchor.y), (110.0, 38.0));
+    assert!(d.warnings.is_empty(), "{:?}", d.warnings);
+}
+
+#[test]
+fn missing_attributes_and_uncovered_tail_preserve_characters() {
+    for runs in [vec![], vec![run(2, None)], vec![run(2, Some(attrs("First", "", 400, false, 14.0)))]] {
+        let d = read(vec![block(utf8("é😀 tail\0"), runs, &[])]);
+        assert_eq!(content(text(&d)), "é😀 tail");
+        assert!(warning(&d, "text without character attributes"));
+        assert!(matches!(text(&d).runs.last().unwrap().fill, Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })));
+        assert_eq!(text(&d).runs.last().unwrap().size, 16.0); // Recovery default: 12 pt at 96 dpi.
+    }
+}
+
+#[test]
+fn malformed_ranges_do_not_discard_the_story() {
+    let mut missing = run(1, None);
+    missing.clear();
+    let d = read(vec![block(
+        utf8("abcdef"),
+        vec![missing, run(-1, None), run(3, Some(attrs("First", "", 400, false, 10.0))), run(2, None), run(i32::MAX, None)],
+        &[],
+    )]);
+    assert_eq!(content(text(&d)), "abcdef");
+    assert_eq!(text(&d).runs[0].text, "abc");
+    assert!(warning(&d, "invalid text attribute range"));
+}
+
+#[test]
+fn inline_fields_count_for_ranges_but_are_reported_and_omitted() {
+    let glyphs = F::Obj(
+        tag(b"GStr"),
+        vec![(
+            tag(b"Mixd"),
+            F::Objs(
+                tag(b"MixS"),
+                vec![
+                    vec![(tag(b"Glys"), F::Shared(vec![F::Obj(tag(b"FldN"), vec![])])), (tag(b"Utf8"), F::Str("é😀".into()))],
+                    vec![(tag(b"Utf8"), F::Str("尾\0".into()))],
+                ],
+            ),
+        )],
+    );
+    let d =
+        read(vec![block(glyphs, vec![run(3, Some(attrs("First", "", 400, false, 10.0))), run(5, Some(attrs("Second", "", 700, false, 15.0)))], &[])]);
+    assert_eq!(text(&d).runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["é😀", "尾"]);
+    assert!(warning(&d, "text fields such as page numbers"));
+}
+
+#[test]
+fn mixed_paragraph_alignments_are_explicitly_reported() {
+    let d = read(vec![block(utf8("one\u{2029}"), vec![run(4, None)], &[2]), block(utf8("two"), vec![run(3, None)], &[0, 1])]);
+    assert_eq!(content(text(&d)), "one\u{2029}two");
+    assert_eq!(text(&d).align, Align::Right);
+    assert!(warning(&d, "mixed paragraph alignments"));
+}
+
+#[test]
+fn unknown_alignment_and_invalid_font_weight_have_honest_fallbacks() {
+    let d = read(vec![block(utf8("test"), vec![run(4, Some(attrs("", "OnlyPostScript", -50, true, f64::NAN)))], &[99])]);
+    assert_eq!((text(&d).runs[0].weight, text(&d).runs[0].size), (400, 16.0));
+    assert_eq!(text(&d).align, Align::Left);
+    assert!(warning(&d, "invalid font weight"));
+    assert!(warning(&d, "unknown paragraph alignment"));
+}
+
+#[test]
+fn unreadable_block_does_not_remove_later_readable_text() {
+    let d = read(vec![F::Obj(tag(b"StBl"), vec![]), block(utf8("still here"), vec![], &[])]);
+    assert_eq!(content(text(&d)), "still here");
+    assert!(warning(&d, "a text block without readable characters"));
+}
+
+#[test]
+fn text_budget_preserves_prefix_and_reports_truncation() {
+    let d = read(vec![block(utf8(&"é".repeat((1 << 20) + 1)), vec![], &[]), block(utf8("later"), vec![], &[])]);
+    assert_eq!(content(text(&d)).chars().count(), 1 << 20);
+    assert!(content(text(&d)).chars().all(|c| c == 'é'));
+    assert!(warning(&d, "text longer than a million characters"));
+}
+
+#[test]
+fn boolean_opentype_and_observed_all_caps_selector_are_kept() {
+    let mut a = attrs("Family", "", 400, false, 12.0);
+    let settings = F::Obj(
+        tag(b"OtAt"),
+        vec![(
+            tag(b"Setn"),
+            F::Objs(
+                tag(b"OTFS"),
+                vec![
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))],
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"liga"))), (tag(b"Valu"), F::I32(0))],
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"CAP\x01"))), (tag(b"Valu"), F::I32(1))],
+                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"salt"))), (tag(b"Valu"), F::I32(2))],
+                ],
+            ),
+        )],
+    );
+    if let F::Obj(_, fields) = &mut a {
+        let objects = fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap();
+        objects.1 = F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
+    }
+    let d = read(vec![block(utf8("Mixed"), vec![run(5, Some(a))], &[])]);
+    assert_eq!(text(&d).runs[0].features, ["smcp", "-liga"]);
+    assert!(text(&d).runs[0].all_caps);
+    assert_eq!(content(text(&d)), "Mixed");
+    assert!(warning(&d, "non-boolean OpenType settings"));
+}
+
+#[test]
+fn stored_fallback_font_is_used_only_when_it_names_a_font() {
+    for (family, expected) in [("", "Requested"), ("Emoji Family", "Emoji Family")] {
+        let mut a = attrs("Requested", "RequestedPS", 700, true, 12.0);
+        if let F::Obj(_, fields) = &mut a {
+            fields.push((tag(b"RFnt"), F::Obj(tag(b"Font"), vec![(tag(b"Famy"), F::Str(family.into())), (tag(b"Wegt"), F::I32(400))])));
+        }
+        let d = read(vec![block(utf8("😀"), vec![run(1, Some(a))], &[])]);
+        assert_eq!(text(&d).runs[0].family, expected);
+        assert_eq!(warning(&d, "stored fallback font"), !family.is_empty());
+    }
+}
+
+#[test]
+fn real_affinity3_text_fixtures_confirm_unicode_and_caps_fields() {
+    let Some(corpus) = support::corpus::pinned() else { return };
+    // Files fetched at the commit and sha256 in xtask/affinity-corpus.sha256. No Patchy parser
+    // source was read; assertions describe this crate's parsing of its published MIT documents.
+    let load = |name: &str| vectorcraft_affinity::read(&std::fs::read(corpus.join(name)).unwrap(), Limits::default()).unwrap();
+    let d = load("patchy-text-runs.af");
+    let t = text(&d);
+    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["AB", "cd", "É", "😀", "X"]);
+    assert_eq!(t.runs[3].family, "Segoe UI Emoji");
+    assert_eq!(t.runs[4].family, "Courier New");
+    assert!(warning(&d, "stored fallback font"));
+    let d = load("patchy-text-caps.af");
+    let texts: Vec<_> = d.spreads[0].nodes.iter().filter_map(|n| if let Kind::Text(t) = &n.kind { Some(t) } else { None }).collect();
+    assert_eq!(texts.len(), 2);
+    assert!(texts[0].runs[0].all_caps);
+    assert_eq!(texts[1].runs[0].features, ["smcp"]);
+    for name in ["patchy-text-indent.af", "patchy-text-para-spacing.af"] {
+        let d = load(name);
+        assert!(warning(&d, "paragraph indents or spacing"), "{name}: {:?}", d.warnings);
+    }
+}
+
+proptest::proptest! {
+    #![proptest_config(proptest::test_runner::Config::with_cases(64))]
+    #[test]
+    fn arbitrary_unicode_survives_damaged_attribute_ranges(
+        chars in proptest::collection::vec(proptest::prelude::any::<char>(), 0..128),
+        ends in proptest::collection::vec(-10i32..200, 0..32),
+    ) {
+        let original: String = chars.into_iter().collect();
+        let expected: String = original.chars().filter(|c| *c != '\0' && *c != '\u{FFFC}').collect();
+        let d = read(vec![block(utf8(&original), ends.into_iter().map(|end| run(end, None)).collect(), &[])]);
+        proptest::prop_assert_eq!(content(text(&d)), expected);
+    }
+}
+
+#[test]
+fn partially_missing_attributes_use_visible_fill_but_explicit_no_fill_is_kept() {
+    let empty = F::Obj(tag(b"GAtt"), vec![]);
+    let none = F::Obj(tag(b"GAtt"), vec![(tag(b"Objs"), F::Shared(vec![F::Obj(tag(b"FilN"), vec![])]))]);
+    let d = read(vec![block(utf8("ab"), vec![run(1, Some(empty)), run(2, Some(none))], &[])]);
+    assert!(matches!(text(&d).runs[0].fill, Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })));
+    assert_eq!(text(&d).runs[1].fill, Paint::None);
+    assert_eq!(content(text(&d)), "ab");
+    assert!(warning(&d, "without readable fill attributes"));
+}
+
+#[test]
+fn excessive_feature_settings_are_bounded_and_reported() {
+    let mut a = attrs("Family", "", 400, false, 12.0);
+    if let F::Obj(_, fields) = &mut a {
+        let settings = F::Obj(
+            tag(b"OtAt"),
+            vec![(
+                tag(b"Setn"),
+                F::Objs(
+                    tag(b"OTFS"),
+                    (0..257).map(|_| vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))]).collect(),
+                ),
+            )],
+        );
+        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 =
+            F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
+    }
+    let d = read(vec![block(utf8("x"), vec![run(1, Some(a))], &[])]);
+    assert_eq!(text(&d).runs[0].features.len(), 256);
+    assert!(warning(&d, "more than 256 text feature settings"));
+}
+
+#[test]
+fn shared_font_metadata_amplification_is_bounded_without_losing_characters() {
+    let mut a = attrs(&"F".repeat(16 * 1024), &"P".repeat(16 * 1024), 400, false, 12.0);
+    if let F::Obj(_, fields) = &mut a {
+        let settings = F::Obj(
+            tag(b"OtAt"),
+            vec![(
+                tag(b"Setn"),
+                F::Objs(
+                    tag(b"OTFS"),
+                    (0..256).map(|_| vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))]).collect(),
+                ),
+            )],
+        );
+        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 =
+            F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
+    }
+    let F::Obj(class, fields) = a else { panic!("attributes must be an object") };
+    let mut runs = vec![run(1, Some(F::Def(42, vec![class], fields)))];
+    runs.extend((2..=1000).map(|end| run(end, Some(F::Ref(42)))));
+    let d = read(vec![block(utf8(&"x".repeat(1000)), runs, &[])]);
+    let t = text(&d);
+    assert_eq!(content(t), "x".repeat(1000));
+    assert_eq!(t.runs.len(), 1000);
+    let metadata: usize = t
+        .runs
+        .iter()
+        .flat_map(|r| [&r.family, &r.postscript].into_iter().chain(r.features.iter()))
+        .filter(|s| !s.is_empty())
+        .map(|s| s.len() + std::mem::size_of::<String>())
+        .sum();
+    assert!(metadata <= 16 << 20, "shared metadata was amplified to {metadata} bytes");
+    assert_eq!(t.runs[0].family.len(), 16 * 1024);
+    assert_eq!(t.runs[0].features.len(), 256);
+    assert!(t.runs.last().unwrap().family.is_empty());
+    assert!(t.runs.last().unwrap().features.is_empty());
+    assert!(warning(&d, "text attribute budget exceeded"));
+}
+
+#[test]
+fn shared_gradient_attributes_are_bounded_without_losing_characters() {
+    let color =
+        F::Def(43, vec![tag(b"RGBA")], vec![(tag(b"_col"), F::Struct([0.2f32, 0.4, 0.6, 1.0].iter().flat_map(|v| v.to_le_bytes()).collect()))]);
+    let mut colors = vec![color];
+    colors.extend((1..1024).map(|_| F::Ref(43)));
+    let positions = (0..1024).map(|i| [(i as f32) / 1023.0, 0.5].iter().flat_map(|v| v.to_le_bytes()).collect()).collect();
+    let gradient = F::Obj(
+        tag(b"FilG"),
+        vec![(tag(b"Grad"), F::Obj(tag(b"Grad"), vec![(tag(b"Cols"), F::Shared(colors)), (tag(b"Posn"), F::Records(8, positions))]))],
+    );
+    let attrs = F::Def(42, vec![tag(b"GAtt")], vec![(tag(b"Objs"), F::Shared(vec![gradient]))]);
+    let mut runs = vec![run(1, Some(attrs))];
+    runs.extend((2..=1000).map(|end| run(end, Some(F::Ref(42)))));
+    let d = read(vec![block(utf8(&"x".repeat(1000)), runs, &[])]);
+    let t = text(&d);
+    assert_eq!(content(t), "x".repeat(1000));
+    assert_eq!(t.runs.len(), 1000);
+    let stop_count: usize = t
+        .runs
+        .iter()
+        .map(|r| match &r.fill {
+            Paint::Gradient(g) => g.stops.len(),
+            _ => 0,
+        })
+        .sum();
+    assert!(stop_count > 0);
+    assert!(stop_count * std::mem::size_of::<vectorcraft_affinity::paint::Stop>() <= 16 << 20);
+    let Paint::Gradient(first) = &t.runs[0].fill else { panic!("first gradient must fit") };
+    assert_eq!(first.stops.len(), 1024);
+    assert!(matches!(t.runs.last().unwrap().fill, Paint::Solid(_)));
+    assert!(warning(&d, "text attribute budget exceeded"));
+    assert!(!warning(&d, "text without character attributes"), "budget recovery must not claim source attributes are absent");
+}

crates/doc/src/clipnest.rs

@@ -21,8 +21,6 @@ pub struct Clip {
     pub id: u32,
     /// The region and its rule; `None` for a plain group.
     pub region: Option<(BezPath, FillRule)>,
-    /// The group is hidden (its art is in it, not shown).
-    pub hidden: bool,
 }
 
 /// Deepest nesting of clips, and of groups, an importer records ([`nest`] goes one level deeper
@@ -80,7 +78,5 @@ fn clip_group(doc: &mut Document, c: &Clip, items: Drawn, depth: usize) -> Arc<N
         children.push(Arc::new(path));
     }
     children.extend(nest_at(doc, items, depth + 1));
-    let mut group = Node::new(doc.alloc_id(), NodeKind::Group { children, clip: c.region.is_some() });
-    group.visible = !c.hidden;
-    Arc::new(group)
+    Arc::new(Node::new(doc.alloc_id(), NodeKind::Group { children, clip: c.region.is_some() }))
 }

crates/doc/src/lib.rs

@@ -96,7 +96,7 @@ pub use vectorcraft_geom as geom;
 
 use serde::{Deserialize, Serialize};
 use vectorcraft_color::{Swatch, SwatchGroup};
-use vectorcraft_geom::{Point, Rect, Vec2};
+use vectorcraft_geom::{Affine, Point, Rect, Vec2};
 
 #[derive(Debug, thiserror::Error, PartialEq)]
 pub enum DocError {
@@ -741,7 +741,8 @@ impl Document {
         }
         max = self.slices.iter().fold(max, |m, s| m.max(s.id.0));
         max = self.assets.iter().fold(max, |m, a| m.max(a.id));
-        self.next_id = self.next_id.max(max + 1);
+        // An id of u64::MAX (a damaged file) can't overflow: ids after it are reused at worst.
+        self.next_id = self.next_id.max(max.saturating_add(1));
     }
 
     /// Find a node anywhere in the tree.
@@ -1006,6 +1007,13 @@ impl Document {
             *g = g.moved(d);
         }
     }
+    /// Map the guides of artboard `id` through `xf`, an axis-aligned scale and move (Scale Artwork
+    /// with Artboard).
+    pub fn map_artboard_guides(&mut self, id: u32, xf: Affine) {
+        for g in self.guides.iter_mut().filter(|g| g.artboard == Some(id)) {
+            g.pos = if g.vertical { (xf * Point::new(g.pos, 0.0)).x } else { (xf * Point::new(0.0, g.pos)).y };
+        }
+    }
     /// Copy the guides of artboard `from` onto artboard `to`, `d` away (with a copy of their
     /// artboard).
     pub fn copy_artboard_guides(&mut self, from: u32, to: u32, d: Vec2) {

crates/effects/src/pixel/tests.rs

@@ -116,7 +116,7 @@ fn every_effect_is_deterministic() {
         assert_eq!(a, b, "{id}");
         assert_ne!(a, src, "{id} changes the image");
         // Premultiplied stays premultiplied.
-        assert!(a.chunks_exact(4).all(|p| p[0] <= p[3] && p[1] <= p[3] && p[2] <= p[3]), "{id}");
+        assert!(a.as_chunks::<4>().0.iter().all(|p| p[0] <= p[3] && p[1] <= p[3] && p[2] <= p[3]), "{id}");
     }
 }
 
@@ -196,9 +196,9 @@ fn lengths_are_document_units() {
 fn gaussian_and_plane_blurs_keep_their_mass() {
     let (w, h) = (30, 30);
     let mut d = image(w, h, |x, y| if (10..20).contains(&x) && (10..20).contains(&y) { grey(255) } else { [0, 0, 0, 0] });
-    let before: u32 = d.chunks_exact(4).map(|p| p[3] as u32).sum();
+    let before: u32 = d.as_chunks::<4>().0.iter().map(|p| p[3] as u32).sum();
     gaussian_rgba(&mut d, w, h, 2.0);
-    let after: u32 = d.chunks_exact(4).map(|p| p[3] as u32).sum();
+    let after: u32 = d.as_chunks::<4>().0.iter().map(|p| p[3] as u32).sum();
     assert!((before as f64 - after as f64).abs() / (before as f64) < 0.02, "{before} → {after}");
     assert!(at(&d, w, 9, 15)[3] > 0 && at(&d, w, 10, 15)[3] < 255);
     let mut plane: Vec<f32> = (0..w * h).map(|i| if i == 15 * w + 15 { 100.0 } else { 0.0 }).collect();

crates/engine/src/cmd/clipboard.rs

@@ -154,11 +154,18 @@ impl Clipboard {
             }
             vectorcraft_brush::store(&mut d, &lib);
         }
-        let mut layer = Node::layer(NodeId(u64::MAX), "Clipboard", vectorcraft_doc::LayerColor::Preset(0));
+        // The layer's id is above every copied object's, so the document saves and reopens as
+        // a native file.
+        let mut top = 0;
+        for n in &self.nodes {
+            n.walk(&mut |c| top = top.max(c.id.0));
+        }
+        let mut layer = Node::layer(NodeId(top.saturating_add(1)), "Clipboard", vectorcraft_doc::LayerColor::Preset(0));
         if let Some(ch) = layer.children_mut() {
             *ch = self.nodes.iter().cloned().map(Arc::new).collect();
         }
         d.layers = vec![Arc::new(layer)];
+        d.fix_next_id();
         d
     }
 }

crates/engine/src/cmd/edit.rs

@@ -287,6 +287,8 @@ enum PasteMode {
     Back,
     InPlace,
     AllArtboards,
+    /// A graphic from the Libraries panel: centred where it is placed, as Paste centres.
+    Library,
 }
 
 impl PasteMode {
@@ -297,6 +299,7 @@ impl PasteMode {
             PasteMode::InPlace => "Paste in Place",
             PasteMode::AllArtboards => "Paste on All Artboards",
             PasteMode::Offset => "Paste",
+            PasteMode::Library => "Place from Library",
         }
     }
 }
@@ -310,6 +313,14 @@ fn paste(s: &mut Session, p: &Value, mode: PasteMode) -> Result<Value> {
     r
 }
 
+/// Place the objects of `clip` (a library graphic) into the active document centred on `center`,
+/// as one undo step: their resources come along as a paste's do, a swatch whose name the document
+/// gives another colour merged into the document's.
+pub(crate) fn place_clip(s: &mut Session, clip: &Clipboard, center: vectorcraft_geom::Point) -> Result<Value> {
+    let choices = SwatchChoices::parse(PasteMode::Library.label(), &json!({}))?;
+    paste_clip(s, &json!({ "center": [center.x, center.y] }), PasteMode::Library, clip, &choices)
+}
+
 /// Paste in Place, in Front or in Back onto artboard `artboard` (the active one, #693): where the
 /// objects were on the artboard they were copied from, on that one; without it (or a copy from no
 /// artboard), where they were.
@@ -348,7 +359,7 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
     };
     let placements: Vec<Affine> = match (mode, board) {
         (_, Some((_, dv))) => vec![Affine::translate(dv)],
-        (PasteMode::Offset, None) => vec![match point_param(p, "center") {
+        (PasteMode::Offset | PasteMode::Library, None) => vec![match point_param(p, "center") {
             Some(c) => clip.bounds().map_or(Affine::IDENTITY, |b| Affine::translate(c - b.center())),
             None => Affine::translate((f64_or(p, "dx", off), f64_or(p, "dy", off))),
         }],

crates/engine/src/cmd/fileio/affinity.rs

@@ -206,6 +206,13 @@ impl Builder {
     /// One Affinity node (and its subtree) as VectorCraft art; `to_doc` maps document pixels to
     /// points. `layer_level`: the node is directly in a spread or a layer, so a layer stays a layer.
     fn node(&mut self, n: &af::Node, to_doc: Affine, boards: &mut Vec<(String, Rect)>, layer_level: bool) -> Option<Arc<Node>> {
+        // Register before descending so nested artboards keep their document order.
+        if let Kind::Artboard { rect, .. } = &n.kind {
+            boards.push((
+                if n.name.is_empty() { format!("Artboard {}", boards.len() + 1) } else { n.name.clone() },
+                to_doc.transform_rect_bbox(rect_of(*rect)),
+            ));
+        }
         let child_level = matches!(n.kind, Kind::Layer) && layer_level;
         let children: Vec<Arc<Node>> = n.children.iter().filter_map(|c| self.node(c, to_doc, boards, child_level)).collect();
         let mut out = match &n.kind {
@@ -241,14 +248,18 @@ impl Builder {
                     self.base(n, NodeKind::Group { children: kids, clip: true })
                 }
             }
-            Kind::Artboard { rect, background } => {
-                let r = to_doc.transform_rect_bbox(rect_of(*rect));
-                boards.push((if n.name.is_empty() { format!("Artboard {}", boards.len() + 1) } else { n.name.clone() }, r));
+            Kind::Artboard { path, even_odd, background, strokes, .. } => {
                 let mut clip = Node::new(
                     self.doc.alloc_id(),
-                    NodeKind::Path { path: shapes::rectangle(r), rule: FillRule::NonZero, live: None, clipping: true, guide: false },
+                    NodeKind::Path {
+                        path: self.path(path, to_doc),
+                        rule: if *even_odd { FillRule::EvenOdd } else { FillRule::NonZero },
+                        live: None,
+                        clipping: true,
+                        guide: false,
+                    },
                 );
-                clip.appearance = self.appearance(background, &[], to_doc);
+                clip.appearance = self.appearance(background, strokes, to_doc);
                 let mut kids = vec![Arc::new(clip)];
                 kids.extend(children);
                 let mut g = self.base(n, NodeKind::Group { children: kids, clip: true });
@@ -432,9 +443,27 @@ impl Builder {
             .runs
             .iter()
             .map(|r| {
-                let mut style =
-                    CharStyle { font_family: if r.family.is_empty() { r.postscript.clone() } else { r.family.clone() }, ..CharStyle::default() };
-                style.font_style = font_style(r.weight, r.italic);
+                let mut style = CharStyle::default();
+                if !r.family.is_empty() {
+                    style.font_family = r.family.clone();
+                } else if !r.postscript.is_empty() {
+                    style.font_family = r.postscript.clone();
+                } else {
+                    self.warn("text without a font name uses the default font");
+                }
+                // A family/weight pair cannot identify width variants such as Arial Narrow.
+                // Resolve a known PostScript identity to the exact installed family and style.
+                if let Some((family, face_style)) = vectorcraft_text::FontDb::global().by_postscript_name(&r.postscript) {
+                    style.font_family = family;
+                    style.font_style = face_style;
+                } else {
+                    style.font_style = font_style(r.weight, r.italic);
+                }
+                style.features = r.features.clone();
+                if r.features.iter().any(|feature| !vectorcraft_text::OtFeatures::known_tag(feature)) {
+                    self.warn("unsupported text OpenType features (retained but not rendered)");
+                }
+                style.all_caps = r.all_caps;
                 style.size = r.size * k;
                 style.leading = r.leading.map(|l| l * k);
                 style.tracking = r.tracking * 1000.0;

crates/engine/src/cmd/fileio/load.rs

@@ -150,6 +150,20 @@ fn through_editing_data(bytes: &[u8], opts: &LoadOptions, doc: Document, warning
     (doc, warnings)
 }
 
+/// A `.ai` saved without PDF compatibility (its PDF part is a placeholder page) from the editor's
+/// own copy of its art alone: `None` when the file has none (or pages are picked, or layers are
+/// off), an error when it can't be read.
+fn from_editing_data_alone(bytes: &[u8], opts: &LoadOptions) -> Option<Result<(Document, Vec<String>)>> {
+    if opts.pages.is_some() || !opts.layers {
+        return None;
+    }
+    let private = vectorcraft_pdf::illustrator_data(bytes, opts.password.as_deref())?;
+    Some(
+        vectorcraft_eps::ai_alone(&private)
+            .map_err(|why| err(format!("this file was saved without PDF compatibility, and its editing data can't be read ({why})"))),
+    )
+}
+
 /// [`load`] with `document.open` options (the PDF pages, box and password; the DXF options).
 pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded> {
     let format = detect(name, bytes).ok_or_else(|| match super::unsupported(&super::extension(name)) {
@@ -188,9 +202,13 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
                 .then(|| vectorcraft_pdf::editing_with(bytes, opts.password.as_deref()))
                 .flatten()
                 .map(|e| (e.intact, move || Some(e.data)));
-            restore_or_import(editing, || {
-                let (doc, warnings) = super::pdfimport::import(bytes, opts)?;
-                Ok(through_editing_data(bytes, opts, doc, warnings))
+            restore_or_import(editing, || match super::pdfimport::import(bytes, opts) {
+                Ok((doc, warnings)) => Ok(through_editing_data(bytes, opts, doc, warnings)),
+                // Saved without its PDF part: the editing copy is all the file has.
+                Err(e) if e.to_string() == vectorcraft_pdf::PdfError::PlaceholderOnly.to_string() => {
+                    from_editing_data_alone(bytes, opts).unwrap_or(Err(e))
+                }
+                Err(e) => Err(e),
             })?
         }
         "dxf" => {

crates/engine/src/cmd/fileio/mod.rs

@@ -54,6 +54,7 @@ pub(crate) use load::native_file;
 pub(crate) use load::source;
 pub use load::{Loaded, RasterImage, detect, file_name, load, load_with, open_bytes, open_bytes_with, open_template, raster_image};
 pub use load::{losses_summary, overwrite_losses};
+pub(crate) use native::preview_png;
 pub use native::with_compression_pref;
 pub use pdfimport::{LoadOptions, page_document};
 pub(crate) use save::job_for;
@@ -938,6 +939,9 @@ mod tests_psd;
 #[cfg(test)]
 mod tests_epsimport;
 
+#[cfg(test)]
+mod tests_aiimport;
+
 #[cfg(test)]
 mod tests_pdflayers;
 

crates/engine/src/cmd/fileio/native.rs

@@ -186,7 +186,7 @@ pub(super) fn ai_native(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Res
 
 /// The first artboard (else the art) as a PNG fitted into [`PREVIEW_MAX`] pixels (`None`: nothing
 /// to show).
-fn preview_png(doc: &Document) -> Result<Option<Vec<u8>>> {
+pub(crate) fn preview_png(doc: &Document) -> Result<Option<Vec<u8>>> {
     let Some(r) = doc.artboards.first().map(|a| a.rect).or_else(|| vectorcraft_render::encode::art_bounds(doc)) else { return Ok(None) };
     let scale = f64::from(PREVIEW_MAX) / r.width().max(r.height());
     if vectorcraft_render::raster_size(r, scale).is_err() {

crates/engine/src/cmd/fileio/pdf.rs

@@ -109,7 +109,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export PDF",
             [],
             None,
-            "{path?, preset?: \"VectorCraft Default\" (built-in or saved: pdf.preset.list), artboard? | artboards?: [i…] | range?: \"1-3, 5\" (1-based; default all, one page each), standard?: none|pdfA2b|pdfX1a (CMYK, grey and spot colours only: colours and images converted to output.destination or the CMYK output intent, untagged; transparency flattened with flattenerPreset; PDF 1.3)|pdfX3 (colours ICC-tagged; transparency flattened; PDF 1.3)|pdfX4 (transparency and layers kept; colours ICC-tagged; PDF 1.6 at most) (PDF/X: a /GTS_PDFX output intent, by default the CMYK profile in effect, embedded; TrimBox, Trapped, GTS_PDFXVersion, title and dates; fonts embedded or outlined), compatibility?: 1.3 (no transparency: it is flattened with flattenerPreset; images keep no see-through pixels)|1.4|1.5|1.6|1.7 (default)|2.0 (choosing a standard sets its version: 1.7 for pdfA2b, 1.6 for pdfX4, 1.3 for pdfX1a and pdfX3, which write 1.4 as 1.3 too; pdfA2b refuses 1.3), preserveEditing? (on in VectorCraft Default: the native document as an embedded file, which document.open restores; choosing a standard turns it off, a standard refuses it), thumbnails? (each page drawn as a /Thumb image, 106 px on its long side), fastWebView? (a linearised file: the first page shows while the rest downloads; it stays linearised when encrypted), viewAfterSaving? (the app opens the written file), createLayers? (each layer and sublayer but template layers as a PDF layer, an optional content group listed under its layer's: hidden layers off, non-printing ones /PrintState /OFF, locked ones locked; needs 1.5 or later; they reopen as layers; choosing pdfX1a or pdfX3 turns it off; they refuse it), includeNonPrinting? (keep layers whose Print option is off; left out by default unless createLayers), flattenerPreset?: \"\" (High Resolution) | high | medium | low | a saved preset (flattener.presets.list): what PDF 1.3 files flatten transparency with, flattener?: {object.flattenTransparency options over it}, compression?: {color?, gray?: {downsample: none|average|subsample|bicubic, ppi: 300, abovePpi: 450, compression: none|zip|jpeg|jpeg2000|auto, quality: minimum|low|medium|high|maximum}, mono?: {downsample, ppi: 1200, abovePpi: 1800, compression: none|ccittG3|ccittG4|zip|runLength} (black-and-white images), compressText?: true} (images above abovePpi are resampled to ppi; auto keeps JPEGs JPEG, the others lossless; JPEG needs opaque images; none, jpeg2000, CCITT and runLength are written as ZIP with a warning), marks?: {trim, registration, colorBars, pageInfo, kind: roman|japanese, weight: 0.25 (trim marks and targets), offset: 6 (pt from the artboard, at least the bleed)} (printer's marks in [Registration], every plate: trim marks, registration targets mid-side, CMYK/spot/black-tint colour bars on top, page information (title, artboard, date UTC) below), bleed?: {useDocument (the document's bleed, document.setup), top, bottom, left, right} (pt; art in the bleed is kept). Each page: TrimBox = artboard, BleedBox = artboard + bleed, MediaBox = that + the marks' room (art clipped to the BleedBox), output?: {conversion: none (default)|destination (every colour into the destination profile's model, CMYK or RGB, also colours of that model in another profile)|preserveNumbers (only colours of the other model and Lab; those in the destination's model keep their numbers) (grey stays grey; images are converted too, printer's marks are not), destination: profile name (edit.colorSettings lists them; default: the document's profile for its colour mode), profiles: none (device colours)|all|destination|taggedSource (documents assigned a profile: edit.assignProfile) (ICC-based colours: CMYK with the destination or document CMYK profile, RGB as sRGB, grey with the sRGB tone curve; PDF/A always), outputIntent: profile name (embedded as the catalog's /GTS_PDFX output intent; a name that isn't a profile is only named, which pdfX1a and pdfX3 allow only with a registry and pdfX4 refuses; pdfX1a needs a CMYK one), outputCondition, outputConditionId (default: outputIntent), registry, trapped (/Trapped /True; /False when an output intent is written)} (PDF/A files keep their own output intent), advanced?: {fontSubsetPercent: 100 (below 100 is accepted with a warning: fonts are always embedded as subsets), outlineText: true (false: type as real, selectable and searchable text in embedded subset fonts with a ToUnicode map; fonts whose licence forbids embedding, or allows only whole fonts, stay outlines with a warning), overprint: preserve (overprinting fills and strokes set /OP /op true, /OPM 1; white ones knock out with document.setup discardWhiteOverprint)|discard (they knock out)}, security?: {openPassword, permissionsPassword, printing: none|low|high, changes: none|pages|forms|comments|any, copy, screenReader, plaintextMetadata}} → {path, bytes, warnings}; no path → {dataBase64, bytes, warnings}. The options apply over the preset (null keeps its value); options ac
Line truncated
+            "{path?, preset?: \"VectorCraft Default\" (built-in or saved: pdf.preset.list), artboard? | artboards?: [i…] | range?: \"1-3, 5\" (1-based; default all, one page each), standard?: none|pdfA2b|pdfX1a (CMYK, grey and spot colours only: colours and images converted to output.destination or the CMYK output intent, untagged; transparency flattened with flattenerPreset; PDF 1.3)|pdfX3 (colours ICC-tagged; transparency flattened; PDF 1.3)|pdfX4 (transparency and layers kept; colours ICC-tagged; PDF 1.6 at most) (PDF/X: a /GTS_PDFX output intent, by default the CMYK profile in effect, embedded; TrimBox, Trapped, GTS_PDFXVersion, title and dates; fonts embedded or outlined), compatibility?: 1.3 (no transparency: it is flattened with flattenerPreset; images keep no see-through pixels)|1.4|1.5|1.6|1.7 (default)|2.0 (choosing a standard sets its version: 1.7 for pdfA2b, 1.6 for pdfX4, 1.3 for pdfX1a and pdfX3, which write 1.4 as 1.3 too; pdfA2b refuses 1.3), preserveEditing? (on in VectorCraft Default: the native document as an embedded file, which document.open restores; choosing a standard turns it off, a standard refuses it), thumbnails? (each page drawn as a /Thumb image, 106 px on its long side), fastWebView? (a linearised file: the first page shows while the rest downloads; it stays linearised when encrypted), viewAfterSaving? (the app opens the written file), createLayers? (each layer and sublayer but template layers as a PDF layer, an optional content group listed under its layer's: hidden layers off, non-printing ones /PrintState /OFF, locked ones locked; needs 1.5 or later; they reopen as layers; choosing pdfX1a or pdfX3 turns it off; they refuse it), includeNonPrinting? (keep layers whose Print option is off; left out by default unless createLayers), flattenerPreset?: \"\" (High Resolution) | high | medium | low | a saved preset (flattener.presets.list): what PDF 1.3 files flatten transparency with, flattener?: {object.flattenTransparency options over it}, compression?: {color?, gray?: {downsample: none|average|subsample|bicubic, ppi: 300, abovePpi: 450, compression: none|zip|jpeg|jpeg2000|auto, quality: minimum|low|medium|high|maximum}, mono?: {downsample, ppi: 1200, abovePpi: 1800, compression: none|ccittG3|ccittG4|zip|runLength} (black-and-white images), compressText?: true} (images above abovePpi are resampled to ppi; auto keeps JPEGs JPEG, the others lossless; JPEG needs opaque images; none, jpeg2000, CCITT and runLength are written as ZIP with a warning), marks?: {trim, registration, colorBars, pageInfo, kind: roman|japanese, weight: 0.25 (trim marks and targets), offset: 6 (pt from the artboard, at least the bleed)} (printer's marks in [Registration], every plate: trim marks, registration targets mid-side, CMYK/spot/black-tint colour bars on top, page information (title, artboard, date UTC) below), bleed?: {useDocument (the document's bleed, document.setup), top, bottom, left, right} (pt; art in the bleed is kept). Each page: TrimBox = artboard, BleedBox = artboard + bleed, MediaBox = that + the marks' room (art clipped to the BleedBox), output?: {conversion: none (default)|destination (every colour into the destination profile's model, CMYK or RGB, also colours of that model in another profile)|preserveNumbers (only colours of the other model and Lab; those in the destination's model keep their numbers) (grey stays grey; images are converted too, printer's marks are not), destination: profile name (edit.colorSettings lists them; default: the document's profile for its colour mode), profiles: none (device colours)|all|destination|taggedSource (documents assigned a profile: edit.assignProfile) (ICC-based colours: CMYK with the destination or document CMYK profile, RGB as sRGB, grey with the sRGB tone curve; PDF/A always), outputIntent: profile name (embedded as the catalog's /GTS_PDFX output intent; a name that isn't a profile is only named, which pdfX1a and pdfX3 allow only with a registry and pdfX4 refuses; pdfX1a needs a CMYK one), outputCondition, outputConditionId (default: outputIntent), registry, trapped (/Trapped /True; /False when an output intent is written)} (PDF/A files keep their own output intent), advanced?: {fontSubsetPercent: 100 (below 100 is accepted with a warning: fonts are always embedded as subsets), outlineText: false (type as real, selectable and searchable text in embedded subset fonts with a ToUnicode map; fonts whose licence forbids embedding, or allows only whole fonts, stay outlines with a warning; true: every glyph as an outline), overprint: preserve (overprinting fills and strokes set /OP /op true, /OPM 1; white ones knock out with document.setup discardWhiteOverprint)|discard (they knock out)}, security?: {openPassword, permissionsPassword, printing: none|low|high, changes: none|pages|forms|comments|any, copy, screenReader, plaintextMetadata}} → {path, bytes, warnings}; no path → {dataBase64, bytes, warnings}. The options apply over the preset (null k
Line truncated
             has_doc,
             export_pdf
         ),

crates/engine/src/cmd/fileio/tests_aiimport.rs

@@ -0,0 +1,110 @@
+//! Illustrator EPS and `.ai` files open from the editing data they carry: layers, groups, names,
+//! hidden objects, artboards, colours and images as they were; what the reader doesn't read yet
+//! opens as before, with a warning saying why.
+
+use std::io::Write as _;
+use std::sync::Arc;
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{Node, NodeKind};
+use vectorcraft_testkit::ai;
+
+use super::*;
+
+fn open(s: &mut Session, name: &str, bytes: &[u8], params: Value) -> Result<Value> {
+    let mut p = json!({"name": name, "dataBase64": vectorcraft_format::base64_encode(bytes)});
+    if let (Some(p), Some(extra)) = (p.as_object_mut(), params.as_object()) {
+        p.extend(extra.clone());
+    }
+    s.execute("document.open", &p)
+}
+
+/// The `.ai` private data of `data`, compressed as older `.ai` files compress it.
+fn compressed(data: &[u8]) -> Vec<u8> {
+    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    e.write_all(data).unwrap();
+    [&b"%AI12_CompressedData"[..], &e.finish().unwrap()].concat()
+}
+
+fn names(nodes: &[Arc<Node>]) -> Vec<String> {
+    nodes.iter().map(|n| n.name.clone().unwrap_or_default()).collect()
+}
+
+/// The sample's structure, as [`ai::sample_data`] builds it.
+fn check_sample(s: &Session) {
+    let doc = &s.doc().unwrap().doc;
+    assert_eq!(names(&doc.layers), ["Art", "Hidden"]);
+    assert_eq!(doc.artboards.len(), 1);
+    assert_eq!(doc.artboards[0].rect, vectorcraft_geom::Rect::new(0.0, 0.0, 200.0, 100.0));
+    let art = doc.layers[0].children().unwrap();
+    assert_eq!(names(art), ["Pair", "Ring", "Window"]);
+    let pair = art[0].children().unwrap();
+    assert_eq!(names(pair), ["Red", ""]);
+    assert!(pair[0].visible && !pair[1].visible, "the hidden member stays hidden");
+    assert!(matches!(art[1].kind, NodeKind::Compound { .. }));
+    assert!(matches!(&art[2].kind, NodeKind::Group { clip: true, children } if matches!(children[0].kind, NodeKind::Path { clipping: true, .. })));
+    let hidden = &doc.layers[1];
+    assert!(!hidden.visible);
+    let kids = hidden.children().unwrap();
+    assert_eq!(names(kids), ["Shaded", "", "Sub", ""]);
+    assert!(matches!(kids[0].appearance.fill().map(|f| &f.paint), Some(vectorcraft_color::Paint::Gradient(_))));
+    assert_eq!((kids[1].opacity, kids[1].blend), (0.5, vectorcraft_color::BlendMode::Screen));
+    assert!(kids[2].locked && matches!(kids[2].kind, NodeKind::Layer { .. }));
+    let NodeKind::Image(im) = &kids[3].kind else { panic!("an image") };
+    assert_eq!((im.width, im.height), (2, 1));
+}
+
+#[test]
+fn an_illustrator_eps_opens_with_its_layers() {
+    let mut s = Session::new();
+    let r = open(&mut s, "art.eps", &ai::eps(&ai::sample_data(), ai::page_ps()), json!({})).unwrap();
+    assert_eq!((&r["format"], &r["warnings"]), (&json!("eps"), &json!([])), "{r}");
+    check_sample(&s);
+    // Saved as EPS and opened again, it comes back the same.
+    let eps = s.execute("document.exportEps", &json!({})).unwrap();
+    let bytes = vectorcraft_format::base64_decode(eps["dataBase64"].as_str().unwrap()).unwrap();
+    let r = open(&mut s, "again.eps", &bytes, json!({})).unwrap();
+    assert_eq!(r["restored"], json!(true), "{r}");
+    check_sample(&s);
+}
+
+#[test]
+fn an_illustrator_ai_file_opens_from_its_editing_data() {
+    let mut s = Session::new();
+    let file = ai::ai(&compressed(&ai::sample_data()), ai::page_pdf());
+    let r = open(&mut s, "art.ai", &file, json!({})).unwrap();
+    assert_eq!(r["format"], json!("ai"), "{r}");
+    assert!(r["warnings"].as_array().unwrap().iter().all(|w| !w.as_str().unwrap().contains("weren't read")), "{r}");
+    check_sample(&s);
+    // Pages picked: the PDF's.
+    open(&mut s, "art.ai", &file, json!({"pages": "1"})).unwrap();
+    assert_ne!(names(&s.doc().unwrap().doc.layers), ["Art", "Hidden"]);
+}
+
+#[test]
+fn what_the_reader_doesnt_read_opens_as_before_with_a_warning() {
+    let symbols = ai::editing_data(200.0, 100.0, &ai::layer("Art", "/SymbolInstance :\n(Dot) /SymbolRef ,\n;\n"));
+    let mut s = Session::new();
+    let r = open(&mut s, "symbols.eps", &ai::eps(symbols.as_bytes(), ai::page_ps()), json!({})).unwrap();
+    assert!(r["warnings"].to_string().contains("layers weren't read") && r["warnings"].to_string().contains("symbols"), "{r}");
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Layer 1"]);
+    let r = open(&mut s, "symbols.ai", &ai::ai(&compressed(symbols.as_bytes()), ai::page_pdf()), json!({})).unwrap();
+    assert!(r["warnings"].to_string().contains("symbols") && r["warnings"].to_string().contains("PDF part"), "{r}");
+}
+
+/// A page showing only a placeholder line, as a `.ai` saved without PDF compatibility has.
+const PLACEHOLDER: &str = "BT /F1 12 Tf 10 50 Td (Saved without its PDF part) Tj ET";
+
+#[test]
+fn an_ai_file_saved_without_its_pdf_part_opens_from_its_editing_data() {
+    let mut s = Session::new();
+    let r = open(&mut s, "art.ai", &ai::ai(&compressed(&ai::sample_data()), PLACEHOLDER), json!({})).unwrap();
+    assert_eq!(r["format"], json!("ai"), "{r}");
+    check_sample(&s);
+    // Its editing data damaged: it says so (the placeholder isn't the art).
+    let e = open(&mut s, "damaged.ai", &ai::ai(b"%AI12_CompressedData not zlib", PLACEHOLDER), json!({})).unwrap_err().to_string();
+    assert!(e.contains("without PDF compatibility") && e.contains("zlib"), "{e}");
+    // Without editing data, the placeholder still isn't opened as the art.
+    let e = open(&mut s, "plain.ai", &ai::ai(b"", PLACEHOLDER), json!({})).unwrap_err().to_string();
+    assert!(e.contains("placeholder"), "{e}");
+}

crates/engine/src/cmd/layer.rs

@@ -10,8 +10,8 @@ use std::collections::HashSet;
 use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Artboard, Document, LAYER_COLORS, LayerColor, Node, NodeId, NodeKind};
-use vectorcraft_geom::Rect;
+use vectorcraft_doc::{Artboard, Document, LAYER_COLORS, LayerColor, Node, NodeId, NodeKind, Scaling};
+use vectorcraft_geom::{Affine, Rect};
 
 use super::*;
 use crate::EngineError;
@@ -135,7 +135,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Artboard Options…",
             ["Window", "Artboards"],
             None,
-            "{index, name?, x?, y?, width?, height?}",
+            "{index, name?, x?, y?, width?, height?, scaleArt?: bool (Scale Artwork with Artboard: resized, the artboard takes the art fully inside it (locked and hidden art only with lockedAndHidden?: bool, default prefs moveLockedWithArtboard) and its guides from its old rectangle onto the new one, each side by its own ratio; strokes/corners/patterns as object.scale)} → null, or with scaleArt {scaled: the art scaled}",
             has_doc,
             artboard_set
         ),
@@ -752,21 +752,62 @@ fn artboard_delete(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn artboard_set(s: &mut Session, p: &Value) -> Result<Value> {
     let i = p.get("index").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let was = s.doc()?.doc.artboards.get(i).map(|a| a.rect).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+    let now = rect_from(p, was);
+    let resized = (now.width() - was.width()).abs() > 1e-6 || (now.height() - was.height()).abs() > 1e-6;
+    // Scale Artwork with Artboard: resized, it takes the art fully inside it (as Move Artwork with
+    // Artboard gathers it) and its guides from the old rectangle onto the new one.
+    let scale_art = bool_or(p, "scaleArt", false);
+    let fit = if scale_art && resized { rect_map(was, now) } else { None };
+    let art = if fit.is_some() {
+        // Locked and hidden art too? Noted in the journal, so a replay scales the same objects
+        // whatever the preference is then.
+        let all = bool_or(p, "lockedAndHidden", s.prefs.move_locked_with_artboard);
+        s.note_journal("lockedAndHidden", json!(all));
+        s.doc()?.doc.art_on_artboard(was, all)
+    } else {
+        vec![]
+    };
+    let mut sc = match fit {
+        Some(xf) if Scaling::factor(xf).is_some() => super::object::scaling(s, p),
+        _ => Scaling::default(),
+    };
+    sc.patterns = super::object::transform_patterns(s, p, &art)?;
     s.edit("Artboard Options", |d, _| {
         let a = d.artboards.get_mut(i).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
-        let was = a.rect;
-        a.rect = rect_from(p, a.rect);
+        a.rect = now;
         if let Some(n) = str_param(p, "name") {
             a.name = n.to_string();
         }
-        // Moved (not resized), it takes its guides along.
-        let (id, now) = (a.id, a.rect);
-        if (now.width() - was.width()).abs() <= 1e-6 && (now.height() - was.height()).abs() <= 1e-6 {
+        let id = a.id;
+        if let Some(xf) = fit {
+            d.map_artboard_guides(id, xf);
+            for id in &art {
+                if let Some(n) = d.node_mut(*id) {
+                    n.transform(xf, sc);
+                }
+            }
+        } else if !resized {
+            // Moved (not resized), it takes its guides along.
             d.move_artboard_guides(id, now.origin() - was.origin());
         }
         Ok(())
     })?;
-    ok()
+    if !scale_art {
+        return ok();
+    }
+    Ok(json!({ "scaled": art.iter().map(|i| i.0).collect::<Vec<_>>() }))
+}
+
+/// The map taking artboard rectangle `from` onto `to`, each side scaled by its own ratio. None
+/// when `from` has no area or the map isn't finite (a size out of range).
+fn rect_map(from: Rect, to: Rect) -> Option<Affine> {
+    if from.width() <= 1e-9 || from.height() <= 1e-9 {
+        return None;
+    }
+    let (sx, sy) = (to.width() / from.width(), to.height() / from.height());
+    let xf = Affine::translate(to.origin().to_vec2()) * Affine::scale_non_uniform(sx, sy) * Affine::translate(-from.origin().to_vec2());
+    xf.is_finite().then_some(xf)
 }
 
 fn artboard_fit_art(s: &mut Session, p: &Value) -> Result<Value> {

crates/engine/src/cmd/library.rs

@@ -0,0 +1,699 @@
+//! Libraries (Window › Libraries): local libraries of graphics, colours and text styles that every
+//! document can use. A library is one `.vclibrary` file (JSON) in the library folder next to the
+//! preferences, which the desktop app sets; without a folder (the web, headless sessions) libraries
+//! live for the session only. A graphic is kept as a native document with a PNG thumbnail: adding
+//! one copies the selection as Copy does, and placing it pastes a copy as Paste does (its images,
+//! symbols, patterns and swatches come along; a swatch name the document gives another colour is
+//! merged into the document's).
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use vectorcraft_color::{Color, Paint};
+use vectorcraft_doc::TextStyleDef;
+
+use super::*;
+use crate::Clipboard;
+
+/// The extension of a library file.
+pub const LIBRARY_EXT: &str = "vclibrary";
+/// Bytes a library file may have when read (graphics with large images included).
+const MAX_FILE: u64 = 512 << 20;
+/// Items of one kind a library may hold.
+const MAX_ITEMS: usize = 10_000;
+
+/// A library: its name and its items, newest last.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Library {
+    pub name: String,
+    #[serde(default)]
+    pub colors: Vec<LibraryColor>,
+    #[serde(default)]
+    pub char_styles: Vec<TextStyleDef>,
+    #[serde(default)]
+    pub para_styles: Vec<TextStyleDef>,
+    #[serde(default)]
+    pub graphics: Vec<LibraryGraphic>,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct LibraryColor {
+    pub name: String,
+    pub color: Color,
+}
+
+/// A graphic: the art as a native document (its own resources included) and its thumbnail.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LibraryGraphic {
+    pub id: String,
+    pub name: String,
+    /// Size of the art (points).
+    pub width: f64,
+    pub height: f64,
+    /// The native document, base64.
+    pub data: String,
+    /// A PNG of the art, at most 256 pixels a side, base64 (empty when it draws nothing).
+    #[serde(default)]
+    pub thumbnail: String,
+}
+
+/// The libraries of a session ([`Session::libraries`]).
+#[derive(Clone, Debug, Default)]
+pub struct Libraries {
+    /// The library folder: none in the web app and headless sessions.
+    dir: Option<String>,
+    /// (id: the file's stem, library), in name order.
+    libs: Vec<(String, Library)>,
+    /// The library the panel shows, which commands without a `library` act on.
+    current: Option<String>,
+}
+
+impl Libraries {
+    pub fn dir(&self) -> Option<&str> {
+        self.dir.as_deref()
+    }
+
+    /// Set the library folder and read its libraries (unreadable files are skipped).
+    pub fn set_dir(&mut self, dir: Option<String>) {
+        self.dir = dir;
+        self.libs.clear();
+        if let Some(dir) = self.dir.clone() {
+            for path in library_paths(&dir) {
+                let id = stem_of(&path);
+                let lib = super::fileio::file_stamp(&path)
+                    .filter(|(len, _)| *len <= MAX_FILE)
+                    .and_then(|_| super::fileio::read_file(&path).ok())
+                    .and_then(|b| serde_json::from_slice::<Library>(&b).ok());
+                if let Some(mut lib) = lib {
+                    lib.cap();
+                    self.libs.push((id, lib));
+                }
+            }
+        }
+        self.sort();
+    }
+
+    fn sort(&mut self) {
+        self.libs.sort_by(|a, b| a.1.name.to_lowercase().cmp(&b.1.name.to_lowercase()).then(a.0.cmp(&b.0)));
+    }
+
+    /// The libraries, as (id, library), in name order.
+    pub fn all(&self) -> &[(String, Library)] {
+        &self.libs
+    }
+
+    /// The library the panel shows: the one chosen last, else the first.
+    pub fn current(&self) -> Option<&str> {
+        self.current.as_deref().filter(|c| self.get(c).is_some()).or_else(|| self.libs.first().map(|(i, _)| i.as_str()))
+    }
+
+    pub fn get(&self, id: &str) -> Option<&Library> {
+        self.libs.iter().find(|(i, _)| i == id).map(|(_, l)| l)
+    }
+
+    /// Library `key` by id, else by name (ignoring case).
+    fn find(&self, key: &str) -> Option<String> {
+        self.libs.iter().find(|(i, _)| i == key).or_else(|| self.libs.iter().find(|(_, l)| l.name.eq_ignore_ascii_case(key))).map(|(i, _)| i.clone())
+    }
+
+    /// A new empty library called `name` → its id.
+    fn create(&mut self, name: &str) -> Result<String> {
+        let base: String = name.chars().map(|c| if c.is_alphanumeric() || c == ' ' || c == '-' || c == '_' { c } else { '-' }).collect();
+        let base = base.trim();
+        let base = if base.is_empty() { "Library" } else { base };
+        let taken = |id: &str| self.libs.iter().any(|(i, _)| i.eq_ignore_ascii_case(id)) || self.file_exists(id);
+        let id = std::iter::once(base.to_string()).chain((2..).map(|n| format!("{base} {n}"))).find(|id| !taken(id)).unwrap_or_default();
+        self.libs.push((id.clone(), Library { name: name.to_string(), ..Default::default() }));
+        if let Err(e) = self.save(&id) {
+            self.libs.retain(|(i, _)| i != &id);
+            return Err(e);
+        }
+        self.sort();
+        self.current = Some(id.clone());
+        Ok(id)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn file_exists(&self, id: &str) -> bool {
+        self.path(id).is_some_and(|p| std::path::Path::new(&p).exists())
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    fn file_exists(&self, _: &str) -> bool {
+        false
+    }
+
+    fn path(&self, id: &str) -> Option<String> {
+        let dir = self.dir.as_deref()?;
+        Some(std::path::Path::new(dir).join(format!("{id}.{LIBRARY_EXT}")).to_string_lossy().into_owned())
+    }
+
+    /// Write library `id` to its file (nothing to do without a folder).
+    fn save(&self, id: &str) -> Result<()> {
+        let (Some(path), Some(lib)) = (self.path(id), self.get(id)) else { return Ok(()) };
+        if let Some(dir) = self.dir.as_deref() {
+            super::fileio::create_dir(dir)?;
+        }
+        let bytes = serde_json::to_vec(lib).map_err(|e| EngineError::Other(e.to_string()))?;
+        super::fileio::write_file(&path, &bytes)
+    }
+
+    /// Change library `id` with `f` and save it; on a failed save the change is undone.
+    fn change<T>(&mut self, id: &str, f: impl FnOnce(&mut Library) -> Result<T>) -> Result<T> {
+        let i = self.libs.iter().position(|(i, _)| i == id).ok_or_else(|| EngineError::Other(format!("no library `{id}`")))?;
+        let before = self.libs.get(i).map(|(_, l)| l.clone()).unwrap_or_default();
+        let r = match self.libs.get_mut(i) {
+            Some((_, lib)) => f(lib)?,
+            None => return Err(EngineError::Other(format!("no library `{id}`"))),
+        };
+        if let Err(e) = self.save(id) {
+            if let Some((_, lib)) = self.libs.get_mut(i) {
+                *lib = before;
+            }
+            return Err(e);
+        }
+        self.sort();
+        Ok(r)
+    }
+
+    fn delete(&mut self, id: &str) -> Result<()> {
+        if let Some(path) = self.path(id) {
+            remove_file(&path)?;
+        }
+        self.libs.retain(|(i, _)| i != id);
+        if self.current.as_deref() == Some(id) {
+            self.current = None;
+        }
+        Ok(())
+    }
+}
+
+impl Library {
+    /// At most [`MAX_ITEMS`] of each kind (a hand-edited file may hold more).
+    fn cap(&mut self) {
+        self.colors.truncate(MAX_ITEMS);
+        self.char_styles.truncate(MAX_ITEMS);
+        self.para_styles.truncate(MAX_ITEMS);
+        self.graphics.truncate(MAX_ITEMS);
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn library_paths(dir: &str) -> Vec<String> {
+    let Ok(rd) = std::fs::read_dir(dir) else { return vec![] };
+    let mut v: Vec<String> = rd
+        .filter_map(|e| e.ok().map(|e| e.path()))
+        .filter(|p| p.extension().is_some_and(|x| x.to_string_lossy().eq_ignore_ascii_case(LIBRARY_EXT)))
+        .map(|p| p.to_string_lossy().into_owned())
+        .collect();
+    v.sort();
+    v
+}
+
+#[cfg(target_arch = "wasm32")]
+fn library_paths(_: &str) -> Vec<String> {
+    vec![]
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn remove_file(path: &str) -> Result<()> {
+    match std::fs::remove_file(path) {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(EngineError::Other(format!("{path}: {e}"))),
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+fn remove_file(_: &str) -> Result<()> {
+    Ok(())
+}
+
+fn stem_of(path: &str) -> String {
+    std::path::Path::new(path).file_stem().map_or_else(String::new, |s| s.to_string_lossy().into_owned())
+}
+
+/// The kinds of library item.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Kind {
+    Graphic,
+    FillColor,
+    StrokeColor,
+    CharStyle,
+    ParaStyle,
+}
+
+impl Kind {
+    fn of(p: &Value, cmd: &str) -> Result<Self> {
+        Ok(match str_param(p, "kind") {
+            Some("graphic") => Kind::Graphic,
+            Some("fillColor") => Kind::FillColor,
+            Some("strokeColor") => Kind::StrokeColor,
+            Some("color") => Kind::FillColor,
+            Some("charStyle") => Kind::CharStyle,
+            Some("paraStyle") => Kind::ParaStyle,
+            _ => return Err(bad(cmd, "kind must be graphic, fillColor, strokeColor, charStyle or paraStyle")),
+        })
+    }
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            query "library.list",
+            "Libraries",
+            [],
+            None,
+            "{} → {libraries: [{id, name, graphics, colors, charStyles, paraStyles} (counts)], current: the current library's id or null, folder: the library folder, or null when libraries last for the session only (the web, headless)}",
+            always,
+            list
+        ),
+        cmd!(
+            query "library.get",
+            "Library",
+            [],
+            None,
+            "{library?: id or name (default: the current library)} → {id, name, graphics: [{id, name, width, height, thumbnail: PNG base64}], colors: [{name, hex, color}], charStyles: [{name, attrs}], paraStyles: [{name, attrs}]}",
+            always,
+            get
+        ),
+        cmd!(
+            "library.setCurrent",
+            "Show Library",
+            [],
+            None,
+            "{library: id or name} the library the Libraries panel shows, which library commands without a `library` act on → {id}",
+            always,
+            set_current
+        ),
+        cmd!(
+            "library.create",
+            "Create New Library",
+            [],
+            None,
+            "{name?: \"My Library\"} a new empty library (its file in the library folder), made the current one → {id, name}",
+            always,
+            create
+        ),
+        cmd!(
+            "library.rename",
+            "Rename Library",
+            [],
+            None,
+            "{library?, name} rename a library (default: the current one) → {id, name}",
+            always,
+            rename
+        ),
+        cmd!(
+            "library.delete",
+            "Delete Library",
+            [],
+            None,
+            "{library?} delete a library (default: the current one) and its file; not undoable → null",
+            always,
+            delete
+        ),
+        cmd!(
+            "library.add",
+            "Add to Library",
+            [],
+            None,
+            "{library?: id or name (default: the current library, made when there is none), kind: graphic|fillColor|strokeColor|charStyle|paraStyle, ids?: objects (default: the selection), name?} add an item from the selection: graphic: a copy of the objects with every resource they use; fillColor/strokeColor: the first selected object's solid fill/stroke colour (else the default fill/stroke); charStyle/paraStyle: the selected text's character/paragraph attributes (the Type tool's range, else the first selected text object). An item the library already has (same kind and contents) isn't added again → {library, kind, name, id?: graphic id, existing: bool}",
+            has_doc,
+            add
+        ),
+        cmd!(
+            "library.use",
+            "Use Library Item",
+            [],
+            None,
+            "{library?, kind, item: name (graphic: id or name), center?: [x, y] (graphic; default: the first artboard's centre), to?: fill|stroke (colours; default: the kind's)} graphic: place a copy centred on `center`, its resources pasted along, selected, one undo step; colours: paint the selection (and the defaults) as paint.setFill/paint.setStroke; charStyle/paraStyle: add the style to the document (a name taken by different attributes gets a number) and apply it to the selected text, one undo step → {kind, ids?, style?}",
+            has_doc,
+            use_item
+        ),
+        cmd!("library.removeItem", "Delete Library Item", [], None, "{library?, kind, item: name (graphic: id or name)} → null", always, remove_item),
+    ]
+}
+
+/// The library `p` names (`library`: id or name), else the current one.
+fn library_id(s: &Session, p: &Value, cmd: &str) -> Result<String> {
+    match str_param(p, "library") {
+        Some(key) => s.libraries.find(key).ok_or_else(|| bad(cmd, format!("no library `{key}`"))),
+        None => s.libraries.current().map(str::to_string).ok_or_else(|| bad(cmd, "there is no library: create one first")),
+    }
+}
+
+fn set_current(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "library.setCurrent";
+    let key = str_param(p, "library").ok_or_else(|| bad(C, "missing `library`"))?;
+    let id = s.libraries.find(key).ok_or_else(|| bad(C, format!("no library `{key}`")))?;
+    s.libraries.current = Some(id.clone());
+    Ok(json!({ "id": id }))
+}
+
+fn counts(lib: &Library) -> Value {
+    json!({
+        "graphics": lib.graphics.len(),
+        "colors": lib.colors.len(),
+        "charStyles": lib.char_styles.len(),
+        "paraStyles": lib.para_styles.len(),
+    })
+}
+
+fn list(s: &mut Session, _: &Value) -> Result<Value> {
+    let libraries: Vec<Value> = s
+        .libraries
+        .all()
+        .iter()
+        .map(|(id, lib)| {
+            let mut v = json!({ "id": id, "name": lib.name });
+            if let (Some(o), Value::Object(c)) = (v.as_object_mut(), counts(lib)) {
+                o.extend(c);
+            }
+            v
+        })
+        .collect();
+    Ok(json!({ "libraries": libraries, "current": s.libraries.current(), "folder": s.libraries.dir() }))
+}
+
+fn get(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = library_id(s, p, "library.get")?;
+    let lib = s.libraries.get(&id).ok_or_else(|| bad("library.get", format!("no library `{id}`")))?;
+    Ok(json!({
+        "id": id,
+        "name": lib.name,
+        "graphics": lib.graphics.iter().map(|g| json!({"id": g.id, "name": g.name, "width": g.width, "height": g.height, "thumbnail": g.thumbnail})).collect::<Vec<_>>(),
+        "colors": lib.colors.iter().map(|c| json!({"name": c.name, "hex": c.color.to_hex(), "color": c.color})).collect::<Vec<_>>(),
+        "charStyles": lib.char_styles.iter().map(|t| json!({"name": t.name, "attrs": t.attrs})).collect::<Vec<_>>(),
+        "paraStyles": lib.para_styles.iter().map(|t| json!({"name": t.name, "attrs": t.attrs})).collect::<Vec<_>>(),
+    }))
+}
+
+fn create(s: &mut Session, p: &Value) -> Result<Value> {
+    let name = str_param(p, "name").map(str::trim).filter(|n| !n.is_empty()).unwrap_or("My Library").to_string();
+    let id = s.libraries.create(&name)?;
+    Ok(json!({ "id": id, "name": name }))
+}
+
+fn rename(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "library.rename";
+    let id = library_id(s, p, C)?;
+    let name = str_param(p, "name").map(str::trim).filter(|n| !n.is_empty()).ok_or_else(|| bad(C, "missing `name`"))?.to_string();
+    let n = name.clone();
+    s.libraries.change(&id, |l| {
+        l.name = n;
+        Ok(())
+    })?;
+    Ok(json!({ "id": id, "name": name }))
+}
+
+fn delete(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = library_id(s, p, "library.delete")?;
+    s.libraries.delete(&id)?;
+    ok()
+}
+
+/// The library `p` names, else the current one, else a new "My Library".
+fn target_library(s: &mut Session, p: &Value, cmd: &str) -> Result<String> {
+    if p.get("library").is_some_and(|v| !v.is_null()) || s.libraries.current().is_some() {
+        return library_id(s, p, cmd);
+    }
+    s.libraries.create("My Library")
+}
+
+/// `base`, or `base 2`, `base 3`… the first that `taken` doesn't hold.
+fn unique(base: &str, taken: impl Fn(&str) -> bool) -> String {
+    std::iter::once(base.to_string()).chain((2..).map(|n| format!("{base} {n}"))).find(|n| !taken(n)).unwrap_or_else(|| base.to_string())
+}
+
+fn add(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "library.add";
+    let kind = Kind::of(p, C)?;
+    let given = str_param(p, "name").map(str::trim).filter(|n| !n.is_empty()).map(str::to_string);
+    // Read what is added before a library is made for it, so a failure makes none.
+    let item = match kind {
+        Kind::Graphic => Item::Graphic(graphic_of(s, p, C)?),
+        Kind::FillColor | Kind::StrokeColor => Item::Color(color_of(s, p, kind == Kind::StrokeColor, C)?),
+        Kind::CharStyle | Kind::ParaStyle => {
+            let para = kind == Kind::ParaStyle;
+            let attrs = super::textstyles::selected_style_attrs(s, para)?.ok_or_else(|| bad(C, "select some type first"))?;
+            Item::Style(para, attrs)
+        }
+    };
+    let id = target_library(s, p, C)?;
+    let kind_name = str_param(p, "kind").unwrap_or_default().to_string();
+    let r = s.libraries.change(&id, |lib| {
+        let full = |n: usize| if n >= MAX_ITEMS { Err(bad(C, format!("the library holds {MAX_ITEMS} items of this kind already"))) } else { Ok(()) };
+        Ok(match item {
+            Item::Graphic(mut g) => {
+                full(lib.graphics.len())?;
+                if let Some(old) = lib.graphics.iter().find(|o| o.data == g.data) {
+                    return Ok(json!({ "name": old.name, "id": old.id, "existing": true }));
+                }
+                let base = given.clone().unwrap_or_else(|| g.name.clone());
+                g.name = unique(&base, |n| lib.graphics.iter().any(|o| o.name == n));
+                g.id = unique("graphic", |n| lib.graphics.iter().any(|o| o.id == n)).replace(' ', "-");
+                let v = json!({ "name": g.name, "id": g.id, "existing": false });
+                lib.graphics.push(g);
+                v
+            }
+            Item::Color((name, color)) => {
+                full(lib.colors.len())?;
+                if let Some(old) = lib.colors.iter().find(|o| o.color == color) {
+                    return Ok(json!({ "name": old.name, "existing": true }));
+                }
+                let name = unique(&given.clone().unwrap_or(name), |n| lib.colors.iter().any(|o| o.name == n));
+                lib.colors.push(LibraryColor { name: name.clone(), color });
+                json!({ "name": name, "existing": false })
+            }
+            Item::Style(para, attrs) => {
+                let list = if para { &mut lib.para_styles } else { &mut lib.char_styles };
+                full(list.len())?;
+                if let Some(old) = list.iter().find(|o| o.attrs == attrs) {
+                    return Ok(json!({ "name": old.name, "existing": true }));
+                }
+                let base = given.clone().unwrap_or_else(|| style_name(&attrs, para));
+                let name = unique(&base, |n| list.iter().any(|o| o.name == n));
+                list.push(TextStyleDef { name: name.clone(), attrs });
+                json!({ "name": name, "existing": false })
+            }
+        })
+    })?;
+    let mut r = r;
+    r["library"] = json!(id);
+    r["kind"] = json!(kind_name);
+    Ok(r)
+}
+
+enum Item {
+    Graphic(LibraryGraphic),
+    Color((String, Color)),
+    Style(bool, Map<String, Value>),
+}
+
+/// The selected objects (or `ids`) as a library graphic (its id and name set by the caller).
+fn graphic_of(s: &Session, p: &Value, cmd: &str) -> Result<LibraryGraphic> {
+    let st = s.doc()?;
+    let ids = match ids_param(p, "ids") {
+        Some(ids) => ids,
+        None => st.selection.in_paint_order(&st.doc),
+    };
+    let roots = super::edit::roots_of(&st.doc, ids);
+    if roots.is_empty() {
+        return Err(bad(cmd, "select the art to add first"));
+    }
+    let clip = Clipboard::copy(st, &roots);
+    let bounds = clip.bounds().ok_or_else(|| bad(cmd, "the selection draws nothing"))?;
+    let mut doc = clip.to_document();
+    let board = bounds.inflate(1.0, 1.0);
+    // One artboard round the art: what the thumbnail shows.
+    doc.artboards.truncate(1);
+    match doc.artboards.first_mut() {
+        Some(a) => a.rect = board,
+        None => return Err(bad(cmd, "the graphic's document has no artboard")),
+    }
+    let name = match roots.as_slice() {
+        [one] => st.doc.node(*one).map(|n| n.display_name()).unwrap_or_default(),
+        _ => String::new(),
+    };
+    let name = if name.trim().is_empty() || name.starts_with('<') { "Graphic".to_string() } else { name };
+    let thumbnail = super::fileio::preview_png(&doc)?.map(|b| vectorcraft_format::base64_encode(&b)).unwrap_or_default();
+    let data = vectorcraft_format::base64_encode(&vectorcraft_format::save(&doc, false));
+    Ok(LibraryGraphic { id: String::new(), name, width: bounds.width(), height: bounds.height(), data, thumbnail })
+}
+
+/// The first selected object's solid fill (`stroke`: stroke) colour, else the default one, with a
+/// name: its swatch's, else its hex.
+fn color_of(s: &Session, p: &Value, stroke: bool, cmd: &str) -> Result<(String, Color)> {
+    // A colour given (a swatch dropped on the panel).
+    if let Some(c) = p.get("color").filter(|v| !v.is_null()) {
+        let color = color_value(c).ok_or_else(|| bad(cmd, "bad colour"))?;
+        return Ok((color.to_hex(), color));
+    }
+    let st = s.doc()?;
+    let ids = match ids_param(p, "ids") {
+        Some(ids) => ids,
+        None => st.selection.objects.clone(),
+    };
+    let from_art = ids.iter().filter_map(|id| st.doc.node(*id)).find_map(|n| {
+        let paint = if stroke { n.appearance.stroke().map(|x| &x.paint) } else { n.appearance.fill().map(|f| &f.paint) };
+        paint.cloned()
+    });
+    let paint = match from_art {
+        Some(p) => p,
+        None => {
+            let d = &s.paint;
+            if stroke { d.stroke.clone() } else { d.fill.clone() }
+        }
+    };
+    match paint {
+        Paint::Solid { color, swatch, .. } => {
+            let name = swatch.filter(|n| !n.is_empty()).unwrap_or_else(|| color.to_hex());
+            Ok((name, color))
+        }
+        Paint::None => Err(bad(cmd, if stroke { "the selection has no stroke colour" } else { "the selection has no fill colour" })),
+        _ => Err(bad(cmd, "only solid colours can be added (not gradients or patterns)")),
+    }
+}
+
+/// A character style's name from its font, style and size ("Source Sans 3 Bold 24 pt"); a
+/// paragraph style's from its alignment and size too, else "Paragraph Style".
+fn style_name(attrs: &Map<String, Value>, para: bool) -> String {
+    let s = |k: &str| attrs.get(k).and_then(Value::as_str).unwrap_or_default().to_string();
+    let size = attrs.get("size").and_then(Value::as_f64).map(|v| format!("{} pt", (v * 100.0).round() / 100.0));
+    let words: Vec<String> = [s("font_family"), s("font_style")].into_iter().chain(size).filter(|w| !w.is_empty()).collect();
+    match (para, words.is_empty()) {
+        (false, false) => words.join(" "),
+        (false, true) => "Character Style".into(),
+        (true, _) => "Paragraph Style".into(),
+    }
+}
+
+/// The library item `p` names: (library id, kind).
+fn item_param<'a>(s: &Session, p: &'a Value, cmd: &str) -> Result<(String, Kind, &'a str)> {
+    let id = library_id(s, p, cmd)?;
+    let kind = Kind::of(p, cmd)?;
+    let item = str_param(p, "item").ok_or_else(|| bad(cmd, "missing `item`"))?;
+    Ok((id, kind, item))
+}
+
+fn use_item(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "library.use";
+    // A replay (the journal) carries what the item was, so it doesn't depend on the library.
+    let recorded = p.get("recorded").cloned();
+    let (kind, data) = match recorded {
+        Some(r) => (Kind::of(p, C)?, r),
+        None => {
+            let (id, kind, item) = item_param(s, p, C)?;
+            let lib = s.libraries.get(&id).ok_or_else(|| bad(C, format!("no library `{id}`")))?;
+            let missing = || bad(C, format!("the library has no item `{item}`"));
+            let data = match kind {
+                Kind::Graphic => {
+                    let g =
+                        lib.graphics.iter().find(|g| g.id == item).or_else(|| lib.graphics.iter().find(|g| g.name == item)).ok_or_else(missing)?;
+                    json!({ "data": g.data })
+                }
+                Kind::FillColor | Kind::StrokeColor => {
+                    let c = lib.colors.iter().find(|c| c.name == item).ok_or_else(missing)?;
+                    json!({ "color": c.color })
+                }
+                Kind::CharStyle | Kind::ParaStyle => {
+                    let list = if kind == Kind::ParaStyle { &lib.para_styles } else { &lib.char_styles };
+                    let t = list.iter().find(|t| t.name == item).ok_or_else(missing)?;
+                    json!({ "name": t.name, "attrs": t.attrs })
+                }
+            };
+            s.note_journal("recorded", data.clone());
+            (kind, data)
+        }
+    };
+    match kind {
+        Kind::Graphic => {
+            let bytes = data
+                .get("data")
+                .and_then(Value::as_str)
+                .and_then(vectorcraft_format::base64_decode)
+                .ok_or_else(|| bad(C, "the graphic's data is damaged"))?;
+            let doc = vectorcraft_format::load(&bytes).map_err(|e| bad(C, format!("the graphic can't be read: {e}")))?;
+            let clip = Clipboard::from_document(&doc);
+            if clip.is_empty() {
+                return Err(bad(C, "the graphic is empty"));
+            }
+            let center = match point_param(p, "center") {
+                Some(c) => c,
+                None => s.doc()?.doc.artboards.first().map(|a| a.rect.center()).unwrap_or_default(),
+            };
+            let mut r = super::edit::place_clip(s, &clip, center)?;
+            r["kind"] = json!("graphic");
+            Ok(r)
+        }
+        Kind::FillColor | Kind::StrokeColor => {
+            let stroke = match str_param(p, "to") {
+                Some("fill") => false,
+                Some("stroke") => true,
+                Some(_) => return Err(bad(C, "to must be fill or stroke")),
+                None => kind == Kind::StrokeColor,
+            };
+            let color = data.get("color").cloned().ok_or_else(|| bad(C, "no colour"))?;
+            s.execute(if stroke { "paint.setStroke" } else { "paint.setFill" }, &json!({ "color": color }))?;
+            Ok(json!({ "kind": if stroke { "strokeColor" } else { "fillColor" } }))
+        }
+        Kind::CharStyle | Kind::ParaStyle => {
+            let para = kind == Kind::ParaStyle;
+            let name = data.get("name").and_then(Value::as_str).unwrap_or("Style").to_string();
+            let attrs = data.get("attrs").and_then(Value::as_object).cloned().unwrap_or_default();
+            let doc = &s.doc()?.doc;
+            // The document's style of that name when it is the same; else a new one.
+            let same = super::textstyles::style_attrs(doc, para, &name).is_some_and(|a| a == attrs);
+            let style = if same { name } else { unique(&name, |n| super::textstyles::style_attrs(doc, para, n).is_some()) };
+            let prefix = if para { "paraStyle" } else { "charStyle" };
+            in_one_step(s, |s| {
+                if !same {
+                    s.execute(&format!("{prefix}.new"), &json!({ "name": style, "attrs": attrs }))?;
+                }
+                s.execute(&format!("{prefix}.apply"), &json!({ "name": style }))
+            })?;
+            Ok(json!({ "kind": if para { "paraStyle" } else { "charStyle" }, "style": style }))
+        }
+    }
+}
+
+/// Run `f`'s commands as one undo step (undone together when it fails), unless an undo group is
+/// already open (its own step then holds them).
+fn in_one_step<T>(s: &mut Session, f: impl FnOnce(&mut Session) -> Result<T>) -> Result<T> {
+    let open = s.active().is_some_and(|st| st.undo_group.is_some());
+    if !open {
+        s.begin_undo_group();
+    }
+    let r = f(s);
+    if !open {
+        s.end_undo_group(r.is_err());
+    }
+    r
+}
+
+fn remove_item(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "library.removeItem";
+    let (id, kind, item) = item_param(s, p, C)?;
+    let item = item.to_string();
+    s.libraries.change(&id, |lib| {
+        let before = (lib.graphics.len(), lib.colors.len(), lib.char_styles.len(), lib.para_styles.len());
+        match kind {
+            Kind::Graphic => {
+                let at = lib.graphics.iter().position(|g| g.id == item).or_else(|| lib.graphics.iter().position(|g| g.name == item));
+                if let Some(i) = at {
+                    lib.graphics.remove(i);
+                }
+            }
+            Kind::FillColor | Kind::StrokeColor => lib.colors.retain(|c| c.name != item),
+            Kind::CharStyle => lib.char_styles.retain(|t| t.name != item),
+            Kind::ParaStyle => lib.para_styles.retain(|t| t.name != item),
+        }
+        if before == (lib.graphics.len(), lib.colors.len(), lib.char_styles.len(), lib.para_styles.len()) {
+            return Err(bad(C, format!("the library has no item `{item}`")));
+        }
+        Ok(())
+    })?;
+    ok()
+}

crates/engine/src/cmd/mod.rs

@@ -32,6 +32,7 @@ pub mod help;
 pub(crate) mod inline;
 mod layer;
 mod layerpanel;
+pub mod library;
 pub mod links;
 mod live;
 pub(crate) mod maskedit;
@@ -245,6 +246,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(freeform::specs());
         v.extend(flatten::specs());
         v.extend(stylelib::specs());
+        v.extend(library::specs());
         v.extend(expand::specs());
         v.extend(attributes::specs());
         v.extend(newart::specs());

crates/engine/src/cmd/path.rs

@@ -63,7 +63,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Join",
             ["Object", "Path"],
             Some("Cmd+J"),
-            "{} join two open paths' nearest endpoints, or close a single open path",
+            "{ids?: [path, path] (default: the selected paths), ends?: [\"first\"|\"last\", \"first\"|\"last\"] (which end of each path to join, as the Pen joins them; default: the nearest pair)} join two open paths into one (the first keeps its id, selected), or close a single open path",
             has_selection,
             join
         ),
@@ -283,8 +283,27 @@ fn end_points(sp: &SubPath) -> Option<(Point, Point)> {
     Some((sp.anchors.first()?.p, sp.anchors.last()?.p))
 }
 
-fn join(s: &mut Session, _: &Value) -> Result<Value> {
-    let ids = selected_paths(s)?;
+fn join(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "path.join";
+    let ids = match ids_param(p, "ids") {
+        Some(ids) => {
+            let st = s.doc()?;
+            if let Some(id) = ids.iter().find(|id| !matches!(st.doc.node(**id).map(|n| &n.kind), Some(NodeKind::Path { .. }))) {
+                return Err(bad(C, format!("{} isn't a path", id.0)));
+            }
+            ids
+        }
+        None => selected_paths(s)?,
+    };
+    // The ends to join, as (reverse the first path, reverse the second): the first path's end
+    // must come last, the second's first.
+    let ends = match p.get("ends") {
+        None => None,
+        Some(e) => match e.as_array().map(|a| a.iter().map(Value::as_str).collect::<Vec<_>>()).as_deref() {
+            Some([Some(a @ ("first" | "last")), Some(b @ ("first" | "last"))]) => Some((*a == "first", *b == "last")),
+            _ => return Err(bad(C, "ends must be two of \"first\" and \"last\"")),
+        },
+    };
     match ids.as_slice() {
         [one] => {
             let id = *one;
@@ -305,6 +324,9 @@ fn join(s: &mut Session, _: &Value) -> Result<Value> {
         }
         [a, b, ..] => {
             let (a, b) = (*a, *b);
+            if a == b {
+                return Err(bad(C, "join two different paths"));
+            }
             s.edit("Join", |d, sel| {
                 let pb = d.node(b).and_then(|n| n.path_data()).cloned().ok_or(EngineError::NoNode(b))?;
                 let pa = path_mut(d, a)?;
@@ -316,10 +338,11 @@ fn join(s: &mut Session, _: &Value) -> Result<Value> {
                 let (Some((xf, xl)), Some((yf, yl))) = (end_points(&x), end_points(&y)) else {
                     return Err(EngineError::Other("join needs open paths".into()));
                 };
-                // Pick the closest pair of ends.
+                // The ends asked for, else the closest pair.
                 let cands =
                     [(xl.distance(yf), false, false), (xl.distance(yl), false, true), (xf.distance(yf), true, false), (xf.distance(yl), true, true)];
-                let (_, rx, ry) = cands.into_iter().min_by(|p, q| p.0.total_cmp(&q.0)).unwrap_or((0.0, false, false));
+                let (rx, ry) =
+                    ends.unwrap_or_else(|| cands.into_iter().min_by(|p, q| p.0.total_cmp(&q.0)).map_or((false, false), |(_, rx, ry)| (rx, ry)));
                 if rx {
                     x.reverse();
                 }

crates/engine/src/cmd/textstyles.rs

@@ -241,6 +241,17 @@ fn selection_attrs(s: &Session, p: &Value, kind: Kind) -> Result<Option<Map<Stri
     }))
 }
 
+/// The selected text's character (`para`: paragraph) attributes, every one of them: what a
+/// library keeps of a text style. `None` without text selected.
+pub(crate) fn selected_style_attrs(s: &Session, para: bool) -> Result<Option<Map<String, Value>>> {
+    selection_attrs(s, &json!({}), if para { Kind::Para } else { Kind::Char })
+}
+
+/// Whether the document has a character (`para`: paragraph) style `name`, and its attributes.
+pub(crate) fn style_attrs(d: &Document, para: bool, name: &str) -> Option<Map<String, Value>> {
+    if para { Kind::Para } else { Kind::Char }.attrs(d, name)
+}
+
 fn name_param<'a>(p: &'a Value, kind: Kind, verb: &str) -> Result<&'a str> {
     str_param(p, "name").ok_or_else(|| bad(&kind.cmd(verb), "missing `name`"))
 }

crates/engine/src/lib.rs

@@ -829,6 +829,8 @@ pub struct Session {
     pub(crate) freeform_point: Option<(usize, cmd::gradient::StopOwner)>,
     /// User Defined and loaded graphic style libraries (Window → Graphic Style Libraries); not saved.
     pub style_libraries: cmd::stylelib::Libraries,
+    /// The Libraries panel's libraries of graphics, colours and text styles (`library.*`).
+    pub libraries: cmd::library::Libraries,
     /// URLs recently given in the Attributes panel (`attributes.set {url}`), newest first; not saved.
     pub recent_urls: Vec<String>,
     /// The language the UI is drawn in (a language code, never `auto`), set by the UI each frame;
@@ -899,6 +901,7 @@ impl Session {
             swatch_libraries: Default::default(),
             freeform_point: None,
             style_libraries: Default::default(),
+            libraries: Default::default(),
             recent_urls: vec![],
             ui_language: None,
             journal_note: Default::default(),
@@ -1475,6 +1478,8 @@ mod tests_layerclip;
 #[cfg(test)]
 mod tests_layers;
 #[cfg(test)]
+mod tests_library;
+#[cfg(test)]
 mod tests_linked_stops;
 #[cfg(test)]
 mod tests_links;

crates/engine/src/tests_bboxrotate.rs

@@ -209,3 +209,26 @@ fn rotated_box_rect_matches_page_bounds_when_upright() {
     sel(&mut s, &[a]);
     assert_eq!(selection_box(&s), OrientedBox::aligned(Rect::new(10.0, 20.0, 40.0, 60.0)));
 }
+
+/// The Selection tool says when a drag moves, scales or rotates the selection (the canvas hides the
+/// bounding box meanwhile, #712), and not on a press that hasn't moved or a marquee.
+#[test]
+fn the_selection_tool_reports_a_transforming_drag() {
+    let mut s = session();
+    let id = id_of(&s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 100, "height": 50})).unwrap());
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    let v = ViewInfo::default();
+    s.select_tool("selection", v).unwrap();
+    let ev = |kind, x: f64, y: f64| PointerEvent::new(kind, x, y).with_mods(Mods::default());
+    s.pointer(&ev(PointerKind::Down, 150.0, 125.0), v).unwrap();
+    assert!(!s.tool_transforming(), "a press that hasn't moved");
+    s.pointer(&ev(PointerKind::Drag, 190.0, 160.0), v).unwrap();
+    assert!(s.tool_transforming(), "moving");
+    s.pointer(&ev(PointerKind::Up, 190.0, 160.0), v).unwrap();
+    assert!(!s.tool_transforming());
+    // A marquee on empty canvas isn't a transform.
+    s.pointer(&ev(PointerKind::Down, 500.0, 400.0), v).unwrap();
+    s.pointer(&ev(PointerKind::Drag, 550.0, 450.0), v).unwrap();
+    assert!(s.tool_busy() && !s.tool_transforming());
+    s.pointer(&ev(PointerKind::Up, 550.0, 450.0), v).unwrap();
+}

crates/engine/src/tests_draw2.rs

@@ -790,3 +790,57 @@ fn pen_with_alt_converts_the_anchors_of_the_path_being_drawn() {
     gesture(&mut s, &[(500.0, 400.0)], none);
     assert_eq!((paths(&s).len(), path(&s, id).subpaths[0].anchors.len()), (1, 5));
 }
+
+/// #776: the Pen continues any open path from the end clicked, selected or not, and while drawing a
+/// click on an end of another open path joins the two into one path, in one undo step, which
+/// finishes it.
+#[test]
+fn the_pen_continues_any_open_path_and_joins_another() {
+    use vectorcraft_tools::Cursor;
+    let (v, none) = (view(), Mods::default());
+    let mut s = session();
+    let a = line(&mut s, 100.0, 100.0, 200.0, 100.0);
+    let b = line(&mut s, 300.0, 200.0, 400.0, 200.0);
+    s.execute("select.none", &json!({})).unwrap();
+    s.select_tool("pen", v).unwrap();
+    assert_eq!(s.cursor(Point::new(200.0, 100.0), none, v), Cursor::PenContinue, "an end of a path that isn't selected");
+    gesture(&mut s, &[(200.0, 100.0)], none);
+    assert_eq!(s.doc().unwrap().selection.objects, vec![a]);
+    assert_eq!(s.cursor(Point::new(300.0, 200.0), none, v), Cursor::PenJoin);
+    assert_eq!(s.cursor(Point::new(350.0, 200.0), none, v), Cursor::Pen, "the middle of the other path");
+    assert_eq!(gesture(&mut s, &[(300.0, 200.0)], none), 1);
+    let pts = |s: &Session, id| path(s, id).subpaths.iter().flat_map(|sp| sp.anchors.iter().map(|x| (x.p.x, x.p.y))).collect::<Vec<_>>();
+    assert_eq!(pts(&s, a), [(100.0, 100.0), (200.0, 100.0), (300.0, 200.0), (400.0, 200.0)]);
+    assert!(s.doc().unwrap().doc.node(b).is_none() && paths(&s).len() == 1, "one path");
+    // The join finished it: the next click starts a new path.
+    gesture(&mut s, &[(500.0, 500.0)], none);
+    assert_eq!(paths(&s).len(), 2);
+    // From a path's first end, drawing goes on from there: the path is reversed.
+    s.execute("select.none", &json!({})).unwrap();
+    s.select_tool("selection", v).unwrap();
+    s.select_tool("pen", v).unwrap();
+    gesture(&mut s, &[(100.0, 100.0)], none);
+    gesture(&mut s, &[(50.0, 50.0)], none);
+    assert_eq!(pts(&s, a), [(400.0, 200.0), (300.0, 200.0), (200.0, 100.0), (100.0, 100.0), (50.0, 50.0)]);
+}
+
+/// `path.join {ids, ends}` joins the ends asked for, not the nearest pair; bad requests are errors.
+#[test]
+fn join_takes_the_paths_and_the_ends_to_join() {
+    let mut s = session();
+    let a = line(&mut s, 0.0, 0.0, 100.0, 0.0);
+    let b = line(&mut s, 110.0, 0.0, 200.0, 0.0);
+    // The far ends: a's first to b's last (the nearest pair would be a's last and b's first).
+    s.execute("path.join", &json!({"ids": [a.0, b.0], "ends": ["first", "last"]})).unwrap();
+    let pts: Vec<(f64, f64)> = path(&s, a).subpaths[0].anchors.iter().map(|x| (x.p.x, x.p.y)).collect();
+    assert_eq!(pts, [(100.0, 0.0), (0.0, 0.0), (200.0, 0.0), (110.0, 0.0)]);
+    let r = rect(&mut s, 0.0, 50.0, 10.0, 10.0);
+    for bad in [
+        json!({"ids": [a.0, a.0]}),
+        json!({"ids": [a.0, 999]}),
+        json!({"ids": [a.0, r.0], "ends": ["first"]}),
+        json!({"ids": [a.0, b.0], "ends": ["first", "middle"]}),
+    ] {
+        assert!(s.execute("path.join", &bad).is_err(), "{bad}");
+    }
+}

crates/engine/src/tests_library.rs

@@ -0,0 +1,163 @@
+//! The Libraries panel's libraries (#745): making, renaming and deleting them, adding graphics,
+//! colours and text styles from the selection, using them in another document, and keeping them
+//! in files across sessions.
+
+use serde_json::{Value, json};
+
+use super::*;
+
+fn session() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    s
+}
+
+fn run(s: &mut Session, id: &str, p: Value) -> Value {
+    s.execute(id, &p).unwrap_or_else(|e| panic!("{id} {p}: {e}"))
+}
+
+fn objects(s: &Session) -> usize {
+    s.doc().unwrap().doc.layers[0].children().map_or(0, |c| c.len())
+}
+
+fn hex_of(s: &Session, id: &Value, stroke: bool) -> String {
+    let n = s.doc().unwrap().doc.node(NodeId(id.as_u64().unwrap())).unwrap().clone();
+    let paint = if stroke { n.appearance.stroke().unwrap().paint.clone() } else { n.appearance.fill().unwrap().paint.clone() };
+    paint.color().unwrap().to_hex()
+}
+
+#[test]
+fn libraries_are_made_renamed_and_deleted() {
+    let mut s = session();
+    assert_eq!(run(&mut s, "library.list", json!({}))["libraries"], json!([]));
+    let id = run(&mut s, "library.create", json!({"name": "Brand"}))["id"].as_str().unwrap().to_string();
+    let other = run(&mut s, "library.create", json!({"name": "Brand"}))["id"].as_str().unwrap().to_string();
+    assert_ne!(id, other, "two libraries of one name are two files");
+    run(&mut s, "library.rename", json!({"library": other, "name": "Client"}));
+    let list = run(&mut s, "library.list", json!({}));
+    let names: Vec<&str> = list["libraries"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap()).collect();
+    assert_eq!(names, ["Brand", "Client"]);
+    assert!(list["folder"].is_null(), "no folder: libraries last for the session");
+    run(&mut s, "library.delete", json!({"library": "client"}));
+    assert_eq!(run(&mut s, "library.list", json!({}))["libraries"].as_array().unwrap().len(), 1);
+    assert!(s.execute("library.get", &json!({"library": "Client"})).is_err());
+}
+
+#[test]
+fn a_graphic_goes_into_a_library_and_comes_out_in_another_document() {
+    let mut s = session();
+    let id = run(&mut s, "shape.ellipse", json!({"x": 10, "y": 10, "width": 40, "height": 30}))["id"].clone();
+    run(&mut s, "paint.setFill", json!({"color": "#cc3300", "ids": [id]}));
+    run(&mut s, "select.set", json!({"ids": [id]}));
+    // With no library yet, adding makes "My Library".
+    let added = run(&mut s, "library.add", json!({"kind": "graphic"}));
+    assert_eq!(added["existing"], false);
+    let lib = added["library"].as_str().unwrap().to_string();
+    let item = added["id"].as_str().unwrap().to_string();
+    let got = run(&mut s, "library.get", json!({"library": lib}));
+    assert_eq!(got["name"], "My Library");
+    let g = &got["graphics"][0];
+    // Its size as it draws: the 1 pt stroke included.
+    assert!((g["width"].as_f64().unwrap() - 41.0).abs() < 1e-6 && (g["height"].as_f64().unwrap() - 31.0).abs() < 1e-6, "{g}");
+    assert!(!g["thumbnail"].as_str().unwrap().is_empty(), "a thumbnail of the art");
+    // The same art again is the item already there.
+    assert_eq!(run(&mut s, "library.add", json!({"kind": "graphic"}))["existing"], true);
+    // Placed in another document, centred where asked, selected, one undo step.
+    run(&mut s, "file.new", json!({"width": 300, "height": 300}));
+    let placed = run(&mut s, "library.use", json!({"library": lib, "kind": "graphic", "item": item, "center": [150, 100]}));
+    let new_id = placed["ids"][0].clone();
+    let st = s.doc().unwrap();
+    let b = st.doc.node(NodeId(new_id.as_u64().unwrap())).unwrap().geometric_bounds().unwrap();
+    assert!((b.center().x - 150.0).abs() < 1e-6 && (b.center().y - 100.0).abs() < 1e-6, "{b:?}");
+    assert_eq!(st.selection.objects, vec![NodeId(new_id.as_u64().unwrap())]);
+    assert_eq!(hex_of(&s, &new_id, false), "#cc3300");
+    assert_eq!(objects(&s), 1);
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(objects(&s), 0);
+    // A graphic is removed by id.
+    run(&mut s, "library.removeItem", json!({"library": lib, "kind": "graphic", "item": item}));
+    assert!(s.execute("library.use", &json!({"library": lib, "kind": "graphic", "item": item})).is_err());
+}
+
+#[test]
+fn colours_come_from_the_selection_and_paint_it() {
+    let mut s = session();
+    let lib = run(&mut s, "library.create", json!({}))["id"].as_str().unwrap().to_string();
+    let a = run(&mut s, "shape.rectangle", json!({"x": 0, "y": 0, "width": 20, "height": 20}))["id"].clone();
+    run(&mut s, "paint.setFill", json!({"color": "#123456", "ids": [a]}));
+    run(&mut s, "paint.setStroke", json!({"color": "#abcdef", "ids": [a]}));
+    run(&mut s, "select.set", json!({"ids": [a]}));
+    assert_eq!(run(&mut s, "library.add", json!({"library": lib, "kind": "fillColor"}))["name"], "#123456");
+    assert_eq!(run(&mut s, "library.add", json!({"library": lib, "kind": "strokeColor"}))["name"], "#abcdef");
+    assert_eq!(run(&mut s, "library.add", json!({"library": lib, "kind": "fillColor"}))["existing"], true);
+    let b = run(&mut s, "shape.rectangle", json!({"x": 50, "y": 0, "width": 20, "height": 20}))["id"].clone();
+    run(&mut s, "select.set", json!({"ids": [b]}));
+    run(&mut s, "library.use", json!({"library": lib, "kind": "fillColor", "item": "#123456"}));
+    run(&mut s, "library.use", json!({"library": lib, "kind": "fillColor", "item": "#123456", "to": "stroke"}));
+    assert_eq!(hex_of(&s, &b, false), "#123456");
+    assert_eq!(hex_of(&s, &b, true), "#123456");
+    assert!(s.execute("library.use", &json!({"library": lib, "kind": "fillColor", "item": "#nope"})).is_err());
+}
+
+#[test]
+fn text_styles_come_from_the_selected_type_and_apply_in_one_step() {
+    let mut s = session();
+    let lib = run(&mut s, "library.create", json!({}))["id"].as_str().unwrap().to_string();
+    assert!(s.execute("library.add", &json!({"library": lib, "kind": "charStyle"})).is_err(), "no type selected");
+    let t = run(&mut s, "text.create", json!({"x": 10, "y": 50, "text": "Heading", "size": 31}))["id"].clone();
+    run(&mut s, "select.set", json!({"ids": [t]}));
+    let name = run(&mut s, "library.add", json!({"library": lib, "kind": "charStyle"}))["name"].as_str().unwrap().to_string();
+    assert!(name.ends_with("31 pt"), "{name}");
+    run(&mut s, "library.add", json!({"library": lib, "kind": "paraStyle"}));
+    // Another document: the style is added and applied, and one undo takes both back.
+    run(&mut s, "file.new", json!({"width": 200, "height": 200}));
+    let u = run(&mut s, "text.create", json!({"x": 10, "y": 50, "text": "Body", "size": 9}))["id"].clone();
+    run(&mut s, "select.set", json!({"ids": [u]}));
+    let undo = s.doc().unwrap().history.undo.len();
+    let r = run(&mut s, "library.use", json!({"library": lib, "kind": "charStyle", "item": name}));
+    assert_eq!(r["style"], name);
+    assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1, "one undo step");
+    let size = |s: &Session| match &s.doc().unwrap().doc.node(NodeId(u.as_u64().unwrap())).unwrap().kind {
+        vectorcraft_doc::NodeKind::Text(t) => t.runs[0].style.size,
+        _ => 0.0,
+    };
+    assert_eq!(size(&s), 31.0);
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(size(&s), 9.0);
+    assert!(s.doc().unwrap().doc.char_styles.iter().all(|c| c.name != name), "the style went with the undo");
+    // A style of that name with other attributes in the document: the library's comes in numbered.
+    run(&mut s, "charStyle.new", json!({"name": name, "attrs": {"size": 5}}));
+    let r = run(&mut s, "library.use", json!({"library": lib, "kind": "charStyle", "item": name}));
+    assert_eq!(r["style"], format!("{name} 2"));
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn libraries_are_kept_in_files_across_sessions() {
+    let dir = std::env::temp_dir().join(format!("vc-libraries-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let folder = dir.to_string_lossy().to_string();
+    let mut s = session();
+    s.libraries.set_dir(Some(folder.clone()));
+    let lib = run(&mut s, "library.create", json!({"name": "Kept"}))["id"].as_str().unwrap().to_string();
+    let id = run(&mut s, "shape.rectangle", json!({"x": 0, "y": 0, "width": 10, "height": 10}))["id"].clone();
+    run(&mut s, "select.set", json!({"ids": [id]}));
+    run(&mut s, "library.add", json!({"library": lib, "kind": "graphic", "name": "Square"}));
+    run(&mut s, "library.add", json!({"library": lib, "kind": "fillColor"}));
+    let mut t = session();
+    t.libraries.set_dir(Some(folder.clone()));
+    let got = run(&mut t, "library.get", json!({"library": "Kept"}));
+    assert_eq!(got["graphics"][0]["name"], "Square");
+    assert_eq!(got["colors"].as_array().unwrap().len(), 1);
+    run(&mut t, "library.delete", json!({"library": "Kept"}));
+    let mut u = session();
+    u.libraries.set_dir(Some(folder));
+    assert_eq!(run(&mut u, "library.list", json!({}))["libraries"], json!([]), "deleting removes the file");
+    // A damaged file is skipped.
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("Bad.vclibrary"), b"{not json").unwrap();
+    let mut v = session();
+    v.libraries.set_dir(Some(dir.to_string_lossy().to_string()));
+    assert_eq!(run(&mut v, "library.list", json!({}))["libraries"], json!([]));
+    let _ = std::fs::remove_dir_all(&dir);
+}

crates/engine/src/tests_xform.rs

@@ -316,6 +316,106 @@ fn artboard_move_copy_reports_the_copies_and_follows_move_art() {
     assert_eq!(ids.len(), 3, "every artboard has an id of its own");
 }
 
+fn stroke_width(s: &Session, id: NodeId) -> f64 {
+    s.doc().unwrap().doc.node(id).unwrap().appearance.stroke().unwrap().width
+}
+
+fn guide_positions(s: &Session) -> Vec<f64> {
+    s.doc().unwrap().doc.guides.iter().map(|g| g.pos).collect()
+}
+
+/// Scale Artwork with Artboard (#602): `artboard.setProps {scaleArt}` takes the art fully inside the
+/// artboard and its guides from the old rectangle onto the new one, each side by its own ratio, in
+/// one undo step; art partly outside and canvas guides stay.
+#[test]
+fn artboard_set_props_scales_the_art_and_guides_with_the_artboard() {
+    let mut s = session();
+    let inside = rect(&mut s, 100.0, 100.0, 200.0, 100.0);
+    s.execute("stroke.set", &json!({"weight": 4})).unwrap();
+    let partly = rect(&mut s, 700.0, 500.0, 200.0, 200.0);
+    for (vertical, pos, artboard) in [(true, 400.0, json!(0)), (false, 300.0, json!(0)), (true, 400.0, json!(null))] {
+        s.execute("guide.add", &json!({"vertical": vertical, "pos": pos, "artboard": artboard})).unwrap();
+    }
+    let before = s.doc().unwrap().doc.clone();
+    // Half the size: half the art, half the stroke (Scale Strokes & Effects).
+    let out = s.execute("artboard.setProps", &json!({"index": 0, "width": 400, "height": 300, "scaleArt": true, "strokes": true})).unwrap();
+    assert_eq!(out["scaled"], json!([inside.0]));
+    assert_eq!(s.doc().unwrap().doc.artboards[0].rect, Rect::new(0.0, 0.0, 400.0, 300.0));
+    assert_eq!(bounds(&s, inside), Rect::new(50.0, 50.0, 150.0, 100.0));
+    assert_eq!(stroke_width(&s, inside), 2.0);
+    assert_eq!(bounds(&s, partly), Rect::new(700.0, 500.0, 900.0, 700.0), "art partly outside stays");
+    assert_eq!(guide_positions(&s), vec![200.0, 150.0, 400.0], "the artboard's guides scale, the canvas guide stays");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(*s.doc().unwrap().doc, *before, "one undo step");
+    // Moved and stretched (left edge to -100, twice as wide), strokes kept: the art follows.
+    s.execute("artboard.setProps", &json!({"index": 0, "x": -100, "width": 1600, "scaleArt": true, "strokes": false})).unwrap();
+    assert_eq!(bounds(&s, inside), Rect::new(100.0, 100.0, 500.0, 200.0));
+    assert_eq!(stroke_width(&s, inside), 4.0);
+    assert_eq!(guide_positions(&s), vec![700.0, 300.0, 400.0]);
+}
+
+/// Without `scaleArt` a resize leaves the art and guides alone (and returns nothing, as before);
+/// with it, a pure move scales nothing (guides move along, as they always have).
+#[test]
+fn artboard_set_props_scales_art_only_when_asked_and_resized() {
+    let mut s = session();
+    let r = rect(&mut s, 100.0, 100.0, 200.0, 100.0);
+    s.execute("guide.add", &json!({"vertical": true, "pos": 400, "artboard": 0})).unwrap();
+    assert_eq!(s.execute("artboard.setProps", &json!({"index": 0, "width": 400})).unwrap(), Value::Null);
+    assert_eq!(bounds(&s, r), Rect::new(100.0, 100.0, 300.0, 200.0));
+    assert_eq!(guide_positions(&s), vec![400.0]);
+    let out = s.execute("artboard.setProps", &json!({"index": 0, "x": 50, "scaleArt": true})).unwrap();
+    assert_eq!(out["scaled"], json!([]));
+    assert_eq!(bounds(&s, r), Rect::new(100.0, 100.0, 300.0, 200.0));
+    assert_eq!(guide_positions(&s), vec![450.0]);
+    assert!(s.execute("artboard.setProps", &json!({"index": 9, "width": 10, "scaleArt": true})).is_err());
+}
+
+/// Locked and hidden art scales only with Move Locked and Hidden Artwork with Artboard, as it
+/// moves only with it.
+#[test]
+fn scale_artwork_with_artboard_leaves_locked_art_unless_the_preference_says() {
+    let mut s = session();
+    let locked = rect(&mut s, 100.0, 100.0, 200.0, 100.0);
+    s.execute("object.lock", &json!({})).unwrap();
+    let scaled = |s: &mut Session| {
+        let out = s.execute("artboard.setProps", &json!({"index": 0, "width": 400, "height": 300, "scaleArt": true})).unwrap();
+        s.execute("edit.undo", &json!({})).unwrap();
+        out["scaled"].clone()
+    };
+    assert_eq!(scaled(&mut s), json!([]));
+    s.execute("prefs.set", &json!({"key": "moveLockedWithArtboard", "value": true})).unwrap();
+    assert_eq!(scaled(&mut s), json!([locked.0]));
+    // The choice is journaled: replayed with the preference off, the same art scales.
+    s.execute("artboard.setProps", &json!({"index": 0, "width": 400, "height": 300, "scaleArt": true})).unwrap();
+    assert_eq!(s.journal.last().unwrap().1["lockedAndHidden"], true);
+    let (id, p) = s.journal.last().unwrap().clone();
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("prefs.set", &json!({"key": "moveLockedWithArtboard", "value": false})).unwrap();
+    assert_eq!(s.execute(&id, &p).unwrap()["scaled"], json!([locked.0]));
+}
+
+/// The Artboard tool with its `scaleArt` option on resizes proportionally and the art scales with
+/// the artboard, in one undo step.
+#[test]
+fn artboard_tool_scales_art_with_the_artboard() {
+    let mut s = session();
+    let r = rect(&mut s, 100.0, 100.0, 200.0, 100.0);
+    let before = s.doc().unwrap().doc.clone();
+    s.set_tool_options(Some("artboard"), json!({"scaleArt": true}).as_object().unwrap());
+    // The right handle 100 pt out: 9/8 as wide, and as tall about the middle of the left side.
+    gesture(&mut s, "artboard", &[(800.0, 300.0), (850.0, 300.0), (900.0, 300.0), (900.0, 300.0)], Mods::default());
+    assert_eq!(s.doc().unwrap().doc.artboards[0].rect, Rect::new(0.0, -37.5, 900.0, 637.5));
+    assert_eq!(bounds(&s, r), Rect::new(112.5, 75.0, 337.5, 187.5));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(*s.doc().unwrap().doc, *before, "one undo step");
+    // Off again (the option is remembered like Move Artwork with Artboard): the art stays.
+    s.set_tool_options(Some("artboard"), json!({"scaleArt": false}).as_object().unwrap());
+    gesture(&mut s, "artboard", &[(800.0, 300.0), (850.0, 300.0), (900.0, 300.0), (900.0, 300.0)], Mods::default());
+    assert_eq!(s.doc().unwrap().doc.artboards[0].rect, Rect::new(0.0, 0.0, 900.0, 600.0));
+    assert_eq!(bounds(&s, r), Rect::new(100.0, 100.0, 300.0, 200.0));
+}
+
 #[test]
 fn magic_wand_selects_same_fill() {
     let mut s = session();

crates/engine/src/tooling.rs

@@ -358,6 +358,11 @@ impl Session {
         self.tool.busy()
     }
 
+    /// Is the active tool moving, scaling or rotating the selection with a drag?
+    pub fn tool_transforming(&self) -> bool {
+        self.tool.transforming()
+    }
+
     /// Does the active tool take `key` ahead of the shortcuts bound to it (see `Tool::claims_key`)?
     pub fn tool_claims_key(&mut self, key: ToolKey, view: ViewInfo) -> bool {
         self.plane_key(key).is_some() || self.with_tool_cx(view, |t, cx| t.claims_key(cx, key))

crates/engine/tests/affinity_artboards.rs

@@ -0,0 +1,147 @@
+//! Synthetic version-12 regression documents exercise placement and clipping, independently of
+//! the pinned real-file corpus. These are reader fixtures, never claimed as Affinity-authored.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use kurbo::Rect;
+use vectorcraft_affinity::synth::{self, F, Method, tag};
+use vectorcraft_doc::{Document, Node, NodeKind};
+
+fn field(t: &[u8; 4], f: F) -> (vectorcraft_affinity::stream::Tag, F) {
+    (tag(t), f)
+}
+
+fn red(id: u32) -> F {
+    F::Def(
+        id,
+        vec![tag(b"FDsc")],
+        vec![field(
+            b"FDeF",
+            F::Def(
+                id + 1,
+                vec![tag(b"FilS")],
+                vec![field(
+                    b"Colr",
+                    F::Def(
+                        id + 2,
+                        vec![tag(b"RGBA")],
+                        vec![field(b"_col", F::Struct([1f32, 0.0, 0.0, 1.0].into_iter().flat_map(f32::to_le_bytes).collect()))],
+                    ),
+                )],
+            ),
+        )],
+    )
+}
+
+fn shape(id: u32, name: &str, board: bool, ellipse: bool, bounds: [f64; 4], transform: [f64; 6], children: Vec<F>) -> F {
+    F::Def(
+        id,
+        vec![tag(b"ShpN")],
+        vec![
+            field(b"Desc", F::Str(name.into())),
+            field(b"ABEn", F::Bool(board)),
+            field(b"Shpe", F::Def(id + 1, vec![tag(if ellipse { b"ShpE" } else { b"ShNR" })], vec![])),
+            field(b"ShpB", F::F64s(bounds.to_vec())),
+            field(b"Xfrm", F::F64s(transform.to_vec())),
+            field(b"BFFl", F::Shared(vec![red(id + 2)])),
+            field(b"Chld", F::Shared(children)),
+        ],
+    )
+}
+
+const IDENTITY: [f64; 6] = [1.0, 0.0, 0.0, 0.0, 1.0, 0.0];
+
+fn document(spreads: Vec<Vec<F>>, dpi: f64, method: Method) -> Vec<u8> {
+    let spreads = spreads
+        .into_iter()
+        .enumerate()
+        .map(|(i, nodes)| {
+            F::Def(1000 + i as u32, vec![tag(b"Sprd")], vec![field(b"SprB", F::F64s(vec![0.0, 0.0, 200.0, 100.0])), field(b"Chld", F::Shared(nodes))])
+        })
+        .collect();
+    let doc = synth::stream(&[
+        field(b"UVCn", F::Obj(tag(b"UVCn"), vec![field(b"UPPI", F::F64(dpi))])),
+        field(b"DocR", F::Def(2000, vec![tag(b"DocN")], vec![field(b"Chld", F::Shared(spreads))])),
+    ]);
+    synth::container(&[("doc.dat", &doc, method)], None)
+}
+
+fn find<'a>(nodes: &'a [std::sync::Arc<Node>], name: &str) -> Option<&'a Node> {
+    nodes.iter().find_map(|n| {
+        if n.name.as_deref() == Some(name) && matches!(n.kind, NodeKind::Group { .. }) {
+            Some(n.as_ref())
+        } else {
+            n.children().and_then(|c| find(c, name))
+        }
+    })
+}
+
+#[test]
+fn nested_boards_keep_order_and_negative_origins_at_document_resolution() {
+    let inner = shape(20, "Inner", true, false, [0.0, 0.0, 20.0, 10.0], [1.0, 0.0, 10.0, 0.0, 1.0, 5.0], vec![]);
+    let outer = shape(10, "Outer", true, false, [0.0, 0.0, 100.0, 60.0], [1.0, 0.0, -40.0, 0.0, 1.0, -20.0], vec![inner]);
+    let last = shape(30, "Last", true, false, [0.0, 0.0, 40.0, 80.0], [1.0, 0.0, 150.0, 0.0, 1.0, 0.0], vec![]);
+    for method in [Method::Stored, Method::Zlib, Method::Zstd] {
+        let loaded = vectorcraft_engine::cmd::fileio::load("boards.af", &document(vec![vec![outer.clone(), last.clone()]], 144.0, method)).unwrap();
+        let boards = &loaded.doc.artboards;
+        assert_eq!(boards.iter().map(|b| b.name.as_str()).collect::<Vec<_>>(), ["Outer", "Inner", "Last"]);
+        assert_eq!(boards.iter().map(|b| b.id).collect::<Vec<_>>(), [1, 2, 3]);
+        assert_eq!(boards[0].rect, Rect::new(-20.0, -10.0, 30.0, 20.0));
+        assert_eq!(boards[1].rect, Rect::new(-15.0, -7.5, -5.0, -2.5));
+        assert_eq!(boards[2].rect, Rect::new(75.0, 0.0, 95.0, 40.0));
+        let reopened = vectorcraft_format::load_file(&vectorcraft_format::save_file(&loaded.doc)).unwrap();
+        assert_eq!(reopened.doc.artboards, loaded.doc.artboards);
+        assert_eq!(reopened.doc.layers, loaded.doc.layers);
+    }
+}
+
+fn pixel(d: &Document, x: usize, y: usize) -> [u8; 4] {
+    let img = vectorcraft_render::Renderer::new().render_region(d, d.artboards[0].rect, 1.0, false);
+    img.to_straight()[(y * img.width as usize + x) * 4..][..4].try_into().unwrap()
+}
+
+#[test]
+fn rotated_board_clips_to_its_outline_instead_of_its_export_rectangle() {
+    let child = shape(20, "Oversized", false, false, [-100.0, -100.0, 200.0, 200.0], IDENTITY, vec![]);
+    let c = std::f64::consts::FRAC_1_SQRT_2;
+    let board = shape(10, "Diamond", true, false, [0.0, 0.0, 80.0, 80.0], [c, -c, 60.0, c, c, 0.0], vec![child]);
+    let loaded = vectorcraft_engine::cmd::fileio::load("rotated.af", &document(vec![vec![board]], 72.0, Method::Zstd)).unwrap();
+    let d = &loaded.doc;
+    let g = find(&d.layers, "Diamond").unwrap();
+    let NodeKind::Path { path, clipping: true, .. } = &g.children().unwrap()[0].kind else { panic!() };
+    let a = &path.subpaths[0].anchors;
+    assert!((a[0].p.x - 60.0).abs() < 1e-8 && a[0].p.y.abs() < 1e-8);
+    assert!((a[1].p.x - (60.0 + 80.0 * c)).abs() < 1e-8);
+    assert_eq!(pixel(d, 2, 2), [0, 0, 0, 0], "bbox corners are outside the diamond");
+    assert_eq!(pixel(d, 55, 55), [255, 0, 0, 255]);
+}
+
+#[test]
+fn converted_ellipse_artboard_keeps_curved_clipping() {
+    let child = shape(20, "Oversized", false, false, [-20.0, -20.0, 120.0, 120.0], IDENTITY, vec![]);
+    let board = shape(10, "Ellipse", true, true, [0.0, 0.0, 100.0, 100.0], IDENTITY, vec![child]);
+    let loaded = vectorcraft_engine::cmd::fileio::load("ellipse.af", &document(vec![vec![board]], 72.0, Method::Stored)).unwrap();
+    assert_eq!(pixel(&loaded.doc, 2, 2), [0, 0, 0, 0]);
+    assert_eq!(pixel(&loaded.doc, 50, 50), [255, 0, 0, 255]);
+}
+
+#[test]
+fn invalid_board_keeps_children_and_reports_the_loss() {
+    let child = shape(20, "Retained", false, false, [1.0, 2.0, 10.0, 20.0], IDENTITY, vec![]);
+    let board = shape(10, "Invalid", true, false, [0.0, 0.0, 0.0, 100.0], IDENTITY, vec![child]);
+    let loaded = vectorcraft_engine::cmd::fileio::load("invalid.af", &document(vec![vec![board]], 72.0, Method::Stored)).unwrap();
+    assert!(loaded.warnings.iter().any(|w| w.contains("artboard without valid bounds")));
+    assert!(!loaded.preview_only);
+    assert_eq!(loaded.doc.artboards[0].rect, Rect::new(0.0, 0.0, 200.0, 100.0));
+    let invalid = find(&loaded.doc.layers, "Invalid").unwrap();
+    assert_eq!(invalid.children().unwrap()[0].name.as_deref(), Some("Retained"));
+}
+
+#[test]
+fn several_spreads_preserve_each_board_and_leave_room_between_spreads() {
+    let a = shape(10, "First", true, false, [0.0, 0.0, 100.0, 60.0], IDENTITY, vec![]);
+    let b = shape(20, "Second", true, false, [0.0, 0.0, 100.0, 60.0], IDENTITY, vec![]);
+    let loaded = vectorcraft_engine::cmd::fileio::load("spreads.af", &document(vec![vec![a], vec![b]], 72.0, Method::Stored)).unwrap();
+    assert_eq!(loaded.doc.artboards.len(), 2);
+    assert_eq!(loaded.doc.artboards[0].rect, Rect::new(0.0, 0.0, 100.0, 60.0));
+    assert_eq!(loaded.doc.artboards[1].rect, Rect::new(136.0, 0.0, 236.0, 60.0));
+}

crates/engine/tests/affinity_corpus.rs

@@ -4,14 +4,27 @@
 //! (0–255 per channel, both flattened on white, at the thumbnail's size) must stay under its
 //! ceiling, which sits just above the difference measured when the importer landed.
 //!
-//! Skips when `corpus/affinity` is absent.
+//! Each artboard is checked. Local runs may skip an absent corpus; CI requires the complete
+//! pinned corpus with `AFFINITY_CORPUS_REQUIRED=1`. Tests recheck hashes before using inputs.
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 use std::path::PathBuf;
 
+#[path = "../../affinity/tests/support/corpus.rs"]
+mod corpus_gate;
+
 /// (file, ceiling). Measured differences when the importer landed are in the comments.
 const FILES: &[(&str, f64)] = &[
+    ("patchy-artboards.af", 0.25),              // 0.00 across both boards, including overflow clipping
+    ("patchy-rgba8.af", 3.0),                   // 2.34: embedded thumbnail versus raster sampling
+    ("patchy-rgba16.af", 3.0),                  // 2.34
+    ("patchy-dpi300.af", 1.5),                  // 0.87
+    ("patchy-group.af", 0.25),                  // 0.00
+    ("patchy-transform.af", 1.0),               // 0.19
+    ("patchy-vector.af", 1.0),                  // 0.12
+    ("patchy-lazy-placed.af", 1.0),             // 0.50: upstream byte-derived lazy-image regression
+    ("patchy-embedded-jpeg.af", 1.0),           // 0.50
     ("affinity3-mexican-guy.af", 3.0),          // 1.80: brush strokes as plain strokes
     ("affinity3-mexican-man.af", 3.5),          // 2.24
     ("affinity3-mexican-woman.af", 3.5),        // 2.55
@@ -37,8 +50,7 @@ const FILES: &[(&str, f64)] = &[
 ];
 
 fn corpus() -> Option<PathBuf> {
-    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
-    dir.join("SOURCES.md").exists().then_some(dir)
+    corpus_gate::pinned()
 }
 
 /// Mean absolute difference of two RGBA8 images of one size, both composited on white.
@@ -48,7 +60,7 @@ fn difference(a: &[u8], b: &[u8]) -> f64 {
         [0, 1, 2].map(|i| f64::from(p[i]) * al + 255.0 * (1.0 - al))
     };
     let (mut sum, mut n) = (0.0, 0usize);
-    for (p, q) in a.chunks_exact(4).zip(b.chunks_exact(4)) {
+    for (p, q) in a.as_chunks::<4>().0.iter().zip(b.as_chunks::<4>().0.iter()) {
         let (x, y) = (white(p), white(q));
         sum += (0..3).map(|i| (x[i] - y[i]).abs()).sum::<f64>();
         n += 3;
@@ -69,23 +81,178 @@ fn public_affinity_documents_render_like_their_affinity_thumbnails() {
         assert!(!loaded.preview_only, "{name} opened as its preview: {:?}", loaded.warnings);
         let d = &loaded.doc;
         let thumb = image::load_from_memory(vectorcraft_affinity::preview(&bytes).unwrap().png).unwrap().to_rgba8();
-        // The thumbnail shows the first page, or every artboard: compare the largest artboard
-        // with its part of the thumbnail.
+        // The embedded thumbnail shows the union of the artboards. Check every board,
+        // including small ones that the previous largest-board-only check omitted.
         let union = d.artboards.iter().map(|a| a.rect).reduce(|a, b| a.union(b)).unwrap();
+        assert!(union.width().is_finite() && union.width() > 0.0);
         let scale = f64::from(thumb.width()) / union.width();
-        let board = d.artboards.iter().max_by(|a, b| a.rect.area().total_cmp(&b.rect.area())).unwrap().rect;
-        let crop = |v: f64| (v * scale).round().max(0.0) as u32;
-        let (x, y) = (crop(board.x0 - union.x0), crop(board.y0 - union.y0));
-        let (w, h) = (crop(board.width()).min(thumb.width() - x), crop(board.height()).min(thumb.height() - y));
-        let expected = image::imageops::crop_imm(&thumb, x, y, w, h).to_image();
-        let rendered = vectorcraft_render::Renderer::new().render_region(d, board, scale, false);
-        let got = image::RgbaImage::from_raw(rendered.width, rendered.height, rendered.to_straight()).unwrap();
-        let got = image::imageops::resize(&got, w, h, image::imageops::FilterType::Triangle);
-        let diff = difference(expected.as_raw(), got.as_raw());
-        eprintln!("{name}: {diff:.2} (ceiling {ceiling})");
-        if diff > *ceiling {
-            failures.push(format!("{name}: {diff:.2} > {ceiling}"));
+        for (index, artboard) in d.artboards.iter().enumerate() {
+            let board = artboard.rect;
+            let crop = |v: f64| (v * scale).round().max(0.0) as u32;
+            let (x, y) = (crop(board.x0 - union.x0), crop(board.y0 - union.y0));
+            assert!(x < thumb.width() && y < thumb.height(), "{name} board {index}: thumbnail crop outside image");
+            let (w, h) = (crop(board.width()).min(thumb.width() - x), crop(board.height()).min(thumb.height() - y));
+            assert!(w > 0 && h > 0, "{name} board {index}: empty thumbnail crop");
+            let expected = image::imageops::crop_imm(&thumb, x, y, w, h).to_image();
+            let rendered = vectorcraft_render::Renderer::new().render_region(d, board, scale, false);
+            let got = image::RgbaImage::from_raw(rendered.width, rendered.height, rendered.to_straight()).unwrap();
+            let got = image::imageops::resize(&got, w, h, image::imageops::FilterType::Triangle);
+            let diff = difference(expected.as_raw(), got.as_raw());
+            eprintln!("{name} board {index} ({}): {diff:.2} (ceiling {ceiling})", artboard.name);
+            if diff > *ceiling {
+                failures.push(format!("{name} board {index}: {diff:.2} > {ceiling}"));
+            }
         }
     }
     assert!(failures.is_empty(), "{}", failures.join("\n"));
 }
+
+/// Every actual .af fixture must open as editable art, retain its complete native document,
+/// and export every artboard. Reimporting our SVG/PDF and comparing our PSD merged pixels
+/// checks our export paths; it is not an independent Affinity-versus-PSD fidelity oracle.
+#[test]
+fn affinity3_all_artboards_survive_native_save_and_export() {
+    let Some(dir) = corpus() else { return };
+    let names: Vec<_> = include_str!("../../../xtask/affinity-corpus.sha256")
+        .lines()
+        .filter_map(|l| l.split_once("  "))
+        .map(|(_, name)| name)
+        .filter(|name| name.ends_with(".af"))
+        .collect();
+    for name in names {
+        let bytes = std::fs::read(dir.join(name)).unwrap();
+        let loaded = vectorcraft_engine::cmd::fileio::load(name, &bytes).unwrap();
+        assert!(!loaded.preview_only, "{name}: preview-only import: {:?}", loaded.warnings);
+        let doc = &loaded.doc;
+        assert!(!doc.artboards.is_empty(), "{name}: no artboards");
+        let native = vectorcraft_format::save(doc, false);
+        let reloaded = vectorcraft_format::load(&native).unwrap();
+        assert_eq!(serde_json::to_value(&reloaded).unwrap(), serde_json::to_value(doc).unwrap(), "{name}: native save/reload lost document data");
+        if doc.artboards.len() > 1 {
+            let params = serde_json::json!({"range": "all", "useArtboards": true, "preserveEditing": false});
+            let svg = vectorcraft_engine::cmd::fileio::encode_all(doc, "svg", &params).unwrap();
+            assert_eq!(svg.files.len(), doc.artboards.len(), "{name}: SVG must write every artboard");
+            assert_eq!(
+                svg.files.iter().map(|(index, _)| *index).collect::<Vec<_>>(),
+                (0..doc.artboards.len()).map(Some).collect::<Vec<_>>(),
+                "{name}: SVG artboard order"
+            );
+            let pdf = vectorcraft_engine::cmd::fileio::encode(doc, "pdf", &params).unwrap();
+            assert_eq!(
+                vectorcraft_pdf::info(&pdf, None).unwrap().pages.len(),
+                doc.artboards.len(),
+                "{name}: PDF must write every artboard as a page"
+            );
+        }
+        for (index, board) in doc.artboards.iter().enumerate() {
+            assert!(
+                board.rect.width().is_finite() && board.rect.width() > 0.0 && board.rect.height().is_finite() && board.rect.height() > 0.0,
+                "{name} board {index}: invalid bounds"
+            );
+            let scale = 128.0 / board.rect.width().max(board.rect.height());
+            let params =
+                serde_json::json!({"artboard": index, "useArtboards": true, "scale": scale, "background": "transparent", "preserveEditing": false});
+            let svg = vectorcraft_engine::cmd::fileio::encode(doc, "svg", &params).unwrap();
+            let svg = vectorcraft_svg::import(std::str::from_utf8(&svg).unwrap()).unwrap();
+            assert_eq!(svg.artboards.len(), 1, "{name} board {index}: SVG page count");
+            assert!((svg.artboards[0].rect.width() - board.rect.width()).abs() < 0.01, "{name} board {index}: SVG width");
+            assert!((svg.artboards[0].rect.height() - board.rect.height()).abs() < 0.01, "{name} board {index}: SVG height");
+            let pdf = vectorcraft_engine::cmd::fileio::encode(doc, "pdf", &params).unwrap();
+            let info = vectorcraft_pdf::info(&pdf, None).unwrap();
+            assert_eq!(info.pages.len(), 1, "{name} board {index}: PDF page count");
+            assert!((info.pages[0].width - board.rect.width()).abs() < 0.01, "{name} board {index}: PDF width");
+            assert!((info.pages[0].height - board.rect.height()).abs() < 0.01, "{name} board {index}: PDF height");
+            assert_eq!(vectorcraft_pdf::import(&pdf).unwrap().artboards.len(), 1, "{name} board {index}: PDF reimport");
+            let psd = vectorcraft_engine::cmd::fileio::encode(doc, "psd", &params).unwrap();
+            let png = vectorcraft_engine::cmd::fileio::encode(doc, "png", &params).unwrap();
+            let png = image::load_from_memory(&png).unwrap().to_rgba8();
+            let (merged, has_alpha) = psd_merged(&psd);
+            assert_eq!(merged.dimensions(), png.dimensions(), "{name} board {index}: PSD image dimensions");
+            // PSD merged RGB is stored on a white matte for readers that ignore alpha;
+            // the separate alpha plane, when present, keeps the original coverage.
+            for (pixel, (p, q)) in png.pixels().zip(merged.pixels()).enumerate() {
+                if has_alpha {
+                    assert_eq!(p[3], q[3], "{name} board {index} pixel {pixel}: PSD alpha");
+                }
+                let alpha = u32::from(p[3]);
+                for channel in 0..3 {
+                    let expected = ((u32::from(p[channel]) * alpha + 255 * (255 - alpha) + 127) / 255) as u8;
+                    assert!(
+                        q[channel].abs_diff(expected) <= 1,
+                        "{name} board {index} pixel {pixel} channel {channel}: PSD white-matted RGB {} differs from PNG on white {expected}",
+                        q[channel]
+                    );
+                }
+            }
+            eprintln!("{name} board {index}: native/SVG/PDF/PSD verified (import warnings: {:?})", loaded.warnings);
+        }
+    }
+}
+
+/// Minimal test-only decoder written from the public PSD file-format layout:
+/// https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/
+/// It independently reads the merged RGB planes and PackBits rows, skipping metadata/layers.
+fn psd_merged(bytes: &[u8]) -> (image::RgbaImage, bool) {
+    let be16 = |at: usize| u16::from_be_bytes(bytes[at..at + 2].try_into().unwrap());
+    let be32 = |at: usize| u32::from_be_bytes(bytes[at..at + 4].try_into().unwrap()) as usize;
+    assert_eq!(&bytes[..4], b"8BPS");
+    assert_eq!(be16(4), 1);
+    assert_eq!(&bytes[6..12], &[0; 6]);
+    let channels = usize::from(be16(12));
+    assert!((3..=4).contains(&channels));
+    let (height, width) = (be32(14), be32(18));
+    assert_eq!(be16(22), 8);
+    assert_eq!(be16(24), 3);
+    let mut at = 26;
+    for _ in 0..3 {
+        at += 4 + be32(at);
+    }
+    let compression = be16(at);
+    at += 2;
+    let mut planes = vec![vec![0; width * height]; channels];
+    match compression {
+        0 => {
+            for plane in &mut planes {
+                plane.copy_from_slice(&bytes[at..at + width * height]);
+                at += width * height;
+            }
+        }
+        1 => {
+            let row_lengths: Vec<_> = (0..channels * height).map(|i| usize::from(be16(at + i * 2))).collect();
+            at += channels * height * 2;
+            for (channel, plane) in planes.iter_mut().enumerate() {
+                for row in 0..height {
+                    let end = at + row_lengths[channel * height + row];
+                    let mut decoded = Vec::new();
+                    while at < end {
+                        let control = bytes[at] as i8;
+                        at += 1;
+                        match control {
+                            0..=127 => {
+                                let n = control as usize + 1;
+                                assert!(at + n <= end);
+                                decoded.extend_from_slice(&bytes[at..at + n]);
+                                at += n;
+                            }
+                            -127..=-1 => {
+                                assert!(at < end);
+                                decoded.extend(std::iter::repeat_n(bytes[at], (1i16 - i16::from(control)) as usize));
+                                at += 1;
+                            }
+                            -128 => {}
+                        }
+                    }
+                    assert_eq!(decoded.len(), width);
+                    plane[row * width..(row + 1) * width].copy_from_slice(&decoded);
+                }
+            }
+        }
+        _ => panic!("unexpected PSD compression {compression}"),
+    }
+    assert_eq!(at, bytes.len(), "PSD merged planes must consume the complete image section");
+    let image = image::RgbaImage::from_fn(width as u32, height as u32, |x, y| {
+        let i = y as usize * width + x as usize;
+        image::Rgba([planes[0][i], planes[1][i], planes[2][i], planes.get(3).map_or(255, |p| p[i])])
+    });
+    (image, channels == 4)
+}

crates/engine/tests/affinity_text.rs

@@ -0,0 +1,198 @@
+//! Editable text import regressions on original synthetic version-12 `.af` streams and pinned
+//! public Affinity 3 files. Font rendering depends on installed fonts; these are structure and
+//! conversion oracles, not claims of pixel-identical typography.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+#[path = "../../affinity/tests/support/corpus.rs"]
+mod corpus;
+#[path = "../../affinity/tests/support/text_fixture.rs"]
+mod fixture;
+use fixture::*;
+use vectorcraft_affinity::synth::{F, tag};
+use vectorcraft_doc::{
+    Document, Node, NodeKind, TextObject,
+    text::{CharStyle, Justify, TextKind},
+};
+use vectorcraft_engine::cmd::fileio;
+
+fn texts(d: &Document) -> Vec<&TextObject> {
+    fn walk<'a>(n: &'a Node, out: &mut Vec<&'a TextObject>) {
+        if let NodeKind::Text(t) = &n.kind {
+            out.push(t);
+        }
+        if let Some(children) = n.children() {
+            for child in children {
+                walk(child, out);
+            }
+        }
+    }
+    let mut out = Vec::new();
+    for n in &d.layers {
+        walk(n, &mut out);
+    }
+    out
+}
+fn import(blocks: Vec<F>, frame: bool, dpi: f64, transform: [f64; 6]) -> fileio::Loaded {
+    let loaded = fileio::load("original-text.af", &document(blocks, frame, dpi, transform)).unwrap();
+    assert!(!loaded.preview_only);
+    loaded
+}
+
+#[test]
+fn unicode_mixed_fonts_line_breaks_and_styles_remain_editable_after_save() {
+    let loaded = import(
+        vec![block(
+            utf8("é😀\u{2028}ab\u{2029}尾\0"),
+            vec![run(2, Some(attrs("First", "FirstPS", 700, true, 24.0))), run(8, Some(attrs("Second", "SecondPS", 300, false, 20.0)))],
+            &[1],
+        )],
+        false,
+        96.0,
+        [2.0, 0.0, 30.0, 0.0, 2.0, 40.0],
+    );
+    let t = texts(&loaded.doc)[0];
+    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["é😀", "\nab\n尾"]);
+    assert_eq!(t.runs[0].style.font_family, "First");
+    assert_eq!(t.runs[0].style.font_style, "Bold Italic");
+    assert_eq!(t.runs[1].style.font_style, "Light");
+    assert_eq!((t.runs[0].style.size, t.runs[0].style.leading, t.runs[0].style.tracking), (36.0, Some(45.0), 25.0));
+    assert_eq!(t.para.justify, Justify::Center);
+    assert!(matches!(t.kind, TextKind::Point));
+    assert_eq!(t.xf.as_coeffs(), [1.0, 0.0, 0.0, 1.0, 187.5, 87.0]);
+    let saved = vectorcraft_format::save_file(&loaded.doc);
+    let restored = vectorcraft_format::load(&saved).unwrap();
+    assert_eq!(texts(&restored)[0], t);
+}
+
+#[test]
+fn absent_font_name_uses_named_default_and_postscript_name_is_preserved() {
+    let loaded =
+        import(vec![block(utf8("ab"), vec![run(1, Some(attrs("", "OnlyPostScript", 400, false, 12.0))), run(2, None)], &[])], false, 72.0, IDENTITY);
+    let t = texts(&loaded.doc)[0];
+    assert_eq!(t.runs[0].style.font_family, "OnlyPostScript");
+    assert_eq!(t.runs[1].style.font_family, CharStyle::default().font_family);
+    assert_eq!(t.runs[1].style.fill.color().unwrap().to_rgb(), [0.0, 0.0, 0.0]);
+    assert!(loaded.warnings.iter().any(|w| w.contains("without a font name")));
+    assert!(loaded.warnings.iter().any(|w| w.contains("without character attributes")));
+}
+
+#[test]
+fn frame_type_keeps_dimensions_alignment_and_unit_conversion() {
+    let loaded = import(vec![block(utf8("text"), vec![run(4, Some(attrs("Frame", "", 500, false, 20.0)))], &[3])], true, 144.0, IDENTITY);
+    let t = texts(&loaded.doc)[0];
+    assert_eq!(t.runs[0].style.size, 10.0);
+    assert_eq!(t.runs[0].style.font_style, "Medium");
+    assert_eq!(t.para.justify, Justify::JustifyLeft);
+    let TextKind::Area { frame } = &t.kind else { panic!("expected area type") };
+    assert_eq!(frame.bounds().unwrap().width(), 100.0);
+    assert_eq!(frame.bounds().unwrap().height(), 50.0);
+}
+
+#[test]
+fn each_font_weight_and_italic_maps_to_the_expected_style() {
+    let cases = [
+        (100, "Thin"),
+        (200, "ExtraLight"),
+        (300, "Light"),
+        (400, "Regular"),
+        (500, "Medium"),
+        (600, "SemiBold"),
+        (700, "Bold"),
+        (800, "ExtraBold"),
+        (900, "Black"),
+    ];
+    for (weight, expected) in cases {
+        for italic in [false, true] {
+            let loaded = import(vec![block(utf8("x"), vec![run(1, Some(attrs("Family", "", weight, italic, 12.0)))], &[])], false, 72.0, IDENTITY);
+            let style = &texts(&loaded.doc)[0].runs[0].style.font_style;
+            let expected = if !italic {
+                expected.into()
+            } else if expected == "Regular" {
+                "Italic".into()
+            } else {
+                format!("{expected} Italic")
+            };
+            assert_eq!(*style, expected);
+        }
+    }
+}
+
+#[test]
+fn caps_and_feature_overrides_pass_through_to_editable_type() {
+    let mut a = attrs("Family", "", 400, false, 12.0);
+    if let F::Obj(_, fields) = &mut a {
+        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 = F::Shared(vec![
+            solid(1.0),
+            F::Null,
+            F::Null,
+            F::Null,
+            F::Null,
+            F::Null,
+            F::Null,
+            F::Obj(
+                tag(b"OtAt"),
+                vec![(
+                    tag(b"Setn"),
+                    F::Objs(
+                        tag(b"OTFS"),
+                        vec![
+                            vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"CAP\x01"))), (tag(b"Valu"), F::I32(1))],
+                            vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"liga"))), (tag(b"Valu"), F::I32(0))],
+                            vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"ss01"))), (tag(b"Valu"), F::I32(1))],
+                        ],
+                    ),
+                )],
+            ),
+        ]);
+    }
+    let loaded = import(vec![block(utf8("Mixed"), vec![run(5, Some(a))], &[])], false, 72.0, IDENTITY);
+    let t = texts(&loaded.doc)[0];
+    assert_eq!(t.runs[0].text, "Mixed");
+    assert!(t.runs[0].style.all_caps);
+    assert_eq!(t.runs[0].style.features, ["-liga", "ss01"]);
+    assert!(loaded.warnings.iter().any(|w| w.contains("retained but not rendered")));
+    let restored = vectorcraft_format::load(&vectorcraft_format::save_file(&loaded.doc)).unwrap();
+    assert_eq!(texts(&restored)[0], t);
+}
+
+#[test]
+fn pinned_affinity3_text_opens_as_editable_unicode_with_resolved_emoji_font() {
+    let Some(corpus) = corpus::pinned() else { return };
+    let load = |name: &str| {
+        let loaded = fileio::load(name, &std::fs::read(corpus.join(name)).unwrap()).unwrap();
+        assert!(!loaded.preview_only);
+        loaded
+    };
+    let loaded = load("patchy-text-runs.af");
+    let t = texts(&loaded.doc)[0];
+    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<String>(), "ABcdÉ😀X");
+    assert_eq!(t.runs[3].style.font_family, "Segoe UI Emoji");
+    assert_eq!(t.runs[4].style.font_family, "Courier New");
+    let loaded = load("patchy-text-caps.af");
+    let ts = texts(&loaded.doc);
+    assert!(ts[0].runs[0].style.all_caps);
+    assert_eq!(ts[1].runs[0].style.features, ["smcp"]);
+    for name in ["patchy-text-artistic.af", "patchy-text-frame.af", "patchy-text-rotated.af", "patchy-text-indent.af", "patchy-text-para-spacing.af"]
+    {
+        let loaded = load(name);
+        assert!(!texts(&loaded.doc).is_empty(), "{name}");
+        let restored = vectorcraft_format::load(&vectorcraft_format::save_file(&loaded.doc)).unwrap();
+        assert_eq!(texts(&restored), texts(&loaded.doc), "{name}");
+    }
+}
+
+#[test]
+fn installed_postscript_identity_overrides_ambiguous_family_and_weight() {
+    // This is an OS font metadata check. No font file is committed or required; the structural
+    // fallback cases above always run, including when the optional font repository is absent.
+    let db = vectorcraft_text::FontDb::global();
+    let Some((family, face_style)) = db.by_postscript_name("DejaVuSans") else {
+        eprintln!("DejaVuSans is not installed; exact PostScript face test skipped");
+        return;
+    };
+    let loaded =
+        import(vec![block(utf8("x"), vec![run(1, Some(attrs("Ambiguous Family", "DejaVuSans", 900, true, 12.0)))], &[])], false, 72.0, IDENTITY);
+    let style = &texts(&loaded.doc)[0].runs[0].style;
+    assert_eq!(style.font_family, family);
+    assert_eq!(style.font_style, face_style);
+}

crates/engine/tests/command_sweep.rs

@@ -272,6 +272,8 @@ fn structured_junk() {
         ("object.setBounds", json!({"width": -10, "height": 1e308, "reference": 99})),
         ("object.distributeSpacing", json!({"axis": "horizontal", "spacing": -1e308})),
         ("artboard.setProps", json!({"index": 0, "width": -1, "height": 0})),
+        ("artboard.setProps", json!({"index": 0, "width": 1e300, "height": 1e-300, "scaleArt": true, "strokes": true, "corners": true})),
+        ("artboard.setProps", json!({"index": 0, "x": -1e308, "width": 0, "height": 1, "scaleArt": true, "patterns": true})),
         ("artboard.new", json!({"width": 0, "height": -1})),
         ("artboard.delete", json!({"index": 0})),
         ("artboard.move", json!({"index": 0, "dx": 1e308, "dy": 0, "moveArt": true})),

crates/engine/tests/import_fuzz.rs

@@ -1707,3 +1707,180 @@ proptest! {
         survive("mutated .ai editing data", || Some(vectorcraft_eps::layered_ai(&private, Document::new(100.0, 100.0), vec![]).0))?;
     }
 }
+
+/// The operators, operands and section comments of hostile editing data.
+fn arb_ai_token() -> impl Strategy<Value = String> {
+    prop_oneof![
+        arb_num(),
+        prop::sample::select(vec![
+            "m",
+            "l",
+            "L",
+            "c",
+            "C",
+            "v",
+            "V",
+            "y",
+            "Y",
+            "h",
+            "H",
+            "N",
+            "n",
+            "F",
+            "f",
+            "S",
+            "s",
+            "B",
+            "b",
+            "W",
+            "(b) *",
+            "u",
+            "U",
+            "*u",
+            "*U",
+            "q",
+            "Q",
+            "LB",
+            "Lb",
+            "Ln",
+            "(name) Ln",
+            "g",
+            "G",
+            "k",
+            "K",
+            "x",
+            "X",
+            "Xa",
+            "XA",
+            "Xx",
+            "XX",
+            "(Ink) 0.5 x",
+            "O",
+            "R",
+            "XR",
+            "w",
+            "J",
+            "j",
+            "M",
+            "d",
+            "[6 3] 0 d",
+            "[]0 d",
+            "Xy",
+            "2 0.5 1 1 1 Xy",
+            "99 -4 Xy",
+            "Xw",
+            "1 Xw",
+            "A",
+            "1 A",
+            "Ae",
+            "XW",
+            "1 (style) XW",
+            "9 () XW",
+            "Bd",
+            "(G) 1 3 Bd",
+            "Bs",
+            "0 0 0 0 1 0 0 2 1 6 50 0 Bs",
+            "BD",
+            "Bb",
+            "1 Bb",
+            "BB",
+            "2 BB",
+            "1 (G) 0 0 0 1 1 0 0 1 0 0 1 Bg",
+            "Bg",
+            "Bm",
+            "1e308 0 0 1e-308 0 0 Bm",
+            "Bh",
+            "XN",
+            "/DeviceCMYK XN",
+            "/DeviceGray XN",
+            "[ 1 0 0 1 0 0 ] 0 0 2 2 2 2 8 3 1 0 1 0",
+            "[ 1 0 0 1 0 0 ] 0 0 99999 99999 99999 99999 1 1 0 0 0 0",
+            "[",
+            "]",
+            "/Name",
+            "(text)",
+            "<ff00>",
+            ":",
+            ";",
+            ",",
+            "/ArtDictionary :",
+            "/XMLUID : (A_x41_) ; (AI10_ArtUID) ,",
+            "(n) /String (AIArtName) ,",
+            "/Document :",
+            "/Array :",
+            "/Dictionary :",
+            "0 0 /RealPoint (PositionPoint1) ,",
+            "/AI11Text :",
+            "0 /StoryIndex ,",
+            "/SymbolInstance :",
+            "/Binary : /ASCII85Decode ,",
+            "~>",
+            "p",
+            "To",
+            "frobnicate",
+            "\n%AI5_BeginLayer\n",
+            "\n%AI5_EndLayer--\n",
+            "\n%_",
+            "\n%AI5_BeginRaster\n",
+            "\n%AI5_EndRaster\n",
+            "\n%%BeginData: 12\rXI\n",
+            "\n%%EndData\n",
+            "\n%AI5_BeginGradient: (G)\n",
+            "\n%AI14_BeginSymbol\n",
+            "\n%AI10_EndSymbol\n",
+            "\n%AI17_Begin_Content_if_version_gt:24 4\n",
+            "\n%AI17_Alternate_Content\n",
+            "\n%AI17_End_Versioned_Content\n",
+            "\n%AI3_Cropmarks: 0 0 1e308 -1e308\n",
+            "\n%AI5_ArtSize: 0 0\n",
+            "\n%AI9_ColorModel: 2\n",
+            "\n%AI5_BeginPlace\n",
+            "\n%AI26_BeginPlacedObjectPreview\n",
+            "\n%%PageTrailer\n",
+        ])
+        .prop_map(str::to_string),
+    ]
+}
+
+/// The testkit's sample editing data, compressed as older `.ai` files compress it.
+fn ai_sample_compressed() -> Vec<u8> {
+    use std::io::Write as _;
+    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    e.write_all(&vectorcraft_testkit::ai::sample_data()).unwrap();
+    [&b"%AI12_CompressedData"[..], &e.finish().unwrap()].concat()
+}
+
+proptest! {
+    #![proptest_config(config())]
+
+    /// Hostile editing data in Illustrator EPS and `.ai` files: operators in any order with any
+    /// operands, sections and dictionaries left open, images of any size.
+    #[test]
+    fn ai_hostile_editing_data_never_panics(tokens in prop::collection::vec(arb_ai_token(), 0..80)) {
+        use vectorcraft_testkit::ai;
+        let data = ai::editing_data(200.0, 100.0, &format!("%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(L) Ln\n{}\nLB\n", tokens.join(" ")));
+        survive("hostile editing data", || Some(vectorcraft_eps::layered_ai(data.as_bytes(), Document::new(200.0, 100.0), vec![]).0))?;
+        let eps = ai::eps(data.as_bytes(), ai::page_ps());
+        survive("hostile editing data in an EPS", || vectorcraft_engine::cmd::fileio::load("x.eps", &eps).ok().map(|l| l.doc))?;
+    }
+
+    /// The testkit's sample damaged, as it is and compressed, in EPS and `.ai` files.
+    #[test]
+    fn ai_mutated_sample_never_panics(cut in 0usize..4_000, edits in prop::collection::vec((0usize..4_000, any::<u8>()), 0..12)) {
+        use vectorcraft_testkit::ai;
+        static PLAIN: std::sync::OnceLock<Vec<u8>> = std::sync::OnceLock::new();
+        static PACKED: std::sync::OnceLock<Vec<u8>> = std::sync::OnceLock::new();
+        for (what, sample) in [("editing data", PLAIN.get_or_init(ai::sample_data)), ("compressed editing data", PACKED.get_or_init(ai_sample_compressed))] {
+            let mut bytes = sample.clone();
+            for &(at, b) in &edits {
+                let n = bytes.len();
+                bytes[at % n] = b;
+            }
+            bytes.truncate(cut.max(4));
+            let file = ai::ai(&bytes, ai::page_pdf());
+            survive(what, || vectorcraft_engine::cmd::fileio::load("x.ai", &file).ok().map(|l| l.doc))?;
+            let file = ai::eps(&bytes, ai::page_ps());
+            survive(what, || vectorcraft_engine::cmd::fileio::load("x.eps", &file).ok().map(|l| l.doc))?;
+        }
+    }
+}

crates/engine/tests/lossy_overwrite.rs

@@ -21,15 +21,15 @@ fn ascii85(data: &[u8]) -> String {
     out
 }
 
-/// A square that is gradient-filled in the layers (which can't be read) and flat on the page: the
-/// file comes in as its page, and its hidden layer is left out.
+/// A square drawn with an operator the layers' reader doesn't know and flat on the page: the file
+/// comes in as its page, and its hidden layer is left out.
 fn lossy_eps() -> Vec<u8> {
     let layer = |name: &str, visible: u8, body: &str| {
         format!("%AI5_BeginLayer\n{visible} 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n({name}) Ln\n{body}\nLB\n%AI5_EndLayer--\n")
     };
     let editing = format!(
         "%!PS-Adobe-3.0 \n%%BoundingBox: 0 0 100 100\n%%HiResBoundingBox: 0 0 100 100\n%AI3_Cropmarks: 0 0 100 100\n{}{}%%Trailer\n",
-        layer("Art", 1, "1 0 0 0 1 0 Bg\n0 0 1 0 k\n10 10 m\n14 10 L\n14 14 L\n10 14 L\nf"),
+        layer("Art", 1, "1 0 0 0 1 0 Zq\n0 0 1 0 k\n10 10 m\n14 10 L\n14 14 L\n10 14 L\nf"),
         layer("Hidden", 0, "0 0 1 0 k\n50 50 m\n54 50 L\n54 54 L\n50 54 L\nf"),
     );
     let packed = ruzstd::encoding::compress_to_vec(editing.as_bytes(), ruzstd::encoding::CompressionLevel::Fastest);

crates/eps/src/import/ai/lex.rs

@@ -0,0 +1,333 @@
+//! The scanner of the editing data: PostScript-like tokens, read line by line.
+//!
+//! - A line starting with `%_` holds tokens like any other line (they are marked [`Token::hidden`]:
+//!   readers of the printed format skip them as comments).
+//! - Any other line starting with `%` is a [`Tok::Comment`] (the section markers).
+//! - `%` later in a line starts a comment that is skipped.
+//! - The binary image data after `%%BeginData:` is one [`Tok::Data`]; the binary previews of placed
+//!   files are skipped.
+
+use super::super::lex::{find, hex_decode};
+
+/// A token.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Tok<'a> {
+    Num(f64),
+    /// A literal `(…)` string, escapes undone.
+    Str(Vec<u8>),
+    /// A hexadecimal `<…>` string.
+    Hex(Vec<u8>),
+    /// A literal `/name`.
+    Name(&'a [u8]),
+    /// An operator (any other word, `[` and `]` included).
+    Word(&'a [u8]),
+    /// A comment line, without its first `%`.
+    Comment(&'a [u8]),
+    /// An image's samples: what follows `XI` in a `%%BeginData:` section.
+    Data(&'a [u8]),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Token<'a> {
+    pub tok: Tok<'a>,
+    /// Read from a `%_` line.
+    pub hidden: bool,
+}
+
+/// Binary sections skipped whole: (begin, end) markers.
+const SKIPPED: [(&[u8], &[u8]); 2] = [(b"%AI26_BeginPlacedObjectPreview", b"%AI26_EndPlacedObjectPreview"), (b"%%BeginDocument", b"%%EndDocument")];
+
+fn is_space(b: u8) -> bool {
+    matches!(b, b' ' | b'\t' | b'\r' | b'\n' | b'\x0c' | b'\0')
+}
+
+fn is_delim(b: u8) -> bool {
+    matches!(b, b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%')
+}
+
+fn is_eol(b: u8) -> bool {
+    matches!(b, b'\r' | b'\n')
+}
+
+pub(super) struct Lexer<'a> {
+    src: &'a [u8],
+    pos: usize,
+    /// The current line started with `%_`.
+    hidden: bool,
+}
+
+impl<'a> Lexer<'a> {
+    pub fn new(src: &'a [u8]) -> Self {
+        Self { src, pos: 0, hidden: false }
+    }
+
+    fn peek(&self) -> Option<u8> {
+        self.src.get(self.pos).copied()
+    }
+
+    fn rest(&self) -> &'a [u8] {
+        self.src.get(self.pos..).unwrap_or_default()
+    }
+
+    fn at_line_start(&self) -> bool {
+        self.pos == 0 || self.src.get(self.pos - 1).is_some_and(|b| is_eol(*b))
+    }
+
+    /// The rest of the current line (without its end), the position moved past it.
+    fn line(&mut self) -> &'a [u8] {
+        let rest = self.rest();
+        let n = rest.iter().position(|b| is_eol(*b)).unwrap_or(rest.len());
+        self.pos += n;
+        rest.get(..n).unwrap_or_default()
+    }
+
+    /// Skip past the next `needle` (the end of data that isn't tokens) → what was skipped.
+    pub fn skip_past(&mut self, needle: &[u8]) -> &'a [u8] {
+        let rest = self.rest();
+        let n = find(rest, needle).map_or(rest.len(), |i| i + needle.len());
+        self.pos += n;
+        rest.get(..n).unwrap_or_default()
+    }
+
+    /// The next token; `None` at the end.
+    pub fn next_token(&mut self) -> Option<Token<'a>> {
+        loop {
+            let b = self.peek()?;
+            if is_eol(b) {
+                self.pos += 1;
+                self.hidden = false;
+                continue;
+            }
+            if is_space(b) {
+                self.pos += 1;
+                continue;
+            }
+            if b == b'%' {
+                if self.at_line_start() {
+                    if self.rest().starts_with(b"%_") {
+                        self.pos += 2;
+                        self.hidden = true;
+                        continue;
+                    }
+                    let line = self.line();
+                    if let Some(t) = self.special(line) {
+                        return Some(t);
+                    }
+                    return Some(Token { tok: Tok::Comment(line.get(1..).unwrap_or_default()), hidden: false });
+                }
+                // A comment later in a line.
+                self.line();
+                continue;
+            }
+            let hidden = self.hidden;
+            self.pos += 1;
+            let tok = match b {
+                b'(' => Tok::Str(self.string()),
+                b'<' => {
+                    let rest = self.rest();
+                    let end = rest.iter().position(|b| *b == b'>').unwrap_or(rest.len());
+                    self.pos += (end + 1).min(rest.len());
+                    // Malformed digits read as an empty string.
+                    Tok::Hex(rest.get(..end).and_then(hex_decode).unwrap_or_default())
+                }
+                b'[' | b']' | b'{' | b'}' | b')' | b'>' => Tok::Word(self.src.get(self.pos - 1..self.pos).unwrap_or_default()),
+                b'/' => Tok::Name(self.word()),
+                _ => {
+                    self.pos -= 1;
+                    let w = self.word();
+                    match number(w) {
+                        Some(v) => Tok::Num(v),
+                        None => Tok::Word(w),
+                    }
+                }
+            };
+            return Some(Token { tok, hidden });
+        }
+    }
+
+    /// The token a comment line stands for when it starts a section read differently: image data
+    /// (`%%BeginData:` followed by `XI`) and skipped binary sections.
+    fn special(&mut self, line: &'a [u8]) -> Option<Token<'a>> {
+        if let Some((_, end)) = SKIPPED.iter().find(|(b, _)| line.starts_with(b)) {
+            let after = find(self.rest(), end).map_or(self.src.len(), |i| self.pos + i);
+            self.pos = after;
+            self.line();
+            return Some(Token { tok: Tok::Comment(line.get(1..).unwrap_or_default()), hidden: false });
+        }
+        let n = line.strip_prefix(b"%%BeginData:")?;
+        let n: usize = std::str::from_utf8(n).ok()?.split_whitespace().next()?.parse().ok()?;
+        // The count starts after the comment's line end character (a following `\n` counts).
+        let from = self.pos + 1;
+        let region = self.src.get(from..)?;
+        let skip = region.iter().take_while(|b| is_space(**b)).count();
+        if !region.get(skip..)?.starts_with(b"XI") {
+            return None;
+        }
+        let mut data = from + skip + 2;
+        match (self.src.get(data), self.src.get(data + 1)) {
+            (Some(b'\r'), Some(b'\n')) => data += 2,
+            (Some(b'\r' | b'\n'), _) => data += 1,
+            _ => {}
+        }
+        // The count leaves out an alpha channel: the data ends where `%%EndData` starts.
+        let declared = from.saturating_add(n).min(self.src.len()).max(data);
+        let window =
+            self.src.get(declared.saturating_sub(4).max(data)..declared.saturating_add(n.saturating_mul(2)).saturating_add(64).min(self.src.len()));
+        let end = match window.and_then(|w| find(w, b"%%EndData")) {
+            Some(i) => declared.saturating_sub(4).max(data) + i,
+            None => declared,
+        };
+        self.pos = end;
+        Some(Token { tok: Tok::Data(self.src.get(data..end).unwrap_or_default()), hidden: false })
+    }
+
+    /// A regular token's characters.
+    fn word(&mut self) -> &'a [u8] {
+        let start = self.pos;
+        while let Some(b) = self.peek() {
+            if is_space(b) || is_delim(b) {
+                break;
+            }
+            self.pos += 1;
+        }
+        self.src.get(start..self.pos).unwrap_or_default()
+    }
+
+    /// A literal string after its `(` (an unterminated one ends with the data).
+    fn string(&mut self) -> Vec<u8> {
+        let mut out = vec![];
+        let mut depth = 0usize;
+        while let Some(b) = self.peek() {
+            self.pos += 1;
+            match b {
+                b'(' => {
+                    depth += 1;
+                    out.push(b);
+                }
+                b')' if depth == 0 => break,
+                b')' => {
+                    depth -= 1;
+                    out.push(b);
+                }
+                b'\\' => {
+                    let Some(e) = self.peek() else { break };
+                    self.pos += 1;
+                    match e {
+                        b'n' => out.push(b'\n'),
+                        b'r' => out.push(b'\r'),
+                        b't' => out.push(b'\t'),
+                        b'b' => out.push(8),
+                        b'f' => out.push(12),
+                        b'\r' => {
+                            if self.peek() == Some(b'\n') {
+                                self.pos += 1;
+                            }
+                        }
+                        b'\n' => {}
+                        b'0'..=b'7' => {
+                            let mut v = u32::from(e - b'0');
+                            for _ in 0..2 {
+                                match self.peek() {
+                                    Some(d @ b'0'..=b'7') => {
+                                        v = v * 8 + u32::from(d - b'0');
+                                        self.pos += 1;
+                                    }
+                                    _ => break,
+                                }
+                            }
+                            out.push((v & 0xff) as u8);
+                        }
+                        other => out.push(other),
+                    }
+                }
+                _ => out.push(b),
+            }
+        }
+        out
+    }
+}
+
+/// A finite number token (`12`, `-3.5`, `.5`, `1e-3`), or `None`.
+fn number(w: &[u8]) -> Option<f64> {
+    let first = *w.first()?;
+    if !(first.is_ascii_digit() || matches!(first, b'+' | b'-' | b'.')) {
+        return None;
+    }
+    if w.iter().any(|b| b.is_ascii_alphabetic() && !matches!(b, b'e' | b'E')) {
+        return None;
+    }
+    let v: f64 = std::str::from_utf8(w).ok()?.parse().ok()?;
+    v.is_finite().then_some(v)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn all(src: &[u8]) -> Vec<Token<'_>> {
+        let mut l = Lexer::new(src);
+        std::iter::from_fn(|| l.next_token()).collect()
+    }
+
+    fn t(tok: Tok<'_>, hidden: bool) -> Token<'_> {
+        Token { tok, hidden }
+    }
+
+    #[test]
+    fn hidden_lines_and_comments() {
+        let toks = all(b"%AI5_BeginLayer\r\n1 (a\\)b) Ln\r%_/X : ;\n0 %_BS\n<4142>\n");
+        assert_eq!(
+            toks,
+            vec![
+                t(Tok::Comment(b"AI5_BeginLayer"), false),
+                t(Tok::Num(1.0), false),
+                t(Tok::Str(b"a)b".to_vec()), false),
+                t(Tok::Word(b"Ln"), false),
+                t(Tok::Name(b"X"), true),
+                t(Tok::Word(b":"), true),
+                t(Tok::Word(b";"), true),
+                t(Tok::Num(0.0), false),
+                t(Tok::Hex(b"AB".to_vec()), false),
+            ]
+        );
+    }
+
+    #[test]
+    fn image_data_is_one_token() {
+        // The count starts after the comment's `\r`: `\nXI\n` and 3 samples; an alpha channel
+        // after them isn't counted.
+        let src = b"[1 0 0 1 0 0] XI\r\n%%BeginData: 7\r\nXI\n(%)A%%EndData\r\nXH\r\n";
+        let toks = all(src);
+        assert!(toks.contains(&t(Tok::Data(b"(%)A"), false)), "{toks:?}");
+        assert_eq!(toks.last(), Some(&t(Tok::Word(b"XH"), false)));
+        // A section of hex lines is comments.
+        let toks = all(b"%%BeginData: 9 Hex Bytes\r\n%00FF\r\n%%EndData\r\n1\r\n");
+        assert_eq!(toks.last(), Some(&t(Tok::Num(1.0), false)));
+    }
+
+    #[test]
+    fn binary_previews_are_skipped() {
+        let toks = all(b"%AI26_BeginPlacedObjectPreview\r\n2 1 (\x00\xff\r\n%AI26_EndPlacedObjectPreview\r\nN\r\n");
+        assert_eq!(toks.last(), Some(&t(Tok::Word(b"N"), false)));
+        assert_eq!(toks.len(), 2);
+    }
+
+    #[test]
+    fn skip_past_data() {
+        let mut l = Lexer::new(b"/Binary : /ASCII85Decode ,\r\n%_(abc[%\r\n%x~>\r\n%_; 1");
+        for _ in 0..4 {
+            l.next_token();
+        }
+        assert_eq!(l.skip_past(b"~>"), b"\r\n%_(abc[%\r\n%x~>");
+        assert_eq!(l.next_token().map(|t| t.tok), Some(Tok::Word(b";")));
+        assert_eq!(l.next_token().map(|t| t.tok), Some(Tok::Num(1.0)));
+    }
+
+    #[test]
+    fn hostile_input_ends() {
+        for src in [&b"(unterminated \\"[..], b"<12", b"%%BeginData: 99999999999\r\nXI", b"%%BeginData: 5\rXI\r", b"/", b"1e999 nan"] {
+            let toks = all(src);
+            assert!(toks.len() < 10);
+        }
+    }
+}

crates/eps/src/import/ai/mod.rs

@@ -0,0 +1,163 @@
+//! Illustrator's editing data: the document as the app keeps it, which an Illustrator EPS carries
+//! after its printed page and a `.ai` file (PDF compatible or not) in its first page's
+//! `/PieceInfo /Illustrator /Private` streams.
+//!
+//! - In an EPS it starts at the `%AI9_PrivateDataBegin` comment: header comments, then
+//!   `%AI24_DataStream` (Zstandard) or `%AI9_DataStream` (zlib) and the compressed data as ASCII85
+//!   on comment lines, up to `%AI9_PrivateDataEnd`. Data that isn't compressed follows the header
+//!   as it is.
+//! - In a `.ai` file the streams joined start with `%AI24_ZStandard_Data` (Zstandard) or
+//!   `%AI12_CompressedData` (zlib), else are the data itself ([`decode_private`]).
+//!
+//! The data is a PostScript-like program of the legacy Illustrator format's operators (layers,
+//! groups, paths, colours, gradients, images) with newer ones (transparency, hidden objects) and
+//! dictionaries (names, artboards, type). `lex` scans it, `read` builds the document.
+//!
+//! Reading is bounded: the data decompresses to at most [`MAX_DATA`], and the reader caps nesting,
+//! objects and points. Anything it doesn't read is an error: the caller opens the file the way it
+//! did before (the printed page, or the PDF), with a warning saying why.
+
+mod lex;
+mod obj;
+mod paint;
+mod read;
+
+use std::io::Read as _;
+
+use super::lex::find;
+use crate::ps;
+
+pub(crate) use read::slot_of;
+pub use read::{Structure, read};
+
+#[cfg(test)]
+mod tests;
+
+/// Largest editing data read, decompressed (bytes).
+pub const MAX_DATA: u64 = 256 << 20;
+/// Largest Zstandard window accepted (a frame asking for more is damaged data).
+const MAX_ZSTD_WINDOW: u64 = 64 << 20;
+/// Most Zstandard frames read (the app writes one).
+const MAX_FRAMES: usize = 4096;
+
+const EPS_BEGIN: &[u8] = b"%AI9_PrivateDataBegin";
+const EPS_END: &[u8] = b"%AI9_PrivateDataEnd";
+
+/// The editing data an Illustrator EPS carries (`ps`: its PostScript), decoded: `None` without
+/// one, an error when it can't be decoded.
+pub fn eps_data(ps: &[u8]) -> Option<Result<Vec<u8>, String>> {
+    let start = find(ps, EPS_BEGIN)? + EPS_BEGIN.len();
+    let rest = ps.get(start..)?;
+    let section = rest.get(..find(rest, EPS_END).unwrap_or(rest.len())).unwrap_or_default();
+    Some(eps_section(section))
+}
+
+/// The editing data between the EPS markers: header comments, then the data (encoded or not).
+fn eps_section(section: &[u8]) -> Result<Vec<u8>, String> {
+    let mut header = Vec::new();
+    let mut lines = section.split(|b| matches!(b, b'\n' | b'\r')).filter(|l| !l.is_empty());
+    let mut codec = None;
+    for line in lines.by_ref() {
+        if line.starts_with(b"%AI24_DataStream") {
+            codec = Some(Codec::Zstd);
+            break;
+        }
+        if line.starts_with(b"%AI9_DataStream") {
+            codec = Some(Codec::Zlib);
+            break;
+        }
+        header.extend_from_slice(line);
+        header.extend_from_slice(b"\n");
+        if header.len() as u64 > MAX_DATA {
+            return Err(too_large());
+        }
+    }
+    let Some(codec) = codec else {
+        // Not compressed: the section is the data, as it is (images' samples are binary).
+        if section.len() as u64 > MAX_DATA {
+            return Err(too_large());
+        }
+        return Ok(section.to_vec());
+    };
+    let mut text = String::new();
+    for line in lines {
+        let body = line.strip_prefix(b"%").unwrap_or(line);
+        text.push_str(std::str::from_utf8(body).map_err(|_| damaged("its ASCII85 encoding"))?);
+        if text.len() as u64 > MAX_DATA {
+            return Err(too_large());
+        }
+    }
+    if !text.contains("~>") {
+        text.push_str("~>");
+    }
+    let packed = ps::ascii85_decode(&text).ok_or_else(|| damaged("its ASCII85 encoding"))?;
+    let mut data = header;
+    data.extend(codec.decode(&packed, MAX_DATA.saturating_sub(data.len() as u64))?);
+    Ok(data)
+}
+
+/// The editing data of a `.ai` file: its `AIPrivateData` streams joined (`raw`), decompressed. The
+/// compressed data may follow header comments that aren't.
+pub fn decode_private(raw: &[u8]) -> Result<Vec<u8>, String> {
+    if raw.len() as u64 > MAX_DATA {
+        return Err(too_large());
+    }
+    for (marker, codec) in [(&b"%AI24_ZStandard_Data"[..], Codec::Zstd), (b"%AI12_CompressedData", Codec::Zlib)] {
+        if let Some(at) = find(raw, marker) {
+            let (header, body) = raw.split_at(at);
+            let mut data = header.to_vec();
+            data.extend(codec.decode(body.get(marker.len()..).unwrap_or_default(), MAX_DATA.saturating_sub(header.len() as u64))?);
+            return Ok(data);
+        }
+    }
+    Ok(raw.to_vec())
+}
+
+#[derive(Clone, Copy)]
+enum Codec {
+    Zstd,
+    Zlib,
+}
+
+impl Codec {
+    /// `data` decompressed, at most `max` bytes.
+    fn decode(self, data: &[u8], max: u64) -> Result<Vec<u8>, String> {
+        let mut out = Vec::new();
+        match self {
+            Codec::Zlib => {
+                flate2::read::ZlibDecoder::new(data).take(max + 1).read_to_end(&mut out).map_err(|_| damaged("its zlib compression"))?;
+            }
+            Codec::Zstd => {
+                // The data may be several frames one after the other, padded with zeros.
+                let end = data.iter().rposition(|b| *b != 0).map_or(0, |i| i + 1);
+                let mut src = data.get(..end).unwrap_or_default();
+                let mut frames = 0usize;
+                while !src.is_empty() {
+                    frames += 1;
+                    if frames > MAX_FRAMES {
+                        return Err(damaged("its Zstandard compression"));
+                    }
+                    let left = (max + 1).saturating_sub(out.len() as u64);
+                    if left == 0 {
+                        break;
+                    }
+                    let d = ruzstd::decoding::StreamingDecoder::new_with_max_window_size(&mut src, MAX_ZSTD_WINDOW)
+                        .map_err(|_| damaged("its Zstandard compression"))?;
+                    d.take(left).read_to_end(&mut out).map_err(|_| damaged("its Zstandard compression"))?;
+                }
+            }
+        }
+        if out.len() as u64 > max {
+            return Err(too_large());
+        }
+        Ok(out)
+    }
+}
+
+fn damaged(what: &str) -> String {
+    format!("{what} is damaged")
+}
+
+fn too_large() -> String {
+    format!("it decompresses to more than {} MB", MAX_DATA >> 20)
+}

crates/eps/src/import/ai/obj.rs

@@ -0,0 +1,208 @@
+//! Operand values, and the dictionaries the editing data writes postfix: `/Type :` opens one,
+//! `values key ,` adds an entry (a type name such as `/Real` may stand before the key; in an
+//! `/Array` there is no key), `;` closes it (after a last `values /key` entry, or a bare value: its
+//! content), leaving it as a value.
+
+use std::rc::Rc;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum V {
+    Num(f64),
+    Str(Vec<u8>),
+    Name(String),
+    Arr(Vec<V>),
+    Obj(Rc<Obj>),
+    /// `[`, until its `]`.
+    Mark,
+}
+
+impl V {
+    pub fn num(&self) -> Option<f64> {
+        match self {
+            V::Num(v) => Some(*v),
+            _ => None,
+        }
+    }
+    pub fn obj(&self) -> Option<&Obj> {
+        match self {
+            V::Obj(o) => Some(o),
+            _ => None,
+        }
+    }
+    /// A string's or name's text.
+    pub fn text(&self) -> Option<String> {
+        match self {
+            V::Str(s) => Some(text(s)),
+            V::Name(n) => Some(n.clone()),
+            _ => None,
+        }
+    }
+}
+
+/// Text from the data's bytes: UTF-8, else Windows-1252 (Latin-1 for its gaps).
+pub(super) fn text(bytes: &[u8]) -> String {
+    match std::str::from_utf8(bytes) {
+        Ok(s) => s.to_string(),
+        Err(_) => bytes.iter().map(|b| cp1252(*b)).collect(),
+    }
+}
+
+fn cp1252(b: u8) -> char {
+    const HIGH: [char; 32] = [
+        '€', '\u{81}', '‚', 'ƒ', '„', '…', '†', '‡', 'ˆ', '‰', 'Š', '‹', 'Œ', '\u{8d}', 'Ž', '\u{8f}', '\u{90}', '‘', '’', '“', '”', '•', '–', '—',
+        '˜', '™', 'š', '›', 'œ', '\u{9d}', 'ž', 'Ÿ',
+    ];
+    match b {
+        0x80..=0x9f => HIGH.get(usize::from(b - 0x80)).copied().unwrap_or('?'),
+        _ => char::from(b),
+    }
+}
+
+/// A dictionary.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(super) struct Obj {
+    pub ty: String,
+    /// Entries in order: the key (`None` in an array) and the values before it.
+    pub entries: Vec<(Option<String>, Vec<V>)>,
+    /// Values closed without a key.
+    pub content: Vec<V>,
+}
+
+impl Obj {
+    /// The values of entry `key` (the first one).
+    pub fn get(&self, key: &str) -> Option<&[V]> {
+        self.entries.iter().find(|(k, _)| k.as_deref() == Some(key)).map(|(_, v)| v.as_slice())
+    }
+    /// The numbers of entry `key`.
+    pub fn nums(&self, key: &str) -> Vec<f64> {
+        self.get(key).unwrap_or_default().iter().filter_map(V::num).collect()
+    }
+    /// The first text value of entry `key`.
+    pub fn text(&self, key: &str) -> Option<String> {
+        self.get(key)?.iter().find(|v| matches!(v, V::Str(_))).and_then(V::text)
+    }
+    /// The dictionary value of entry `key`.
+    pub fn obj(&self, key: &str) -> Option<&Obj> {
+        self.get(key)?.iter().find_map(V::obj)
+    }
+    /// The dictionaries an array holds, in order.
+    pub fn items(&self) -> impl Iterator<Item = &Obj> {
+        self.entries.iter().flat_map(|(_, v)| v.iter()).chain(self.content.iter()).filter_map(V::obj)
+    }
+    /// The first text of the content.
+    pub fn content_text(&self) -> Option<String> {
+        self.content.iter().find_map(V::text)
+    }
+}
+
+/// Add the values on `stack` above `base` to `o` as one entry (`,`): the last is the key, except
+/// in an array.
+pub(super) fn add_entry(o: &mut Obj, stack: &mut Vec<V>, base: usize) {
+    let mut vals: Vec<V> = stack.drain(base.min(stack.len())..).collect();
+    if o.ty == "Array" {
+        o.entries.push((None, vals));
+        return;
+    }
+    let key = match vals.last() {
+        Some(V::Str(_) | V::Name(_)) => vals.pop().and_then(|k| k.text()),
+        _ => None,
+    };
+    o.entries.push((key, vals));
+}
+
+/// Close `o` (`;`): a last entry ending with a name is an entry, other values are its content.
+pub(super) fn close(o: &mut Obj, stack: &mut Vec<V>, base: usize) {
+    if stack.len() <= base {
+        return;
+    }
+    if o.ty != "Array" && matches!(stack.last(), Some(V::Name(_))) {
+        add_entry(o, stack, base);
+    } else {
+        let vals: Vec<V> = stack.drain(base.min(stack.len())..).collect();
+        o.content.extend(vals);
+    }
+}
+
+/// An object name from its XML id (`AI10_ArtUID`): `_` stands for a space and `_xHH_` for a
+/// character; ids made unique end with `_` and 20 or more digits.
+pub(super) fn xml_name(id: &str) -> String {
+    let id = strip_unique(id);
+    let mut out = String::with_capacity(id.len());
+    let mut rest = id;
+    while let Some(c) = rest.chars().next() {
+        if c == '_' {
+            if let Some((ch, n)) = escaped(rest) {
+                out.push(ch);
+                rest = rest.get(n..).unwrap_or_default();
+                continue;
+            }
+            out.push(' ');
+        } else {
+            out.push(c);
+        }
+        rest = rest.get(c.len_utf8()..).unwrap_or_default();
+    }
+    out
+}
+
+/// `_xHHHH_` at the start of `s`: the character and the escape's length.
+fn escaped(s: &str) -> Option<(char, usize)> {
+    let body = s.strip_prefix("_x")?;
+    let end = body.find('_')?;
+    let hex = body.get(..end)?;
+    if hex.is_empty() || hex.len() > 6 {
+        return None;
+    }
+    let c = char::from_u32(u32::from_str_radix(hex, 16).ok()?)?;
+    Some((c, end + 3))
+}
+
+/// `id` without the `_000…_` suffix that makes it unique.
+fn strip_unique(id: &str) -> &str {
+    let Some(body) = id.strip_suffix('_') else { return id };
+    let Some(at) = body.rfind('_') else { return id };
+    let digits = body.get(at + 1..).unwrap_or_default();
+    if digits.len() >= 20 && digits.bytes().all(|b| b.is_ascii_digit()) { body.get(..at).unwrap_or(id) } else { id }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn names_from_xml_ids() {
+        assert_eq!(xml_name("Layer_1"), "Layer 1");
+        assert_eq!(xml_name("My_Rect__x23_2"), "My Rect #2");
+        assert_eq!(xml_name("_x31_abc__x28_paren_x29_"), "1abc (paren)");
+        assert_eq!(xml_name("Ünï_日本"), "Ünï 日本");
+        assert_eq!(xml_name("S_00000092429200007574234970000005974767392385616558_"), "S");
+        assert_eq!(xml_name("a_x_"), "a x ");
+        assert_eq!(xml_name("_xD800_"), " xD800 ");
+    }
+
+    #[test]
+    fn entries_and_content() {
+        let mut o = Obj { ty: "XMLUID".into(), ..Obj::default() };
+        let mut st = vec![V::Num(9.0), V::Str(b"Main".to_vec())];
+        close(&mut o, &mut st, 1);
+        assert_eq!(o.content_text().as_deref(), Some("Main"));
+        assert_eq!(st, vec![V::Num(9.0)]);
+        let mut d = Obj { ty: "Dictionary".into(), ..Obj::default() };
+        let mut st = vec![V::Num(1.0), V::Num(2.0), V::Name("RealPoint".into()), V::Str(b"P".to_vec())];
+        add_entry(&mut d, &mut st, 0);
+        let mut st = vec![V::Name("Def".into())];
+        close(&mut d, &mut st, 0);
+        assert_eq!(d.nums("P"), vec![1.0, 2.0]);
+        assert_eq!(d.get("Def"), Some(&[][..]));
+        let mut a = Obj { ty: "Array".into(), ..Obj::default() };
+        let mut st = vec![V::Obj(Rc::new(d.clone()))];
+        add_entry(&mut a, &mut st, 0);
+        assert_eq!(a.items().count(), 1);
+    }
+
+    #[test]
+    fn latin_text() {
+        assert_eq!(text(b"caf\xe9 \x80"), "café €");
+        assert_eq!(text("ü".as_bytes()), "ü");
+    }
+}

crates/eps/src/import/ai/paint.rs

@@ -0,0 +1,277 @@
+//! Colours and gradients of the editing data.
+//!
+//! - Colours: `g`/`G` grey (1 is white), `k`/`K` CMYK, `x`/`X` a named CMYK colour at a tint
+//!   (`c m y k (name) tint`; tint 0 is the full colour), `Xa`/`XA` RGB (`c m y k r g b`, the CMYK
+//!   values its equivalent), `Xx`/`XX` a named colour of either model
+//!   (`c m y k [r g b] (name) tint type`). Lower case paints fills, upper case strokes.
+//! - Gradient definitions: `(name) type stops Bd`, its stops as `colour style [opacity 6]
+//!   midpoint ramp Bs` (style 0 grey, 1 CMYK, 2 RGB with its CMYK, 3 and 4 named colours), `BD`.
+//! - A gradient on an object: `[flag] Bb` (1: the stroke), `flag (name) x y angle length a b c d
+//!   tx ty Bg`, the gradient matrix `a b c d tx ty Bm`, the focal point `x y angle length Bh`,
+//!   `flag BB`.
+
+use std::collections::HashMap;
+
+use kurbo::{Affine, Point, Vec2};
+use vectorcraft_color::gradient::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+use vectorcraft_color::{Color, Paint};
+
+use super::obj::V;
+
+/// Largest number of stops read in one gradient.
+const MAX_STOPS: usize = 256;
+
+/// A colour read with the swatch it names (spot and global colours).
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Named {
+    pub name: String,
+    /// The full colour.
+    pub color: Color,
+    pub tint: f32,
+}
+
+/// The paint of a colour operator's operands (`op`: its name, lower case or not), with the named
+/// colour it uses. `None` when the operands don't fit.
+pub(super) fn color_op(op: &str, vals: &[V]) -> Option<(Paint, Option<Named>)> {
+    let nums: Vec<f32> = vals.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let last = |n: usize| nums.get(nums.len().checked_sub(n)?..);
+    match op.to_ascii_lowercase().as_str() {
+        "g" => Some((Paint::solid(Color::gray(1.0 - unit(*nums.last()?))), None)),
+        "k" => {
+            let [c, m, y, k] = last(4)? else { return None };
+            Some((Paint::solid(Color::cmyk(unit(*c), unit(*m), unit(*y), unit(*k))), None))
+        }
+        "xa" => {
+            let [r, g, b] = last(3)? else { return None };
+            Some((Paint::solid(Color::rgb(unit(*r), unit(*g), unit(*b))), None))
+        }
+        "x" => named(vals, Some(false)),
+        "xx" => named(vals, None),
+        _ => None,
+    }
+}
+
+/// `c m y k (name) tint x` or `c m y k [r g b] (name) tint type Xx` (type 1: RGB); `rgb` forces
+/// the model.
+fn named(vals: &[V], rgb: Option<bool>) -> Option<(Paint, Option<Named>)> {
+    let at = vals.iter().rposition(|v| matches!(v, V::Str(_)))?;
+    let name = vals.get(at)?.text()?;
+    let before: Vec<f32> = vals.get(..at)?.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let after: Vec<f32> = vals.get(at + 1..)?.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let tint = 1.0 - unit(*after.first()?);
+    let n = before.len();
+    let color = if rgb.unwrap_or(after.get(1).is_some_and(|t| *t == 1.0)) {
+        let [r, g, b] = before.get(n.checked_sub(3)?..)? else { return None };
+        Color::rgb(unit(*r), unit(*g), unit(*b))
+    } else {
+        // The CMYK values come first (an RGB equivalent may follow them).
+        let from = if n >= 7 { n - 7 } else { n.checked_sub(4)? };
+        let [c, m, y, k] = before.get(from..from + 4)? else { return None };
+        Color::cmyk(unit(*c), unit(*m), unit(*y), unit(*k))
+    };
+    let paint = Paint::Solid { color: color.tinted(tint), swatch: Some(name.clone()), tint };
+    Some((paint, Some(Named { name, color, tint })))
+}
+
+/// The colour of a gradient stop's colour values and style.
+fn stop_color(style: f64, comps: &[V]) -> Option<(Color, Option<Named>)> {
+    let nums: Vec<f32> = comps.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let tail = |n: usize| nums.get(nums.len().checked_sub(n)?..);
+    Some(match style as i64 {
+        0 => (Color::gray(1.0 - unit(*nums.last()?)), None),
+        1 => {
+            let [c, m, y, k] = tail(4)? else { return None };
+            (Color::cmyk(unit(*c), unit(*m), unit(*y), unit(*k)), None)
+        }
+        2 => {
+            let [r, g, b] = tail(3)? else { return None };
+            (Color::rgb(unit(*r), unit(*g), unit(*b)), None)
+        }
+        _ => {
+            let (paint, named) = named(comps, Some(style as i64 == 4))?;
+            (paint.color()?, named)
+        }
+    })
+}
+
+/// A gradient definition being read.
+#[derive(Debug)]
+pub(super) struct GradientDef {
+    pub name: String,
+    pub gradient: Gradient,
+}
+
+impl GradientDef {
+    /// `(name) type stops Bd`.
+    pub fn begin(vals: &[V]) -> Option<Self> {
+        let name = vals.iter().find_map(|v| if let V::Str(_) = v { v.text() } else { None })?;
+        let nums: Vec<f64> = vals.iter().filter_map(V::num).collect();
+        let kind = if nums.first().copied() == Some(1.0) { GradientKind::Radial } else { GradientKind::Linear };
+        Some(Self { name, gradient: Gradient { kind, stops: vec![] } })
+    }
+
+    /// A stop (`Bs`).
+    pub fn stop(&mut self, vals: &[V], spots: &mut Vec<Named>) {
+        if self.gradient.stops.len() >= MAX_STOPS {
+            return;
+        }
+        let n = vals.len();
+        let num = |i: usize| vals.get(i).and_then(V::num);
+        let (Some(ramp), Some(mid)) = (n.checked_sub(1).and_then(num), n.checked_sub(2).and_then(num)) else { return };
+        // Newer stops have an opacity and the marker 6 before the midpoint.
+        let newer = n >= 5 && n.checked_sub(3).and_then(num) == Some(6.0);
+        let (style_at, opacity) = if newer { (n.checked_sub(5), n.checked_sub(4).and_then(num).unwrap_or(1.0)) } else { (n.checked_sub(3), 1.0) };
+        let (Some(style_at), Some(style)) = (style_at, style_at.and_then(num)) else { return };
+        let Some((color, named)) = stop_color(style, vals.get(..style_at).unwrap_or_default()) else { return };
+        let mut stop = GradientStop::new((ramp / 100.0).clamp(0.0, 1.0) as f32, color);
+        stop.opacity = opacity.clamp(0.0, 1.0) as f32;
+        stop.midpoint = (mid / 100.0).clamp(0.13, 0.87) as f32;
+        if let Some(n) = named {
+            stop.set_color(n.color.tinted(n.tint), Some((n.name.clone(), n.tint)));
+            spots.push(n);
+        }
+        self.gradient.stops.push(stop);
+    }
+
+    /// The finished gradient (`BD`): stops in order of their ramp points.
+    pub fn finish(mut self) -> Option<(String, Gradient)> {
+        if self.gradient.stops.is_empty() {
+            return None;
+        }
+        self.gradient.stops.sort_by(|a, b| a.offset.total_cmp(&b.offset));
+        Some((self.name, self.gradient))
+    }
+}
+
+/// A gradient instance on an object, between `Bb` and `BB`.
+#[derive(Clone, Debug, Default)]
+pub(super) struct Instance {
+    pub stroke: bool,
+    pub name: Option<String>,
+    origin: Point,
+    angle: f64,
+    length: f64,
+    /// `Bg`'s own matrix.
+    bg: Affine,
+    /// The gradient matrix (`Bm`), when there is one.
+    bm: Option<Affine>,
+    /// The focal point's offset from the origin (`Bh`).
+    hilight: Vec2,
+}
+
+fn affine(n: &[f64]) -> Option<Affine> {
+    let [a, b, c, d, e, f] = n else { return None };
+    let m = Affine::new([*a, *b, *c, *d, *e, *f]);
+    (m.as_coeffs().iter().all(|v| v.is_finite())).then_some(m)
+}
+
+impl Instance {
+    pub fn begin(vals: &[V]) -> Self {
+        let stroke = vals.iter().filter_map(V::num).next_back() == Some(1.0);
+        Self { stroke, length: 1.0, ..Self::default() }
+    }
+
+    /// `flag (name) x y angle length a b c d tx ty Bg`.
+    pub fn bg(&mut self, vals: &[V]) {
+        let Some(at) = vals.iter().rposition(|v| matches!(v, V::Str(_))) else { return };
+        self.name = vals.get(at).and_then(V::text);
+        let n: Vec<f64> = vals.get(at + 1..).unwrap_or_default().iter().filter_map(V::num).collect();
+        if let [x, y, angle, length, m @ ..] = n.as_slice() {
+            self.origin = Point::new(*x, *y);
+            self.angle = *angle;
+            self.length = *length;
+            self.bg = affine(m).unwrap_or(Affine::IDENTITY);
+        }
+    }
+
+    /// `a b c d tx ty Bm`.
+    pub fn bm(&mut self, vals: &[V]) {
+        let n: Vec<f64> = vals.iter().filter_map(V::num).collect();
+        self.bm = n.get(n.len().saturating_sub(6)..).and_then(affine).filter(|m| m.determinant().abs() > 1e-12);
+    }
+
+    /// `x y angle length Bh`.
+    pub fn bh(&mut self, vals: &[V]) {
+        let n: Vec<f64> = vals.iter().filter_map(V::num).collect();
+        if let [x, y, ..] = n.as_slice() {
+            self.hilight = Vec2::new(*x, *y);
+        }
+    }
+
+    /// The paint, through `to_doc` (art space → the document), when the gradient is defined.
+    pub fn paint(&self, defs: &HashMap<String, Gradient>, to_doc: Affine) -> Option<Paint> {
+        let name = self.name.as_ref()?;
+        let gradient = defs.get(name)?.clone();
+        let m = to_doc * self.bm.unwrap_or(Affine::IDENTITY) * self.bg;
+        let a = self.angle.to_radians();
+        let dir = Vec2::new(a.cos(), a.sin()) * self.length;
+        let start = m * self.origin;
+        let end = m * (self.origin + dir);
+        if !(start.is_finite() && end.is_finite()) || start.distance(end) < 1e-9 {
+            return None;
+        }
+        // Across the vector, for an elliptical radial gradient.
+        let across = m * (self.origin + Vec2::new(-dir.y, dir.x));
+        let aspect = (across.distance(start) / start.distance(end)).clamp(0.01, 100.0);
+        let focal = (self.hilight.hypot() > 1e-9).then(|| m * (self.origin + self.hilight)).filter(|p| p.is_finite());
+        let radial = gradient.kind == GradientKind::Radial;
+        let geom = GradientGeom { start, end, aspect: if radial { aspect } else { 1.0 }, focal: if radial { focal } else { None } };
+        let angle = -(end - start).atan2().to_degrees();
+        Some(Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), angle, swatch: Some(name.clone()), ..GradientPaint::new(gradient) })))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn nums(v: &[f64]) -> Vec<V> {
+        v.iter().map(|n| V::Num(*n)).collect()
+    }
+
+    #[test]
+    fn colours() {
+        let (p, _) = color_op("g", &nums(&[0.7])).unwrap();
+        assert!(matches!(p.color(), Some(Color::Gray { k }) if (k - 0.3).abs() < 1e-6));
+        let (p, _) = color_op("XA", &nums(&[0.0, 0.99, 1.0, 0.0, 1.0, 0.0, 0.0])).unwrap();
+        assert_eq!(p.color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+        let mut v = nums(&[0.0, 0.5, 1.0, 0.0]);
+        v.push(V::Str(b"MySpot".to_vec()));
+        v.push(V::Num(0.4));
+        let (p, named) = color_op("x", &v).unwrap();
+        let named = named.unwrap();
+        assert_eq!(named.name, "MySpot");
+        assert!((named.tint - 0.6).abs() < 1e-6);
+        assert!(matches!(p, Paint::Solid { swatch: Some(_), .. }));
+        assert!(color_op("k", &nums(&[1.0])).is_none());
+    }
+
+    #[test]
+    fn gradient_definition_and_instance() {
+        let mut d = GradientDef::begin(&[V::Str(b"G".to_vec()), V::Num(1.0), V::Num(2.0)]).unwrap();
+        let mut spots = vec![];
+        d.stop(&nums(&[0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 2.0, 0.5, 6.0, 30.0, 100.0]), &mut spots);
+        d.stop(&nums(&[0.81, 0.0, 1.0, 6.0, 50.0, 0.0]), &mut spots);
+        let (name, g) = d.finish().unwrap();
+        assert_eq!(name, "G");
+        assert_eq!(g.kind, GradientKind::Radial);
+        assert_eq!(g.stops.len(), 2);
+        assert_eq!(g.stops[1].opacity, 0.5);
+        assert!(matches!(g.stops[0].color, Color::Gray { k } if (k - 0.19).abs() < 1e-6));
+        let defs = HashMap::from([(name, g)]);
+        let mut i = Instance::begin(&[]);
+        let mut bg = vec![V::Num(1.0), V::Str(b"G".to_vec())];
+        bg.extend(nums(&[0.0, 0.0, 0.0, 1.0, 1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
+        i.bg(&bg);
+        i.bm(&nums(&[50.0, 0.0, 0.0, -50.0, 100.0, 100.0]));
+        let Some(Paint::Gradient(gp)) = i.paint(&defs, Affine::IDENTITY) else { panic!() };
+        let geom = gp.geom.unwrap();
+        assert_eq!(geom.start, Point::new(100.0, 100.0));
+        assert_eq!(geom.end, Point::new(150.0, 100.0));
+        assert!((geom.aspect - 1.0).abs() < 1e-9);
+        assert!(i.paint(&HashMap::new(), Affine::IDENTITY).is_none());
+    }
+}

crates/eps/src/import/ai/tests.rs

@@ -0,0 +1,428 @@
+//! The editing data reader on synthetic data, written from the format as `read` documents it.
+
+use std::sync::Arc;
+
+use kurbo::{Point, Rect};
+use vectorcraft_color::gradient::GradientKind;
+use vectorcraft_color::{BlendMode, Color, Paint};
+use vectorcraft_doc::{ColorMode, Document, Knockout, LayerColor, LineCap, LineJoin, Node, NodeKind};
+
+use super::*;
+
+/// Editing data: header comments (crop marks 0 0 200 100), then `body`.
+fn stream(body: &str) -> String {
+    format!(
+        "%!PS-Adobe-3.0\n%%Creator: test\n%AI5_FileFormat 14.0\n%AI3_Cropmarks: 0 0 200 100\n%%EndComments\n%%BeginProlog\n%%EndProlog\n%%BeginSetup\n%%EndSetup\n{body}\n%%PageTrailer\ngsave annotatepage grestore showpage\n%%Trailer\n%%EOF\n"
+    )
+}
+
+/// One layer named `L` holding `art`.
+fn layer(art: &str) -> String {
+    format!("%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(L) Ln\n0 A\n0 Xw\n{art}\nLB\n%AI5_EndLayer--\n")
+}
+
+fn read_ok(body: &str) -> Structure {
+    match read(stream(body).as_bytes()) {
+        Ok(i) => i,
+        Err(e) => panic!("{e}"),
+    }
+}
+
+/// The children of the first layer.
+fn art(doc: &Document) -> Vec<Arc<Node>> {
+    doc.layers.first().and_then(|l| l.children()).cloned().unwrap_or_default()
+}
+
+fn fill(n: &Node) -> Paint {
+    n.appearance.fill().map(|f| f.paint.clone()).unwrap_or_default()
+}
+
+fn rect_path(x0: f64, y0: f64, x1: f64, y1: f64) -> String {
+    format!("{x0} {y0} m\n{x0} {y1} L\n{x1} {y1} L\n{x1} {y0} L\n{x0} {y0} L\n")
+}
+
+const RED: &str = "0 1 1 0 1 0 0 Xa\n";
+
+#[test]
+fn layers_and_sublayers() {
+    let body = format!(
+        "%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(Bottom) Ln\n{RED}{}f\n\
+         %AI5_BeginLayer\n0 1 0 0 0 0 0 -1 10 200 30 0 50 0 Lb\n(Inner) Ln\n{}f\nLB\n%AI5_EndLayer--\nLB\n%AI5_EndLayer--\n\
+         %AI5_BeginLayer\n1 0 1 1 1 0 1 3 79 79 255 0 70 0 Lb\n(Top) Ln\n{}f\nLB\n%AI5_EndLayer--\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+        rect_path(40.0, 0.0, 50.0, 10.0)
+    );
+    let doc = read_ok(&body).doc;
+    let names: Vec<_> = doc.layers.iter().map(|l| l.name.clone().unwrap_or_default()).collect();
+    assert_eq!(names, ["Bottom", "Top"], "bottom first");
+    let bottom = &doc.layers[0];
+    assert!(bottom.visible && !bottom.locked);
+    let kids = bottom.children().unwrap();
+    assert_eq!(kids.len(), 2);
+    let inner = &kids[1];
+    assert_eq!(inner.name.as_deref(), Some("Inner"));
+    assert!(!inner.visible && inner.locked);
+    let NodeKind::Layer { color, printable, .. } = &inner.kind else { panic!("a sublayer") };
+    assert_eq!((*color, *printable), (LayerColor::Custom([10, 200, 30]), false));
+    let NodeKind::Layer { color, preview, dim_images, .. } = &doc.layers[1].kind else { panic!() };
+    assert_eq!((*color, *preview, *dim_images), (LayerColor::Preset(3), false, Some(70)));
+}
+
+#[test]
+fn groups_names_hidden_and_locked() {
+    let art_ = format!(
+        "0 Ae\nu\n{RED}{}f\n%_/ArtDictionary :\n%_/XMLUID : (My_Rect__x23_2) ; (AI10_ArtUID) ,\n%_;\n%_\n\
+         1 A\n0 Ae\nu\n0 A\n1 Xw\n{}f\n0 Xw\nU\n%_/ArtDictionary :\n%_(Inner group) /String (AIArtName) ,\n%_;\n9 () XW\n\
+         0 A\nU\n%_/ArtDictionary :\n%_/XMLUID : (Outer) ; (AI10_ArtUID) ,\n%_;\n%_\n9 () XW\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let top = art(&doc);
+    assert_eq!(top.len(), 1);
+    let outer = &top[0];
+    assert_eq!(outer.name.as_deref(), Some("Outer"));
+    let kids = outer.children().unwrap();
+    assert_eq!(kids[0].name.as_deref(), Some("My Rect #2"));
+    let inner = &kids[1];
+    assert_eq!(inner.name.as_deref(), Some("Inner group"));
+    assert!(inner.locked, "locked when it opened");
+    let hidden = &inner.children().unwrap()[0];
+    assert!(!hidden.visible);
+}
+
+#[test]
+fn paths_colours_and_strokes() {
+    let art_ = format!(
+        "{RED}0 R\n0 0 1 0 0 0 1 XA\n1 J 2 j 3 w 4 M [6 3 ]1 d\n1 XR\n{}b\n\
+         0.1 0.2 0.3 0.4 k\n{}f\n0.7 g\n{}F\n0 0.5 1 0 (Ink) 0.4 x\n{}f\n\
+         10 50 m\n20 60 30 60 40 50 c\n50 40 60 40 v\n70 60 80 60 y\nS\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+        rect_path(40.0, 0.0, 50.0, 10.0),
+        rect_path(60.0, 0.0, 70.0, 10.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let a = art(&doc);
+    assert_eq!(a.len(), 5);
+    // y up from the crop marks' top: (0, 0)-(10, 10) is at y 90-100.
+    let NodeKind::Path { path, rule, .. } = &a[0].kind else { panic!() };
+    assert_eq!(path.bounds(), Some(Rect::new(0.0, 90.0, 10.0, 100.0)));
+    assert!(path.subpaths[0].closed);
+    assert_eq!(path.subpaths[0].anchors.len(), 4, "the closing point merges with the first");
+    assert_eq!(*rule, vectorcraft_geom::FillRule::EvenOdd);
+    assert_eq!(fill(&a[0]).color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+    let st = a[0].appearance.stroke().unwrap();
+    assert_eq!((st.width, st.cap, st.join, st.miter_limit), (3.0, LineCap::Round, LineJoin::Bevel, 4.0));
+    assert_eq!(st.paint.color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+    let dash = st.dash.clone().unwrap();
+    assert_eq!((dash.pattern, dash.offset), (vec![6.0, 3.0], 1.0));
+    assert_eq!(fill(&a[1]).color(), Some(Color::cmyk(0.1, 0.2, 0.3, 0.4)));
+    assert!(matches!(fill(&a[2]).color(), Some(Color::Gray { k }) if (k - 0.3).abs() < 1e-6));
+    assert!(!matches!(&a[2].kind, NodeKind::Path { path, .. } if path.subpaths[0].closed), "F leaves the path open");
+    let Paint::Solid { swatch, tint, .. } = fill(&a[3]) else { panic!() };
+    assert_eq!(swatch.as_deref(), Some("Ink"));
+    assert!((tint - 0.6).abs() < 1e-6);
+    let ink = doc.swatch("Ink").unwrap();
+    assert!(ink.spot && ink.global);
+    // Curves: `c`, `v` (first control at the current point) and `y` (second at the end).
+    let NodeKind::Path { path, .. } = &a[4].kind else { panic!() };
+    assert_eq!(path.subpaths[0].anchors.len(), 4);
+    assert!(a[4].appearance.fill().is_none() && a[4].appearance.stroke().is_some());
+}
+
+#[test]
+fn compound_paths_and_clipping() {
+    let art_ = format!(
+        "0 Ae\n*u\n{RED}{}f\n{}f\n*U\n%_/ArtDictionary :\n%_/XMLUID : (Donut) ; (AI10_ArtUID) ,\n%_;\n\
+         0 Ae\nq\n{}f\n{}h\nW\nn\nQ\n%_/ArtDictionary :\n%_/XMLUID : (Clipped) ; (AI10_ArtUID) ,\n%_;\n9 () XW\n",
+        rect_path(0.0, 0.0, 30.0, 30.0),
+        rect_path(10.0, 10.0, 20.0, 20.0),
+        rect_path(40.0, 0.0, 80.0, 40.0),
+        rect_path(50.0, 10.0, 60.0, 20.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let a = art(&doc);
+    let NodeKind::Compound { children, .. } = &a[0].kind else { panic!("{:?}", a[0].kind) };
+    assert_eq!((children.len(), a[0].name.as_deref()), (2, Some("Donut")));
+    assert_eq!(fill(&a[0]).color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+    let NodeKind::Group { children, clip: true } = &a[1].kind else { panic!("a clipping group") };
+    assert_eq!(a[1].name.as_deref(), Some("Clipped"));
+    // The clipping path goes first.
+    assert!(matches!(children[0].kind, NodeKind::Path { clipping: true, .. }));
+    assert!(matches!(children[1].kind, NodeKind::Path { clipping: false, .. }));
+    // A clipping path in a layer clips the layer.
+    let doc = read_ok(&layer(&format!("{}f\n{}W\nn\n", rect_path(0.0, 0.0, 9.0, 9.0), rect_path(0.0, 0.0, 5.0, 5.0)))).doc;
+    let NodeKind::Layer { clip, children, .. } = &doc.layers[0].kind else { panic!() };
+    assert!(*clip && matches!(children[0].kind, NodeKind::Path { clipping: true, .. }));
+}
+
+#[test]
+fn transparency_of_objects_and_groups() {
+    let art_ = format!(
+        "{RED}1 0.5 0 0 0 Xy\n{}f\n0 Ae\nu\n0 1 0 0 0 Xy\n{}f\nU\n2 0.7 1 1 0 Xy\n0 0 Xd\n6 () XW\n0 1 0 0 0 Xy\n{}f\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+        rect_path(40.0, 0.0, 50.0, 10.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let a = art(&doc);
+    assert_eq!((a[0].opacity, a[0].blend), (0.5, BlendMode::Multiply));
+    assert_eq!((a[1].opacity, a[1].blend, a[1].isolate, a[1].knockout), (0.7, BlendMode::Screen, true, Knockout::On));
+    let inner = &a[1].children().unwrap()[0];
+    assert_eq!(inner.opacity, 1.0);
+    assert_eq!((a[2].opacity, a[2].blend), (1.0, BlendMode::Normal), "the next object's state isn't the group's");
+}
+
+#[test]
+fn gradients() {
+    let defs = "%AI5_BeginGradient: (G)\n(G) 1 2 Bd\n[\n<00FF>\n0\n0 0 0 0 1 0 0 2 1 6 %_BS\n\
+                %_0 0 0 0 1 0 0 2 1 6 40 0 Bs\n%_0 0 0 0 0 0 1 2 0.5 6 50 100 Bs\nBD\n%AI5_EndGradient\n";
+    let art_ = format!(
+        "{RED}{}Bb\n0 0 0 0 Bh\n1 (G) 0 0 0 1 1 0 0 1 0 0 1 Bg\n50 0 0 -50 100 50 Bm\nf\n0 BB\n{}f\n",
+        rect_path(50.0, 0.0, 150.0, 100.0),
+        rect_path(0.0, 0.0, 10.0, 10.0),
+    );
+    let doc = read_ok(&format!("{defs}{}", layer(&art_))).doc;
+    let a = art(&doc);
+    let Paint::Gradient(g) = fill(&a[0]) else { panic!("{:?}", fill(&a[0])) };
+    assert_eq!(g.gradient.kind, GradientKind::Radial);
+    assert_eq!(g.gradient.stops.len(), 2);
+    assert!((g.gradient.stops[0].midpoint - 0.4).abs() < 1e-6);
+    assert_eq!(g.gradient.stops[1].opacity, 0.5);
+    let geom = g.geom.unwrap();
+    assert_eq!((geom.start, geom.end), (Point::new(100.0, 50.0), Point::new(150.0, 50.0)));
+    // The gradient was the one object's.
+    assert_eq!(fill(&a[1]).color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+}
+
+#[test]
+fn artboards() {
+    let data = "%_/Document :\n%_/Dictionary :\n%_/Array :\n\
+                %_/Dictionary :\n%_0 200 /RealPointRelToROrigin\n%_ (PositionPoint1) ,\n%_300 0 /RealPointRelToROrigin\n%_ (PositionPoint2) ,\n%_(One) /UnicodeString (Name) ,\n%_; ,\n\
+                %_/Dictionary :\n%_400 0 /RealPointRelToROrigin\n%_ (PositionPoint1) ,\n%_600 -150 /RealPointRelToROrigin\n%_ (PositionPoint2) ,\n%_; ,\n\
+                %_; (ArtboardArray) ,\n%_; /NotRecorded ,\n%_;\n";
+    let art_ = rect_path(420.0, -70.0, 470.0, -20.0) + "f\n";
+    let doc = read_ok(&format!("{data}{}", layer(&art_))).doc;
+    let boards: Vec<_> = doc.artboards.iter().map(|a| (a.name.clone(), a.rect)).collect();
+    assert_eq!(boards, [("One".to_string(), Rect::new(0.0, 0.0, 300.0, 200.0)), ("Artboard 2".to_string(), Rect::new(400.0, 200.0, 600.0, 350.0))]);
+    let NodeKind::Path { path, .. } = &art(&doc)[0].kind else { panic!() };
+    assert_eq!(path.bounds(), Some(Rect::new(420.0, 220.0, 470.0, 270.0)));
+    // Without artboards or crop marks: the art size around the template box's centre.
+    let old = format!(
+        "%!PS-Adobe-3.0\n%AI5_ArtSize: 600 400\n%AI3_TemplateBox: 300.5 199.5 300.5 199.5\n%%EndComments\n{}",
+        layer("10 10 m\n20 20 L\nS\n")
+    );
+    let doc = read(old.as_bytes()).unwrap().doc;
+    assert_eq!(doc.artboards[0].rect, Rect::new(0.0, 0.0, 600.0, 400.0));
+}
+
+#[test]
+fn a_drawn_look_stands_for_its_object() {
+    // The look (a group, with a part on `%_` lines for newer readers), then the object on `%_`
+    // lines and its style.
+    let hidden_rect = rect_path(0.0, 0.0, 10.0, 10.0).replace('\n', "\n%_");
+    let art_ = format!(
+        "0 Ae\nu\n%_0 Ae\n%_u\n%_{hidden_rect}S\n%_U\n{RED}{}f\n0 0 0 0 0 0 1 XA\n{}S\nU\n\
+         %_/ArtDictionary :\n%_/XMLUID : (Neon_00000092429200007574234970000005974767392385616558_) ; (AI10_ArtUID) ,\n%_;\n\
+         0 0.4 0 0 0 Xy\n0 0 Xd\n6 () XW\n%_{hidden_rect}n\n%_/ArtDictionary :\n%_/XMLUID : (Neon) ; (AI10_ArtUID) ,\n%_;\n1 (Neon style) XW\n\
+         0 1 0 0 0 Xy\n{}f\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(30.0, 0.0, 40.0, 10.0),
+    );
+    let r = read_ok(&layer(&art_));
+    let a = art(&r.doc);
+    assert_eq!(a.len(), 2, "{a:#?}");
+    assert_eq!(a[0].name.as_deref(), Some("Neon"));
+    assert_eq!(a[0].opacity, 0.4);
+    assert_eq!(a[0].children().unwrap().len(), 2, "the newer readers' part is left out");
+    assert!(r.warnings.iter().any(|w| w.contains("drawn look (1)")), "{:?}", r.warnings);
+}
+
+/// Editing data with one layer holding an image: `matrix` (`[a b c d tx ty]`), its size, colour
+/// space, kind and alpha channels, its samples, and the size the data comment declares.
+fn image(matrix: &str, (w, h): (u32, u32), (space, kind, alpha): (&str, u32, u32), data: &[u8], declared: usize) -> Vec<u8> {
+    let mut s = format!(
+        "%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(L) Ln\n%AI5_File:\n%AI5_BeginRaster\n() 1 XG\n/{space} XN\n{matrix} {w} {h} 0 Xh\n\
+         {matrix} 0 0 {w} {h} {w} {h} 8 {kind} {alpha} 0 1 0 4 4 0 0\n%%BeginData: {declared}\rXI\n"
+    )
+    .into_bytes();
+    s.extend_from_slice(data);
+    s.extend_from_slice(b"%%EndData\r\nXH\r\n%AI5_EndRaster\r\nN\r\nLB\r\n%AI5_EndLayer--\r\n");
+    let mut out = stream("").into_bytes();
+    let at = out.windows(14).position(|w| w == b"%%PageTrailer\n").unwrap();
+    out.splice(at..at, s);
+    out
+}
+
+fn pixels(doc: &Document) -> (image::RgbaImage, kurbo::Affine) {
+    let a = art(doc);
+    let NodeKind::Image(im) = &a[0].kind else { panic!("{:?}", a[0].kind) };
+    let blob = doc.images.get(&im.key).unwrap();
+    (image::load_from_memory(&blob.bytes).unwrap().to_rgba8(), im.xf)
+}
+
+#[test]
+fn images_with_alpha_channels() {
+    // RGB samples, then the alpha channel (not counted in the data's size).
+    let data = [255, 0, 0, 0, 255, 0, 255, 128];
+    let doc = read(&image("[ 10 0 0 10 50 90 ]", (2, 1), ("DeviceRGB", 3, 1), &data, 10)).unwrap().doc;
+    let (img, xf) = pixels(&doc);
+    assert_eq!((img.get_pixel(0, 0).0, img.get_pixel(1, 0).0), ([255, 0, 0, 255], [0, 255, 0, 128]));
+    // Pixel space (y down) to the top left at (50, 90) in art space: (50, 10) on the page.
+    assert_eq!(xf * Point::ZERO, Point::new(50.0, 10.0));
+    assert_eq!(xf * Point::new(2.0, 1.0), Point::new(70.0, 20.0));
+    // CMYK and grey.
+    let doc = read(&image("[ 1 0 0 1 0 100 ]", (1, 1), ("DeviceCMYK", 4, 0), &[0, 0, 0, 255], 6)).unwrap().doc;
+    let px = pixels(&doc).0.get_pixel(0, 0).0;
+    assert!(px[0] < 64 && px[3] == 255, "100% black is dark: {px:?}");
+    let doc = read(&image("[ 1 0 0 1 0 100 ]", (2, 1), ("DeviceGray", 1, 0), &[0, 200], 6)).unwrap().doc;
+    assert_eq!(pixels(&doc).0.get_pixel(1, 0).0, [200, 200, 200, 255]);
+    // Data cut short: the image goes, with a warning.
+    let r = read(&image("[ 1 0 0 1 0 100 ]", (4, 4), ("DeviceRGB", 3, 0), &[1, 2, 3], 6)).unwrap();
+    assert!(art(&r.doc).is_empty() && r.warnings.iter().any(|w| w.contains("cut short")));
+}
+
+#[test]
+fn text_objects_are_slots_named_after_their_story() {
+    let words = "/AI11Text :\n0 /FreeUndo ,\n0 /FrameIndex ,\n3 /StoryIndex ,\n;\n%_/ArtDictionary :\n%_/XMLUID : (Title) ; (AI10_ArtUID) ,\n%_;\n";
+    let r = read_ok(&layer(&format!("1 Xw\n{words}0 Xw\n")));
+    let a = art(&r.doc);
+    assert_eq!(slot_of(a[0].name.as_deref()), Some(Some(3)));
+    assert!(!a[0].visible);
+    assert_eq!(r.slot_names.get(&a[0].id).map(String::as_str), Some("Title"));
+    // A copy on `%_` lines of a story that has a plain text object goes; one without stays.
+    let commented = |story: u32| -> String { format!("/AI11Text :\n{story} /StoryIndex ,\n;\n").lines().map(|l| format!("%_{l}\n")).collect() };
+    let r = read_ok(&layer(&format!("/AI11Text :\n0 /StoryIndex ,\n;\n{}{}", commented(0), commented(1))));
+    let stories: Vec<_> = art(&r.doc).iter().map(|n| slot_of(n.name.as_deref())).collect();
+    assert_eq!(stories, [Some(Some(0)), Some(Some(1))]);
+}
+
+#[test]
+fn what_it_doesnt_read_is_an_error_where_it_shows() {
+    let e = read(stream(&layer("1 2 frobnicate\n")).as_bytes()).unwrap_err();
+    assert!(e.contains("`frobnicate`"), "{e}");
+    let e = read(stream(&layer("(Jive) 0 0 1 1 0 0 0 0 0 [1 0 0 1 0 0] p\n")).as_bytes()).unwrap_err();
+    assert!(e.contains("pattern fills"), "{e}");
+    let e = read(stream(&layer("/SymbolInstance :\n(Dot) /SymbolRef ,\n;\n")).as_bytes()).unwrap_err();
+    assert!(e.contains("symbols"), "{e}");
+    // On a layer that doesn't show, it is left out of it.
+    let hidden = "%AI5_BeginLayer\n0 1 1 1 0 0 0 1 255 79 79 0 50 0 Lb\n(Off) Ln\n1 2 frobnicate\n(J) 0 0 1 1 0 0 0 0 0 [1 0 0 1 0 0] p\nLB\n%AI5_EndLayer--\n";
+    let r = read_ok(hidden);
+    assert_eq!(r.hidden_unread.iter().cloned().collect::<Vec<_>>(), ["`frobnicate`", "pattern fills"]);
+    // Unbalanced containers, a layer that doesn't end, no layers.
+    assert!(read(stream(&layer("U\n")).as_bytes()).is_err());
+    assert!(read(stream("%AI5_BeginLayer\n(L) Ln\n0 Ae\nu\n").as_bytes()).is_err());
+    assert!(read(stream("").as_bytes()).is_err());
+    // The setup's procedures and what follows the page don't count.
+    read_ok(&format!("Adobe_level2_AI5 /initialize get exec\n{}", layer("")));
+}
+
+#[test]
+fn sections_it_skips() {
+    let body = "%AI5_Begin_NonPrinting\n%AI14_BeginSymbol\n0 Ae\nu\nfrobnicate\n%AI10_EndSymbol\n%AI3_BeginPattern: (P)\nU\nU\n%AI3_EndPattern\n%AI5_End_NonPrinting--\n\
+                %AI17_Begin_Content_if_version_gt:24 4\n%AI17_Alternate_Content\n%AI17_Begin_Content_if_version_gt:23 1\nfrobnicate\n%AI17_End_Versioned_Content\nfrobnicate\n%AI17_End_Versioned_Content\n\
+                %_/Document :\n%_/Binary : /ASCII85Decode ,\n%_(]<[%\n%;;;~>\n%_; (Profile) ,\n%_;\n";
+    let doc = read_ok(&format!("{body}{}", layer(&(rect_path(0.0, 0.0, 1.0, 1.0) + "f\n")))).doc;
+    assert_eq!(art(&doc).len(), 1);
+}
+
+#[test]
+fn cmyk_documents() {
+    let doc = read_ok(&format!("%AI9_ColorModel: 2\n{}", layer(""))).doc;
+    assert_eq!(doc.color_mode, ColorMode::Cmyk);
+}
+
+#[test]
+fn hostile_data_ends_without_panics() {
+    let deep = "0 Ae\nu\n".repeat(300) + &"U\n".repeat(300);
+    assert!(read(stream(&layer(&deep)).as_bytes()).unwrap_err().contains("nested too deeply"));
+    let keys = "/X :\n".repeat(300);
+    assert!(read(stream(&layer(&keys)).as_bytes()).is_err());
+    for junk in [
+        &b"%AI5_BeginLayer\n(\xff\xfe"[..],
+        b"%AI5_BeginLayer\n<zz",
+        b"]]]] [ [ ; , : : ;",
+        b"1e308 1e308 m 1e308 -1e308 L f",
+        b"%%BeginData: 5\rXI\n",
+    ] {
+        let _ = read(junk);
+    }
+    // Images with absurd sizes are left out.
+    let r = read(&image("[ 1 0 0 1 0 0 ]", (1 << 20, 1 << 20), ("DeviceRGB", 3, 0), &[0; 12], 12)).unwrap();
+    assert!(art(&r.doc).is_empty());
+}
+
+fn zstd(data: &[u8]) -> Vec<u8> {
+    ruzstd::encoding::compress_to_vec(data, ruzstd::encoding::CompressionLevel::Fastest)
+}
+
+/// An EPS whose page draws a line, and the editing data `packed` after it (`marker`: its codec).
+fn eps(marker: &str, packed: &[u8]) -> Vec<u8> {
+    let lines: String = crate::ps::ascii85(packed).lines().map(|l| format!("%{l}\n")).collect();
+    format!(
+        "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 200 100\n%%EndComments\n0 0 moveto 10 10 lineto stroke\nshowpage\n%%EOF\n\
+         %AI9_PrivateDataBegin\n%!PS-Adobe-3.0 EPSF-3.0\n%AI3_Cropmarks: 0 0 200 100\n%AI5_FileFormat 14.0\n{marker}\n{lines}%AI9_PrivateDataEnd\n"
+    )
+    .into_bytes()
+}
+
+#[test]
+fn eps_containers() {
+    let body = stream(&layer(&(rect_path(0.0, 0.0, 10.0, 10.0) + "f\n")));
+    let body = body.as_bytes();
+    for file in [eps("%AI24_DataStream", &zstd(body)), eps("%AI9_DataStream", &crate::ps::deflate(body))] {
+        let (ps, _) = crate::sections(&file).unwrap();
+        let data = eps_data(ps).unwrap().unwrap();
+        assert!(data.starts_with(b"%!PS-Adobe-3.0 EPSF-3.0\n%AI3_Cropmarks"), "the header comes first");
+        assert!(data.ends_with(body));
+        assert_eq!(read(&data).unwrap().doc.layers.len(), 1);
+    }
+    // Damaged data says why.
+    let (ps, _) = crate::sections(&eps("%AI24_DataStream", b"not zstd")).map(|(p, t)| (p.to_vec(), t.map(<[u8]>::to_vec))).unwrap();
+    assert!(eps_data(&ps).unwrap().unwrap_err().contains("Zstandard"));
+    // Data that isn't compressed is used as it is.
+    let plain = format!("%!PS-Adobe-3.0\n%%EOF\n%AI9_PrivateDataBegin\n{}%AI9_PrivateDataEnd\n", stream(&layer("")));
+    assert!(read(&eps_data(plain.as_bytes()).unwrap().unwrap()).is_ok());
+    // An EPS without editing data has none.
+    let other = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 10 10\n%%EndComments\n0 0 moveto 10 10 lineto stroke\nshowpage\n";
+    assert!(eps_data(other).is_none());
+}
+
+#[test]
+fn ai_private_data() {
+    let body = stream(&layer(""));
+    let body = body.as_bytes();
+    let header = b"%%BoundingBox: 0 0 1 1\r\n";
+    for raw in [
+        [&b"%AI24_ZStandard_Data"[..], &zstd(body)].concat(),
+        [&header[..], b"%AI12_CompressedData", &crate::ps::deflate(body)].concat(),
+        body.to_vec(),
+    ] {
+        let data = decode_private(&raw).unwrap();
+        assert!(data.ends_with(b"%%EOF\n"));
+        assert!(read(&data).is_ok());
+    }
+    assert!(decode_private(b"%AI12_CompressedDataxx").is_err());
+}
+
+#[test]
+fn many_zstandard_frames_are_read_in_one_pass_and_capped() {
+    let frame = zstd(b" ");
+    let frames = |n: usize| -> Vec<u8> { [&b"%AI24_ZStandard_Data"[..], &frame.repeat(n), &[0; 64]].concat() };
+    let started = std::time::Instant::now();
+    assert_eq!(decode_private(&frames(4000)).unwrap().len(), 4000);
+    assert!(decode_private(&frames(50_000)).unwrap_err().contains("Zstandard"));
+    assert!(started.elapsed() < std::time::Duration::from_secs(20), "{:?}", started.elapsed());
+}
+
+#[test]
+fn closing_brackets_without_their_opening_dont_rescan_the_stack() {
+    let n = 200_000;
+    let body = format!("{}\n{}\n", "1 ".repeat(n), "] ".repeat(n));
+    let started = std::time::Instant::now();
+    let _ = read(stream(&layer(&body)).as_bytes());
+    assert!(started.elapsed() < std::time::Duration::from_secs(20), "{:?}", started.elapsed());
+}

crates/eps/src/import/graphics.rs

@@ -153,18 +153,6 @@ impl Default for GState {
     }
 }
 
-/// The name of the empty group that stands for a text object (see [`Out::text_slot`]), followed by
-/// the number of its story in the text document when the file says.
-pub(crate) const TEXT_SLOT: &str = "\u{0}text";
-
-/// Is `name` that of a text slot, and which story is it of?
-pub(crate) fn slot_of(name: Option<&str>) -> Option<Option<u32>> {
-    name?.strip_prefix(TEXT_SLOT).map(|rest| rest.parse().ok())
-}
-
-/// An object drawn, with its chain of clips and groups.
-type DrawnItem = (Vec<Arc<Clip>>, Node);
-
 /// What the program draws.
 pub(crate) struct Out {
     /// The document being made: ids, images and swatches.
@@ -181,14 +169,6 @@ pub(crate) struct Out {
     /// goes in the innermost group kept).
     groups: Vec<Arc<Clip>>,
     too_deep: usize,
-    /// Illustrator clipping groups open (`q` … `Q`): the group's id (none when it opened past
-    /// [`MAX_NEST`]) and how many objects were drawn before it.
-    open_clips: Vec<(Option<u32>, usize)>,
-    /// Illustrator compound paths open (`*u` … `*U`): how many objects were drawn before each.
-    compounds: Vec<(usize, bool)>,
-    /// What the file says of the objects it draws now: hidden (Illustrator's `Xw`, a state it
-    /// changes only when the next object differs).
-    pub hidden: bool,
     /// Path elements (and the clips and groups of each object) drawn so far (see [`MAX_DRAWN`]).
     elements: usize,
     /// The path the last object was filled with: a stroke of the same path right after joins it.
@@ -224,9 +204,6 @@ impl Out {
             next_clip: 0,
             groups: vec![],
             too_deep: 0,
-            open_clips: vec![],
-            compounds: vec![],
-            hidden: false,
             elements: 0,
             merge: None,
             cmyk: 0,
@@ -252,7 +229,7 @@ impl Out {
             return;
         }
         self.next_clip += 1;
-        self.groups.push(Arc::new(Clip { id: self.next_clip, region: None, hidden: self.hidden }));
+        self.groups.push(Arc::new(Clip { id: self.next_clip, region: None }));
     }
 
     /// End the innermost group open (an end without a beginning ends nothing).
@@ -264,76 +241,6 @@ impl Out {
         }
     }
 
-    /// Open an Illustrator clipping group (`q`): a group that [`Self::end_clip_group`] clips with
-    /// the clip path the file gives at its end.
-    pub fn begin_clip_group(&mut self) {
-        let deep = self.too_deep;
-        self.begin_group();
-        let id = if self.too_deep == deep { self.groups.last().map(|c| c.id) } else { None };
-        self.open_clips.push((id, self.drawn.len()));
-    }
-
-    /// End the innermost clipping group open (`Q`), clipped to `region` when the file gave one
-    /// (without, it stays a plain group). An end without a beginning ends nothing.
-    pub fn end_clip_group(&mut self, region: Option<(BezPath, FillRule)>) {
-        let Some((id, start)) = self.open_clips.pop() else { return };
-        let hidden = self.groups.last().is_some_and(|c| Some(c.id) == id && c.hidden);
-        self.end_group();
-        let (Some(id), Some(region)) = (id, region) else { return };
-        // The objects drawn in the group hold the group's clip as it was when they were drawn,
-        // without its region.
-        let clip = Arc::new(Clip { id, region: Some(region), hidden });
-        for (chain, _) in self.drawn.iter_mut().skip(start) {
-            for c in chain.iter_mut().filter(|c| c.id == id) {
-                *c = clip.clone();
-            }
-        }
-    }
-
-    /// Open an Illustrator compound path (`*u`): the paths drawn until [`Self::end_compound`] are
-    /// its parts.
-    pub fn begin_compound(&mut self) {
-        self.compounds.push((self.drawn.len(), self.hidden));
-    }
-
-    /// End the innermost compound path open (`*U`): its parts become one compound path painted
-    /// with the first part's appearance (what Illustrator does). One part stays a plain path.
-    pub fn end_compound(&mut self) {
-        let Some((start, hidden)) = self.compounds.pop() else { return };
-        let parts = self.drawn.get(start..).unwrap_or_default();
-        let same_chain = |a: &DrawnItem, b: &DrawnItem| a.0.iter().map(|c| c.id).eq(b.0.iter().map(|c| c.id));
-        let Some(first) = parts.first() else { return };
-        if parts.len() < 2 || !parts.iter().all(|p| matches!(p.1.kind, NodeKind::Path { .. }) && same_chain(first, p)) {
-            return;
-        }
-        let parts = self.drawn.split_off(start);
-        let chain = parts.first().map(|p| p.0.clone()).unwrap_or_default();
-        let (mut rule, mut appearance) = (FillRule::NonZero, Appearance::default());
-        let mut children = Vec::with_capacity(parts.len());
-        for (i, (_, mut part)) in parts.into_iter().enumerate() {
-            if i == 0 {
-                appearance = std::mem::take(&mut part.appearance);
-                if let NodeKind::Path { rule: r, .. } = &part.kind {
-                    rule = *r;
-                }
-            }
-            part.appearance = Appearance::default();
-            children.push(Arc::new(part));
-        }
-        let mut compound = Node::new(self.doc.alloc_id(), NodeKind::Compound { children, rule });
-        compound.appearance = appearance;
-        compound.visible = !hidden;
-        self.drawn.push((chain, compound));
-    }
-
-    /// Where a text object of the file's editing data goes: an empty group named [`TEXT_SLOT`],
-    /// which the importer replaces with the text it read from the file's page.
-    pub fn text_slot(&mut self, story: Option<u32>) {
-        let mut n = Node::group(NodeId(0), vec![]);
-        n.name = Some(story.map_or_else(|| TEXT_SLOT.to_string(), |s| format!("{TEXT_SLOT}{s}")));
-        self.push(n, &[]);
-    }
-
     /// The chain an object drawn under `clips` is drawn in: the clips and the groups open, in the
     /// order they opened.
     pub fn chain(&self, clips: &[Arc<Clip>]) -> Vec<Arc<Clip>> {
@@ -365,7 +272,6 @@ impl Out {
             return None;
         }
         node.id = self.doc.alloc_id();
-        node.visible = !self.hidden;
         let id = node.id;
         self.drawn.push((chain, node));
         Some(id)
@@ -420,7 +326,7 @@ impl Out {
             return None;
         }
         self.next_clip += 1;
-        Some(Arc::new(Clip { id: self.next_clip, region: Some((path, rule)), hidden: false }))
+        Some(Arc::new(Clip { id: self.next_clip, region: Some((path, rule)) }))
     }
 }
 

crates/eps/src/import/interp.rs

@@ -7,7 +7,7 @@
 use std::cell::RefCell;
 use std::rc::Rc;
 
-use vectorcraft_geom::{Affine, BezPath, FillRule};
+use vectorcraft_geom::Affine;
 
 use super::graphics::{GState, Out};
 use super::lex::{IMMEDIATE, Lexer};
@@ -65,11 +65,6 @@ pub(crate) struct Interp<'a> {
     /// The program is in the legacy Illustrator format: its group operators `u` … `U` (at the top
     /// level, whatever its prolog defines them as) are groups (see the module docs of `import`).
     pub illustrator: bool,
-    /// The program is the editing copy of an Illustrator file's art (see `native`): its clipping
-    /// groups, compound paths and text objects have operators of their own too.
-    pub native: bool,
-    /// The clip path `W` set for the clipping group about to end.
-    clip_region: Option<(BezPath, FillRule)>,
 }
 
 /// Where a PostScript error was raised: the operator that raised it (none for an unknown name)
@@ -169,8 +164,6 @@ impl<'a> Interp<'a> {
             saved: vec![],
             out,
             illustrator: false,
-            native: false,
-            clip_region: None,
         }
     }
 
@@ -179,9 +172,6 @@ impl<'a> Interp<'a> {
         loop {
             let Some(o) = self.lex.next()? else { return Ok(()) };
             let o = self.scanned(o, self.lex.immediate)?;
-            if self.native && self.native_op(&o)? {
-                continue;
-            }
             // A group begins before its `u` runs (`Some(true)`) and ends after its `U`
             // has (`Some(false)`).
             let group = match &o {
@@ -205,32 +195,6 @@ impl<'a> Interp<'a> {
         }
     }
 
-    /// The operators only the editing copy of an Illustrator file's art has (`native`), run
-    /// instead of defined; `false` for any other token.
-    fn native_op(&mut self, o: &Obj) -> Res<bool> {
-        let Obj::Exec(name) = o else { return Ok(false) };
-        match &**name {
-            "q" => self.out.begin_clip_group(),
-            "Q" => {
-                let region = self.clip_region.take();
-                self.out.end_clip_group(region);
-            }
-            "W" => {
-                let path = self.take_path();
-                self.clip_region = (!path.elements().is_empty()).then_some((path, FillRule::NonZero));
-            }
-            "*u" => self.out.begin_compound(),
-            "*U" => self.out.end_compound(),
-            "Xw" => self.out.hidden = self.pop_num()? != 0.0,
-            "__txt" => {
-                let story = self.pop_num()?;
-                self.out.text_slot((story >= 0.0 && story < f64::from(u32::MAX)).then_some(story as u32));
-            }
-            _ => return Ok(false),
-        }
-        Ok(true)
-    }
-
     /// Empty the standard dictionaries, so the memory they hold is freed with the interpreter:
     /// systemdict holds itself, and programs link dictionaries into each other.
     pub fn release(&mut self) {

crates/eps/src/import/mod.rs

@@ -25,6 +25,7 @@
 //! error, the operator and the procedures it ran in; without a preview, what was drawn before the
 //! error is kept (with that warning), else the file is refused.
 
+mod ai;
 mod ate;
 mod data;
 mod graphics;
@@ -60,7 +61,7 @@ use graphics::{GState, Out};
 use interp::{Fault, Interp};
 use obj::PsError;
 
-pub use native::{is_loss, layered_ai};
+pub use native::{ai_alone, is_loss, layered_ai};
 pub use text::family_style;
 
 /// The page of a PostScript file without a bounding box (US Letter).

crates/eps/src/import/native.rs

@@ -1,84 +1,49 @@
 //! The layers of an Illustrator EPS or `.ai`.
 //!
 //! Besides the page it prints, such a file carries the app's own copy of the art: an EPS after its
-//! `%%EOF`, between `%AI9_PrivateDataBegin` and `%AI9_PrivateDataEnd` (ASCII85 text of a Zstandard
-//! stream, `%AI24_DataStream`; older files: zlib, `%AI9_DataStream`); a PDF-compatible `.ai` in its `AIPrivateData` streams (the Zstandard
-//! stream after `%AI24_ZStandard_Data`). It is the document as the legacy Illustrator format writes
-//! it (`%AI5_BeginLayer`, `Lb`, `Ln`, `u` … `U`, `*u` … `*U`, `q` … `Q`, `m` `l` `c` `f` `S` …). It
-//! has what the page doesn't: the layers with their names, which of them are hidden (and what is on
-//! them), the hidden objects, the art outside the artboards, the groups, the compound paths and the
-//! clipping groups.
+//! `%%EOF`, a `.ai` in its `AIPrivateData` streams (see `ai` for the containers). It has what the
+//! page doesn't: the layers with their names and options, the groups, compound paths and clipping
+//! groups, the objects' names, the hidden objects and layers, the art outside the artboards and
+//! every artboard. `ai` reads that structure into a document, with the colours, gradients,
+//! transparency and images of the art.
 //!
-//! The page stays the source of what the art looks like; this copy only gives it its structure. Only
-//! the legacy format's own operators and comments are read, never what the app keeps in its private
-//! comments (`%_`) and dictionaries. So:
+//! Text objects are slots in that document: their characters, fonts and places are in the file's
+//! text document (see `ate`). Type that shows comes from the page, which draws it, into the slot
+//! whose text is where the page has it. Type that doesn't show (a hidden layer or object, or off
+//! the page) is made from the text document; where that can't be read (area type, type on a path)
+//! it's left out, with a warning.
 //!
-//! - Text objects are stubs here: their characters, fonts and places are in the file's text document
-//!   (see `ate`). Type that shows comes from the page, which draws it, into the slot whose text is
-//!   where the page has it. Type that doesn't show (a hidden layer or object, or off the page) is made
-//!   from the text document; where that can't be read (area type, type on a path) it's left out, with
-//!   a warning.
-//! - A line with an operator that isn't read (gradients, patterns, images, blends, …) isn't read. If
-//!   one is on a layer that shows, the art of this copy would differ from the page's, so the layers
-//!   aren't used: the file comes in as its page, as it did before.
-//!
-//! Sources (no Adobe software was run, no Adobe file is in this repo, and no Adobe specification,
-//! SDK or installation was used):
-//!
-//! - The layer, group, compound-path and clipping vocabulary of the legacy format, the container
-//!   (`%AI9_PrivateDataBegin`, `%AI24_DataStream`, `%AI24_ZStandard_Data`, the `AIPrivateData`
-//!   streams), the meaning of the `Xw` hidden flag and the text document were worked out from `.eps`
-//!   and `.ai` files their users own, used locally and never committed. (Adobe published a
-//!   specification of the legacy format, listed by PRONOM at
-//!   <https://www.nationalarchives.gov.uk/PRONOM/fmt/423>; it was not used here.)
-//! - The wrappers: the text is the standard ASCII85 encoding; the compressed stream is Zstandard,
-//!   RFC 8878 (<https://www.rfc-editor.org/rfc/rfc8878>), read with the permissively licensed
-//!   `ruzstd` crate (MIT); the older one is zlib, read with `flate2`. The PostScript the layers are
-//!   translated into is run by this project's own interpreter (`interp`).
+//! What a layer that shows has that `ai` doesn't read makes the file come in as its page, as it did
+//! before; on a layer that doesn't show it is left out of that layer, with a warning. The page is
+//! also the safety net: when the layers' art looks different from it, the page is used.
 //!
 //! Where a file doesn't match what this module expects, it is left alone and its page is imported.
 
 use std::collections::BTreeSet;
-use std::io::Read;
 use std::sync::Arc;
 
-use vectorcraft_doc::clipnest::nest;
-use vectorcraft_doc::{AppearanceItem, Document, LayerColor, Node, NodeId, NodeKind};
-use vectorcraft_geom::{Affine, Point, Rect};
+use vectorcraft_doc::{AppearanceItem, Document, Node, NodeId, NodeKind};
+use vectorcraft_geom::{Affine, Point, Rect, Vec2};
 
+use super::Imported;
+use super::ai::{self, Structure, slot_of};
 use super::ate::{Story, Texts};
-use super::graphics::{GState, Out, slot_of};
-use super::interp::Interp;
-use super::{Imported, box_of, finish_with, reason};
 
-const BEGIN: &[u8] = b"%AI9_PrivateDataBegin";
-const END: &[u8] = b"%AI9_PrivateDataEnd";
-const STREAM: &[u8] = b"%AI24_DataStream";
-/// The same, in files from before Zstandard.
-const STREAM_ZLIB: &[u8] = b"%AI9_DataStream";
-/// What a `.ai`'s private data starts with, before its Zstandard stream.
-const ZSTD_MARK: &[u8] = b"%AI24_ZStandard_Data";
-/// Most bytes the editing copy may have once decompressed.
-const MAX_DECODED: u64 = 256 << 20;
-/// The largest Zstandard window a frame may ask for: the decoder allocates it before reading.
-const MAX_ZSTD_WINDOW: u64 = 64 << 20;
 /// The notes that say the import left out something the file has (see [`is_loss`]).
 const TEXT_LEFT_OUT: &str = "text objects on hidden layers or hidden objects couldn't be read, so they are left out";
+/// The same for a file without a page to take shown type from.
+const TYPE_LEFT_OUT: &str = "text objects of kinds VectorCraft doesn't read from the file's text document yet are left out";
 const ART_LEFT_OUT: &str = "hidden layers have art this can't read";
-const PART_LEFT_OUT: &str = "part of a layer was left out";
 const LAYERS_UNREAD: &str = "the file's layers weren't read";
 
 /// Does this import note say that the file has something the document doesn't (hidden text, art or
 /// layers that could not be read)? Writing the document over the file would lose it for good.
 pub fn is_loss(note: &str) -> bool {
     note.ends_with(TEXT_LEFT_OUT)
-        || [ART_LEFT_OUT, PART_LEFT_OUT, LAYERS_UNREAD, super::graphics::TOO_MUCH, super::graphics::FAR_AWAY].iter().any(|n| note.starts_with(n))
+        || note.ends_with(TYPE_LEFT_OUT)
+        || [ART_LEFT_OUT, LAYERS_UNREAD, super::graphics::TOO_MUCH, super::graphics::FAR_AWAY].iter().any(|n| note.starts_with(n))
 }
 
-/// Deepest nesting of layers read (a file with deeper ones comes in as its page).
-const MAX_DEPTH: usize = 32;
-/// Most layers read.
-const MAX_LAYERS: usize = 4096;
 /// Most text objects in the layers, and most pieces of type in one place on the page, that are matched
 /// to each other (more than this and the layers aren't used).
 const MAX_SLOTS: usize = 5000;
@@ -88,378 +53,6 @@ const MAX_TEXT: usize = 16 << 20;
 /// Most pairs of a text object and a piece of the page's type compared.
 const MAX_PAIRS: usize = 4_000_000;
 
-/// What the operators of the format do, as PostScript: paths are the path operators, a fill or a
-/// stroke uses the colour the last `k` `K` `g` `G` set (a file's objects each set their own).
-const PROLOGUE: &str = "\
-/m {moveto} def /l {lineto} def /L {lineto} def /c {curveto} def /C {curveto} def
-/v {currentpoint 6 2 roll curveto} def /V {currentpoint 6 2 roll curveto} def
-/y {2 copy curveto} def /Y {2 copy curveto} def
-/h {closepath} def /N {newpath} def /n {closepath newpath} def
-/fc [0 0 0 0] def /sc [0 0 0 1] def /eo false def
-/setc {dup length 1 eq {0 get setgray} {dup length 3 eq {aload pop setrgbcolor} {aload pop setcmykcolor} ifelse} ifelse} def
-/k {4 array astore /fc exch def} def /K {4 array astore /sc exch def} def
-/g {1 exch sub 0 0 0 4 -1 roll 4 array astore /fc exch def} def /G {1 exch sub 0 0 0 4 -1 roll 4 array astore /sc exch def} def
-/Xk {pop pop pop 4 array astore /fc exch def} def /XK {pop pop pop 4 array astore /sc exch def} def
-/x {pop pop 4 array astore /fc exch def} def /X {pop pop 4 array astore /sc exch def} def
-/Xx {6 {pop} repeat 4 array astore /fc exch def} def /XX {6 {pop} repeat 4 array astore /sc exch def} def
-/H {} def
-/D {1 eq /eo exch def} def
-/doF {fc setc eo {eofill} {fill} ifelse} def /doS {sc setc stroke} def
-/F {doF} def /f {closepath doF} def /S {doS} def /s {closepath doS} def
-/B {gsave doF grestore doS} def /b {closepath B} def
-/w {setlinewidth} def /J {setlinecap} def /j {setlinejoin} def /M {setmiterlimit} def /d {setdash} def
-/u {} def /U {} def
-";
-
-/// Operators that draw, set the state they draw with, or group (`q` `Q` `W` `*u` `*U` are the
-/// interpreter's own, see `Interp::native_op`).
-const KEEP: &[&str] = &[
-    "m", "l", "L", "c", "C", "v", "V", "y", "Y", "h", "n", "N", "f", "F", "s", "S", "b", "B", "k", "K", "g", "G", "Xk", "XK", "x", "X", "Xx", "XX",
-    "H", "w", "J", "j", "M", "d", "D", "u", "U", "*u", "*U", "q", "Q", "W", "Xw",
-];
-/// Operators that only describe an object to the app (its lock, its overprint, its name's id, …):
-/// the line is left out.
-const IGNORE: &[&str] = &["A", "Ae", "AE", "As", "Ap", "O", "R", "i", "Xd", "Xy", "XR", "XW", "XP"];
-
-/// One token of a line.
-enum Tok<'a> {
-    Num(f64),
-    Str(Vec<u8>),
-    Name(&'a str),
-}
-
-/// The tokens of `line`: numbers, strings, names (the brackets of an array are left out); `None`
-/// for a string that doesn't end.
-fn tokens(line: &str) -> Option<Vec<Tok<'_>>> {
-    let b = line.as_bytes();
-    let mut out = vec![];
-    let mut i = 0;
-    while let Some(&c) = b.get(i) {
-        match c {
-            c if c.is_ascii_whitespace() || c == b'[' || c == b']' => i += 1,
-            b'(' => {
-                let (mut depth, mut s) = (1, vec![]);
-                i += 1;
-                loop {
-                    let c = *b.get(i)?;
-                    i += 1;
-                    match c {
-                        b'\\' => {
-                            let e = *b.get(i)?;
-                            i += 1;
-                            s.push(match e {
-                                b'n' => b'\n',
-                                b'r' => b'\r',
-                                b't' => b'\t',
-                                b'0'..=b'7' => {
-                                    let mut v = u32::from(e - b'0');
-                                    for _ in 0..2 {
-                                        match b.get(i) {
-                                            Some(d @ b'0'..=b'7') => {
-                                                v = v * 8 + u32::from(d - b'0');
-                                                i += 1;
-                                            }
-                                            _ => break,
-                                        }
-                                    }
-                                    (v & 0xff) as u8
-                                }
-                                other => other,
-                            });
-                        }
-                        b'(' => {
-                            depth += 1;
-                            s.push(c);
-                        }
-                        b')' => {
-                            depth -= 1;
-                            if depth == 0 {
-                                break;
-                            }
-                            s.push(c);
-                        }
-                        _ => s.push(c),
-                    }
-                }
-                out.push(Tok::Str(s));
-            }
-            _ => {
-                let start = i;
-                while b.get(i).is_some_and(|c| !c.is_ascii_whitespace() && !matches!(c, b'[' | b']' | b'(')) {
-                    i += 1;
-                }
-                let word = line.get(start..i)?;
-                out.push(word.parse::<f64>().map_or(Tok::Name(word), Tok::Num));
-            }
-        }
-    }
-    Some(out)
-}
-
-/// What the editing copy holds of a layer.
-#[derive(Default)]
-struct Layer {
-    name: String,
-    visible: bool,
-    color: Option<[u8; 3]>,
-    items: Vec<Item>,
-    /// The code read since the last sublayer.
-    code: String,
-    /// Operators on this layer that aren't read.
-    unsupported: BTreeSet<String>,
-}
-
-enum Item {
-    Code(String),
-    Sub(Layer),
-}
-
-impl Layer {
-    fn flush(&mut self) {
-        if !self.code.is_empty() {
-            self.items.push(Item::Code(std::mem::take(&mut self.code)));
-        }
-    }
-}
-
-struct Parsed {
-    /// The art's bounding box `llx lly urx ury`.
-    bbox: [f64; 4],
-    /// The first artboard (`%AI3_Cropmarks`), in the same space.
-    artboard: Option<[f64; 4]>,
-    /// The template box (`%AI3_TemplateBox`): its centre is the centre of the app's canvas.
-    template: Option<[f64; 4]>,
-    layers: Vec<Layer>,
-}
-
-/// The editing copy of the art, decompressed.
-fn decode(ps: &[u8]) -> Option<Vec<u8>> {
-    fn find(h: &[u8], n: &[u8], from: usize) -> Option<usize> {
-        h.get(from..)?.windows(n.len()).position(|w| w == n).map(|p| p + from)
-    }
-    let begin = find(ps, BEGIN, 0)?;
-    let end = find(ps, END, begin).unwrap_or(ps.len());
-    let block = ps.get(begin..end)?;
-    // Newer files compress with Zstandard, older ones (CS-era) with zlib.
-    let (at, zstd) = match find(block, STREAM, 0) {
-        Some(at) => (at + STREAM.len(), true),
-        None => (find(block, STREAM_ZLIB, 0)? + STREAM_ZLIB.len(), false),
-    };
-    // The stream's lines each start with a `%`.
-    let text: String = block
-        .get(at..)?
-        .split(|b| matches!(b, b'\r' | b'\n'))
-        .filter(|l| !l.is_empty())
-        .flat_map(|l| l.strip_prefix(b"%").unwrap_or(l).iter())
-        .map(|b| char::from(*b))
-        .collect();
-    let packed = crate::ps::ascii85_decode(&text)?;
-    if zstd { unzstd(&packed) } else { unzlib(&packed) }
-}
-
-/// The editing copy of a PDF-compatible `.ai`'s `AIPrivateData` streams, joined, decompressed.
-fn decode_ai(private: &[u8]) -> Option<Vec<u8>> {
-    unzstd(private.strip_prefix(ZSTD_MARK)?)
-}
-
-/// `packed` as a zlib stream decompressed (up to [`MAX_DECODED`] bytes).
-fn unzlib(packed: &[u8]) -> Option<Vec<u8>> {
-    let mut data = vec![];
-    flate2::read::ZlibDecoder::new(packed).take(MAX_DECODED).read_to_end(&mut data).ok()?;
-    (data.len() as u64 != MAX_DECODED).then_some(data)
-}
-
-/// `packed` as a Zstandard stream decompressed (up to [`MAX_DECODED`] bytes).
-fn unzstd(packed: &[u8]) -> Option<Vec<u8>> {
-    let mut zstd = ruzstd::decoding::StreamingDecoder::new_with_max_window_size(packed, MAX_ZSTD_WINDOW).ok()?;
-    let mut data = vec![];
-    (&mut zstd).take(MAX_DECODED).read_to_end(&mut data).ok()?;
-    (data.len() as u64 != MAX_DECODED).then_some(data)
-}
-
-/// The stories that text objects written plainly (not as comments) name.
-fn plain_stories(data: &[u8]) -> BTreeSet<u32> {
-    data.split(|b| matches!(b, b'\r' | b'\n'))
-        .filter_map(|raw| {
-            let line = String::from_utf8_lossy(raw);
-            line.trim().strip_suffix("/StoryIndex ,").and_then(|n| n.trim().parse().ok())
-        })
-        .collect()
-}
-
-/// The layers of the editing copy `data`.
-fn parse(data: &[u8]) -> Option<Parsed> {
-    let (mut bbox, mut hires, mut artboard, mut template) = (None, None, None, None);
-    let mut stack: Vec<Layer> = vec![];
-    let mut done: Vec<Layer> = vec![];
-    let mut dict_depth = 0usize;
-    // In a text object's dictionary: the story it names, once the dictionary says.
-    let mut text_story: Option<Option<u32>> = None;
-    // Whether that text object is written as comments, which the file does for some of its stories
-    // twice (once plain, once commented) and for others only commented.
-    let mut text_commented = false;
-    let plain = plain_stories(data);
-    let mut count = 0usize;
-    for raw in data.split(|b| matches!(b, b'\r' | b'\n')) {
-        let line = String::from_utf8_lossy(raw);
-        let line = line.trim();
-        if line.is_empty() {
-            continue;
-        }
-        // A text object's dictionary may be written as comments (`%_`), which a reader that doesn't
-        // know text objects skips: what that reader skips is read here, for the text object only.
-        let line = match line.strip_prefix("%_") {
-            Some(rest) if dict_depth > 0 || rest.starts_with("/AI11Text") && rest.ends_with(':') => {
-                if dict_depth == 0 {
-                    text_commented = true;
-                }
-                rest.trim()
-            }
-            _ => {
-                if dict_depth == 0 {
-                    text_commented = false;
-                }
-                line
-            }
-        };
-        if line.starts_with('%') {
-            match line {
-                "%AI5_BeginLayer" => {
-                    count += 1;
-                    // Too many, too deep, or in the middle of a dictionary: not a file this reads.
-                    if count > MAX_LAYERS || stack.len() > MAX_DEPTH || dict_depth > 0 {
-                        return None;
-                    }
-                    if let Some(parent) = stack.last_mut() {
-                        parent.flush();
-                    }
-                    stack.push(Layer { visible: true, ..Layer::default() });
-                }
-                "%AI5_EndLayer--" => {
-                    if dict_depth > 0 {
-                        return None;
-                    }
-                    let mut l = stack.pop()?;
-                    l.flush();
-                    match stack.last_mut() {
-                        Some(parent) => parent.items.push(Item::Sub(l)),
-                        None => done.push(l),
-                    }
-                }
-                _ if stack.is_empty() => {
-                    if let Some(v) = line.strip_prefix("%%HiResBoundingBox:") {
-                        hires = box_of(v.trim()).or(hires);
-                    } else if let Some(v) = line.strip_prefix("%%BoundingBox:") {
-                        bbox = box_of(v.trim()).or(bbox);
-                    } else if let Some(v) = line.strip_prefix("%AI3_Cropmarks:") {
-                        artboard = box_of(v.trim()).or(artboard);
-                    } else if let Some(v) = line.strip_prefix("%AI3_TemplateBox:") {
-                        template = four_numbers(v).or(template);
-                    }
-                }
-                _ => {}
-            }
-            continue;
-        }
-        let Some(layer) = stack.last_mut() else { continue };
-        // The app's dictionaries (`/Name :` … `;`): a text object's is a slot for its text.
-        if dict_depth > 0 {
-            // A dictionary ends with `;`, which may have its key after it (`; /ConfiningPath ,`).
-            if line == ";" || line.starts_with("; /") {
-                dict_depth -= 1;
-                if dict_depth == 0
-                    && let Some(story) = text_story.take()
-                {
-                    // A commented copy of a story that has a plain text object is not another object.
-                    if !(text_commented && story.is_some_and(|n| plain.contains(&n))) {
-                        layer.code.push_str(&format!("{} __txt\n", story.map_or(-1, i64::from)));
-                    }
-                }
-            } else if line.ends_with(':') {
-                dict_depth += 1;
-            } else if text_story.is_some()
-                && let Some(n) = line.strip_suffix("/StoryIndex ,")
-            {
-                text_story = Some(n.trim().parse().ok());
-            }
-            continue;
-        }
-        if line.starts_with('/') {
-            if line.ends_with(':') {
-                dict_depth = 1;
-                if line.starts_with("/AI11Text") {
-                    text_story = Some(None);
-                } else {
-                    layer.unsupported.insert("an object with its own dictionary".into());
-                }
-            } else {
-                layer.unsupported.insert("an unknown object".into());
-            }
-            continue;
-        }
-        let Some(toks) = tokens(line) else {
-            layer.unsupported.insert("an unreadable line".into());
-            continue;
-        };
-        let last = toks.last().and_then(|t| if let Tok::Name(n) = t { Some(*n) } else { None });
-        match last {
-            Some("Lb") => {
-                let n: Vec<f64> = toks.iter().filter_map(|t| if let Tok::Num(v) = t { Some(*v) } else { None }).collect();
-                layer.visible = n.first().is_none_or(|v| *v != 0.0);
-                if let [r, g, b] = n.get(8..11).unwrap_or_default() {
-                    let byte = |v: &f64| (v.is_finite() && (0.0..=255.0).contains(v)).then_some(*v as u8);
-                    layer.color = byte(r).zip(byte(g)).zip(byte(b)).map(|((r, g), b)| [r, g, b]);
-                }
-                continue;
-            }
-            Some("Ln") => {
-                if let Some(Tok::Str(s)) = toks.first() {
-                    layer.name = String::from_utf8_lossy(s).into_owned();
-                }
-                continue;
-            }
-            Some("LB") => continue,
-            _ => {}
-        }
-        let mut ignored = false;
-        let mut missing: Option<&str> = None;
-        for t in &toks {
-            if let Tok::Name(n) = t {
-                if IGNORE.contains(n) {
-                    ignored = true;
-                } else if !KEEP.contains(n) {
-                    missing = missing.or(Some(n));
-                }
-            }
-        }
-        if let Some(n) = missing {
-            let shown = n.len() <= 8 && n.chars().all(|c| c.is_ascii_graphic());
-            layer.unsupported.insert(if shown { format!("`{n}`") } else { "binary data".to_string() });
-        } else if !ignored {
-            layer.code.push_str(line);
-            layer.code.push('\n');
-        }
-    }
-    if dict_depth > 0 {
-        return None;
-    }
-    while let Some(mut l) = stack.pop() {
-        l.flush();
-        match stack.last_mut() {
-            Some(parent) => parent.items.push(Item::Sub(l)),
-            None => done.push(l),
-        }
-    }
-    Some(Parsed { bbox: hires.or(bbox)?, artboard, template, layers: done })
-}
-
-/// Four numbers (a box that may be a point).
-fn four_numbers(v: &str) -> Option<[f64; 4]> {
-    let n: Vec<f64> = v.split_whitespace().map_while(|w| w.parse::<f64>().ok()).collect();
-    let [a, b, c, d] = n.as_slice() else { return None };
-    [a, b, c, d].iter().all(|v| v.is_finite() && v.abs() <= 1e7).then_some([*a, *b, *c, *d])
-}
-
 /// `names` for a note: the first few, and how many more.
 fn few(names: BTreeSet<String>) -> String {
     const SHOWN: usize = 5;
@@ -471,19 +64,6 @@ fn few(names: BTreeSet<String>) -> String {
     list.join(", ")
 }
 
-/// What the operators not read are, on layers that show and on layers that don't.
-fn unread(layers: &[Layer], shown: bool, on: &mut BTreeSet<String>, off: &mut BTreeSet<String>) {
-    for l in layers {
-        let shown = shown && l.visible;
-        let set = if shown { &mut *on } else { &mut *off };
-        set.extend(l.unsupported.iter().cloned());
-        let subs: Vec<&Layer> = l.items.iter().filter_map(|i| if let Item::Sub(s) = i { Some(s) } else { None }).collect();
-        for s in subs {
-            unread(std::slice::from_ref(s), shown, on, off);
-        }
-    }
-}
-
 /// A text slot of the layers.
 struct SlotInfo {
     story: Option<u32>,
@@ -503,54 +83,6 @@ fn collect_slots(nodes: &[Arc<Node>], shown: bool, out: &mut Vec<SlotInfo>) {
     }
 }
 
-/// Builds the layers' nodes by running each stretch of their code.
-struct Builder {
-    out: Option<Out>,
-}
-
-impl Builder {
-    /// What `code` draws, as the nodes of a layer.
-    fn run(&mut self, code: &str) -> Vec<Arc<Node>> {
-        let Some(out) = self.out.take() else { return vec![] };
-        let src = format!("{PROLOGUE}{code}");
-        let mut out = out;
-        out.hidden = false;
-        let mut it = Interp::new(src.as_bytes(), GState::default(), out);
-        it.illustrator = true;
-        it.native = true;
-        let result = it.run();
-        it.release();
-        let fault = it.fault.take();
-        let mut out = it.out;
-        if let Err(e) = result {
-            out.warn(&format!("{PART_LEFT_OUT}: {}", reason(&e, fault.as_ref())));
-        }
-        let drawn = std::mem::take(&mut out.drawn);
-        let nodes = nest(&mut out.doc, drawn);
-        self.out = Some(out);
-        nodes
-    }
-
-    fn layer(&mut self, l: &Layer, depth: usize) -> Option<Arc<Node>> {
-        let mut children = vec![];
-        for item in &l.items {
-            match item {
-                Item::Code(code) => children.extend(self.run(code)),
-                Item::Sub(sub) if depth < MAX_DEPTH => children.extend(self.layer(sub, depth + 1)),
-                Item::Sub(_) => {}
-            }
-        }
-        let out = self.out.as_mut()?;
-        let name = if l.name.is_empty() { "Layer" } else { &l.name };
-        let mut node = Node::layer(out.doc.alloc_id(), name, l.color.map_or(LayerColor::Preset(0), LayerColor::Custom));
-        node.visible = l.visible;
-        if let Some(c) = node.children_mut() {
-            *c = children;
-        }
-        Some(Arc::new(node))
-    }
-}
-
 /// How far from a text object's own extent the strokes drawn around it reach (points).
 const OUTLINE_REACH: f64 = 6.0;
 
@@ -657,24 +189,46 @@ enum Content {
 }
 
 /// Replace the text slots in `nodes` with what `content` has for each, in order (a slot given none is
-/// left out). `empty` counts those.
-fn fill_slots(doc: &mut Document, nodes: &mut Vec<Arc<Node>>, content: &mut std::vec::IntoIter<Content>, empty: &mut usize) {
+/// left out): the page's type takes its place as it is, made type keeps the slot's name. `empty`
+/// counts those left out.
+fn fill_slots(
+    doc: &mut Document,
+    nodes: &mut Vec<Arc<Node>>,
+    content: &mut std::vec::IntoIter<Content>,
+    names: &std::collections::HashMap<NodeId, String>,
+    empty: &mut usize,
+) {
     let mut i = 0;
     while i < nodes.len() {
         let Some(n) = nodes.get(i) else { break };
         if slot_of(n.name.as_deref()).is_some() {
             let visible = n.visible;
+            let name = names.get(&n.id);
             let replacement = match content.next() {
                 Some(Content::Page(parts)) if !parts.is_empty() => {
-                    let children = parts.iter().map(|p| reid(doc, p)).collect();
-                    let mut group = Node::group(doc.alloc_id(), children);
-                    group.visible = visible;
-                    Some(group)
+                    // The page's type (and the strokes round it) take the slot's place as they are.
+                    let parts: Vec<Arc<Node>> = parts
+                        .iter()
+                        .map(|p| {
+                            let mut p = reid(doc, p);
+                            if !visible {
+                                Arc::make_mut(&mut p).visible = false;
+                            }
+                            if let Some(name) = name.filter(|_| matches!(p.kind, NodeKind::Text(_))) {
+                                Arc::make_mut(&mut p).name = Some(name.clone());
+                            }
+                            p
+                        })
+                        .collect();
+                    let n = parts.len();
+                    nodes.splice(i..=i, parts);
+                    i += n;
+                    continue;
                 }
                 Some(Content::Made(mut text)) => {
                     text.id = doc.alloc_id();
                     text.visible = visible;
-                    text.name = Some(MADE.into());
+                    text.name = Some(format!("{MADE}{}", name.map_or("", String::as_str)));
                     Some(*text)
                 }
                 Some(Content::Merged) => {
@@ -700,7 +254,7 @@ fn fill_slots(doc: &mut Document, nodes: &mut Vec<Arc<Node>>, content: &mut std:
                 && !matches!(n.kind, NodeKind::Compound { .. })
                 && let Some(c) = nodes.get_mut(i).map(Arc::make_mut).and_then(Node::children_mut)
             {
-                fill_slots(doc, c, content, empty);
+                fill_slots(doc, c, content, names, empty);
             }
             i += 1;
         }
@@ -961,7 +515,7 @@ fn plan(
                 };
             }
         }
-        if spare.len() != loose.len() {
+        if !spare.is_empty() && spare.len() != loose.len() {
             warn.push("the text is on the layers in the order the page paints it, so a text object may be in another group than it was".into());
         }
     }
@@ -976,23 +530,67 @@ fn plan(
     content
 }
 
-/// How much of `page` two documents draw differently (0 to 1), each seen on white.
-fn difference(a: &Document, b: &Document, page: Rect) -> f64 {
-    let scale = (400.0 / page.width().max(page.height()).max(1.0)).min(4.0);
-    let mut r = vectorcraft_render::Renderer::new();
-    let (x, y) = (r.render_region(a, page, scale, true), r.render_region(b, page, scale, true));
-    if x.width != y.width || x.height != y.height {
-        return 1.0;
+/// `doc` with its layers that don't print hidden, when it has any.
+fn as_printed(doc: &Document) -> Option<Document> {
+    fn hide(nodes: &mut [Arc<Node>]) -> bool {
+        let mut any = false;
+        for n in nodes {
+            if matches!(n.kind, NodeKind::Layer { printable: false, .. }) && n.visible {
+                Arc::make_mut(n).visible = false;
+                any = true;
+            } else if matches!(n.kind, NodeKind::Layer { .. })
+                && let Some(c) = Arc::make_mut(n).children_mut()
+            {
+                any |= hide(c);
+            }
+        }
+        any
+    }
+    let mut d = doc.clone();
+    hide(&mut d.layers).then_some(d)
+}
+
+/// The lightness (0 to 255, Rec. 601 weights) of a premultiplied pixel seen on white.
+fn lightness(p: &[u8; 4]) -> u8 {
+    let on_white = |c: u8| u32::from(c) + 255 - u32::from(p[3]).min(255);
+    ((on_white(p[0]) * 299 + on_white(p[1]) * 587 + on_white(p[2]) * 114) / 1000).min(255) as u8
+}
+
+/// The page drawn once, to weigh the layers' art against it: [`Self::difference`] draws the layers
+/// with a renderer of their own, which keeps their decoded images between draws (the page's images
+/// can share their keys and not their pixels, so the two don't share one).
+struct PageView {
+    page: vectorcraft_render::Rendered,
+    layers: vectorcraft_render::Renderer,
+    scale: f64,
+}
+
+impl PageView {
+    fn new(frame: &Frame<'_>) -> Self {
+        let ra = frame.page_rect;
+        let scale = (400.0 / ra.width().max(ra.height()).max(1.0)).min(4.0);
+        // Drawn on nothing and then seen on white: blending modes have no page to blend with, as in
+        // the app that wrote the file.
+        let page = vectorcraft_render::Renderer::new().render_region(frame.page, ra, scale, false);
+        Self { page, layers: vectorcraft_render::Renderer::new(), scale }
+    }
+
+    /// How much `b` on `rb` (a rectangle the page's size) draws differently from the page (0 to 1),
+    /// each seen on white. Pixels are compared by lightness: the page of an RGB document is written in
+    /// the colours' CMYK equivalents, and what the comparison looks for is art that is missing or out
+    /// of place.
+    fn difference(&mut self, b: &Document, rb: Rect) -> f64 {
+        // The page doesn't print what isn't printed.
+        let printed = as_printed(b);
+        let b = printed.as_ref().unwrap_or(b);
+        let (x, y) = (&self.page, self.layers.render_region(b, rb, self.scale, false));
+        if x.width != y.width || x.height != y.height {
+            return 1.0;
+        }
+        let differing =
+            x.pixels.as_chunks::<4>().0.iter().zip(y.pixels.as_chunks::<4>().0).filter(|(p, q)| lightness(p).abs_diff(lightness(q)) > 48).count();
+        differing as f64 / (f64::from(x.width) * f64::from(x.height)).max(1.0)
     }
-    let differing = x
-        .pixels
-        .as_chunks::<4>()
-        .0
-        .iter()
-        .zip(y.pixels.as_chunks::<4>().0)
-        .filter(|(p, q)| p.iter().zip(q.iter()).any(|(a, b)| a.abs_diff(*b) > 48))
-        .count();
-    differing as f64 / (f64::from(x.width) * f64::from(x.height)).max(1.0)
 }
 
 /// More of the page than this differing between the layers' art and the page's own, and the
@@ -1010,49 +608,50 @@ enum Page {
     Artboard,
 }
 
-/// What [`build`] made: the layers, and the drawing state they were made in (swatches, warnings).
-struct Built {
-    out: Out,
-    layers: Vec<Arc<Node>>,
+/// The page (`visible`, the file read as its page) and the place of its area in the layers'
+/// document.
+struct Frame<'a> {
+    page: &'a Document,
+    /// The page's area in `page`.
+    page_rect: Rect,
+    /// The same area in the layers' document.
+    rect: Rect,
 }
 
-/// The layers of the editing copy `data`, with the text (and strokes round it) of `visible`, the
-/// file read as its page, put on them. `base` is the document they go in.
-fn build(data: &[u8], visible: &Document, base: Document, page: Page) -> Result<Built, String> {
-    let parsed = parse(data).ok_or("its editing data is damaged")?;
-    if parsed.layers.is_empty() {
-        return Err("its editing data has no layers".into());
-    }
-    let [llx, lly, urx, ury] = match page {
-        Page::Art => parsed.bbox,
-        Page::Artboard => parsed.artboard.ok_or("its editing data doesn't say where its artboard is")?,
-    };
-    let artboard = visible.artboards.first().map(|a| a.rect).ok_or("it has no page")?;
-    if matches!(page, Page::Artboard) && visible.artboards.len() != 1 {
-        return Err("it has more than one artboard".into());
-    }
-    if ((urx - llx) - artboard.width()).abs() > 0.5 || ((ury - lly) - artboard.height()).abs() > 0.5 {
-        return Err("its editing data is for a different page".into());
-    }
-    let (mut on, mut off) = (BTreeSet::new(), BTreeSet::new());
-    unread(&parsed.layers, true, &mut on, &mut off);
-    if !on.is_empty() {
-        return Err(format!("its layers use {}, which aren't read yet", few(on)));
-    }
+/// The document of the editing copy `data`, with the text (and strokes round it) of `visible`, the
+/// file read as its page, put in its text objects → the document and its notes. Without a page
+/// (a `.ai` saved without its PDF part), its type is made from the file's text document alone and
+/// nothing is compared.
+fn build(data: &[u8], visible: Option<&Document>, page: Page) -> Result<(Document, Vec<String>), String> {
+    let Structure { mut doc, to_doc, bbox, artboard, template, hidden_unread, slot_names, warnings } = ai::read(data)?;
     let (mut shown, mut hidden) = (vec![], vec![]);
-    for l in &visible.layers {
-        if let Some(c) = l.children() {
-            text_objects(c, l.visible, &mut shown, &mut hidden);
+    let mut frame = None;
+    if let Some(visible) = visible {
+        let art_box = match page {
+            Page::Art => bbox.map(|[a, b, c, d]| Rect::new(a, b, c, d)).ok_or("its editing data doesn't say where its art is")?,
+            Page::Artboard => artboard.ok_or("its editing data doesn't say where its artboard is")?,
+        };
+        let page_rect = visible.artboards.first().map(|a| a.rect).ok_or("it has no page")?;
+        if (art_box.width() - page_rect.width()).abs() > 0.5 || (art_box.height() - page_rect.height()).abs() > 0.5 {
+            return Err("its editing data is for a different page".into());
         }
+        // The page's area in the layers' document, and the page's type moved there.
+        let rect = to_doc.transform_rect_bbox(art_box);
+        let shift = Affine::translate(Vec2::new(rect.x0 - page_rect.x0, rect.y0 - page_rect.y0));
+        for l in &visible.layers {
+            if let Some(c) = l.children() {
+                text_objects(c, l.visible, &mut shown, &mut hidden);
+            }
+        }
+        for object in shown.iter_mut().chain(hidden.iter_mut()) {
+            for n in object.iter_mut() {
+                Arc::make_mut(n).transform(shift, false);
+            }
+        }
+        frame = Some(Frame { page: visible, page_rect, rect });
     }
-    let mut doc = base;
-    doc.layers.clear();
-    let to_doc = Affine::translate((artboard.x0, artboard.y0)) * Affine::new([1.0, 0.0, 0.0, -1.0, -llx, ury]);
-    let mut b = Builder { out: Some(Out::new(doc, to_doc, artboard)) };
-    let mut layers: Vec<Arc<Node>> = parsed.layers.iter().filter_map(|l| b.layer(l, 0)).collect();
-    let mut out = b.out.ok_or("a layer couldn't be read")?;
     let mut infos = vec![];
-    collect_slots(&layers, true, &mut infos);
+    collect_slots(&doc.layers, true, &mut infos);
     if infos.iter().all(|i| !i.shown) && !shown.is_empty() {
         return Err("its page has text, and its layers have no text objects to put it in".into());
     }
@@ -1073,21 +672,31 @@ fn build(data: &[u8], visible: &Document, base: Document, page: Page) -> Result<
     if stories.iter().flatten().map(|s| s.len()).sum::<usize>() > MAX_TEXT {
         return Err("it has too much text".into());
     }
-    let template = parsed.template.map(|t| ((t[0] + t[2]) / 2.0, (t[1] + t[3]) / 2.0));
-    let mut notes = vec![];
+    let template = template.map(|t| ((t[0] + t[2]) / 2.0, (t[1] + t[3]) / 2.0));
+    let mut notes = warnings;
     let content = plan(&infos, &stories, template, to_doc, [&shown, &hidden], &mut notes);
     let mut empty = 0;
-    fill_slots(&mut out.doc, &mut layers, &mut content.into_iter(), &mut empty);
-    for n in notes {
-        out.warn(&n);
-    }
+    let mut layers = std::mem::take(&mut doc.layers);
+    fill_slots(&mut doc, &mut layers, &mut content.into_iter(), &slot_names, &mut empty);
+    doc.layers = layers;
     if empty > 0 {
-        out.warn(&format!("{empty} {TEXT_LEFT_OUT}"));
+        notes.push(format!("{empty} {}", if frame.is_some() { TEXT_LEFT_OUT } else { TYPE_LEFT_OUT }));
     }
-    if !off.is_empty() {
-        out.warn(&format!("{ART_LEFT_OUT} ({}), left out of them", few(off)));
+    if !hidden_unread.is_empty() {
+        notes.push(format!("{ART_LEFT_OUT} ({}), left out of them", few(hidden_unread)));
     }
-    Ok(Built { out, layers })
+    match frame {
+        Some(frame) => {
+            let mut view = PageView::new(&frame);
+            let unseen = prune_unseen(&frame, &mut view, &mut doc);
+            if unseen > 0 {
+                notes.push(format!("{unseen} {UNSEEN_TEXT}"));
+            }
+            notes.extend(compare(&frame, &mut view, &doc)?);
+        }
+        None => unmark(&mut doc.layers, true, &mut vec![]),
+    }
+    Ok((doc, notes))
 }
 
 /// Marks (in a node's name, until [`prune_unseen`] has looked) the text objects made from the file's
@@ -1104,11 +713,12 @@ const UNSEEN_MARGIN: f64 = 5e-5;
 fn unmark(nodes: &mut [Arc<Node>], shown: bool, found: &mut Vec<(NodeId, Option<Rect>)>) {
     for n in nodes {
         let shown = shown && n.visible;
-        if n.name.as_deref() == Some(MADE) {
+        if let Some(name) = n.name.as_deref().and_then(|m| m.strip_prefix(MADE)) {
             if shown {
                 found.push((n.id, n.visual_bounds()));
             }
-            Arc::make_mut(n).name = None;
+            let name = (!name.is_empty()).then(|| name.to_string());
+            Arc::make_mut(n).name = name;
         } else if !matches!(n.kind, NodeKind::Compound { .. })
             && let Some(c) = Arc::make_mut(n).children_mut()
         {
@@ -1136,14 +746,14 @@ fn take_out(nodes: &mut Vec<Arc<Node>>, id: NodeId, hide: bool) -> bool {
 /// has no type to match them, and that the layers look no worse without, are not drawn by the app
 /// that wrote the file (which paints every shown text object; it keeps the type of what was turned
 /// to outlines): they are taken out. How many.
-fn prune_unseen(page: &Document, doc: &mut Document) -> usize {
+fn prune_unseen(frame: &Frame<'_>, view: &mut PageView, doc: &mut Document) -> usize {
     let mut found = vec![];
     unmark(&mut doc.layers, true, &mut found);
-    let Some(rect) = page.artboards.first().map(|a| a.rect) else { return 0 };
+    let rect = frame.rect;
     if found.is_empty() || found.len() > MAX_WEIGHED {
         return 0;
     }
-    let mut with = difference(page, doc, rect);
+    let mut with = view.difference(doc, rect);
     let mut removed = 0;
     for (id, bounds) in found {
         if bounds.is_none_or(|b| b.intersect(rect).is_zero_area()) {
@@ -1153,7 +763,7 @@ fn prune_unseen(page: &Document, doc: &mut Document) -> usize {
         if !take_out(&mut without.layers, id, true) {
             continue;
         }
-        let d = difference(page, &without, rect);
+        let d = view.difference(&without, rect);
         if d - with <= UNSEEN_MARGIN {
             take_out(&mut doc.layers, id, false);
             with = d;
@@ -1165,9 +775,8 @@ fn prune_unseen(page: &Document, doc: &mut Document) -> usize {
 
 /// Do the layers' art and the page's own look alike? An error says they don't; `Ok` has the note
 /// to give when they differ a little.
-fn compare(page: &Document, layered: &Document) -> Result<Option<String>, String> {
-    let Some(rect) = page.artboards.first().map(|a| a.rect) else { return Ok(None) };
-    let diff = difference(page, layered, rect);
+fn compare(frame: &Frame<'_>, view: &mut PageView, layered: &Document) -> Result<Option<String>, String> {
+    let diff = view.difference(layered, frame.rect);
     if diff > MAX_DIFFERENCE {
         return Err(format!("the art on them differs from the page's in {:.0}% of it", diff * 100.0));
     }
@@ -1180,38 +789,20 @@ fn compare(page: &Document, layered: &Document) -> Result<Option<String>, String
 }
 
 /// The EPS `visible` (read as its page) read through its editing copy instead: its layers (the
-/// hidden ones too), groups, compound paths and clipping groups, with the text and the strokes
-/// around it of the page. When the file has no editing copy this reads, `visible` as it was; when
-/// it has one that can't be used, `visible` with a warning that says why.
-pub(super) fn layered(ps: &[u8], mut visible: Imported) -> Imported {
-    let Some(data) = decode(ps) else {
-        // A file that says it has the editing copy but has none that can be read is a loss too.
-        let has = |n: &[u8]| ps.windows(n.len()).any(|w| w == n);
-        if has(BEGIN) && (has(STREAM) || has(STREAM_ZLIB)) {
-            visible.warnings.push(format!("{LAYERS_UNREAD} (its editing data is damaged or too large): it comes in as its page, in one layer"));
-        }
-        return visible;
-    };
-    let Some(page) = visible.document.artboards.first().map(|a| a.rect) else { return visible };
-    let base = Document::new(page.width(), page.height());
-    let result = build(&data, &visible.document, base, Page::Art).and_then(|built| {
-        let mut done = finish_with(built.out, built.layers);
-        let unseen = prune_unseen(&visible.document, &mut done.document);
-        if unseen > 0 {
-            done.warnings.push(format!("{unseen} {UNSEEN_TEXT}"));
-        }
-        let note = compare(&visible.document, &done.document)?;
-        done.warnings.extend(note);
-        Ok(done)
-    });
+/// hidden ones too), groups, compound paths, clipping groups and artboards, with the text and the
+/// strokes around it of the page. When the file has no editing copy, `visible` as it was; when it
+/// has one that can't be used, `visible` with a warning that says why.
+pub(super) fn layered(ps: &[u8], visible: Imported) -> Imported {
+    let Some(data) = ai::eps_data(ps) else { return visible };
+    let result = data.and_then(|data| build(&data, Some(&visible.document), Page::Art));
     match result {
-        Ok(mut done) => {
+        Ok((document, mut warnings)) => {
             for w in &visible.warnings {
-                if !done.warnings.contains(w) {
-                    done.warnings.push(w.clone());
+                if !warnings.contains(w) {
+                    warnings.push(w.clone());
                 }
             }
-            done
+            Imported { document, warnings, preview: false }
         }
         Err(why) => {
             let mut v = visible;
@@ -1221,24 +812,16 @@ pub(super) fn layered(ps: &[u8], mut visible: Imported) -> Imported {
     }
 }
 
-/// The PDF-compatible `.ai` `visible` (read as its PDF part) read through its editing copy
-/// (`private`, the joined `AIPrivateData` streams) instead, as [`layered`] reads an EPS: with the
-/// layers and objects of the file, and the art that lies outside its artboard, which its PDF part
-/// doesn't have. `warnings` are the notes of reading the PDF part; the notes returned are those,
-/// and the layers'.
+/// The `.ai` `visible` (read as its PDF part) read through its editing copy (`private`, the joined
+/// `AIPrivateData` streams) instead, as [`layered`] reads an EPS: with the layers and objects of the
+/// file, its artboards, and the art that lies outside them, which its PDF part doesn't have.
+/// `warnings` are the notes of reading the PDF part; the notes returned are those, and the layers'.
 pub fn layered_ai(private: &[u8], visible: Document, warnings: Vec<String>) -> (Document, Vec<String>) {
-    let Some(data) = decode_ai(private) else { return (visible, warnings) };
-    let result = build(&data, &visible, visible.clone(), Page::Artboard).and_then(|built| {
-        let mut notes = built.out.warnings.clone();
-        let mut done = finish_layers(built.out, built.layers);
-        let unseen = prune_unseen(&visible, &mut done);
-        if unseen > 0 {
-            notes.push(format!("{unseen} {UNSEEN_TEXT}"));
-        }
-        notes.extend(compare(&visible, &done)?);
-        Ok((done, notes))
-    });
-    match result {
+    let Ok(data) = ai::decode_private(private) else { return (visible, warnings) };
+    if !data.windows(15).any(|w| w == b"%AI5_BeginLayer") {
+        return (visible, warnings);
+    }
+    match build(&data, Some(&visible), Page::Artboard) {
         Ok((done, notes)) => {
             let mut all = warnings;
             all.extend(notes.into_iter().filter(|n| !all.contains(n)).collect::<Vec<_>>());
@@ -1252,10 +835,11 @@ pub fn layered_ai(private: &[u8], visible: Document, warnings: Vec<String>) -> (
     }
 }
 
-fn finish_layers(out: Out, layers: Vec<Arc<Node>>) -> Document {
-    let mut doc = out.doc;
-    doc.layers = layers;
-    doc
+/// A `.ai` saved without its PDF part (its pages show only a placeholder) from its editing copy
+/// alone (`private`, the joined `AIPrivateData` streams) → the document and the import's notes.
+pub fn ai_alone(private: &[u8]) -> Result<(Document, Vec<String>), String> {
+    let data = ai::decode_private(private)?;
+    build(&data, None, Page::Artboard)
 }
 
 #[cfg(test)]

crates/eps/src/import/tests_native.rs

@@ -95,7 +95,8 @@ fn layers_come_in_with_their_names_colours_and_hidden_state() {
     assert_eq!([d.layers[0].visible, d.layers[1].visible], [true, false]);
     // What is on a hidden layer stays: the page doesn't have it.
     assert_eq!(kinds(&d.layers[1]), ["path"]);
-    assert!(matches!(&d.layers[0].kind, NodeKind::Layer { color: LayerColor::Custom([79, 128, 255]), .. }));
+    // Colour 0 of the layer colours (light blue), by its place in the list.
+    assert!(matches!(&d.layers[0].kind, NodeKind::Layer { color: LayerColor::Preset(0), .. }));
     assert!(r.warnings.is_empty(), "{:?}", r.warnings);
     // The page is where the page's art was.
     let b = d.layers[0].children().unwrap()[0].visual_bounds().unwrap();
@@ -143,13 +144,13 @@ fn sublayers_groups_compounds_clip_groups_and_hidden_objects_come_in() {
 
 #[test]
 fn what_the_layers_cant_say_keeps_the_page_when_it_shows_and_not_when_it_doesnt() {
-    // A gradient (`Bg`) on a layer that shows: the layers would draw it as a flat colour.
-    let shown = native(&layer("Art", true, &format!("{}\n0 0 0 1 0 0 Bg", square(10, 10))));
+    // An operator that isn't read (`Zq`) on a layer that shows: the layers would draw without it.
+    let shown = native(&layer("Art", true, &format!("{}\n0 0 0 1 0 0 Zq", square(10, 10))));
     let r = import(&eps(&page_square(10, 10), &shown)).unwrap();
     assert_eq!(names(&r.document), ["Layer 1"]);
-    assert!(r.warnings.iter().any(|w| w.contains("layers weren't read") && w.contains("`Bg`")), "{:?}", r.warnings);
+    assert!(r.warnings.iter().any(|w| w.contains("layers weren't read") && w.contains("`Zq`")), "{:?}", r.warnings);
     // On a hidden layer it only costs that layer's look.
-    let hidden = native(&(layer("Art", true, &square(10, 10)) + &layer("Old", false, "0 0 0 1 0 0 Bg")));
+    let hidden = native(&(layer("Art", true, &square(10, 10)) + &layer("Old", false, "0 0 0 1 0 0 Zq")));
     let r = import(&eps(&page_square(10, 10), &hidden)).unwrap();
     assert_eq!(names(&r.document), ["Art", "Old"]);
     assert!(r.warnings.iter().any(|w| w.contains("hidden layers have art this can't read")), "{:?}", r.warnings);
@@ -166,9 +167,8 @@ fn text_and_its_strokes_come_from_the_page_into_the_layer_of_its_text_object() {
     let r = import(&eps(&page, &art)).unwrap();
     assert_eq!(names(&r.document), ["Art", "Words"], "{:?}", r.warnings);
     assert_eq!(kinds(&r.document.layers[0]), ["path"]);
-    // The text and the path of its stroke, together where the text object is.
-    let group = &r.document.layers[1].children().unwrap()[0];
-    assert_eq!(kinds(group), ["text", "path"], "{:?}", r.warnings);
+    // The text and the path of its stroke, where the text object is (no group of their own).
+    assert_eq!(kinds(&r.document.layers[1]), ["text", "path"], "{:?}", r.warnings);
     assert!(r.warnings.is_empty(), "{:?}", r.warnings);
 }
 
@@ -238,14 +238,15 @@ fn an_ai_file_that_cant_be_read_through_its_editing_data_keeps_its_pdf_part() {
 }
 
 #[test]
-fn a_gray_is_the_black_ink_as_in_a_cmyk_document() {
-    // `g` is a gray: 0.25 is 75 % of the black ink, as the page's own CMYK black says.
+fn a_gray_is_a_grayscale_colour() {
+    // `g` is a gray: 0.25 is 75 % of the black ink, as the page's own CMYK black says; the colour
+    // stays in its grayscale model.
     let art = native(&layer("Art", true, "0.25 g\n10 10 m\n14 10 L\n14 14 L\n10 14 L\nf"));
     let page = "0 0 0 0.75 setcmykcolor 10 10 moveto 14 10 lineto 14 14 lineto 10 14 lineto closepath fill";
     let r = import(&eps(page, &art)).unwrap();
     assert_eq!(names(&r.document), ["Art"], "{:?}", r.warnings);
     let fill = r.document.layers[0].children().unwrap()[0].appearance.fill().and_then(|f| f.paint.color());
-    assert_eq!(fill, Some(vectorcraft_color::Color::cmyk(0.0, 0.0, 0.0, 0.75)));
+    assert_eq!(fill, Some(vectorcraft_color::Color::gray(0.75)));
     assert!(r.warnings.is_empty(), "{:?}", r.warnings);
 }
 
@@ -378,7 +379,7 @@ fn shown_type_keeps_the_pages_and_type_off_the_page_comes_from_the_text_document
     let r = import(&eps(page, &art)).unwrap();
     assert_eq!(names(&r.document), ["Art"], "{:?}", r.warnings);
     let texts = text_of(&r.document.layers[0]);
-    // The page's own object is a group (its type and strokes), and the other is made from the file.
+    // The page's own object, and the other made from the file.
     let all: Vec<String> = {
         let mut v = vec![];
         r.document.walk(|n| {
@@ -390,7 +391,7 @@ fn shown_type_keeps_the_pages_and_type_off_the_page_comes_from_the_text_document
     };
     assert_eq!(all.len(), 2, "{all:?} {:?}", r.warnings);
     assert!(all.contains(&"Hi there".to_string()) && all.contains(&"Away".to_string()), "{all:?}");
-    assert_eq!(texts.len(), 1, "the type of the page sits in a group of its own");
+    assert_eq!(texts.len(), 2, "the page's type is in the layer as it is, not in a group");
     assert!(!r.warnings.iter().any(|w| w.contains("order the page paints")), "{:?}", r.warnings);
 }
 
@@ -422,13 +423,12 @@ fn a_line_the_page_draws_in_pieces_goes_to_its_text_object_whole() {
     let page = "0 0 0 1 setcmykcolor /Helvetica findfont 14 scalefont setfont 58.5 61.5 moveto (Hi) show 70 61.5 moveto (there) show";
     let r = import(&eps(page, &art)).unwrap();
     // One text, with the line's space between the pieces.
-    let group = &r.document.layers[0].children().unwrap()[0];
-    assert_eq!(kinds(group), ["text"], "{:?}", r.warnings);
-    let texts: Vec<String> =
-        group.children().unwrap().iter().filter_map(|n| if let NodeKind::Text(t) = &n.kind { Some(t.plain_text()) } else { None }).collect();
+    let art = &r.document.layers[0];
+    assert_eq!(kinds(art), ["text"], "{:?}", r.warnings);
+    let texts: Vec<String> = text_of(art).iter().map(|t| t.plain_text()).collect();
     assert_eq!(texts, ["Hi there"]);
     // Its bounds are laid out afresh for the whole text, not those of the first piece.
-    let NodeKind::Text(t) = &group.children().unwrap()[0].kind else { panic!("text") };
+    let NodeKind::Text(t) = &art.children().unwrap()[0].kind else { panic!("text") };
     assert!(t.cached_bounds.is_none() && t.cached_baselines.is_empty());
 }
 
@@ -521,3 +521,24 @@ fn a_dictionary_left_open_at_the_end_of_a_layer_is_a_damaged_file() {
     assert_eq!(names(&r.document), ["Layer 1"], "{:?}", r.warnings);
     assert!(r.warnings.iter().any(|w| crate::is_loss(w)), "{:?}", r.warnings);
 }
+
+#[test]
+fn an_ai_file_without_its_pdf_part_reads_its_layers_and_makes_its_type() {
+    // Point type from the text document, shown or not; a story it can't read is left out, with a
+    // note that is a loss.
+    let mut doc = text_document(&[("Hi there\r", 0, (8200.0, 8180.0), (0.0, 0.0), 0.0), ("Area\r", 0, (8200.0, 8160.0), (0.0, 0.0), 0.0)]);
+    // Story 1 in frame 1, a frame that says more than a matrix.
+    let at = doc.rfind("/1 << /0 [ << /0 0 >> ]").unwrap();
+    doc.replace_range(at..at + 23, "/1 << /0 [ << /0 1 >> ]");
+    let at = doc.rfind("/2 << /2 [ 1 0 0 1 0 0 ] >>").unwrap();
+    doc.replace_range(at..at + 27, "/2 << /2 [ 1 0 0 1 0 0 ] /7 1 >>");
+    let art = native_with_text(&(layer("Back", true, &square(10, 10)) + &layer("Words", true, &(text_object(0) + &text_object(1)))), &doc);
+    let (d, notes) = crate::ai_alone(&private(&art)).unwrap();
+    assert_eq!(names(&d), ["Back", "Words"], "{notes:?}");
+    let texts: Vec<String> = text_of(&d.layers[1]).iter().map(|t| t.plain_text()).collect();
+    assert_eq!(texts, ["Hi there"], "{notes:?}");
+    let left = notes.iter().find(|n| n.contains("left out")).unwrap();
+    assert!(left.starts_with("1 ") && crate::is_loss(left), "{notes:?}");
+    assert!(!notes.iter().any(|n| n.contains("order the page paints")), "{notes:?}");
+    assert!(crate::ai_alone(b"%AI24_ZStandard_Data nothing").is_err());
+}

crates/eps/src/lib.rs

@@ -34,7 +34,7 @@ mod ps;
 mod scene;
 mod tiff;
 
-pub use import::{Imported, family_style, import, is_loss, layered_ai};
+pub use import::{Imported, ai_alone, family_style, import, is_loss, layered_ai};
 pub use print::{PrintJob, PrintPage, print};
 
 use vectorcraft_doc::Document;

crates/metafile/src/import.rs

@@ -700,7 +700,7 @@ impl Player {
             return self.warn(&deep_clips());
         }
         self.next_clip += 1;
-        self.dc.clips.push(Arc::new(Clip { id: self.next_clip, region: Some((path, rule)), hidden: false }));
+        self.dc.clips.push(Arc::new(Clip { id: self.next_clip, region: Some((path, rule)) }));
     }
 
     /// SelectClipPath (`mode`: 1 and, 5 copy; the others cut out, which isn't read).

crates/pdf/src/export.rs

@@ -270,10 +270,12 @@ impl Writer {
             // The drawing space the page shows (the marks' area).
             let shown = sheet.view.inverse().transform_rect_bbox(paper);
             let knockout = std::mem::replace(&mut ex.knockout, false);
-            // Marks keep their inks: they aren't converted to the destination.
+            // Marks keep their inks: they aren't converted to the destination. The page
+            // information is drawn as glyph shapes, like the other marks, not as text.
             let convert = std::mem::replace(&mut ex.convert, false);
+            let outline = std::mem::replace(&mut ex.outline_text, true);
             ex.node(&mut s, art, sheet.window.map_or(shown, |r| r.intersect(shown)), true);
-            (ex.knockout, ex.convert) = (knockout, convert);
+            (ex.knockout, ex.convert, ex.outline_text) = (knockout, convert, outline);
         }
         if window.is_some() {
             s.pop();

crates/pdf/src/import_text.rs

@@ -24,6 +24,9 @@ pub(crate) struct Placement {
     pub size: f64,
     /// Width of the em ÷ its height, in percent.
     pub h_scale: f64,
+    /// How far the em leans along the baseline per unit of its height (a text matrix with a
+    /// shear: faux italic, or type slanted as a whole); 0 when it stands square on the baseline.
+    pub slant: f64,
 }
 
 impl Placement {
@@ -33,14 +36,23 @@ impl Placement {
         let origin = m * Point::ORIGIN;
         let ex = m * Point::new(1000.0, 0.0) - origin;
         let ey = m * Point::new(0.0, 1000.0) - origin;
-        let (w, size) = (ex.hypot(), ey.hypot());
+        let w = ex.hypot();
         // Upright in y-down document space: x to the right of up.
         let upright = ex.cross(ey) < 0.0;
-        (origin.is_finite() && w.is_finite() && size.is_finite() && w > 0.01 && size > 0.01 && size < 1e5 && upright).then(|| Self {
+        if !(w.is_finite() && w > 0.01) {
+            return None;
+        }
+        let dir = ex / w;
+        // The em's height is across the baseline; what's left of `ey` along it is a slant.
+        let up = Vec2::new(dir.y, -dir.x);
+        let size = ey.dot(up);
+        let slant = ey.dot(dir) / size;
+        (origin.is_finite() && size.is_finite() && slant.is_finite() && size > 0.01 && size < 1e5 && upright).then(|| Self {
             origin,
-            dir: ex / w,
+            dir,
             size,
             h_scale: w / size * 100.0,
+            slant,
         })
     }
 
@@ -211,6 +223,7 @@ impl TextLine {
             let gap = (at.origin - self.next).dot(self.last_dir);
             let on_line = opacity == self.opacity
                 && at.dir.dot(self.at.dir) > 0.9995
+                && (at.slant - self.at.slant).abs() < 1e-3
                 && (at.origin - self.at.origin).dot(self.at.up()).abs() < size * 0.15
                 && gap > -size * 0.3
                 && gap < size * 3.0;
@@ -218,6 +231,7 @@ impl TextLine {
             // that one ends.
             let on_curve = !on_line
                 && opacity == self.opacity
+                && (at.slant - self.at.slant).abs() < 1e-3
                 && at.dir.dot(self.last_dir) > CURVE_TURN_COS
                 && at.dir.dot(self.last_dir) < 0.99999
                 && (at.origin - self.next).hypot() < size * 0.6;
@@ -309,7 +323,8 @@ impl TextLine {
             to_logical(&mut t);
         }
         let angle = self.at.dir.atan2();
-        t.xf = Affine::translate(self.at.origin.to_vec2()) * Affine::rotate(angle);
+        // The glyphs' tops lean along the baseline (+x), up being -y in the type's own space.
+        t.xf = Affine::translate(self.at.origin.to_vec2()) * Affine::rotate(angle) * Affine::skew(-self.at.slant, 0.0);
         let db = vectorcraft_text::FontDb::global();
         if let Some(path) = path {
             t.kind = TextKind::OnPath { path: vectorcraft_geom::PathData::from_bezpath(&path), start: 0.0, end: None };

crates/pdf/src/settings.rs

@@ -373,7 +373,7 @@ pub struct AdvancedSettings {
 
 impl Default for AdvancedSettings {
     fn default() -> Self {
-        Self { font_subset_percent: 100.0, outline_text: true, overprint: Overprint::Preserve }
+        Self { font_subset_percent: 100.0, outline_text: false, overprint: Overprint::Preserve }
     }
 }
 

crates/pdf/src/tests.rs

@@ -342,9 +342,13 @@ fn text_exported_as_outlines() {
     let mut d = doc(300.0, 100.0);
     let t = TextObject::point(Point::new(10.0, 50.0), "Hello", CharStyle { size: 24.0, ..CharStyle::default() });
     add(&mut d, Node::new(NodeId(0), NodeKind::Text(Box::new(t))));
-    let s = uncompressed(&d);
+    let mut outlined = PdfOptions::uncompressed();
+    outlined.settings.advanced.outline_text = true;
+    let s = String::from_utf8_lossy(&export(&d, &outlined).unwrap()).into_owned();
     assert!(!s.contains("/Font"), "no fonts when outlining text");
-    let r = import_with_report(&export(&d, &PdfOptions::default()).unwrap(), &ImportOptions::default()).unwrap();
+    // Real text in an embedded font by default, as a PDF from Illustrator has it (#733).
+    assert!(uncompressed(&d).contains("/FontFile"), "a font embedded by default");
+    let r = import_with_report(&export(&d, &outlined).unwrap(), &ImportOptions::default()).unwrap();
     let l = leaves(&r.document);
     assert!(!l.is_empty());
     assert!(l.iter().all(|n| matches!(n.kind, NodeKind::Path { .. })));

crates/pdf/src/tests_layers.rs

@@ -331,9 +331,11 @@ fn pdf_a_overprint_mode_is_0() {
 #[test]
 fn overprinting_art_imports_as_it_was_drawn() {
     let d = overprinting(RED);
-    let plain = leaves(&import(&export(&d, json!({"advanced": {"overprint": "discard"}})).bytes).unwrap());
+    // What is drawn (a form's bounds may come back as an unpainted clipping path).
+    let painted = |bytes: &[u8]| leaves(&import(bytes).unwrap()).into_iter().filter(|l| l.2.is_some()).collect::<Vec<_>>();
+    let plain = painted(&export(&d, json!({"advanced": {"overprint": "discard"}})).bytes);
     for v in [json!({}), json!({"createLayers": true})] {
-        assert_eq!(leaves(&import(&export(&d, v.clone()).bytes).unwrap()), plain, "{v}: the marks draw nothing");
+        assert_eq!(painted(&export(&d, v.clone()).bytes), plain, "{v}: the marks draw nothing");
     }
 }
 

crates/pdf/src/tests_live_text.rs

@@ -265,7 +265,7 @@ fn a_single_upright_glyph_comes_in_as_vertical_type_and_takes_no_horizontal_glyp
         fill: Some(vectorcraft_color::Paint::solid(vectorcraft_color::Color::rgb(0.0, 0.0, 0.0))),
         stroke: None,
     };
-    let at = |x: f64, y: f64| Placement { origin: Point::new(x, y), dir: Vec2::new(1.0, 0.0), size: 20.0, h_scale: 100.0 };
+    let at = |x: f64, y: f64| Placement { origin: Point::new(x, y), dir: Vec2::new(1.0, 0.0), size: 20.0, h_scale: 100.0, slant: 0.0 };
     let mut line = TextLine::new(at(100.0, 100.0), 1.0);
     assert!(line.push_upright(&look, at(100.0, 100.0), 1.0, Upright { top: Point::new(110.0, 82.0) }, "§"));
     assert!(!line.push(&look, at(130.0, 100.0), 1.0, 10.0, "a"), "a horizontal glyph starts another line");
@@ -288,7 +288,7 @@ fn letter_spaced_vertical_type_keeps_its_characters_together() {
         stroke: None,
     };
     // Glyphs set down a column 1.5 em apart (tracking 500): no spaces come in between them.
-    let at = |y: f64| Placement { origin: Point::new(100.0, y), dir: Vec2::new(1.0, 0.0), size: 20.0, h_scale: 100.0 };
+    let at = |y: f64| Placement { origin: Point::new(100.0, y), dir: Vec2::new(1.0, 0.0), size: 20.0, h_scale: 100.0, slant: 0.0 };
     let mut line = TextLine::new(at(100.0), 1.0);
     for (i, c) in ["§", "§", "§"].iter().enumerate() {
         let y = 100.0 + 30.0 * i as f64;

crates/pdf/src/tests_realtext.rs

@@ -274,3 +274,19 @@ fn an_embedded_fonts_own_cmap_names_its_glyphs() {
     }
     assert!(crate::import::font_chars(b"not a font").is_none());
 }
+
+/// Type whose text matrix shears its glyphs (slanted as a whole, as Illustrator writes type
+/// turned and skewed) reopens as type that still leans: drawn, it covers what its outlines do.
+#[test]
+fn slanted_type_reopens_as_type_that_still_leans() {
+    for (turn, lean) in [(0.0, 0.25), (-0.2, 0.25), (0.3, -0.15)] {
+        let mut t = TextObject::point(Point::new(80.0, 150.0), "LEAN", style(60.0));
+        t.xf *= Affine::rotate(turn) * Affine::skew(lean, 0.0);
+        let d = doc(vec![t]);
+        let reopened = import_as(&pdf(&d, false).bytes, TextAs::Text);
+        assert_eq!(texts(&reopened), ["LEAN"], "{turn} {lean}: reopened as type");
+        let (a, b) = (ink(&import_as(&pdf(&reopened, true).bytes, TextAs::Outlines)), ink(&import_as(&pdf(&d, true).bytes, TextAs::Outlines)));
+        let off = [a.x0 - b.x0, a.y0 - b.y0, a.x1 - b.x1, a.y1 - b.y1].iter().fold(0.0f64, |m, v| m.max(v.abs()));
+        assert!(off < 0.5, "{turn} {lean}: {a:?} vs {b:?}");
+    }
+}

crates/pdf/src/tests_settings.rs

@@ -95,7 +95,7 @@ fn options_not_applied_yet_come_back_as_warnings() {
         json!({"output": {"outputIntent": vectorcraft_color::cms::GENERIC_CMYK, "outputCondition": "Press", "registry": "r", "trapped": true}}),
         json!({"output": {"outputConditionId": "CGATS TR 001"}}),
         json!({"advanced": {"outlineText": false}}),
-        json!({"advanced": {"fontSubsetPercent": 35}}),
+        json!({"advanced": {"outlineText": true, "fontSubsetPercent": 35}}),
         json!({"bleed": {"useDocument": true, "top": 9}}),
         json!({"bleed": {"top": 9}, "marks": {"trim": true, "registration": true, "colorBars": true, "pageInfo": true}}),
         json!({"includeNonPrinting": true}),

crates/pdf/tests/system_fonts.rs

@@ -14,21 +14,36 @@ fn a_fresh_session_resolves_pdf_fonts_to_installed_families() {
     let probe = FontDb::with_font_dirs(system_font_dirs());
     probe.load_system_fonts();
     let installed = probe.families();
-    // A family whose PDF name is its name without the spaces (as "TimesNewRoman").
-    let Some(family) = installed.iter().find(|f| !bundled.contains(f) && f.contains(' ') && f.chars().all(|c| c.is_ascii_alphanumeric() || c == ' '))
-    else {
+    // Families whose PDF name is their name without the spaces (as "TimesNewRoman"). The font
+    // isn't embedded, so the page draws a stand-in; text stays live only where the installed
+    // font's glyphs match it, as a plain sans-serif's do and a condensed display face's don't:
+    // which family that is depends on the machine's fonts, so the first of them to do is checked.
+    let candidates: Vec<&String> = installed
+        .iter()
+        .filter(|f| !bundled.contains(f) && f.contains(' ') && f.chars().all(|c| c.is_ascii_alphanumeric() || c == ' '))
+        .take(200)
+        .collect();
+    if candidates.is_empty() {
         eprintln!("no system fonts installed: nothing to check");
         return;
+    }
+    let import = |family: &str| {
+        let resources = format!("/Font << /F1 << /Type /Font /Subtype /TrueType /BaseFont /{} >> >>", family.replace(' ', ""));
+        let page = PdfPage { resources, ..PdfPage::new(100.0, 100.0, "BT /F1 12 Tf 10 30 Td (Hi) Tj ET") };
+        let r = import_with_report(&pdf_with(&[page], &[], None), &ImportOptions::default()).unwrap();
+        let mut families = vec![];
+        r.document.walk(|n| {
+            if let NodeKind::Text(t) = &n.kind {
+                families.extend(t.runs.iter().map(|r| r.style.font_family.clone()));
+            }
+        });
+        (families, r.warnings)
     };
-    let resources = format!("/Font << /F1 << /Type /Font /Subtype /TrueType /BaseFont /{} >> >>", family.replace(' ', ""));
-    let page = PdfPage { resources, ..PdfPage::new(100.0, 100.0, "BT /F1 12 Tf 10 30 Td (Hi) Tj ET") };
-    let r = import_with_report(&pdf_with(&[page], &[], None), &ImportOptions::default()).unwrap();
-    let mut families = vec![];
-    r.document.walk(|n| {
-        if let NodeKind::Text(t) = &n.kind {
-            families.extend(t.runs.iter().map(|r| r.style.font_family.clone()));
-        }
+    let found = candidates.iter().find_map(|family| {
+        let (families, warnings) = import(family);
+        (!families.is_empty()).then_some((family, families, warnings))
     });
-    assert_eq!(families, std::slice::from_ref(family));
-    assert!(!r.warnings.iter().any(|w| w.contains(family.as_str())), "{:?}", r.warnings);
+    let (family, families, warnings) = found.expect("one of the installed families stays live text");
+    assert_eq!(families, std::slice::from_ref(*family));
+    assert!(!warnings.iter().any(|w| w.contains(family.as_str())), "{warnings:?}");
 }

crates/render/src/lib.rs

@@ -85,7 +85,8 @@ pub struct RenderOptions {
     pub overprint_preview: bool,
     /// Trim View: clip the artwork to the artboards (nothing on the pasteboard is drawn).
     pub trim: bool,
-    /// Leave template layers out (exports and thumbnails: templates are guides, not artwork).
+    /// Leave template layers and guides out (exports and thumbnails: they're aids to drawing, not
+    /// artwork).
     pub skip_templates: bool,
     /// Pattern editing mode's tile edge and swatch bounds colour (Object → Pattern → Tile Edge
     /// Color), RGB.
@@ -725,9 +726,9 @@ impl Renderer {
         Some(p)
     }
 
-    /// Whether `a` is left out of this frame: hidden, a skipped template, or culled.
+    /// Whether `a` is left out of this frame: hidden, a skipped template or guide, or culled.
     fn skipped(&mut self, f: &Frame, a: &Arc<Node>) -> bool {
-        let skipped_template = f.opts.skip_templates && matches!(a.kind, NodeKind::Layer { template: true, .. });
+        let skipped_template = f.opts.skip_templates && matches!(a.kind, NodeKind::Layer { template: true, .. } | NodeKind::Path { guide: true, .. });
         if !a.visible || skipped_template || f.opts.hidden.contains(&a.id) {
             return true;
         }

crates/render/src/tests_layeropts.rs

@@ -66,3 +66,22 @@ fn dim_images_fades_only_the_images() {
     assert_eq!(img.pixel(25, 25), [255, 0, 0, 255], "vector art stays");
     assert_eq!(render(&d, true).pixel(65, 25), [255, 0, 0, 255], "exports are not dimmed");
 }
+
+/// A guide path draws on screen only: exports leave it out, as they leave templates out (and as
+/// the SVG, PSD and PDF exports and printing already do).
+#[test]
+fn guides_draw_on_screen_only() {
+    let mut d = Document::new(100.0, 100.0);
+    let l = d.layers[0].id;
+    let mut g = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(70.0, 70.0, 90.0, 90.0)), Appearance::default());
+    if let NodeKind::Path { guide, .. } = &mut g.kind {
+        *guide = true;
+    }
+    d.insert(Some(l), 0, g).unwrap();
+    let drawn = |export: bool| {
+        let r = render(&d, export);
+        (60..100).flat_map(|y| (60..100).map(move |x| (x, y))).filter(|&(x, y)| r.pixel(x, y) != [255, 255, 255, 255]).count()
+    };
+    assert!(drawn(false) > 0, "on screen the guide shows");
+    assert_eq!(drawn(true), 0, "exports leave it out");
+}

crates/testkit/src/ai.rs

@@ -0,0 +1,142 @@
+//! Hand-written Illustrator editing data (the format `vectorcraft_eps`'s reader documents) and the
+//! EPS and `.ai` files that carry it, for import tests. Nothing here comes from files another app
+//! wrote.
+
+/// Editing data of a `width` × `height` page: header comments (the art's bounding box and the crop
+/// marks are the page), `body` (setup and layers), the trailer.
+pub fn editing_data(width: f64, height: f64, body: &str) -> String {
+    format!(
+        "{PS_HEADER}\n%%Creator: VectorCraft tests\n%%BoundingBox: 0 0 {width} {height}\n%%HiResBoundingBox: 0 0 {width} {height}\n\
+         %AI5_FileFormat 14.0\n%AI3_Cropmarks: 0 0 {width} {height}\n%%EndComments\n\
+         %%BeginProlog\n%%EndProlog\n%%BeginSetup\n%%EndSetup\n{body}\n%%PageTrailer\ngsave annotatepage grestore showpage\n%%Trailer\n%%EOF\n"
+    )
+}
+
+/// The first line of a PostScript file (the DSC version comment).
+const PS_HEADER: &str = "%!PS-Adobe-3.0"; // brand-ok: the PostScript header comment
+/// The `PieceInfo` key the private data streams are under.
+const PIECE: &str = "Illustrator"; // brand-ok: the key the files use
+
+/// A layer named `name` (shown, unlocked, printing, light blue) holding `art`.
+pub fn layer(name: &str, art: &str) -> String {
+    format!("%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n({name}) Ln\n0 A\n0 Xw\n{art}\nLB\n%AI5_EndLayer--\n")
+}
+
+/// The path of the rectangle `x0 y0 x1 y1` (art space: y up).
+pub fn rect(x0: f64, y0: f64, x1: f64, y1: f64) -> String {
+    format!("{x0} {y0} m\n{x0} {y1} L\n{x1} {y1} L\n{x1} {y0} L\n{x0} {y0} L\n")
+}
+
+/// `name` given to the object before it (its XML id).
+pub fn named(name: &str) -> String {
+    format!("%_/ArtDictionary :\n%_/XMLUID : ({}) ; (AI10_ArtUID) ,\n%_;\n%_\n", name.replace(' ', "_"))
+}
+
+/// A document of 200 × 100 pt with a bit of everything the reader reads. A layer `Art` that shows:
+/// a group `Pair` (a red square `Red` and a hidden one), a compound path `Ring`, a clipping group
+/// `Window` (a grey square seen through a smaller one), what [`page_ps`] and [`page_pdf`] draw. A
+/// hidden layer `Hidden`: a radially shaded square `Shaded`, a screened square at half opacity, a
+/// locked sublayer `Sub`, and a 2 × 1 image with an alpha channel.
+pub fn sample_data() -> Vec<u8> {
+    let red = "0 1 1 0 1 0 0 Xa\n";
+    let gradient =
+        "%AI5_BeginGradient: (Glow)\n(Glow) 1 2 Bd\n[\n%_0 0 0 0 1 1 1 2 1 6 50 0 Bs\n%_0 0 0 1 0 0 0 2 0.5 6 50 100 Bs\nBD\n%AI5_EndGradient\n";
+    let group = format!(
+        "0 Ae\nu\n{red}{}f\n{}1 Xw\n0 0 1 0 0 0 1 XA\n2 w\n{}b\n0 Xw\nU\n{}9 () XW\n",
+        rect(10.0, 50.0, 40.0, 90.0),
+        named("Red"),
+        rect(50.0, 50.0, 80.0, 90.0),
+        named("Pair")
+    );
+    let compound = format!("0 Ae\n*u\n{red}1 XR\n{}f\n{}f\n*U\n{}", rect(100.0, 50.0, 140.0, 90.0), rect(110.0, 60.0, 130.0, 80.0), named("Ring"));
+    let clip =
+        format!("0 Ae\nq\n0.5 g\n{}f\n{}h\nW\nn\nQ\n{}9 () XW\n", rect(150.0, 50.0, 190.0, 90.0), rect(160.0, 60.0, 180.0, 80.0), named("Window"));
+    let shaded = format!(
+        "{}Bb\n1 (Glow) 0 0 0 1 1 0 0 1 0 0 1 Bg\n20 0 0 -20 30 25 Bm\nf\n0 BB\n{}2 0.5 0 0 0 Xy\n{red}{}f\n0 1 0 0 0 Xy\n",
+        rect(10.0, 5.0, 50.0, 45.0),
+        named("Shaded"),
+        rect(60.0, 5.0, 90.0, 45.0)
+    );
+    let sub = "%AI5_BeginLayer\n1 1 0 1 0 0 1 2 79 255 79 0 50 0 Lb\n(Sub) Ln\n0 g\n10 10 m\n30 30 L\nS\nLB\n%AI5_EndLayer--\n";
+    let mut image = b"%AI5_File:\n%AI5_BeginRaster\n() 1 XG\n/DeviceRGB XN\n\
+        [ 20 0 0 20 100 40 ] 2 1 0 Xh\n[ 20 0 0 20 100 40 ] 0 0 2 1 2 1 8 3 1 17 1 0 4 4 0 0\n%%BeginData: 10\rXI\n"
+        .to_vec();
+    image.extend_from_slice(&[255, 0, 0, 0, 0, 255, 255, 128]);
+    image.extend_from_slice(b"%%EndData\r\nXH\r\n%AI5_EndRaster\r\nN\r\n");
+    let head = format!(
+        "{gradient}{}%AI5_BeginLayer\n0 1 1 1 0 0 0 1 255 79 79 0 50 0 Lb\n(Hidden) Ln\n{shaded}{sub}",
+        layer("Art", &format!("{group}{compound}{clip}"))
+    );
+    let mut body = head.into_bytes();
+    body.extend_from_slice(&image);
+    body.extend_from_slice(b"LB\n%AI5_EndLayer--\n");
+    let mut data = editing_data(200.0, 100.0, "").into_bytes();
+    let at = data.windows(14).position(|w| w == b"%%PageTrailer\n").unwrap_or(data.len());
+    data.splice(at..at, body);
+    data
+}
+
+/// The sample's page in PostScript (what shows of it).
+pub fn page_ps() -> &'static str {
+    "1 0 0 setrgbcolor 10 50 30 40 rectfill\n\
+     newpath 100 50 moveto 140 50 lineto 140 90 lineto 100 90 lineto closepath 110 60 moveto 130 60 lineto 130 80 lineto 110 80 lineto closepath eofill\n\
+     0.5 setgray 160 60 20 20 rectfill\n"
+}
+
+/// The sample's page as PDF content (what shows of it).
+pub fn page_pdf() -> &'static str {
+    "1 0 0 rg 10 50 30 40 re f 100 50 40 40 re 110 60 20 20 re f* 0.5 g 160 60 20 20 re f"
+}
+
+/// An Illustrator EPS: its page drawing `page` (PostScript, 200 × 100 pt), and the editing data
+/// `data` after it, not compressed.
+pub fn eps(data: &[u8], page: &str) -> Vec<u8> {
+    let mut out = format!(
+        "{PS_HEADER} EPSF-3.0\n%%Creator: VectorCraft tests\n%%BoundingBox: 0 0 200 100\n%%HiResBoundingBox: 0 0 200 100\n%%EndComments\n{page}showpage\n%%EOF\n%AI9_PrivateDataBegin\n"
+    )
+    .into_bytes();
+    out.extend_from_slice(data);
+    out.extend_from_slice(b"\n%AI9_PrivateDataEnd\n");
+    out
+}
+
+/// An Illustrator `.ai` file: a 200 × 100 pt PDF page drawing `page` (PDF content), carrying
+/// `private` (the private data streams' contents, such as `%AI12_CompressedData` and zlib data) in
+/// two streams.
+pub fn ai(private: &[u8], page: &str) -> Vec<u8> {
+    let (first, second) = private.split_at(private.len() / 2);
+    let stream = |part: &[u8]| {
+        let mut s = format!("<< /Length {} >>\nstream\n", part.len()).into_bytes();
+        s.extend_from_slice(part);
+        s.extend_from_slice(b"\nendstream");
+        s
+    };
+    let objects: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R \
+             /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >> \
+             /PieceInfo << /{PIECE} << /Private << /AIPrivateData1 5 0 R /AIPrivateData2 6 0 R /NumBlock 2 >> >> >> >>"
+        )
+        .into_bytes(),
+        stream(page.as_bytes()),
+        stream(first),
+        stream(second),
+    ];
+    let mut out = b"%PDF-1.5\n".to_vec();
+    let mut offsets = vec![];
+    for (i, o) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend(format!("{} 0 obj\n", i + 1).bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).bytes());
+    for off in offsets {
+        out.extend(format!("{off:010} 00000 n \n").bytes());
+    }
+    out.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).bytes());
+    out
+}

crates/testkit/src/lib.rs

@@ -10,6 +10,7 @@
 //! - [`raster`]: rendering helpers and image comparison with a perceptual tolerance.
 //! - [`geom`]: geometry assertions (approximate equality, curve sampling, Hausdorff distance).
 //! - [`pdf`]: hand-written PDF files (page boxes, colour spaces, encryption) for import tests.
+//! - [`ai`]: hand-written Illustrator editing data, and the EPS and `.ai` files that carry it.
 //! - [`ase`]: hand-written swatch exchange (`.ase`) files for swatch library tests.
 //!
 //! This crate may only be used as a dev-dependency (enforced by `cargo xtask layers`).
@@ -19,6 +20,7 @@
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 #![forbid(unsafe_code)]
 
+pub mod ai;
 pub mod ase;
 pub mod fixtures;
 pub mod geom;

crates/text/src/fontdb.rs

@@ -773,16 +773,37 @@ fn enumerate_faces(data: &[u8]) -> Vec<(u32, FaceStyle)> {
         .collect()
 }
 
+/// The font files held by the file at `path`: its contents, or for a suitcase font the fonts in
+/// its resource fork ([`crate::suitcase`]). None when it can't be read.
+#[cfg(not(target_arch = "wasm32"))]
+fn font_files(path: &Path) -> Vec<Vec<u8>> {
+    if crate::suitcase::is_suitcase(path) {
+        return crate::suitcase::read_fonts(path);
+    }
+    std::fs::read(path).into_iter().collect()
+}
+
 /// The styles of every face in the font file at `path` ([`face_styles`]), reading only its table
 /// directories and `name` and `fvar` tables: a scan opens hundreds of font files, many of them
 /// megabytes long.
 #[cfg(not(target_arch = "wasm32"))]
 fn file_face_names(path: &Path) -> Vec<FaceStyle> {
-    use std::io::{Read, Seek, SeekFrom};
+    if crate::suitcase::is_suitcase(path) {
+        return crate::suitcase::read_fonts(path).into_iter().flat_map(|font| reader_face_names(std::io::Cursor::new(font))).collect();
+    }
+    match std::fs::File::open(path) {
+        Ok(file) => reader_face_names(file),
+        Err(_) => vec![],
+    }
+}
+
+/// [`file_face_names`] for the font file `file` reads.
+#[cfg(not(target_arch = "wasm32"))]
+fn reader_face_names(mut file: impl std::io::Read + std::io::Seek) -> Vec<FaceStyle> {
+    use std::io::SeekFrom;
     /// Caps on what a (possibly damaged) file can make the scan read.
     const MAX_FACES: u32 = 256;
     const MAX_NAME_TABLE: u32 = 1 << 20;
-    let Ok(mut file) = std::fs::File::open(path) else { return vec![] };
     let mut read_at = |offset: u64, len: usize| -> Option<Vec<u8>> {
         let mut buf = vec![0; len];
         file.seek(SeekFrom::Start(offset)).ok()?;
@@ -1328,9 +1349,10 @@ impl FontDb {
         }
         for (p, named) in files {
             // A file named by itself is a font whatever its name (font services keep fonts in
-            // files without an extension); one of a folder's only with a font's extension.
+            // files without an extension); one of a folder's only with a font's extension, or
+            // a suitcase font (whose fonts are in its resource fork, whatever its name).
             let ext = p.extension().and_then(|e| e.to_str()).map(|e| e.to_ascii_lowercase());
-            if !named && !matches!(ext.as_deref(), Some("ttf" | "otf" | "ttc" | "otc")) {
+            if !named && !matches!(ext.as_deref(), Some("ttf" | "otf" | "ttc" | "otc")) && !crate::suitcase::is_suitcase(&p) {
                 continue;
             }
             for FaceStyle { family, style, keys, weight, italic, traits, .. } in file_face_names(&p) {
@@ -1451,7 +1473,7 @@ impl FontDb {
         paths.dedup();
         let mut any = false;
         for p in paths {
-            if let Ok(data) = std::fs::read(&p) {
+            for data in font_files(&p) {
                 any |= self.add_font_from(data, Some(&p)) > 0;
             }
         }
@@ -1592,10 +1614,12 @@ impl FontDb {
             if std::fs::metadata(&p).map(|m| m.len() > 40 << 20).unwrap_or(true) {
                 continue;
             }
-            let Ok(data) = std::fs::read(&p) else { continue };
-            let hit = enumerate_faces(&data).iter().any(|(i, _)| skrifa::FontRef::from_index(&data, *i).is_ok_and(|f| f.charmap().map(c).is_some()));
-            if hit && self.add_font_from(data, Some(&p)) > 0 && covered(self) {
-                return true;
+            for data in font_files(&p) {
+                let hit =
+                    enumerate_faces(&data).iter().any(|(i, _)| skrifa::FontRef::from_index(&data, *i).is_ok_and(|f| f.charmap().map(c).is_some()));
+                if hit && self.add_font_from(data, Some(&p)) > 0 && covered(self) {
+                    return true;
+                }
             }
         }
         self.sys.lock().unwrap_or_else(|e| e.into_inner()).misses.insert(c);

crates/text/src/lib.rs

@@ -18,6 +18,8 @@ mod fontdb;
 pub mod hyphen;
 mod layout;
 mod shape;
+#[cfg(not(target_arch = "wasm32"))]
+mod suitcase;
 #[cfg(any(test, feature = "test-fonts"))]
 pub mod test_fonts;
 pub mod thread;

crates/text/src/suitcase.rs

@@ -0,0 +1,151 @@
+//! Suitcase fonts: classic Mac OS font files whose data fork is empty and whose fonts are `sfnt`
+//! resources in the resource fork (Microsoft Office installs its fonts this way in
+//! `/Library/Fonts/Microsoft`). macOS lists them as installed; a reader of the file's data finds
+//! nothing, so the scan reads the resource fork. The fork's layout is Apple's published resource
+//! file format (Inside Macintosh: More Macintosh Toolbox, "Resource Manager").
+
+use std::path::Path;
+
+/// Caps on what a (possibly damaged) fork can make the scan read.
+const MAX_FORK: u64 = 256 << 20;
+const MAX_TYPES: usize = 1 << 12;
+const MAX_FONTS: usize = 256;
+
+fn be16(b: &[u8], at: usize) -> Option<usize> {
+    b.get(at..at.checked_add(2)?).and_then(|s| s.try_into().ok()).map(|s| u16::from_be_bytes(s) as usize)
+}
+
+fn be32(b: &[u8], at: usize) -> Option<usize> {
+    b.get(at..at.checked_add(4)?).and_then(|s| s.try_into().ok()).map(|s| u32::from_be_bytes(s) as usize)
+}
+
+/// The font files (`sfnt` resources) of a resource fork, in the order its map lists them. A
+/// fork that isn't well formed gives the fonts read before the damage, or none.
+pub(crate) fn sfnt_resources(fork: &[u8]) -> Vec<&[u8]> {
+    let mut fonts = Vec::new();
+    let _ = collect(fork, &mut fonts);
+    fonts
+}
+
+fn collect<'a>(fork: &'a [u8], fonts: &mut Vec<&'a [u8]>) -> Option<()> {
+    // The header: where the data and the map start.
+    let data = be32(fork, 0)?;
+    let map = fork.get(be32(fork, 4)?..)?;
+    // The map: its type list starts at the offset kept 24 bytes in, and counts from the map.
+    let types = be16(map, 24)?;
+    // Counts are stored less one, so a list of none is 0xFFFF.
+    let n_types = (be16(map, types)? + 1) & 0xFFFF;
+    let mut total = 0usize;
+    for t in 0..n_types.min(MAX_TYPES) {
+        let at = types + 2 + t * 8;
+        if map.get(at..at + 4)? != b"sfnt" {
+            continue;
+        }
+        let count = (be16(map, at + 4)? + 1) & 0xFFFF;
+        // Each reference: its data's offset is the low three bytes of the word 4 bytes in.
+        let refs = types + be16(map, at + 6)?;
+        for r in 0..count {
+            let start = data.checked_add(be32(map, refs + r * 12 + 4)? & 0x00FF_FFFF)?;
+            let len = be32(fork, start)?;
+            // References can share data: cap the total too, as every font is copied out.
+            total = total.checked_add(len)?;
+            if fonts.len() >= MAX_FONTS || total as u64 > MAX_FORK {
+                return Some(());
+            }
+            fonts.push(fork.get(start + 4..start.checked_add(4)?.checked_add(len)?)?);
+        }
+    }
+    Some(())
+}
+
+/// The fonts of the suitcase font at `path`, read from its resource fork; none for a file
+/// without one, and off macOS, the only place such a fork is a part of a file.
+pub(crate) fn read_fonts(path: &Path) -> Vec<Vec<u8>> {
+    let Some(fork) = read_fork(path) else { return vec![] };
+    sfnt_resources(&fork).into_iter().map(<[u8]>::to_vec).collect()
+}
+
+/// Whether the file at `path` is a suitcase font: nothing in its data fork and something in its
+/// resource fork.
+pub(crate) fn is_suitcase(path: &Path) -> bool {
+    // Off macOS no file has a fork: don't look at every font file twice.
+    cfg!(target_os = "macos") && std::fs::metadata(path).is_ok_and(|m| m.is_file() && m.len() == 0) && fork_len(path) > 0
+}
+
+#[cfg(target_os = "macos")]
+fn fork_path(path: &Path) -> std::path::PathBuf {
+    path.join("..namedfork/rsrc")
+}
+
+#[cfg(target_os = "macos")]
+fn fork_len(path: &Path) -> u64 {
+    std::fs::metadata(fork_path(path)).map_or(0, |m| m.len())
+}
+
+#[cfg(target_os = "macos")]
+fn read_fork(path: &Path) -> Option<Vec<u8>> {
+    use std::io::Read;
+    let mut fork = Vec::new();
+    std::fs::File::open(fork_path(path)).ok()?.take(MAX_FORK).read_to_end(&mut fork).ok()?;
+    Some(fork)
+}
+
+#[cfg(not(target_os = "macos"))]
+fn fork_len(_: &Path) -> u64 {
+    0
+}
+
+#[cfg(not(target_os = "macos"))]
+fn read_fork(_: &Path) -> Option<Vec<u8>> {
+    let _ = MAX_FORK;
+    None
+}
+
+/// A resource fork holding `fonts` as `sfnt` resources and one other resource (a `vers`), as
+/// a font utility writes them.
+#[cfg(test)]
+pub(crate) fn fork_of(fonts: &[Vec<u8>]) -> Vec<u8> {
+    let mut data = Vec::new();
+    let mut offsets = Vec::new();
+    for body in fonts.iter().map(Vec::as_slice).chain([&b"1.0"[..]]) {
+        offsets.push(data.len() as u32);
+        data.extend_from_slice(&(body.len() as u32).to_be_bytes());
+        data.extend_from_slice(body);
+    }
+    let n = fonts.len();
+    // The type list: `vers` (1 resource) then `sfnt`, each entry pointing at its references.
+    let list = 2 + 2 * 8;
+    let mut types = Vec::new();
+    types.extend_from_slice(&1u16.to_be_bytes());
+    types.extend_from_slice(b"vers");
+    types.extend_from_slice(&0u16.to_be_bytes());
+    types.extend_from_slice(&(list as u16).to_be_bytes());
+    types.extend_from_slice(b"sfnt");
+    types.extend_from_slice(&((n - 1) as u16).to_be_bytes());
+    types.extend_from_slice(&((list + 12) as u16).to_be_bytes());
+    let reference = |id: i16, offset: u32| {
+        let mut r = Vec::new();
+        r.extend_from_slice(&id.to_be_bytes());
+        r.extend_from_slice(&0xFFFFu16.to_be_bytes());
+        r.extend_from_slice(&offset.to_be_bytes());
+        r.extend_from_slice(&[0; 4]);
+        r
+    };
+    types.extend(reference(1, offsets[n]));
+    for (i, o) in offsets[..n].iter().enumerate() {
+        types.extend(reference(5000 + i as i16, *o));
+    }
+    // The map: a copy of the header, a handle, attributes, then the offsets of the lists.
+    let mut map = vec![0; 24];
+    map.extend_from_slice(&28u16.to_be_bytes());
+    map.extend_from_slice(&((28 + types.len()) as u16).to_be_bytes());
+    map.extend(types);
+    let mut fork = Vec::new();
+    for v in [256u32, 256 + data.len() as u32, data.len() as u32, map.len() as u32] {
+        fork.extend_from_slice(&v.to_be_bytes());
+    }
+    fork.resize(256, 0);
+    fork.extend(data);
+    fork.extend(map);
+    fork
+}

crates/text/src/tests_sysfonts.rs

@@ -263,3 +263,42 @@ fn fonts_the_platform_lists_outside_the_font_folders_are_cataloged() {
     assert_eq!(db.styles("Service Sans3"), ["Regular"]);
     assert!(!FontDb::with_font_dirs(vec![file.parent().unwrap().to_path_buf()]).has_family("Service Sans3"));
 }
+
+#[test]
+fn a_resource_fork_gives_up_its_font_files() {
+    let (regular, bold) = (renamed("SourceSans3-Regular.ttf"), renamed("SourceSans3-Bold.ttf"));
+    let fork = crate::suitcase::fork_of(&[regular.clone(), bold.clone()]);
+    assert_eq!(crate::suitcase::sfnt_resources(&fork), [regular.as_slice(), bold.as_slice()]);
+    // Damage keeps what was read before it, and never panics.
+    for cut in [0, 3, 16, 300, fork.len() - 1] {
+        let _ = crate::suitcase::sfnt_resources(&fork[..cut]);
+    }
+    assert!(crate::suitcase::sfnt_resources(&[0xFF; 600]).is_empty());
+    // A fork can't make the scan read more than so many fonts.
+    assert_eq!(crate::suitcase::sfnt_resources(&crate::suitcase::fork_of(&vec![b"font".to_vec(); 300])).len(), 256);
+}
+
+/// Office's fonts: a file with nothing in it but a resource fork holding the fonts, named
+/// without an extension. Only macOS keeps a resource fork in a file.
+#[cfg(target_os = "macos")]
+#[test]
+fn the_scan_reads_suitcase_fonts() {
+    let dir = font_dir("suitcase");
+    std::fs::remove_file(dir.join("Sysfont-Regular.ttf")).unwrap();
+    std::fs::remove_file(dir.join("Sub/Sysfont-Bold.TTF")).unwrap();
+    let suitcase = dir.join("Sysfont Sans3");
+    std::fs::write(&suitcase, b"").unwrap();
+    std::fs::write(
+        suitcase.join("..namedfork/rsrc"),
+        crate::suitcase::fork_of(&[renamed("SourceSans3-Regular.ttf"), renamed("SourceSans3-Bold.ttf")]),
+    )
+    .unwrap();
+    // A file with nothing in either fork is no font.
+    std::fs::write(dir.join("empty"), b"").unwrap();
+    let db = FontDb::with_font_dirs(vec![dir.clone()]);
+    assert_eq!(db.styles(FAMILY), ["Regular", "Bold"]);
+    let bold = db.face(FAMILY, "Bold").unwrap();
+    assert_eq!((bold.family.as_str(), bold.style.as_str()), (FAMILY, "Bold"));
+    assert_eq!(bold.path(), Some(suitcase.as_path()));
+    assert_eq!(db.find_family("SysfontSans3").as_deref(), Some(FAMILY), "by a PostScript-style name, as an EPS names it");
+}

crates/tools/src/cropimage.rs

@@ -0,0 +1,343 @@
+//! Crop Image (#734): a crop box over the selected image. It starts on the part of the image over
+//! its artboard (the whole image when it lies inside one); its handles and its inside drag it,
+//! always within the image, and the part outside it is dimmed. Enter (or the Control bar's Apply)
+//! crops the image to it (`object.cropImage {rect}`), Escape (or Cancel) leaves it as it was; both
+//! go back to the Selection tool. The Control bar edits the box through the `rect` option.
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{Document, NodeId, NodeKind, Selection};
+use vectorcraft_geom::{Point, Rect, Vec2};
+
+use crate::bbox::{Handle, hit_handle};
+use crate::xform::CYAN;
+use crate::{Action, Cursor, Mods, Overlay, PointerEvent, PointerKind, Tool, ToolContext, ToolKey};
+
+/// The tool's id; Object › Crop Image and the image's Crop Image buttons choose it.
+pub const ID: &str = "cropImage";
+
+/// The smallest the box gets, in points.
+const MIN: f64 = 1.0;
+
+/// Create the Crop Image tool by id (None = not ours).
+pub fn create(id: &str) -> Option<Box<dyn Tool>> {
+    (id == ID).then(|| Box::new(CropImageTool::default()) as Box<dyn Tool>)
+}
+
+/// The selected image (the first image of the selection) and its bounds.
+pub fn selected_image(doc: &Document, sel: &Selection) -> Option<(NodeId, Rect)> {
+    sel.objects.iter().find_map(|id| {
+        let n = doc.node(*id)?;
+        matches!(n.kind, NodeKind::Image(_)).then_some(())?;
+        Some((*id, n.geometric_bounds()?))
+    })
+}
+
+/// Where the box starts for an image with bounds `image`: its part over the artboard its centre is
+/// on, or all of it when it lies inside that artboard or isn't on one.
+pub fn initial_box(doc: &Document, image: Rect) -> Rect {
+    doc.artboard_at(image.center())
+        .and_then(|i| doc.artboards.get(i))
+        .map(|a| a.rect.intersect(image))
+        .filter(|r| r.width() >= MIN && r.height() >= MIN)
+        .unwrap_or(image)
+}
+
+/// The selected image, its bounds and the box over it: `set` kept within the image, or where the
+/// box starts ([`initial_box`]).
+pub fn crop_box(doc: &Document, sel: &Selection, set: Option<Rect>) -> Option<(NodeId, Rect, Rect)> {
+    let (id, image) = selected_image(doc, sel)?;
+    Some((id, image, set.map_or_else(|| initial_box(doc, image), |r| within(r, image))))
+}
+
+/// `r` (moved whole) slid back within `image` without changing its size; `r` lies within `image`
+/// to begin with, so it fits.
+fn slid_within(r: Rect, image: Rect) -> Rect {
+    let x0 = r.x0.min(image.x1 - r.width()).max(image.x0);
+    let y0 = r.y0.min(image.y1 - r.height()).max(image.y0);
+    Rect::new(x0, y0, x0 + r.width(), y0 + r.height())
+}
+
+/// `r` cut to `image`, at least [`MIN`] wide and high.
+fn within(r: Rect, image: Rect) -> Rect {
+    let r = r.abs().intersect(image);
+    let w = r.width().max(MIN).min(image.width());
+    let h = r.height().max(MIN).min(image.height());
+    let x0 = r.x0.min(image.x1 - w).max(image.x0);
+    let y0 = r.y0.min(image.y1 - h).max(image.y0);
+    Rect::new(x0, y0, x0 + w, y0 + h)
+}
+
+#[derive(Clone, Copy)]
+enum Drag {
+    /// A handle, with the box as it was pressed.
+    Handle(Handle, Rect),
+    /// The box itself, from where it was pressed.
+    Move(Point, Rect),
+}
+
+#[derive(Default)]
+pub struct CropImageTool {
+    /// The box, for the image it was made for (None: set from outside, for the selected image);
+    /// None until it's dragged or set.
+    rect: Option<(Option<NodeId>, Rect)>,
+    drag: Option<Drag>,
+}
+
+impl CropImageTool {
+    /// The selected image, its bounds and the box over it.
+    fn current(&self, cx: &ToolContext) -> Option<(NodeId, Rect, Rect)> {
+        let (id, _) = selected_image(cx.doc, cx.selection)?;
+        let set = self.rect.filter(|(of, _)| of.is_none_or(|of| of == id)).map(|(_, r)| r);
+        crop_box(cx.doc, cx.selection, set)
+    }
+
+    /// Crop to the box and go back to the Selection tool (only back when it covers the image).
+    fn apply(&mut self, cx: &ToolContext) -> Vec<Action> {
+        let current = self.current(cx);
+        self.reset();
+        let mut out = vec![];
+        if let Some((_, image, r)) = current
+            && !same(r, image)
+        {
+            out.push(Action::Exec("object.cropImage".into(), json!({ "rect": [r.x0, r.y0, r.width(), r.height()] })));
+        }
+        out.push(Action::SwitchTool("selection".into()));
+        out
+    }
+
+    fn reset(&mut self) {
+        self.rect = None;
+        self.drag = None;
+    }
+}
+
+/// Whether two rectangles are the same to a thousandth of a point.
+fn same(a: Rect, b: Rect) -> bool {
+    [a.x0 - b.x0, a.y0 - b.y0, a.x1 - b.x1, a.y1 - b.y1].iter().all(|d| d.abs() < 1e-3)
+}
+
+/// The box `r` with the sides handle `h` holds moved to `p`.
+fn resized(r: Rect, h: Handle, p: Point) -> Rect {
+    let (mut x0, mut y0, mut x1, mut y1) = (r.x0, r.y0, r.x1, r.y1);
+    match h {
+        Handle::TopLeft | Handle::Left | Handle::BottomLeft => x0 = p.x.min(x1 - MIN),
+        Handle::TopRight | Handle::Right | Handle::BottomRight => x1 = p.x.max(x0 + MIN),
+        Handle::Top | Handle::Bottom => {}
+    }
+    match h {
+        Handle::TopLeft | Handle::Top | Handle::TopRight => y0 = p.y.min(y1 - MIN),
+        Handle::BottomLeft | Handle::Bottom | Handle::BottomRight => y1 = p.y.max(y0 + MIN),
+        Handle::Left | Handle::Right => {}
+    }
+    Rect::new(x0, y0, x1, y1)
+}
+
+impl Tool for CropImageTool {
+    fn id(&self) -> &'static str {
+        ID
+    }
+
+    fn busy(&self) -> bool {
+        self.drag.is_some()
+    }
+
+    fn pointer(&mut self, cx: &ToolContext, ev: &PointerEvent) -> Vec<Action> {
+        let Some((id, image, r)) = self.current(cx) else { return vec![] };
+        match ev.kind {
+            PointerKind::Down => {
+                self.drag = match hit_handle(r, ev.pos, cx.tol(5.0)) {
+                    Some(h) => Some(Drag::Handle(h, r)),
+                    None => r.contains(ev.pos).then_some(Drag::Move(ev.pos, r)),
+                };
+            }
+            PointerKind::Drag => {
+                let next = match self.drag {
+                    Some(Drag::Handle(h, from)) => within(resized(from, h, ev.pos), image),
+                    Some(Drag::Move(start, from)) => {
+                        let d: Vec2 = ev.pos - start;
+                        slid_within(from + d, image)
+                    }
+                    None => return vec![],
+                };
+                self.rect = Some((Some(id), next));
+            }
+            PointerKind::Up => self.drag = None,
+            PointerKind::DoubleClick => return self.apply(cx),
+            PointerKind::Move => {}
+        }
+        vec![]
+    }
+
+    fn key(&mut self, cx: &ToolContext, key: ToolKey, _mods: Mods) -> Vec<Action> {
+        match key {
+            ToolKey::Enter => self.apply(cx),
+            ToolKey::Escape => {
+                self.reset();
+                vec![Action::SwitchTool("selection".into())]
+            }
+            _ => vec![],
+        }
+    }
+
+    fn claims_key(&self, cx: &ToolContext, key: ToolKey) -> bool {
+        matches!(key, ToolKey::Enter | ToolKey::Escape) && self.current(cx).is_some()
+    }
+
+    fn overlays(&self, cx: &ToolContext) -> Vec<Overlay> {
+        let Some((_, image, r)) = self.current(cx) else { return vec![] };
+        let shade = [0, 0, 0, 110];
+        let quad = |x0: f64, y0: f64, x1: f64, y1: f64| [Point::new(x0, y0), Point::new(x1, y0), Point::new(x1, y1), Point::new(x0, y1)];
+        // The image outside the box, dimmed: above, below, then left and right of it.
+        let mut out: Vec<Overlay> = [
+            quad(image.x0, image.y0, image.x1, r.y0),
+            quad(image.x0, r.y1, image.x1, image.y1),
+            quad(image.x0, r.y0, r.x0, r.y1),
+            quad(r.x1, r.y0, image.x1, r.y1),
+        ]
+        .into_iter()
+        .filter(|q| (q[2].x - q[0].x) > 1e-9 && (q[2].y - q[0].y) > 1e-9)
+        .map(|quad| Overlay::Highlight { quad, color: shade })
+        .collect();
+        let corners = [Point::new(r.x0, r.y0), Point::new(r.x1, r.y0), Point::new(r.x1, r.y1), Point::new(r.x0, r.y1)];
+        out.extend(corners.iter().zip(corners.iter().cycle().skip(1)).map(|(a, b)| Overlay::Line { a: *a, b: *b, color: CYAN, dashed: false }));
+        out.extend(Handle::ALL.iter().map(|h| Overlay::Handle { p: h.pos(r), color: CYAN }));
+        out.push(Overlay::Label { p: Point::new(r.x0, r.y1), text: cx.size_label(r.width(), r.height()), color: CYAN });
+        out
+    }
+
+    fn cursor(&self, cx: &ToolContext, p: Point, _mods: Mods) -> Cursor {
+        let Some((_, _, r)) = self.current(cx) else { return Cursor::Arrow };
+        match hit_handle(r, p, cx.tol(5.0)) {
+            Some(Handle::Top | Handle::Bottom) => Cursor::ResizeV,
+            Some(Handle::Left | Handle::Right) => Cursor::ResizeH,
+            Some(Handle::TopLeft | Handle::BottomRight) => Cursor::ResizeNwSe,
+            Some(Handle::TopRight | Handle::BottomLeft) => Cursor::ResizeNeSw,
+            None if r.contains(p) => Cursor::Move,
+            None => Cursor::Arrow,
+        }
+    }
+
+    /// `rect`: the box as `[x, y, width, height]` once it's been dragged or set (until then it's
+    /// [`initial_box`]).
+    fn options(&self) -> Value {
+        match self.rect {
+            Some((_, r)) => json!({ "rect": [r.x0, r.y0, r.width(), r.height()] }),
+            None => json!({}),
+        }
+    }
+
+    /// `rect` `[x, y, width, height]` sets the box (kept within the selected image when used);
+    /// anything else puts it back where it starts.
+    fn set_option(&mut self, key: &str, value: &Value) {
+        if key != "rect" {
+            return;
+        }
+        let n: Vec<f64> = value.as_array().map(|v| v.iter().filter_map(Value::as_f64).filter(|n| n.is_finite()).collect()).unwrap_or_default();
+        self.rect = match n.as_slice() {
+            [x, y, w, h] => Some((None, Rect::new(*x, *y, x + w, y + h))),
+            _ => None,
+        };
+    }
+
+    fn deactivate(&mut self, _cx: &ToolContext) -> Vec<Action> {
+        self.reset();
+        vec![]
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use vectorcraft_doc::{ImageObject, Node};
+    use vectorcraft_geom::Affine;
+
+    use super::*;
+    use crate::testutil::{cx, paint};
+
+    /// A 500 × 500 document (one artboard) with a 100 × 50 px image drawn at twice that size from
+    /// `at`, selected.
+    fn doc_with_image(at: (f64, f64)) -> (Document, Selection) {
+        let mut d = Document::new(500.0, 500.0);
+        let l = d.layers[0].id;
+        let id = d.alloc_id();
+        let im = ImageObject {
+            key: "k".into(),
+            width: 100,
+            height: 50,
+            xf: Affine::translate(at) * Affine::scale(2.0),
+            link: None,
+            placement: Default::default(),
+        };
+        d.insert(Some(l), 0, Node::new(id, NodeKind::Image(im))).unwrap();
+        let mut s = Selection::default();
+        s.add(id);
+        (d, s)
+    }
+
+    fn drag(t: &mut CropImageTool, cx: &ToolContext, from: (f64, f64), to: (f64, f64)) {
+        for (kind, (x, y)) in [(PointerKind::Down, from), (PointerKind::Drag, to), (PointerKind::Up, to)] {
+            assert!(t.pointer(cx, &PointerEvent::new(kind, x, y)).is_empty());
+        }
+    }
+
+    fn crop_rect(acts: &[Action]) -> Option<Vec<f64>> {
+        acts.iter().find_map(|a| match a {
+            Action::Exec(c, v) if c == "object.cropImage" => Some(v["rect"].as_array()?.iter().filter_map(Value::as_f64).collect()),
+            _ => None,
+        })
+    }
+
+    #[test]
+    fn the_box_is_dragged_by_its_handles_and_inside_within_the_image() {
+        let (d, s) = doc_with_image((50.0, 60.0));
+        let p = paint();
+        let cx = cx(&d, &s, &p);
+        let mut t = CropImageTool::default();
+        // An image inside its artboard: the box starts on all of it, and Enter has nothing to cut.
+        assert_eq!(t.cursor(&cx, Point::new(50.0, 60.0), Mods::default()), Cursor::ResizeNwSe);
+        assert_eq!(t.cursor(&cx, Point::new(150.0, 110.0), Mods::default()), Cursor::Move);
+        assert!(t.claims_key(&cx, ToolKey::Enter));
+        // The top-left handle in, then the box dragged left past the image's edge: it stops there.
+        drag(&mut t, &cx, (50.0, 60.0), (80.0, 70.0));
+        assert_eq!(t.options()["rect"], json!([80.0, 70.0, 170.0, 90.0]));
+        drag(&mut t, &cx, (150.0, 110.0), (50.0, 110.0));
+        assert_eq!(t.options()["rect"], json!([50.0, 70.0, 170.0, 90.0]));
+        // A handle dragged past the opposite side leaves the box at least a point wide.
+        drag(&mut t, &cx, (220.0, 115.0), (0.0, 115.0));
+        assert_eq!(t.options()["rect"], json!([50.0, 70.0, 1.0, 90.0]));
+        drag(&mut t, &cx, (51.0, 115.0), (180.0, 115.0));
+        // The outside of the box is dimmed, the box drawn with its handles.
+        let ov = t.overlays(&cx);
+        assert_eq!(ov.iter().filter(|o| matches!(o, Overlay::Highlight { .. })).count(), 2, "above and right of the box");
+        assert_eq!(ov.iter().filter(|o| matches!(o, Overlay::Handle { .. })).count(), 8);
+        // Enter crops to it and goes back to the Selection tool.
+        let acts = t.key(&cx, ToolKey::Enter, Mods::default());
+        assert_eq!(crop_rect(&acts), Some(vec![50.0, 70.0, 130.0, 90.0]));
+        assert_eq!(acts.last(), Some(&Action::SwitchTool("selection".into())));
+        assert!(t.options().get("rect").is_none(), "the next crop starts afresh");
+        assert!(crop_rect(&t.key(&cx, ToolKey::Enter, Mods::default())).is_none(), "the whole image: nothing to cut");
+    }
+
+    #[test]
+    fn the_box_starts_on_the_part_over_the_artboard_and_escape_cancels() {
+        // 200 × 100 from (-50, 100): its left 50 pt hang off the artboard.
+        let (d, s) = doc_with_image((-50.0, 100.0));
+        let p = paint();
+        let cx = cx(&d, &s, &p);
+        let mut t = CropImageTool::default();
+        drag(&mut t, &cx, (100.0, 150.0), (110.0, 150.0));
+        assert_eq!(t.key(&cx, ToolKey::Escape, Mods::default()), vec![Action::SwitchTool("selection".into())]);
+        assert_eq!(crop_rect(&t.key(&cx, ToolKey::Enter, Mods::default())), Some(vec![0.0, 100.0, 150.0, 100.0]));
+        // The Control bar sets the box; it stays within the image.
+        t.set_option("rect", &json!([100, 120, 500, 20]));
+        assert_eq!(crop_rect(&t.key(&cx, ToolKey::Enter, Mods::default())), Some(vec![100.0, 120.0, 50.0, 20.0]));
+        // Nothing selected: no box, and the keys go elsewhere.
+        let none = Selection::default();
+        let cx = crate::testutil::cx(&d, &none, &p);
+        assert!(t.overlays(&cx).is_empty() && !t.claims_key(&cx, ToolKey::Enter));
+    }
+
+    #[test]
+    fn the_tool_is_made_by_its_id() {
+        assert_eq!(crate::create(ID).id(), ID);
+    }
+}

crates/tools/src/lib.rs

@@ -11,6 +11,7 @@ pub mod bbox;
 pub mod builder;
 pub mod catalog;
 pub mod corners;
+pub mod cropimage;
 pub mod cut;
 pub mod direct;
 pub mod distort;
@@ -431,6 +432,8 @@ pub enum Cursor {
     PenDelete,
     PenClose,
     PenContinue,
+    /// While drawing, over an end of another open path (a click joins the two).
+    PenJoin,
     /// Over the last anchor of the path being drawn (a click retracts its outgoing handle), or with
     /// Alt held over a selected path's handle or anchor (the Anchor Point tool's gesture).
     PenConvert,
@@ -517,6 +520,11 @@ pub trait Tool: Send {
     fn busy(&self) -> bool {
         false
     }
+    /// Is a drag moving, scaling or rotating the selection (the canvas then hides the bounding box,
+    /// so only the art is seen going with the pointer)?
+    fn transforming(&self) -> bool {
+        false
+    }
     /// Does the tool take `key` now, ahead of the command shortcuts bound to it (the Gradient tool
     /// with a stop selected takes Delete and the arrows)?
     fn claims_key(&self, _cx: &ToolContext, _key: ToolKey) -> bool {
@@ -586,6 +594,7 @@ pub fn create(id: &str) -> Box<dyn Tool> {
             .or_else(|| extra::create(other))
             .or_else(|| slice::create(other))
             .or_else(|| printtiling::create(other))
+            .or_else(|| cropimage::create(other))
             .or_else(|| cut::create(other))
             .unwrap_or_else(|| Box::new(NoopTool(tool_info(other).map(|t| t.id).unwrap_or("selection")))),
     }

crates/tools/src/pen.rs

@@ -11,8 +11,9 @@
 //! it a corner, dragging an anchor pulls out new symmetric handles and dragging a segment reshapes
 //! it. Cmd held lends the selection tool used last for a drag (the engine's
 //! `Session::pointer`); the path being drawn goes on afterwards while it stays selected.
-//! Enter/Esc (or switching tools) ends the path. Clicking the end of a selected open path continues
-//! it. The rubber-band preview shows the next segment (Enable Rubber Band for Pen Tool). Auto Add/Delete: between paths, a click on a
+//! Enter/Esc (or switching tools) ends the path. Clicking an end of an open path continues it
+//! (selecting it); while drawing, clicking an end of another open path joins the two into one
+//! (#776). The rubber-band preview shows the next segment (Enable Rubber Band for Pen Tool). Auto Add/Delete: between paths, a click on a
 //! segment of a selected path adds an anchor there and a click on one of its anchors deletes it
 //! (Shift held or General → Disable Auto Add/Delete starts a new path instead). On a selected
 //! blend's spine a click adds a point (on a point no key object sits on: deletes it).
@@ -80,6 +81,29 @@ fn active_path(cx: &ToolContext) -> Option<(NodeId, Point, Point, Point)> {
     Some((id, first, last.p, last.h_out))
 }
 
+/// An end of an open path (one subpath, not `except`) under `p`, within `tol`: the path the Pen
+/// continues or joins to, and whether it's the path's first anchor. Only paths that can be edited,
+/// not guides.
+fn open_end_at(cx: &ToolContext, p: Point, tol: f64, except: Option<NodeId>) -> Option<(NodeId, bool)> {
+    let id = vectorcraft_doc::hit::hit_test(cx.doc, p, cx.hit_options())?.leaf;
+    if Some(id) == except || !cx.doc.is_editable(id) {
+        return None;
+    }
+    let NodeKind::Path { path, guide: false, .. } = &cx.doc.node(id)?.kind else { return None };
+    let [sp] = path.subpaths.as_slice() else { return None };
+    if sp.closed {
+        return None;
+    }
+    let (first, last) = (sp.anchors.first()?.p, sp.anchors.last()?.p);
+    if p.distance(last) <= tol {
+        Some((id, false))
+    } else if p.distance(first) <= tol {
+        Some((id, true))
+    } else {
+        None
+    }
+}
+
 /// The last anchor of `id`'s last subpath: (subpath, anchor).
 fn last_anchor(cx: &ToolContext, id: NodeId) -> Option<(usize, usize)> {
     let pd = cx.doc.node(id)?.path_data()?;
@@ -160,6 +184,12 @@ impl Tool for PenTool {
                         self.handle = Some((id, si, ai, last));
                         return vec![Action::Begin("Convert Anchor Point".into()), set_out_handle(id, si, ai, last)];
                     }
+                    // An end of another open path: the two become one, and the path is finished.
+                    if let Some((other, at_first)) = open_end_at(cx, p, tol, Some(id)) {
+                        self.stop();
+                        let end = if at_first { "first" } else { "last" };
+                        return vec![Action::Exec("path.join".into(), json!({"ids": [id.0, other.0], "ends": ["last", end]}))];
+                    }
                     if let Some(acts) = self.alt_convert(cx, ev) {
                         return acts;
                     }
@@ -184,6 +214,15 @@ impl Tool for PenTool {
                     }
                     return vec![];
                 }
+                // Continue any other open path from the end clicked, selecting it.
+                if let Some((id, at_first)) = open_end_at(cx, p, tol, None) {
+                    (self.drawing, self.path) = (true, Some(id));
+                    let mut out = vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))];
+                    if at_first {
+                        out.push(Action::Exec("path.reverse".into(), json!({"ids": [id.0]})));
+                    }
+                    return out;
+                }
                 if let Some(act) = auto_add_delete(cx, ev.pos, ev.mods, tol) {
                     return vec![act];
                 }
@@ -306,6 +345,9 @@ impl Tool for PenTool {
             if p.distance(last) <= tol {
                 return Cursor::PenConvert;
             }
+            if open_end_at(cx, p, tol, Some(id)).is_some() {
+                return Cursor::PenJoin;
+            }
         }
         if alt_converts(cx, p, m) {
             return Cursor::PenConvert;
@@ -316,7 +358,9 @@ impl Tool for PenTool {
                 Some([_]) => return Cursor::PenAdd,
                 _ => {}
             }
-            if active_path(cx).is_some_and(|(_, first, last, _)| p.distance(last) <= tol || p.distance(first) <= tol) {
+            if active_path(cx).is_some_and(|(_, first, last, _)| p.distance(last) <= tol || p.distance(first) <= tol)
+                || open_end_at(cx, p, tol, None).is_some()
+            {
                 return Cursor::PenContinue;
             }
             match auto_add_delete(cx, p, m, tol) {

crates/tools/src/select.rs

@@ -73,9 +73,10 @@ pub struct SelectionTool {
     guide: GuideEdit,
 }
 
-/// Snapping for the selection moved as a whole, its targets gathered when the move begins: Smart
-/// Guides line its bounds up with the other art; with them off, View → Snap to Point lands the
-/// point it was grabbed by on an anchor or a ruler guide; Snap to Pixel puts its top-left on whole
+/// Snapping for the selection moved as a whole, its targets gathered when the move begins: View →
+/// Snap to Grid lands its bounds on the grid (#740), taking over from the rest; otherwise Smart
+/// Guides line its bounds up with the other art, and with them off, View → Snap to Point lands the
+/// point it was grabbed by on an anchor or a ruler guide. Snap to Pixel puts its top-left on whole
 /// pixels.
 pub(crate) struct MoveSnap {
     bounds: Option<Rect>,
@@ -87,14 +88,19 @@ impl MoveSnap {
     pub(crate) fn new(cx: &ToolContext) -> Self {
         Self {
             bounds: selection_bounds(cx),
-            targets: cx.smart_guides.then(|| Targets::for_move(cx)),
-            points: Targets::snap_to_point(cx, &cx.selection.objects),
+            targets: (cx.smart_guides && !cx.snap_to_grid).then(|| Targets::for_move(cx)),
+            points: if cx.snap_to_grid { None } else { Targets::snap_to_point(cx, &cx.selection.objects) },
         }
     }
 
     /// The move by `d` of the selection grabbed at `start`, snapped, and its guides.
     pub(crate) fn snap(&self, cx: &ToolContext, start: Point, mut d: Vec2) -> (Vec2, Vec<Overlay>) {
         let mut guides = vec![];
+        if cx.snap_to_grid
+            && let Some(b) = self.bounds
+        {
+            d += grid_pull(b + d, cx.grid_step());
+        }
         if let Some(t) = &self.points {
             let (q, ov) = t.snap_point(start + d, cx.tol(cx.snap_tolerance));
             d = q - start;
@@ -115,6 +121,15 @@ impl MoveSnap {
     }
 }
 
+/// The shift that lands `r` on the grid (a gridline every `step`), on each axis by whichever of its
+/// two edges and its centre is nearest a gridline, however far that is.
+fn grid_pull(r: Rect, step: f64) -> Vec2 {
+    let pull = |vs: [f64; 3]| {
+        vs.iter().map(|v| vectorcraft_geom::snap::snap_to_grid(*v, step, 0.0) - v).min_by(|a, b| a.abs().total_cmp(&b.abs())).unwrap_or(0.0)
+    };
+    Vec2::new(pull([r.x0, r.center().x, r.x1]), pull([r.y0, r.center().y, r.y1]))
+}
+
 pub fn matrix_json(a: Affine) -> Value {
     let c = a.as_coeffs();
     json!([c[0], c[1], c[2], c[3], c[4], c[5]])
@@ -163,6 +178,10 @@ impl Tool for SelectionTool {
         !matches!(self.state, State::Idle) || self.guide.busy()
     }
 
+    fn transforming(&self) -> bool {
+        matches!(self.state, State::Moving { began: true, .. } | State::Scaling { .. } | State::Rotating { .. })
+    }
+
     fn pointer(&mut self, cx: &ToolContext, ev: &PointerEvent) -> Vec<Action> {
         if let Some(out) = self.guide.pointer(cx, ev) {
             return out;
@@ -513,6 +532,32 @@ mod tests {
         assert_eq!(a, vec![Action::Commit]);
     }
 
+    /// #740: with Snap to Grid on, a moved object lands on the grid (every 9 pt by default) by
+    /// whichever of its edges or its centre is nearest a gridline, on each axis.
+    #[test]
+    fn a_move_lands_the_nearest_edge_or_centre_on_the_grid() {
+        let (d, id) = doc_with_rect();
+        let mut s = Selection::default();
+        s.add(id);
+        let p = paint();
+        let cx = ToolContext { snap_to_grid: true, smart_guides: true, ..cx(&d, &s, &p) };
+        let moved = |to: (f64, f64)| {
+            let mut t = SelectionTool::default();
+            t.pointer(&cx, &ev(PointerKind::Down, 150.0, 150.0));
+            let a = t.pointer(&cx, &ev(PointerKind::Drag, to.0, to.1));
+            match a.get(1) {
+                Some(Action::Preview(_, v)) => (v["matrix"][4].as_f64().unwrap(), v["matrix"][5].as_f64().unwrap()),
+                other => panic!("{other:?}"),
+            }
+        };
+        // Bounds 100–200 moved by (13, 4): the centres (163, 154) are nearest gridlines (162, 153).
+        let (x, y) = moved((163.0, 154.0));
+        assert!((x - 12.0).abs() < 1e-9 && (y - 3.0).abs() < 1e-9, "{x} {y}");
+        // Moved by (7, 0): the right edge is on a gridline (207) and the top goes up to one (99).
+        let (x, y) = moved((157.0, 150.0));
+        assert!((x - 7.0).abs() < 1e-9 && (y + 1.0).abs() < 1e-9, "{x} {y}");
+    }
+
     #[test]
     fn shift_drag_on_a_selected_object_moves_it_constrained() {
         let (d, id) = doc_with_rect();

crates/tools/src/settings.rs

@@ -34,7 +34,7 @@ const ROWS: &[Row] = &[
     (&["polygon"], None, &["sides"]),
     (&["star"], None, &["points"]),
     (&["freeTransform"], None, &["constrain"]),
-    (&["artboard"], None, &["moveArt"]),
+    (&["artboard"], None, &["moveArt", "scaleArt"]),
 ];
 
 /// The stores `tool`'s persistent options live in, each with the option keys it holds.

crates/tools/src/xform/artboard.rs

@@ -3,15 +3,16 @@
 //! Click an artboard to make it active (dashed bounds, 8 handles and its name). Drag inside moves
 //! it (with its artwork when the `moveArt` option is on, Shift constrains; Alt moves a copy and
 //! leaves the artboard where it was), drag a handle resizes it
-//! (Shift proportional, Alt from centre), drag on the pasteboard draws a new artboard, Delete removes
+//! (Shift proportional, Alt from centre; with the `scaleArt` option on, Scale Artwork with Artboard,
+//! always proportional, and the art fully inside scales with it), drag on the pasteboard draws a new artboard, Delete removes
 //! the active one (Copy, Cut and Paste take it with its art: `artboard.copy`) and Escape returns to
 //! the Selection tool. Moving and resizing snap like drawing
 //! does: to whole pixels, to the grid, or with Smart Guides to other artboards, their bleed and
-//! objects (never to the dragged artboard or the art moving with it); the artboard's own bleed edges
+//! objects (never to the dragged artboard or the art moving or scaling with it); the artboard's own bleed edges
 //! snap too. A new artboard's corners snap as drawn points do ([`DrawSnap`]).
 
 use serde_json::{Value, json};
-use vectorcraft_geom::{Point, Rect, Vec2};
+use vectorcraft_geom::{Affine, Point, Rect, Vec2};
 
 use super::{BLUE, polygon, rect_corners};
 use crate::bbox::{Handle, hit_handle, move_delta, scale_for_drag};
@@ -49,6 +50,9 @@ pub struct ArtboardTool {
     pub active: usize,
     /// Move artwork with the artboard.
     pub move_art: bool,
+    /// Scale artwork with the artboard: a resize takes the art fully inside it along, and keeps the
+    /// artboard's proportions.
+    pub scale_art: bool,
     drag: Option<Drag>,
     preview: Option<Rect>,
     /// Smart Guide targets, gathered when a move or resize starts.
@@ -63,7 +67,17 @@ pub struct ArtboardTool {
 
 impl Default for ArtboardTool {
     fn default() -> Self {
-        Self { active: 0, move_art: true, drag: None, preview: None, targets: None, copy_targets: None, guides: vec![], draw: DrawSnap::default() }
+        Self {
+            active: 0,
+            move_art: true,
+            scale_art: false,
+            drag: None,
+            preview: None,
+            targets: None,
+            copy_targets: None,
+            guides: vec![],
+            draw: DrawSnap::default(),
+        }
     }
 }
 
@@ -140,6 +154,20 @@ impl ArtboardTool {
     }
 }
 
+/// An artboard's shortest side (as `artboard.setProps` keeps it).
+const MIN_SIDE: f64 = 1.0;
+
+/// `r` grown about `anchor` until both sides are at least [`MIN_SIDE`], by one factor, so a
+/// proportional resize keeps its proportions where the command would lengthen only the short side.
+fn keep_min_side(r: Rect, anchor: Point) -> Rect {
+    let short = r.width().min(r.height());
+    if short >= MIN_SIDE || short <= 0.0 || !short.is_finite() {
+        return r;
+    }
+    let k = MIN_SIDE / short;
+    (Affine::translate(anchor.to_vec2()) * Affine::scale(k) * Affine::translate(-anchor.to_vec2())).transform_rect_bbox(r)
+}
+
 /// Where the bleed edge lies beyond a handle, along the axes the handle moves.
 fn bleed_offset(cx: &ToolContext, rect: Rect, handle: Handle) -> Vec2 {
     let d = handle.pos(cx.doc.setup.bleed_rect(rect)) - handle.pos(rect);
@@ -206,13 +234,21 @@ impl Tool for ArtboardTool {
                 let mut out = vec![];
                 if !began {
                     out.push(Action::Begin("Resize Artboard".into()));
-                    self.begin_snapping(cx, index, false);
+                    self.begin_snapping(cx, index, self.scale_art);
                 }
                 self.drag = Some(Drag::Resize { index, handle, rect, grab, began: true });
                 let h = self.snap_handle(cx, p + grab, bleed_offset(cx, rect, handle));
-                let nr = scale_for_drag(rect, handle, h, m.shift, m.alt).transform_rect_bbox(rect);
+                let proportional = m.shift || self.scale_art;
+                let mut nr = scale_for_drag(rect, handle, h, proportional, m.alt).transform_rect_bbox(rect);
+                if proportional {
+                    nr = keep_min_side(nr, if m.alt { rect.center() } else { handle.opposite().pos(rect) });
+                }
                 self.preview = Some(nr);
-                out.push(Action::Preview("artboard.setProps".into(), rect_json(index, nr)));
+                let mut v = rect_json(index, nr);
+                if self.scale_art {
+                    v["scaleArt"] = json!(true);
+                }
+                out.push(Action::Preview("artboard.setProps".into(), v));
                 out
             }
             (PointerKind::Drag, Some(Drag::Create { start, .. })) => {
@@ -338,13 +374,14 @@ impl Tool for ArtboardTool {
     }
 
     fn options(&self) -> Value {
-        json!({ "active": self.active, "moveArt": self.move_art })
+        json!({ "active": self.active, "moveArt": self.move_art, "scaleArt": self.scale_art })
     }
 
     fn set_option(&mut self, key: &str, value: &Value) {
         match key {
             "active" => self.active = value.as_u64().unwrap_or(0) as usize,
             "moveArt" => self.move_art = value.as_bool().unwrap_or(true),
+            "scaleArt" => self.scale_art = value.as_bool().unwrap_or(false),
             _ => {}
         }
     }
@@ -483,6 +520,49 @@ mod tests {
         assert_eq!(v["width"].as_f64(), Some(210.0));
     }
 
+    /// Scale Artwork with Artboard (#602): the resize asks for the art to scale, keeps the artboard's
+    /// proportions, and never snaps to the art scaling with it.
+    #[test]
+    fn scale_art_resizes_proportionally_without_snapping_to_its_art() {
+        let mut d = two_boards();
+        let l = d.layers[0].id;
+        let id = d.alloc_id();
+        let art = vectorcraft_geom::shapes::rectangle(Rect::new(700.0, 50.0, 710.0, 60.0));
+        d.insert(Some(l), 0, vectorcraft_doc::Node::path(id, art, vectorcraft_doc::Appearance::default_art())).unwrap();
+        let (s, p) = (Selection::default(), paint());
+        let c = cx(&d, &s, &p);
+        // Off: the right handle 3 pt past the art's right edge (710) lands on it; the height stays.
+        let mut t = ArtboardTool { active: 1, ..Default::default() };
+        t.pointer(&c, &ev(PointerKind::Down, 800.0, 100.0));
+        let v = preview_params(&t.pointer(&c, &ev(PointerKind::Drag, 713.0, 100.0)));
+        assert_eq!((v["width"].as_f64(), v["height"].as_f64(), v.get("scaleArt")), (Some(110.0), Some(200.0), None));
+        t.pointer(&c, &ev(PointerKind::Up, 713.0, 100.0));
+        // On: the art scales along, so it's no target, and the height follows the width.
+        t.set_option("scaleArt", &json!(true));
+        assert_eq!(t.options()["scaleArt"], true);
+        t.pointer(&c, &ev(PointerKind::Down, 800.0, 100.0));
+        let v = preview_params(&t.pointer(&c, &ev(PointerKind::Drag, 713.0, 100.0)));
+        assert_eq!((v["width"].as_f64(), v["scaleArt"].as_bool()), (Some(113.0), Some(true)));
+        assert!((v["height"].as_f64().unwrap() - 113.0).abs() < 1e-9);
+    }
+
+    /// A proportional resize never asks for a side under 1 pt, which the command would lengthen
+    /// alone (scaling the art unevenly): both sides grow by one factor instead.
+    #[test]
+    fn a_proportional_resize_keeps_its_proportions_at_the_smallest_size() {
+        let mut d = two_boards();
+        d.artboards[1].rect = Rect::new(600.0, 0.0, 800.0, 20.0);
+        let (s, p) = (Selection::default(), paint());
+        let mut c = cx(&d, &s, &p);
+        c.smart_guides = false;
+        let mut t = ArtboardTool { active: 1, scale_art: true, ..Default::default() };
+        // The right handle to 2.5 % of the width: 5 × 0.5, grown to 10 × 1 about the left middle.
+        t.pointer(&c, &ev(PointerKind::Down, 800.0, 10.0));
+        let v = preview_params(&t.pointer(&c, &ev(PointerKind::Drag, 605.0, 10.0)));
+        let got = ["x", "y", "width", "height"].map(|k| v[k].as_f64().unwrap());
+        assert!(got.iter().zip([600.0, 9.5, 10.0, 1.0]).all(|(a, b)| (a - b).abs() < 1e-9), "{got:?}");
+    }
+
     #[test]
     fn bleed_edges_snap_to_bleed_edges() {
         let mut d = two_boards();

crates/ui-egui/src/canvas.rs

@@ -483,7 +483,9 @@ fn cursor_icon(c: Cursor) -> egui::CursorIcon {
         Cursor::ResizeNwSe => C::ResizeNwSe,
         Cursor::ResizeNeSw => C::ResizeNeSw,
         Cursor::Rotate => C::Alias,
-        Cursor::Pen | Cursor::PenAdd | Cursor::PenDelete | Cursor::PenClose | Cursor::PenContinue | Cursor::PenConvert => C::Crosshair,
+        Cursor::Pen | Cursor::PenAdd | Cursor::PenDelete | Cursor::PenClose | Cursor::PenContinue | Cursor::PenJoin | Cursor::PenConvert => {
+            C::Crosshair
+        }
         Cursor::Text => C::Text,
         Cursor::Hand => C::Grab,
         Cursor::HandGrab => C::Grabbing,
@@ -1295,6 +1297,14 @@ fn panel_drop(app: &mut VectorcraftApp, ui: &Ui, resp: &egui::Response, xf: &Xf)
         return;
     }
     let Some(d) = resp.dnd_release_payload::<widgets::PanelDrag>() else { return };
+    // A Libraries panel graphic: a copy centred where it is dropped.
+    if let widgets::PanelDrag::LibraryGraphic { library, item } = &*d {
+        let at = xf.to_doc(pos);
+        if let Err(e) = app.run("library.use", json!({"library": library, "kind": "graphic", "item": item, "center": [at.x, at.y]})) {
+            app.status(e);
+        }
+        return;
+    }
     // A symbol from the Symbols panel: an instance centred where it is dropped, on art or not.
     if let widgets::PanelDrag::Symbol(name) = &*d {
         let at = xf.to_doc(pos);
@@ -1333,7 +1343,7 @@ fn panel_drop(app: &mut VectorcraftApp, ui: &Ui, resp: &egui::Response, xf: &Xf)
         }
         // Art dragged back onto the canvas: its move was already dropped. (A symbol was placed
         // above.)
-        widgets::PanelDrag::Art(_) | widgets::PanelDrag::Symbol(_) => return,
+        widgets::PanelDrag::Art(_) | widgets::PanelDrag::Symbol(_) | widgets::PanelDrag::LibraryGraphic { .. } => return,
     };
     if let Err(e) = app.run(cmd, params) {
         app.status(e);
@@ -1541,8 +1551,10 @@ fn print_tiling_overlay(app: &mut VectorcraftApp, p: &egui::Painter, xf: &Xf) {
 const PRINT_TILING: Color32 = Color32::from_gray(96);
 
 fn selection_overlay(app: &mut VectorcraftApp, p: &egui::Painter, xf: &Xf) {
-    // The Selection tool's bounding box (rotated with the objects after a rotation).
+    // The Selection tool's bounding box (rotated with the objects after a rotation). It hides while
+    // a drag moves or resizes the selection, so only the art is seen going with the pointer (#712).
     let show_box = app.session.tool_id() == "selection"
+        && !app.session.tool_transforming()
         && app.ui.view.bounding_box
         && app.session.active().is_some_and(|st| !st.selection.is_empty() && st.selection.anchors.is_empty());
     let bbox = if show_box { app.selection_box() } else { None };

crates/ui-egui/src/chrome.rs

@@ -323,26 +323,55 @@ fn tab_title(d: &vectorcraft_engine::DocState, zoom: f64, outline: bool) -> Stri
 /// Linux and the web).
 const CLOSE_BEFORE_TITLE: bool = cfg!(target_os = "macos");
 
+/// The first of tabs `widths` wide that the strip shows in `room`: the first one, or a later one so
+/// that the `active` tab fits.
+fn first_tab_shown(widths: &[f32], active: Option<usize>, room: f32) -> usize {
+    let Some(a) = active else { return 0 };
+    let mut first = 0;
+    while first < a && widths.get(first..=a).map_or(0.0, |w| w.iter().sum::<f32>()) > room {
+        first += 1;
+    }
+    first
+}
+
 /// Document tab strip: "Name* @ 66.67% (RGB/Preview)". User Interface › Large Tabs makes the tabs
-/// taller, with larger titles.
+/// taller, with larger titles. Tabs that don't fit are reached from a » button at the strip's
+/// right end, which lists every open document, and the active tab is always in view (#746).
 pub fn doc_tabs(app: &mut VectorcraftApp, ui: &mut Ui) {
+    /// The width of the » button.
+    const MORE: f32 = 30.0;
     let t = Tokens::get(ui.ctx());
     let (height, title_size) = if app.session.prefs.large_tabs { (44.0, 14.0) } else { (35.0, 12.5) };
     let (strip, _) = ui.allocate_exact_size(vec2(ui.available_width(), height), Sense::hover());
     ui.painter().rect_filled(strip, 0.0, t.tab_strip);
     ui.painter().line_segment([strip.left_bottom(), strip.right_bottom()], Stroke::new(1.0, t.border));
+    // On the Home screen no tab is the current one.
+    let active = app.session.active_index().filter(|_| app.ui.home.is_none());
+    let tabs: Vec<(String, std::sync::Arc<egui::Galley>)> = app
+        .session
+        .documents()
+        .iter()
+        .enumerate()
+        .map(|(i, d)| {
+            let zoom = app.views.get(i).map(|v| v.zoom).unwrap_or(1.0);
+            let title = tab_title(d, zoom, app.ui.view.outline);
+            let color = if Some(i) == active { t.text_strong } else { t.text_dim };
+            (title.clone(), ui.painter().layout_no_wrap(title, theme::semibold(title_size), color))
+        })
+        .collect();
+    let widths: Vec<f32> = tabs.iter().map(|(_, g)| g.size().x + 50.0).collect();
+    let overflow = widths.iter().sum::<f32>() > strip.width();
+    let room = strip.width() - if overflow { MORE } else { 0.0 };
+    let first = if overflow { first_tab_shown(&widths, active, room) } else { 0 };
     let mut x = strip.left();
     let mut activate = None;
     let mut close = None;
-    let active = app.session.active_index();
-    for (i, d) in app.session.documents().iter().enumerate() {
-        let zoom = app.views.get(i).map(|v| v.zoom).unwrap_or(1.0);
-        let title = tab_title(d, zoom, app.ui.view.outline);
-        // On the Home screen no tab is the current one.
-        let is_active = Some(i) == active && app.ui.home.is_none();
-        let galley = ui.painter().layout_no_wrap(title, theme::semibold(title_size), if is_active { t.text_strong } else { t.text_dim });
-        let w = galley.size().x + 50.0;
-        let r = egui::Rect::from_min_size(egui::pos2(x, strip.top()), vec2(w, strip.height() - 1.0));
+    for (i, ((_, galley), w)) in tabs.iter().zip(&widths).enumerate().skip(first) {
+        if x + w > strip.left() + room && Some(i) != active {
+            break;
+        }
+        let is_active = Some(i) == active;
+        let r = egui::Rect::from_min_size(egui::pos2(x, strip.top()), vec2(*w, strip.height() - 1.0));
         let resp = ui.interact(r, ui.id().with(("tab", i)), Sense::click());
         if is_active {
             ui.painter().rect_filled(r, 0.0, t.panel);
@@ -356,7 +385,7 @@ pub fn doc_tabs(app: &mut VectorcraftApp, ui: &mut Ui) {
         let xr = egui::Rect::from_center_size(egui::pos2(x_center, r.center().y), vec2(12.0, 12.0));
         let xresp = ui.interact(xr.expand(3.0), ui.id().with(("tabx", i)), Sense::click());
         icons::paint(ui, "x", xr, if xresp.hovered() { t.text_strong } else { t.text });
-        ui.painter().galley(egui::pos2(title_left, r.center().y - galley.size().y / 2.0), galley, t.text);
+        ui.painter().galley(egui::pos2(title_left, r.center().y - galley.size().y / 2.0), galley.clone(), t.text);
         if xresp.clicked() {
             close = Some(i);
         } else if resp.clicked() {
@@ -364,6 +393,22 @@ pub fn doc_tabs(app: &mut VectorcraftApp, ui: &mut Ui) {
         }
         x += w;
     }
+    // The » button: every open document, the active one checked.
+    if overflow {
+        let more = egui::Rect::from_min_max(egui::pos2(strip.right() - MORE, strip.top()), egui::pos2(strip.right(), strip.bottom() - 1.0));
+        let resp = ui.interact(more, ui.id().with("tabs-more"), Sense::click());
+        ui.painter().rect_filled(more, 0.0, if resp.hovered() { t.hover.gamma_multiply(0.4) } else { t.tab_strip });
+        icons::paint(ui, "chevrons-right", egui::Rect::from_center_size(more.center(), vec2(14.0, 14.0)), t.text);
+        let resp = resp.on_hover_text(tl!("Show all open documents"));
+        egui::Popup::menu(&resp).show(|ui| {
+            for (i, (title, _)) in tabs.iter().enumerate() {
+                if widgets::menu_item_name(ui, title, true, Some(i) == active) {
+                    activate = Some(i);
+                    ui.close();
+                }
+            }
+        });
+    }
     if let Some(i) = close {
         if let Err(e) = crate::unsaved::close(app, i) {
             app.status(e);
@@ -764,6 +809,16 @@ pub fn hint_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
 
 #[cfg(test)]
 mod tests {
+
+    /// With more tabs than fit, the strip starts late enough to show the active one (#746).
+    #[test]
+    fn the_active_tab_stays_in_view() {
+        let widths = [100.0; 10];
+        assert_eq!(super::first_tab_shown(&widths, Some(2), 350.0), 0, "it fits from the start");
+        assert_eq!(super::first_tab_shown(&widths, Some(9), 350.0), 7, "the last three tabs shown");
+        assert_eq!(super::first_tab_shown(&widths, None, 350.0), 0);
+        assert_eq!(super::first_tab_shown(&widths, Some(4), 50.0), 4, "a tab wider than the room still shows");
+    }
     use serde_json::json;
     use vectorcraft_engine::Session;
 

crates/ui-egui/src/cursors.rs

@@ -84,6 +84,12 @@ fn pen(p: &mut Ink, o: Pos2, badge: &str) {
         }
         "-" => line(p, b + vec2(0.0, 3.0), b + vec2(6.0, 3.0)),
         "/" => line(p, b + vec2(0.0, 6.0), b + vec2(5.0, 0.0)),
+        // Join: a segment running into a square end point.
+        "j" => {
+            line(p, b + vec2(0.0, 6.0), b + vec2(3.5, 2.5));
+            let sq = [(3.0, -1.0), (7.0, -1.0), (7.0, 3.0), (3.0, 3.0)].map(|(x, y)| b + vec2(x, y));
+            poly(p, sq.to_vec(), INK, INK);
+        }
         "^" => {
             line(p, b + vec2(0.0, 6.0), b + vec2(3.0, 0.0));
             line(p, b + vec2(3.0, 0.0), b + vec2(6.0, 6.0));
@@ -270,6 +276,7 @@ fn glyph(c: Cursor, p: Pos2) -> Option<Vec<Shape>> {
         Cursor::PenDelete => pen(ink, p, "-"),
         Cursor::PenClose => pen(ink, p, "o"),
         Cursor::PenContinue => pen(ink, p, "/"),
+        Cursor::PenJoin => pen(ink, p, "j"),
         Cursor::PenConvert => pen(ink, p, "^"),
         Cursor::Text => ibeam(ink, p),
         Cursor::AddStop => stop_badge(ink, p, true),
@@ -425,7 +432,7 @@ mod tests {
     use crate::VectorcraftApp;
 
     /// Every cursor with a glyph.
-    const GLYPHS: [Cursor; 32] = [
+    const GLYPHS: [Cursor; 33] = [
         Cursor::Arrow,
         Cursor::ArrowHollow,
         Cursor::Move,
@@ -441,6 +448,7 @@ mod tests {
         Cursor::PenDelete,
         Cursor::PenClose,
         Cursor::PenContinue,
+        Cursor::PenJoin,
         Cursor::PenConvert,
         Cursor::Text,
         Cursor::Eyedropper,

crates/ui-egui/src/dialogs/save_options.rs

@@ -330,7 +330,8 @@ mod tests {
     #[test]
     fn save_a_copy_and_template_suggest_their_names() {
         let (mut app, written, picks) = desktop("copy.vectorcraft");
-        app.session.prefs.templates_folder = "/templates".into();
+        let folder = vectorcraft_testkit::temp_dir("save-template-dialog");
+        app.session.prefs.templates_folder = folder.to_string_lossy().into_owned();
         app.run("file.saveCopy", json!({})).unwrap();
         assert_eq!(picks.borrow()[0].name, "Untitled-1 copy.vectorcraft");
         assert!(app.ui.dialog.is_none(), "the native format has no options");
@@ -338,7 +339,8 @@ mod tests {
         assert!(app.session.active().unwrap().path.is_none() && app.session.active().unwrap().is_dirty());
         app.run("file.saveAsTemplate", json!({})).unwrap();
         let pick = &picks.borrow()[1];
-        assert_eq!((pick.name.as_str(), pick.folder.as_deref()), ("Untitled-1 template.vctemplate", Some("/templates")));
+        assert_eq!(pick.name, "Untitled-1 template.vctemplate");
+        assert_eq!(pick.folder.as_deref().map(std::path::Path::new), Some(folder.as_path()));
         assert_eq!(pick.filters, [("VectorCraft Template", &["vctemplate"][..])]);
         assert_eq!(written.borrow()[1].0, "copy.vectorcraft", "the picked name is kept");
     }

crates/ui-egui/src/floating.rs

@@ -129,7 +129,7 @@ pub fn float(ui: &mut UiState, ids: &[&str], active: &str, pos: Pos2) {
     }
     let panels: Vec<String> = ids.iter().map(|id| id.to_string()).collect();
     let active = panels.iter().position(|p| p == active).unwrap_or(0);
-    ui.floating_panels.push(FloatingPanels { panels, active, pos: [pos.x, pos.y] });
+    ui.floating_panels.push(FloatingPanels { panels, active, pos: [pos.x, pos.y], width: None });
     // The tabbed group shows another of its tabs when the one it showed floats.
     if let Some(tab) = shown_tab(ui) {
         ui.dock_tab = tab;
@@ -312,6 +312,7 @@ pub fn show(app: &mut VectorcraftApp, ctx: &egui::Context) {
         let ids = ids_of(g);
         let Some(&first) = ids.first() else { continue };
         let active = ids.get(g.active).copied().unwrap_or(first);
+        let given = g.width.map(|w| w.min(screen.width() - 16.0));
         let area = area_id(first);
         let size = ctx.memory(|m| m.area_rect(area)).map_or(vec2(dock::panel_width(active), 200.0), |r| r.size());
         let pos = clamp(g.pos, size, screen);
@@ -333,7 +334,7 @@ pub fn show(app: &mut VectorcraftApp, ctx: &egui::Context) {
                     })
                     .collect();
                 let tabs_width: f32 = tabs.iter().map(|g| g.size().x + 24.0).sum();
-                let width = ids.iter().map(|id| dock::panel_width(id)).fold(tabs_width + 32.0, f32::max);
+                let width = ids.iter().map(|id| dock::panel_width(id)).fold(tabs_width + 32.0, f32::max).max(given.unwrap_or(0.0));
                 ui.set_width(width);
                 // Title bar: a grip that moves the group, and the × that docks it.
                 let (bar, _) = ui.allocate_exact_size(vec2(width, TITLE), Sense::hover());
@@ -763,7 +764,7 @@ mod tests {
         }))
         .unwrap();
         let edited = edited.sanitized();
-        assert_eq!(edited.floating_panels, [FloatingPanels { panels: vec!["layers".into()], active: 0, pos: [1.0, 2.0] }]);
+        assert_eq!(edited.floating_panels, [FloatingPanels { panels: vec!["layers".into()], active: 0, pos: [1.0, 2.0], width: None }]);
         h.settle();
         let g = h.group("layers");
         let screen = Rect::from_min_size(Pos2::ZERO, SCREEN);

crates/ui-egui/src/i18n/cs.tsv

@@ -285,6 +285,8 @@
 	Fill with Placeholder Text	Vyplnit zástupným textem
 	Insert Inline Symbol	Vložit symbol do textu
 	Show Hidden Characters	Zobrazit skryté znaky
+	Bold	Tučné
+	Italic	Kurzíva
 	Hide Hidden Characters	Skrýt skryté znaky
 	Type Orientation	Orientace textu
 	Horizontal	Vodorovně

crates/ui-egui/src/i18n/es.tsv

@@ -161,6 +161,7 @@
 	Appearance panel	Panel Apariencia
 	Applies when the linked file is relinked or updated.	Se aplica al volver a vincular o actualizar el archivo vinculado.
 	Applies the next time VectorCraft starts.	Se aplica la próxima vez que se inicie VectorCraft.
+	Apply	Aplicar
 	Apply Brush	Aplicar pincel
 	Apply Character Style	Aplicar estilo de carácter
 	Apply Effect	Aplicar efecto
@@ -339,6 +340,8 @@
 	Clean Up…	Limpiar…
 	Clear	Borrar
 	Clear All Tabs	Borrar todas las tabulaciones
+	Above Text	Sobre el texto
+	Position Panel Above Text	Colocar el panel sobre el texto
 	Clear Appearance	Borrar apariencia
 	Clear Guides	Borrar guías
 	Clear Overrides	Borrar modificaciones
@@ -1989,6 +1992,7 @@
 	Arrange by Row	Organizar en una fila
 	Arrange by Column	Organizar en una columna
 	Move Artwork with Artboard	Mover la ilustración con la mesa de trabajo
+	Scale Artwork with Artboard	Escalar la ilustración con la mesa de trabajo
 	Artboards: {n}	Mesas de trabajo: {n}
 	Rearrange All Artboards…	Reorganizar todas las mesas de trabajo…
 	Recall Selection	Recuperar selección
@@ -2444,6 +2448,8 @@
 	Show Guides	Mostrar guías
 	Show handles when multiple anchors are selected	Mostrar manejadores al seleccionar varias anclas
 	Show Hidden Characters	Mostrar caracteres ocultos
+	Bold	Negrita
+	Italic	Cursiva
 	Show Images in Outline Mode	Mostrar imágenes en modo de contorno
 	Show in Folder	Mostrar en carpeta
 	Show Indic Options	Mostrar opciones índicas
@@ -2643,6 +2649,25 @@
 	Swatch Tiles	Mosaicos de muestras
 	Swatches	Muestras
 	Switch workspace	Cambiar espacio de trabajo
+	Add Content	Añadir contenido
+	Click to apply to the selected type	Haz clic para aplicarlo al texto seleccionado
+	Create New Library	Crear nueva biblioteca
+	Create New Library…	Crear nueva biblioteca…
+	Rename Library…	Cambiar nombre de la biblioteca…
+	Delete the library “{name}”?	¿Eliminar la biblioteca “{name}”?
+	Drag art or swatches here, or use + to add the selection's colors and text styles.	Arrastra aquí ilustraciones o muestras, o usa + para añadir los colores y estilos de texto de la selección.
+	Its graphics, colors and text styles are deleted from this machine.	Sus gráficos, colores y estilos de texto se eliminan de este equipo.
+	Keep graphics, colors and text styles here to use them in any document. Libraries are stored on this machine — no account required.	Guarda aquí gráficos, colores y estilos de texto para usarlos en cualquier documento. Las bibliotecas se guardan en este equipo; no hace falta una cuenta.
+	This library is empty	Esta biblioteca está vacía
+	Add to Library	Añadir a la biblioteca
+	Delete Library	Eliminar biblioteca
+	Delete Library Item	Eliminar elemento de la biblioteca
+	Library	Biblioteca
+	Rename Library	Cambiar nombre de la biblioteca
+	Show Library	Mostrar biblioteca
+	Use Library Item	Usar elemento de la biblioteca
+	Graphic	Gráfico
+	Show all open documents	Mostrar todos los documentos abiertos
 	Symbol Instance	Instancia de símbolo
 	Symbol Libraries	Bibliotecas de símbolos
 	Symbol Libraries (on the roadmap)	Bibliotecas de símbolos (en la hoja de ruta)
@@ -3124,6 +3149,9 @@ axis	Both	Ambos
 # stays English for agents and tests. `{_1}`, `{_2}` … stand for the `{}` of the format string, in order
 # (`complete_languages_translate_every_message` lists any that are missing). Command ids, parameter
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
+@msg	no library `{id}`	no hay ninguna biblioteca `{id}`
+@msg	select some type first	selecciona primero algún texto
+@msg	{_1} has no {_2} style	{_1} no tiene el estilo {_2}
 @msg	a layer couldn't be read	no se pudo leer una capa
 @msg	it has more than one artboard	tiene más de una mesa de trabajo
 @msg	it has no page	no tiene página
@@ -3660,6 +3688,23 @@ axis	Both	Ambos
 @msg	x and y must both be numbers	x e y deben ser números
 @msg	"{0}" is not a colour: write it as #rrggbb	"{0}" no es un color: escríbelo como #rrggbb
 @msg	this isn't a flat-colour logo ({_1}% of its solid areas match a few flat colours), so Flat Logo mode would turn its gradients into patches: use Color mode instead	esto no es un logotipo de colores planos ({_1}% de sus zonas sólidas coinciden con unos pocos colores planos), así que el modo Logotipo plano convertiría sus degradados en manchas: usa el modo Color
+@msg	`{what}` closes nothing	`{what}` no cierra nada
+@msg	`{what}` closes something it didn't open	`{what}` cierra algo que no abrió
+@msg	a path has too many points	un trazado tiene demasiados puntos
+@msg	it ends inside a layer	terminan dentro de una capa
+@msg	it has art outside its layers	tienen ilustraciones fuera de sus capas
+@msg	it has more than {MAX_NODES} objects	tienen más de {MAX_NODES} objetos
+@msg	it has no layers	no tienen capas
+@msg	it has too many values in a row	tienen demasiados valores seguidos
+@msg	it has {_1}, which VectorCraft doesn't read from it yet	tienen {_1}, que VectorCraft aún no lee de ellos
+@msg	its objects are nested too deeply	sus objetos están anidados a demasiada profundidad
+@msg	its section ending with `%{end}` doesn't end	su sección que termina con `%{end}` no termina
+@msg	objects with several fills or strokes, effects or brushes came in as their drawn look ({_1}): their appearance isn't editable yet	los objetos con varios rellenos o trazos, efectos o pinceles se importaron con su aspecto dibujado ({_1}): su aspecto aún no se puede editar
+@msg	gradient “{name}” isn't defined in the file: a plain colour stands in for it	el degradado “{name}” no está definido en el archivo: lo sustituye un color sólido
+@msg	an image VectorCraft can't read was left out	se omitió una imagen que VectorCraft no puede leer
+@msg	an image whose data is cut short was left out	se omitió una imagen con datos incompletos
+@msg	its editing data doesn't say where its art is	sus datos de edición no dicen dónde está su ilustración
+@msg	this file was saved without PDF compatibility, and its editing data can't be read ({why})	este archivo se guardó sin compatibilidad con PDF y sus datos de edición no se pueden leer ({why})
 
 # The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
 	Services	Servicios

crates/ui-egui/src/i18n/fr.tsv

@@ -162,6 +162,7 @@
 	Appearance panel	Panneau Aspect
 	Applies when the linked file is relinked or updated.	S’applique lorsque le fichier lié est de nouveau lié ou mis à jour.
 	Applies the next time VectorCraft starts.	S’applique au prochain démarrage de VectorCraft.
+	Apply	Appliquer
 	Apply Brush	Appliquer la forme
 	Apply Character Style	Appliquer le style de caractère
 	Apply Effect	Appliquer l’effet
@@ -340,6 +341,8 @@
 	Clean Up…	Nettoyer…
 	Clear	Effacer
 	Clear All Tabs	Effacer toutes les tabulations
+	Above Text	Au-dessus du texte
+	Position Panel Above Text	Placer le panneau au-dessus du texte
 	Clear Appearance	Effacer l’aspect
 	Clear Guides	Effacer les repères
 	Clear Overrides	Effacer les remplacements
@@ -1986,6 +1989,7 @@
 	Arrange by Row	Disposer en ligne
 	Arrange by Column	Disposer en colonne
 	Move Artwork with Artboard	Déplacer l’illustration avec le plan de travail
+	Scale Artwork with Artboard	Mettre à l’échelle l’illustration avec le plan de travail
 	Artboards: {n}	Plans de travail : {n}
 	Rearrange All Artboards…	Réorganiser tous les plans de travail…
 	Recall Selection	Rappeler la sélection
@@ -2441,6 +2445,8 @@
 	Show Guides	Afficher les repères
 	Show handles when multiple anchors are selected	Afficher les poignées lorsque plusieurs points d’ancrage sont sélectionnés
 	Show Hidden Characters	Afficher les caractères masqués
+	Bold	Gras
+	Italic	Italique
 	Show Images in Outline Mode	Afficher les images en mode Tracés
 	Show in Folder	Afficher dans le dossier
 	Show Indic Options	Afficher les options indiennes
@@ -2640,6 +2646,25 @@
 	Swatch Tiles	Carreaux de nuances
 	Swatches	Nuancier
 	Switch workspace	Changer d’espace de travail
+	Add Content	Ajouter du contenu
+	Click to apply to the selected type	Cliquez pour l’appliquer au texte sélectionné
+	Create New Library	Créer une bibliothèque
+	Create New Library…	Créer une bibliothèque…
+	Rename Library…	Renommer la bibliothèque…
+	Delete the library “{name}”?	Supprimer la bibliothèque « {name} » ?
+	Drag art or swatches here, or use + to add the selection's colors and text styles.	Faites glisser ici des illustrations ou des nuances, ou utilisez + pour ajouter les couleurs et les styles de texte de la sélection.
+	Its graphics, colors and text styles are deleted from this machine.	Ses graphismes, couleurs et styles de texte sont supprimés de cet ordinateur.
+	Keep graphics, colors and text styles here to use them in any document. Libraries are stored on this machine — no account required.	Conservez ici des graphismes, des couleurs et des styles de texte pour les utiliser dans n’importe quel document. Les bibliothèques sont stockées sur cet ordinateur, sans compte.
+	This library is empty	Cette bibliothèque est vide
+	Add to Library	Ajouter à la bibliothèque
+	Delete Library	Supprimer la bibliothèque
+	Delete Library Item	Supprimer l’élément de la bibliothèque
+	Library	Bibliothèque
+	Rename Library	Renommer la bibliothèque
+	Show Library	Afficher la bibliothèque
+	Use Library Item	Utiliser l’élément de la bibliothèque
+	Graphic	Graphisme
+	Show all open documents	Afficher tous les documents ouverts
 	Symbol Instance	Occurrence de symbole
 	Symbol Libraries	Bibliothèques de symboles
 	Symbol Libraries (on the roadmap)	Bibliothèques de symboles (prévu dans la feuille de route)
@@ -3121,6 +3146,9 @@ axis	Both	Les deux
 # stays English for agents and tests. `{_1}`, `{_2}` … stand for the `{}` of the format string, in order
 # (`complete_languages_translate_every_message` lists any that are missing). Command ids, parameter
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
+@msg	no library `{id}`	aucune bibliothèque `{id}`
+@msg	select some type first	sélectionnez d’abord du texte
+@msg	{_1} has no {_2} style	{_1} n’a pas de style {_2}
 @msg	a layer couldn't be read	un calque n’a pas pu être lu
 @msg	it has more than one artboard	il a plus d'un plan de travail
 @msg	it has no page	il n’a pas de page
@@ -3657,6 +3685,23 @@ axis	Both	Les deux
 @msg	x and y must both be numbers	x et y doivent tous deux être des nombres
 @msg	"{0}" is not a colour: write it as #rrggbb	« {0} » n’est pas une couleur : écrivez-la sous la forme #rrggbb
 @msg	this isn't a flat-colour logo ({_1}% of its solid areas match a few flat colours), so Flat Logo mode would turn its gradients into patches: use Color mode instead	ce n’est pas un logo en aplats ({_1} % de ses zones pleines correspondent à quelques couleurs unies), donc le mode Logo en aplats transformerait ses dégradés en taches : utilisez le mode Couleur
+@msg	`{what}` closes nothing	`{what}` ne ferme rien
+@msg	`{what}` closes something it didn't open	`{what}` ferme quelque chose qu’il n’a pas ouvert
+@msg	a path has too many points	un tracé a trop de points
+@msg	it ends inside a layer	elles se terminent à l’intérieur d’un calque
+@msg	it has art outside its layers	elles contiennent des illustrations hors de leurs calques
+@msg	it has more than {MAX_NODES} objects	elles contiennent plus de {MAX_NODES} objets
+@msg	it has no layers	elles n’ont aucun calque
+@msg	it has too many values in a row	elles contiennent trop de valeurs à la suite
+@msg	it has {_1}, which VectorCraft doesn't read from it yet	elles contiennent {_1}, que VectorCraft n’y lit pas encore
+@msg	its objects are nested too deeply	leurs objets sont imbriqués trop profondément
+@msg	its section ending with `%{end}` doesn't end	leur section qui se termine par `%{end}` ne se termine pas
+@msg	objects with several fills or strokes, effects or brushes came in as their drawn look ({_1}): their appearance isn't editable yet	les objets à plusieurs fonds ou contours, effets ou formes ont été importés tels qu’ils sont dessinés ({_1}) : leur aspect n’est pas encore modifiable
+@msg	gradient “{name}” isn't defined in the file: a plain colour stands in for it	le dégradé « {name} » n’est pas défini dans le fichier : une couleur unie le remplace
+@msg	an image VectorCraft can't read was left out	une image que VectorCraft ne peut pas lire a été ignorée
+@msg	an image whose data is cut short was left out	une image aux données tronquées a été ignorée
+@msg	its editing data doesn't say where its art is	ses données d’édition ne disent pas où se trouve son illustration
+@msg	this file was saved without PDF compatibility, and its editing data can't be read ({why})	ce fichier a été enregistré sans compatibilité PDF et ses données d’édition sont illisibles ({why})
 
 # The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
 	Services	Services

crates/ui-egui/src/i18n/it.tsv

@@ -161,6 +161,7 @@
 	Appearance panel	Pannello Aspetto
 	Applies when the linked file is relinked or updated.	Si applica quando il file collegato viene ricollegato o aggiornato.
 	Applies the next time VectorCraft starts.	Si applica al prossimo avvio di VectorCraft.
+	Apply	Applica
 	Apply Brush	Applica pennello
 	Apply Character Style	Applica stile carattere
 	Apply Effect	Applica effetto
@@ -339,6 +340,8 @@
 	Clean Up…	Pulisci…
 	Clear	Cancella
 	Clear All Tabs	Cancella tutte le tabulazioni
+	Above Text	Sopra il testo
+	Position Panel Above Text	Posiziona il pannello sopra il testo
 	Clear Appearance	Cancella aspetto
 	Clear Guides	Cancella guide
 	Clear Overrides	Cancella sostituzioni
@@ -1989,6 +1992,7 @@
 	Arrange by Row	Disponi in una riga
 	Arrange by Column	Disponi in una colonna
 	Move Artwork with Artboard	Sposta la grafica con la tavola da disegno
+	Scale Artwork with Artboard	Scala la grafica con la tavola da disegno
 	Artboards: {n}	Tavole da disegno: {n}
 	Rearrange All Artboards…	Ridisponi tutte le tavole da disegno…
 	Recall Selection	Richiama selezione
@@ -2444,6 +2448,8 @@
 	Show Guides	Mostra guide
 	Show handles when multiple anchors are selected	Mostra le maniglie quando sono selezionati più punti di ancoraggio
 	Show Hidden Characters	Mostra caratteri nascosti
+	Bold	Grassetto
+	Italic	Corsivo
 	Show Images in Outline Mode	Mostra immagini in modalità Contorno
 	Show in Folder	Mostra nella cartella
 	Show Indic Options	Mostra opzioni per lingue indiane
@@ -2643,6 +2649,25 @@
 	Swatch Tiles	Riquadri campioni
 	Swatches	Campioni
 	Switch workspace	Cambia area di lavoro
+	Add Content	Aggiungi contenuto
+	Click to apply to the selected type	Fai clic per applicarlo al testo selezionato
+	Create New Library	Crea nuova libreria
+	Create New Library…	Crea nuova libreria…
+	Rename Library…	Rinomina libreria…
+	Delete the library “{name}”?	Eliminare la libreria “{name}”?
+	Drag art or swatches here, or use + to add the selection's colors and text styles.	Trascina qui grafica o campioni, oppure usa + per aggiungere i colori e gli stili di testo della selezione.
+	Its graphics, colors and text styles are deleted from this machine.	Grafiche, colori e stili di testo vengono eliminati da questo computer.
+	Keep graphics, colors and text styles here to use them in any document. Libraries are stored on this machine — no account required.	Conserva qui grafiche, colori e stili di testo per usarli in qualsiasi documento. Le librerie restano su questo computer: non serve un account.
+	This library is empty	Questa libreria è vuota
+	Add to Library	Aggiungi alla libreria
+	Delete Library	Elimina libreria
+	Delete Library Item	Elimina elemento della libreria
+	Library	Libreria
+	Rename Library	Rinomina libreria
+	Show Library	Mostra libreria
+	Use Library Item	Usa elemento della libreria
+	Graphic	Grafica
+	Show all open documents	Mostra tutti i documenti aperti
 	Symbol Instance	Istanza di simbolo
 	Symbol Libraries	Librerie simboli
 	Symbol Libraries (on the roadmap)	Librerie simboli (in programma)
@@ -3124,6 +3149,9 @@ axis	Both	Entrambi
 # stays English for agents and tests. `{_1}`, `{_2}` … stand for the `{}` of the format string, in order
 # (`complete_languages_translate_every_message` lists any that are missing). Command ids, parameter
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
+@msg	no library `{id}`	nessuna libreria `{id}`
+@msg	select some type first	seleziona prima del testo
+@msg	{_1} has no {_2} style	{_1} non ha lo stile {_2}
 @msg	a layer couldn't be read	non è stato possibile leggere un livello
 @msg	it has more than one artboard	ha più di una tavola da disegno
 @msg	it has no page	non ha pagine
@@ -3660,6 +3688,23 @@ axis	Both	Entrambi
 @msg	x and y must both be numbers	x e y devono essere entrambi numeri
 @msg	"{0}" is not a colour: write it as #rrggbb	"{0}" non è un colore: scrivilo come #rrggbb
 @msg	this isn't a flat-colour logo ({_1}% of its solid areas match a few flat colours), so Flat Logo mode would turn its gradients into patches: use Color mode instead	questo non è un logo a colori piatti ({_1}% delle sue aree piene corrisponde a pochi colori piatti), quindi la modalità Logo piatto trasformerebbe i suoi sfumati in macchie: usa la modalità Colore
+@msg	`{what}` closes nothing	`{what}` non chiude nulla
+@msg	`{what}` closes something it didn't open	`{what}` chiude qualcosa che non ha aperto
+@msg	a path has too many points	un tracciato ha troppi punti
+@msg	it ends inside a layer	terminano all'interno di un livello
+@msg	it has art outside its layers	contengono grafica al di fuori dei loro livelli
+@msg	it has more than {MAX_NODES} objects	contengono più di {MAX_NODES} oggetti
+@msg	it has no layers	non hanno livelli
+@msg	it has too many values in a row	contengono troppi valori di seguito
+@msg	it has {_1}, which VectorCraft doesn't read from it yet	contengono {_1}, che VectorCraft non vi legge ancora
+@msg	its objects are nested too deeply	i loro oggetti sono annidati troppo in profondità
+@msg	its section ending with `%{end}` doesn't end	la loro sezione che termina con `%{end}` non termina
+@msg	objects with several fills or strokes, effects or brushes came in as their drawn look ({_1}): their appearance isn't editable yet	gli oggetti con più riempimenti o tratti, effetti o pennelli sono stati importati come appaiono disegnati ({_1}): il loro aspetto non è ancora modificabile
+@msg	gradient “{name}” isn't defined in the file: a plain colour stands in for it	la sfumatura “{name}” non è definita nel file: la sostituisce un colore pieno
+@msg	an image VectorCraft can't read was left out	un'immagine che VectorCraft non può leggere è stata omessa
+@msg	an image whose data is cut short was left out	un'immagine con dati incompleti è stata omessa
+@msg	its editing data doesn't say where its art is	i suoi dati di modifica non dicono dove si trova la grafica
+@msg	this file was saved without PDF compatibility, and its editing data can't be read ({why})	questo file è stato salvato senza compatibilità PDF e i suoi dati di modifica non si possono leggere ({why})
 
 # The macOS menu bar (native_menu): the app and Window menus' system items, Settings pages.
 	Services	Servizi