Part of #637: the editing data's readers stay linear on hostile input

Zstandard frames: the trailing zero padding is trimmed once, not looked
for again before each frame, and at most 4096 frames are read (more is
damaged data). A `]` finds its `[` from a list of where they are rather
than by scanning the operand stack back. Images are read up to 32
million pixels. Tests: thousands of tiny frames, and hundreds of
thousands of unmatched brackets, read in one pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.lock

@@ -3460,6 +3460,15 @@ dependencies = [
  "unicode-script",
 ]
 
+[[package]]
+name = "ruzstd"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a252f5e20f038fe7b4ea53e073e65398d652c864cc162fc77c56c2f13717b888"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -4123,6 +4132,12 @@ dependencies = [
  "core_maths",
 ]
 
+[[package]]
+name = "twox-hash"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -4320,6 +4335,16 @@ dependencies = [
  "winresource",
 ]
 
+[[package]]
+name = "vectorcraft-affinity"
+version = "0.7.0"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "proptest",
+ "ruzstd",
+]
+
 [[package]]
 name = "vectorcraft-brush"
 version = "0.7.0"
@@ -4414,14 +4439,17 @@ dependencies = [
 name = "vectorcraft-engine"
 version = "0.7.0"
 dependencies = [
+ "crc32fast",
  "flate2",
  "image",
  "kurbo 0.13.1",
  "log",
  "proptest",
+ "ruzstd",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
+ "vectorcraft-affinity",
  "vectorcraft-brush",
  "vectorcraft-cad",
  "vectorcraft-color",
@@ -4449,6 +4477,7 @@ dependencies = [
  "flate2",
  "image",
  "kurbo 0.13.1",
+ "ruzstd",
  "vectorcraft-brush",
  "vectorcraft-color",
  "vectorcraft-doc",

Cargo.toml

@@ -33,6 +33,7 @@ vectorcraft-cad = { path = "crates/cad" }
 vectorcraft-eps = { path = "crates/eps" }
 vectorcraft-metafile = { path = "crates/metafile" }
 vectorcraft-plugins = { path = "crates/plugins" }
+vectorcraft-affinity = { path = "crates/affinity" }
 
 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -42,6 +43,7 @@ serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
 proptest = "1"
+crc32fast = "1.5"
 # tests: a TCP port bound without listening (connections to it are refused)
 socket2 = "0.6"
 # Sandboxed WebAssembly plug-ins: a pure-Rust interpreter (MIT OR Apache-2.0) that builds for wasm32
@@ -60,6 +62,8 @@ skrifa = "0.47"
 harfrust = "0.13"
 linesweeper = "0.4"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
+# Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
+ruzstd = { version = "0.9", default-features = false, features = ["std"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
 # CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG

README.md

@@ -193,7 +193,13 @@ milestones, and honest time-to-parity estimates.
 **Where we are (2026-10-07):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
 "a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
-files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The interface
+files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package).
+Affinity documents (`.af` from Affinity 3, `.afdesign`, `.afpub` and, by their content, `.afphoto` from Affinity 1 and 2) open
+and place natively: layers, groups, artboards and pages, curves and shapes, fills, gradients and strokes, clipping
+and masks, text and images, with what didn't come in (effects, adjustments, brushes, master pages…) listed in the
+import warning; a file whose native data can't be read opens as its embedded preview, saying why. VectorCraft
+doesn't write Affinity files. [Scope and limits](crates/affinity/README.md).
+The interface
 speaks English, Japanese, Traditional and Simplified Chinese, Spanish, French, Italian and Russian (and Czech and Brazilian Portuguese in the menus).
 The scores are
 self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-09 (after placed documents (File › Place of a `.vectorcraft` file, linked), M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG windoLine truncated
+_Last updated: 2026-10-09 (after placed documents (File › Place of a `.vectorcraft` file, linked), M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG windoLine truncated
 
 ## Where we are
 
@@ -35,10 +35,10 @@ since 2026-10-01.
 |---|---|---|
 | **Breadth:** menus, tools and panels exist | ~90% | 13 menu items still stubbed; every tool implemented except Touch Type; 51 panel modules |
 | **Depth:** each feature behaves like Illustrator | ~69–75% | Strong: paint, appearance and colour (M3), Pathfinder and booleans, selection, drawing, files (M4). Weak: advanced type (~45%; inline symbols in text are beyond parity and don't raise it), brushes and symbols (in progress), raster effects (~20%) |
-| **Large missing subsystems** | 0–20% | 3D & Materials (0%), Photoshop-style raster effects and the Effect Gallery (~1 of ~56 filters), SVG Filters, CJK composition (vertical type with kinsoku, tate-chu-yoko and the font's vertical metrics; ruby, mojikumi and proportional vertical metrics open), Variables (data merge), scripting |
+| **Large missing subsystems** | 0–20% | 3D & Materials (0%), Photoshop-style raster effects and the Effect Gallery (~4 of ~56 filters), SVG Filters, CJK composition (vertical type with kinsoku, tate-chu-yoko and the font's vertical metrics; ruby, mojikumi and proportional vertical metrics open), Variables (data merge), scripting |
 | **Interaction fidelity:** modifiers, cursors, small behaviours | ~30–40% | The dedicated pass hasn't started, and there has been no side-by-side session with Illustrator yet. A power user notices this first |
 | **Look & feel** | ~75–80% | Measured against Illustrator 2026 screenshots (2026-10-02); the panels added since haven't been re-measured |
-| **File interop** | ~85% | SVG/SVGZ, PDF and PDF-compatible `.ai`, EPS, DXF, EMF/WMF, raster formats, PSD export, Place and Links, Package, Print, clipboard flavours. Native `.ai` private data is out of scope by design; DWG has no open spec |
+| **File interop** | ~85% | SVG/SVGZ, PDF and PDF-compatible `.ai`, EPS, DXF, EMF/WMF, raster formats, PSD export, Place and Links, Package, Print, clipboard flavours. Affinity documents (Affinity 1–3) open natively as editable art, checked against Affinity's own thumbnails of 22 pinned public files; Affinity export is missing and effects, adjustments and brushes don't import. Affinity isn't an Illustrator feature, so this doesn't raise the parity score. The editing copy inside an Illustrator EPS or `.ai` is read for its structure: layers, groups, names, hidden objects and type, colours, gradients, transparency, images and every artboard (see Out of scope for what it doesn't read yet); DWG has no open spec |
 | **Bundled content:** brush, symbol, style and swatch libraries | ~30% | Ours are original and generated in code, and far fewer than Illustrator ships; brush and symbol libraries are still missing |
 | **Performance** | unverified | Multithreaded, off-thread rendering and caches are in place. The last budget run (2026-10-01, loaded machine) measured 290 ms for a 50k-path fit against a 16 ms budget. Re-run `vectorcraft-cli perf` on an idle machine |
 | **Robustness** | good, new | ~2,840 tests, property tests, no panics in shipped code (lints, the `guard` safety net, import fuzzing), Data Recovery. Missing: a corpus of real-world files, Windows/Linux/browser QA |
@@ -53,9 +53,12 @@ Ordered by how much each gap blocks someone from switching. Sizes are one-agent
 1. **Interaction fidelity:** go tool by tool and panel by panel against `plan/illustrator/05-tools.md`,
    `06-panels.md` and `09-shortcuts.md`, covering modifier keys, cursors, the Properties panel per context and
    isolation mode. The Shaper’s rough-square recognition and shape orientation steps are corrected; Shaper Groups now retain editable originals for region merges/punches and separate fill/stroke edits; their construction-mode widget and gesture refinements remain. 60–90 h.
-2. **Photoshop-style raster effects and the Effect Gallery:** about 55 filters (Artistic, Brush Strokes, Distort,
-   Pixelate, Sketch, Stylize, Texture, Video) on the raster pipeline that drop shadows already use, applied at
-   Document Raster Effects Settings resolution. Parallelizes well across agents. 28–42 h.
+2. **Photoshop-style raster effects and the Effect Gallery:** about 52 filters (Artistic, Brush Strokes, Distort,
+   Pixelate, Sketch, Stylize, Texture, Video) and the Effect Gallery. The pixel-filter pipeline is in place
+   (`vectorcraft_effects::pixel`: the object rendered offscreen, filtered in stack order with Gaussian Blur and
+   Feather, cached while panning, images in PDF/SVG/Expand Appearance) with Blur › Radial Blur and Smart Blur
+   (Normal mode only) and Sharpen › Unsharp Mask; each new filter is now one function, a catalogue row, menu and
+   translations. Parallelizes well across agents. 26–40 h.
 3. **3D and Materials:** Extrude & Bevel, Revolve, Inflate and Rotate with lighting and materials, using a software
    renderer in its own crate (layering allows it below L6), with output in SVG/PDF as rasters or projected vectors.
    The largest single gap. 50–80 h.
@@ -70,7 +73,9 @@ Ordered by how much each gap blocks someone from switching. Sizes are one-agent
 6. **Automation:** Variables (data merge), a scripting surface over the command registry, batch. 8–12 h.
 7. **Views and windows:** multiple windows and arrange, Consolidate All Windows, video
    rulers. 15–25 h.
-8. **Hardening at scale:** a corpus of real-world SVG/PDF/EPS files, idle-machine perf budgets, Windows, Linux and
+8. **Hardening at scale:** a corpus of real-world SVG/PDF/EPS files, Affinity files from more versions and platforms
+   (the native reader is checked against 22 public files' own thumbnails; synthetic one-feature oracles saved by
+   Affinity itself are still missing), idle-machine perf budgets, Windows, Linux and
    browser QA, pen tablets on Wayland and pen pressure beyond Windows (winit 0.31's tablet input, #491), accessibility, packaging. 50–80 h.
 
 ### Where we're going
@@ -109,7 +114,7 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
   - Save / Don't Save / Cancel before closing or quitting with unsaved documents (tabs, Close, Close All, Quit, window close).
   - Four brightness themes, persistent preferences.
-  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways; Alt/Option-wheel and a trackpad pinch zoom about the pointer either way), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. Then Smart Guides › Color, Alignment Guides, Anchor/Path Labels, Measurement Labels, Transform Tools, Object Highlighting (with Smart Guides on) and Snapping Tolerance (4 px by default, for every smart guide snap), then Construction Guides and their Angles (#506: a drawn point near a line at one of those angles through the point it leaves from lands on it). Then Type › Type Object Selection by Path Only (type is picked on the baseline of any of its lines, area type's frame or the path of type on a path, no longer anywhere in its bounds; the Type tools and the Eyedropper still take a click among the characters). Then General › Anti-aliased Artwork (off, the canvas draws the art with hard edges). Then Guides & Grid › Show Pixel Grid (Above 600% Zoom), a line at every document pixel over the art in Pixel Preview, turning with a rotated view as the document grid now does too. Then General › Show The Home Screen When No Documents Are Open (off, closing the last document leaves an empty window; the Home button still opens the screen). Then Units › Numbers Without Units Are Points (on by default: a number typed with no unit into a field in picas is read in points, a typed unit still wins; dimmed unless a unit is Picas). Then User Interface › Auto-Collapse Iconic Panels (off by default: on, a click away from a panel popped out of the icon column puts it away). They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). About 30 stored options still do nothing yet (the rest of #394: Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, Spacing Guides, performance, devices…).
+  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways; Alt/Option-wheel and a trackpad pinch zoom about the pointer either way), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. Then Smart Guides › Color, Alignment Guides, Anchor/Path Labels, Measurement Labels, Transform Tools, Object Highlighting (with Smart Guides on) and Snapping Tolerance (4 px by default, for every smart guide snap), then Construction Guides and their Angles (#506: a drawn point near a line at one of those angles through the point it leaves from lands on it). Then Type › Type Object Selection by Path Only (type is picked on the baseline of any of its lines, area type's frame or the path of type on a path, no longer anywhere in its bounds; the Type tools and the Eyedropper still take a click among the characters). Then General › Anti-aliased Artwork (off, the canvas draws the art with hard edges). Then Guides & Grid › Show Pixel Grid (Above 600% Zoom), a line at every document pixel over the art in Pixel Preview, turning with a rotated view as the document grid now does too. Then General › Show The Home Screen When No Documents Are Open (off, closing the last document leaves an empty window; the Home button still opens the screen). Then Units › Numbers Without Units Are Points (on by default: a number typed with no unit into a field in picas is read in points, a typed unit still wins; dimmed unless a unit is Picas). Then User Interface › Auto-Collapse Iconic Panels (off by default: on, a click away from a panel popped out of the icon column puts it away). Then Performance › Animated Zoom (on, with GPU Performance, which it needs and which dims it when off: the Zoom tool dragged sideways zooms about the press, right in and left out, and held still zooms on, Alt out; off, a drag zooms to the area dragged across, now drawn as a marquee), User Interface › Large Tabs (taller document tabs) and Scale Cursor Proportional to UI (off, the tool cursors keep their size whatever the UI Scaling), and File Handling › Display Bitmaps as Anti-aliased Images in Pixel Preview (off by default: Pixel Preview draws images with each pixel taking its nearest image pixel). Type › Auto Size New Area Type works too (new area type gets Auto Size). They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). Then Smart Guides › Spacing Guides (moves space the selection evenly with its row or column, see Drawing aids). About 20 stored options still do nothing yet (the rest of #394: Show Font Names in English, Highlight Alternate Glyphs, Display Print Size at 100% Zoom, Identify Objects By, East Asian Type units, Open Documents As Tabs, Real-time Drawing and Editing, GPU Performance beyond Animated Zoom, hyphenation, scratch disks, the legacy clipboard, Appearance of Black, Touch Workspace).
   - Dialogs move by dragging their heading (the band down from the top edge, as a title bar), stay on screen and keep where they were moved for the session; the form dialogs' choices are dropdowns (Offset Path's Joins, Average's and Shear's and Reflect's axis), and Offset Path lists Offset, Joins, Miter Limit and previews (#423).
   - Dialogs open with their first field focused and its value selected: type a value and press Enter (Move, Rotate, Scale…). Number fields in panels, the Control bar and dialogs (preferences too) step with Up/Down, or with the mouse wheel over the focused field (#485: a notch a step; the panel under it then stays put, and an unfocused field leaves the wheel to scrolling) (Shift: ten, Ctrl/Cmd: a tenth of their unit), applied at once.
   - Scrubby labels (#400, beyond Illustrator, as in Photoshop): dragging a numeric field's label left or right (the ↔ cursor shows over it) steps the value one unit every 2 points (Shift: ten, Ctrl/Cmd: a tenth; counts stay whole), in the field's unit and within its limits, applied live as the art follows; the whole drag is one undo step and Escape puts the value back. A click on the label focuses the field; the text box itself never scrubs, and a field with no label doesn't. Text labels before a field (Transform, Properties, Control bar, Stroke, Transparency, form rows in dialogs) and the Character and Paragraph panels' icons act as labels. Preferences › General › Scrub Numeric Fields by Dragging (on by default) turns it off.
@@ -129,24 +134,25 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. A press on the first anchor of the path being drawn closes it whatever the drag then does: the drag shapes the closing curve (symmetric handles, Alt breaks them) and the release closes the path wherever it ends (#501). Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead. Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as the Anchor Point tool, with its convert cursor: dragging a handle moves it alone, clicking a smooth anchor makes it a corner, dragging an anchor pulls out new symmetric handles, dragging a segment reshapes it; drawing then goes on. Cmd (Ctrl) held drags with the selection tool chosen last, Direct Selection until one is (handles, anchors and segments of the path being drawn or another), and the Pen then goes on drawing its path while that stays selected; the pointer shows that tool's while Cmd is held. The same holds for agents (`pointer_gesture` with `mods.cmd`), as the borrowing now lives in the engine (#494).
   - **Path editing (#494):** the handles shown are the handles that drag: Direct Selection drags those of a path selected as a whole (as the Pen leaves it), the Anchor Point tool and Pen+Alt no longer grab handles that Show handles when multiple anchors are selected hides, a handle shorter than the tolerance leaves its anchor to be picked, and the anchor tools pick within Selection & Anchor Display › Tolerance. A dragged segment keeps a smooth anchor at either end smooth. With Direct Selection, the Pen, the Curvature and the anchor tools, a path selected as a whole shows all its anchors selected, and the Control bar and the Properties panel offer Convert (corner, smooth) for them too; Remove and Cut wait for anchors direct-selected (#504). A handle drag gathers its snap targets once per drag (it took 21 ms per pointer move on a 20,000-path document, now 1 ms; `vectorcraft-cli perf` measures handle and segment drags on a 5,000-anchor path).
   - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type.
-  - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446), Measure, Type, Hand, Zoom, Rotate View.
+  - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446; Object › Artboards › Rearrange All Artboards lays them out in a grid by row or by column, in one row or one column, left to right or right to left, from the menu, the Artboards panel or Properties' Rearrange All, #681), Measure, Type, Hand, Zoom, Rotate View.
   - **Editing type:** double-clicking type with a selection tool switches to the Type tool with the caret where it was clicked.
   - **Temporary tools:** Cmd with any other tool drags with the selection tool used last (Selection, Direct Selection or Group Selection). Held Space pans and Cmd+Space zooms (Cmd+Alt+Space out) whatever the tool.
   - **Panel drag and drop:** art dragged off the canvas onto the Symbols panel becomes a symbol, onto the Swatches panel a pattern swatch and onto the Brushes panel an Art brush; a symbol dragged onto the canvas places an instance where it is dropped, and a brush dragged onto a path is applied to it.
   - **Tool double-clicks:** double-clicking a tool's button opens its options: Hand fits the artboard in the window, Zoom shows 100 %, Rotate, Scale, Reflect and Shear open their Object › Transform dialogs, the Selection, Direct Selection and Group Selection tools the Move dialog (Enter opens these seven tools' dialogs too), Gradient, Eyedropper, Blend and the Liquify tools their panels or options, and the Pencil, Paintbrush, Smooth, Blob Brush and Eraser tools their Tool Options (Fidelity, fill, the tolerances, the brush size).
 - **Layers panel:** every layer, sublayer, group and object is a clickable row at any depth: a click highlights it and makes its layer current (new art goes there), Shift-click a range, Ctrl/Cmd-click toggles. Sublayers are no longer treated as objects: clicks, marquees, Select All and the Select menu take the art inside them, and each sublayer selects in its own colour. Selection squares on rows with selected art (click selects a row's art, Shift adds or removes; dragging the square moves the selection to another row, Alt copies), the eye and lock on every row with drag-down-the-column (one undo step), Ctrl/Cmd-click an eye for per-layer Outline, Alt-click an eye or lock to hide or lock the other layers (again: show or unlock them all), triangles with Alt to open or close everything inside, drag and drop rows above, below or into layers and groups with a drop line (Alt copies) and a dimmed copy of the row under the pointer (dropped on the trash rows are deleted, on New Layer duplicated, as in Illustrator), inline rename, Delete key on highlighted rows. Buttons and the full panel menu: New Layer/Sublayer (Alt: options, Ctrl: on top), Duplicate, Delete, Options for Selection, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New Layer, Release to Layers (Sequence and Build), Reverse Order, Template, Hide/Outline/Lock Others and Show/Preview/Unlock All, Paste Remembers Layers, Panel Options (row size, thumbnails per kind, Show Layers Only). Layer Options: name, colour (presets, each with a chip of its colour, or custom), Template, Lock, Show, Print, Preview (outline drawing and clicking) and Dim Images to %. Every operation is a command (`layer.move`, `layer.highlight`, `layer.merge`…) with validation against cycles and invalid nesting. A document opens with only its top-level layers open; the rows left open are saved in the native file (nothing is written for the default) and reopen that way. Only the rows scrolled into view are laid out, from a row list made once per change: a layer of 5,000 groups of 10 paths, all open, draws the panel in 0.4 ms a frame instead of about 29 s (#638).
-- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles with the Selection or Free Transform tool, Shift and Alt too: the dragged corner or side lands on the other objects' anchors and centres ("anchor", "center") or lines up with their edges and centres (a line and "align"); the Rotate, Scale, Shear and Reflect tools drag from the anchor they grab and snap the pointer the same way, so a corner dragged onto another object's anchor scales exactly onto it, #482; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H; drawn points, #506: hovering shows where the press goes, the point lands on the other objects' anchors, centres and paths ("anchor", "center", "path") or lines up with their anchors, edges and centres ("align"), the Pen's on the path being drawn too, near a construction guide through the anchor before it on that guide (Preferences › Smart Guides › Construction Guides and Angles), and with Shift kept to its 45° step or a square's diagonal it slides along that way into line; the targets are gathered once per document state, from the art in the window, and the anchors, centres and lines near the pointer are found by bisection, so hovering never rescans the document), guides dragged out of the rulers (#451: they snap as moved guides do, Shift to the ruler's ticks; with the Artboard tool they are artboard guides, which run across their artboard only and move, copy and delete with it, `guide.add {artboard}`) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the edges, centres (so the sides' midpoints) and anchors of the art and the artboards, or with Smart Guides off Snap to Point pulls it onto anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), a right-click on either ruler or the origin box to pick the document's units (the current one checked; `document.setUnits`, one undo step, #528), and Draw Normal / Behind / Inside modes.
+- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles with the Selection or Free Transform tool, Shift and Alt too: the dragged corner or side lands on the other objects' anchors and centres ("anchor", "center") or lines up with their edges and centres (a line and "align"); with Smart Guides › Spacing Guides, a moved selection that lines up with nothing along an axis lands as far from its neighbour as two other objects of its row or column are apart, or halfway between its two neighbours, the equal gaps marked; the Rotate, Scale, Shear and Reflect tools drag from the anchor they grab and snap the pointer the same way, so a corner dragged onto another object's anchor scales exactly onto it, #482; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H; drawn points, #506: hovering shows where the press goes, the point lands on the other objects' anchors, centres and paths ("anchor", "center", "path") or lines up with their anchors, edges and centres ("align"), the Pen's on the path being drawn too, near a construction guide through the anchor before it on that guide (Preferences › Smart Guides › Construction Guides and Angles), and with Shift kept to its 45° step or a square's diagonal it slides along that way into line; the targets are gathered once per document state, from the art in the window, and the anchors, centres and lines near the pointer are found by bisection, so hovering never rescans the document), guides dragged out of the rulers (#451: they snap as moved guides do, Shift to the ruler's ticks; with the Artboard tool they are artboard guides, which run across their artboard only and move, copy and delete with it, `guide.add {artboard}`) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the edges, centres (so the sides' midpoints) and anchors of the art and the artboards, or with Smart Guides off Snap to Point pulls it onto anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), a right-click on either ruler or the origin box to pick the document's units (the current one checked; `document.setUnits`, one undo step, #528), and Draw Normal / Behind / Inside modes.
 - **Views:** the status bar's artboard navigator (first, previous, next, last; `view.goToArtboard`) goes to an artboard and fits it, and Fit Artboard in Window and Actual Size show the navigator's artboard. The Artboards panel highlights that active artboard: clicking a row makes it active (the Artboard tool's too, while it is chosen) as does clicking an artboard with the Artboard tool, double-clicking its number also fits it in the window and double-clicking its name renames it. Duplicate Artboards, or a row dragged onto New Artboard, copies the artboard with its art (#446). Escape leaves Presentation Mode, F from it goes back to Normal Screen Mode, and the screen mode isn't saved with the preferences: the app always starts in Normal Screen Mode with its menus and panels (#472). View › Pixel Preview shows the art as the document pixels it rasterizes to, one per point and hard-edged when magnified, turning with a rotated view (it used to draw the smooth vectors, with only the pixel grid over them).
 - **Geometry and effects:**
   - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected. With anchors selected, the Control bar and the Properties panel also convert them to corner or smooth (`path.convertAnchors`), connect end points (Join) and cut the path at them (`path.cutAtAnchors`, also on the task bar and the context menu): a closed path opens there and an open one becomes one path per piece, each cut leaving one of its two coincident anchors selected so a drag pulls the path apart.
   - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
 - **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), paragraph attributes per paragraph (alignment, indents, spacing, hyphenation, hanging punctuation, tab stops, paragraph style, direction, mojikumi and leading model; the Paragraph, Tabs and Paragraph Styles panels act on the paragraphs the Type tool's selection or caret touches, Return continues the paragraph's style, threads and SVG keep them), Area Type Options (rows/columns/inset/first baseline, vertical Align Top/Center/Bottom/Justify per row/column, reflowing non-rectangular frames and text wrap), threaded text across any closed shapes, Fit Headline, the Every-line Composer for justified and ragged text (paragraph-wide breaks for an even rag, Single-line per object from the Paragraph panel menu or `text.setFormat {composer}`). Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. Auto Size: the frame height follows the text after every edit, in the same undo step (rectangular frames of horizontal type in one row; columns get the least height that holds them; a height set by hand or threading turns it off), and the "Auto Size New Area Type" preference gives it to new area type. Shrink Text to Fit (beyond Illustrator): overflowing area type scales its sizes, leading and baseline shifts down by the largest factor (in 0.1 pt steps of the first run, down to a minimum percentage) that fits, at layout time so every export sees it. `text.areaOptions` and `document.inspect` report overflow and the shrink factor. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Beyond Illustrator: inline graphics (`text.insertInline`, Type ▸ Insert Inline Symbol) set a document symbol in a run of type as one character that flows, wraps and justifies like a glyph (InDesign-style inline objects, e.g. mana symbols in card rules text): sized to a multiple of the font size, centred on the cap height, opening up tall lines, following Redefine Symbol; a character of its run's size for Character Alignment and Top-to-Top leading, placed by the bidi reordering in right-to-left text (a neutral U+FFFC); drawn on the canvas, kept as live text plus a `<use>` in SVG and as vector art in PDF; Backspace removes it whole. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
-- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale), French (every `fr-*` locale), Italian (every `it-*` locale) and Russian (every `ru-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish, French, Italian and Russian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish, French, Italian and Russian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline, the em box top/right, centre or bottom/left, or the ICF (ideographic character face) top/right or bottom/left, from the font's BASE table or, without one, the average ink box of some ideographs and kana; Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale), French (every `fr-*` locale), Italian (every `it-*` locale) and Russian (every `ru-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish, French, Italian and Russian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish, French, Italian and Russian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku applies to horizontal and vertical Japanese (Paragraph panel › Kinsoku Set, `text.setFormat {kinsoku}`: Hard, the default, keeps closing marks, iteration marks, the prolonged sound mark and small kana off the line start and opening brackets off its end; Soft lets 々, ー and small kana start a line as JLREQ's level 3 rules do; None turns it off), and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a line flush with its start (a paragraph's first line at its first-line indent, JIS X 4051's principle in JLREQ 3.1.5), and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline (new type in a Japanese interface starts top to top, with em box centre character alignment, #432); Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline, the em box top/right, centre or bottom/left, or the ICF (ideographic character face) top/right or bottom/left, from the font's BASE table or, without one, the average ink box of some ideographs and kana; Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
 - **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
-- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets, colour layers traced in parallel; a trace past two million anchor points or an image over 64 megapixels is refused with advice rather than running out of memory, and a selection too large to outline shows its bounds (#525); Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), the Image Trace panel and Expand, plus Release in Properties; Advanced › Create: Fills and/or Strokes, where lines up to the Stroke width trace as stroked centre lines (distance transform, thinning, a skeleton graph with spurs pruned, curve fitting; one width per line; without Fills, wider areas become stroked outlines), part of #641; the View modes are not done), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
+- **Image Trace Flat Logo mode:** a fourth mode beside Black and White, Grayscale and Color, for flat-colour logos. Each pixel is read as a blend of the logo's colours (found automatically or named), the blend is interpolated smoothly and every outline is placed where two colours are equally present, so edges are accurate to a fraction of a pixel. Outlines are then cleaned: corners the blur rounded are put back, near-straight runs and near-circular arcs become exact lines and arcs, the rest is fitted with as few Béziers as the tolerance allows, touching colours overlap by a hair so no gap opens, and an outline that strays from the raw contour is fitted plainly instead. Gradients and photos are refused with advice to use Color. *Measured* (a local experiment, not run in CI): a flat-colour logo's vector original was rendered down to a soft 199 × 100 px transparent PNG, traced, and the result compared with the original at 1600 px wide. The built-in colour presets (6 Colors, 16 Colors, High Fidelity Photo, Low Fidelity Photo) had a mean edge error of 2.5 to 3.4 px and region overlap of 0.88 to 0.91; Flat Logo had 0.78 px and 0.966 (0.48 px and 0.975 from a crisp source), in about 0.1 s. Limits: flat-colour art only; needle-thin sharp tips are shortened by about 1.7 source pixels because the blur erases them; it works at no more than 1024 px on the long side (larger images are averaged down first); only one logo family has been scored against a vector original.
+- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets, colour layers traced in parallel; a trace past two million anchor points or an image over 64 megapixels is refused with advice rather than running out of memory, and a selection too large to outline shows its bounds (#525); Object › Image Trace › Make and Make and Expand trace at once with the Default preset, #543; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image (`object.cropImage {trim: true}` cuts an image to its pixels that aren't fully transparent, pixel for pixel) and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), View, the Image Trace panel and Expand, plus Release in Properties; the five View modes (Tracing Result, with Outlines, Outlines, Outlines with Source Image, Source Image) redraw a trace on screen without tracing again, are saved with it and `imageTrace.setView` sets them, while exports and Expand keep the result; the panel's Advanced section is a header that stays open or closed as it was left (part of #641); Color mode's Palette: Limited, Full Tone (as many colours as the tones need, Less … More), Automatic (flat art with its own colours, else Full Tone; a heuristic) and Document Library (the most used colours of the document's swatches or a swatch library, filled with the swatch colours as they are), part of #641; Advanced › Create: Fills and/or Strokes, where lines up to the Stroke width trace as stroked centre lines (distance transform, thinning, a skeleton graph with spurs pruned, curve fitting; one width per line; without Fills, wider areas become stroked outlines), part of #641), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
 - **Paint and appearance (M3):**
   - **Swatches:** names follow the colour model and are unique; Swatch Options (process/spot, Global, Gray/RGB/HSB/CMYK/Web, live preview); editing a global or spot swatch recolours every linked fill, stroke and text run in one undo step; multi-select and delete with confirmation; New Swatch and New Color Group dialogs (a group from the selected artwork's colours); swatches in colour groups convert, separate and count like any other. The Swatches panel selects ranges and whole groups, has a find field, and drags swatches to reorder, regroup or paint art; Add Used Colors, Select All Unused, Merge, Ungroup and Sort by Kind; a CMYK document keeps applied colours in CMYK. Swatch libraries: nine generated colour libraries and five gradient libraries in a library panel, saved as `.vcswatches`, `.gpl` or CSS, and loaded from `.vcswatches`, `.gpl` and swatch exchange (`.ase`) files (RGB, CMYK, Lab and Gray; global, spot and process; groups). Tints of global and spot colours ("Name 40%") stay linked and separate as a percentage of their plate. Spot colours can be defined in Lab (Spot Colors options). A built-in [Registration] swatch prints on every plate.
-  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers (the Properties panel has the Control bar's Fill and Stroke chips, Stroke link and weight spinner, with nothing selected too), panels have Illustrator's Window menu keys (Align Shift+F7, Transform Shift+F8, Pathfinder Cmd+Shift+F9, Layers F7, Character Cmd+T…; every panel can be given one in Edit › Keyboard Shortcuts), and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
+  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers (the Properties panel has the Control bar's Fill and Stroke chips, Stroke link and weight spinner, with nothing selected too), panels have Illustrator's Window menu keys (Align Shift+F7, Transform Shift+F8, Pathfinder Cmd+Shift+F9, Layers F7, Character Cmd+T…; every panel can be given one in Edit › Keyboard Shortcuts), and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). An ICC CMYK profile converts straight into the RGB working space (not through sRGB, so a wider space such as Wide Gamut RGB keeps colours sRGB can't hold) with the colour settings' black-point compensation, on the canvas and in RGB exports alike. Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
   - **Gradients:** lossless, validated gradient params; gradients follow rotate, reflect, shear, non-uniform scale and distortions; the Gradient tool edits the fill or stroke of the active proxy, type included; an interactive on-canvas annotator (move, length/angle, rotate, add/move/delete/duplicate stops, midpoints, a stop popover, Delete and arrow keys). The Gradient panel has the Fill/Stroke proxy, a gradient-swatch dropdown with Save to Swatches, midpoint locations, Alt-drag to copy or swap stops, swatch drops on the ramp and a stop eyedropper; copied appearances and graphic styles place gradients on each target's own bounds; gradient handles snap and honour Constrain Angle. Gradient stops stay linked to global and spot swatches. Freeform gradients (points and lines) are edited on the canvas; radial gradients have an extent ellipse, an aspect handle and an off-centre focal point (SVG `fx`/`fy`, PDF two-point radials). A stroke's gradient runs within, along or across it. Object ▸ Expand turns gradients into N objects or a gradient mesh.
   - **Strokes:** one stroke-geometry module shared by the canvas, SVG, PDF and Outline Stroke; dotted lines (zero-length dashes draw dots or squares); arrowheads with hollow outlines, tip-on-end or extend-past-end alignment and one opacity for line and head. SVG and PDF export arrowheads, width profiles, brushes and aligned strokes exactly as the canvas draws them; Outline Stroke and the live Outline Stroke effect outline every stroke item as drawn (dashes, heads, profiles, alignment); dashes can be fitted to corners and path ends; width profiles carry through dashes, and their corners take the join. The Stroke panel edits type's character strokes, follows the stroke units (its weight presets are round values in that unit: `0.25 mm`, `0.0625 in`, `1 px`, #426; fields show four decimals in mm, cm and inches, three in points), shows mixed values blank and opens from the Control bar. A width profile library, thirty more arrowheads, and Width Point Edit with multi-select and discontinuous points. Visual bounds and clicks cover the whole painted stroke. Scale Strokes & Effects, Scale Corners and Use Preview Bounds work everywhere, and new art inherits stroke options, a graphic style or the whole last appearance.
   - **Appearance:** the Appearance panel's selected row drives every paint, stroke, gradient and transparency edit (`item` on the commands); effects apply to one fill or stroke; per-item Opacity popups, whose blend-mode list and opacity slider stay open inside them (#430; the Control bar's Stroke popover too); Mixed Appearances, Layers target dots and basic-appearance rules. Effects can be reordered, moved between items and copied by dragging; Show All Hidden Attributes; clicking an effect edits it in place; the object thumbnail drags onto art; effects render on type, images, symbols, blends, envelopes, meshes and repeats, and per-item raster effects export. Groups, layers and type have their own fills, strokes and effects (Contents and Characters rows); the Layers panel's target circles target layers, groups and objects; Expand Appearance turns fills, strokes, effects and brushes into objects.
@@ -158,8 +164,9 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 - **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed (exports that draw it — PDF, EPS, EMF/WMF, raster, SVG outlines or embedded fonts — warn that they wrote the fallback font; `textAs: outlines` keeps the PDF's embedded glyphs).
 - **Files (M4):**
   - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export. The desktop app writes its warnings and errors (graphics adapter, a lost graphics device, panics the guard recovered from) to standard error and to `logs/vectorcraft.log` next to the preferences, the two previous runs kept and each file capped at 16 MiB, so a launch without a terminal still leaves something to attach to a bug report (#465).
-  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420; hidden objects written hidden on Save and `convert`, and `data-*` attributes kept as the objects' own data: #522; top-level groups open as layers named from `data-name`, else the id, also when one more group (a transform on all the art, a `<switch>`) wraps them, hidden ones hidden, and a file whose art sits loose under a root `<svg>` with an id (or `data-name`), as one-layer exports write it, opens with its one layer named from it; nested groups stay groups, except the sublayers VectorCraft writes, marked `data-vc-layer`, and Inkscape sublayers, which open as sublayers in their layer's colour: #372); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
-  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
+  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420; hidden objects written hidden on Save and `convert`, and `data-*` attributes kept as the objects' own data: #522; top-level groups open as layers named from `data-name`, else the id, also when one more group (a transform on all the art, a `<switch>`) wraps them, hidden ones hidden, and a file whose art sits loose under a root `<svg>` with an id (or `data-name`), as one-layer exports write it, opens with its one layer named from it; nested groups stay groups, except the sublayers VectorCraft writes, marked `data-vc-layer`, and Inkscape sublayers, which open as sublayers in their layer's colour: #372); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320). A masked CMYK image (`/SMask`, `/Mask` or a colour key) keeps its inks too, its alpha coming in as a greyscale opacity mask.
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
+  - Affinity documents in (AF.1–AF.3): `.af` (Affinity 3) and `.afdesign`/`.afphoto`/`.afpub` (Affinity 1 and 2, container versions 8–12) open and place as editable art: layers and sublayers, groups (pass-through or isolated), artboards (with their names and backgrounds) and Publisher pages side by side, curves with live corners, parametric shapes (rectangles with corner radii, ellipses, polygons, stars, pies, triangles, trapezoids), compound shapes, solid/linear/elliptical gradient fills and strokes (weight, dashes, alignment, scale-with-object), clipping by nesting, vector and pixel masks, artistic and frame text with fonts, sizes, tracking, leading and alignment, placed images (their original JPEG/PNG) and pixel layers (8/16-bit RGB, CMYK), opacity, visibility, locking and blend modes, at the document's resolution in points. Effects, adjustments, brushes and pressure profiles, transparency gradients, master pages, symbol instances (imported as their cached picture), special shapes (cloud, heart, cog…, imported as ellipses) and Affinity-only blend modes are named in the import warning. A file whose native data can't be read opens as its embedded preview with the reason, and that preview can't be placed. Save never writes back over the Affinity file and there is no Affinity export. 22 public CC0/MIT/Apache-2.0 files, pinned and sha256-verified (`cargo xtask corpus --affinity`), must render within a few levels of the thumbnails Affinity saved in them; [scope, provenance and limits](crates/affinity/README.md).
   - Placed documents: File › Place of a `.vectorcraft` file links to it by default (`file.place`'s `link`): one locked object showing an artboard of the document (or its art's bounds), read the way placing it without Link reads it, its symbols, patterns and images kept apart from the document's; without Link (or from bytes, not a file) it is an editable copy as before. It stays vectors in every output (SVG, PDF, EPS, EMF, DXF), and so do placed documents inside it, read from their own files up to 8 levels deep (documents that place each other stop there). On screen they draw from bitmaps cached per file and zoom step, shared by every copy and made in the background (a placeholder until ready), so a sheet of them redraws in about a millisecond; exports and prints draw them exactly. Like linked images, a save keeps only a preview of each (JPEG when opaque) unless Include Linked Files; output, and zooming past the preview, read the file again, falling back to the preview with a warning when it is gone or changed. Saves for older versions write them as plain art. Links check, update, relink, Update Links on open, Link Info (the artboard's size), Placement Options, Break Link (also Embed, Object › Expand: the editable copy placing without Link gives, its resources joining the document), Edit Original (the document in a new tab) and the Links panel cover them; saving a document updates the open documents that place it. The native format (v4) keeps data of 8 KB or more after the JSON instead of base64 in it.
   - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); on Linux the Paste menu checks the clipboard off the UI thread, so an X11 owner that never answers can't freeze the window (#510); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
@@ -171,10 +178,10 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 | # | Milestone | Status | Est. remaining, one agent (h) |
 |---|---|---|---|
 | M0 | Skeleton + vertical slice | ✅ done | — |
-| M1 | Selection, transform, layers, MCP | ✅ mostly done (transform reference point snaps to anchors/centres; rotated objects keep a rotated bounding box and their angle; Free Transform, Scale and Reflect along a rotated box pending) | 4–6 |
+| M1 | Selection, transform, layers, MCP (common command tools, strict keys, session resources and version-aware result hints) | ✅ mostly done (transform reference point snaps to anchors/centres; rotated objects keep a rotated bounding box and their angle; Free Transform, Scale and Reflect along a rotated box pending) | 4–6 |
 | M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging and per-corner radii and kinds landed, on any path's corners; Shaper rough-shape recognition and orientation steps, the remaining Pen modifier nuances; Shaper Groups with editable sources and separate fill/stroke edits landed; construction widget/refinements pending) | 12–18 |
 | M3 | Paint & appearance (swatches, color, gradient, stroke, appearance, transparency, styles) | ✅ done (M3.7–M3.98): swatches, groups, libraries, tints, Lab spots and Registration; Color Picker, Color panel, Color Guide, Color Themes, Edit Colors and Recolor Artwork; gradients that follow every transform, the annotator, linked stops, freeform gradients, focal points, gradients on strokes and Expand; stroke geometry, arrowheads, dashes fitted to corners, stroke on type, width profiles and the Width tool, Scale Strokes and preview bounds; Appearance targeting, container appearance, target circles, Expand Appearance; knockout, isolation, blend accuracy, CMYK blending, overprint, Attributes, masks and clipping, Flatten Transparency; graphic styles, links and libraries. Left: freeform and mixed spot/process gradients export as stops or process colours to SVG/PDF; confirm the Scale Strokes & Effects default | 4–8 |
-| M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info. Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, polish | 3–6 |
+| M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info; AF.1–AF.3 add Affinity import (native layers, artboards, vectors, text and images from Affinity 1–3 files; the embedded preview only as a warned fallback). Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, Affinity export, polish | 3–6 (existing scope; Affinity export unestimated) |
 | M5 | Performance | 🟡 background render + caches + MT done; `vectorcraft-cli bench` and `vectorcraft-cli perf` (budget suite); file format v2 opens 3× faster (50k paths: 722 → 244 ms); raster effects (glows, shadows, blur, feather) no longer force the whole frame single-threaded (filtered offscreen per effect, verified equal to the single-threaded reference); effect-heavy demos need a clean-machine benchmark; dirty-region rendering, GPU backend spike pending | 15–25 |
 | M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
 | M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, per-paragraph paragraph attributes, Area Type Options (with Width/Height, Auto Size and Shrink Text to Fit; overflow reported to agents and vertical Align), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, inline symbols in text (beyond parity), Hebrew/Arabic bidirectional text, Paragraph Direction, Every-line/Single-line Composer per object (ragged text too) done; tab leaders, spell check, vertical type pending | 45–60 |
@@ -182,7 +189,7 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
 | M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder and Color Adjustments; SVG Filters, Document Raster Effects Settings, 3D pending | 86–135 |
 | M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
 | M11 | Artboards & views (artboard panel/tool, Trim View, middle-button pan, print tiling and the status bar's artboard navigator done; multiple windows, presentation polish) | 🟡 | 15–25 |
-| M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (12 presets, 18 ms/1k² image), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, regenerate in place) done; graph Design/Column/Marker designs pending | 6–10 |
+| M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (13 presets, 18 ms/1k² image; the Flat Logo mode places edges to a fraction of a pixel, restores sharp corners, snaps lines and circles, and refuses gradients), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, regenerate in place) done; graph Design/Column/Marker designs pending | 6–10 |
 | M13 | Automation (Actions ✅ record/playback, persisted; variables, scripting, batch) | 🟡 | 18–27 |
 | M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs, menus that scroll when longer than the window and macOS native menu dismissal done (M14.8); an experimental, unsupported Windows 7 x64 portable OpenGL build (not verified by maintainers); accessibility and broader Windows/Linux packaging/QA pending | 18–28 |
 | — | Interaction fidelity pass (every tool's modifiers, Properties panel per context, isolation, nuance) | ⬜ | 60–90 |
@@ -210,20 +217,20 @@ about 1–1.5 agent-hours each, so the other rows (estimated on the older scale)
 | Strokes, brushes, width profiles | 5 | 88% | brush options depth, brush libraries (generated in code), brushes driven by pen tilt, bearing and barrel rotation (6D art pens) | 12–20 |
 | Appearance, transparency, graphic styles, masks | 5 | 98% | raster effect reach in preview bounds (flattener presets apply in PDF, EPS and print) | 1–2 |
 | Live vector effects | 5 | 85% | Outline Object, Pathfinder Hard/Soft Mix and Trap, SVG Filters | 6–10 |
-| Raster effects (Effect Gallery, Document Raster Effects Settings) | 4 | 20% | ~55 Photoshop-style filters (Artistic, Brush Strokes, Distort, Pixelate, Sketch, Stylize, Texture, Video) and the Effect Gallery; Document Raster Effects Settings and raster effects in PDF are done | 28–42 |
+| Raster effects (Effect Gallery, Document Raster Effects Settings) | 4 | 24% | ~52 Photoshop-style filters (Artistic, Brush Strokes, Distort, Pixelate, Sketch, Stylize, Texture, Video), Smart Blur's Edge Only / Overlay Edge modes and the Effect Gallery; Document Raster Effects Settings, raster effects in PDF, the pixel-filter pipeline, Radial Blur, Smart Blur and Unsharp Mask are done | 26–40 |
 | 3D and Materials | 4 | 0% | Extrude & Bevel, Revolve, Inflate, Rotate, lighting, materials (software renderer) | 50–80 |
 | Type core | 9 | 80% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); Hyphenation… and Justification… options (Every-line Composer for justified and ragged text, per object, is done; it is tuned by eye, not yet compared side by side with Illustrator; mixed type sizes in a paragraph still break single-line), Optical Margin Alignment, paragraph spacing limit for vertically justified area type, hidden characters, paragraph attributes in the Type tool's copy and paste (the characters keep their styles, the paragraphs take the destination's), mixed-value display in the Paragraph panel for a selection across differing paragraphs, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 14–19 |
-| Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), kinsoku sets and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support (beyond parity, not scored: inline symbols in text) | 20–28 |
+| Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), custom kinsoku sets (beyond Hard, Soft and None) and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support (beyond parity, not scored: inline symbols in text) | 20–28 |
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 88% | symbol libraries (original), dynamic symbols, envelope Anti-Alias/Preserve Shape output and warp point editing, brush interpolation in blends (M8 fidelity pass done) | 5–8 |
-| Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (an on-canvas crop box), Image Trace View modes (Outlines, Source Image), per-feature stroke/fill choice and varying widths in Create Strokes (Vector Halftone is done) | 6–10 |
-| Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard presets/rearrange polish (Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
+| Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (an on-canvas crop box), per-feature stroke/fill choice and varying widths in Image Trace's Create Strokes (Vector Halftone and the Image Trace View modes, Palette and Create Strokes are done) | 6–10 |
+| Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard preset polish (Rearrange All Artboards, Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
 | View & navigation | 3 | 70% | New View/Edit Views, multiple windows/arrange, Snap to Pixel/Glyph (print tiling is done) | 9–14 |
-| Guides, grids, smart guides, snapping, rulers | 3 | 84% | global/video rulers, Spacing Guides, Smart Guides' angle and distance readouts while drawing, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451; the drawing tools snapping, with Construction Guides, #506) | 2–4 |
-| File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
+| Guides, grids, smart guides, snapping, rulers | 3 | 85% | global/video rulers, Spacing Guides' distance readouts and spacing for resized or drawn art, Smart Guides' angle and distance readouts while drawing, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451; the drawing tools snapping, with Construction Guides, #506; Spacing Guides for moves, #394) | 2–4 |
+| File formats | 6 | 85% | Affinity export, and the rest of Affinity import (effects, adjustments, brushes, master pages, live symbol instances), DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the rest of Illustrator's editing data (area type and type on a path, appearances and live effects, symbols, pattern fills, brushes, placed files: #637), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers, presets and Affinity import are done | 6–10 (existing scope; Affinity export unestimated) |
 | Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
 | Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
 | Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
-| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | macOS native menu dismissal fixed (M14.8); remaining: Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 30 Preferences options stored but not yet acted on (#394: Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
+| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | macOS native menu dismissal fixed (M14.8); remaining: Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 20 Preferences options stored but not yet acted on (#394: Spacing Guides, Show Font Names in English, Highlight Alternate Glyphs, Display Print Size, Open Documents As Tabs, Real-time Drawing, hyphenation, Appearance of Black, devices…) | 14–22 |
 | Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done; placed VectorCraft documents are done (linked by default, vectors in every output, previews, Break Link, Expand, Edit Original, refresh on save) | 5–8 |
 | **Feature parity** | **103** | **~75%** | | **~210–330** |
 | Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |
@@ -236,14 +243,14 @@ With 4–6 agents working on disjoint crates (as the layering allows) the wall-c
 
 _Inventories (2026-10-07):_ 13 menu items still stubbed (`todo(…)` in `crates/ui-egui/src/menus.rs`); every tool
 implemented except Touch Type; 51 panel modules; Illustrator-style live
-effects ~44/54, Photoshop-style raster effects ~1/56, 3D 0/5; ~2,840 tests; ~221k lines of Rust.
+effects ~44/54, Photoshop-style raster effects ~4/56, 3D 0/5; ~2,840 tests; ~221k lines of Rust.
 
 _Where we already beat Illustrator:_ exact curve booleans, off-thread multithreaded rendering, undo that never runs out,
 lossless SVG/PDF export of live effects with SVG filters, a documented JSON format, the same app on the web, and every
 command, gesture and dialog drivable by agents (MCP, CLI, control channel).
 
 ## Out of scope (by design or by law)
-- **Native `.ai` private data:** it's undocumented. We read the PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+- **Native `.ai` private data, beyond its structure:** the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths, clipping groups and layer clipping, object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours), linear and radial gradients, opacity, blend modes, isolation and knockout, embedded images with their alpha channel, guides, and every artboard where it is. An object with several fills or strokes, effects or a brush comes in as its drawn look (a group named after it). Type that shows comes from the page, which draws it, into its text object's place (no group around it); type that doesn't (hidden layers and objects, art off the page) is made from the file's text document (characters, font, size, colour, alignment and where it is, for point type), and area type and type on a path in it are left out with a note. Symbols, pattern fills, placed files and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike); the page is used when they differ by more than 5%. A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 - **Adobe cloud services** (Libraries sync, Adobe Fonts, Firefly/generative): these are pluggable provider APIs, not built in.
 - **Adobe's bundled assets** (swatch/brush/symbol libraries, presets, icons): ours are original.
 

apps/vectorcraft-cli/src/main.rs

@@ -4,7 +4,7 @@
 //! vectorcraft-cli mcp [--connect 127.0.0.1:7979 | --headless]
 //! vectorcraft-cli run [--in FILE] [--cmd id [--params '{json}']]... [--export out.svg]... [--scale 2]
 //! vectorcraft-cli commands
-//! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text]
+//! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text] [--replace-lossy]
 //! vectorcraft-cli info FILE
 //! vectorcraft-cli bench FILE [--size 2880x1800] [--iters 5]
 //! vectorcraft-cli perf [--paths 50000]
@@ -71,12 +71,14 @@ USAGE:
   vectorcraft-cli commands
       Print the command catalogue as JSON.
 
-  vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text]
+  vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text] [--replace-lossy]
       Open IN (any readable format) and export OUT in the format its extension picks (see Writable
       formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
       unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
       Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
-      SVG's data-* attributes; --outline-text writes SVG text as paths.
+      SVG's data-* attributes; --outline-text writes SVG text as paths. OUT may not be IN when reading
+      IN left things out (hidden text, art or layers it could not read; the notes say which) unless
+      --replace-lossy is given.
 
   vectorcraft-cli info FILE
       Print a JSON summary: the import warnings (what didn't come in as it was, such as an EPS
@@ -173,7 +175,7 @@ fn commands() -> Result<(), String> {
 
 fn convert(args: &[String]) -> Result<(), String> {
     let mut files = vec![];
-    let (mut scale, mut artboard, mut range, mut outline_text) = (1.0f64, None::<u64>, None::<String>, false);
+    let (mut scale, mut artboard, mut range, mut outline_text, mut replace_lossy) = (1.0f64, None::<u64>, None::<String>, false, false);
     let mut it = args.iter();
     while let Some(a) = it.next() {
         match a.as_str() {
@@ -181,6 +183,7 @@ fn convert(args: &[String]) -> Result<(), String> {
             "--artboard" | "-a" => artboard = Some(it.next().and_then(|v| v.parse().ok()).ok_or("--artboard needs an index")?),
             "--range" | "-r" => range = Some(it.next().cloned().ok_or("--range needs artboards such as 1-3,5")?),
             "--outline-text" => outline_text = true,
+            "--replace-lossy" => replace_lossy = true,
             f => files.push(f.to_string()),
         }
     }
@@ -189,7 +192,7 @@ fn convert(args: &[String]) -> Result<(), String> {
     h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?;
     // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
     // PSD).
-    let params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true});
+    let params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
     let r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
     outln!("{r}");
     Ok(())

apps/vectorcraft-cli/tests/cli.rs

@@ -137,7 +137,7 @@ fn mcp_protocol_over_stdio() {
     assert!(r["result"]["completion"]["values"].as_array().is_some_and(|v| v.contains(&json!("svg"))), "{r}");
 
     send(&mut stdin, json!({"jsonrpc":"2.0","id":5,"method":"resources/list","params":{}}));
-    assert!(recv(&mut lines, &mut notes, 5)["result"]["resources"].as_array().is_some_and(|v| v.len() == 2));
+    assert!(recv(&mut lines, &mut notes, 5)["result"]["resources"].as_array().is_some_and(|v| v.len() == 3));
     send(&mut stdin, json!({"jsonrpc":"2.0","id":6,"method":"resources/templates/list","params":{}}));
     assert!(recv(&mut lines, &mut notes, 6)["result"]["resourceTemplates"].as_array().is_some_and(|v| v.len() >= 4));
 

apps/vectorcraft/src/gpu.rs

@@ -22,8 +22,9 @@ use std::sync::{Arc, OnceLock};
 use eframe::egui_wgpu::NativeAdapterSelectorMethod;
 use eframe::wgpu::{self, Backend, DeviceType, PowerPreference};
 
-/// The adapters a restart leaves out, those the window failed on, as comma-separated
-/// `backend:vendor:device` keys (`Vulkan:1002:164e`). Set by the app itself when it starts again.
+/// The adapters a restart leaves out, those the window failed on, as comma-separated [`key`]s
+/// (`Vulkan:1002:164e`, `Metal:Intel Iris Pro Graphics`). Set by the app itself when it starts
+/// again.
 pub const SKIP_ENV: &str = "VECTORCRAFT_GPU_SKIP";
 
 /// wgpu's variable for choosing an adapter by (part of) its name, any case.
@@ -36,7 +37,7 @@ const HELP: &str =
 /// Frames the UI ran before the failure, below which it was still starting up. The failure in
 /// #502 came on the first or second frame; later, the adapter has proved itself, and a lost
 /// window is something else (such as the compositor restarting).
-const STARTUP_FRAMES: u64 = 10;
+pub const STARTUP_FRAMES: u64 = 10;
 
 /// The preference used when Preferences say Automatic. Windows and macOS show frames from any GPU
 /// (the integrated one avoids the flicker of #306). Elsewhere, the system's own order: Mesa's
@@ -60,7 +61,7 @@ pub fn power_preference(pref: Option<&str>, env: Option<PowerPreference>) -> Pow
 /// One adapter, as [`adapter_order`] sees it.
 #[derive(Clone, Debug)]
 pub struct Candidate {
-    /// Identifies the adapter across a restart: `backend:vendor:device` ([`key`]).
+    /// Identifies the adapter across a restart ([`key`]).
     pub key: String,
     pub name: String,
     pub backend: Backend,
@@ -73,7 +74,7 @@ impl Candidate {
     fn new(adapter: &wgpu::Adapter, surface: Option<&wgpu::Surface<'_>>) -> Self {
         let info = adapter.get_info();
         Self {
-            key: key(info.backend, info.vendor, info.device),
+            key: key(info.backend, info.vendor, info.device, &info.name),
             presents: surface.is_none_or(|s| adapter.is_surface_supported(s)),
             name: info.name,
             backend: info.backend,
@@ -83,8 +84,15 @@ impl Candidate {
 }
 
 /// `backend:vendor:device`, e.g. `Vulkan:1002:164e` (PCI ids, as `MESA_VK_DEVICE_SELECT` takes them).
-fn key(backend: Backend, vendor: u32, device: u32) -> String {
-    format!("{backend:?}:{vendor:04x}:{device:04x}")
+/// Metal reports no ids (`0000:0000` for every GPU), so an adapter without them is `backend:name`
+/// (`Metal:Intel Iris Pro Graphics`): otherwise leaving out the one that failed would leave out
+/// every GPU of a dual-GPU Mac (#651). Commas, which separate [`SKIP_ENV`]'s keys, become spaces.
+fn key(backend: Backend, vendor: u32, device: u32, name: &str) -> String {
+    if vendor == 0 && device == 0 {
+        format!("{backend:?}:{}", name.replace(',', " ").trim())
+    } else {
+        format!("{backend:?}:{vendor:04x}:{device:04x}")
+    }
 }
 
 /// The order to try `candidates` in (their indices): only those that present to the window and
@@ -307,6 +315,27 @@ mod tests {
 
     /// A restart leaves out the adapter the window failed on, so Power Saving on the machine of
     /// #502 ends up on the NVIDIA GPU, and once every adapter failed there is nothing to try.
+    /// A dual-GPU Mac reports both GPUs under Metal with no PCI ids (#651): their keys still
+    /// differ, so when the integrated GPU fails, the restart renders on the discrete one.
+    #[test]
+    fn gpus_without_pci_ids_are_told_apart_by_name() {
+        let mac = |name: &str, device_type| Candidate {
+            key: key(Backend::Metal, 0, 0, name),
+            name: name.into(),
+            backend: Backend::Metal,
+            device_type,
+            presents: true,
+        };
+        let c = vec![mac("NVIDIA GeForce GT 750M", DeviceType::DiscreteGpu), mac("Intel Iris Pro Graphics", DeviceType::IntegratedGpu)];
+        assert_eq!((c[0].key.as_str(), c[1].key.as_str()), ("Metal:NVIDIA GeForce GT 750M", "Metal:Intel Iris Pro Graphics"));
+        let first = adapter_order(&c, PowerPreference::LowPower, None, &[]);
+        assert_eq!(names(&c, &first)[0], "Intel Iris Pro Graphics");
+        let skip = parse_skip(&c[first[0]].key);
+        assert_eq!(names(&c, &adapter_order(&c, PowerPreference::LowPower, None, &skip)), ["NVIDIA GeForce GT 750M"]);
+        // A comma in a name can't split the list.
+        assert_eq!(parse_skip(&key(Backend::Gl, 0, 0, "Mesa, llvmpipe")), ["Gl:Mesa  llvmpipe"]);
+    }
+
     #[test]
     fn a_restart_tries_the_next_adapter() {
         let c = issue_502();
@@ -433,8 +462,8 @@ mod tests {
     fn skipped_adapters_parse_from_a_comma_separated_list() {
         assert_eq!(parse_skip("Vulkan:1002:164e, Gl:10de:2f04,,"), ["Vulkan:1002:164e", "Gl:10de:2f04"]);
         assert!(parse_skip("").is_empty());
-        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e), "Vulkan:1002:164e");
-        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04), "Gl:10de:2f04");
+        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e, "AMD Radeon"), "Vulkan:1002:164e");
+        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04, "NVIDIA"), "Gl:10de:2f04");
     }
 
     #[test]

apps/vectorcraft/src/main.rs

@@ -43,10 +43,13 @@ struct App {
     graphics_loss: GraphicsLoss,
     /// The graphics device was lost and the unsaved changes are kept for Data Recovery.
     graphics_lost: bool,
+    /// Frames the UI has run (see [`end_before_teardown`]).
+    frames: u64,
 }
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        self.frames = ctx.cumulative_frame_nr();
         if let Some(why) = self.graphics_loss.take() {
             // eframe can't give a window a new device: the user saves and starts again.
             self.graphics_lost = self.app.graphics_lost(&why);
@@ -87,6 +90,7 @@ impl eframe::App for App {
     #[cfg(not(feature = "windows7"))]
     fn on_exit(&mut self) {
         save_prefs(&self.app);
+        end_before_teardown(self.frames);
     }
     #[cfg(feature = "windows7")]
     fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
@@ -94,6 +98,22 @@ impl eframe::App for App {
     }
 }
 
+/// On macOS with accessibility, end the process once the app has saved what it keeps on quitting,
+/// before eframe tears the window down (#661). AccessKit then gives the window's content view back
+/// its own class, which AppKit's Touch Bar support was observing it under, and AppKit aborts the
+/// app as it quits on Macs with a Touch Bar. Nothing after the window is needed on a normal quit.
+/// Not while the window is still starting up (`frames` below [`gpu::STARTUP_FRAMES`]): a graphics
+/// failure then starts the app again on another adapter (#651).
+#[allow(unused_variables)]
+fn end_before_teardown(frames: u64) {
+    #[cfg(all(target_os = "macos", feature = "accessibility", feature = "wgpu"))]
+    if frames >= gpu::STARTUP_FRAMES {
+        log::info!("quitting");
+        log::logger().flush();
+        std::process::exit(0);
+    }
+}
+
 /// Open files handed to the app (command line, macOS Finder and Dock) as documents. A file that
 /// can't be opened is reported in the status bar and on stderr; the others still open.
 fn open_files(app: &mut VectorcraftApp, files: Vec<String>) {
@@ -344,6 +364,18 @@ fn app_icon() -> egui::IconData {
     eframe::icon_data::from_png_bytes(png).unwrap_or_default()
 }
 
+/// Windows shows a window's big icon (`ICON_BIG`) in the taskbar and Alt+Tab; eframe sets only the
+/// small one (the title bar's), so the taskbar showed a generic icon. Set the big one too.
+#[cfg(windows)]
+fn set_taskbar_icon(w: &winit::window::Window) {
+    use winit::platform::windows::WindowExtWindows as _;
+    let icon = app_icon();
+    // An icon that can't be made leaves the generic one: nothing else depends on it.
+    if let Ok(i) = winit::window::Icon::from_rgba(icon.rgba, icon.width, icon.height) {
+        w.set_taskbar_icon(Some(i));
+    }
+}
+
 /// "name (backend, kind)" of the adapter the window renders with, for Help › About and bug reports.
 #[cfg(feature = "wgpu")]
 fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
@@ -423,6 +455,11 @@ fn main() -> std::process::ExitCode {
         // Only adapters that can show the window, in the order `gpu` gives (#306, #502).
         if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
             create.native_adapter_selector = Some(gpu::selector(power, startup.clone()));
+            // Nothing draws or dispatches indirectly, so wgpu's check of indirect arguments only
+            // costs a compute shader at start-up, one some drivers can't compile (OCLP-patched
+            // Metal on an Iris Pro, #651). `WGPU_VALIDATION_INDIRECT_CALL=1` turns it back on.
+            create.instance_descriptor.flags =
+                (eframe::wgpu::InstanceFlags::from_build_config() - eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL).with_env();
         }
         options
     };
@@ -444,6 +481,8 @@ fn main() -> std::process::ExitCode {
                 // Fit the window to its monitor, or put it back where it was (still hidden).
                 if let Some(w) = cc.winit_window() {
                     app.ui.window = Some(window::restore(w, saved_window));
+                    #[cfg(windows)]
+                    set_taskbar_icon(w);
                 }
                 // User Defined swatch and graphic style libraries live next to the preferences.
                 let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
@@ -490,7 +529,7 @@ fn main() -> std::process::ExitCode {
                 #[cfg(not(target_os = "macos"))]
                 let _ = in_window_menus;
                 open_files(&mut app, files);
-                Ok(Box::new(App { app, graphics_loss, graphics_lost: false }))
+                Ok(Box::new(App { app, graphics_loss, graphics_lost: false, frames: 0 }))
             }),
         )
     });

crates/affinity/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "vectorcraft-affinity"
+description = "Bounded reader for native Affinity documents: archive, object stream and document model"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[features]
+# Synthetic-container builders for tests and fuzz seeds; not an Affinity exporter.
+synth = []
+
+[dependencies]
+crc32fast = { workspace = true }
+flate2 = { workspace = true }
+ruzstd = "0.9"
+
+[dev-dependencies]
+proptest = { workspace = true }

crates/affinity/README.md

@@ -0,0 +1,123 @@
+# vectorcraft-affinity
+
+An independent, bounded Rust reader for native Affinity documents: `.af` from Affinity 3 and
+`.afdesign`, `.afphoto` and `.afpub` from Affinity 1 and 2 (container versions 8 to 12). It reads
+the archive, the tagged object stream in `doc.dat` and the part of the document model listed below,
+and hands the engine a document in pixels with every transform composed. It does not write
+Affinity files.
+
+## What is imported
+
+| Affinity | VectorCraft |
+|---|---|
+| Pages, Publisher spreads (one or two pages) | artboards, spreads side by side |
+| Artboards (`ShpN` with `ABEn`), with name, background fill, any transform | artboards plus a clip group with the background |
+| Layers (`Scop`), groups (`Grup`), pass-through or isolated | layers and sublayers, groups |
+| Curves (`PCrv`): cubic subpaths, closed flags, live corners (`CnrD`) | paths (multi-subpath curves fill even-odd) |
+| Rectangles with corner radii (relative or absolute), ellipses, polygons (smooth too), stars, square stars, pies, triangles, trapezoids | paths |
+| Compound shapes (`Comp`, add and subtract) | one even-odd path |
+| A shape or curve with children clips them | clip group whose clipping path keeps its fill (behind) and stroke (over) |
+| Vector masks (`AdCh` curves and shapes) | clip group |
+| Pixel masks (`MRst`, attached or as a layer in a group) | opacity mask |
+| Solid fills: RGBA, HSLA, CMYK, grey, Lab (D50) | fill appearance (alpha as fill opacity) |
+| Linear, elliptical and radial gradients with Affinity's midpoint bias | gradients (the bias as the midpoint where the blend is half way) |
+| Strokes: weight, scale with object, dash pattern and phase, alignment, miter limit, behind the fill | stroke appearance |
+| Fill layers (`FRst`) | filled rectangles |
+| Artistic and frame text: characters, font family/weight/style, size, tracking, fixed leading, colour, paragraph alignment, first baseline | point type and area type |
+| Placed images (`ImgN`): the original JPEG/PNG embedded in the file | embedded images |
+| Pixel layers (`Rstr`): RGBA 8/16-bit and CMYK 8-bit tiles, cropped to their content | embedded PNG images |
+| Embedded documents and symbols (`EmbN`) | the picture Affinity cached of them |
+| Opacity, visibility, lock, names, the blend modes VectorCraft has | the same |
+
+Everything else is reported in the import warnings, one line per kind with a count, never
+dropped silently: layer effects, adjustment layers and live filters, brush and pressure strokes,
+transparency gradients, fill opacity, bitmap fills, master pages, conical gradients (as radial),
+special shapes (cloud, heart, cog, callouts, arrows…, imported as their bounding ellipse), corner
+types other than round, stars with rounded points, several fills or strokes on one object (the
+active one is used), outlined or scaled text, text fields such as page numbers, frames with
+columns or a curved outline, grey/Lab/32-bit pixels, CMYK pixels (converted to RGB without the
+document's profile) and Affinity-only blend modes (Add, Linear Light… as Normal).
+
+When the native document can't be read at all, the engine opens the embedded PNG preview instead,
+with a warning that names the reason; that preview can't be placed, used as a template or mined
+for swatches and styles. Save never writes back over the Affinity file.
+
+## Provenance and clean-room
+
+Affinity has no published file-format specification, so this reader is built only from a public
+description of the format and from public files, never from Affinity itself. This is how the sibling app PhotoCraft already treats formats that
+are only partly documented:
+its PSD reader fills the gaps in Adobe's specification from the MIT-licensed psd-tools and
+ag-psd, and its camera raw decoder recovered Nikon's compression tables by black-box analysis
+of CC0 sample files.
+
+* **No Affinity software.** Affinity was never downloaded, installed, run, scripted, screenshotted or
+  disassembled for this work, and nothing from an Affinity installation (program code, resources,
+  presets, fonts, colour profiles) was read. No file was made with Affinity for it: every sample
+  is a document its author published.
+* **A public, permissively licensed description.** The container and object-stream layout was
+  learned from [VMDevCpp/afread](https://github.com/VMDevCpp/afread) (MIT, at
+  `04b672334a43e3e37ded6b5ffc57af231d589774`, written for container versions 7–11) and re-described
+  in our own words before this Rust code was written; no code was translated. No GPL/AGPL code (such
+  as Inkscape's Affinity extension) was read.
+* **Every structure checked against public files.** afread doesn't say how its author learned the
+  format, so nothing here rests on it alone: each structure the reader relies on is confirmed by
+  the public documents. Every archive entry carries a CRC-32 that must match, and every field in
+  the object stream names its own type, so a misread layout fails loudly instead of producing
+  plausible wrong data.
+* **Meaning fitted to Affinity's own pictures.** What shapes, paints, text and pixel data mean was
+  worked out by comparing our render with the thumbnail every Affinity document embeds (Affinity's
+  render of itself), on 176 public documents saved by Affinity 1.x, 2.x and 3.0/3.1 on Windows,
+  macOS and iPad. The collection has since grown to 189 distinct documents, and the reader opens
+  all of them. Most are published under CC0, MIT, BSD, Apache-2.0 or CC BY (-SA); the others
+  (no licence stated, or GPL or non-commercial terms) were only opened locally to compare
+  pictures, never committed or redistributed. The corpus test keeps the comparison for the pinned
+  files, which are CC0, MIT or Apache-2.0 only.
+* **Nothing of Affinity's is in this repository**: no program code, assets or documents. The test
+  files are fetched at pinned commits and sha256-verified, never committed.
+* **Read-only.** Nothing is written in Affinity's format; export waits until someone can check
+  written files in Affinity itself.
+
+The same reader is shared, as an independent copy, with PhotoCraft's `photocraft-affinity`.
+
+## Validation
+
+* Unit tests on synthetic containers built by the `synth` feature (stored, zlib and zstd entries,
+  checksums, budgets, cycles, hostile streams, every truncation) and property tests of random
+  mutations.
+* `cargo xtask corpus --affinity` fetches 22 public CC0/MIT/Apache-2.0 documents, including the
+  four Affinity 3 `.af` files of [samuel-etver/vector-art](https://github.com/samuel-etver/vector-art)
+  (CC0), at pinned commits, each checked against `xtask/affinity-corpus.sha256`. `tests/real_files.rs`
+  parses them; `engine/tests/affinity_corpus.rs` renders each one and compares it with the
+  thumbnail Affinity saved in it (mean difference 0–4.4 of 255 at the thumbnail's size, with a
+  ceiling per file).
+* `engine/tests/import_fuzz.rs` mutates a synthetic native document's stream and archive and checks
+  that whatever opens also renders and exports; `fuzz/` has `cargo-fuzz` targets for the whole
+  reader (`container`) and the object stream (`stream`):
+
+  ```sh
+  cd crates/affinity
+  cargo +nightly fuzz run stream -- -max_total_time=600
+  ```
+
+What has not been verified: files from Affinity builds or platforms outside the public set, files
+written by other applications, rotated or skewed images against Affinity's render, mask polarity
+against a render with and without the mask, and anything listed as a warning above. The `synth`
+builders write only what this reader accepts; Affinity has never opened their output, so they are
+test fixtures, not an exporter.
+
+## Safety limits
+
+Every size is checked before it is allocated: 256 MiB per archive entry and 1 GiB per import by
+default (`Limits`), a 64 MiB zstd window, 4096 saved revisions, array lengths no longer than the
+bytes left, 16 777 216 decoded values per document stream (fields and array elements together, counted before
+anything is allocated: a value takes about 40 bytes in memory however few it took in the file; the largest of
+those 189 public documents uses 3.3 million), 384 levels of object nesting, 128 levels of layers, 500 000 layers, four million curve
+nodes per curve, 64 megapixels per pixel layer (cropped to its content first) and 1024 gradient
+stops. Every archive entry's CRC-32 and size must match. Malformed input returns an `Error`; the
+crate has no panics outside tests.
+
+## Privacy
+
+Affinity documents can hold the folder they were saved in, user names, original image paths and
+XMP metadata. This reader never imports those fields.

crates/affinity/fuzz/.gitignore

@@ -0,0 +1,5 @@
+/target
+/corpus
+/artifacts
+/coverage
+/Cargo.lock

crates/affinity/fuzz/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "vectorcraft-affinity-fuzz"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+vectorcraft-affinity = { path = "..", features = ["synth"] }
+
+[[bin]]
+name = "container"
+path = "fuzz_targets/container.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "stream"
+path = "fuzz_targets/stream.rs"
+test = false
+doc = false
+bench = false
+
+[workspace]
+members = ["."]

crates/affinity/fuzz/fuzz_targets/container.rs

@@ -0,0 +1,10 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+// The whole native reader (archive, object stream, model) and the preview, on arbitrary bytes.
+fuzz_target!(|bytes: &[u8]| {
+    let _ = vectorcraft_affinity::container::header(bytes);
+    let _ = vectorcraft_affinity::preview(bytes);
+    let _ = vectorcraft_affinity::read(bytes, vectorcraft_affinity::Limits { max_entry: 16 << 20, max_total: 64 << 20 });
+});

crates/affinity/fuzz/fuzz_targets/stream.rs

@@ -0,0 +1,11 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+// The doc.dat object stream and the model built from it, wrapped in a stored archive entry so
+// mutations reach the tagged grammar instead of the archive's checksum.
+fuzz_target!(|stream: &[u8]| {
+    let _ = vectorcraft_affinity::stream::parse(stream);
+    let file = vectorcraft_affinity::synth::container(&[("doc.dat", stream, vectorcraft_affinity::synth::Method::Stored)], None);
+    let _ = vectorcraft_affinity::read(&file, vectorcraft_affinity::Limits { max_entry: 16 << 20, max_total: 64 << 20 });
+});

crates/affinity/src/access.rs

@@ -0,0 +1,105 @@
+//! Typed reads of [`Stream`] objects. Every accessor returns `None` when a field is missing or has
+//! another type, so the document mapping treats odd data as absent rather than failing.
+
+use crate::stream::{ObjId, Object, Stream, Tag, Value};
+
+impl Stream {
+    pub fn object(&self, id: ObjId) -> Option<&Object> {
+        self.objects.get(id)
+    }
+
+    pub fn field(&self, id: ObjId, tag: &[u8; 4]) -> Option<&Value> {
+        self.object(id)?.get(Tag::of(tag))
+    }
+
+    pub fn class(&self, id: ObjId) -> Option<Tag> {
+        self.object(id).map(|o| o.class)
+    }
+
+    pub fn is(&self, id: ObjId, class: &[u8; 4]) -> bool {
+        self.class(id) == Some(Tag::of(class))
+    }
+
+    /// A child object (shared, linked or inline); `None` for null or missing.
+    pub fn obj(&self, id: ObjId, tag: &[u8; 4]) -> Option<ObjId> {
+        match self.field(id, tag)? {
+            Value::Obj(o) => *o,
+            _ => None,
+        }
+    }
+
+    /// An array of objects (nulls skipped).
+    pub fn objs(&self, id: ObjId, tag: &[u8; 4]) -> Vec<ObjId> {
+        match self.field(id, tag) {
+            Some(Value::Array(a)) => a.iter().filter_map(|v| if let Value::Obj(Some(o)) = v { Some(*o) } else { None }).collect(),
+            _ => Vec::new(),
+        }
+    }
+
+    pub fn f64(&self, id: ObjId, tag: &[u8; 4]) -> Option<f64> {
+        match self.field(id, tag)? {
+            Value::Float(f) if f.is_finite() => Some(*f),
+            _ => None,
+        }
+    }
+
+    pub fn int(&self, id: ObjId, tag: &[u8; 4]) -> Option<i64> {
+        match self.field(id, tag)? {
+            Value::Int(i) => Some(*i),
+            Value::UInt(u) => i64::try_from(*u).ok(),
+            _ => None,
+        }
+    }
+
+    pub fn bool(&self, id: ObjId, tag: &[u8; 4]) -> Option<bool> {
+        match self.field(id, tag)? {
+            Value::Bool(b) => Some(*b),
+            _ => None,
+        }
+    }
+
+    pub fn str(&self, id: ObjId, tag: &[u8; 4]) -> Option<&str> {
+        match self.field(id, tag)? {
+            Value::Str(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    pub fn enumeration(&self, id: ObjId, tag: &[u8; 4]) -> Option<(u16, u16)> {
+        match self.field(id, tag)? {
+            Value::Enum { id, version } => Some((*id, *version)),
+            _ => None,
+        }
+    }
+
+    /// A fixed vector of `N` finite floats (points, rectangles, transforms).
+    pub fn floats<const N: usize>(&self, id: ObjId, tag: &[u8; 4]) -> Option<[f64; N]> {
+        match self.field(id, tag)? {
+            Value::Floats(v) if v.len() == N && v.iter().all(|f| f.is_finite()) => {
+                let mut a = [0.0; N];
+                a.copy_from_slice(v);
+                Some(a)
+            }
+            _ => None,
+        }
+    }
+
+    pub fn bytes(&self, id: ObjId, tag: &[u8; 4]) -> Option<&[u8]> {
+        match self.field(id, tag)? {
+            Value::Bytes(b) | Value::Blob(b) => Some(b),
+            _ => None,
+        }
+    }
+
+    pub fn entry(&self, id: ObjId, tag: &[u8; 4]) -> Option<&str> {
+        match self.field(id, tag)? {
+            Value::Entry(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    /// Untagged fields of a positional object, in order.
+    pub fn positional(&self, id: ObjId) -> impl Iterator<Item = &Value> {
+        self.object(id).into_iter().flat_map(|o| o.fields.iter().map(|(_, v)| v))
+    }
+}

crates/affinity/src/container.rs

@@ -0,0 +1,371 @@
+//! The Affinity archive: header, the chain of file allocation tables (one per save) and
+//! bounded, CRC-checked extraction of named entries such as `doc.dat` and raster tiles.
+
+use std::collections::{HashMap, HashSet};
+use std::io::Read;
+
+use crate::Error;
+
+pub const MAGIC: &[u8; 4] = b"\x00\xffKA";
+/// Oldest and newest container versions seen in real documents (Affinity 1.x writes 8,
+/// Affinity 3 writes 12). Version 7 is described by afread but no sample exists.
+pub const VERSIONS: std::ops::RangeInclusive<u16> = 8..=12;
+/// `Prsn` (stored byte-reversed): documents. Asset, brush and style libraries share the magic.
+const DOCUMENT_KIND: &[u8; 4] = b"nsrP";
+
+/// A save appends one table; real files have one to a few hundred.
+const MAX_TABLES: usize = 4096;
+/// zstd window ceiling: real documents use a few MiB; this stops a header from reserving gigabytes.
+const MAX_ZSTD_WINDOW: u64 = 64 << 20;
+
+/// Decompression budget for one import. Every entry declares its size, which is checked against
+/// these limits before anything is allocated, and the decoded length must match it exactly.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Limits {
+    /// Largest single entry (`doc.dat` or one tile).
+    pub max_entry: usize,
+    /// Total bytes extracted over the whole import.
+    pub max_total: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self { max_entry: 256 << 20, max_total: 1 << 30 }
+    }
+}
+
+/// The container header, all integers little-endian.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Header {
+    pub version: u16,
+    /// Seen as 0, 4 or 8 in real files; bits 0 and 1 mark container variants that are rejected.
+    pub flags: u16,
+    pub(crate) fat_offset: u64,
+    pub(crate) thumbnail_offset: u64,
+    /// Save time in Unix seconds, as written by the application.
+    pub saved: u32,
+}
+
+/// One FAT record, as of the newest table that mentions its id.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Entry {
+    pub id: u32,
+    pub name: String,
+    offset: u64,
+    size: u64,
+    compressed: u64,
+    crc: u32,
+    compression: u8,
+}
+
+impl Entry {
+    /// Decompressed size declared by the table.
+    pub fn size(&self) -> u64 {
+        self.size
+    }
+}
+
+#[derive(Debug)]
+pub struct Archive<'a> {
+    bytes: &'a [u8],
+    pub header: Header,
+    /// Head revision of every named, non-deleted entry.
+    entries: HashMap<String, Entry>,
+    /// Number of tables (saves) in the chain.
+    pub revisions: usize,
+    extracted: usize,
+    limits: Limits,
+}
+
+pub(crate) struct Cursor<'a> {
+    bytes: &'a [u8],
+    pub(crate) pos: usize,
+}
+
+impl<'a> Cursor<'a> {
+    pub(crate) fn new(bytes: &'a [u8], pos: usize) -> Self {
+        Self { bytes, pos }
+    }
+    pub(crate) fn remaining(&self) -> usize {
+        self.bytes.len().saturating_sub(self.pos)
+    }
+    pub(crate) fn take(&mut self, n: usize) -> Result<&'a [u8], Error> {
+        let end = self.pos.checked_add(n).ok_or(Error::Malformed("length overflow"))?;
+        let s = self.bytes.get(self.pos..end).ok_or(Error::Malformed("truncated data"))?;
+        self.pos = end;
+        Ok(s)
+    }
+    pub(crate) fn array<const N: usize>(&mut self) -> Result<[u8; N], Error> {
+        let s = self.take(N)?;
+        let mut a = [0u8; N];
+        a.copy_from_slice(s);
+        Ok(a)
+    }
+    pub(crate) fn u8(&mut self) -> Result<u8, Error> {
+        Ok(self.array::<1>()?[0])
+    }
+    pub(crate) fn u16(&mut self) -> Result<u16, Error> {
+        Ok(u16::from_le_bytes(self.array()?))
+    }
+    pub(crate) fn u32(&mut self) -> Result<u32, Error> {
+        Ok(u32::from_le_bytes(self.array()?))
+    }
+    pub(crate) fn u64(&mut self) -> Result<u64, Error> {
+        Ok(u64::from_le_bytes(self.array()?))
+    }
+}
+
+fn offset(v: u64) -> Result<usize, Error> {
+    usize::try_from(v).map_err(|_| Error::Malformed("offset beyond addressable memory"))
+}
+
+/// True when `bytes` start with the Affinity container signature (documents and libraries).
+pub fn is_affinity(bytes: &[u8]) -> bool {
+    bytes.starts_with(MAGIC)
+}
+
+/// Check the signature, version and document kind.
+pub fn header(bytes: &[u8]) -> Result<Header, Error> {
+    if !is_affinity(bytes) {
+        return Err(Error::Malformed("missing container signature"));
+    }
+    let mut c = Cursor::new(bytes, 4);
+    let version = c.u16()?;
+    let flags = c.u16()?;
+    if !VERSIONS.contains(&version) {
+        return Err(Error::Unsupported("unknown container version"));
+    }
+    if flags & 3 != 0 {
+        return Err(Error::Unsupported("container variant"));
+    }
+    if c.take(4)? != DOCUMENT_KIND {
+        return Err(Error::Unsupported("this Affinity file is a library (assets, brushes or styles), not a document"));
+    }
+    if c.take(4)? != b"#Inf" {
+        return Err(Error::Malformed("missing information header"));
+    }
+    let fat_offset = c.u64()?;
+    let thumbnail_offset = c.u64()?;
+    c.take(16)?;
+    let saved = u32::try_from(c.u64()?).unwrap_or(0);
+    c.take(8)?;
+    if c.take(4)? != b"Prot" {
+        return Err(Error::Malformed("missing protocol header"));
+    }
+    Ok(Header { version, flags, fat_offset, thumbnail_offset, saved })
+}
+
+impl<'a> Archive<'a> {
+    pub fn open(bytes: &'a [u8], limits: Limits) -> Result<Self, Error> {
+        let header = header(bytes)?;
+        // Newest record per id: (table date, table index, record).
+        let mut latest: HashMap<u32, (u64, usize, Option<Entry>)> = HashMap::new();
+        let mut names: HashMap<u32, String> = HashMap::new();
+        let mut seen = HashSet::new();
+        let mut next = header.fat_offset;
+        let mut tables = 0usize;
+        while next != 0 {
+            if !seen.insert(next) {
+                return Err(Error::Malformed("allocation tables form a cycle"));
+            }
+            tables += 1;
+            if tables > MAX_TABLES {
+                return Err(Error::Limit("too many saved revisions"));
+            }
+            let mut c = Cursor::new(bytes, offset(next)?);
+            let tag = c.array::<4>()?;
+            let level = match &tag {
+                b"#FAT" => 1,
+                b"#FT2" => 2,
+                b"#FT3" => 3,
+                b"#FT4" => 4,
+                _ => return Err(Error::Malformed("missing allocation table")),
+            };
+            next = c.u64()?;
+            let date = c.u64()?;
+            c.take(24)?;
+            let files = c.u32()?;
+            c.take(8)?;
+            let dirs = c.u16()?;
+            c.take(1)?;
+            for _ in 0..files {
+                let id = c.u32()?;
+                let flag = c.u8()?;
+                let mut record = None;
+                match flag {
+                    0 | 1 => {
+                        let offset = c.u64()?;
+                        let size = c.u64()?;
+                        let compressed = c.u64()?;
+                        let crc = c.u32()?;
+                        let stored = c.u8()?;
+                        if level >= 2 {
+                            c.take(4)?;
+                        }
+                        if level >= 4 {
+                            c.take(4)?;
+                        }
+                        // Old tables number the methods; newer ones store the method byte itself.
+                        let compression = if level <= 2 {
+                            match stored {
+                                1 => 0x01,
+                                2 => 0x41,
+                                3 => 0x81,
+                                4 => 0xC1,
+                                _ => 0,
+                            }
+                        } else {
+                            stored
+                        };
+                        record = Some(Entry { id, name: String::new(), offset, size, compressed, crc, compression });
+                    }
+                    2 => {}
+                    _ => return Err(Error::Malformed("unknown allocation record")),
+                }
+                if flag == 0 {
+                    let len = usize::from(c.u16()?);
+                    let name = String::from_utf8_lossy(c.take(len)?).into_owned();
+                    names.entry(id).or_insert(name);
+                }
+                // Equal dates: the first table in the chain (the newest) wins, as in afread.
+                let replace = latest.get(&id).is_none_or(|(d, _, _)| date > *d);
+                if replace {
+                    latest.insert(id, (date, tables, record));
+                }
+            }
+            for _ in 0..dirs {
+                let len = usize::from(c.u16()?);
+                c.take(10)?;
+                c.take(len)?;
+            }
+        }
+        let mut entries = HashMap::new();
+        for (id, (_, _, record)) in latest {
+            if let (Some(mut e), Some(name)) = (record, names.get(&id)) {
+                e.name = name.clone();
+                entries.insert(e.name.clone(), e);
+            }
+        }
+        Ok(Self { bytes, header, entries, revisions: tables, extracted: 0, limits })
+    }
+
+    pub fn entry(&self, name: &str) -> Option<&Entry> {
+        self.entries.get(name)
+    }
+
+    pub fn entry_names(&self) -> impl Iterator<Item = &str> {
+        self.entries.keys().map(String::as_str)
+    }
+
+    /// Bytes extracted so far, counted against [`Limits::max_total`].
+    pub fn extracted(&self) -> usize {
+        self.extracted
+    }
+
+    /// Extract an entry by name: decompress, undo the byte predictor and verify the CRC.
+    pub fn read(&mut self, name: &str) -> Result<Vec<u8>, Error> {
+        let e = self.entries.get(name).ok_or(Error::Malformed("missing archive entry"))?.clone();
+        let size = usize::try_from(e.size).map_err(|_| Error::Limit("archive entry too large"))?;
+        if size > self.limits.max_entry {
+            return Err(Error::Limit("archive entry too large"));
+        }
+        let total = self.extracted.checked_add(size).ok_or(Error::Limit("document too large"))?;
+        if total > self.limits.max_total {
+            return Err(Error::Limit("document too large"));
+        }
+        let mut c = Cursor::new(self.bytes, offset(e.offset)?);
+        if c.take(4)? != b"#Fil" {
+            return Err(Error::Malformed("archive entry has no data block"));
+        }
+        let method = e.compression & 3;
+        let stored_len = if matches!(method, 1 | 2) { e.compressed } else { e.size };
+        let data = c.take(offset(stored_len)?)?;
+        let mut out = match method {
+            1 => inflate(data, size)?,
+            2 => unzstd(data, size)?,
+            _ => data.to_vec(),
+        };
+        if out.len() != size {
+            return Err(Error::Malformed("archive entry size mismatch"));
+        }
+        unpredict(&mut out, e.compression)?;
+        if crc32fast::hash(&out) != e.crc {
+            return Err(Error::Malformed("archive entry checksum mismatch"));
+        }
+        self.extracted = total;
+        Ok(out)
+    }
+}
+
+/// Read at most `size + 1` bytes so a stream that decodes past its declared size is caught
+/// without unbounded allocation.
+fn read_bounded(mut r: impl Read, size: usize) -> Result<Vec<u8>, Error> {
+    let mut out = Vec::with_capacity(size.min(64 << 20));
+    let cap = u64::try_from(size).unwrap_or(u64::MAX).saturating_add(1);
+    r.by_ref().take(cap).read_to_end(&mut out).map_err(|_| Error::Malformed("corrupt compressed entry"))?;
+    Ok(out)
+}
+
+fn inflate(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
+    read_bounded(flate2::read::ZlibDecoder::new(data), size)
+}
+
+fn unzstd(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
+    let mut src = data;
+    let mut out = Vec::new();
+    // Entries may hold several concatenated frames.
+    while !src.is_empty() {
+        let left = size.checked_sub(out.len()).ok_or(Error::Malformed("archive entry size mismatch"))?;
+        let decoder = ruzstd::decoding::StreamingDecoder::new_with_max_window_size(&mut src, MAX_ZSTD_WINDOW)
+            .map_err(|_| Error::Malformed("corrupt compressed entry"))?;
+        let frame = read_bounded(decoder, left)?;
+        if frame.is_empty() {
+            return Err(Error::Malformed("corrupt compressed entry"));
+        }
+        out.extend_from_slice(&frame);
+        if out.len() > size {
+            return Err(Error::Malformed("archive entry size mismatch"));
+        }
+    }
+    Ok(out)
+}
+
+/// Undo the byte predictor selected by the high bits of the compression byte.
+fn unpredict(b: &mut [u8], compression: u8) -> Result<(), Error> {
+    match (compression & 0xC0, compression & 0x20 != 0) {
+        (0x00, _) => {}
+        (0x40, _) => byte_delta(b),
+        (0x80, false) => {
+            let mut prev = 0u16;
+            for pair in b.chunks_exact_mut(2) {
+                let v = u16::from_le_bytes([pair[0], pair[1]]).wrapping_add(prev);
+                pair.copy_from_slice(&v.to_le_bytes());
+                prev = v;
+            }
+        }
+        (0x80, true) => {
+            byte_delta(b);
+            // A 64 KiB tile of 16-bit samples is stored as all high bytes, then all low bytes.
+            if b.len() == 0x10000 {
+                let planes = b.to_vec();
+                let (hi, lo) = planes.split_at(0x8000);
+                for (i, out) in b.chunks_exact_mut(4).enumerate() {
+                    let (Some(h), Some(l)) = (hi.get(2 * i..2 * i + 2), lo.get(2 * i..2 * i + 2)) else {
+                        return Err(Error::Malformed("tile size"));
+                    };
+                    out.copy_from_slice(&[l[0], h[0], l[1], h[1]]);
+                }
+            }
+        }
+        _ => return Err(Error::Unsupported("archive entry predictor")),
+    }
+    Ok(())
+}
+
+fn byte_delta(b: &mut [u8]) {
+    let mut prev = 0u8;
+    for v in b {
+        *v = v.wrapping_add(prev);
+        prev = *v;
+    }
+}

crates/affinity/src/geometry.rs

@@ -0,0 +1,175 @@
+//! Outlines of curves (`PCvD` node lists), parametric shapes (`Shpe` objects) and compounds, in
+//! node space.
+
+use crate::model::{Affine, Path, Point, Reader, SubPath};
+use crate::stream::{ObjId, Tag, Value};
+
+/// Nodes per curve object.
+const MAX_NODES: usize = 4_000_000;
+
+/// The node-space outline of a curve, shape or compound node, and whether it fills even-odd.
+/// Instances (master-page or symbol copies) take the geometry of their master.
+pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> Option<(Path, bool)> {
+    let s = r.s;
+    match &class.0.to_be_bytes() {
+        b"PCrv" | b"TxtC" => {
+            let crvs = s.obj(id, b"Crvs").or_else(|| s.obj(id, b"MCrM").and_then(|m| s.obj(m, b"Crvs")))?;
+            let path = curves(r, crvs)?;
+            let multi = path.subpaths.len() > 1;
+            Some((path, multi))
+        }
+        b"Comp" => {
+            // One path of all the operands' contours in the compound's space, filled even-odd: this
+            // matches add and subtract operands in every public sample; a true union of overlapping
+            // added operands would differ.
+            let mut path = Path::default();
+            for c in s.objs(id, b"Chld") {
+                let local = s.floats::<6>(c, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+                let class = s.class(c)?;
+                if s.enumeration(c, b"ComO").is_some_and(|(op, _)| op != 0 && op != 2) {
+                    r.warn("compound shapes that intersect or exclude (imported as add)");
+                }
+                if let Some((p, _)) = outline(r, c, class, local.then(world)) {
+                    path.subpaths.extend(p.transformed(local).subpaths);
+                }
+            }
+            Some((path, true))
+        }
+        _ => {
+            let (shape, box_owner) = match s.obj(id, b"Shpe") {
+                Some(sh) => (sh, id),
+                None => {
+                    let master = s.obj(id, b"ShpM")?;
+                    (s.obj(master, b"Shpe")?, master)
+                }
+            };
+            let b = s.floats::<4>(box_owner, b"ShpB")?;
+            crate::shapes::shape(r, shape, b, world).map(|p| (p, false))
+        }
+    }
+}
+
+/// `PCvD.Data`: positional `[u8, u32 count, then per subpath: bool closed, 18-byte records]`.
+/// A record is (f64 x, f64 y, u8 kind, u8 role): role 0 is an anchor, 1 the out-handle of the
+/// anchor before it, 2 the in-handle of the anchor after it. A closed subpath repeats its first
+/// anchor at the end. `CnrD` live corners are rounded on the stored polyline.
+pub(crate) fn curves(r: &mut Reader, crvs: ObjId) -> Option<Path> {
+    let s = r.s;
+    let data = s.obj(crvs, b"Data")?;
+    let mut fields = s.positional(data);
+    fields.next()?;
+    let count = match fields.next()? {
+        Value::UInt(n) => usize::try_from(*n).ok()?,
+        _ => return None,
+    };
+    let corners = s.obj(crvs, b"CnrD").and_then(|c| corner_radii(s.positional(c).collect()));
+    let mut path = Path::default();
+    let mut seen = 0usize;
+    for index in 0..count {
+        let closed = match fields.next()? {
+            Value::Bool(b) => *b,
+            _ => return None,
+        };
+        let Value::Array(records) = fields.next()? else { return None };
+        seen = seen.checked_add(records.len())?;
+        if seen > MAX_NODES {
+            r.warn("curves with more than four million nodes");
+            return None;
+        }
+        let anchors = anchors(records)?;
+        let radii = if index == 0 { corners.as_ref() } else { None };
+        if let Some(sp) = subpath(&anchors, closed, radii) {
+            path.subpaths.push(sp);
+        }
+    }
+    if corners.is_some() && count > 1 {
+        r.warn("rounded corners on curves with several subpaths (only the first is rounded)");
+    }
+    Some(path)
+}
+
+struct Anchor {
+    p: Point,
+    inh: Option<Point>,
+    out: Option<Point>,
+    /// Index of the anchor's record (live corners refer to records).
+    record: usize,
+}
+
+fn record(v: &Value) -> Option<(Point, u8)> {
+    let Value::Bytes(b) = v else { return None };
+    if b.len() != 18 {
+        return None;
+    }
+    let x = f64::from_le_bytes(b.get(0..8)?.try_into().ok()?);
+    let y = f64::from_le_bytes(b.get(8..16)?.try_into().ok()?);
+    if !x.is_finite() || !y.is_finite() {
+        return None;
+    }
+    Some((Point { x, y }, *b.get(17)?))
+}
+
+fn anchors(records: &[Value]) -> Option<Vec<Anchor>> {
+    let mut out: Vec<Anchor> = Vec::with_capacity(records.len() / 3 + 1);
+    let mut pending_in = None;
+    for (i, v) in records.iter().enumerate() {
+        let (p, role) = record(v)?;
+        match role {
+            0 => {
+                out.push(Anchor { p, inh: pending_in.take(), out: None, record: i });
+            }
+            1 => {
+                // A leading out-handle without an anchor is edit state only.
+                if let Some(a) = out.last_mut() {
+                    a.out = Some(p);
+                }
+            }
+            2 => pending_in = Some(p),
+            _ => return None,
+        }
+    }
+    Some(out)
+}
+
+fn subpath(anchors: &[Anchor], closed: bool, radii: Option<&Vec<(usize, f64)>>) -> Option<SubPath> {
+    let first = anchors.first()?;
+    if let Some(radii) = radii.filter(|r| !r.is_empty()) {
+        let corner = |a: &Anchor| radii.iter().filter(|(rec, _)| *rec == a.record).map(|(_, r)| *r).fold(0.0, f64::max);
+        let polyline = anchors.iter().all(|a| a.inh.is_none_or(|h| h == a.p) && a.out.is_none_or(|h| h == a.p));
+        if polyline {
+            let mut pts: Vec<(Point, f64)> = anchors.iter().map(|a| (a.p, corner(a))).collect();
+            // A closed subpath repeats its first anchor; its radius may be on either copy.
+            if closed
+                && pts.len() > 1
+                && pts.first().map(|p| p.0) == pts.last().map(|p| p.0)
+                && let Some((_, r)) = pts.pop()
+                && let Some(f) = pts.first_mut()
+            {
+                f.1 = f.1.max(r);
+            }
+            return Some(crate::shapes::fillet(&pts, closed));
+        }
+    }
+    let segments = anchors
+        .windows(2)
+        .filter_map(|w| {
+            let [a, b] = w else { return None };
+            Some([a.out.unwrap_or(a.p), b.inh.unwrap_or(b.p), b.p])
+        })
+        .collect();
+    Some(SubPath { start: first.p, segments, closed })
+}
+
+/// `CnrD`: positional `[u8, i32[] record indices, f64[] radii, u8[] types]`.
+fn corner_radii(fields: Vec<&Value>) -> Option<Vec<(usize, f64)>> {
+    let (Some(Value::Array(idx)), Some(Value::Array(rad))) = (fields.get(1), fields.get(2)) else { return None };
+    Some(
+        idx.iter()
+            .zip(rad)
+            .filter_map(|(i, r)| match (i, r) {
+                (Value::Int(i), Value::Float(r)) if r.is_finite() && *r > 0.0 => Some((usize::try_from(*i).ok()?, *r)),
+                _ => None,
+            })
+            .collect(),
+    )
+}

crates/affinity/src/lib.rs

@@ -0,0 +1,51 @@
+//! Reader for native Affinity documents (`.af`, and `.afdesign`/`.afphoto`/`.afpub` from
+//! Affinity 1 and 2): the archive container, the tagged object stream in `doc.dat`, and the
+//! subset of the document model VectorCraft imports.
+//!
+//! Layouts follow the MIT-licensed afread reference and were checked against public documents
+//! saved by Affinity 1.x to 3.x (container versions 8 to 12); see the crate README for provenance
+//! and the exact supported subset. Nothing here writes Affinity files.
+#![forbid(unsafe_code)]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use std::fmt;
+
+mod access;
+pub mod container;
+mod geometry;
+pub mod model;
+pub mod paint;
+pub mod preview;
+mod raster;
+mod shapes;
+pub mod stream;
+#[cfg(any(test, feature = "synth"))]
+pub mod synth;
+mod text;
+
+pub use container::{Archive, Limits, MAGIC, is_affinity};
+pub use model::{Document, read};
+pub use preview::{MAX_PREVIEW_BYTES, MAX_PREVIEW_DIMENSION, Preview, preview};
+
+/// Why a file could not be read. Messages are short reasons; callers add advice.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Error {
+    Malformed(&'static str),
+    Unsupported(&'static str),
+    Limit(&'static str),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Malformed(s) => write!(f, "damaged Affinity file: {s}"),
+            Self::Unsupported(s) => write!(f, "unsupported Affinity file: {s}"),
+            Self::Limit(s) => write!(f, "Affinity file exceeds a safety limit: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+#[cfg(test)]
+mod tests;

crates/affinity/src/model.rs

@@ -0,0 +1,594 @@
+//! The document model VectorCraft imports: spreads, artboards, layers, groups, curves, shapes,
+//! text and images, with transforms composed into document space. Anything else is reported
+//! by [`Document::warnings`] instead of being dropped silently.
+
+use std::collections::{BTreeMap, HashSet};
+
+use crate::paint::{self, Paint, Stroke};
+use crate::stream::{ObjId, Stream, Tag};
+use crate::{Archive, Error, Limits, stream};
+
+/// Affine map `x' = a·x + c·y + e`, `y' = b·x + d·y + f` (kurbo's coefficient order).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Affine(pub [f64; 6]);
+
+impl Affine {
+    pub const IDENTITY: Self = Self([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
+
+    /// Affinity's `Xfrm`, stored row by row: (a, c, e, b, d, f).
+    pub(crate) fn from_xfrm(m: [f64; 6]) -> Self {
+        Self([m[0], m[3], m[1], m[4], m[2], m[5]])
+    }
+
+    pub fn then(self, outer: Self) -> Self {
+        let [a, b, c, d, e, f] = self.0;
+        let [oa, ob, oc, od, oe, of] = outer.0;
+        Self([oa * a + oc * b, ob * a + od * b, oa * c + oc * d, ob * c + od * d, oa * e + oc * f + oe, ob * e + od * f + of])
+    }
+
+    pub fn apply(&self, p: Point) -> Point {
+        let [a, b, c, d, e, f] = self.0;
+        Point { x: a * p.x + c * p.y + e, y: b * p.x + d * p.y + f }
+    }
+
+    /// Geometric mean of the axis scales: how much a stroke width or font size grows.
+    pub fn scale(&self) -> f64 {
+        let [a, b, c, d, ..] = self.0;
+        (a * d - b * c).abs().sqrt()
+    }
+
+    pub fn is_finite(&self) -> bool {
+        self.0.iter().all(|v| v.is_finite())
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Point {
+    pub x: f64,
+    pub y: f64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Rect {
+    pub x0: f64,
+    pub y0: f64,
+    pub x1: f64,
+    pub y1: f64,
+}
+
+/// One cubic Bézier subpath, in document pixels.
+#[derive(Debug, Clone, PartialEq)]
+pub struct SubPath {
+    pub start: Point,
+    /// (control 1, control 2, end) per segment.
+    pub segments: Vec<[Point; 3]>,
+    pub closed: bool,
+}
+
+/// An outline in document pixels.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct Path {
+    pub subpaths: Vec<SubPath>,
+}
+
+impl Path {
+    pub fn transformed(&self, m: Affine) -> Self {
+        Self {
+            subpaths: self
+                .subpaths
+                .iter()
+                .map(|s| SubPath {
+                    start: m.apply(s.start),
+                    segments: s.segments.iter().map(|seg| seg.map(|p| m.apply(p))).collect(),
+                    closed: s.closed,
+                })
+                .collect(),
+        }
+    }
+}
+
+/// Affinity's blend modes, numbered by the `Blnd` enum.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum Blend {
+    #[default]
+    Normal,
+    PassThrough,
+    Darken,
+    DarkerColor,
+    Multiply,
+    ColorBurn,
+    Lighten,
+    LighterColor,
+    Screen,
+    ColorDodge,
+    Add,
+    Overlay,
+    SoftLight,
+    HardLight,
+    VividLight,
+    PinLight,
+    LinearLight,
+    HardMix,
+    Difference,
+    Exclusion,
+    Subtract,
+    Hue,
+    Saturation,
+    Luminosity,
+    Color,
+    Average,
+    Negation,
+    Reflect,
+    Glow,
+    Erase,
+}
+
+impl Blend {
+    /// The enum (id, version) pairs observed in a document whose layers are named after their mode.
+    fn from_enum(id: u16, version: u16) -> Option<Self> {
+        use Blend::*;
+        Some(match (id, version) {
+            (0, _) => Normal,
+            (1, 0) => Darken,
+            (2, 1) => DarkerColor,
+            (2, 0) => Multiply,
+            (3, 0) => ColorBurn,
+            (4, 0) => Lighten,
+            (6, 1) => LighterColor,
+            (5, 0) => Screen,
+            (6, 0) => ColorDodge,
+            (7, 0) => Add,
+            (8, 0) => Overlay,
+            (9, 0) => SoftLight,
+            (10, 0) => HardLight,
+            (11, 0) => VividLight,
+            (12, 0) => PinLight,
+            (15, 1) => LinearLight,
+            (13, 0) => HardMix,
+            (14, 0) => Difference,
+            (15, 0) => Exclusion,
+            (16, 0) => Subtract,
+            (17, 0) => Hue,
+            (18, 0) => Saturation,
+            (19, 0) => Luminosity,
+            (20, 0) => Color,
+            (21, 0) => Average,
+            (22, 0) => Negation,
+            (23, 0) => Reflect,
+            (24, 0) => Glow,
+            (25, 0) => Erase,
+            _ => return None,
+        })
+    }
+}
+
+/// A run of text with one set of character attributes.
+#[derive(Debug, Clone, PartialEq)]
+pub struct TextRun {
+    pub text: String,
+    /// PostScript name and family of the chosen font.
+    pub postscript: String,
+    pub family: String,
+    /// CSS weight (400 regular, 700 bold).
+    pub weight: i64,
+    pub italic: bool,
+    /// Font size in document pixels, before the node's transform.
+    pub size: f64,
+    /// Tracking in em.
+    pub tracking: f64,
+    /// Fixed line pitch in document pixels, when the run overrides automatic leading.
+    pub leading: Option<f64>,
+    pub fill: Paint,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Align {
+    Left,
+    Center,
+    Right,
+    Justify,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Text {
+    pub runs: Vec<TextRun>,
+    pub align: Align,
+    /// Artistic text: the first baseline's anchor point in node space (start, centre or end of the
+    /// line according to `align`). Frame text: the frame box in node space.
+    pub anchor: Point,
+    pub frame: Option<Rect>,
+    /// Node space to document pixels.
+    pub transform: Affine,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Pixels {
+    /// Straight-alpha RGBA, 8 bits per channel, row by row.
+    Rgba8(Vec<u8>),
+    /// The original file a placed image was made from (PNG, JPEG…), as embedded.
+    Encoded(Vec<u8>),
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Image {
+    pub width: u32,
+    pub height: u32,
+    pub pixels: Pixels,
+    /// Pixel space (0..w, 0..h) to document pixels.
+    pub transform: Affine,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Kind {
+    /// Layer container (`Scop`).
+    Layer,
+    Group,
+    /// Artboard: a rectangle that clips its children; `background` paints behind them.
+    Artboard {
+        rect: Rect,
+        background: Vec<Paint>,
+    },
+    /// Curve, parametric shape or compound shape: an outline with its fills and strokes.
+    /// Children of a shape are clipped by its outline (painted over its fills, under its strokes).
+    Shape {
+        path: Path,
+        fills: Vec<Paint>,
+        strokes: Vec<Stroke>,
+        even_odd: bool,
+    },
+    Text(Text),
+    Image(Image),
+    /// Something this reader does not import; its children are still imported.
+    Unsupported,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Node {
+    pub class: Tag,
+    pub name: String,
+    pub visible: bool,
+    pub locked: bool,
+    pub opacity: f64,
+    pub blend: Blend,
+    pub kind: Kind,
+    /// Vector mask in document pixels: the node shows only inside it (nonzero fill).
+    pub mask: Option<Path>,
+    /// Pixel mask: grey levels (white shows the node, black hides it); outside it the node is hidden.
+    pub pixel_mask: Option<Image>,
+    /// Bottom to top.
+    pub children: Vec<Node>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Spread {
+    /// Spread bounds in document pixels (the canvas, or the union of the artboards).
+    pub bounds: Rect,
+    /// Pages of a Publisher-style spread (one, or two facing pages), in document pixels.
+    pub pages: Vec<Rect>,
+    /// Transparent background; otherwise the page is white.
+    pub transparent: bool,
+    /// Bottom to top.
+    pub nodes: Vec<Node>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Document {
+    /// Pixels per inch: all geometry is in document pixels at this resolution.
+    pub dpi: f64,
+    pub spreads: Vec<Spread>,
+    /// Application that last saved the file, as stored (`Affinity 3.0.2`), when present.
+    pub saved_by: Option<String>,
+    /// Content that was not imported or was approximated, one line per kind, deduplicated.
+    pub warnings: Vec<String>,
+}
+
+/// Deepest layer nesting followed; deeper content is reported, not imported.
+const MAX_TREE_DEPTH: usize = 128;
+/// Total layer nodes imported.
+const MAX_NODES: usize = 500_000;
+
+/// Read a document: archive, `doc.dat` and the model.
+pub fn read(bytes: &[u8], limits: Limits) -> Result<Document, Error> {
+    let mut archive = Archive::open(bytes, limits)?;
+    let doc = archive.read("doc.dat")?;
+    let s = stream::parse(&doc)?;
+    Reader::new(&s, &mut archive).document()
+}
+
+pub(crate) struct Reader<'s, 'a, 'b> {
+    pub(crate) s: &'s Stream,
+    pub(crate) archive: &'b mut Archive<'a>,
+    pub(crate) dpi: f64,
+    warnings: BTreeMap<String, usize>,
+    nodes: usize,
+    active: HashSet<ObjId>,
+}
+
+impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
+    fn new(s: &'s Stream, archive: &'b mut Archive<'a>) -> Self {
+        Self { s, archive, dpi: 72.0, warnings: BTreeMap::new(), nodes: 0, active: HashSet::new() }
+    }
+
+    pub(crate) fn warn(&mut self, what: impl Into<String>) {
+        *self.warnings.entry(what.into()).or_default() += 1;
+    }
+
+    fn document(mut self) -> Result<Document, Error> {
+        let s = self.s;
+        let root = s.root;
+        self.dpi = s.obj(root, b"UVCn").and_then(|u| s.f64(u, b"UPPI")).filter(|d| *d > 0.0 && *d < 100_000.0).unwrap_or(72.0);
+        let saved_by = s.obj(root, b"NVer").map(|v| {
+            let product = s.str(v, b"Prod").unwrap_or("Affinity");
+            match (s.int(v, b"Majr"), s.int(v, b"Minr"), s.int(v, b"Bild")) {
+                (Some(a), Some(b), Some(c)) => format!("{product} {a}.{b}.{c}"),
+                _ => product.to_string(),
+            }
+        });
+        let doc = s.obj(root, b"DocR").ok_or(Error::Malformed("document has no root node"))?;
+        let mut spreads = Vec::new();
+        for spread in s.objs(doc, b"Chld") {
+            if !s.is(spread, b"Sprd") {
+                self.warn("an unknown kind of page");
+                continue;
+            }
+            let pages = pages(s, spread);
+            let default_size =
+                s.floats::<2>(doc, b"DfSz").filter(|[w, h]| *w > 0.0 && *h > 0.0).map(|[w, h]| Rect { x0: 0.0, y0: 0.0, x1: w, y1: h });
+            let bounds = s.floats::<4>(spread, b"SprB").map(rect).or_else(|| pages.iter().copied().reduce(union)).or(default_size).unwrap_or(Rect {
+                x0: 0.0,
+                y0: 0.0,
+                x1: 0.0,
+                y1: 0.0,
+            });
+            let transparent = s.bool(spread, b"SprT").unwrap_or(false);
+            let (nodes, mask) = self.children(spread, Affine::IDENTITY, 0)?;
+            if mask.is_some() {
+                self.warn("mask layers directly on a page (imported without them)");
+            }
+            spreads.push(Spread { bounds, pages, transparent, nodes });
+        }
+        if spreads.is_empty() {
+            return Err(Error::Malformed("document has no pages"));
+        }
+        if !s.objs(doc, b"MpCh").is_empty() {
+            self.warn("master pages (their content is not placed on the pages that use them)");
+        }
+        let warnings = self.warnings.into_iter().map(|(w, n)| if n > 1 { format!("{w} ({n}×)") } else { w }).collect();
+        Ok(Document { dpi: self.dpi, spreads, saved_by, warnings })
+    }
+
+    /// The children of `parent`, and the pixel mask a mask layer among them puts on the parent.
+    fn children(&mut self, parent: ObjId, world: Affine, depth: usize) -> Result<(Vec<Node>, Option<Image>), Error> {
+        let s = self.s;
+        let mut out = Vec::new();
+        let mut mask = None;
+        for c in s.objs(parent, b"Chld") {
+            if s.is(c, b"MRst") {
+                // A mask layer inside a group or layer masks that container.
+                if s.bool(c, b"Visi") == Some(false) {
+                    continue;
+                }
+                let local = s.floats::<6>(c, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+                match crate::raster::mask(self, c, local.then(world))? {
+                    Some(m) if mask.is_none() => mask = Some(m),
+                    Some(_) => self.warn("several pixel masks on one layer (only the first is used)"),
+                    None => {}
+                }
+                continue;
+            }
+            if let Some(n) = self.node(c, world, depth + 1)? {
+                out.push(n);
+            }
+        }
+        Ok((out, mask))
+    }
+
+    fn node(&mut self, id: ObjId, parent: Affine, depth: usize) -> Result<Option<Node>, Error> {
+        let s = self.s;
+        if depth > MAX_TREE_DEPTH {
+            self.warn("layers nested deeper than 128 levels");
+            return Ok(None);
+        }
+        self.nodes += 1;
+        if self.nodes > MAX_NODES {
+            return Err(Error::Limit("too many layers"));
+        }
+        // A node that contains itself (a shared object linked back into its own subtree).
+        if !self.active.insert(id) {
+            self.warn("a layer that contains itself");
+            return Ok(None);
+        }
+        let local = s.floats::<6>(id, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+        let world = local.then(parent);
+        let class = s.class(id).unwrap_or(Tag(0));
+        let name = s.str(id, b"Desc").unwrap_or_default().to_string();
+        let visible = s.bool(id, b"Visi").unwrap_or(true);
+        let locked = s.bool(id, b"Edtb").is_some_and(|e| !e);
+        let opacity = s.f64(id, b"Opac").map_or(1.0, |o| o.clamp(0.0, 1.0));
+        let blend = match s.enumeration(id, b"Blnd") {
+            None if s.bool(id, b"PasT") != Some(false) && is_container(class) => Blend::PassThrough,
+            None => Blend::Normal,
+            Some((i, v)) => Blend::from_enum(i, v).unwrap_or_else(|| {
+                self.warn("an unknown blend mode (imported as Normal)");
+                Blend::Normal
+            }),
+        };
+        let kind = if !world.is_finite() {
+            self.warn("a layer with an invalid transform");
+            Kind::Unsupported
+        } else {
+            self.kind(id, class, world, parent)?
+        };
+        // A compound's children are its operands, already merged into its outline.
+        let (children, child_mask) = if class == Tag::of(b"Comp") { (Vec::new(), None) } else { self.children(id, world, depth)? };
+        let (mask, attached_mask) = self.attached_masks(id, world)?;
+        let pixel_mask = attached_mask.or(child_mask);
+        self.active.remove(&id);
+        if s.objs(id, b"FiEf").iter().any(|e| s.bool(*e, b"Enab") != Some(false)) {
+            self.warn("layer effects (shadows, glows, outlines, bevels…)");
+        }
+        Ok(Some(Node { class, name, visible, locked, opacity, blend, kind, mask, pixel_mask, children }))
+    }
+
+    fn kind(&mut self, id: ObjId, class: Tag, world: Affine, parent: Affine) -> Result<Kind, Error> {
+        let s = self.s;
+        Ok(match &class.0.to_be_bytes() {
+            b"Scop" => Kind::Layer,
+            b"Grup" => Kind::Group,
+            b"PCrv" | b"ShpN" | b"Comp" | b"SNEN" | b"SNRR" | b"ShRN" => {
+                if class == Tag::of(b"ShpN") && s.bool(id, b"ABEn") == Some(true) {
+                    return Ok(self.artboard(id, world));
+                }
+                let Some((local, even_odd)) = crate::geometry::outline(self, id, class, world) else {
+                    self.warn(format!("a {} that could not be read", describe(class)));
+                    return Ok(Kind::Unsupported);
+                };
+                let (fills, strokes) = paint::node_paint(self, id, world);
+                Kind::Shape { path: local.transformed(world), fills, strokes, even_odd }
+            }
+            b"TxtA" | b"TxtF" | b"TxtC" => match crate::text::read(self, id, world) {
+                Some(t) => Kind::Text(t),
+                None => {
+                    self.warn("text whose story could not be read (master-page text, or an unknown layout)");
+                    Kind::Unsupported
+                }
+            },
+            b"ImgN" | b"Rstr" => match crate::raster::node_image(self, id, world)? {
+                Some(img) => Kind::Image(img),
+                None => Kind::Unsupported,
+            },
+            b"EmbN" => match crate::raster::embedded(self, id, world)? {
+                Some(img) => {
+                    self.warn("embedded documents and symbols (imported as pictures of them)");
+                    Kind::Image(img)
+                }
+                None => {
+                    self.warn("embedded documents and symbols without a cached picture");
+                    Kind::Unsupported
+                }
+            },
+            b"FRst" => {
+                // A fill layer paints its whole bitmap area; its gradient lives in page space.
+                let b = s.obj(id, b"Bitm");
+                let size = |t: &[u8; 4]| b.and_then(|b| s.int(b, t)).map(|v| v as f64).filter(|v| *v > 0.0);
+                match (size(b"BmpW"), size(b"BmpH")) {
+                    (Some(w), Some(h)) => {
+                        let local = Path { subpaths: vec![crate::shapes::rectangle(0.0, 0.0, w, h)] };
+                        let fills = paint::fills(self, id, parent, b"BFFl");
+                        Kind::Shape { path: local.transformed(world), fills, strokes: Vec::new(), even_odd: false }
+                    }
+                    _ => {
+                        self.warn("fill layers without an area");
+                        Kind::Unsupported
+                    }
+                }
+            }
+            _ => {
+                self.warn(format!("{} layers", describe(class)));
+                Kind::Unsupported
+            }
+        })
+    }
+
+    /// Vector shapes attached to a node (`AdCh`) mask it: it shows only inside their outlines;
+    /// an attached mask layer is a pixel mask. Adjustments attached the same way are reported.
+    fn attached_masks(&mut self, id: ObjId, world: Affine) -> Result<(Option<Path>, Option<Image>), Error> {
+        let s = self.s;
+        let attached = s.objs(id, b"AdCh");
+        let mut mask: Option<Path> = None;
+        let mut pixels: Option<Image> = None;
+        for a in attached {
+            let class = s.class(a).unwrap_or(Tag(0));
+            if s.bool(a, b"Visi") == Some(false) {
+                continue;
+            }
+            if class == Tag::of(b"PCrv") || class == Tag::of(b"ShpN") || class == Tag::of(b"Comp") {
+                let local = s.floats::<6>(a, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY).then(world);
+                if let Some((p, _)) = crate::geometry::outline(self, a, class, local) {
+                    mask.get_or_insert_with(Path::default).subpaths.extend(p.transformed(local).subpaths);
+                }
+            } else if class == Tag::of(b"MRst") {
+                let local = s.floats::<6>(a, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY).then(world);
+                match crate::raster::mask(self, a, local)? {
+                    Some(m) if pixels.is_none() => pixels = Some(m),
+                    Some(_) => self.warn("several pixel masks on one layer (only the first is used)"),
+                    None => {}
+                }
+            } else {
+                self.warn(format!("{} layers attached to other layers (imported without them)", describe(class)));
+            }
+        }
+        Ok((mask, pixels))
+    }
+
+    fn artboard(&mut self, id: ObjId, world: Affine) -> Kind {
+        let s = self.s;
+        let b = s.floats::<4>(id, b"ShpB").map(rect).unwrap_or(Rect { x0: 0.0, y0: 0.0, x1: 0.0, y1: 0.0 });
+        let corners =
+            [Point { x: b.x0, y: b.y0 }, Point { x: b.x1, y: b.y0 }, Point { x: b.x1, y: b.y1 }, Point { x: b.x0, y: b.y1 }].map(|p| world.apply(p));
+        let [a, b2, c, d, ..] = world.0;
+        if b2.abs() > 1e-9 || c.abs() > 1e-9 || a <= 0.0 || d <= 0.0 {
+            self.warn("a rotated or flipped artboard (imported at its bounding box)");
+        }
+        let xs = corners.map(|p| p.x);
+        let ys = corners.map(|p| p.y);
+        let rect = Rect {
+            x0: xs.iter().copied().fold(f64::INFINITY, f64::min),
+            y0: ys.iter().copied().fold(f64::INFINITY, f64::min),
+            x1: xs.iter().copied().fold(f64::NEG_INFINITY, f64::max),
+            y1: ys.iter().copied().fold(f64::NEG_INFINITY, f64::max),
+        };
+        let background = paint::fills(self, id, world, b"BFFl");
+        Kind::Artboard { rect, background }
+    }
+}
+
+/// Page rectangles: `SpMd.PagR[].rctp` (Publisher 2, Affinity 3) or `SprB` split into `PagC`
+/// equal pages (Publisher 1 facing spreads).
+fn pages(s: &Stream, spread: ObjId) -> Vec<Rect> {
+    if let Some(md) = s.obj(spread, b"SpMd") {
+        let v: Vec<Rect> =
+            s.objs(md, b"PagR").into_iter().filter_map(|p| s.floats::<4>(p, b"rctp").map(rect)).filter(|r| r.x1 > r.x0 && r.y1 > r.y0).collect();
+        if !v.is_empty() {
+            return v;
+        }
+    }
+    match (s.floats::<4>(spread, b"SprB").map(rect), s.int(spread, b"PagC")) {
+        (Some(b), Some(n @ 2..=16)) => {
+            let w = (b.x1 - b.x0) / n as f64;
+            (0..n).map(|i| Rect { x0: b.x0 + w * i as f64, x1: b.x0 + w * (i + 1) as f64, ..b }).collect()
+        }
+        _ => Vec::new(),
+    }
+}
+
+pub(crate) fn union(a: Rect, b: Rect) -> Rect {
+    Rect { x0: a.x0.min(b.x0), y0: a.y0.min(b.y0), x1: a.x1.max(b.x1), y1: a.y1.max(b.y1) }
+}
+
+fn is_container(class: Tag) -> bool {
+    class == Tag::of(b"Scop") || class == Tag::of(b"Grup")
+}
+
+pub(crate) fn rect(v: [f64; 4]) -> Rect {
+    Rect { x0: v[0], y0: v[1], x1: v[2], y1: v[3] }
+}
+
+/// A readable name for a layer class in warnings.
+pub(crate) fn describe(class: Tag) -> &'static str {
+    match &class.0.to_be_bytes() {
+        b"PCrv" => "curve",
+        b"ShpN" | b"SNEN" | b"SNRR" | b"ShRN" => "shape",
+        b"Comp" => "compound",
+        b"Rstr" => "pixel",
+        b"ImgN" => "image",
+        b"EmbN" => "embedded document",
+        b"MPIN" => "master page instance",
+        b"FRst" => "fill",
+        b"MRst" => "mask",
+        b"Slic" | b"SlcP" => "slice",
+        b"3DLA" => "3D",
+        [_, _, b'R', b'A'] => "adjustment",
+        _ => "unknown",
+    }
+}

crates/affinity/src/paint.rs

@@ -0,0 +1,329 @@
+//! Fills, strokes and colours. Two schemas exist: Affinity 1 (`BFil` fill, `PFil` stroke paint,
+//! `LSty` stroke style) and Affinity 2/3 (`BFFl`, `LIFl` and `LILn` lists with a current index).
+
+use crate::model::{Affine, Reader};
+use crate::stream::{ObjId, Value};
+
+/// A colour as stored: RGB and grey values are encoded in the document's RGB space (sRGB unless
+/// the document embeds another profile), CMYK values go through its CMYK profile. Alpha is straight.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Color {
+    Rgb {
+        r: f64,
+        g: f64,
+        b: f64,
+        a: f64,
+    },
+    Cmyk {
+        c: f64,
+        m: f64,
+        y: f64,
+        k: f64,
+        a: f64,
+    },
+    Gray {
+        v: f64,
+        a: f64,
+    },
+    /// CIE L*a*b* (D50).
+    Lab {
+        l: f64,
+        a: f64,
+        b: f64,
+        alpha: f64,
+    },
+}
+
+impl Color {
+    pub fn alpha(&self) -> f64 {
+        match self {
+            Color::Rgb { a, .. } | Color::Cmyk { a, .. } | Color::Gray { a, .. } => *a,
+            Color::Lab { alpha, .. } => *alpha,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum GradientKind {
+    Linear,
+    /// Elliptical and radial: distance from the centre in unit space.
+    Radial,
+    /// Angle around the centre.
+    Conical,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Stop {
+    pub offset: f64,
+    pub color: Color,
+    /// Affinity's midpoint bias for the segment from this stop to the next (0.5 = even blend).
+    pub bias: f64,
+}
+
+impl Stop {
+    /// Where, between this stop (0) and the next (1), the blend reaches half way: the bias curve
+    /// fitted to Affinity's renders is `t^k` (bias ≥ 0.5) or `1-(1-t)^k`, with `k = 1 + 8·|bias-0.5|`.
+    pub fn half_point(&self) -> f64 {
+        let k = 1.0 + 8.0 * (self.bias - 0.5).abs();
+        let h = 0.5f64.powf(1.0 / k);
+        if self.bias >= 0.5 { h } else { 1.0 - h }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Gradient {
+    pub kind: GradientKind,
+    pub stops: Vec<Stop>,
+    /// Unit space to document pixels: linear runs from unit (0,0) to (1,0); radial is the unit
+    /// circle; conical starts along unit +x and turns towards unit +y.
+    pub transform: Affine,
+}
+
+#[derive(Debug, Clone, PartialEq, Default)]
+pub enum Paint {
+    #[default]
+    None,
+    Solid(Color),
+    Gradient(Gradient),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Cap {
+    Butt,
+    Round,
+    Square,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Join {
+    Miter,
+    Round,
+    Bevel,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Align {
+    Center,
+    Inside,
+    Outside,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Stroke {
+    pub paint: Paint,
+    /// Width in document pixels.
+    pub width: f64,
+    pub cap: Cap,
+    pub join: Join,
+    pub miter_limit: f64,
+    pub align: Align,
+    /// Dash and gap lengths in document pixels, and the phase.
+    pub dash: Option<(Vec<f64>, f64)>,
+    /// Painted below the fill instead of above it.
+    pub behind: bool,
+}
+
+/// Gradient stops per gradient.
+const MAX_STOPS: usize = 1024;
+
+fn floats(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Floats(f) => Some(f.clone()),
+        Value::Bytes(b) if b.len() % 4 == 0 => Some(b.chunks_exact(4).map(|c| f64::from(f32::from_le_bytes([c[0], c[1], c[2], c[3]]))).collect()),
+        _ => None,
+    }
+}
+
+/// A colour object (`RGBA`, `HSLA`, `CMYK`, `GRAY`, `LABA`, `Pant`).
+pub(crate) fn color(r: &mut Reader, id: ObjId) -> Option<Color> {
+    let s = r.s;
+    let class = s.class(id)?;
+    let col = || -> Option<Vec<f64>> {
+        let v = floats(s.field(id, b"_col")?)?;
+        v.iter().all(|f| f.is_finite()).then_some(v)
+    };
+    Some(match &class.0.to_be_bytes() {
+        b"RGBA" => {
+            let v = col()?;
+            Color::Rgb { r: *v.first()?, g: *v.get(1)?, b: *v.get(2)?, a: v.get(3)?.clamp(0.0, 1.0) }
+        }
+        b"HSLA" => {
+            let v = col()?;
+            let (r2, g, b) = hsl(*v.first()?, *v.get(1)?, *v.get(2)?);
+            Color::Rgb { r: r2, g, b, a: v.get(3)?.clamp(0.0, 1.0) }
+        }
+        b"CMYK" => {
+            let v = col()?;
+            Color::Cmyk { c: *v.first()?, m: *v.get(1)?, y: *v.get(2)?, k: *v.get(3)?, a: v.get(4)?.clamp(0.0, 1.0) }
+        }
+        b"GRAY" => {
+            let v = col()?;
+            Color::Gray { v: *v.first()?, a: v.get(1)?.clamp(0.0, 1.0) }
+        }
+        b"LABA" => {
+            let b = s.bytes(id, b"_col")?;
+            let u = |i: usize| -> Option<f64> { Some(f64::from(u16::from_le_bytes([*b.get(2 * i)?, *b.get(2 * i + 1)?])) / 65535.0) };
+            Color::Lab { l: 100.0 * u(0)?, a: 255.0 * u(1)? - 128.0, b: 255.0 * u(2)? - 128.0, alpha: u(3)? }
+        }
+        b"Pant" => {
+            r.warn("spot colours (imported as their RGB equivalent)");
+            return s.obj(id, b"srgb").and_then(|c| color(r, c)).or_else(|| s.obj(id, b"base").and_then(|c| color(r, c)));
+        }
+        b"RegC" => Color::Cmyk { c: 1.0, m: 1.0, y: 1.0, k: 1.0, a: 1.0 },
+        _ => {
+            r.warn("colours in an unknown model");
+            return None;
+        }
+    })
+}
+
+fn hsl(h: f64, s: f64, l: f64) -> (f64, f64, f64) {
+    let c = (1.0 - (2.0 * l - 1.0).abs()) * s;
+    let hp = (h.rem_euclid(1.0)) * 6.0;
+    let x = c * (1.0 - (hp % 2.0 - 1.0).abs());
+    let (r, g, b) = match hp as u32 {
+        0 => (c, x, 0.0),
+        1 => (x, c, 0.0),
+        2 => (0.0, c, x),
+        3 => (0.0, x, c),
+        4 => (x, 0.0, c),
+        _ => (c, 0.0, x),
+    };
+    let m = l - c / 2.0;
+    (r + m, g + m, b + m)
+}
+
+/// A fill descriptor (`FDsc`) or, in Affinity 1 files, a bare `FilS`; `local` maps the node's
+/// space to document pixels.
+pub(crate) fn descriptor(r: &mut Reader, id: ObjId, local: Affine) -> Option<Paint> {
+    let s = r.s;
+    let (fill, unit) = if s.is(id, b"FDsc") {
+        let unit = s.floats::<6>(id, b"FDeX").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
+        (s.obj(id, b"FDeF")?, unit)
+    } else {
+        (id, Affine::IDENTITY)
+    };
+    match &s.class(fill)?.0.to_be_bytes() {
+        b"FilN" => Some(Paint::None),
+        b"FilS" => Some(Paint::Solid(color(r, s.obj(fill, b"Colr")?)?)),
+        b"FilG" => {
+            let kind = match s.enumeration(fill, b"Type").map(|(i, _)| i) {
+                Some(0) | None => GradientKind::Linear,
+                Some(1 | 2) => GradientKind::Radial,
+                Some(3) => GradientKind::Conical,
+                Some(_) => {
+                    r.warn("gradients of an unknown kind (imported as linear)");
+                    GradientKind::Linear
+                }
+            };
+            let grad = s.obj(fill, b"Grad")?;
+            let cols = s.objs(grad, b"Cols");
+            let posn: Vec<Vec<f64>> = match s.field(grad, b"Posn") {
+                Some(Value::Array(a)) => a.iter().filter_map(floats).collect(),
+                _ => Vec::new(),
+            };
+            let mut stops = Vec::new();
+            for (c, p) in cols.iter().zip(&posn).take(MAX_STOPS) {
+                let color = color(r, *c)?;
+                let offset = p.first().copied().filter(|v| v.is_finite()).unwrap_or(0.0).clamp(0.0, 1.0);
+                let bias = p.get(1).copied().filter(|v| v.is_finite()).unwrap_or(0.5).clamp(0.0, 1.0);
+                stops.push(Stop { offset, color, bias });
+            }
+            if stops.is_empty() {
+                return Some(Paint::None);
+            }
+            Some(Paint::Gradient(Gradient { kind, stops, transform: unit.then(local) }))
+        }
+        b"FilB" => {
+            r.warn("bitmap and pattern fills (left empty)");
+            Some(Paint::None)
+        }
+        _ => {
+            r.warn("fills of an unknown kind (left empty)");
+            Some(Paint::None)
+        }
+    }
+}
+
+fn current(r: &Reader, id: ObjId, list: &[u8; 4], index: &[u8; 4]) -> Option<ObjId> {
+    let items = r.s.objs(id, list);
+    let i = r.s.int(id, index).and_then(|i| usize::try_from(i).ok()).unwrap_or(0);
+    items.get(i).or_else(|| items.first()).copied()
+}
+
+/// The fills of `list` (artboard backgrounds use `BFFl`).
+pub(crate) fn fills(r: &mut Reader, id: ObjId, local: Affine, list: &[u8; 4]) -> Vec<crate::paint::Paint> {
+    let d = current(r, id, list, b"BFCr").or_else(|| r.s.obj(id, b"BFil"));
+    d.and_then(|d| descriptor(r, d, local)).filter(|p| *p != Paint::None).into_iter().collect()
+}
+
+/// A node's fill and stroke. `local` maps the node's space to document pixels.
+pub(crate) fn node_paint(r: &mut Reader, id: ObjId, local: Affine) -> (Vec<Paint>, Vec<Stroke>) {
+    let s = r.s;
+    let fills = fills(r, id, local, b"BFFl");
+    if r.s.objs(id, b"BFFl").len() > 1 || r.s.objs(id, b"LIFl").len() > 1 {
+        r.warn("several fills or strokes on one object (only the active one is imported)");
+    }
+    if s.f64(id, b"FOpc").is_some_and(|o| o < 0.999) {
+        r.warn("fill opacity (imported at full fill opacity)");
+    }
+    if s.obj(id, b"Trns").is_some() {
+        r.warn("transparency gradients (imported without them)");
+    }
+    let (pen, style) = if s.field(id, b"LIFl").is_some() {
+        (current(r, id, b"LIFl", b"LICr"), current(r, id, b"LILn", b"LICr"))
+    } else {
+        (s.obj(id, b"PFil"), s.obj(id, b"LSty"))
+    };
+    let behind = matches!(s.field(id, b"DrwO"), Some(Value::Array(a)) if a.first() == Some(&Value::Enum { id: 1, version: 0 }));
+    let stroke = match (pen, style) {
+        (Some(pen), Some(style)) => stroke(r, pen, style, local, behind),
+        _ => None,
+    };
+    (fills, stroke.into_iter().collect())
+}
+
+fn stroke(r: &mut Reader, pen: ObjId, ldsc: ObjId, local: Affine, behind: bool) -> Option<Stroke> {
+    let s = r.s;
+    let paint = descriptor(r, pen, local)?;
+    if paint == Paint::None {
+        return None;
+    }
+    let lsty = if s.is(ldsc, b"LDsc") { s.obj(ldsc, b"LDeL")? } else { ldsc };
+    let weight = s.f64(lsty, b"Wght").filter(|w| *w > 0.0 && *w < 1e7)?;
+    // "Scale with object": the weight follows the object's transform; otherwise it is absolute.
+    let scales = s.bool(ldsc, b"LDSc").unwrap_or(true);
+    let width = if scales { weight * local.scale() } else { weight };
+    let data = s.bytes(lsty, b"Data").unwrap_or_default();
+    let miter_limit = data.get(0..8).and_then(|b| b.try_into().ok()).map(f64::from_le_bytes).filter(|m| m.is_finite() && *m >= 1.0).unwrap_or(4.0);
+    // Cap and join bytes are only partly understood: (0, 0) is butt/miter in every clean sample;
+    // (2, 2) ends plain lines square and brush lines round; joins import round, which never
+    // looks wrong.
+    let (cap, join) = match (data.get(8).copied(), data.get(9).copied(), data.get(10).copied()) {
+        (Some(0), Some(0), _) => (Cap::Butt, Join::Miter),
+        (Some(0), Some(_), _) => (Cap::Butt, Join::Round),
+        (Some(2), Some(2), Some(3)) => (Cap::Round, Join::Round),
+        (Some(2), Some(2), _) => (Cap::Square, Join::Round),
+        _ => (Cap::Round, Join::Round),
+    };
+    let align = match s.int(ldsc, b"LDSa") {
+        Some(1) => Align::Inside,
+        Some(2) => Align::Outside,
+        _ => Align::Center,
+    };
+    let dash = match s.field(lsty, b"Patn") {
+        Some(Value::Array(a)) if data.get(10) == Some(&2) || !a.is_empty() => {
+            let mut v: Vec<f64> = a.iter().filter_map(|x| if let Value::Float(f) = x { Some(*f) } else { None }).collect();
+            while v.len() >= 2 && v.iter().rev().take(2).all(|x| *x == 0.0) {
+                v.truncate(v.len() - 2);
+            }
+            let valid = !v.is_empty() && v.iter().all(|x| x.is_finite() && *x >= 0.0) && v.iter().any(|x| *x > 0.0);
+            valid.then(|| (v.iter().map(|x| x * width).collect(), s.f64(lsty, b"Phse").unwrap_or(0.0) * width))
+        }
+        _ => None,
+    };
+    if s.obj(lsty, b"Brus").is_some() || s.obj(ldsc, b"LDeP").is_some() {
+        r.warn("brush and pressure strokes (imported as plain strokes)");
+    }
+    Some(Stroke { paint, width, cap, join, miter_limit, align, dash, behind })
+}

crates/affinity/src/preview.rs

@@ -0,0 +1,127 @@
+//! The indexed PNG thumbnail Affinity stores next to the archive: Affinity's own render of the
+//! document, at most 512 pixels on the long side in real files, never the document itself.
+
+use crate::Error;
+use crate::container::header;
+
+pub const MAX_PREVIEW_BYTES: usize = 16 << 20;
+pub const MAX_PREVIEW_DIMENSION: u32 = 4096;
+
+/// Borrowed embedded thumbnail, at its own dimensions, never the native document dimensions.
+#[derive(Debug)]
+pub struct Preview<'a> {
+    pub png: &'a [u8],
+    pub width: u32,
+    pub height: u32,
+}
+
+fn bytes_at(bytes: &[u8], offset: usize, length: usize) -> Result<&[u8], Error> {
+    let end = offset.checked_add(length).ok_or(Error::Malformed("offset overflow"))?;
+    bytes.get(offset..end).ok_or(Error::Malformed("truncated record"))
+}
+
+fn le32(bytes: &[u8], offset: usize) -> Result<u32, Error> {
+    let b = bytes_at(bytes, offset, 4)?;
+    Ok(u32::from_le_bytes(b.try_into().map_err(|_| Error::Malformed("integer"))?))
+}
+
+fn be32(bytes: &[u8], offset: usize) -> Result<u32, Error> {
+    let b = bytes_at(bytes, offset, 4)?;
+    Ok(u32::from_be_bytes(b.try_into().map_err(|_| Error::Malformed("PNG integer"))?))
+}
+
+/// Read only the indexed `Thmb` record (identical in container versions 8 to 12), checking every PNG chunk CRC. Compressed
+/// pixels must still be validated by the consuming image decoder, with allocation limits.
+pub fn preview(bytes: &[u8]) -> Result<Preview<'_>, Error> {
+    let h = header(bytes)?;
+    if h.thumbnail_offset == 0 {
+        return Err(Error::Unsupported("no embedded preview"));
+    }
+    let offset = usize::try_from(h.thumbnail_offset).map_err(|_| Error::Malformed("thumbnail offset overflow"))?;
+    if offset < 72 {
+        return Err(Error::Malformed("thumbnail overlaps the file header"));
+    }
+    let record = bytes.get(offset..).ok_or(Error::Malformed("thumbnail offset outside file"))?;
+    if bytes_at(record, 0, 8)? != b"\xff\xff\xff\xffThmb" {
+        return Err(Error::Malformed("missing indexed thumbnail"));
+    }
+    if le32(record, 8)? != 1 || bytes_at(record, 28, 1)? != [1] {
+        return Err(Error::Unsupported("thumbnail record version or encoding"));
+    }
+    let size = usize::try_from(le32(record, 24)?).map_err(|_| Error::Limit("encoded size"))?;
+    if size > MAX_PREVIEW_BYTES {
+        return Err(Error::Limit("encoded preview exceeds 16 MiB"));
+    }
+    if le32(record, 16)? != 29 || le32(record, 20)? != 0 || u64::from(le32(record, 12)?) != size as u64 + 13 {
+        return Err(Error::Malformed("inconsistent thumbnail record lengths"));
+    }
+    let png = bytes_at(record, 29, size)?;
+    if bytes_at(png, 0, 8)? != b"\x89PNG\r\n\x1a\n" || be32(png, 8)? != 13 || bytes_at(png, 12, 4)? != b"IHDR" {
+        return Err(Error::Malformed("thumbnail is not a PNG"));
+    }
+    let width = be32(png, 16)?;
+    let height = be32(png, 20)?;
+    if width == 0 || height == 0 || width > MAX_PREVIEW_DIMENSION || height > MAX_PREVIEW_DIMENSION {
+        return Err(Error::Limit("preview dimensions must be 1..4096"));
+    }
+    // Bound work by bytes, not a file-supplied chunk count, and require exactly one complete PNG.
+    let mut pos = 8usize;
+    let (mut palette, mut image_data, mut image_data_ended) = (false, false, false);
+    loop {
+        let length = usize::try_from(be32(png, pos)?).map_err(|_| Error::Limit("PNG chunk length"))?;
+        let chunk_size = length.checked_add(12).ok_or(Error::Malformed("PNG chunk overflow"))?;
+        let chunk = bytes_at(png, pos, chunk_size)?;
+        let checksum_input = bytes_at(chunk, 4, chunk_size - 8)?;
+        if crc32fast::hash(checksum_input) != be32(chunk, chunk_size - 4)? {
+            return Err(Error::Malformed("PNG chunk checksum"));
+        }
+        let kind = bytes_at(chunk, 4, 4)?;
+        if !kind.iter().all(u8::is_ascii_alphabetic) {
+            return Err(Error::Malformed("PNG chunk type"));
+        }
+        match kind {
+            b"IHDR" if pos == 8 => {}
+            b"IHDR" => return Err(Error::Malformed("duplicate PNG header")),
+            b"PLTE" => {
+                if palette || image_data {
+                    return Err(Error::Malformed("PNG palette order"));
+                }
+                palette = true;
+            }
+            b"IDAT" => {
+                if image_data_ended {
+                    return Err(Error::Malformed("non-contiguous PNG image data"));
+                }
+                image_data = true;
+            }
+            b"IEND" => {
+                if !image_data {
+                    return Err(Error::Malformed("PNG has no image data"));
+                }
+            }
+            _ if kind.first().is_some_and(u8::is_ascii_uppercase) => {
+                return Err(Error::Unsupported("unknown critical PNG chunk"));
+            }
+            _ => {}
+        }
+        if image_data && kind != b"IDAT" {
+            image_data_ended = true;
+        }
+        // Native sample previews are plain, single-frame PNGs. Pixel allocation limits do not
+        // necessarily bound aggregate compressed metadata; leave these layouts unsupported.
+        if matches!(kind, b"zTXt" | b"iTXt" | b"iCCP") {
+            return Err(Error::Unsupported("compressed PNG metadata in the preview"));
+        }
+        if matches!(kind, b"acTL" | b"fcTL" | b"fdAT") {
+            return Err(Error::Unsupported("animated PNG preview"));
+        }
+        pos = pos.checked_add(chunk_size).ok_or(Error::Malformed("PNG offset overflow"))?;
+        if kind == b"IEND" {
+            if length != 0 || pos != png.len() {
+                return Err(Error::Malformed("PNG end or trailing data"));
+            }
+            break;
+        }
+    }
+    Ok(Preview { png, width, height })
+}

crates/affinity/src/raster.rs

@@ -0,0 +1,243 @@
+//! Pixel layers (`Rstr`) and placed images (`ImgN`). A placed image keeps its original file
+//! (`DyBm.Bckg` → archive entry `c/N`), which is imported as is; other pixels are planar tiles of
+//! 256 bytes × 256 rows per channel, each its own archive entry.
+
+use std::collections::HashMap;
+
+use crate::Error;
+use crate::model::{Affine, Image, Pixels, Reader};
+use crate::stream::{self, ObjId, Tag, Value};
+
+/// Pixels decoded per layer (the content's bounding box, not the canvas).
+const MAX_PIXELS: u64 = 64 << 20;
+const TILE: usize = 256;
+const TILE_BYTES: usize = TILE * TILE;
+
+pub(crate) fn node_image(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let Some(bitmap) = s.obj(id, b"Bitm") else {
+        r.warn("pixel layers without pixels");
+        return Ok(None);
+    };
+    if !s.is(bitmap, b"DyBm") {
+        r.warn("pixel layers stored in an unknown way");
+        return Ok(None);
+    }
+    let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    if width == 0 || height == 0 {
+        return Ok(None);
+    }
+    // A placed image: the original file, byte for byte.
+    let has_tiles = s.field(bitmap, b"Sta1").is_some();
+    if let Some(name) = s.entry(bitmap, b"Bckg").filter(|n| !n.is_empty())
+        && (s.is(id, b"ImgN") || !has_tiles)
+    {
+        match original(r, name) {
+            Ok(bytes) => return Ok(Some(Image { width, height, pixels: Pixels::Encoded(bytes), transform: world })),
+            Err(Error::Limit(e)) => return Err(Error::Limit(e)),
+            Err(_) => r.warn("an embedded image file that could not be read (its cached pixels were used)"),
+        }
+    }
+    // The content's bounding box, so a mostly empty canvas-sized layer stays small.
+    let crop = s
+        .field(id, b"BitR")
+        .and_then(|v| if let Value::Ints(i) = v { Some(i.clone()) } else { None })
+        .filter(|v| v.len() == 4 && v[0] > i64::from(i32::MIN) + 1)
+        .map(|v| {
+            (
+                v[0].clamp(0, i64::from(width)) as u32,
+                v[1].clamp(0, i64::from(height)) as u32,
+                v[2].clamp(0, i64::from(width)) as u32,
+                v[3].clamp(0, i64::from(height)) as u32,
+            )
+        })
+        .unwrap_or((0, 0, width, height));
+    if s.field(bitmap, b"Bckg").is_some() && has_tiles && !s.is(id, b"ImgN") {
+        r.warn("edited placed images use their stored pixels");
+    }
+    decode(r, bitmap, crop, world)
+}
+
+/// A mask layer (`MRst`): one channel of coverage as grey pixels (white shows, black hides).
+pub(crate) fn mask(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let Some(bitmap) = s.obj(id, b"Bitm") else { return Ok(None) };
+    let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    if width == 0 || height == 0 || !matches!(s.enumeration(bitmap, b"Frmt"), Some((6 | 7, _))) {
+        r.warn("pixel masks in an unknown format (imported without them)");
+        return Ok(None);
+    }
+    decode(r, bitmap, (0, 0, width, height), world)
+}
+
+/// An embedded document or symbol instance (`EmbN`), as the picture of it Affinity caches.
+pub(crate) fn embedded(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let Some(cache) = s.obj(id, b"Bitm").and_then(|e| s.obj(e, b"Cach")) else { return Ok(None) };
+    let Some(bbox) = s.obj(id, b"Bitm").and_then(|e| s.floats::<4>(e, b"ChBB")) else { return Ok(None) };
+    let width = s.int(cache, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(cache, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
+    if width == 0 || height == 0 {
+        return Ok(None);
+    }
+    let [x0, y0, x1, y1] = bbox;
+    // The instance's origin is the centre of the embedded content (checked against the
+    // thumbnails of documents with embedded documents and SVG files).
+    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
+    let place = Affine([(x1 - x0) / f64::from(width), 0.0, 0.0, (y1 - y0) / f64::from(height), x0 - cx, y0 - cy]).then(world);
+    decode(r, cache, (0, 0, width, height), place)
+}
+
+/// Decode the tiles of a bitmap inside `crop` (pixels), placed by `world` (bitmap pixels to document).
+fn decode(r: &mut Reader, bitmap: ObjId, crop: (u32, u32, u32, u32), world: Affine) -> Result<Option<Image>, Error> {
+    let s = r.s;
+    let (x0, y0, x1, y1) = crop;
+    if x1 <= x0 || y1 <= y0 {
+        return Ok(None);
+    }
+    let (w, h) = (x1 - x0, y1 - y0);
+    if u64::from(w) * u64::from(h) > MAX_PIXELS {
+        r.warn("pixel layers larger than 64 megapixels");
+        return Ok(None);
+    }
+    let format = s.enumeration(bitmap, b"Frmt").map(|(f, _)| f);
+    let (channels, bps) = match format {
+        Some(0) => (4, 1),
+        Some(1) => (4, 2),
+        Some(6) => (1, 1),
+        Some(7) => (1, 2),
+        Some(4) => {
+            r.warn("CMYK pixel layers (converted to RGB without the document's colour profile)");
+            (5, 1)
+        }
+        _ => {
+            r.warn("pixel layers in grey, Lab or 32-bit formats");
+            return Ok(None);
+        }
+    };
+    let mut planes = Vec::with_capacity(channels);
+    let mut cache = HashMap::new();
+    for c in 1..=channels {
+        planes.push(plane(r, bitmap, c, bps, (x0, y0, w, h), &mut cache)?);
+    }
+    let n = (w as usize) * (h as usize);
+    let mut rgba = vec![0u8; n * 4];
+    let sample = |p: &Vec<u8>, i: usize| -> f64 {
+        if bps == 2 {
+            f64::from(u16::from_le_bytes([p.get(2 * i).copied().unwrap_or(0), p.get(2 * i + 1).copied().unwrap_or(0)])) / 65535.0
+        } else {
+            f64::from(p.get(i).copied().unwrap_or(0)) / 255.0
+        }
+    };
+    for (i, px) in rgba.chunks_exact_mut(4).enumerate() {
+        let v: Vec<f64> = planes.iter().map(|p| sample(p, i)).collect();
+        let (r2, g, b, a) = if channels == 1 {
+            (v[0], v[0], v[0], 1.0)
+        } else if channels == 5 {
+            let k = 1.0 - v[3];
+            ((1.0 - v[0]) * k, (1.0 - v[1]) * k, (1.0 - v[2]) * k, v[4])
+        } else {
+            (v[0], v[1], v[2], v[3])
+        };
+        px.copy_from_slice(&[r2, g, b, a].map(|c| (c.clamp(0.0, 1.0) * 255.0).round() as u8));
+    }
+    let transform = Affine([1.0, 0.0, 0.0, 1.0, f64::from(x0), f64::from(y0)]).then(world);
+    Ok(Some(Image { width: w, height: h, pixels: Pixels::Rgba8(rgba), transform }))
+}
+
+/// The original image file: entry `c/N` is a stream whose root (`Blck`) holds it as `Data`.
+fn original(r: &mut Reader, name: &str) -> Result<Vec<u8>, Error> {
+    let bytes = r.archive.read(name)?;
+    let s = stream::parse(&bytes)?;
+    let root = s.object(s.root).ok_or(Error::Malformed("embedded image"))?;
+    match root.get(Tag::of(b"Data")) {
+        Some(Value::Blob(b)) if !b.is_empty() => Ok(b.clone()),
+        _ => Err(Error::Malformed("embedded image without data")),
+    }
+}
+
+fn tag(prefix: &[u8; 3], c: usize) -> [u8; 4] {
+    [prefix[0], prefix[1], prefix[2], b'0' + c as u8]
+}
+
+/// One channel of level 0, cropped to (x0, y0, w, h) pixels; `bps` bytes per sample.
+fn plane(
+    r: &mut Reader,
+    bitmap: ObjId,
+    c: usize,
+    bps: usize,
+    (x0, y0, w, h): (u32, u32, u32, u32),
+    cache: &mut HashMap<String, Vec<u8>>,
+) -> Result<Vec<u8>, Error> {
+    let s = r.s;
+    let width = s.int(bitmap, b"BmpW").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
+    let height = s.int(bitmap, b"BmpH").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
+    let tw = s.int(bitmap, &tag(b"TWi", c)).and_then(|v| usize::try_from(v).ok()).unwrap_or_else(|| (width * bps).div_ceil(TILE));
+    let th = s.int(bitmap, &tag(b"THi", c)).and_then(|v| usize::try_from(v).ok()).unwrap_or_else(|| height.div_ceil(TILE));
+    let states: Vec<u8> = match s.field(bitmap, &tag(b"Sta", c)) {
+        Some(Value::Array(a)) => a.iter().map(|v| if let Value::UInt(u) = v { u8::try_from(*u).unwrap_or(255) } else { 255 }).collect(),
+        _ => Vec::new(),
+    };
+    let tiles = s.objs(bitmap, &tag(b"Idx", c));
+    let row = (w as usize) * bps;
+    let mut out = vec![0u8; row * h as usize];
+    let (bx0, bx1) = (x0 as usize * bps, (x0 + w) as usize * bps);
+    let (py0, py1) = (y0 as usize, (y0 + h) as usize);
+    let mut next = 0usize;
+    for (t, state) in states.iter().enumerate().take(tw.saturating_mul(th)) {
+        let (ty, tx) = (t / tw.max(1), t % tw.max(1));
+        let fill = match state {
+            0 | 1 => None,
+            2 => Some(0xFF),
+            4 => {
+                let Some(blck) = tiles.get(next).copied() else { return Err(Error::Malformed("missing pixel tile")) };
+                next += 1;
+                let (ox, oy) = (tx * TILE, ty * TILE);
+                if ox >= bx1 || ox + TILE <= bx0 || oy >= py1 || oy + TILE <= py0 {
+                    continue;
+                }
+                let name = s.entry(blck, b"Data").ok_or(Error::Malformed("pixel tile without data"))?.to_string();
+                if !cache.contains_key(&name) {
+                    let mut data = r.archive.read(&name)?;
+                    // Older files wrap a tile in a one-field stream: header, then a 64 KiB blob.
+                    if data.len() == TILE_BYTES + 22 && data.starts_with(b"\x00\xffKS") {
+                        data = data.get(21..21 + TILE_BYTES).ok_or(Error::Malformed("pixel tile"))?.to_vec();
+                    }
+                    if data.len() != TILE_BYTES {
+                        return Err(Error::Malformed("pixel tile size"));
+                    }
+                    cache.insert(name.clone(), data);
+                }
+                let tile = cache.get(&name).ok_or(Error::Malformed("pixel tile"))?;
+                copy(&mut out, row, (bx0, py0, bx1, py1), (ox, oy), |x, y| tile.get(y * TILE + x).copied().unwrap_or(0));
+                continue;
+            }
+            3 => {
+                r.warn("32-bit pixel layers");
+                None
+            }
+            5 => {
+                r.warn("pixel layers drawn from an embedded image (left empty)");
+                None
+            }
+            _ => return Err(Error::Malformed("unknown pixel tile state")),
+        };
+        if let Some(v) = fill {
+            copy(&mut out, row, (bx0, py0, bx1, py1), (tx * TILE, ty * TILE), |_, _| v);
+        }
+    }
+    Ok(out)
+}
+
+/// Copy the overlap of a tile at byte column `ox`, row `oy` into the cropped plane.
+fn copy(out: &mut [u8], row: usize, (bx0, py0, bx1, py1): (usize, usize, usize, usize), (ox, oy): (usize, usize), at: impl Fn(usize, usize) -> u8) {
+    for y in oy.max(py0)..(oy + TILE).min(py1) {
+        for x in ox.max(bx0)..(ox + TILE).min(bx1) {
+            if let Some(b) = out.get_mut((y - py0) * row + (x - bx0)) {
+                *b = at(x - ox, y - oy);
+            }
+        }
+    }
+}

crates/affinity/src/shapes.rs

@@ -0,0 +1,259 @@
+//! Parametric shapes: Affinity stores the shape's parameters and its box, never the outline.
+//! Formulas were fitted to Affinity's own renders (the document thumbnails) of public files.
+
+use std::f64::consts::{FRAC_PI_2, PI, TAU};
+
+use crate::model::{Affine, Path, Point, Reader, SubPath};
+use crate::stream::{ObjId, Tag, Value};
+
+/// Handle length of a quarter circle of radius 1.
+const KAPPA: f64 = 0.552_284_749_830_793_4;
+/// Vertices of a polygon or star.
+const MAX_SIDES: i64 = 10_000;
+
+/// The last value of a tag: a shape changed from one kind to another keeps a stale first block.
+fn last<'a>(r: &'a Reader, id: ObjId, tag: &[u8; 4]) -> Option<&'a Value> {
+    let t = Tag::of(tag);
+    r.s.object(id)?.fields.iter().rev().find(|(k, _)| *k == t).map(|(_, v)| v)
+}
+
+fn num(r: &Reader, id: ObjId, tag: &[u8; 4]) -> Option<f64> {
+    match last(r, id, tag)? {
+        Value::Float(f) if f.is_finite() => Some(*f),
+        Value::UInt(u) => Some(*u as f64),
+        Value::Int(i) => Some(*i as f64),
+        _ => None,
+    }
+}
+
+fn sides(r: &Reader, id: ObjId, tag: &[u8; 4], default: f64) -> usize {
+    let n = num(r, id, tag).unwrap_or(default).round();
+    n.clamp(3.0, MAX_SIDES as f64) as usize
+}
+
+fn pt(x: f64, y: f64) -> Point {
+    Point { x, y }
+}
+
+fn polygon(pts: impl IntoIterator<Item = Point>) -> Option<SubPath> {
+    let mut it = pts.into_iter();
+    let start = it.next()?;
+    let segments = it.map(|p| [p, p, p]).collect();
+    Some(SubPath { start, segments, closed: true })
+}
+
+/// Outline of `shape` (a `Shpe` object) in the node box `b` = (x0, y0, x1, y1).
+pub(crate) fn shape(r: &mut Reader, shape: ObjId, b: [f64; 4], world: Affine) -> Option<Path> {
+    let [x0, y0, x1, y1] = b;
+    let (w, h) = (x1 - x0, y1 - y0);
+    let (cx, cy, rx, ry) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0, w / 2.0, h / 2.0);
+    let on_ellipse = |a: f64, f: f64| pt(cx + f * rx * a.cos(), cy + f * ry * a.sin());
+    let class = r.s.class(shape)?;
+    let sub = match &class.0.to_be_bytes() {
+        b"ShNR" | b"ShRR" => {
+            let rounded = matches!(last(r, shape, b"CTyp"), Some(Value::Array(a)) if !a.is_empty());
+            let radius = match last(r, shape, b"ShCR") {
+                Some(Value::Floats(v)) => v.first().copied().filter(|f| f.is_finite() && *f > 0.0),
+                _ => None,
+            };
+            if let (true, Some(f)) = (rounded, radius) {
+                if let Some(Value::Array(types)) = last(r, shape, b"CTyp")
+                    && types.iter().any(|t| !matches!(t, Value::Enum { id: 0 | 4, .. }))
+                {
+                    r.warn("rectangles with straight, concave or other corner types (imported with round corners)");
+                }
+                let (crx, cry) = if r.s.bool(shape, b"AbSz") == Some(true) {
+                    // An absolute radius is in document pixels, whatever the node's scale.
+                    let [a, b2, c, d, ..] = world.0;
+                    let (sx, sy) = ((a * a + b2 * b2).sqrt(), (c * c + d * d).sqrt());
+                    if sx > 0.0 && sy > 0.0 { (f / sx, f / sy) } else { (0.0, 0.0) }
+                } else {
+                    (f * w.min(h), f * w.min(h))
+                };
+                rounded_rect(b, crx.min(w / 2.0), cry.min(h / 2.0))
+            } else {
+                polygon([pt(x0, y0), pt(x1, y0), pt(x1, y1), pt(x0, y1)])?
+            }
+        }
+        b"ShpE" => ellipse(cx, cy, rx, ry),
+        b"ShPy" => {
+            let n = sides(r, shape, b"Side", 5.0);
+            let a = |i: usize| -FRAC_PI_2 + TAU * i as f64 / n as f64;
+            if r.s.object(shape).is_some_and(|_| matches!(last(r, shape, b"Smth"), Some(Value::Bool(true)))) {
+                // Smoothed: tangent handles of length curv·4/3·tan(π/2n) along the inscribed ellipse.
+                let k = num(r, shape, b"Curv").unwrap_or(0.0) * 4.0 / 3.0 * (PI / (2.0 * n as f64)).tan();
+                let v = |i: usize| on_ellipse(a(i), 1.0);
+                let t = |i: usize| pt(-rx * a(i).sin(), ry * a(i).cos());
+                let segments = (0..n)
+                    .map(|i| {
+                        let (p, q, tp, tq) = (v(i), v(i + 1), t(i), t(i + 1));
+                        [pt(p.x + k * tp.x, p.y + k * tp.y), pt(q.x - k * tq.x, q.y - k * tq.y), q]
+                    })
+                    .collect();
+                SubPath { start: v(0), segments, closed: true }
+            } else {
+                polygon((0..n).map(|i| on_ellipse(a(i), 1.0)))?
+            }
+        }
+        b"ShSt" => {
+            let n = sides(r, shape, b"Pnts", 5.0);
+            let q = num(r, shape, b"IRad").unwrap_or(0.382).clamp(0.0, 1.0);
+            if [b"CrcI", b"CrcO", b"CrvL", b"CrvR"].iter().any(|t| num(r, shape, t).is_some_and(|v| v.abs() > 1e-9)) {
+                r.warn("stars with rounded or curved points (imported with sharp points)");
+            }
+            polygon((0..2 * n).map(|i| on_ellipse(-FRAC_PI_2 + PI * i as f64 / n as f64, if i % 2 == 0 { 1.0 } else { q })))?
+        }
+        b"ShSS" => {
+            let n = sides(r, shape, b"Side", 5.0);
+            let ri = num(r, shape, b"COut").unwrap_or(0.5).clamp(0.0, 1.0);
+            let step = PI / n as f64;
+            let (l, hw, inner) = (step.cos(), ri * step.sin(), ri * step.cos());
+            polygon((0..n).flat_map(|k| {
+                let phi = -FRAC_PI_2 + step + TAU * k as f64 / n as f64;
+                let (c, s) = (phi.cos(), phi.sin());
+                [(inner, -hw), (l, -hw), (l, hw), (inner, hw)].map(|(u, v)| pt(cx + rx * (u * c - v * s), cy + ry * (u * s + v * c)))
+            }))?
+        }
+        b"ShPi" => {
+            let start = num(r, shape, b"AngS").unwrap_or(0.0);
+            let mut end = num(r, shape, b"AngE").unwrap_or(TAU);
+            while end < start {
+                end += TAU;
+            }
+            let inner = num(r, shape, b"IRad").unwrap_or(0.0).clamp(0.0, 1.0);
+            pie(cx, cy, rx, ry, start, end.min(start + TAU), inner)
+        }
+        b"ShpT" => {
+            let p = num(r, shape, b"Pos ").unwrap_or(0.5);
+            polygon([pt(x0 + p * w, y0), pt(x1, y1), pt(x0, y1)])?
+        }
+        b"ShTz" => {
+            let (l, rr) = (num(r, shape, b"PosL").unwrap_or(0.25), num(r, shape, b"PosR").unwrap_or(0.75));
+            polygon([pt(x0 + l * w, y0), pt(x0 + rr * w, y0), pt(x1, y1), pt(x0, y1)])?
+        }
+        _ => {
+            r.warn("cloud, heart, cog, callout, arrow, tear and other special shapes (imported as their bounding ellipse)");
+            ellipse(cx, cy, rx, ry)
+        }
+    };
+    Some(Path { subpaths: vec![sub] })
+}
+
+pub(crate) fn rectangle(x0: f64, y0: f64, x1: f64, y1: f64) -> SubPath {
+    SubPath { start: pt(x0, y0), segments: [pt(x1, y0), pt(x1, y1), pt(x0, y1)].map(|p| [p, p, p]).to_vec(), closed: true }
+}
+
+fn ellipse(cx: f64, cy: f64, rx: f64, ry: f64) -> SubPath {
+    let (kx, ky) = (KAPPA * rx, KAPPA * ry);
+    SubPath {
+        start: pt(cx + rx, cy),
+        segments: vec![
+            [pt(cx + rx, cy + ky), pt(cx + kx, cy + ry), pt(cx, cy + ry)],
+            [pt(cx - kx, cy + ry), pt(cx - rx, cy + ky), pt(cx - rx, cy)],
+            [pt(cx - rx, cy - ky), pt(cx - kx, cy - ry), pt(cx, cy - ry)],
+            [pt(cx + kx, cy - ry), pt(cx + rx, cy - ky), pt(cx + rx, cy)],
+        ],
+        closed: true,
+    }
+}
+
+fn rounded_rect([x0, y0, x1, y1]: [f64; 4], rx: f64, ry: f64) -> SubPath {
+    let (kx, ky) = ((1.0 - KAPPA) * rx, (1.0 - KAPPA) * ry);
+    SubPath {
+        start: pt(x0 + rx, y0),
+        segments: vec![
+            [pt(x1 - rx, y0), pt(x1 - rx, y0), pt(x1 - rx, y0)],
+            [pt(x1 - kx, y0), pt(x1, y0 + ky), pt(x1, y0 + ry)],
+            [pt(x1, y1 - ry), pt(x1, y1 - ry), pt(x1, y1 - ry)],
+            [pt(x1, y1 - ky), pt(x1 - kx, y1), pt(x1 - rx, y1)],
+            [pt(x0 + rx, y1), pt(x0 + rx, y1), pt(x0 + rx, y1)],
+            [pt(x0 + kx, y1), pt(x0, y1 - ky), pt(x0, y1 - ry)],
+            [pt(x0, y0 + ry), pt(x0, y0 + ry), pt(x0, y0 + ry)],
+            [pt(x0, y0 + ky), pt(x0 + kx, y0), pt(x0 + rx, y0)],
+        ],
+        closed: true,
+    }
+}
+
+/// Elliptical arc from angle `a0` to `a1` (radians, measured y-up as Affinity's pie angles are),
+/// as cubic segments of at most a quarter turn.
+fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, a1: f64, out: &mut Vec<[Point; 3]>) {
+    let n = ((a1 - a0).abs() / FRAC_PI_2).ceil().clamp(1.0, 8.0) as usize;
+    let step = (a1 - a0) / n as f64;
+    let k = 4.0 / 3.0 * (step / 4.0).tan();
+    let p = |a: f64| pt(cx + rx * a.cos(), cy - ry * a.sin());
+    let d = |a: f64| pt(-rx * a.sin(), -ry * a.cos());
+    for i in 0..n {
+        let (s, e) = (a0 + step * i as f64, a0 + step * (i + 1) as f64);
+        let (ps, pe, ds, de) = (p(s), p(e), d(s), d(e));
+        out.push([pt(ps.x + k * ds.x, ps.y + k * ds.y), pt(pe.x - k * de.x, pe.y - k * de.y), pe]);
+    }
+}
+
+fn pie(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, a1: f64, inner: f64) -> SubPath {
+    let start = pt(cx + rx * a0.cos(), cy - ry * a0.sin());
+    let mut segments = Vec::new();
+    arc(cx, cy, rx, ry, a0, a1, &mut segments);
+    if inner > 0.0 {
+        let p = pt(cx + inner * rx * a1.cos(), cy - inner * ry * a1.sin());
+        segments.push([p, p, p]);
+        arc(cx, cy, inner * rx, inner * ry, a1, a0, &mut segments);
+    } else {
+        let c = pt(cx, cy);
+        segments.push([c, c, c]);
+    }
+    SubPath { start, segments, closed: true }
+}
+
+/// A polyline with circular corners of the given radii (Affinity's live corners on curves).
+pub(crate) fn fillet(pts: &[(Point, f64)], closed: bool) -> SubPath {
+    let n = pts.len();
+    let get = |i: isize| -> Option<Point> {
+        if closed { pts.get(i.rem_euclid(n as isize) as usize).map(|p| p.0) } else { usize::try_from(i).ok().and_then(|i| pts.get(i)).map(|p| p.0) }
+    };
+    let mut corners: Vec<(Point, Point, Point, Point)> = Vec::with_capacity(n);
+    for (i, (p, radius)) in pts.iter().enumerate() {
+        let (prev, next) = (get(i as isize - 1), get(i as isize + 1));
+        let (Some(a), Some(b)) = (prev, next) else {
+            corners.push((*p, *p, *p, *p));
+            continue;
+        };
+        let (u1, l1) = unit(*p, a);
+        let (u2, l2) = unit(*p, b);
+        let cos = (u1.x * u2.x + u1.y * u2.y).clamp(-1.0, 1.0);
+        let phi = cos.acos();
+        if *radius <= 0.0 || phi < 1e-6 || (PI - phi) < 1e-6 {
+            corners.push((*p, *p, *p, *p));
+            continue;
+        }
+        let t = (radius / (phi / 2.0).tan()).min(l1 / 2.0).min(l2 / 2.0);
+        let r = t * (phi / 2.0).tan();
+        let k = 4.0 / 3.0 * ((PI - phi) / 4.0).tan() * r;
+        let s = pt(p.x + u1.x * t, p.y + u1.y * t);
+        let e = pt(p.x + u2.x * t, p.y + u2.y * t);
+        corners.push((s, pt(s.x - u1.x * k, s.y - u1.y * k), pt(e.x - u2.x * k, e.y - u2.y * k), e));
+    }
+    let Some(first) = corners.first().copied() else { return SubPath { start: pt(0.0, 0.0), segments: vec![], closed } };
+    let mut segments = Vec::with_capacity(2 * n);
+    let mut cur = first.0;
+    let start = cur;
+    for (i, (s, c1, c2, e)) in corners.iter().enumerate() {
+        if i > 0 {
+            segments.push([cur, *s, *s]);
+        }
+        if s != e {
+            segments.push([*c1, *c2, *e]);
+        }
+        cur = *e;
+    }
+    if closed && cur != start {
+        segments.push([cur, start, start]);
+    }
+    SubPath { start, segments, closed }
+}
+
+fn unit(from: Point, to: Point) -> (Point, f64) {
+    let (dx, dy) = (to.x - from.x, to.y - from.y);
+    let l = (dx * dx + dy * dy).sqrt();
+    if l > 0.0 { (pt(dx / l, dy / l), l) } else { (pt(0.0, 0.0), 0.0) }
+}

crates/affinity/src/stream.rs

@@ -0,0 +1,402 @@
+//! The tagged object stream inside `doc.dat`: a self-describing tree of objects whose fields carry
+//! a type code and a four-character tag. Parsing needs no schema; unknown fields are kept, so the
+//! document mapping can name what it could not import.
+
+use crate::Error;
+use crate::container::Cursor;
+
+/// A four-character tag in its readable order (`Desc`, `Chld`).
+#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct Tag(pub u32);
+
+impl Tag {
+    pub const fn of(s: &[u8; 4]) -> Self {
+        Self(u32::from_be_bytes(*s))
+    }
+}
+
+impl std::fmt::Debug for Tag {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", String::from_utf8_lossy(&self.0.to_be_bytes()))
+    }
+}
+
+impl std::fmt::Display for Tag {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Debug::fmt(self, f)
+    }
+}
+
+/// Index of an object in [`Stream::objects`].
+pub type ObjId = usize;
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Value {
+    Int(i64),
+    UInt(u64),
+    Float(f64),
+    Bool(bool),
+    Enum {
+        id: u16,
+        version: u16,
+    },
+    Str(String),
+    /// Fixed-length vectors of i32/f32/f64 (points, rectangles, transforms).
+    Ints(Vec<i64>),
+    Floats(Vec<f64>),
+    /// Fixed-size record (curve nodes, ids) or fixed-size struct (colour components).
+    Bytes(Vec<u8>),
+    Blob(Vec<u8>),
+    /// Name of another archive entry (raster tiles, embedded files).
+    Entry(String),
+    Flags(u64),
+    /// `None` is a null object.
+    Obj(Option<ObjId>),
+    Array(Vec<Value>),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Kind {
+    Root,
+    /// Defined once and referenced by id elsewhere.
+    Shared,
+    Inline,
+    /// Untagged fields identified by position (curve data).
+    Positional,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Object {
+    pub class: Tag,
+    pub kind: Kind,
+    /// Class chain, most derived first (`ShpN`, `VNod`, `Node`).
+    pub chain: Vec<Tag>,
+    /// Fields in stream order; positional fields have tag 0.
+    pub fields: Vec<(Tag, Value)>,
+}
+
+impl Object {
+    pub fn get(&self, tag: Tag) -> Option<&Value> {
+        self.fields.iter().find(|(t, _)| *t == tag).map(|(_, v)| v)
+    }
+}
+
+#[derive(Debug)]
+pub struct Stream {
+    pub root: ObjId,
+    pub objects: Vec<Object>,
+}
+
+/// Deepest object nesting accepted; real documents stay well below (each layer level adds three).
+pub const MAX_DEPTH: usize = 384;
+
+const MAX_OBJECTS: usize = 8_000_000;
+
+/// Most values (fields and array elements) one stream may decode. A value takes about 40 bytes
+/// in memory however few it took in the file (a bool array packs eight in a byte), so the size
+/// of the input alone doesn't bound what parsing allocates: a small compressed entry could
+/// otherwise ask for tens of gigabytes. Real documents stay far below.
+pub const MAX_VALUES: usize = 1 << 24;
+
+struct Parser<'a> {
+    c: Cursor<'a>,
+    objects: Vec<Object>,
+    /// Shared ids, defined at first use and referenced backwards.
+    shared: std::collections::HashMap<u32, ObjId>,
+    depth: usize,
+    /// Values decoded so far, against [`MAX_VALUES`].
+    values: usize,
+}
+
+/// Parse a stream (`00 FF 4B 53` header). Bytes after the root's terminator are ignored.
+pub fn parse(bytes: &[u8]) -> Result<Stream, Error> {
+    let mut c = Cursor::new(bytes, 0);
+    if c.take(4)? != b"\x00\xffKS" {
+        return Err(Error::Malformed("document stream signature"));
+    }
+    let version = c.u16()?;
+    if version > 2 {
+        return Err(Error::Unsupported("document stream version"));
+    }
+    let class = Tag(c.u32()?);
+    c.u16()?;
+    if version == 2 {
+        c.u32()?;
+    }
+    let mut p = Parser { c, objects: Vec::new(), shared: std::collections::HashMap::new(), depth: 0, values: 0 };
+    let root = p.push(Object { class, kind: Kind::Root, chain: vec![class], fields: Vec::new() })?;
+    let fields = p.fields(true, class)?;
+    if let Some(o) = p.objects.get_mut(root) {
+        o.fields = fields;
+    }
+    Ok(Stream { root, objects: p.objects })
+}
+
+impl Parser<'_> {
+    fn push(&mut self, o: Object) -> Result<ObjId, Error> {
+        if self.objects.len() >= MAX_OBJECTS {
+            return Err(Error::Limit("too many objects"));
+        }
+        self.objects.push(o);
+        Ok(self.objects.len() - 1)
+    }
+
+    /// Counts `n` more values against [`MAX_VALUES`], before anything is allocated for them.
+    fn spend(&mut self, n: usize) -> Result<(), Error> {
+        self.values = self.values.checked_add(n).filter(|&v| v <= MAX_VALUES).ok_or(Error::Limit("too many values in the document stream"))?;
+        Ok(())
+    }
+
+    /// An empty array with room for `n` values, paid for first; an allocation that still fails
+    /// is an error, not an abort.
+    fn vec<T>(&mut self, n: usize) -> Result<Vec<T>, Error> {
+        self.spend(n)?;
+        let mut v = Vec::new();
+        v.try_reserve_exact(n).map_err(|_| Error::Limit("not enough memory for the document stream"))?;
+        Ok(v)
+    }
+
+    /// Element count of an array: each element takes at least `min` bytes, so a count the
+    /// remaining input cannot hold is rejected before anything is allocated.
+    fn count(&mut self, min: usize) -> Result<usize, Error> {
+        let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
+        if n.checked_mul(min.max(1)).is_none_or(|bytes| bytes > self.c.remaining()) {
+            return Err(Error::Malformed("array longer than its data"));
+        }
+        Ok(n)
+    }
+
+    fn fields(&mut self, tagged: bool, class: Tag) -> Result<Vec<(Tag, Value)>, Error> {
+        self.depth += 1;
+        if self.depth > MAX_DEPTH {
+            return Err(Error::Limit("objects nested too deeply"));
+        }
+        let mut out = Vec::new();
+        loop {
+            let t = self.c.u8()?;
+            let code = t & 0x7F;
+            if code == 0 {
+                break;
+            }
+            self.spend(1)?;
+            let tag = if tagged { Tag(self.c.u32()?) } else { Tag(0) };
+            let v = if t & 0x80 != 0 { self.array(code, class)? } else { self.scalar(code, tagged, class)? };
+            out.push((tag, v));
+        }
+        self.depth -= 1;
+        Ok(out)
+    }
+
+    fn string(&mut self) -> Result<String, Error> {
+        let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("string length"))?;
+        Ok(String::from_utf8_lossy(self.c.take(n)?).into_owned())
+    }
+
+    fn floats(&mut self, n: usize, wide: bool) -> Result<Value, Error> {
+        let mut v = Vec::with_capacity(n);
+        for _ in 0..n {
+            v.push(if wide { f64::from_le_bytes(self.c.array()?) } else { f64::from(f32::from_le_bytes(self.c.array()?)) });
+        }
+        Ok(Value::Floats(v))
+    }
+
+    fn scalar(&mut self, code: u8, tagged: bool, class: Tag) -> Result<Value, Error> {
+        let c = &mut self.c;
+        Ok(match code {
+            0x01 => Value::UInt(c.u8()?.into()),
+            0x02 => Value::UInt(c.u16()?.into()),
+            0x03 | 0x2f | 0x34 => Value::UInt(c.u32()?.into()),
+            0x04 => Value::UInt(c.u64()?),
+            0x05 => Value::Int(i8::from_le_bytes(c.array()?).into()),
+            0x06 => Value::Int(i16::from_le_bytes(c.array()?).into()),
+            0x07 => Value::Int(i32::from_le_bytes(c.array()?).into()),
+            0x08 => Value::Int(i64::from_le_bytes(c.array()?)),
+            0x09 => Value::Float(f32::from_le_bytes(c.array()?).into()),
+            0x0a => Value::Float(f64::from_le_bytes(c.array()?)),
+            0x15..=0x19 => {
+                let n = usize::from(code - 0x13);
+                let mut v = Vec::with_capacity(n);
+                for _ in 0..n {
+                    v.push(i32::from_le_bytes(c.array()?).into());
+                }
+                Value::Ints(v)
+            }
+            0x1f..=0x23 => return self.floats(usize::from(code - 0x1d), false),
+            0x24..=0x28 => return self.floats(usize::from(code - 0x22), true),
+            0x29 => Value::Bool(c.u8()? != 0),
+            0x2a => Value::Enum { id: c.u16()?, version: c.u16()? },
+            0x2b | 0x2e => Value::Str(self.string()?),
+            0x2c => {
+                let n = usize::from(c.u16()?);
+                Value::Bytes(c.take(n)?.to_vec())
+            }
+            0x35..=0x74 => Value::Bytes(c.take(usize::from(code - 0x34))?.to_vec()),
+            0x2d => {
+                let n = usize::try_from(c.u32()?).map_err(|_| Error::Malformed("blob length"))?;
+                Value::Blob(c.take(n)?.to_vec())
+            }
+            0x33 => {
+                c.u32()?;
+                let n = usize::try_from(c.u32()?).map_err(|_| Error::Malformed("entry name length"))?;
+                Value::Entry(String::from_utf8_lossy(c.take(n)?).into_owned())
+            }
+            0x75 => {
+                c.u16()?;
+                let n = usize::from(c.u8()?);
+                if n > 8 {
+                    return Err(Error::Malformed("flags wider than 64 bits"));
+                }
+                let mut b = [0u8; 8];
+                b.get_mut(..n).ok_or(Error::Malformed("flags"))?.copy_from_slice(c.take(n)?);
+                Value::Flags(u64::from_le_bytes(b))
+            }
+            0x30 => {
+                let fields = self.fields(false, class)?;
+                let id = self.push(Object { class, kind: Kind::Positional, chain: Vec::new(), fields })?;
+                Value::Obj(Some(id))
+            }
+            0x31 | 0x32 if !tagged => return Err(Error::Malformed("object without a field tag")),
+            0x31 => self.shared()?,
+            0x32 => self.inline(None)?,
+            _ => return Err(Error::Unsupported("unknown field type in document stream")),
+        })
+    }
+
+    fn array(&mut self, code: u8, class: Tag) -> Result<Value, Error> {
+        let min = match code {
+            0x01 | 0x05 | 0x29 => 1,
+            0x02 | 0x06 => 2,
+            0x03 | 0x07 | 0x09 | 0x2f | 0x34 => 4,
+            0x04 | 0x08 | 0x0a => 8,
+            0x15..=0x19 => 4 * usize::from(code - 0x13),
+            0x1f..=0x23 => 4 * usize::from(code - 0x1d),
+            0x24..=0x28 => 8 * usize::from(code - 0x22),
+            0x35..=0x74 => usize::from(code - 0x34),
+            _ => 1,
+        };
+        match code {
+            0x29 => {
+                let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
+                let bits = self.c.take(n.div_ceil(8))?;
+                let mut v = self.vec(n)?;
+                v.extend((0..n).map(|i| Value::Bool(bits.get(i / 8).is_some_and(|b| b >> (i % 8) & 1 != 0))));
+                Ok(Value::Array(v))
+            }
+            0x2a => {
+                let n = self.count(2)?;
+                let version = self.c.u16()?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(Value::Enum { id: self.c.u16()?, version });
+                }
+                Ok(Value::Array(v))
+            }
+            0x2b | 0x2e => {
+                self.c.u32()?;
+                let n = self.count(4)?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(Value::Str(self.string()?));
+                }
+                Ok(Value::Array(v))
+            }
+            0x2c => {
+                let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
+                let size = usize::from(self.c.u16()?);
+                if n.checked_mul(size).is_none_or(|b| b > self.c.remaining()) {
+                    return Err(Error::Malformed("array longer than its data"));
+                }
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(Value::Bytes(self.c.take(size)?.to_vec()));
+                }
+                Ok(Value::Array(v))
+            }
+            0x32 => {
+                let n = self.count(1)?;
+                let class = Tag(self.c.u32()?);
+                self.c.u16()?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(self.inline(Some(class))?);
+                }
+                Ok(Value::Array(v))
+            }
+            0x2d | 0x33 | 0x75 => Err(Error::Malformed("array of an unarrayable type")),
+            _ => {
+                let n = self.count(min)?;
+                let mut v = self.vec(n)?;
+                for _ in 0..n {
+                    v.push(self.scalar(code, true, class)?);
+                }
+                Ok(Value::Array(v))
+            }
+        }
+    }
+
+    /// Inline object; `class` is given once for a whole array of them.
+    fn inline(&mut self, class: Option<Tag>) -> Result<Value, Error> {
+        match self.c.u8()? {
+            0 => return Ok(Value::Obj(None)),
+            1 => {}
+            _ => return Err(Error::Malformed("object marker")),
+        }
+        let class = match class {
+            Some(c) => c,
+            None => {
+                let c = Tag(self.c.u32()?);
+                self.c.u16()?;
+                c
+            }
+        };
+        let fields = self.fields(true, class)?;
+        let id = self.push(Object { class, kind: Kind::Inline, chain: vec![class], fields })?;
+        Ok(Value::Obj(Some(id)))
+    }
+
+    fn shared(&mut self) -> Result<Value, Error> {
+        let flag = self.c.u8()?;
+        if flag == 0 {
+            return Ok(Value::Obj(None));
+        }
+        let key = self.c.u32()?;
+        match flag {
+            2 => return self.shared.get(&key).map(|id| Value::Obj(Some(*id))).ok_or(Error::Malformed("reference to an undefined object")),
+            1 => {}
+            _ => return Err(Error::Malformed("object marker")),
+        }
+        if self.shared.contains_key(&key) {
+            return Err(Error::Malformed("object defined twice"));
+        }
+        // Register before the fields: an object's own fields may refer back to it.
+        let id = self.push(Object { class: Tag(0), kind: Kind::Shared, chain: Vec::new(), fields: Vec::new() })?;
+        self.shared.insert(key, id);
+        let mut chain = Vec::new();
+        let mut fields = Vec::new();
+        loop {
+            match self.c.u8()? {
+                0 => {
+                    let tag = Tag(self.c.u32()?);
+                    self.c.u16()?;
+                    chain.push(tag);
+                    fields.extend(self.fields(true, tag)?);
+                }
+                1 => {
+                    chain.push(Tag(self.c.u32()?));
+                    break;
+                }
+                2 => break,
+                _ => return Err(Error::Malformed("object class chain")),
+            }
+            if chain.len() > 64 {
+                return Err(Error::Limit("object class chain too long"));
+            }
+        }
+        let class = chain.first().copied().unwrap_or(Tag(0));
+        fields.extend(self.fields(true, class)?);
+        if let Some(o) = self.objects.get_mut(id) {
+            *o = Object { class, kind: Kind::Shared, chain, fields };
+        }
+        Ok(Value::Obj(Some(id)))
+    }
+}

crates/affinity/src/synth.rs

@@ -0,0 +1,259 @@
+//! Synthetic containers for tests and fuzz seeds (cargo feature `synth`).
+//!
+//! These builders write the layout the reader accepts, so tests can describe documents in a few
+//! lines. They are **not** an Affinity exporter: nothing written here has been opened in Affinity.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use crate::stream::Tag;
+
+/// A field value to encode.
+#[derive(Debug, Clone)]
+pub enum F {
+    U8(u8),
+    U32(u32),
+    I32(i32),
+    F32(f32),
+    F64(f64),
+    Bool(bool),
+    Enum(u16, u16),
+    Str(String),
+    /// f64 vector of 2..6 values (points, rectangles, transforms).
+    F64s(Vec<f64>),
+    /// Fixed-size struct (colour components), 1..64 bytes.
+    Struct(Vec<u8>),
+    /// Array of fixed-size records, all `size` bytes.
+    Records(u16, Vec<Vec<u8>>),
+    U8s(Vec<u8>),
+    Entry(String),
+    /// Shared object: `Def` defines id with class chain and fields, `Ref` links back.
+    Def(u32, Vec<Tag>, Vec<(Tag, F)>),
+    Ref(u32),
+    Null,
+    /// Inline object.
+    Obj(Tag, Vec<(Tag, F)>),
+    /// Positional (untagged) object.
+    Pos(Vec<F>),
+    /// Array of shared objects / links.
+    Shared(Vec<F>),
+    /// Array of inline objects of one class.
+    Objs(Tag, Vec<Vec<(Tag, F)>>),
+    /// Raw bytes appended verbatim (malformed-input tests).
+    Raw(Vec<u8>),
+}
+
+pub fn tag(s: &[u8; 4]) -> Tag {
+    Tag::of(s)
+}
+
+fn put_tag(out: &mut Vec<u8>, t: Tag) {
+    out.extend(t.0.to_le_bytes());
+}
+
+fn code(f: &F) -> u8 {
+    match f {
+        F::U8(_) => 0x01,
+        F::U32(_) => 0x03,
+        F::I32(_) => 0x07,
+        F::F32(_) => 0x09,
+        F::F64(_) => 0x0a,
+        F::Bool(_) => 0x29,
+        F::Enum(..) => 0x2a,
+        F::Str(_) => 0x2b,
+        F::F64s(v) => 0x22 + v.len() as u8,
+        F::Struct(b) => 0x34 + b.len() as u8,
+        F::Records(..) => 0x80 | 0x2c,
+        F::U8s(_) => 0x80 | 0x01,
+        F::Entry(_) => 0x33,
+        F::Def(..) | F::Ref(_) => 0x31,
+        F::Null => 0x31,
+        F::Obj(..) => 0x32,
+        F::Pos(_) => 0x30,
+        F::Shared(_) => 0x80 | 0x31,
+        F::Objs(..) => 0x80 | 0x32,
+        F::Raw(_) => 0,
+    }
+}
+
+fn payload(out: &mut Vec<u8>, f: &F) {
+    match f {
+        F::U8(v) => out.push(*v),
+        F::U32(v) => out.extend(v.to_le_bytes()),
+        F::I32(v) => out.extend(v.to_le_bytes()),
+        F::F32(v) => out.extend(v.to_le_bytes()),
+        F::F64(v) => out.extend(v.to_le_bytes()),
+        F::Bool(v) => out.push(u8::from(*v)),
+        F::Enum(id, ver) => {
+            out.extend(id.to_le_bytes());
+            out.extend(ver.to_le_bytes());
+        }
+        F::Str(s) => {
+            out.extend((s.len() as u32).to_le_bytes());
+            out.extend(s.as_bytes());
+        }
+        F::F64s(v) => v.iter().for_each(|x| out.extend(x.to_le_bytes())),
+        F::Struct(b) => out.extend(b),
+        F::Records(size, recs) => {
+            out.extend((recs.len() as u32).to_le_bytes());
+            out.extend(size.to_le_bytes());
+            recs.iter().for_each(|r| out.extend(r));
+        }
+        F::U8s(v) => {
+            out.extend((v.len() as u32).to_le_bytes());
+            out.extend(v);
+        }
+        F::Entry(name) => {
+            put_tag(out, tag(b"Data"));
+            out.extend((name.len() as u32).to_le_bytes());
+            out.extend(name.as_bytes());
+        }
+        F::Def(id, chain, fields) => {
+            out.push(1);
+            out.extend(id.to_le_bytes());
+            // Class chain: each level but the last carries no fields here; the last ends the chain.
+            let (last, rest) = chain.split_last().expect("class chain");
+            for t in rest {
+                out.push(0);
+                put_tag(out, *t);
+                out.extend(0u16.to_le_bytes());
+                out.push(0);
+            }
+            out.push(1);
+            put_tag(out, *last);
+            fields_into(out, fields, true);
+        }
+        F::Ref(id) => {
+            out.push(2);
+            out.extend(id.to_le_bytes());
+        }
+        F::Null => out.push(0),
+        F::Obj(class, fields) => {
+            out.push(1);
+            put_tag(out, *class);
+            out.extend(0u16.to_le_bytes());
+            fields_into(out, fields, true);
+        }
+        F::Pos(items) => {
+            for f in items {
+                out.push(code(f));
+                payload(out, f);
+            }
+            out.push(0);
+        }
+        F::Shared(items) => {
+            out.extend((items.len() as u32).to_le_bytes());
+            items.iter().for_each(|f| payload(out, f));
+        }
+        F::Objs(class, items) => {
+            out.extend((items.len() as u32).to_le_bytes());
+            put_tag(out, *class);
+            out.extend(0u16.to_le_bytes());
+            for fields in items {
+                out.push(1);
+                fields_into(out, fields, true);
+            }
+        }
+        F::Raw(b) => out.extend(b),
+    }
+}
+
+fn fields_into(out: &mut Vec<u8>, fields: &[(Tag, F)], tagged: bool) {
+    for (t, f) in fields {
+        if let F::Raw(b) = f {
+            out.extend(b);
+            continue;
+        }
+        out.push(code(f));
+        if tagged {
+            put_tag(out, *t);
+        }
+        payload(out, f);
+    }
+    out.push(0);
+}
+
+/// A `doc.dat` stream with root class `Pers`.
+pub fn stream(root: &[(Tag, F)]) -> Vec<u8> {
+    let mut out = b"\x00\xffKS".to_vec();
+    out.extend(2u16.to_le_bytes());
+    put_tag(&mut out, tag(b"Pers"));
+    out.extend(0u16.to_le_bytes());
+    out.extend(30u32.to_le_bytes());
+    fields_into(&mut out, root, true);
+    out
+}
+
+/// How an entry is stored.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Method {
+    Stored,
+    Zlib,
+    Zstd,
+}
+
+/// A version-12 container with one `#FT4` table holding `entries`, then an optional thumbnail record.
+pub fn container(entries: &[(&str, &[u8], Method)], thumbnail_png: Option<&[u8]>) -> Vec<u8> {
+    let mut out = vec![0u8; 72];
+    out[..4].copy_from_slice(crate::container::MAGIC);
+    out[4..6].copy_from_slice(&12u16.to_le_bytes());
+    out[6..8].copy_from_slice(&4u16.to_le_bytes());
+    out[8..12].copy_from_slice(b"nsrP");
+    out[12..16].copy_from_slice(b"#Inf");
+    out[64..68].copy_from_slice(b"Prot");
+    let mut records = Vec::new();
+    for (i, (name, data, method)) in entries.iter().enumerate() {
+        let packed = match method {
+            Method::Stored => data.to_vec(),
+            Method::Zlib => {
+                use std::io::Write;
+                let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
+                e.write_all(data).unwrap();
+                e.finish().unwrap()
+            }
+            Method::Zstd => ruzstd::encoding::compress_to_vec(*data, ruzstd::encoding::CompressionLevel::Fastest),
+        };
+        let offset = out.len() as u64;
+        out.extend(b"#Fil");
+        out.extend(&packed);
+        let mut r = Vec::new();
+        r.extend((i as u32 + 1).to_le_bytes());
+        r.push(0);
+        r.extend(offset.to_le_bytes());
+        r.extend((data.len() as u64).to_le_bytes());
+        r.extend((packed.len() as u64).to_le_bytes());
+        r.extend(crc32fast::hash(data).to_le_bytes());
+        r.push(match method {
+            Method::Stored => 0,
+            Method::Zlib => 1,
+            Method::Zstd => 2,
+        });
+        r.extend(0u32.to_le_bytes());
+        r.extend(0u32.to_le_bytes());
+        r.extend((name.len() as u16).to_le_bytes());
+        r.extend(name.as_bytes());
+        records.push(r);
+    }
+    let fat = out.len() as u64;
+    out.extend(b"#FT4");
+    out.extend(0u64.to_le_bytes());
+    out.extend(1_700_000_000u64.to_le_bytes());
+    out.extend([0u8; 24]);
+    out.extend((records.len() as u32).to_le_bytes());
+    out.extend([0u8; 8]);
+    out.extend(0u16.to_le_bytes());
+    out.push(0);
+    records.iter().for_each(|r| out.extend(r));
+    let thumb = out.len() as u64;
+    out[16..24].copy_from_slice(&fat.to_le_bytes());
+    if let Some(png) = thumbnail_png {
+        out[24..32].copy_from_slice(&thumb.to_le_bytes());
+        out.extend(b"\xff\xff\xff\xffThmb");
+        out.extend(1u32.to_le_bytes());
+        out.extend((png.len() as u32 + 13).to_le_bytes());
+        out.extend(29u32.to_le_bytes());
+        out.extend(0u32.to_le_bytes());
+        out.extend((png.len() as u32).to_le_bytes());
+        out.push(1);
+        out.extend(png);
+    }
+    out
+}

crates/affinity/src/tests.rs

@@ -0,0 +1,354 @@
+//! Unit tests on synthetic inputs; `tests/real_files.rs` covers public Affinity documents.
+
+mod preview {
+    use crate::container::header;
+    use crate::*;
+    use proptest::prelude::*;
+
+    fn fixture() -> Vec<u8> {
+        let mut png = b"\x89PNG\r\n\x1a\n".to_vec();
+        png.extend(13u32.to_be_bytes());
+        png.extend(b"IHDR");
+        png.extend(2u32.to_be_bytes());
+        png.extend(1u32.to_be_bytes());
+        png.extend([8, 6, 0, 0, 0]);
+        png.extend(crc32fast::hash(&png[12..]).to_be_bytes());
+        png.extend([0; 4]);
+        png.extend(b"IDAT");
+        png.extend(crc32fast::hash(b"IDAT").to_be_bytes());
+        png.extend([0; 4]);
+        png.extend(b"IEND");
+        png.extend(crc32fast::hash(b"IEND").to_be_bytes());
+        let mut b = vec![0; 72];
+        b[..4].copy_from_slice(MAGIC);
+        b[4..6].copy_from_slice(&12u16.to_le_bytes());
+        b[8..12].copy_from_slice(b"nsrP");
+        b[12..16].copy_from_slice(b"#Inf");
+        b[24..32].copy_from_slice(&72u64.to_le_bytes());
+        b[64..68].copy_from_slice(b"Prot");
+        b.extend(b"\xff\xff\xff\xffThmb");
+        b.extend(1u32.to_le_bytes());
+        b.extend((png.len() as u32 + 13).to_le_bytes());
+        b.extend(29u32.to_le_bytes());
+        b.extend(0u32.to_le_bytes());
+        b.extend((png.len() as u32).to_le_bytes());
+        b.push(1);
+        b.extend(png);
+        b
+    }
+
+    #[test]
+    fn indexed_preview_and_header() {
+        let b = fixture();
+        assert_eq!(header(&b).unwrap().version, 12);
+        let p = preview(&b).unwrap();
+        assert_eq!((p.width, p.height), (2, 1));
+        assert_eq!(p.png, &b[101..]);
+    }
+
+    #[test]
+    fn every_truncation_is_rejected() {
+        let b = fixture();
+        for end in 0..b.len() {
+            assert!(preview(&b[..end]).is_err(), "{end}");
+        }
+    }
+
+    #[test]
+    fn rejects_assets_versions_offsets_lengths_and_bombs() {
+        let b = fixture();
+        for (offset, value) in [
+            (4, 13u64.to_le_bytes().to_vec()),
+            (8, b"urBR".to_vec()),
+            (24, u64::MAX.to_le_bytes().to_vec()),
+            (24, 1u64.to_le_bytes().to_vec()),
+            (24, 0u64.to_le_bytes().to_vec()),
+            (84, u32::MAX.to_le_bytes().to_vec()),
+            (88, 30u32.to_le_bytes().to_vec()),
+            (96, u32::MAX.to_le_bytes().to_vec()),
+            (117, 5000u32.to_be_bytes().to_vec()),
+        ] {
+            let mut broken = b.clone();
+            broken[offset..offset + value.len()].copy_from_slice(&value);
+            assert!(preview(&broken).is_err(), "offset {offset}");
+        }
+        // Versions 8 to 11 store the same record (checked on public Affinity 1 and 2 files).
+        for version in 8..12 {
+            let mut legacy = b.clone();
+            legacy[4..6].copy_from_slice(&(version as u16).to_le_bytes());
+            assert!(preview(&legacy).is_ok());
+        }
+        // Flags 4 and 8 occur in real files; the low two bits mark other container variants.
+        for (flags, ok) in [(4u16, true), (8, true), (1, false), (2, false)] {
+            let mut variant = b.clone();
+            variant[6..8].copy_from_slice(&flags.to_le_bytes());
+            assert_eq!(preview(&variant).is_ok(), ok, "flags {flags}");
+        }
+        let mut old = b.clone();
+        old[4..6].copy_from_slice(&7u16.to_le_bytes());
+        assert!(matches!(preview(&old), Err(Error::Unsupported(_))));
+    }
+
+    #[test]
+    fn an_unindexed_png_or_resource_is_never_used() {
+        let mut b = fixture();
+        b[24..32].copy_from_slice(&0u64.to_le_bytes());
+        assert!(preview(&b).is_err());
+        b[24..32].copy_from_slice(&72u64.to_le_bytes());
+        b[76..80].copy_from_slice(b"Meta");
+        assert!(preview(&b).is_err());
+    }
+
+    #[test]
+    fn every_chunk_checksum_including_the_end_is_checked() {
+        let b = fixture();
+        for at in [130, b.len() - 1] {
+            let mut damaged = b.clone();
+            damaged[at] ^= 1;
+            assert_eq!(preview(&damaged).unwrap_err(), Error::Malformed("PNG chunk checksum"));
+        }
+        let mut ancillary = vec![0; 4];
+        ancillary.extend(b"tEXt");
+        ancillary.extend(crc32fast::hash(b"tEXt").to_be_bytes());
+        let mut with_ancillary = b.clone();
+        let at = b.len() - 12;
+        with_ancillary.splice(at..at, ancillary);
+        let png_length = (with_ancillary.len() - 101) as u32;
+        with_ancillary[84..88].copy_from_slice(&(png_length + 13).to_le_bytes());
+        with_ancillary[96..100].copy_from_slice(&png_length.to_le_bytes());
+        assert!(preview(&with_ancillary).is_ok());
+        with_ancillary[at + 8] ^= 1;
+        assert_eq!(preview(&with_ancillary).unwrap_err(), Error::Malformed("PNG chunk checksum"));
+    }
+
+    #[test]
+    fn compressed_metadata_and_animation_are_not_preview_support() {
+        for kind in [b"zTXt", b"iTXt", b"iCCP", b"acTL", b"fcTL", b"fdAT"] {
+            let mut extra = vec![0; 4];
+            extra.extend(kind);
+            extra.extend(crc32fast::hash(kind).to_be_bytes());
+            let mut b = fixture();
+            let at = b.len() - 12;
+            b.splice(at..at, extra);
+            let length = (b.len() - 101) as u32;
+            b[84..88].copy_from_slice(&(length + 13).to_le_bytes());
+            b[96..100].copy_from_slice(&length.to_le_bytes());
+            assert!(matches!(preview(&b), Err(Error::Unsupported(_))));
+        }
+    }
+
+    #[test]
+    fn critical_chunks_follow_a_single_complete_png_layout() {
+        fn with_chunks(kinds: &[&[u8; 4]]) -> Vec<u8> {
+            let original = fixture();
+            let mut b = original[..134].to_vec(); // File, record and complete first IHDR.
+            for kind in kinds {
+                b.extend([0; 4]);
+                b.extend(*kind);
+                b.extend(crc32fast::hash(*kind).to_be_bytes());
+            }
+            let length = (b.len() - 101) as u32;
+            b[84..88].copy_from_slice(&(length + 13).to_le_bytes());
+            b[96..100].copy_from_slice(&length.to_le_bytes());
+            b
+        }
+        assert!(preview(&with_chunks(&[b"IDAT", b"IDAT", b"IEND"])).is_ok());
+        // PNG readers must not reject an otherwise valid unknown ancillary chunk just
+        // because its reserved (third-letter) bit is set; future versions can define it.
+        assert!(preview(&with_chunks(&[b"abct", b"IDAT", b"IEND"])).is_ok());
+        for kinds in [
+            vec![b"IEND"],
+            vec![b"IDAT", b"IHDR", b"IEND"],
+            vec![b"PLTE", b"PLTE", b"IDAT", b"IEND"],
+            vec![b"IDAT", b"PLTE", b"IEND"],
+            vec![b"IDAT", b"tEXt", b"IDAT", b"IEND"],
+            vec![b"ABCD", b"IDAT", b"IEND"],
+            vec![b"IDAT", b"IEND", b"tEXt"],
+        ] {
+            assert!(preview(&with_chunks(&kinds)).is_err(), "{kinds:?}");
+        }
+    }
+
+    proptest! {
+        #![proptest_config(ProptestConfig::with_cases(256))]
+        #[test]
+        fn arbitrary_input_never_panics(b in prop::collection::vec(any::<u8>(), 0..2048)) {
+            let _ = header(&b);
+            let _ = preview(&b);
+        }
+        #[test]
+        fn mutations_never_panic(edits in prop::collection::vec((0usize..200, any::<u8>()), 0..32)) {
+            let mut b = fixture();
+            for (i, value) in edits { if let Some(v) = b.get_mut(i) { *v = value; } }
+            let _ = preview(&b);
+        }
+    }
+}
+
+mod archive {
+    use crate::Error;
+    use crate::container::{Archive, Limits};
+    use crate::stream::{self, Kind, Tag, Value};
+    use crate::synth::{self, F, Method, tag};
+    use proptest::prelude::*;
+
+    fn doc() -> Vec<u8> {
+        synth::stream(&[
+            (tag(b"Desc"), F::Str("Document".into())),
+            (tag(b"Visi"), F::Bool(true)),
+            (tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 5.0, 0.0, 1.0, -2.0])),
+            (tag(b"Colr"), F::Def(7, vec![tag(b"RGBA")], vec![(tag(b"_col"), F::Struct([0u8; 16].to_vec()))])),
+            (tag(b"Same"), F::Ref(7)),
+            (tag(b"Null"), F::Null),
+            (tag(b"Kids"), F::Shared(vec![F::Def(8, vec![tag(b"Grup"), tag(b"Node")], vec![(tag(b"Desc"), F::Str("g".into()))]), F::Ref(8)])),
+            (
+                tag(b"Crvs"),
+                F::Obj(tag(b"PCvD"), vec![(tag(b"Data"), F::Pos(vec![F::U8(0), F::U32(1), F::Bool(true), F::Records(18, vec![vec![0; 18]; 4])]))]),
+            ),
+            (tag(b"Enum"), F::Enum(2, 1)),
+            (tag(b"Tile"), F::Entry("d/3".into())),
+            (tag(b"Stat"), F::U8s(vec![4, 0, 2])),
+        ])
+    }
+
+    #[test]
+    fn every_method_round_trips_with_checksums() {
+        let d = doc();
+        for method in [Method::Stored, Method::Zlib, Method::Zstd] {
+            let file = synth::container(&[("doc.dat", &d, method), ("d/3", b"tile", method)], None);
+            let mut a = Archive::open(&file, Limits::default()).unwrap();
+            assert_eq!(a.header.version, 12);
+            assert_eq!(a.read("doc.dat").unwrap(), d);
+            assert_eq!(a.read("d/3").unwrap(), b"tile");
+            assert_eq!(a.extracted(), d.len() + 4);
+            assert!(a.read("missing").is_err());
+        }
+    }
+
+    #[test]
+    fn the_stream_parses_into_shared_objects_and_links() {
+        let s = stream::parse(&doc()).unwrap();
+        let root = &s.objects[s.root];
+        assert_eq!(root.class, Tag::of(b"Pers"));
+        assert_eq!(root.get(Tag::of(b"Desc")), Some(&Value::Str("Document".into())));
+        assert_eq!(root.get(Tag::of(b"Xfrm")), Some(&Value::Floats(vec![1.0, 0.0, 5.0, 0.0, 1.0, -2.0])));
+        let (Some(Value::Obj(Some(a))), Some(Value::Obj(Some(b)))) = (root.get(Tag::of(b"Colr")), root.get(Tag::of(b"Same"))) else { panic!() };
+        assert_eq!(a, b);
+        assert_eq!(s.objects[*a].class, Tag::of(b"RGBA"));
+        assert_eq!(s.objects[*a].kind, Kind::Shared);
+        let Some(Value::Array(kids)) = root.get(Tag::of(b"Kids")) else { panic!() };
+        assert_eq!(kids[0], kids[1]);
+        let Value::Obj(Some(g)) = kids[0] else { panic!() };
+        assert_eq!(s.objects[g].chain, vec![Tag::of(b"Grup"), Tag::of(b"Node")]);
+        assert_eq!(root.get(Tag::of(b"Enum")), Some(&Value::Enum { id: 2, version: 1 }));
+        assert_eq!(root.get(Tag::of(b"Tile")), Some(&Value::Entry("d/3".into())));
+        assert_eq!(root.get(Tag::of(b"Null")), Some(&Value::Obj(None)));
+    }
+
+    #[test]
+    fn checksums_sizes_and_budgets_are_enforced() {
+        let d = doc();
+        let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
+        // Flip a byte inside the compressed payload, past the "#Fil" tag at offset 72.
+        let mut broken = file.clone();
+        broken[90] ^= 0x55;
+        let mut a = Archive::open(&broken, Limits::default()).unwrap();
+        assert!(a.read("doc.dat").is_err());
+        let mut a = Archive::open(&file, Limits { max_entry: d.len() - 1, max_total: usize::MAX }).unwrap();
+        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
+        let mut a = Archive::open(&file, Limits { max_entry: usize::MAX, max_total: d.len() + 1 }).unwrap();
+        a.read("doc.dat").unwrap();
+        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
+    }
+
+    #[test]
+    fn a_declared_size_smaller_than_the_data_is_rejected_not_truncated() {
+        let big = vec![7u8; 1 << 20];
+        let mut file = synth::container(&[("doc.dat", &big, Method::Zlib)], None);
+        // Rewrite the declared size in the table to 1 KiB: decoding must stop and fail.
+        let fat = u64::from_le_bytes(file[16..24].try_into().unwrap()) as usize;
+        let size_at = fat + 59 + 5 + 8;
+        file[size_at..size_at + 8].copy_from_slice(&1024u64.to_le_bytes());
+        let mut a = Archive::open(&file, Limits::default()).unwrap();
+        assert_eq!(a.read("doc.dat").unwrap_err(), Error::Malformed("archive entry size mismatch"));
+    }
+
+    #[test]
+    fn libraries_and_cyclic_tables_are_rejected() {
+        let d = doc();
+        let mut file = synth::container(&[("doc.dat", &d, Method::Stored)], None);
+        let mut library = file.clone();
+        library[8..12].copy_from_slice(b"rAsA");
+        assert!(matches!(Archive::open(&library, Limits::default()), Err(Error::Unsupported(_))));
+        let fat = u64::from_le_bytes(file[16..24].try_into().unwrap());
+        let at = fat as usize + 4;
+        file[at..at + 8].copy_from_slice(&fat.to_le_bytes());
+        assert_eq!(Archive::open(&file, Limits::default()).unwrap_err(), Error::Malformed("allocation tables form a cycle"));
+    }
+
+    #[test]
+    fn hostile_streams_fail_cleanly() {
+        let deep = (0..2000).fold(Vec::new(), |inner, _| vec![(tag(b"Chld"), F::Obj(tag(b"Grup"), inner))]);
+        assert_eq!(stream::parse(&synth::stream(&deep)).unwrap_err(), Error::Limit("objects nested too deeply"));
+        // An array claiming four billion elements in a few bytes.
+        let huge = synth::stream(&[(tag(b"Big_"), F::Raw(vec![0x81, b'_', b'g', b'i', b'B', 0xff, 0xff, 0xff, 0xff, 0]))]);
+        assert_eq!(stream::parse(&huge).unwrap_err(), Error::Malformed("array longer than its data"));
+        let forward = synth::stream(&[(tag(b"Link"), F::Ref(99))]);
+        assert!(stream::parse(&forward).is_err());
+        let twice = synth::stream(&[(tag(b"A___"), F::Def(1, vec![tag(b"RGBA")], vec![])), (tag(b"B___"), F::Def(1, vec![tag(b"RGBA")], vec![]))]);
+        assert!(stream::parse(&twice).is_err());
+        let unknown = synth::stream(&[(tag(b"X___"), F::Raw(vec![0x0b, 1, 2, 3, 4]))]);
+        assert!(matches!(stream::parse(&unknown), Err(Error::Unsupported(_))));
+        let d = doc();
+        for end in 0..d.len() {
+            assert!(stream::parse(&d[..end]).is_err(), "{end}");
+        }
+    }
+
+    #[test]
+    fn a_small_compressed_entry_cannot_make_the_stream_allocate_gigabytes() {
+        // Each decoded value takes about 40 bytes, and a bool array packs eight in a byte: 16 MiB
+        // of zero bits, a few KiB once compressed, would ask for 2^27 values (about 4 GiB). An
+        // array of one-byte values just past the budget fails the same way, before allocating.
+        let field = |code: u8, n: u32, data: usize| {
+            let mut f = vec![0x80 | code];
+            f.extend(tag(b"Big_").0.to_le_bytes());
+            f.extend(n.to_le_bytes());
+            f.resize(f.len() + data, 0);
+            F::Raw(f)
+        };
+        let bools = 1u32 << 27;
+        let bytes = u32::try_from(stream::MAX_VALUES).unwrap() + 1;
+        for f in [field(0x29, bools, (bools / 8) as usize), field(0x01, bytes, bytes as usize)] {
+            let d = synth::stream(&[(tag(b"Big_"), f)]);
+            let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
+            assert!(file.len() < d.len() / 100, "{} of {}", file.len(), d.len());
+            let entry = Archive::open(&file, Limits::default()).unwrap().read("doc.dat").unwrap();
+            assert_eq!(stream::parse(&entry).unwrap_err(), Error::Limit("too many values in the document stream"));
+        }
+    }
+
+    proptest! {
+        #![proptest_config(ProptestConfig::with_cases(512))]
+        #[test]
+        fn mutated_containers_and_streams_never_panic(edits in prop::collection::vec((0usize..4096, any::<u8>()), 1..24)) {
+            let d = doc();
+            for method in [Method::Stored, Method::Zlib, Method::Zstd] {
+                let mut file = synth::container(&[("doc.dat", &d, method)], None);
+                for (i, v) in &edits {
+                    let n = file.len();
+                    file[i % n] = *v;
+                }
+                if let Ok(bytes) = Archive::open(&file, Limits::default()).and_then(|mut a| a.read("doc.dat")) {
+                    let _ = stream::parse(&bytes);
+                }
+            }
+            let mut s = d.clone();
+            for (i, v) in &edits {
+                let n = s.len();
+                s[i % n] = *v;
+            }
+            let _ = stream::parse(&s);
+        }
+    }
+}

crates/affinity/src/text.rs

@@ -0,0 +1,151 @@
+//! Artistic and frame text: the story's characters with their font, size, colour, tracking and
+//! leading, the paragraph alignment and the first baseline. Layout (line breaks in frames, kerning,
+//! OpenType features) is left to the importing application.
+
+use crate::model::{Affine, Align, Point, Reader, Text, TextRun, rect};
+use crate::paint::{self, Paint};
+use crate::stream::{ObjId, Value};
+
+/// Characters read per text node (stories are split into blocks; this caps hostile ones).
+const MAX_CHARS: usize = 1 << 20;
+
+pub(crate) fn read(r: &mut Reader, id: ObjId, world: Affine) -> Option<Text> {
+    let s = r.s;
+    let story = s.obj(id, b"StSt")?;
+    let frame = s.obj(id, b"TxtH")?;
+    let artistic = s.is(frame, b"ArFr");
+    let bounds = s.floats::<4>(frame, b"FrmB").map(rect)?;
+    let mut runs = Vec::new();
+    let mut align = None;
+    let mut total = 0usize;
+    let mut placeholders = false;
+    for block in s.objs(story, b"Blok") {
+        let glyphs = s.obj(block, b"Glyp")?;
+        let chars: Vec<char> = match s.str(glyphs, b"Utf8") {
+            Some(t) => t.chars().collect(),
+            None => {
+                // Inline objects (page numbers, anchors) each take one index before the segment text.
+                let mut v = Vec::new();
+                for seg in s.objs(glyphs, b"Mixd") {
+                    let inline = s.objs(seg, b"Glys").len();
+                    v.extend(std::iter::repeat_n('\u{FFFC}', inline));
+                    placeholders |= inline > 0;
+                    v.extend(s.str(seg, b"Utf8").unwrap_or_default().chars());
+                }
+                v
+            }
+        };
+        total = total.checked_add(chars.len())?;
+        if total > MAX_CHARS {
+            r.warn("text longer than a million characters (truncated)");
+            break;
+        }
+        let mut start = 0usize;
+        for run in s.obj(block, b"GAtt").map(|g| s.objs(g, b"Runs")).unwrap_or_default() {
+            let end = usize::try_from(s.int(run, b"Indx")?).ok()?.min(chars.len());
+            if end <= start {
+                continue;
+            }
+            let text: String = chars.get(start..end)?.iter().filter(|c| **c != '\0' && **c != '\u{FFFC}').collect();
+            start = end;
+            let Some(attrs) = s.obj(run, b"Item") else { continue };
+            if !text.is_empty() {
+                runs.push(run_attrs(r, attrs, text, world));
+            }
+        }
+        if align.is_none() {
+            align = s
+                .obj(block, b"PAtt")
+                .and_then(|p| s.objs(p, b"Runs").first().copied())
+                .and_then(|run| s.obj(run, b"Item"))
+                .map(|p| paragraph_align(r, p));
+        }
+    }
+    if placeholders {
+        r.warn("text fields such as page numbers (left out of the text)");
+    }
+    let align = align.unwrap_or(Align::Left);
+    let first_baseline = bounds.y0 + s.f64(frame, b"ArtV").unwrap_or(0.0);
+    let anchor_x = match align {
+        Align::Center => (bounds.x0 + bounds.x1) / 2.0,
+        Align::Right => bounds.x1,
+        _ => bounds.x0,
+    };
+    if !artistic {
+        if s.objs(frame, b"ColW").len() > 1 || matches!(s.field(frame, b"ColW"), Some(Value::Array(a)) if a.len() > 1) {
+            r.warn("text frames with several columns (imported as one column)");
+        }
+        if s.class(id) == Some(crate::stream::Tag::of(b"TxtC")) {
+            r.warn("text frames with a curved outline (imported as rectangular frames)");
+        }
+    }
+    Some(Text { runs, align, anchor: Point { x: anchor_x, y: first_baseline }, frame: if artistic { None } else { Some(bounds) }, transform: world })
+}
+
+fn slot<T: Copy>(v: Option<&Value>, i: usize, f: impl Fn(&Value) -> Option<T>) -> Option<T> {
+    match v? {
+        Value::Array(a) => a.get(i).and_then(f),
+        _ => None,
+    }
+}
+
+fn float(v: &Value) -> Option<f64> {
+    match v {
+        Value::Float(f) if f.is_finite() => Some(*f),
+        _ => None,
+    }
+}
+
+fn int(v: &Value) -> Option<i64> {
+    match v {
+        Value::Int(i) => Some(*i),
+        Value::UInt(u) => i64::try_from(*u).ok(),
+        _ => None,
+    }
+}
+
+fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine) -> TextRun {
+    let s = r.s;
+    let doubles = s.field(attrs, b"Doub");
+    let ints = s.field(attrs, b"Ints");
+    let size = slot(doubles, 0, float).filter(|v| *v > 0.0 && *v < 1e6).unwrap_or(12.0 * r.dpi / 72.0);
+    let tracking = slot(doubles, 4, float).unwrap_or(0.0);
+    let leading = (slot(ints, 4, int) == Some(1)).then(|| slot(doubles, 13, float)).flatten().filter(|v| *v > 0.0);
+    let objects = match s.field(attrs, b"Objs") {
+        Some(Value::Array(a)) => a.iter().map(|v| if let Value::Obj(o) = v { *o } else { None }).collect(),
+        _ => Vec::new(),
+    };
+    let fill = objects.first().copied().flatten().and_then(|f| paint::descriptor(r, f, world)).unwrap_or(Paint::None);
+    if objects.get(1).copied().flatten().and_then(|f| paint::descriptor(r, f, world)).is_some_and(|p| p != Paint::None) {
+        r.warn("outlined (stroked) text");
+    }
+    if slot(doubles, 10, float).is_some_and(|h| (h - 1.0).abs() > 1e-3) {
+        r.warn("horizontally scaled text");
+    }
+    let font = s.obj(attrs, b"DFnt");
+    let get = |tag: &[u8; 4]| font.and_then(|f| s.str(f, tag)).unwrap_or_default().to_string();
+    TextRun {
+        text,
+        postscript: get(b"Post"),
+        family: get(b"Famy"),
+        weight: font.and_then(|f| s.int(f, b"Wegt")).unwrap_or(400),
+        italic: font.and_then(|f| s.bool(f, b"Ital")).unwrap_or(false),
+        size,
+        tracking,
+        leading,
+        fill,
+    }
+}
+
+fn paragraph_align(r: &mut Reader, p: ObjId) -> Align {
+    match slot(r.s.field(p, b"Ints"), 0, int) {
+        Some(1) => Align::Center,
+        Some(2) => Align::Right,
+        Some(3) => Align::Justify,
+        Some(0) | None => Align::Left,
+        Some(_) => {
+            r.warn("an unknown paragraph alignment (imported as left)");
+            Align::Left
+        }
+    }
+}

crates/affinity/tests/real_files.rs

@@ -0,0 +1,83 @@
+//! Public Affinity documents: the pinned set `cargo xtask corpus --affinity` fetches into
+//! `corpus/affinity`, or any folder of `.af`/`.afdesign`/`.afphoto`/`.afpub` files named by
+//! `AFFINITY_SAMPLES` (searched recursively). Without either, these tests do nothing.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::{Path, PathBuf};
+
+use vectorcraft_affinity::{Archive, Limits, stream};
+
+fn files(dir: &Path, out: &mut Vec<PathBuf>) {
+    for e in std::fs::read_dir(dir).into_iter().flatten().flatten() {
+        let p = e.path();
+        if p.is_dir() {
+            files(&p, out);
+        } else if p.extension().and_then(|e| e.to_str()).is_some_and(|e| ["af", "afdesign", "afphoto", "afpub", "aftemplate"].contains(&e))
+            && std::fs::read(&p).is_ok_and(|b| b.starts_with(vectorcraft_affinity::MAGIC))
+        {
+            out.push(p);
+        }
+    }
+}
+
+fn samples() -> Option<PathBuf> {
+    let pinned = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
+    std::env::var_os("AFFINITY_SAMPLES").map(PathBuf::from).or_else(|| pinned.join("SOURCES.md").exists().then_some(pinned))
+}
+
+#[test]
+fn public_documents_parse_completely() {
+    let Some(dir) = samples() else { return };
+    let mut paths = Vec::new();
+    files(&dir, &mut paths);
+    assert!(!paths.is_empty(), "no Affinity documents under {dir:?}");
+    let mut failures = Vec::new();
+    for p in &paths {
+        let bytes = std::fs::read(p).unwrap();
+        let result = Archive::open(&bytes, Limits::default()).and_then(|mut a| {
+            let doc = a.read("doc.dat")?;
+            stream::parse(&doc).map(|s| s.objects.len())
+        });
+        match result {
+            Ok(n) => assert!(n > 0),
+            Err(e) => failures.push(format!("{}: {e}", p.display())),
+        }
+    }
+    assert!(failures.is_empty(), "{} of {} failed:\n{}", failures.len(), paths.len(), failures.join("\n"));
+    eprintln!("{} Affinity documents parsed", paths.len());
+}
+
+#[test]
+fn public_documents_map_to_the_model() {
+    let Some(dir) = samples() else { return };
+    let mut paths = Vec::new();
+    files(&dir, &mut paths);
+    let mut warnings = std::collections::BTreeMap::<String, usize>::new();
+    let mut failures = Vec::new();
+    let (mut nodes, mut docs) = (0usize, 0usize);
+    fn count(n: &[vectorcraft_affinity::model::Node]) -> usize {
+        n.iter().map(|n| 1 + count(&n.children)).sum()
+    }
+    for p in &paths {
+        let bytes = std::fs::read(p).unwrap();
+        if !bytes.starts_with(vectorcraft_affinity::MAGIC) {
+            continue;
+        }
+        match vectorcraft_affinity::read(&bytes, Limits::default()) {
+            Ok(d) => {
+                docs += 1;
+                nodes += d.spreads.iter().map(|s| count(&s.nodes)).sum::<usize>();
+                for w in d.warnings {
+                    let key = w.split(" (").next().unwrap_or(&w).to_string();
+                    *warnings.entry(key).or_default() += 1;
+                }
+            }
+            Err(e) => failures.push(format!("{}: {e}", p.display())),
+        }
+    }
+    eprintln!("{docs} documents, {nodes} nodes");
+    for (w, n) in &warnings {
+        eprintln!("{n:4} documents: {w}");
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}

crates/cad/src/lib.rs

@@ -2,9 +2,9 @@
 //!
 //! [`export`] writes the visible art of a document into one DXF drawing: each layer becomes a DXF
 //! layer (hidden ones switched off, locked ones locked, non-printing ones not plotted), paths
-//! become polylines (straight segments) or cubic splines (curves), fills solid hatches, type text
-//! entities or glyph outlines, and placed images image entities linked to PNG or JPEG files the
-//! caller writes next to the drawing. Coordinates are y-up, in drawing units: `scale` units per
+//! become polylines (straight segments) or cubic splines (curves), fills their outlines and solid
+//! hatches, type text entities or glyph outlines, and placed images image entities linked to PNG
+//! or JPEG files the caller writes next to the drawing. Coordinates are y-up, in drawing units: `scale` units per
 //! `unit` of the art, with the origin at the bottom-left corner of [`DxfOptions::region`].
 //!
 //! What DXF can't hold (blending modes, opacity masks, raster effects, gradients, patterns,

crates/cad/src/scene.rs

@@ -1,6 +1,7 @@
 //! The document walk: each visible object becomes DXF entities on its layer's DXF layer, in paint
-//! order. Fills are solid hatches (outlines in R12), strokes polylines and cubic splines with a
-//! lineweight and dashes, or filled outlines where the look needs them.
+//! order. Fills are their outlines then solid hatches (the outlines alone in R12), strokes
+//! polylines and cubic splines with a lineweight and dashes, or filled outlines where the look
+//! needs them.
 
 use std::collections::HashMap;
 use std::io::Cursor;
@@ -504,8 +505,9 @@ impl<'a> Scene<'a> {
         Some(vectorcraft_brush::stroke_pieces(b, bp, st))
     }
 
-    /// A filled area as a solid hatch (R12: its outlines). `clean`: the path has no overlaps, so
-    /// the hatch's even-odd rule reads it as it is.
+    /// A filled area as its outlines followed by a solid hatch (R12: the outlines alone). Laser
+    /// and cutter software reads the outlines and skips hatches. `clean`: the path has no
+    /// overlaps, so the hatch's even-odd rule reads it as it is.
     fn area(&mut self, bp: &BezPath, rule: FillRule, style: &EntityStyle, clean: bool) {
         if !self.o.version.handles() {
             self.warn(NO_FILLS);
@@ -517,10 +519,12 @@ impl<'a> Scene<'a> {
             .then(|| vectorcraft_pathops::try_normalize(&PathData::from_bezpath(bp), rule).ok())
             .flatten()
             .map(|p| p.to_bezpath());
-        let loops: Vec<Vec<Point>> = polygons(normalized.as_ref().unwrap_or(bp)).into_iter().filter(|p| p.len() >= 3).collect();
+        let outline = normalized.as_ref().unwrap_or(bp);
+        let loops: Vec<Vec<Point>> = polygons(outline).into_iter().filter(|p| p.len() >= 3).collect();
         if loops.is_empty() {
             return;
         }
+        self.lines(outline, style, 0.0);
         let h = self.handle();
         let layer = self.layer.clone();
         self.e.entity("HATCH", h, fixed::MODEL_RECORD, &layer, style, "AcDbHatch");

crates/cad/src/tests.rs

@@ -129,30 +129,42 @@ fn every_version_declares_its_acadver_and_is_well_formed() {
 fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
     let d = shapes_doc();
     let out = export(&d, &opts(&d)).unwrap();
-    assert_eq!(kinds(&out), ["HATCH", "LWPOLYLINE", "SPLINE"], "fill, then stroke, then the ellipse's stroke");
+    assert_eq!(
+        kinds(&out),
+        ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"],
+        "the fill's outline and hatch, then the stroke, then the ellipse's stroke"
+    );
     let e = entities(&out);
     // The rectangle, y up from the artboard's bottom-left corner: 10..110 × 40..90.
-    let poly = &e[1];
-    assert_eq!(get(poly, 70), Some("1"), "closed");
-    let mut xs = all(poly, 10);
-    xs.sort_by(f64::total_cmp);
-    assert_eq!(xs, [10.0, 10.0, 110.0, 110.0]);
-    let mut ys = all(poly, 20);
-    ys.sort_by(f64::total_cmp);
-    assert_eq!(ys, [40.0, 40.0, 90.0, 90.0]);
-    let hatch = &e[0];
+    let corners = |poly: &Pairs| {
+        let mut xs = all(poly, 10);
+        xs.sort_by(f64::total_cmp);
+        let mut ys = all(poly, 20);
+        ys.sort_by(f64::total_cmp);
+        (xs, ys)
+    };
+    let rect = (vec![10.0, 10.0, 110.0, 110.0], vec![40.0, 40.0, 90.0, 90.0]);
+    for poly in [&e[0], &e[2]] {
+        assert_eq!(get(poly, 70), Some("1"), "closed");
+        assert_eq!(corners(poly), rect);
+    }
+    // Laser and cutter software skips hatches: the fill's outline comes first, without a lineweight.
+    assert_eq!((get(&e[0], 370), get(&e[2], 370)), (None, Some("35")));
+    let hatch = &e[1];
     assert_eq!((get(hatch, 2), get(hatch, 70), get(hatch, 91), get(hatch, 93)), (Some("SOLID"), Some("1"), Some("1"), Some("4")));
     // The ellipse: four cubics through clamped knots.
-    let spline = &e[2];
+    let spline = &e[3];
     assert_eq!((get(spline, 71), get(spline, 73)), (Some("3"), Some("13")));
     assert_eq!(all(spline, 40), [0.0, 0.0, 0.0, 0.0, 1.0, 1.0, 1.0, 2.0, 2.0, 2.0, 3.0, 3.0, 3.0, 4.0, 4.0, 4.0, 4.0]);
     // R14 has lightweight polylines but no lineweights: the stroke is a polyline width.
     let r14 = export(&d, &DxfOptions { version: DxfVersion::R14, ..opts(&d) }).unwrap();
-    assert_eq!(get(&entities(&r14)[1], 43), Some("1"));
-    assert_eq!(get(&entities(&r14)[1], 370), None);
+    assert_eq!(get(&entities(&r14)[2], 43), Some("1"));
+    assert_eq!(get(&entities(&r14)[2], 370), None);
+    assert_eq!(get(&entities(&r14)[0], 43), None, "a fill's outline has no width");
     // R13 has splines and hatches, and polylines of vertices.
     let r13 = export(&d, &DxfOptions { version: DxfVersion::R13, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&r13), ["HATCH", "POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND", "SPLINE"]);
+    let poly = ["POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND"];
+    assert_eq!(kinds(&r13), [&poly[..], &["HATCH"], &poly, &["SPLINE"]].concat());
     // R12: polylines only; the fill is its outline, the ellipse flattened.
     let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
     let k = kinds(&r12);
@@ -171,8 +183,9 @@ fn colours_map_to_the_index_palette_or_true_colour() {
     };
     let out = export(&d, &opts(&d)).unwrap();
     assert_eq!(style(&out, 0), (Some("1".into()), Some("16711680".into())), "red: index 1, true colour 0xFF0000");
-    assert_eq!(style(&out, 1), (Some("7".into()), Some("0".into())), "black is index 7");
-    assert_eq!(style(&out, 2), (Some("5".into()), Some("255".into())));
+    assert_eq!(style(&out, 1), style(&out, 0), "the fill's outline has the fill's colour");
+    assert_eq!(style(&out, 2), (Some("7".into()), Some("0".into())), "black is index 7");
+    assert_eq!(style(&out, 3), (Some("5".into()), Some("255".into())));
     for depth in [ColorDepth::Aci8, ColorDepth::Aci16, ColorDepth::Aci256] {
         let o = export(&d, &DxfOptions { colors: depth, ..opts(&d) }).unwrap();
         assert_eq!(style(&o, 0), (Some("1".into()), None), "{depth:?}");
@@ -196,7 +209,7 @@ fn colours_map_to_the_index_palette_or_true_colour() {
 fn units_scale_coordinates_and_set_insunits() {
     let d = shapes_doc();
     let insunits = |o: &DxfOutput| header(&pairs(&o.bytes), "$INSUNITS");
-    let max_x = |o: &DxfOutput| all(&entities(o)[1], 10).into_iter().fold(f64::MIN, f64::max);
+    let max_x = |o: &DxfOutput| all(&entities(o)[2], 10).into_iter().fold(f64::MIN, f64::max);
     let mm = export(&d, &DxfOptions { unit: Unit::Millimeters, ..opts(&d) }).unwrap();
     assert_eq!(insunits(&mm).as_deref(), Some("4"));
     assert!((max_x(&mm) - 110.0 * 25.4 / 72.0).abs() < 1e-5);
@@ -208,9 +221,9 @@ fn units_scale_coordinates_and_set_insunits() {
     assert_eq!(insunits(&scaled).as_deref(), Some("0"));
     assert!((max_x(&scaled) - 110.0 / 72.0 * 10.0).abs() < 1e-5);
     // Lineweights: 1 pt is 0.35 mm, scaled with the drawing only when asked.
-    assert_eq!(get(&entities(&scaled)[1], 370), Some("35"));
+    assert_eq!(get(&entities(&scaled)[2], 370), Some("35"));
     let heavy = export(&d, &DxfOptions { unit: Unit::Inches, scale: 2.0, scale_lineweights: true, ..opts(&d) }).unwrap();
-    assert_eq!(get(&entities(&heavy)[1], 370), Some("70"));
+    assert_eq!(get(&entities(&heavy)[2], 370), Some("70"));
     assert!(export(&d, &DxfOptions { scale: 0.0, ..opts(&d) }).is_err());
     assert!(export(&d, &DxfOptions { scale: f64::NAN, ..opts(&d) }).is_err());
 }
@@ -238,7 +251,7 @@ fn layers_become_dxf_layers() {
     assert_eq!(names, ["0", "Layer 1", "Dims_ _top_", "Notes"], "the template layer is left out");
     assert!(layers[3].1.starts_with('-'), "a hidden layer is switched off");
     let on: Vec<String> = entities(&out).iter().map(|e| get(e, 8).unwrap().to_string()).collect();
-    assert_eq!(on, ["Layer 1", "Layer 1", "Layer 1", "Dims_ _top_", "Notes"]);
+    assert_eq!(on, ["Layer 1", "Layer 1", "Layer 1", "Layer 1", "Dims_ _top_", "Dims_ _top_", "Notes", "Notes"]);
     // Before 2000: capitals, letters, digits and $-_ only.
     let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
     let names: Vec<String> = table(&r12, "LAYER").iter().map(|o| get(o, 2).unwrap().to_string()).collect();
@@ -270,18 +283,21 @@ fn dashes_become_linetypes_and_opacity_transparency() {
 fn alter_paths_writes_strokes_as_filled_outlines() {
     let d = shapes_doc();
     let out = export(&d, &DxfOptions { alter_paths: true, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&out), ["HATCH", "HATCH", "HATCH"]);
+    // Each fill and stroke: its outlines, then its hatch.
+    let fill = ["LWPOLYLINE", "HATCH"];
+    let rect_stroke = ["LWPOLYLINE", "LWPOLYLINE", "HATCH"];
+    assert_eq!(kinds(&out), [&fill[..], &rect_stroke, &["SPLINE", "SPLINE", "HATCH"]].concat());
     // The rectangle's stroke: an outer and an inner boundary.
-    assert_eq!(get(&entities(&out)[1], 91), Some("2"));
+    assert_eq!(get(&entities(&out)[4], 91), Some("2"));
     // Preserve Appearance outlines only the strokes a line can't draw.
     let mut d = shapes_doc();
     let rect = d.layers[0].children().and_then(|c| c.first()).map(|n| n.id).unwrap();
     if let Some(st) = d.node_mut(rect).and_then(|n| n.appearance.stroke_mut()) {
         st.align = vectorcraft_doc::StrokeAlign::Outside;
     }
-    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), ["HATCH", "HATCH", "SPLINE"]);
+    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), [&fill[..], &rect_stroke, &["SPLINE"]].concat());
     let editable = export(&d, &DxfOptions { preserve: Preserve::Editability, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&editable), ["HATCH", "LWPOLYLINE", "SPLINE"]);
+    assert_eq!(kinds(&editable), ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"]);
     assert!(editable.warnings.iter().any(|w| w.contains("stroke alignment")));
 }
 
@@ -308,7 +324,9 @@ fn type_is_text_or_outlines() {
     // Outline Text, and Preserve Appearance: the glyphs as filled outlines.
     for o in [DxfOptions { preserve: Preserve::Editability, outline_text: true, ..opts(&d) }, opts(&d)] {
         let k = kinds(&export(&d, &o).unwrap());
-        assert!(!k.is_empty() && k.iter().all(|k| k == "HATCH"), "{k:?}");
+        assert!(k.iter().any(|k| k == "HATCH"), "{k:?}");
+        assert!(k.iter().all(|k| matches!(k.as_str(), "HATCH" | "LWPOLYLINE" | "SPLINE")), "{k:?}");
+        assert_eq!(k.first().map(String::as_str), Some("SPLINE"), "a glyph's outline before its hatch");
     }
 }
 
@@ -367,5 +385,5 @@ fn crop_leaves_out_art_outside_the_region() {
     // Only the ellipse (120..180) reaches into 115..200.
     let o = DxfOptions { region: Rect::new(115.0, 0.0, 200.0, 100.0), crop: true, ..opts(&d) };
     assert_eq!(kinds(&export(&d, &o).unwrap()), ["SPLINE"]);
-    assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 3);
+    assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 4);
 }

crates/color/src/cms/icc.rs

@@ -1,7 +1,7 @@
 //! ICC profiles through `moxcms` (pure Rust): built-in RGB spaces and user-supplied `.icc` files,
 //! and the profiles exports embed ([`encode_builtin`]), written in code from the CMS.
 
-use std::sync::{Arc, OnceLock};
+use std::sync::{Arc, Mutex, OnceLock};
 
 use moxcms::{
     ColorProfile, DataColorSpace, Layout, LocalizableString, LutMultidimensionalType, LutStore, LutWarehouse, Matrix3d, ProfileClass, ProfileText,
@@ -27,6 +27,9 @@ fn intent_index(i: Intent) -> usize {
 
 type Xf = Option<Arc<TransformF32Executor>>;
 
+/// A direct transform's cache key: destination name, intent index, black-point compensation.
+type DirectKey = (String, usize, bool);
+
 /// A parsed ICC profile plus lazily-built transforms to/from sRGB.
 pub struct IccProfile {
     pub name: String,
@@ -37,6 +40,21 @@ pub struct IccProfile {
     srgb: ColorProfile,
     to_srgb: [OnceLock<Xf>; 4],
     from_srgb: [OnceLock<Xf>; 4],
+    /// Direct transforms into other RGB profiles ([`Self::to_rgb_of`]), by destination, intent
+    /// and black-point compensation.
+    direct: Mutex<Vec<(DirectKey, Option<Arc<Direct>>)>>,
+}
+
+/// A transform from one profile into an RGB profile without passing through sRGB: into the
+/// destination's primaries with linear tone curves, where black-point compensation is a linear
+/// remap, then onto its own curves.
+struct Direct {
+    to_linear: Arc<TransformF32Executor>,
+    /// Linear → the destination's curves; `None` when the destination isn't a matrix profile
+    /// (the first transform goes straight into it, without compensation).
+    to_dest: Option<Arc<TransformF32Executor>>,
+    /// The source black's luminance in the linear destination (0: no compensation).
+    black: f32,
 }
 
 impl std::fmt::Debug for IccProfile {
@@ -72,6 +90,7 @@ impl IccProfile {
             srgb: ColorProfile::new_srgb(),
             to_srgb: Default::default(),
             from_srgb: Default::default(),
+            direct: Mutex::new(Vec::new()),
         })
     }
 
@@ -135,6 +154,72 @@ impl IccProfile {
         Some(dst.into_iter().map(|x| x.clamp(0.0, 1.0)).collect())
     }
 
+    /// Device values (RGB / CMYK / Gray, 0..1) → `dest`'s RGB, converted directly with `intent`:
+    /// not through sRGB, so colours outside sRGB keep their place in a wider space. With `bpc`
+    /// (and an intent other than absolute), this profile's black maps onto the destination's
+    /// black (black-point compensation, the darkest ink the profile prints becoming RGB 0 rather
+    /// than a dark grey). `None` when `dest` isn't RGB or no transform can be built.
+    pub fn to_rgb_of(&self, dest: &IccProfile, v: &[f32], intent: Intent, bpc: bool) -> Option<[f32; 3]> {
+        let t = self.direct_xf(dest, intent, bpc && intent != Intent::AbsoluteColorimetric)?;
+        let mut src = v.to_vec();
+        src.resize(self.channels(), 0.0);
+        let mut lin = [0.0f32; 3];
+        t.to_linear.transform(&src, &mut lin).ok()?;
+        let Some(to_dest) = &t.to_dest else { return Some(lin.map(|x| x.clamp(0.0, 1.0))) };
+        if t.black > 0.0 {
+            lin = lin.map(|x| (x - t.black) / (1.0 - t.black));
+        }
+        let lin = lin.map(|x| x.clamp(0.0, 1.0));
+        let mut out = [0.0f32; 3];
+        to_dest.transform(&lin, &mut out).ok()?;
+        Some(out.map(|x| x.clamp(0.0, 1.0)))
+    }
+
+    fn direct_xf(&self, dest: &IccProfile, intent: Intent, bpc: bool) -> Option<Arc<Direct>> {
+        if dest.kind != ProfileKind::Rgb {
+            return None;
+        }
+        let key = (dest.name.clone(), intent_index(intent), bpc);
+        let mut cache = self.direct.lock().unwrap_or_else(|e| e.into_inner());
+        if let Some((_, t)) = cache.iter().find(|(k, _)| *k == key) {
+            return t.clone();
+        }
+        let t = self.build_direct(dest, intent, bpc).map(Arc::new);
+        cache.push((key, t.clone()));
+        t
+    }
+
+    fn build_direct(&self, dest: &IccProfile, intent: Intent, bpc: bool) -> Option<Direct> {
+        let d = &dest.profile;
+        let matrix = d.red_trc.is_some() && d.green_trc.is_some() && d.blue_trc.is_some();
+        if !matrix {
+            let xf = self.profile.create_transform_f32(self.layout(), d, Layout::Rgb, Self::opts(intent)).ok()?;
+            return Some(Direct { to_linear: xf, to_dest: None, black: 0.0 });
+        }
+        let mut linear = d.clone();
+        for trc in [&mut linear.red_trc, &mut linear.green_trc, &mut linear.blue_trc] {
+            *trc = Some(ToneReprCurve::Parametric(vec![1.0]));
+        }
+        // A coding-independent code point names the transfer curve outright (moxcms's sRGB has
+        // one) and would override the linear curves.
+        linear.cicp = None;
+        let to_linear = self.profile.create_transform_f32(self.layout(), &linear, Layout::Rgb, Self::opts(intent)).ok()?;
+        let to_dest = linear.create_transform_f32(Layout::Rgb, d, Layout::Rgb, Self::opts(Intent::RelativeColorimetric)).ok()?;
+        // The source black: the darkest colour the profile reproduces, found as lcms does for an
+        // output profile (black sent into the profile and read back), made neutral.
+        let black = if bpc && self.kind == ProfileKind::Cmyk {
+            let inks = self.from_srgb([0.0; 3], Intent::RelativeColorimetric)?;
+            let mut lin = [0.0f32; 3];
+            to_linear.transform(&inks, &mut lin).ok()?;
+            let y = |c: &moxcms::Xyzd| c.y as f32;
+            let lum = lin[0] * y(&d.red_colorant) + lin[1] * y(&d.green_colorant) + lin[2] * y(&d.blue_colorant);
+            lum.clamp(0.0, 0.5)
+        } else {
+            0.0
+        };
+        Some(Direct { to_linear, to_dest: Some(to_dest), black })
+    }
+
     /// Whether transforms can be built for this profile (checked at registration).
     pub fn usable(&self) -> bool {
         self.to_xf(Intent::RelativeColorimetric).is_some() && self.inverse_xf(Intent::RelativeColorimetric).is_some()

crates/color/src/cms/mod.rs

@@ -356,10 +356,37 @@ impl Cms {
         }
     }
 
-    /// CMYK in the working space → display sRGB (`absolute` simulates the paper colour).
+    /// CMYK in the working space → display sRGB (`absolute` simulates the paper colour). An ICC
+    /// CMYK profile converts as [`Self::cmyk_to_rgb`] does into sRGB (with the settings'
+    /// black-point compensation), so what shows is what an RGB export writes.
     pub fn cmyk_to_srgb(&self, cmyk: [f32; 4], absolute: bool) -> [f32; 3] {
+        if let (false, CmykSpace::Icc(p)) = (absolute, &self.cmyk)
+            && let Some(srgb) = builtin_rgb_cache(SRGB)
+            && let Some(v) = p.to_rgb_of(&srgb, &cmyk.map(|v| v.clamp(0.0, 1.0)), Intent::RelativeColorimetric, self.settings.bpc)
+        {
+            return v;
+        }
         Self::cmyk_to_srgb_in(&self.cmyk, cmyk, absolute)
     }
+    /// CMYK in the working space → working RGB with `intent`. An ICC CMYK profile converts
+    /// directly into the RGB profile: not through display sRGB, which would clip colours a wider
+    /// RGB space holds (Wide Gamut RGB keeps CMYK cyan that sRGB can't show), and with the
+    /// settings' black-point compensation. The built-in CMYK spaces go through sRGB as before
+    /// (Generic CMYK compensates in its own model).
+    pub fn cmyk_to_rgb(&self, cmyk: [f32; 4], intent: Intent) -> [f32; 3] {
+        let cmyk = cmyk.map(|v| v.clamp(0.0, 1.0));
+        let src = match &self.cmyk {
+            CmykSpace::Icc(p) => Some(p.clone()),
+            CmykSpace::Generic(_) | CmykSpace::Device => None,
+        };
+        let dest = match &self.rgb {
+            RgbSpace::Icc(p) => Some(p.clone()),
+            RgbSpace::Srgb => builtin_rgb_cache(SRGB),
+        };
+        src.zip(dest)
+            .and_then(|(s, d)| s.to_rgb_of(&d, &cmyk, intent, self.settings.bpc))
+            .unwrap_or_else(|| self.srgb_to_rgb(self.cmyk_to_srgb(cmyk, false)))
+    }
     /// Display sRGB → working CMYK with `intent`.
     pub fn srgb_to_cmyk(&self, srgb: [f32; 3], intent: Intent) -> [f32; 4] {
         Self::srgb_to_cmyk_in(&self.cmyk, srgb, intent, self.settings.bpc)
@@ -424,6 +451,10 @@ impl Cms {
                 let [c, m, y, k] = self.to_cmyk(c, intent);
                 Color::Cmyk { c, m, y, k }
             }
+            (Color::Cmyk { c, m, y, k }, Model::Rgb) => {
+                let [r, g, b] = self.cmyk_to_rgb([*c, *m, *y, *k], intent);
+                Color::Rgb { r, g, b }
+            }
             (_, Model::Rgb) => {
                 let [r, g, b] = self.srgb_to_rgb(self.display_rgb(c));
                 Color::Rgb { r, g, b }

crates/color/src/cms/tests_icc.rs

@@ -60,3 +60,54 @@ fn a_loaded_profile_is_embedded_as_loaded() {
     register_icc(&bytes, Some("Embedded As Loaded RGB".into())).unwrap();
     assert_eq!(&*icc_bytes("Embedded As Loaded RGB").unwrap(), &bytes[..]);
 }
+
+/// Settings with an ICC CMYK profile (Generic CMYK's, loaded as a file is) and Wide Gamut RGB.
+fn icc_cmyk(bpc: bool) -> Cms {
+    let name = register_icc(&icc_bytes(GENERIC_CMYK).unwrap(), Some("Test ICC CMYK".into())).unwrap().name;
+    Cms::new(&ColorSettings { rgb: WIDE_GAMUT_RGB.into(), cmyk: name, bpc, ..ColorSettings::default() }).unwrap()
+}
+
+#[test]
+fn icc_cmyk_converts_into_a_wide_rgb_space_directly_without_clipping_to_srgb() {
+    let wide = icc_cmyk(true);
+    let cyan = [1.0, 0.0, 0.0, 0.0];
+    let direct = wide.cmyk_to_rgb(cyan, Intent::RelativeColorimetric);
+    // Through sRGB, cyan clips to sRGB's gamut first: in the wider space that reads as a red
+    // channel well above zero.
+    let hub = wide.srgb_to_rgb(wide.cmyk_to_srgb(cyan, false));
+    assert!(direct[0] + 0.15 < hub[0], "direct {direct:?}, through sRGB {hub:?}");
+    // Same colour either way where sRGB holds it: a mid grey and paper white.
+    for inks in [[0.0, 0.0, 0.0, 0.5], [0.0; 4]] {
+        let (d, h) = (wide.cmyk_to_rgb(inks, Intent::RelativeColorimetric), wide.srgb_to_rgb(wide.cmyk_to_srgb(inks, false)));
+        assert!(d.iter().zip(h).all(|(a, b)| (a - b).abs() < 0.02), "{inks:?}: direct {d:?}, through sRGB {h:?}");
+    }
+    // Cms::convert takes the direct route for CMYK.
+    let Color::Rgb { r, .. } = wide.convert(&Color::Cmyk { c: 1.0, m: 0.0, y: 0.0, k: 0.0 }, Model::Rgb, Intent::RelativeColorimetric) else {
+        panic!("RGB")
+    };
+    assert!((r - direct[0]).abs() < 1e-6);
+}
+
+#[test]
+fn black_point_compensation_maps_the_darkest_ink_to_rgb_black() {
+    let rich = [0.75, 0.68, 0.67, 0.9];
+    let (on, off) = (icc_cmyk(true).cmyk_to_rgb(rich, Intent::RelativeColorimetric), icc_cmyk(false).cmyk_to_rgb(rich, Intent::RelativeColorimetric));
+    // Without compensation the profile's black is a dark grey; with it, rich black goes most of
+    // the way to RGB black (not all: it isn't quite the darkest ink the profile prints).
+    assert!(off.iter().all(|v| *v > 0.1), "without: {off:?}");
+    assert!(on.iter().zip(off).all(|(a, b)| *a < 0.08 && *a < b * 0.5), "with: {on:?}, without: {off:?}");
+    // The screen shows what an sRGB conversion writes, compensated alike.
+    let srgb = |bpc| {
+        let c = icc_cmyk(bpc);
+        Cms::new(&ColorSettings { rgb: SRGB.into(), ..c.settings().clone() }).unwrap()
+    };
+    for bpc in [true, false] {
+        let c = srgb(bpc);
+        assert_eq!(c.cmyk_to_srgb(rich, false), c.cmyk_to_rgb(rich, Intent::RelativeColorimetric), "bpc {bpc}");
+    }
+    // White is untouched, and absolute colorimetric never compensates.
+    let white = icc_cmyk(true).cmyk_to_rgb([0.0; 4], Intent::RelativeColorimetric);
+    assert!(white.iter().all(|v| *v > 0.99), "{white:?}");
+    let abs = |bpc| icc_cmyk(bpc).cmyk_to_rgb(rich, Intent::AbsoluteColorimetric);
+    assert_eq!(abs(true), abs(false));
+}

crates/doc/src/cmyk.rs

@@ -136,10 +136,65 @@ fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
     Inks::new(w, h, data)
 }
 
+/// A CMYK TIFF with an alpha channel (5 samples) as RGBA pixels, each colour converted by `rgb`
+/// (ink amounts 0..1 → sRGB 0..1) and associated (premultiplied) alpha divided back out; `None`
+/// for other images, planar ones and ones larger than [`MAX_CMYK_PIXELS`]. The image decoder
+/// doesn't read these at all; the inks can't be kept with the transparency, so they show as RGB.
+pub fn cmyka_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3]) -> Option<image::RgbaImage> {
+    let (kind, mut d) = tiff(bytes)?;
+    let (w, h) = d.dimensions().ok()?;
+    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
+    if !matches!(kind, tiff::ColorType::CMYKA(8 | 16)) || planar {
+        return None;
+    }
+    let n = usize::try_from(pixels(w, h)?).ok()?;
+    // ExtraSamples 1: associated alpha (premultiplied colour); 2 (or none stated): unassociated.
+    let associated = d.find_tag_unsigned_vec::<u16>(tiff::tags::Tag::ExtraSamples).ok().flatten().is_some_and(|v| v.first() == Some(&1));
+    let data: Vec<u8> = match d.read_image().ok()? {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    if data.len() != n * 5 {
+        return None;
+    }
+    let mut out = Vec::with_capacity(n * 4);
+    for p in data.as_chunks::<5>().0 {
+        let a = f32::from(p[4]) / 255.0;
+        let ink = |v: u8| {
+            let v = f32::from(v) / 255.0;
+            if associated && a > 0.0 { (v / a).min(1.0) } else { v }
+        };
+        let [r, g, b] = rgb([ink(p[0]), ink(p[1]), ink(p[2]), ink(p[3])]);
+        out.extend([r, g, b].map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8));
+        out.push(p[4]);
+    }
+    image::RgbaImage::from_raw(w, h, out)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_cmyk_tiff_with_alpha_reads_as_rgba() {
+        use tiff::encoder::{TiffEncoder, colortype::CMYKA8};
+        // 2 × 1: full cyan opaque, then 100% K at half alpha (premultiplied: K 128, alpha 128).
+        let mut file = Cursor::new(Vec::new());
+        let mut enc = TiffEncoder::new(&mut file).unwrap();
+        let mut img = enc.new_image::<CMYKA8>(2, 1).unwrap();
+        img.encoder().write_tag(tiff::tags::Tag::ExtraSamples, &[1u16][..]).unwrap();
+        img.write_data(&[255, 0, 0, 0, 255, 0, 0, 0, 128, 128]).unwrap();
+        let bytes = file.into_inner();
+        let naive = |[c, m, y, k]: [f32; 4]| [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)];
+        let px = cmyka_tiff_rgba(&bytes, naive).expect("CMYKA reads");
+        assert_eq!(px.dimensions(), (2, 1));
+        assert_eq!(px.get_pixel(0, 0).0, [0, 255, 255, 255], "cyan, opaque");
+        assert_eq!(px.get_pixel(1, 0).0, [0, 0, 0, 128], "the premultiplied K divided back out: black at half alpha");
+        // Not CMYKA: not this reader's.
+        assert!(cmyka_tiff_rgba(&ImageBlob::cmyk_tiff(&inks()).unwrap().bytes, naive).is_none());
+    }
+
     fn inks() -> Inks {
         Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
     }

crates/doc/src/lib.rs

@@ -40,6 +40,7 @@ pub mod slices;
 pub mod style_libs;
 pub mod swatches;
 pub mod text;
+pub mod trace;
 
 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -85,10 +86,11 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, FirstBaseline, InlineArt, Justify, LeadingModel, Mojikumi,
-    ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap,
-    VerticalAlign, WrapShape,
+    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, FirstBaseline, InlineArt, Justify, Kinsoku, LeadingModel,
+    Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef,
+    TextWrap, VerticalAlign, WrapShape,
 };
+pub use trace::TraceView;
 pub use vectorcraft_color as color;
 pub use vectorcraft_geom as geom;
 

crates/doc/src/node.rs

@@ -463,7 +463,8 @@ pub struct Node {
     /// Opacity mask (Transparency panel). Its art lives here, outside the layer tree.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub mask: Option<Box<OpacityMask>>,
-    /// Image Trace object: `{preset, params}` it was traced with (the Image Trace panel shows them).
+    /// Image Trace object: `{preset, params, view?}` it was traced with (the Image Trace panel shows
+    /// them; `view` is its [`crate::TraceView`] id, absent for the tracing result).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub trace: Option<Box<serde_json::Value>>,
     /// Object → Text Wrap: area type below this object (in the same layer) flows around it.

crates/doc/src/text.rs

@@ -341,6 +341,9 @@ pub struct ParaStyle {
     /// may stand outside the frame. New type takes [`Burasagari::Standard`]; documents from before
     /// it and imported text keep [`Burasagari::None`].
     pub burasagari: Burasagari,
+    /// Kinsoku (Paragraph panel › Kinsoku Set): which Japanese characters may not start or end a
+    /// line.
+    pub kinsoku: Kinsoku,
 }
 
 /// [`ParaStyle`] as saved. [`Justify::Auto`] is written as the alignment it has in the paragraph
@@ -378,6 +381,8 @@ struct ParaStyleFile {
     leading_model: LeadingModel,
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     burasagari: Burasagari,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    kinsoku: Kinsoku,
 }
 
 impl From<ParaStyle> for ParaStyleFile {
@@ -402,6 +407,7 @@ impl From<ParaStyle> for ParaStyleFile {
             direction,
             leading_model,
             burasagari,
+            kinsoku,
             ..
         } = p;
         Self {
@@ -420,6 +426,7 @@ impl From<ParaStyle> for ParaStyleFile {
             direction,
             leading_model,
             burasagari,
+            kinsoku,
         }
     }
 }
@@ -441,6 +448,7 @@ impl From<ParaStyleFile> for ParaStyle {
             direction,
             leading_model,
             burasagari,
+            kinsoku,
             ..
         } = f;
         Self {
@@ -458,6 +466,7 @@ impl From<ParaStyleFile> for ParaStyle {
             direction,
             leading_model,
             burasagari,
+            kinsoku,
         }
     }
 }
@@ -504,6 +513,21 @@ impl Mojikumi {
     }
 }
 
+/// Which Japanese characters may not start or end a line (kinsoku shori).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Kinsoku {
+    /// No kinsoku: a line may break between any two characters that allow a break.
+    None,
+    /// Closing brackets, commas, full stops, iteration marks, the prolonged sound mark, small
+    /// kana and the like don't start a line; opening brackets don't end one.
+    #[default]
+    Hard,
+    /// As Hard, except that 々, the prolonged sound mark ー and small kana may start a line
+    /// (JLREQ's level 3 line-breaking rules, Appendix C.3).
+    Soft,
+}
+
 /// Hanging punctuation (burasagari): an East Asian comma or full stop ending a line (、。，．､｡)
 /// stands outside the line's measure, in the space its punctuation spacing gives it (half width
 /// with Line-end Punctuation Half Width). Closing brackets and Latin punctuation don't hang. Shown

crates/doc/src/trace.rs

@@ -0,0 +1,92 @@
+//! Image Trace objects' View: how a live trace draws on screen.
+//!
+//! An Image Trace object is a group whose `trace` holds `{preset, params, view}` (see
+//! `imageTrace.make`). The view is a viewing aid only: exports, printing and Expand always use the
+//! tracing result, whatever it is set to.
+
+use crate::node::Node;
+
+/// Image Trace › View.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum TraceView {
+    /// The traced shapes as they are filled.
+    #[default]
+    Result,
+    /// The traced shapes, with their outlines over them.
+    ResultWithOutlines,
+    /// Only the traced shapes' outlines.
+    Outlines,
+    /// The source image, with the traced shapes' outlines over it.
+    OutlinesWithSource,
+    /// Only the source image.
+    Source,
+}
+
+impl TraceView {
+    /// Panel order.
+    pub const ALL: [Self; 5] = [Self::Result, Self::ResultWithOutlines, Self::Outlines, Self::OutlinesWithSource, Self::Source];
+
+    /// The id used in command params and in the saved `trace` object.
+    pub fn id(self) -> &'static str {
+        match self {
+            Self::Result => "tracingResult",
+            Self::ResultWithOutlines => "tracingResultWithOutlines",
+            Self::Outlines => "outlines",
+            Self::OutlinesWithSource => "outlinesWithSourceImage",
+            Self::Source => "sourceImage",
+        }
+    }
+
+    /// The view an id names (any case).
+    pub fn from_id(id: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|v| v.id().eq_ignore_ascii_case(id))
+    }
+
+    /// The view an Image Trace object's `trace` settings ask for (the tracing result when they
+    /// name none, or an unknown one).
+    pub fn of(trace: &serde_json::Value) -> Self {
+        trace.get("view").and_then(serde_json::Value::as_str).and_then(Self::from_id).unwrap_or_default()
+    }
+
+    /// Whether the source image shows.
+    pub fn shows_source(self) -> bool {
+        matches!(self, Self::OutlinesWithSource | Self::Source)
+    }
+
+    /// Whether the traced shapes show filled.
+    pub fn shows_result(self) -> bool {
+        matches!(self, Self::Result | Self::ResultWithOutlines)
+    }
+
+    /// Whether the traced shapes' outlines show.
+    pub fn shows_outlines(self) -> bool {
+        matches!(self, Self::ResultWithOutlines | Self::Outlines | Self::OutlinesWithSource)
+    }
+}
+
+impl Node {
+    /// The View of an Image Trace object (the tracing result for anything else, or an unknown id).
+    pub fn trace_view(&self) -> TraceView {
+        self.trace.as_deref().map(TraceView::of).unwrap_or_default()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ids_round_trip_and_unknown_views_show_the_result() {
+        for v in TraceView::ALL {
+            assert_eq!(TraceView::from_id(v.id()), Some(v));
+            assert_eq!(TraceView::from_id(&v.id().to_ascii_uppercase()), Some(v));
+            assert!(v.shows_result() || v.shows_outlines() || v.shows_source(), "{v:?} shows something");
+        }
+        let mut g = Node::group(crate::NodeId(1), vec![]);
+        assert_eq!(g.trace_view(), TraceView::Result);
+        g.trace = Some(Box::new(serde_json::json!({"view": "outlines"})));
+        assert_eq!(g.trace_view(), TraceView::Outlines);
+        g.trace = Some(Box::new(serde_json::json!({"view": "sepia"})));
+        assert_eq!(g.trace_view(), TraceView::Result);
+    }
+}

crates/effects/src/lib.rs

@@ -5,7 +5,8 @@
 //!
 //! - **Geometry effects** (Distort & Transform, Path, Convert to Shape, Round Corners, Scribble,
 //!   Warp) rewrite a path: [`apply_geometry`] evaluates them in stack order.
-//! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur) are described by
+//! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur, and the
+//!   Photoshop-style filters of [`pixel`]: Radial Blur, Smart Blur, Unsharp Mask) are described by
 //!   [`raster_effects`] and painted by the renderer; [`outset`] says how far they reach beyond
 //!   the geometry.
 //! - **Stroke geometry** ([`stroke`]): arrowheads, dash patterns and width profiles, shared by the
@@ -36,6 +37,7 @@ mod distort;
 mod group;
 mod live;
 mod marks;
+pub mod pixel;
 mod raster;
 mod reshape;
 pub mod stroke;
@@ -61,6 +63,7 @@ pub use group::{
 };
 pub use live::{expand_live, expand_live_deep, expanded_live_group, text_outliner};
 pub use marks::{CROP_MARKS, crop_marks_art, has_crop_marks};
+pub use pixel::{PIXEL_EFFECTS, PixelFx, PixelSpace};
 pub use raster::{RasterFx, outset, raster_effects};
 pub use reshape::{expand_outlined, needs_outline, outline_art, outline_text, reshape};
 pub use warp::{WarpStyle, warp_point};
@@ -118,7 +121,7 @@ fn lengths_of(id: &str) -> Lengths {
         "distort.transform" => always(&["moveH", "moveV"]),
         "path.offsetPath" => always(&["offset"]),
         "path.outlineStroke" => always(&["width"]),
-        "stylize.roundCorners" | "stylize.feather" | "blur.gaussian" => always(&["radius"]),
+        "stylize.roundCorners" | "stylize.feather" | "blur.gaussian" | "blur.smart" | "sharpen.unsharpMask" => always(&["radius"]),
         "stylize.scribble" => always(&["overlap", "strokeWidth", "spacing", "variation"]),
         "stylize.dropShadow" => always(&["x", "y", "blur"]),
         "stylize.innerGlow" | "stylize.outerGlow" => always(&["blur"]),
@@ -134,6 +137,7 @@ const SHAPE: &[&str] = &["Effect", "Convert to Shape"];
 const STYLIZE: &[&str] = &["Effect", "Stylize"];
 const WARP: &[&str] = &["Effect", "Warp"];
 const BLUR: &[&str] = &["Effect", "Blur"];
+const SHARPEN: &[&str] = &["Effect", "Sharpen"];
 const PATHFINDER: &[&str] = &["Effect", "Pathfinder"];
 const PLUGINS: &[&str] = &["Effect", "Plug-ins"];
 const ADJUST: &[&str] = &["Effect", "Color Adjustments"];
@@ -265,6 +269,27 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
         ),
         r("stylize.feather", "Feather…", STYLIZE, "{radius: pt (5)}", json!({"radius": 5.0})),
         r("blur.gaussian", "Gaussian Blur…", BLUR, "{radius: pt (5)}", json!({"radius": 5.0})),
+        r(
+            "blur.radial",
+            "Radial Blur…",
+            BLUR,
+            "{amount: 1..100 (10; spin: an arc of `amount`°, zoom: the content scaled by up to about ±amount/2 %), method: \"spin\"|\"zoom\" (\"spin\"), quality: \"draft\"|\"good\"|\"best\" (\"good\"; 16, 64 or 256 samples)} blurs around the object's centre",
+            json!({"amount": 10.0, "method": "spin", "quality": "good"}),
+        ),
+        r(
+            "blur.smart",
+            "Smart Blur…",
+            BLUR,
+            "{radius: pt 0.1..100 (3), threshold: levels 0.1..100 (25; only colours closer than this blur together, so edges stay sharp), quality: \"low\"|\"medium\"|\"high\" (\"medium\"; 5, 7 or 9 samples across)} (Normal mode)",
+            json!({"radius": 3.0, "threshold": 25.0, "quality": "medium"}),
+        ),
+        r(
+            "sharpen.unsharpMask",
+            "Unsharp Mask…",
+            SHARPEN,
+            "{amount: % 1..500 (50), radius: pt 0.1..250 (1; σ of the blur edges are found against), threshold: levels 0..255 (0; smaller differences are left alone)}",
+            json!({"amount": 50.0, "radius": 1.0, "threshold": 0.0}),
+        ),
     ];
     v.extend([
         g(
@@ -428,6 +453,7 @@ pub fn scale_effect(e: &mut Effect, s: f64) {
 /// Is `id` a raster (painted) effect?
 pub fn is_raster(id: &str) -> bool {
     matches!(id, "stylize.dropShadow" | "stylize.innerGlow" | "stylize.outerGlow" | "stylize.feather" | "blur.gaussian")
+        || PIXEL_EFFECTS.contains(&id)
 }
 
 /// Does `id` change geometry? (Crop Marks adds art of its own instead, [`crop_marks_art`]; colour

crates/effects/src/pixel/blur.rs

@@ -0,0 +1,129 @@
+//! Blur › Radial Blur and Smart Blur.
+
+use vectorcraft_geom::{Affine, Point, Vec2};
+
+use super::{PixelSpace, Px16, box_blur, to8, to16};
+
+/// Zoom's total spread, in log scale: `amount` 100 scales the content between 1/√2 and √2.
+pub(super) fn zoom_extent(amount: f64) -> f64 {
+    (1.0 + amount / 100.0).ln()
+}
+
+/// `buf` (`w` × `h`) sampled bilinearly at pixel index position (`x`, `y`) (pixel centres at
+/// whole coordinates); transparent outside.
+fn bilinear(buf: &[Px16], w: usize, h: usize, x: f64, y: f64) -> [f32; 4] {
+    if !(x > -1.0 && y > -1.0 && x < w as f64 && y < h as f64) {
+        return [0.0; 4];
+    }
+    let (x0, y0) = (x.floor(), y.floor());
+    let (fx, fy) = ((x - x0) as f32, (y - y0) as f32);
+    let (xi, yi) = (x0 as isize, y0 as isize);
+    let at = |cx: isize, cy: isize| -> [f32; 4] {
+        if cx < 0 || cy < 0 || cx as usize >= w || cy as usize >= h {
+            return [0.0; 4];
+        }
+        buf.get(cy as usize * w + cx as usize).map_or([0.0; 4], |p| p.map(f32::from))
+    };
+    let (a, b, c, d) = (at(xi, yi), at(xi + 1, yi), at(xi, yi + 1), at(xi + 1, yi + 1));
+    let (wa, wb, wc, wd) = ((1.0 - fx) * (1.0 - fy), fx * (1.0 - fy), (1.0 - fx) * fy, fx * fy);
+    std::array::from_fn(|i| a[i] * wa + b[i] * wb + c[i] * wc + d[i] * wd)
+}
+
+/// Radial Blur: the average of the content turned (spin) or scaled (zoom) about the centre over
+/// evenly spaced steps spanning `amount`. Each pass averages the previous result with itself
+/// turned both ways by half the last step, so `passes` passes average 2^`passes` samples at two
+/// lookups a pixel each.
+pub(super) fn radial(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, amount: f64, zoom: bool, passes: u32) {
+    // The centre in pixel index coordinates (pixel centres at whole numbers).
+    let c = space.to_doc.inverse() * space.center - Vec2::new(0.5, 0.5);
+    if !(c.x.is_finite() && c.y.is_finite()) {
+        return;
+    }
+    let total = if zoom { zoom_extent(amount) } else { amount.to_radians() };
+    let about = |m: Affine| Affine::translate(c.to_vec2()) * m * Affine::translate(-c.to_vec2());
+    // A pixel's reflection in the view (one axis flipped) only turns the spin the other way,
+    // which a symmetric blur doesn't notice.
+    let step = |d: f64| if zoom { about(Affine::scale(d.exp())) } else { about(Affine::rotate(d)) };
+    let mut cur = to16(px);
+    let mut next = vec![[0u16; 4]; cur.len()];
+    for j in 1..=passes.min(12) {
+        let d = total / f64::powi(2.0, j as i32 + 1);
+        let (fwd, back) = (step(d), step(-d));
+        // Where a pixel's two samples lie moves by a fixed step along a row.
+        let (df, db) = (fwd * Point::new(1.0, 0.0) - fwd * Point::ZERO, back * Point::new(1.0, 0.0) - back * Point::ZERO);
+        for (y, row) in next.chunks_exact_mut(w).enumerate().take(h) {
+            let (mut f, mut b) = (fwd * Point::new(0.0, y as f64), back * Point::new(0.0, y as f64));
+            for out in row.iter_mut() {
+                let (s, t) = (bilinear(&cur, w, h, f.x, f.y), bilinear(&cur, w, h, b.x, b.y));
+                *out = std::array::from_fn(|i| ((s[i] + t[i]) * 0.5).round().clamp(0.0, 65535.0) as u16);
+                (f, b) = (f + df, b + db);
+            }
+        }
+        std::mem::swap(&mut cur, &mut next);
+    }
+    for (p, q) in px.iter_mut().zip(&cur) {
+        *p = q.map(to8);
+    }
+}
+
+/// The largest radius (pixels) Smart Blur looks over: farther neighbours are as good as gone.
+const MAX_SMART: f64 = 4096.0;
+
+/// Smart Blur (Normal mode): each pixel averaged with itself and the neighbours within `radius`
+/// pixels whose premultiplied channels all lie within `threshold` levels of its own. Wide radii
+/// look at `samples` × `samples` neighbours spread over the disc, read from a copy box-blurred
+/// over the gaps between them so the blur stays smooth (a neighbour counts when both it and its
+/// blurred surroundings are within the threshold, so at most a fringe under the threshold crosses
+/// an edge).
+pub(super) fn smart(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, threshold: f64, samples: u32) {
+    if radius.is_nan() || radius < 0.5 {
+        return;
+    }
+    let r = radius.min(MAX_SMART);
+    let n = samples.clamp(3, 15) as f64;
+    let k = r.round();
+    let (offsets, prefilter): (Vec<Vec2>, usize) = if 2.0 * k < n {
+        let k = k as i32;
+        ((-k..=k).flat_map(|dy| (-k..=k).map(move |dx| Vec2::new(dx as f64, dy as f64))).collect(), 0)
+    } else {
+        let gap = 2.0 * r / (n - 1.0);
+        let grid = (0..n as i32).map(|i| -r + gap * i as f64);
+        (grid.clone().flat_map(|dy| grid.clone().map(move |dx| Vec2::new(dx.round(), dy.round()))).collect(), (gap / 2.0).floor() as usize)
+    };
+    let offsets: Vec<(isize, isize)> =
+        offsets.into_iter().filter(|o| o.hypot() <= r + 0.5 && *o != Vec2::ZERO).map(|o| (o.x as isize, o.y as isize)).collect();
+    let src = to16(px);
+    let blurred;
+    let near: &[Px16] = if prefilter > 0 {
+        let mut b = src.clone();
+        box_blur(&mut b, w, prefilter);
+        blurred = b;
+        &blurred
+    } else {
+        &src
+    };
+    let t = (threshold.clamp(0.0, 255.0) * 257.0) as i32;
+    for (y, (row, out)) in src.chunks_exact(w).zip(px.chunks_exact_mut(w)).enumerate().take(h) {
+        for (x, (c, o)) in row.iter().zip(out.iter_mut()).enumerate() {
+            let mut acc = c.map(u64::from);
+            let mut count = 1u64;
+            for (dx, dy) in &offsets {
+                let (sx, sy) = (x as isize + dx, y as isize + dy);
+                if sx < 0 || sy < 0 || sx as usize >= w || sy as usize >= h {
+                    continue;
+                }
+                let i = sy as usize * w + sx as usize;
+                let (Some(s), Some(own)) = (near.get(i), src.get(i)) else { continue };
+                // The neighbour itself and its surroundings both close enough: edges stay sharp.
+                let close = |p: &Px16| p.iter().zip(c).all(|(a, b)| (*a as i32 - *b as i32).abs() <= t);
+                if close(own) && close(s) {
+                    for (a, v) in acc.iter_mut().zip(s) {
+                        *a += *v as u64;
+                    }
+                    count += 1;
+                }
+            }
+            *o = acc.map(|a| to8(((a + count / 2) / count).min(65535) as u16));
+        }
+    }
+}

crates/effects/src/pixel/mod.rs

@@ -0,0 +1,297 @@
+//! Photoshop-style raster effects (Effect › Blur › Radial Blur and Smart Blur, Sharpen › Unsharp
+//! Mask): filters over the pixels of an object rendered alone, premultiplied RGBA8.
+//!
+//! - Every distance is in document units (points) and becomes pixels through the raster's
+//!   [`PixelSpace::px`], so an effect looks the same at any zoom and at any Document Raster Effects
+//!   Settings resolution (as Gaussian Blur's radius does).
+//! - The work per pixel is bounded whatever the parameters: blurs are box approximations whose
+//!   cost doesn't grow with the radius, and sample counts come from the effect's quality.
+//! - Beyond the raster's edges is transparency.
+
+mod blur;
+mod sharpen;
+
+use serde_json::Value;
+use vectorcraft_geom::{Affine, Point, Rect};
+
+use crate::util::{num, text};
+
+/// The Photoshop-style effect ids (all raster effects, see [`crate::is_raster`]).
+pub const PIXEL_EFFECTS: [&str; 3] = ["blur.radial", "blur.smart", "sharpen.unsharpMask"];
+
+/// A Photoshop-style raster effect with its parameters read and clamped to their ranges. Lengths
+/// are in document units.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum PixelFx {
+    /// Blur › Radial Blur around the object's centre: along arcs (spin, an arc of `amount`°) or
+    /// along rays (zoom, the content scaled by up to about ±`amount`/2 %), averaging 2^`passes` samples.
+    RadialBlur { amount: f64, zoom: bool, passes: u32 },
+    /// Blur › Smart Blur (Normal mode): each pixel averaged with the neighbours within `radius`
+    /// whose colour differs from its own by no more than `threshold` levels, over a grid of
+    /// `samples` × `samples` neighbours at most.
+    SmartBlur { radius: f64, threshold: f64, samples: u32 },
+    /// Sharpen › Unsharp Mask: colours pushed away from a Gaussian blur of σ = `radius` by `amount`
+    /// (1 = 100 %), where they differ from it by at least `threshold` levels.
+    UnsharpMask { amount: f64, radius: f64, threshold: f64 },
+}
+
+/// Where a raster's pixels lie in the document.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct PixelSpace {
+    /// Pixel coordinates (x right, y down, (0, 0) the top-left corner of the first pixel) →
+    /// document coordinates.
+    pub to_doc: Affine,
+    /// The size of a pixel in document units.
+    pub px: f64,
+    /// The object's centre (document coordinates): where Radial Blur blurs around.
+    pub center: Point,
+}
+
+/// Effect `id`'s parameters `p` (defaults merged in) as a [`PixelFx`]; `None` for other effects.
+pub(crate) fn parse(id: &str, p: &Value) -> Option<PixelFx> {
+    let quality = |levels: [(&str, u32); 3], default: u32| {
+        let q = text(p, "quality", "");
+        levels.iter().find(|(name, _)| name.eq_ignore_ascii_case(q)).map_or(default, |(_, v)| *v)
+    };
+    Some(match id {
+        "blur.radial" => PixelFx::RadialBlur {
+            amount: num(p, "amount", 10.0).clamp(1.0, 100.0),
+            zoom: text(p, "method", "spin").eq_ignore_ascii_case("zoom"),
+            passes: quality([("draft", 4), ("good", 6), ("best", 8)], 6),
+        },
+        "blur.smart" => PixelFx::SmartBlur {
+            radius: num(p, "radius", 3.0).clamp(0.1, 100.0),
+            threshold: num(p, "threshold", 25.0).clamp(0.1, 100.0),
+            samples: quality([("low", 5), ("medium", 7), ("high", 9)], 7),
+        },
+        "sharpen.unsharpMask" => PixelFx::UnsharpMask {
+            amount: num(p, "amount", 50.0).clamp(1.0, 500.0) / 100.0,
+            radius: num(p, "radius", 1.0).clamp(0.1, 250.0),
+            threshold: num(p, "threshold", 0.0).clamp(0.0, 255.0),
+        },
+        _ => return None,
+    })
+}
+
+impl PixelFx {
+    /// How far beyond `bounds` (the content's, document units) the effect can paint.
+    pub fn outset(&self, bounds: Rect) -> f64 {
+        // From the centre to the farthest corner, and to the nearest side.
+        let far = 0.5 * bounds.width().hypot(bounds.height());
+        let near = 0.5 * bounds.width().min(bounds.height());
+        match *self {
+            // A rotated corner reaches the circle through the corners.
+            PixelFx::RadialBlur { zoom: false, .. } => (far - near).max(0.0),
+            PixelFx::RadialBlur { amount, zoom: true, .. } => far * (blur::zoom_extent(amount).exp() - 1.0),
+            PixelFx::SmartBlur { radius, .. } => radius,
+            PixelFx::UnsharpMask { .. } => 0.0,
+        }
+    }
+
+    /// How far (document units) from a pixel the content that decides it lies; `None` when that
+    /// is anywhere in the object (Radial Blur).
+    pub fn reach(&self) -> Option<f64> {
+        match *self {
+            PixelFx::RadialBlur { .. } => None,
+            PixelFx::SmartBlur { radius, .. } => Some(radius),
+            PixelFx::UnsharpMask { radius, .. } => Some(3.0 * radius),
+        }
+    }
+
+    /// Run the effect on `data`, `w` × `h` premultiplied RGBA8 pixels lying in the document as
+    /// `space` says. Does nothing when the sizes don't match.
+    pub fn apply(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace) {
+        let Some(px) = pixels(data, w, h) else { return };
+        let to_px = |len: f64| len / space.px.max(1e-9);
+        match *self {
+            PixelFx::RadialBlur { amount, zoom, passes } => blur::radial(px, w, h, space, amount, zoom, passes),
+            PixelFx::SmartBlur { radius, threshold, samples } => blur::smart(px, w, h, to_px(radius), threshold, samples),
+            PixelFx::UnsharpMask { amount, radius, threshold } => sharpen::unsharp(px, w, h, amount, to_px(radius), threshold),
+        }
+    }
+}
+
+/// `data` as `w` × `h` RGBA pixels, `None` when it isn't that size (or is empty).
+fn pixels(data: &mut [u8], w: usize, h: usize) -> Option<&mut [[u8; 4]]> {
+    let (px, rest) = data.as_chunks_mut::<4>();
+    (w > 0 && h > 0 && rest.is_empty() && w.checked_mul(h) == Some(px.len())).then_some(px)
+}
+
+/// The largest box radius the blurs use: wider boxes look the same on any raster we make.
+const MAX_BOX: usize = 1 << 17;
+
+/// Radii of three box blurs approximating a Gaussian of `sigma` pixels.
+pub fn gauss_boxes(sigma: f64) -> [usize; 3] {
+    let sigma = if sigma.is_finite() { sigma.clamp(0.0, MAX_BOX as f64 / 2.0) } else { 0.0 };
+    let n = 3.0;
+    let w_ideal = (12.0 * sigma * sigma / n + 1.0).sqrt();
+    let mut wl = w_ideal.floor() as i64;
+    if wl % 2 == 0 {
+        wl -= 1;
+    }
+    let wu = wl + 2;
+    let m_ideal = (12.0 * sigma * sigma - n * (wl * wl) as f64 - 4.0 * n * wl as f64 - 3.0 * n) / (-4.0 * wl as f64 - 4.0);
+    let m = m_ideal.round() as i64;
+    let r = |i: i64| ((((if i < m { wl } else { wu }) - 1) / 2).max(0) as usize).min(MAX_BOX);
+    [r(0), r(1), r(2)]
+}
+
+/// One horizontal box blur of radius `r` over the rows of `w` values of a plane (running sum,
+/// zero past the ends).
+fn box_plane(src: &[f32], dst: &mut [f32], w: usize, r: usize) {
+    if r == 0 {
+        dst.copy_from_slice(src);
+        return;
+    }
+    let norm = 1.0 / (2 * r + 1) as f32;
+    for (row, out) in src.chunks_exact(w).zip(dst.chunks_exact_mut(w)) {
+        let mut acc: f32 = row.iter().take(r + 1).sum();
+        for (x, o) in out.iter_mut().enumerate() {
+            *o = acc * norm;
+            if let Some(v) = row.get(x + r + 1) {
+                acc += v;
+            }
+            if let Some(v) = x.checked_sub(r).and_then(|i| row.get(i)) {
+                acc -= v;
+            }
+        }
+    }
+}
+
+fn transpose<T: Copy>(src: &[T], dst: &mut [T], w: usize, h: usize) {
+    for (y, row) in src.chunks_exact(w).enumerate().take(h) {
+        for (x, v) in row.iter().enumerate() {
+            if let Some(d) = dst.get_mut(x * h + y) {
+                *d = *v;
+            }
+        }
+    }
+}
+
+/// Gaussian-blur a `w` × `h` plane of values in place (three box passes per axis, zero past the
+/// edges). Does nothing when the sizes don't match.
+pub fn blur_plane(a: &mut Vec<f32>, w: usize, h: usize, sigma: f64) {
+    if sigma < 0.2 || w == 0 || h == 0 || w.checked_mul(h) != Some(a.len()) {
+        return;
+    }
+    let boxes = gauss_boxes(sigma);
+    let mut tmp = vec![0.0; a.len()];
+    for (len, other) in [(w, h), (h, w)] {
+        for r in boxes {
+            box_plane(a, &mut tmp, len, r);
+            std::mem::swap(a, &mut tmp);
+        }
+        transpose(a, &mut tmp, len, other);
+        std::mem::swap(a, &mut tmp);
+    }
+}
+
+/// Premultiplied RGBA at 16 bits (×257): blurs and averages that keep their tones.
+pub(super) type Px16 = [u16; 4];
+
+pub(super) fn to16(px: &[[u8; 4]]) -> Vec<Px16> {
+    px.iter().map(|p| p.map(|v| v as u16 * 257)).collect()
+}
+
+pub(super) fn to8(v: u16) -> u8 {
+    ((v as u32 + 128) / 257).min(255) as u8
+}
+
+fn add(acc: &mut [u64; 4], p: &Px16) {
+    for (a, v) in acc.iter_mut().zip(p) {
+        *a += *v as u64;
+    }
+}
+
+fn sub(acc: &mut [u64; 4], p: &Px16) {
+    for (a, v) in acc.iter_mut().zip(p) {
+        *a = a.saturating_sub(*v as u64);
+    }
+}
+
+fn mean(acc: &[u64; 4], n: u64) -> Px16 {
+    acc.map(|a| ((a + n / 2) / n.max(1)).min(65535) as u16)
+}
+
+/// One box blur of radius `r` along the rows of `w` pixels (transparent past the ends).
+fn box_rows(src: &[Px16], dst: &mut [Px16], w: usize, r: usize) {
+    let n = 2 * r as u64 + 1;
+    for (row, out) in src.chunks_exact(w).zip(dst.chunks_exact_mut(w)) {
+        let mut acc = [0u64; 4];
+        row.iter().take(r + 1).for_each(|p| add(&mut acc, p));
+        for (x, o) in out.iter_mut().enumerate() {
+            *o = mean(&acc, n);
+            if let Some(p) = row.get(x + r + 1) {
+                add(&mut acc, p);
+            }
+            if let Some(p) = x.checked_sub(r).and_then(|i| row.get(i)) {
+                sub(&mut acc, p);
+            }
+        }
+    }
+}
+
+/// One box blur of radius `r` down the columns of `w`-wide rows (transparent past the ends), row
+/// by row with a running sum per column.
+fn box_cols(src: &[Px16], dst: &mut [Px16], w: usize, r: usize) {
+    let n = 2 * r as u64 + 1;
+    let rows: Vec<&[Px16]> = src.chunks_exact(w).collect();
+    let mut acc = vec![[0u64; 4]; w];
+    let add_row = |acc: &mut [[u64; 4]], row: &[Px16]| acc.iter_mut().zip(row).for_each(|(a, p)| add(a, p));
+    rows.iter().take(r + 1).for_each(|row| add_row(&mut acc, row));
+    for (y, out) in dst.chunks_exact_mut(w).enumerate() {
+        for (o, a) in out.iter_mut().zip(&acc) {
+            *o = mean(a, n);
+        }
+        if let Some(row) = rows.get(y + r + 1) {
+            add_row(&mut acc, row);
+        }
+        if let Some(row) = y.checked_sub(r).and_then(|i| rows.get(i)) {
+            acc.iter_mut().zip(*row).for_each(|(a, p)| sub(a, p));
+        }
+    }
+}
+
+/// Box-blur `w`-wide rows of pixels in place with radius `r` along both axes.
+pub(super) fn box_blur(px: &mut [Px16], w: usize, r: usize) {
+    if r == 0 || w == 0 {
+        return;
+    }
+    let mut tmp = vec![[0u16; 4]; px.len()];
+    box_rows(px, &mut tmp, w, r);
+    box_cols(&tmp, px, w, r);
+}
+
+/// Gaussian-blur `w`-wide rows of premultiplied pixels in place (σ = `sigma` pixels, three box
+/// passes per axis, transparent past the edges).
+pub(super) fn gaussian(px: &mut [Px16], w: usize, sigma: f64) {
+    if sigma < 0.2 || w == 0 {
+        return;
+    }
+    let mut tmp = vec![[0u16; 4]; px.len()];
+    for r in gauss_boxes(sigma) {
+        box_rows(px, &mut tmp, w, r);
+        px.copy_from_slice(&tmp);
+    }
+    for r in gauss_boxes(sigma) {
+        box_cols(px, &mut tmp, w, r);
+        px.copy_from_slice(&tmp);
+    }
+}
+
+/// Gaussian-blur `data`, `w` × `h` premultiplied RGBA8 pixels, in place (σ = `sigma` pixels). Does
+/// nothing when the sizes don't match.
+pub fn gaussian_rgba(data: &mut [u8], w: usize, h: usize, sigma: f64) {
+    if let Some(px) = pixels(data, w, h)
+        && sigma >= 0.2
+    {
+        let mut wide = to16(px);
+        gaussian(&mut wide, w, sigma);
+        for (p, q) in px.iter_mut().zip(&wide) {
+            *p = q.map(to8);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/effects/src/pixel/sharpen.rs

@@ -0,0 +1,31 @@
+//! Sharpen › Unsharp Mask.
+
+use super::{gaussian, to16};
+
+/// Unsharp Mask: each colour channel pushed away from a Gaussian blur of the pixels (σ = `sigma`
+/// pixels) by `amount` times their difference, where that difference reaches `threshold` levels.
+/// The blur is premultiplied, so edges against transparency don't darken; coverage stays as it is.
+pub(super) fn unsharp(px: &mut [[u8; 4]], w: usize, h: usize, amount: f64, sigma: f64, threshold: f64) {
+    if sigma.is_nan() || sigma < 0.2 || amount.is_nan() || amount <= 0.0 || h == 0 {
+        return;
+    }
+    let mut blurred = to16(px);
+    gaussian(&mut blurred, w, sigma);
+    let (amount, threshold) = (amount as f32, threshold as f32);
+    for (p, b) in px.iter_mut().zip(&blurred) {
+        let a = p[3] as f32;
+        if a == 0.0 {
+            continue;
+        }
+        for i in 0..3 {
+            let own = p[i] as f32 * 255.0 / a;
+            let around = if b[3] > 0 { b[i] as f32 * 255.0 / b[3] as f32 } else { own };
+            let diff = own - around;
+            if diff.abs() < threshold || diff == 0.0 {
+                continue;
+            }
+            let v = (own + amount * diff).clamp(0.0, 255.0);
+            p[i] = (v * a / 255.0).round().clamp(0.0, 255.0) as u8;
+        }
+    }
+}

crates/effects/src/pixel/tests.rs

@@ -0,0 +1,231 @@
+use serde_json::json;
+use vectorcraft_doc::Effect;
+use vectorcraft_geom::{Affine, Point, Rect};
+
+use super::*;
+use crate::{RasterFx, raster_effects};
+
+/// A `w` × `h` raster whose pixels are document points (origin top-left).
+fn space(w: usize, h: usize) -> PixelSpace {
+    PixelSpace { to_doc: Affine::IDENTITY, px: 1.0, center: Point::new(w as f64 / 2.0, h as f64 / 2.0) }
+}
+
+fn image(w: usize, h: usize, f: impl Fn(usize, usize) -> [u8; 4]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(w * h * 4);
+    for y in 0..h {
+        for x in 0..w {
+            out.extend(f(x, y));
+        }
+    }
+    out
+}
+
+fn at(d: &[u8], w: usize, x: usize, y: usize) -> [u8; 4] {
+    let i = (y * w + x) * 4;
+    [d[i], d[i + 1], d[i + 2], d[i + 3]]
+}
+
+fn fx(id: &str, p: serde_json::Value) -> PixelFx {
+    let e = Effect { id: id.into(), params: p, visible: true };
+    match raster_effects(&[e]).first() {
+        Some(RasterFx::Pixel(p)) => *p,
+        other => panic!("{id}: {other:?}"),
+    }
+}
+
+fn grey(v: u8) -> [u8; 4] {
+    [v, v, v, 255]
+}
+
+#[test]
+fn params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("blur.radial", json!({})), PixelFx::RadialBlur { amount: 10.0, zoom: false, passes: 6 });
+    assert_eq!(
+        fx("blur.radial", json!({"amount": 1e308, "method": "ZOOM", "quality": "best"})),
+        PixelFx::RadialBlur { amount: 100.0, zoom: true, passes: 8 }
+    );
+    assert_eq!(fx("blur.radial", json!({"amount": -5, "quality": "nonsense"})), PixelFx::RadialBlur { amount: 1.0, zoom: false, passes: 6 });
+    assert_eq!(fx("blur.smart", json!({})), PixelFx::SmartBlur { radius: 3.0, threshold: 25.0, samples: 7 });
+    assert_eq!(
+        fx("blur.smart", json!({"radius": "1e999", "threshold": -1, "quality": "low"})),
+        PixelFx::SmartBlur { radius: 3.0, threshold: 0.1, samples: 5 }
+    );
+    assert_eq!(fx("sharpen.unsharpMask", json!({})), PixelFx::UnsharpMask { amount: 0.5, radius: 1.0, threshold: 0.0 });
+    assert_eq!(
+        fx("sharpen.unsharpMask", json!({"amount": 1e9, "radius": 0, "threshold": 1e9})),
+        PixelFx::UnsharpMask { amount: 5.0, radius: 0.1, threshold: 255.0 }
+    );
+    for id in PIXEL_EFFECTS {
+        assert!(crate::is_raster(id) && crate::effect_info(id).is_some_and(|e| e.raster), "{id}");
+    }
+}
+
+#[test]
+fn outsets_follow_the_object() {
+    let b = Rect::new(0.0, 0.0, 100.0, 50.0);
+    let spin = fx("blur.radial", json!({}));
+    let far = 0.5 * 100f64.hypot(50.0);
+    assert!((spin.outset(b) - (far - 25.0)).abs() < 1e-9);
+    assert!(fx("blur.radial", json!({"method": "zoom", "amount": 100})).outset(b) > 0.4 * far);
+    assert_eq!(fx("blur.smart", json!({"radius": 4})).outset(b), 4.0);
+    assert_eq!(fx("sharpen.unsharpMask", json!({})).outset(b), 0.0);
+    assert_eq!(spin.reach(), None);
+    assert_eq!(fx("sharpen.unsharpMask", json!({"radius": 2})).reach(), Some(6.0));
+}
+
+#[test]
+fn wrong_sizes_and_empty_rasters_are_left_alone() {
+    for id in PIXEL_EFFECTS {
+        let f = fx(id, json!({}));
+        let mut d = vec![200u8; 4 * 10];
+        f.apply(&mut d, 3, 3, &space(3, 3));
+        f.apply(&mut d, 0, 10, &space(0, 10));
+        f.apply(&mut [], 0, 0, &space(0, 0));
+        assert!(d.iter().all(|v| *v == 200), "{id}");
+    }
+}
+
+#[test]
+fn extreme_parameters_finish() {
+    let (w, h) = (40, 30);
+    let src = image(w, h, |x, y| if (x / 5 + y / 5) % 2 == 0 { grey(250) } else { [0, 0, 0, 0] });
+    let tiny = PixelSpace { px: 1e-9, ..space(w, h) };
+    let huge = PixelSpace { px: 1e9, center: Point::new(f64::MAX, -1e300), ..space(w, h) };
+    for id in PIXEL_EFFECTS {
+        for p in [json!({"amount": 1e308, "radius": 1e308, "threshold": 1e308, "quality": "best"}), json!({"amount": 0, "radius": 0})] {
+            for s in [tiny, huge, space(w, h)] {
+                let mut d = src.clone();
+                fx(id, p.clone()).apply(&mut d, w, h, &s);
+            }
+        }
+    }
+}
+
+#[test]
+fn every_effect_is_deterministic() {
+    let (w, h) = (32, 24);
+    let src = image(w, h, |x, y| {
+        let a = if x > 4 { 255 } else { 128 };
+        [((x * 8) as u8).min(a), ((y * 10) as u8).min(a), ((x * y % 256) as u8).min(a), a]
+    });
+    for id in PIXEL_EFFECTS {
+        let f = fx(id, json!({"amount": 40, "radius": 3, "threshold": 40}));
+        let (mut a, mut b) = (src.clone(), src.clone());
+        f.apply(&mut a, w, h, &space(w, h));
+        f.apply(&mut b, w, h, &space(w, h));
+        assert_eq!(a, b, "{id}");
+        assert_ne!(a, src, "{id} changes the image");
+        // Premultiplied stays premultiplied.
+        assert!(a.chunks_exact(4).all(|p| p[0] <= p[3] && p[1] <= p[3] && p[2] <= p[3]), "{id}");
+    }
+}
+
+#[test]
+fn spin_blur_smears_along_arcs_and_keeps_the_centre() {
+    let (w, h) = (41, 41);
+    // A white dot 12 px right of the centre (20.5, 20.5), and one on the centre.
+    let src = image(w, h, |x, y| if (x == 32 || x == 20) && y == 20 { grey(255) } else { [0, 0, 0, 0] });
+    let mut d = src.clone();
+    fx("blur.radial", json!({"amount": 60, "quality": "best"})).apply(&mut d, w, h, &space(w, h));
+    // 60° of arc around the centre: up to 30° either way, 12 px out: (20.5 + 12 cos 20°, 20.5 ± 12 sin 20°).
+    assert!(at(&d, w, 31, 16)[3] > 0 && at(&d, w, 31, 24)[3] > 0, "the dot spreads along its circle");
+    assert_eq!(at(&d, w, 32, 10)[3], 0, "not beyond the arc");
+    assert_eq!(at(&d, w, 26, 20)[3], 0, "not towards the centre");
+    assert!(at(&d, w, 20, 20)[3] > 100, "the centre barely moves: {:?}", at(&d, w, 20, 20));
+    // Zoom smears along the ray instead.
+    let mut z = src.clone();
+    fx("blur.radial", json!({"amount": 60, "method": "zoom", "quality": "best"})).apply(&mut z, w, h, &space(w, h));
+    assert!(at(&z, w, 35, 20)[3] > 0 && at(&z, w, 29, 20)[3] > 0, "the dot streaks along the ray");
+    assert_eq!(at(&z, w, 32, 16)[3], 0, "not across it");
+}
+
+#[test]
+fn smart_blur_smooths_noise_and_keeps_edges() {
+    let (w, h) = (40, 20);
+    // Left: grey 100 with ±6 noise; right: white.
+    let src = image(w, h, |x, y| if x < 20 { grey(if (x + y) % 2 == 0 { 94 } else { 106 }) } else { grey(255) });
+    let mut d = src.clone();
+    fx("blur.smart", json!({"radius": 3, "threshold": 25})).apply(&mut d, w, h, &space(w, h));
+    let v = at(&d, w, 8, 10)[0];
+    assert!((97..=103).contains(&v), "noise smoothed: {v}");
+    assert!(at(&d, w, 19, 10)[0] < 120, "the edge's dark side doesn't take the white");
+    assert_eq!(at(&d, w, 20, 10)[0], 255, "the edge's white side stays white");
+    // A threshold above the step blurs across it.
+    let mut all = src.clone();
+    fx("blur.smart", json!({"radius": 3, "threshold": 100})).apply(&mut all, w, h, &space(w, h));
+    assert_eq!(at(&all, w, 20, 10)[0], 255, "a 155-level step is still past 100");
+}
+
+#[test]
+fn unsharp_mask_overshoots_at_edges() {
+    let (w, h) = (40, 10);
+    let src = image(w, h, |x, _| grey(if x < 20 { 100 } else { 150 }));
+    let mut d = src.clone();
+    fx("sharpen.unsharpMask", json!({"amount": 100, "radius": 2})).apply(&mut d, w, h, &space(w, h));
+    assert!(at(&d, w, 19, 5)[0] < 95, "dark side darker: {:?}", at(&d, w, 19, 5));
+    assert!(at(&d, w, 20, 5)[0] > 155, "light side lighter: {:?}", at(&d, w, 20, 5));
+    assert_eq!(at(&d, w, 5, 5), grey(100), "flat areas stay");
+    assert_eq!(at(&d, w, 35, 5), grey(150));
+    // Differences under the threshold are left alone.
+    let mut t = src.clone();
+    fx("sharpen.unsharpMask", json!({"amount": 100, "radius": 2, "threshold": 60})).apply(&mut t, w, h, &space(w, h));
+    assert_eq!(t, src);
+    // Coverage stays, and a shape's edge against transparency doesn't darken.
+    let shape = image(w, h, |x, _| if x < 20 { [200, 0, 0, 255] } else { [0, 0, 0, 0] });
+    let mut s = shape.clone();
+    fx("sharpen.unsharpMask", json!({"amount": 300, "radius": 3})).apply(&mut s, w, h, &space(w, h));
+    assert_eq!(s, shape);
+}
+
+#[test]
+fn lengths_are_document_units() {
+    // The same art at twice the resolution, sharpened with the same radius in points: the
+    // overshoot spans twice the pixels, the same distance.
+    let edge = |scale: usize| image(40 * scale, 4, move |x, _| grey(if x < 20 * scale { 100 } else { 150 }));
+    let run = |scale: usize| {
+        let mut d = edge(scale);
+        let s = PixelSpace { to_doc: Affine::scale(1.0 / scale as f64), px: 1.0 / scale as f64, center: Point::ZERO };
+        fx("sharpen.unsharpMask", json!({"amount": 100, "radius": 2})).apply(&mut d, 40 * scale, 4, &s);
+        (0..40 * scale).filter(|x| at(&d, 40 * scale, *x, 2)[0] < 99).count()
+    };
+    let (one, two) = (run(1), run(2));
+    assert!(one > 1 && (two as f64 / one as f64 - 2.0).abs() < 0.5, "{one} px at 1×, {two} px at 2×");
+}
+
+#[test]
+fn gaussian_and_plane_blurs_keep_their_mass() {
+    let (w, h) = (30, 30);
+    let mut d = image(w, h, |x, y| if (10..20).contains(&x) && (10..20).contains(&y) { grey(255) } else { [0, 0, 0, 0] });
+    let before: u32 = d.chunks_exact(4).map(|p| p[3] as u32).sum();
+    gaussian_rgba(&mut d, w, h, 2.0);
+    let after: u32 = d.chunks_exact(4).map(|p| p[3] as u32).sum();
+    assert!((before as f64 - after as f64).abs() / (before as f64) < 0.02, "{before} → {after}");
+    assert!(at(&d, w, 9, 15)[3] > 0 && at(&d, w, 10, 15)[3] < 255);
+    let mut plane: Vec<f32> = (0..w * h).map(|i| if i == 15 * w + 15 { 100.0 } else { 0.0 }).collect();
+    blur_plane(&mut plane, w, h, 2.0);
+    assert!((plane.iter().sum::<f32>() - 100.0).abs() < 0.5 && plane[15 * w + 13] > 0.0 && plane[13 * w + 15] > 0.0);
+}
+
+/// Timings on a 2000 × 2000 raster (`cargo test -p vectorcraft-effects --release -- --ignored
+/// --nocapture pixel_timings`).
+#[test]
+#[ignore]
+fn pixel_timings() {
+    let (w, h) = (2000, 2000);
+    let src = image(w, h, |x, y| [(x % 256) as u8, (y % 256) as u8, ((x ^ y) % 256) as u8, 255]);
+    let s = PixelSpace { to_doc: Affine::IDENTITY, px: 1.0, center: Point::new(1000.0, 1000.0) };
+    let cases = [
+        ("blur.radial", json!({"quality": "draft"})),
+        ("blur.radial", json!({"quality": "good"})),
+        ("blur.radial", json!({"quality": "best", "method": "zoom"})),
+        ("blur.smart", json!({"quality": "low"})),
+        ("blur.smart", json!({"quality": "high", "radius": 30})),
+        ("sharpen.unsharpMask", json!({"radius": 20})),
+    ];
+    for (id, p) in cases {
+        let mut d = src.clone();
+        let t = std::time::Instant::now();
+        fx(id, p.clone()).apply(&mut d, w, h, &s);
+        println!("{id} {p}: {:?}", t.elapsed());
+    }
+}

crates/effects/src/raster.rs

@@ -4,7 +4,10 @@ use serde_json::Value;
 use vectorcraft_doc::Effect;
 use vectorcraft_doc::color::{BlendMode, Color};
 
+use vectorcraft_geom::Rect;
+
 use crate::merged_params;
+use crate::pixel::{self, PixelFx};
 use crate::util::*;
 
 /// A painted effect, in document units. `blur` is Illustrator's blur distance; the renderer uses
@@ -40,6 +43,8 @@ pub enum RasterFx {
     GaussianBlur {
         radius: f64,
     },
+    /// A Photoshop-style filter over the object's pixels (Radial Blur, Unsharp Mask…).
+    Pixel(PixelFx),
 }
 
 impl RasterFx {
@@ -47,13 +52,15 @@ impl RasterFx {
     pub fn is_below(&self) -> bool {
         matches!(self, RasterFx::DropShadow { .. } | RasterFx::OuterGlow { .. })
     }
-    /// How far this effect reaches beyond the geometry.
-    pub fn outset(&self) -> f64 {
+    /// How far this effect reaches beyond `bounds`, what it paints around (Radial Blur reaches
+    /// further around larger objects).
+    pub fn outset(&self, bounds: Rect) -> f64 {
         match self {
             RasterFx::DropShadow { dx, dy, blur, .. } => dx.abs().max(dy.abs()) + 1.5 * blur,
             RasterFx::OuterGlow { blur, .. } => 1.5 * blur,
             RasterFx::InnerGlow { .. } | RasterFx::Feather { .. } => 0.0,
             RasterFx::GaussianBlur { radius } => 1.5 * radius,
+            RasterFx::Pixel(p) => p.outset(bounds),
         }
     }
 }
@@ -113,14 +120,14 @@ pub fn raster_effects(effects: &[Effect]) -> Vec<RasterFx> {
                 },
                 "stylize.feather" => RasterFx::Feather { radius: num(&p, "radius", 5.0).clamp(0.0, 1000.0) },
                 "blur.gaussian" => RasterFx::GaussianBlur { radius: num(&p, "radius", 5.0).clamp(0.0, 1000.0) },
-                _ => return None,
+                id => RasterFx::Pixel(pixel::parse(id, &p)?),
             })
         })
         .collect()
 }
 
-/// How far the visible raster effects of `effects` paint beyond the (effected) geometry, in
-/// document units. Geometry effects are accounted for by evaluating them.
-pub fn outset(effects: &[Effect]) -> f64 {
-    raster_effects(effects).iter().map(RasterFx::outset).fold(0.0, f64::max)
+/// How far the visible raster effects of `effects` paint beyond `bounds`, the (effected)
+/// geometry's, in document units. Geometry effects are accounted for by evaluating them.
+pub fn outset(effects: &[Effect], bounds: Rect) -> f64 {
+    raster_effects(effects).iter().map(|fx| fx.outset(bounds)).fold(0.0, f64::max)
 }

crates/effects/src/tests.rs

@@ -301,8 +301,8 @@ fn raster_effects_parse_and_outset() {
         other => panic!("{other:?}"),
     }
     assert!(matches!(r[2], RasterFx::InnerGlow { center: true, .. }));
-    assert!(close(outset(&list), 10.0 + 9.0, 1e-9));
-    assert_eq!(outset(&[]), 0.0);
+    assert!(close(outset(&list, vectorcraft_geom::Rect::ZERO), 10.0 + 9.0, 1e-9));
+    assert_eq!(outset(&[], vectorcraft_geom::Rect::ZERO), 0.0);
 }
 
 #[test]

crates/engine/Cargo.toml

@@ -25,6 +25,7 @@ vectorcraft-cad = { workspace = true }
 vectorcraft-eps = { workspace = true }
 vectorcraft-metafile = { workspace = true }
 vectorcraft-plugins = { workspace = true }
+vectorcraft-affinity = { workspace = true }
 image = { workspace = true }
 flate2 = { workspace = true }
 kurbo = { workspace = true }
@@ -34,6 +35,10 @@ thiserror = { workspace = true }
 log = { workspace = true }
 
 [dev-dependencies]
+vectorcraft-affinity = { workspace = true, features = ["synth"] }
+crc32fast = { workspace = true }
 vectorcraft-testkit = { workspace = true }
 proptest = { workspace = true }
 wat = { workspace = true }
+# Zstandard streams for the Illustrator editing data fuzz tests.
+ruzstd = { workspace = true }

crates/engine/src/cmd/buildcmds.rs

@@ -15,7 +15,7 @@ use std::sync::Arc;
 use serde_json::{Value, json};
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::appearance::{AppearanceItem, FillLayer, LineCap, LineJoin, StrokeLayer};
-use vectorcraft_doc::{Appearance, Document, Node, NodeId, NodeKind, Selection};
+use vectorcraft_doc::{Appearance, Document, Node, NodeId, NodeKind, Selection, TraceView};
 use vectorcraft_geom::{FillRule, PathData, Point, Rect, SubPath};
 use vectorcraft_pathops as po;
 use vectorcraft_tools::builder::{
@@ -120,7 +120,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Make",
             ["Object", "Image Trace"],
             None,
-            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\", threshold: 0-255, colors: 2-256, paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite, snapCurvesToLines, fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10)}} → {id, paths, anchors, colors}",
+            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite, snapCurvesToLines, fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult)} → {id, paths, anchors, colors}",
             has_selection_or_ids,
             |s, p| trace_make(s, p, false)
         ),
@@ -151,6 +151,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection_or_ids,
             trace_expand
         ),
+        cmd!(
+            "imageTrace.setView",
+            "Image Trace View",
+            [],
+            None,
+            "{id?|ids?: Image Trace objects (default: selection), view: \"tracingResult\"|\"tracingResultWithOutlines\"|\"outlines\"|\"outlinesWithSourceImage\"|\"sourceImage\"} how they draw on screen; exports, printing and Expand keep the tracing result → {ids, view}",
+            has_selection_or_ids,
+            trace_set_view
+        ),
         cmd!(query "imageTrace.presets", "Image Trace Presets", [], None, "{} → {presets: [{name, params}]}", always, |_, _| {
             Ok(json!({ "presets": tr::presets().into_iter().map(|(n, p)| json!({ "name": n, "params": p })).collect::<Vec<_>>() }))
         }),
@@ -639,6 +648,13 @@ fn is_trace_group(n: &Node) -> bool {
         && n.children().is_some_and(|c| c.first().is_some_and(|i| matches!(i.kind, NodeKind::Image(_))))
 }
 
+/// The `view` param ([`TraceView`] id), if given.
+fn view_param(cmd: &str, p: &Value) -> Result<Option<TraceView>> {
+    let Some(v) = p.get("view").filter(|v| !v.is_null()) else { return Ok(None) };
+    let ids = || TraceView::ALL.map(TraceView::id).join(", ");
+    v.as_str().and_then(TraceView::from_id).map(Some).ok_or_else(|| bad(cmd, format!("view must be one of {}", ids())))
+}
+
 fn trace_params(p: &Value) -> Result<tr::TraceParams> {
     let name = str_param(p, "preset").unwrap_or("Default");
     let base = tr::preset(name).ok_or_else(|| bad("imageTrace.make", format!("unknown preset `{name}` (see imageTrace.presets)")))?;
@@ -658,6 +674,30 @@ fn trace_params(p: &Value) -> Result<tr::TraceParams> {
     Ok(params)
 }
 
+/// Document Library in Color mode: look the library's colours up into `params.swatches` → each
+/// one as traced (sRGB) with the colour to fill with.
+fn trace_library(s: &Session, params: &mut tr::TraceParams) -> Result<Vec<([u8; 3], Color)>> {
+    const C: &str = "imageTrace.make";
+    if params.mode != tr::Mode::Color || params.palette != tr::Palette::DocumentLibrary {
+        return Ok(vec![]);
+    }
+    let key = params.library.as_str();
+    let colors = super::swatchlib::library_colors(s, key)
+        .ok_or_else(|| bad(C, format!("no swatch library `{key}` (see swatch.library.list; \"document\": the document's swatches)")))?;
+    if colors.is_empty() {
+        return Err(bad(C, format!("`{key}` has no colours")));
+    }
+    let library: Vec<([u8; 3], Color)> = colors
+        .into_iter()
+        .map(|c| {
+            let [r, g, b, _] = c.to_rgba8(1.0);
+            ([r, g, b], c)
+        })
+        .collect();
+    params.swatches = library.iter().map(|l| l.0).collect();
+    Ok(library)
+}
+
 /// The most anchor points an Image Trace may make: a photo traced at high fidelity can make
 /// millions, more than the canvas draws smoothly or a laptop has memory for, so the trace is
 /// refused with advice instead (#525).
@@ -665,7 +705,8 @@ pub const MAX_TRACE_ANCHORS: usize = 2_000_000;
 
 fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     const C: &str = "imageTrace.make";
-    let params = trace_params(p)?;
+    let mut params = trace_params(p)?;
+    let view = view_param(C, p)?;
     let params_json = serde_json::to_value(&params).map_err(|e| EngineError::Other(e.to_string()))?;
     // The preset's name if the parameters are exactly that preset's, else "Custom".
     let named = str_param(p, "preset").unwrap_or("Default");
@@ -694,6 +735,7 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     };
     let blob = s.doc()?.doc.images.get(&img.key).ok_or_else(|| EngineError::Other(format!("image data `{}` is missing", img.key)))?;
     let raster = tr::Raster::decode(&blob.bytes).map_err(|e| EngineError::Other(e.to_string()))?;
+    let library = trace_library(s, &mut params)?;
     let res = tr::trace_within(&raster, &params, MAX_TRACE_ANCHORS).map_err(|e| EngineError::Other(e.to_string()))?;
     // Pixel space of the decoded raster → the image object's pixel space → document.
     let sx = img.width.max(1) as f64 / raster.width.max(1) as f64;
@@ -723,7 +765,9 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
         for tp in res.paths {
             let path = tp.path.transformed(xf);
             let mut n = shape_node(d, path, None);
-            let paint = Paint::solid(Color::rgb8(tp.color[0], tp.color[1], tp.color[2]));
+            // A library colour fills with the swatch's own colour (its model kept).
+            let color = library.iter().find(|(rgb, _)| *rgb == tp.color).map_or_else(|| Color::rgb8(tp.color[0], tp.color[1], tp.color[2]), |l| l.1);
+            let paint = Paint::solid(color);
             n.appearance = match tp.stroke {
                 // Traced lines: round ends and corners, as drawn lines have.
                 Some(width) => Appearance {
@@ -742,7 +786,9 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
         let mut g = Node::group(gid, children);
         g.name = if expand { None } else { Some(TRACE_NAME.into()) };
         if !expand {
-            g.trace = Some(Box::new(json!({ "preset": preset_label, "params": params_json })));
+            // Tracing again keeps the object's view unless another is asked for.
+            let view = view.unwrap_or_else(|| src.trace_view());
+            g.trace = Some(Box::new(json!({ "preset": preset_label, "params": params_json, "view": view.id() })));
         }
         let (par, idx, _) = d.position(target).ok_or(EngineError::NoNode(target))?;
         d.remove(target)?;
@@ -762,6 +808,28 @@ fn trace_targets(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
     Ok(v)
 }
 
+fn trace_set_view(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "imageTrace.setView";
+    let view = view_param(C, p)?.ok_or_else(|| bad(C, "view is required"))?;
+    let targets = trace_targets(s, p)?;
+    let d = &s.doc()?.doc;
+    if targets.iter().all(|g| d.node(*g).is_some_and(|n| n.trace_view() == view)) {
+        return Ok(json!({ "ids": ids_json(&targets), "view": view.id() }));
+    }
+    s.edit("Image Trace View", |d, _| {
+        for g in &targets {
+            let n = d.node_mut(*g).ok_or(EngineError::NoNode(*g))?;
+            if let Some(t) = n.trace.as_deref_mut().and_then(Value::as_object_mut) {
+                t.insert("view".into(), json!(view.id()));
+            } else {
+                n.trace = Some(Box::new(json!({ "preset": "Custom", "view": view.id() })));
+            }
+        }
+        Ok(())
+    })?;
+    Ok(json!({ "ids": ids_json(&targets), "view": view.id() }))
+}
+
 fn trace_release(s: &mut Session, p: &Value) -> Result<Value> {
     let targets = trace_targets(s, p)?;
     let ids = s.edit("Release Image Trace", |d, sel| {

crates/engine/src/cmd/clipboard.rs

@@ -170,8 +170,10 @@ impl Session {
             return None;
         }
         let d = self.clipboard.to_document();
+        // SVG has no filters for the Photoshop-style effects: their objects go in as images.
+        let flat = super::rasterfx::flatten_pixel_effects(&d);
         Some(vectorcraft_svg::export(
-            &d,
+            flat.as_ref().unwrap_or(&d),
             &vectorcraft_svg::ExportOptions { artboard: None, object_ids: vectorcraft_svg::ObjectIds::Minimal, ..Default::default() },
         ))
     }

crates/engine/src/cmd/edit.rs

@@ -55,7 +55,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Paste in Front",
             ["Edit"],
             Some("Cmd+F"),
-            "{swatchConflict?} paste in place just above the top selected object, or on top of the current layer when nothing is selected (resources and layers as edit.paste) → {ids, added, merged, renamed}",
+            "{swatchConflict?, artboard?: index (the active artboard: the objects go where they were on the artboard they were copied from, on this one)} paste in place just above the top selected object, or on top of the current layer when nothing is selected (resources and layers as edit.paste) → {ids, added, merged, renamed}",
             has_clipboard,
             |s, p| paste(s, p, PasteMode::Front)
         ),
@@ -64,7 +64,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Paste in Back",
             ["Edit"],
             Some("Cmd+B"),
-            "{swatchConflict?} paste in place just below the bottom selected object, or at the bottom of the current layer when nothing is selected (resources and layers as edit.paste) → {ids, added, merged, renamed}",
+            "{swatchConflict?, artboard?: index (as edit.pasteInFront)} paste in place just below the bottom selected object, or at the bottom of the current layer when nothing is selected (resources and layers as edit.paste) → {ids, added, merged, renamed}",
             has_clipboard,
             |s, p| paste(s, p, PasteMode::Back)
         ),
@@ -73,7 +73,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Paste in Place",
             ["Edit"],
             Some("Cmd+Shift+V"),
-            "{swatchConflict?} paste where the objects were copied (resources and layers as edit.paste) → {ids, added, merged, renamed}",
+            "{swatchConflict?, artboard?: index (as edit.pasteInFront)} paste where the objects were copied (resources and layers as edit.paste) → {ids, added, merged, renamed}",
             has_clipboard,
             |s, p| paste(s, p, PasteMode::InPlace)
         ),
@@ -310,6 +310,17 @@ fn paste(s: &mut Session, p: &Value, mode: PasteMode) -> Result<Value> {
     r
 }
 
+/// Paste in Place, in Front or in Back onto artboard `artboard` (the active one, #693): where the
+/// objects were on the artboard they were copied from, on that one; without it (or a copy from no
+/// artboard), where they were.
+fn onto_artboard(doc: &Document, p: &Value, clip: &Clipboard) -> Affine {
+    let target = p.get("artboard").and_then(Value::as_u64).and_then(|i| usize::try_from(i).ok()).and_then(|i| doc.artboards.get(i));
+    match (target, clip.source_artboard) {
+        (Some(t), Some(src)) => Affine::translate(t.rect.origin() - src.origin()),
+        _ => Affine::IDENTITY,
+    }
+}
+
 fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, choices: &SwatchChoices) -> Result<Value> {
     let off = s.prefs.paste_offset;
     let st = s.doc()?;
@@ -345,7 +356,8 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
             let src = clip.source_artboard.or_else(|| st.doc.artboards.first().map(|a| a.rect)).map(|r| r.origin()).unwrap_or_default();
             st.doc.artboards.iter().map(|a| Affine::translate(a.rect.origin() - src)).collect()
         }
-        _ => vec![Affine::IDENTITY],
+        // In place, in front, in back: onto the active artboard when the UI names it.
+        _ => vec![onto_artboard(&st.doc, p, clip)],
     };
     let (ids, imported, artboard) = s.edit(mode.label(), |d, sel| {
         let imported = clip.import_into(d, choices, same_doc);

crates/engine/src/cmd/fileio/affinity.rs

@@ -0,0 +1,509 @@
+//! Affinity documents (`.af`, `.afdesign`, `.afphoto`, `.afpub`): the native layers, curves,
+//! shapes, artboards, text and images that `vectorcraft-affinity` reads, mapped to editable
+//! VectorCraft art. Whatever the reader could not map is listed in the warnings. A file whose
+//! native document can't be read opens as its embedded preview instead, with a warning that says
+//! why, and can't be placed.
+
+use std::io::Cursor;
+use std::sync::Arc;
+
+use kurbo::{Affine, BezPath, Point, Rect, Vec2};
+use vectorcraft_affinity::model::{self as af, Align as AfAlign, Blend, Kind, Pixels};
+use vectorcraft_affinity::paint::{self as ap, Cap, GradientKind as AfKind, Join};
+use vectorcraft_color::{BlendMode, Color, Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop, Paint};
+use vectorcraft_doc::appearance::{Appearance, AppearanceItem, Dash, FillLayer, LineCap, LineJoin, StrokeAlign, StrokeLayer};
+use vectorcraft_doc::geom::{FillRule, PathData, shapes};
+use vectorcraft_doc::text::{CharStyle, Justify, TextKind, TextObject, TextRun};
+use vectorcraft_doc::{Artboard, Document, ImageObject, LayerColor, Node, NodeKind, OpacityMask};
+
+use super::load::{err, raster_doc};
+use crate::Result;
+
+/// What an Affinity file opened as.
+pub(super) struct Imported {
+    pub doc: Document,
+    pub warnings: Vec<String>,
+    /// Only the embedded preview: never placed, used as a template or mined for styles.
+    pub preview_only: bool,
+}
+
+pub(super) fn import(name: &str, bytes: &[u8]) -> Result<Imported> {
+    match vectorcraft_affinity::read(bytes, vectorcraft_affinity::Limits::default()) {
+        Ok(d) => {
+            let mut b = Builder { doc: Document::new(0.0, 0.0), warnings: Vec::new(), k: 72.0 / d.dpi, layer: 0 };
+            b.document(&d)?;
+            let mut warnings = d.warnings.iter().map(|w| format!("Affinity: not imported or approximated: {w}.")).collect::<Vec<_>>();
+            warnings.extend(b.warnings.iter().map(|w| format!("Affinity: {w}.")));
+            Ok(Imported { doc: b.doc, warnings, preview_only: false })
+        }
+        Err(native) => {
+            let (doc, w) = preview(name, bytes, &native)?;
+            Ok(Imported { doc, warnings: vec![w], preview_only: true })
+        }
+    }
+}
+
+/// The embedded preview, for files whose native document can't be read.
+fn preview(name: &str, bytes: &[u8], native: &vectorcraft_affinity::Error) -> Result<(Document, String)> {
+    let p = vectorcraft_affinity::preview(bytes).map_err(|e| err(format!("{native}; its embedded preview can't be read either ({e})")))?;
+    // `raster_doc` normally probes PNG dimensions and keeps its encoded bytes. Verify this
+    // untrusted preview's complete pixels first, so corrupt data cannot create a blank image.
+    let mut reader = image::ImageReader::with_format(Cursor::new(p.png), image::ImageFormat::Png);
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(4096);
+    limits.max_image_height = Some(4096);
+    limits.max_alloc = Some(128 << 20);
+    reader.limits(limits);
+    let _pixels = reader.decode().map_err(err)?;
+    let d = raster_doc(name, p.png)?;
+    Ok((
+        d,
+        format!(
+            "The native Affinity document could not be read ({native}). Opened only its embedded {}×{} PNG preview, which may be smaller than the document: no layers, vectors, text or pages. Save a new copy; the Affinity source cannot be saved back. Export SVG or PDF from Affinity for editable vectors.",
+            p.width, p.height
+        ),
+    ))
+}
+
+struct Builder {
+    doc: Document,
+    warnings: Vec<String>,
+    /// Points per document pixel.
+    k: f64,
+    /// Layers made so far (their colours cycle).
+    layer: u8,
+}
+
+fn rect_of(r: af::Rect) -> Rect {
+    Rect::new(r.x0, r.y0, r.x1, r.y1)
+}
+
+fn affine(a: af::Affine) -> Affine {
+    Affine::new(a.0)
+}
+
+impl Builder {
+    fn warn(&mut self, w: &str) {
+        if !self.warnings.iter().any(|x| x == w) {
+            self.warnings.push(w.to_string());
+        }
+    }
+
+    fn document(&mut self, d: &af::Document) -> Result<()> {
+        // Spreads (Publisher pages) sit side by side, 36 pt apart; a single spread keeps its origin.
+        let mut layers = Vec::new();
+        let mut artboards = Vec::new();
+        let mut x = 0.0;
+        for (i, spread) in d.spreads.iter().enumerate() {
+            let shift = if i == 0 { 0.0 } else { x - spread.bounds.x0 * self.k };
+            let to_doc = Affine::translate((shift, 0.0)) * Affine::scale(self.k);
+            let before = artboards.len();
+            let mut loose: Vec<Arc<Node>> = Vec::new();
+            for n in &spread.nodes {
+                let top = match &n.kind {
+                    Kind::Layer => self.node(n, to_doc, &mut artboards, true),
+                    Kind::Artboard { .. } => self.node(n, to_doc, &mut artboards, true).map(|art| self.layer_of(&n.name, art, n.visible, n.locked)),
+                    _ => {
+                        if let Some(art) = self.node(n, to_doc, &mut artboards, false) {
+                            loose.push(art);
+                        }
+                        continue;
+                    }
+                };
+                if !loose.is_empty() {
+                    layers.push(self.layer_with(None, std::mem::take(&mut loose)));
+                }
+                layers.extend(top);
+            }
+            if !loose.is_empty() {
+                layers.push(self.layer_with(None, loose));
+            }
+            // Without artboards, each page (or the spread) becomes one.
+            if artboards.len() == before {
+                let rects = if spread.pages.is_empty() { vec![spread.bounds] } else { spread.pages.clone() };
+                for r in rects {
+                    let name = format!("{} {}", if d.spreads.len() > 1 || spread.pages.len() > 1 { "Page" } else { "Artboard" }, artboards.len() + 1);
+                    artboards.push((name, to_doc.transform_rect_bbox(rect_of(r))));
+                }
+            }
+            x = artboards.iter().map(|(_, r)| r.x1).fold(x, f64::max) + 36.0;
+            if spread.transparent && i == 0 {
+                self.warn("transparent page backgrounds show as white artboards");
+            }
+        }
+        self.doc.artboards = artboards
+            .into_iter()
+            .enumerate()
+            .filter(|(_, (_, r))| r.width() > 0.0 && r.height() > 0.0)
+            .map(|(i, (name, rect))| Artboard { id: i as u32 + 1, name, rect, show_center_mark: false, show_cross_hairs: false })
+            .collect();
+        if self.doc.artboards.is_empty() {
+            return Err(err("the Affinity document has no page with a size"));
+        }
+        // Bottom to top, as Affinity lists them.
+        self.doc.layers = layers;
+        if self.doc.layers.is_empty() {
+            let empty = self.layer_with(None, Vec::new());
+            self.doc.layers.push(empty);
+        }
+        Ok(())
+    }
+
+    fn layer_with(&mut self, name: Option<&str>, children: Vec<Arc<Node>>) -> Arc<Node> {
+        let id = self.doc.alloc_id();
+        self.layer = self.layer.wrapping_add(1);
+        let label = name.map(str::to_string).unwrap_or_else(|| format!("Layer {}", self.layer));
+        let mut n = Node::layer(id, &label, LayerColor::Preset(self.layer % 9));
+        if let Some(c) = n.children_mut() {
+            *c = children;
+        }
+        Arc::new(n)
+    }
+
+    /// An artboard at the top level becomes a layer of its name holding its clip group.
+    fn layer_of(&mut self, name: &str, art: Arc<Node>, visible: bool, locked: bool) -> Arc<Node> {
+        let mut l = (*self.layer_with(Some(if name.is_empty() { "Artboard" } else { name }), vec![art])).clone();
+        l.visible = visible;
+        l.locked = locked;
+        Arc::new(l)
+    }
+
+    fn base(&mut self, n: &af::Node, kind: NodeKind) -> Node {
+        let mut out = Node::new(self.doc.alloc_id(), kind);
+        out.name = (!n.name.is_empty()).then(|| n.name.clone());
+        out.visible = n.visible;
+        out.locked = n.locked;
+        out.opacity = n.opacity as f32;
+        out.blend = self.blend(n.blend);
+        out
+    }
+
+    fn blend(&mut self, b: Blend) -> BlendMode {
+        match b {
+            Blend::Normal | Blend::PassThrough => BlendMode::Normal,
+            Blend::Darken => BlendMode::Darken,
+            Blend::Multiply => BlendMode::Multiply,
+            Blend::ColorBurn => BlendMode::ColorBurn,
+            Blend::Lighten => BlendMode::Lighten,
+            Blend::Screen => BlendMode::Screen,
+            Blend::ColorDodge => BlendMode::ColorDodge,
+            Blend::Overlay => BlendMode::Overlay,
+            Blend::SoftLight => BlendMode::SoftLight,
+            Blend::HardLight => BlendMode::HardLight,
+            Blend::Difference => BlendMode::Difference,
+            Blend::Exclusion => BlendMode::Exclusion,
+            Blend::Hue => BlendMode::Hue,
+            Blend::Saturation => BlendMode::Saturation,
+            Blend::Color => BlendMode::Color,
+            Blend::Luminosity => BlendMode::Luminosity,
+            _ => {
+                self.warn("blend modes VectorCraft doesn't have (Add, Linear Light, Vivid Light, Pin Light, Hard Mix, Subtract, Darker/Lighter Colour, Average, Negation, Reflect, Glow, Erase) import as Normal");
+                BlendMode::Normal
+            }
+        }
+    }
+
+    /// One Affinity node (and its subtree) as VectorCraft art; `to_doc` maps document pixels to
+    /// points. `layer_level`: the node is directly in a spread or a layer, so a layer stays a layer.
+    fn node(&mut self, n: &af::Node, to_doc: Affine, boards: &mut Vec<(String, Rect)>, layer_level: bool) -> Option<Arc<Node>> {
+        let child_level = matches!(n.kind, Kind::Layer) && layer_level;
+        let children: Vec<Arc<Node>> = n.children.iter().filter_map(|c| self.node(c, to_doc, boards, child_level)).collect();
+        let mut out = match &n.kind {
+            Kind::Layer if layer_level => {
+                let mut l = (*self.layer_with(Some(if n.name.is_empty() { "Layer" } else { &n.name }), children)).clone();
+                l.visible = n.visible;
+                l.locked = n.locked;
+                l.opacity = n.opacity as f32;
+                l.blend = self.blend(n.blend);
+                l
+            }
+            Kind::Layer | Kind::Group => {
+                let mut g = self.base(n, NodeKind::Group { children, clip: false });
+                // Affinity groups isolate their blending unless they pass through.
+                g.isolate = n.blend != Blend::PassThrough;
+                g
+            }
+            Kind::Shape { path, fills, strokes, even_odd } => {
+                let data = self.path(path, to_doc);
+                let rule = if *even_odd { FillRule::EvenOdd } else { FillRule::NonZero };
+                let appearance = self.appearance(fills, strokes, to_doc);
+                if children.is_empty() {
+                    let mut p = self.base(n, NodeKind::Path { path: data, rule, live: None, clipping: false, guide: false });
+                    p.appearance = appearance;
+                    p
+                } else {
+                    // A shape clips its children: VectorCraft's clipping path keeps its paint, its
+                    // fill behind the clipped art and its stroke over it, as Affinity draws it.
+                    let mut clip = Node::new(self.doc.alloc_id(), NodeKind::Path { path: data, rule, live: None, clipping: true, guide: false });
+                    clip.appearance = appearance;
+                    let mut kids = vec![Arc::new(clip)];
+                    kids.extend(children);
+                    self.base(n, NodeKind::Group { children: kids, clip: true })
+                }
+            }
+            Kind::Artboard { rect, background } => {
+                let r = to_doc.transform_rect_bbox(rect_of(*rect));
+                boards.push((if n.name.is_empty() { format!("Artboard {}", boards.len() + 1) } else { n.name.clone() }, r));
+                let mut clip = Node::new(
+                    self.doc.alloc_id(),
+                    NodeKind::Path { path: shapes::rectangle(r), rule: FillRule::NonZero, live: None, clipping: true, guide: false },
+                );
+                clip.appearance = self.appearance(background, &[], to_doc);
+                let mut kids = vec![Arc::new(clip)];
+                kids.extend(children);
+                let mut g = self.base(n, NodeKind::Group { children: kids, clip: true });
+                g.name = Some(if n.name.is_empty() { "Artboard".into() } else { n.name.clone() });
+                g
+            }
+            Kind::Text(t) => {
+                let text = self.text(t, to_doc);
+                let mut node = self.base(n, NodeKind::Text(Box::new(text)));
+                if !children.is_empty() {
+                    let mut kids = vec![Arc::new(node)];
+                    kids.extend(children);
+                    node = Node::group(self.doc.alloc_id(), kids);
+                }
+                node
+            }
+            Kind::Image(img) => match self.image(img, to_doc) {
+                Some(kind) => self.base(n, kind),
+                None if children.is_empty() => return None,
+                None => self.base(n, NodeKind::Group { children, clip: false }),
+            },
+            Kind::Unsupported if children.is_empty() => return None,
+            Kind::Unsupported => self.base(n, NodeKind::Group { children, clip: false }),
+        };
+        if let Some(img) = &n.pixel_mask {
+            // A pixel mask: its grey levels show (white) or hide (black) the node, and nothing
+            // shows outside it, as an opacity mask that clips.
+            if let Some(kind) = self.image(img, to_doc) {
+                let art = Node::new(self.doc.alloc_id(), kind);
+                out.mask = Some(Box::new(OpacityMask::new(art, true)));
+            }
+        }
+        if let Some(mask) = &n.mask {
+            // A vector mask: the node shows only inside it.
+            let clip = Node::new(
+                self.doc.alloc_id(),
+                NodeKind::Path { path: self.path(mask, to_doc), rule: FillRule::NonZero, live: None, clipping: true, guide: false },
+            );
+            let (opacity, blend, visible, name) = (out.opacity, out.blend, out.visible, out.name.clone());
+            out.opacity = 1.0;
+            out.blend = BlendMode::Normal;
+            let mut g = Node::new(self.doc.alloc_id(), NodeKind::Group { children: vec![Arc::new(clip), Arc::new(out)], clip: true });
+            (g.opacity, g.blend, g.visible, g.name) = (opacity, blend, visible, name);
+            out = g;
+        }
+        Some(Arc::new(out))
+    }
+
+    fn path(&self, p: &af::Path, to_doc: Affine) -> PathData {
+        let mut bp = BezPath::new();
+        for s in &p.subpaths {
+            let pt = |q: af::Point| Point::new(q.x, q.y);
+            bp.move_to(pt(s.start));
+            for [c1, c2, e] in &s.segments {
+                if c1 == c2 && c2 == e {
+                    bp.line_to(pt(*e));
+                } else {
+                    bp.curve_to(pt(*c1), pt(*c2), pt(*e));
+                }
+            }
+            if s.closed {
+                bp.close_path();
+            }
+        }
+        PathData::from_bezpath(&(to_doc * bp))
+    }
+
+    fn color(c: ap::Color) -> (Color, f32) {
+        let f = |v: f64| v.clamp(0.0, 1.0) as f32;
+        match c {
+            ap::Color::Rgb { r, g, b, a } => (Color::Rgb { r: f(r), g: f(g), b: f(b) }, f(a)),
+            ap::Color::Cmyk { c, m, y, k, a } => (Color::Cmyk { c: f(c), m: f(m), y: f(y), k: f(k) }, f(a)),
+            ap::Color::Gray { v, a } => (Color::Gray { k: 1.0 - f(v) }, f(a)),
+            ap::Color::Lab { l, a, b, alpha } => (Color::Lab { l: l as f32, a: a as f32, b: b as f32 }, f(alpha)),
+        }
+    }
+
+    /// A paint and the opacity its colour's alpha becomes.
+    fn paint(&mut self, p: &ap::Paint, to_doc: Affine) -> Option<(Paint, f32)> {
+        match p {
+            ap::Paint::None => None,
+            ap::Paint::Solid(c) => {
+                let (color, a) = Self::color(*c);
+                Some((Paint::solid(color), a))
+            }
+            ap::Paint::Gradient(g) => {
+                let stops = g
+                    .stops
+                    .iter()
+                    .map(|s| {
+                        let (color, opacity) = Self::color(s.color);
+                        let mut stop = GradientStop::new(s.offset as f32, color);
+                        stop.opacity = opacity;
+                        stop.midpoint = s.half_point().clamp(0.13, 0.87) as f32;
+                        stop
+                    })
+                    .collect();
+                let m = to_doc * affine(g.transform);
+                let (o, x, y) = (m * Point::ZERO, m * Point::new(1.0, 0.0), m * Point::new(0.0, 1.0));
+                let kind = match g.kind {
+                    AfKind::Linear => GradientKind::Linear,
+                    AfKind::Radial => GradientKind::Radial,
+                    AfKind::Conical => {
+                        self.warn("conical gradients import as radial gradients");
+                        GradientKind::Radial
+                    }
+                };
+                let (u, v): (Vec2, Vec2) = (x - o, y - o);
+                if kind == GradientKind::Radial && u.hypot() > 0.0 && (u.dot(v) / (u.hypot() * v.hypot().max(1e-12))).abs() > 0.01 {
+                    self.warn("skewed elliptical gradients import as upright ellipses");
+                }
+                let aspect = if u.hypot() > 0.0 { (v.hypot() / u.hypot()).clamp(0.01, 100.0) } else { 1.0 };
+                let geom = GradientGeom { start: o, end: x, aspect: if kind == GradientKind::Radial { aspect } else { 1.0 }, focal: None };
+                let mut gp = GradientPaint::new(Gradient { kind, stops });
+                gp.angle = (-(u.y)).atan2(u.x).to_degrees();
+                gp.geom = Some(geom);
+                Some((Paint::Gradient(Box::new(gp)), 1.0))
+            }
+        }
+    }
+
+    fn appearance(&mut self, fills: &[ap::Paint], strokes: &[ap::Stroke], to_doc: Affine) -> Appearance {
+        let mut items = Vec::new();
+        let mut above = Vec::new();
+        for f in fills {
+            if let Some((paint, opacity)) = self.paint(f, to_doc) {
+                let mut l = FillLayer::new(paint);
+                l.opacity = opacity;
+                items.push(AppearanceItem::Fill(l));
+            }
+        }
+        for s in strokes {
+            let Some((paint, opacity)) = self.paint(&s.paint, to_doc) else { continue };
+            let mut l = StrokeLayer::new(paint, s.width * self.k);
+            l.opacity = opacity;
+            l.cap = match s.cap {
+                Cap::Butt => LineCap::Butt,
+                Cap::Round => LineCap::Round,
+                Cap::Square => LineCap::Square,
+            };
+            l.join = match s.join {
+                Join::Miter => LineJoin::Miter,
+                Join::Round => LineJoin::Round,
+                Join::Bevel => LineJoin::Bevel,
+            };
+            l.miter_limit = s.miter_limit;
+            l.align = match s.align {
+                ap::Align::Center => StrokeAlign::Center,
+                ap::Align::Inside => StrokeAlign::Inside,
+                ap::Align::Outside => StrokeAlign::Outside,
+            };
+            l.dash = s.dash.as_ref().map(|(pattern, phase)| Dash {
+                pattern: pattern.iter().map(|v| v * self.k).collect(),
+                offset: phase * self.k,
+                align_corners: false,
+            });
+            if s.behind {
+                items.insert(0, AppearanceItem::Stroke(l));
+            } else {
+                above.push(AppearanceItem::Stroke(l));
+            }
+        }
+        items.extend(above);
+        Appearance { items, ..Appearance::default() }
+    }
+
+    fn text(&mut self, t: &af::Text, to_doc: Affine) -> TextObject {
+        let origin = match t.frame {
+            Some(f) => Point::new(f.x0, f.y0),
+            None => Point::new(t.anchor.x, t.anchor.y),
+        };
+        // Text space: origin at the anchor (or frame corner), the transform's uniform scale moved
+        // into the type size so sizes read in points.
+        let m = to_doc * affine(t.transform) * Affine::translate(origin.to_vec2());
+        let c = m.as_coeffs();
+        let k = (c[0] * c[3] - c[1] * c[2]).abs().sqrt().max(1e-9);
+        let xf = m * Affine::scale(1.0 / k);
+        let mut obj = TextObject::point(Point::ZERO, "", CharStyle::default());
+        obj.xf = xf;
+        obj.runs = t
+            .runs
+            .iter()
+            .map(|r| {
+                let mut style =
+                    CharStyle { font_family: if r.family.is_empty() { r.postscript.clone() } else { r.family.clone() }, ..CharStyle::default() };
+                style.font_style = font_style(r.weight, r.italic);
+                style.size = r.size * k;
+                style.leading = r.leading.map(|l| l * k);
+                style.tracking = r.tracking * 1000.0;
+                style.fill = match self.paint(&r.fill, to_doc) {
+                    Some((p, a)) => {
+                        if a < 0.999 {
+                            self.warn("translucent text colours import opaque");
+                        }
+                        p
+                    }
+                    None => Paint::None,
+                };
+                // Affinity separates paragraphs with U+2029 and lines with U+2028.
+                TextRun::new(r.text.replace(['\u{2029}', '\u{2028}'], "\n"), style)
+            })
+            .collect();
+        obj.para.justify = match t.align {
+            AfAlign::Left => Justify::Left,
+            AfAlign::Center => Justify::Center,
+            AfAlign::Right => Justify::Right,
+            AfAlign::Justify => Justify::JustifyLeft,
+        };
+        if let Some(f) = t.frame {
+            obj.kind = TextKind::Area { frame: shapes::rectangle(Rect::new(0.0, 0.0, (f.x1 - f.x0) * k, (f.y1 - f.y0) * k)) };
+        }
+        obj
+    }
+
+    fn image(&mut self, img: &af::Image, to_doc: Affine) -> Option<NodeKind> {
+        let bytes = match &img.pixels {
+            Pixels::Encoded(b) => b.clone(),
+            Pixels::Rgba8(rgba) => {
+                let buf = image::RgbaImage::from_raw(img.width, img.height, rgba.clone())?;
+                let mut png = Vec::new();
+                buf.write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).ok()?;
+                png
+            }
+        };
+        let r = match super::load::raster_image(&bytes) {
+            Ok(r) => r,
+            Err(_) => {
+                self.warn("an embedded image that could not be decoded was left out");
+                return None;
+            }
+        };
+        // The pixel grid maps onto the Affinity image's own size, whatever the stored file's.
+        let sx = img.width as f64 / f64::from(r.width.max(1));
+        let sy = img.height as f64 / f64::from(r.height.max(1));
+        let xf = to_doc * affine(img.transform) * Affine::scale_non_uniform(sx, sy);
+        self.doc.images.entry(r.key.clone()).or_insert(r.blob);
+        Some(NodeKind::Image(ImageObject { key: r.key, width: r.width, height: r.height, xf, link: None, placement: Default::default() }))
+    }
+}
+
+fn font_style(weight: i64, italic: bool) -> String {
+    let w = match weight {
+        ..=150 => "Thin",
+        151..=250 => "ExtraLight",
+        251..=325 => "Light",
+        326..=450 => "Regular",
+        451..=550 => "Medium",
+        551..=650 => "SemiBold",
+        651..=750 => "Bold",
+        751..=850 => "ExtraBold",
+        _ => "Black",
+    };
+    match (w, italic) {
+        ("Regular", true) => "Italic".into(),
+        (w, true) => format!("{w} Italic"),
+        (w, false) => w.into(),
+    }
+}

crates/engine/src/cmd/fileio/dxf.rs

@@ -21,7 +21,7 @@ pub fn specs() -> Vec<CommandSpec> {
         "Export DXF",
         [],
         None,
-        "{path?, version?: R12|R13|R14|2000|2004|2007|2010|2013|2018 (default), unit?: mm (default; any unit name: pt, in, cm…), scale?: 1 (drawing units per unit), scaleLineweights?: false, colors?: 8|16|256|true (default; true colour needs 2004+, else 256), rasterFormat?: png (default)|jpeg (placed images, written next to the file), preserve?: appearance (default: type as outlines; strokes a CAD line can't draw as filled outlines; brush art)|editability (type as text; every stroke a line with its lineweight and dashes), alterPaths?: false (every stroke as its filled outline), outlineText?: false, selectedOnly?: false (the selected objects, in their layers), artboard?: 0 (the origin is its bottom-left corner), useArtboards?: true (one drawing per chosen artboard, artboards?/range?, holding the art over it: {stem}-{artboard}.dxf) | false (the origin at the art's bounds)} → {path, bytes, warnings, files?, linked?: [image files]}; no path → {dataBase64, …, linked?: [{name, dataBase64}]}. Layers become DXF layers (hidden: off; locked; non-printing: not plotted); paths become polylines and splines, fills solid hatches. Same as document.export {format: dxf}",
+        "{path?, version?: R12|R13|R14|2000|2004|2007|2010|2013|2018 (default), unit?: mm (default; any unit name: pt, in, cm…), scale?: 1 (drawing units per unit), scaleLineweights?: false, colors?: 8|16|256|true (default; true colour needs 2004+, else 256), rasterFormat?: png (default)|jpeg (placed images, written next to the file), preserve?: appearance (default: type as outlines; strokes a CAD line can't draw as filled outlines; brush art)|editability (type as text; every stroke a line with its lineweight and dashes), alterPaths?: false (every stroke as its filled outline), outlineText?: false, selectedOnly?: false (the selected objects, in their layers), artboard?: 0 (the origin is its bottom-left corner), useArtboards?: true (one drawing per chosen artboard, artboards?/range?, holding the art over it: {stem}-{artboard}.dxf) | false (the origin at the art's bounds)} → {path, bytes, warnings, files?, linked?: [image files]}; no path → {dataBase64, …, linked?: [{name, dataBase64}]}. Layers become DXF layers (hidden: off; locked; non-printing: not plotted); paths become polylines and splines, fills their outlines (which laser and cutter software reads) and solid hatches. Same as document.export {format: dxf}",
         has_doc,
         export_dxf
     )]

crates/engine/src/cmd/fileio/export.rs

@@ -45,6 +45,9 @@ pub(super) fn serialize(s: &mut Session, p: &Value) -> Result<Value> {
 
 pub(super) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_param(p, "path");
+    if let Some(path) = path {
+        super::check_not_lossy_overwrite(s.doc()?, path, p, "document.export")?;
+    }
     let f = writable("document.export", str_param(p, "format"), path)?;
     let expanded = expand_presets(s, "document.export", p)?;
     let p = &*expanded;
@@ -166,6 +169,9 @@ pub(crate) fn isolated(doc: &Document, ids: &[NodeId], name: &str) -> Option<(Do
 /// template layers are guides, not artwork, and are left out.
 pub(super) fn export_selection(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "document.exportSelection";
+    if let Some(path) = str_param(p, "path") {
+        super::check_not_lossy_overwrite(s.doc()?, path, p, C)?;
+    }
     let path = str_param(p, "path");
     let f = writable(C, str_param(p, "format"), path)?;
     let expanded = expand_presets(s, C, p)?;
@@ -181,6 +187,9 @@ pub(super) fn export_selection(s: &mut Session, p: &Value) -> Result<Value> {
 /// `transparent`.
 pub(super) fn export_for_office(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "document.exportForOffice";
+    if let Some(path) = str_param(p, "path") {
+        super::check_not_lossy_overwrite(s.doc()?, path, p, C)?;
+    }
     let path = str_param(p, "path");
     let ppi = f64_or(p, "ppi", 150.0);
     let doc = &s.doc()?.doc;

crates/engine/src/cmd/fileio/load.rs

@@ -21,6 +21,9 @@ pub struct Loaded {
     /// An older native file (the former `.drawcraft` name or format version): saving it again
     /// rewrites it in today's format.
     pub converted: bool,
+    /// Only a stand-in picture of the file (an Affinity document whose native data couldn't be
+    /// read): Open shows it with its warning; Place, templates and libraries refuse it.
+    pub preview_only: bool,
 }
 
 /// An image ready to embed: PNG/JPEG/GIF/WebP keep their bytes, other formats are stored as PNG
@@ -48,6 +51,9 @@ pub fn file_name(name: &str) -> String {
 /// extension of `name`.
 pub fn detect(name: &str, bytes: &[u8]) -> Option<&'static Format> {
     let by_name = format_for_name(name).filter(|f| f.read);
+    if vectorcraft_affinity::is_affinity(bytes) {
+        return format("affinity");
+    }
     if vectorcraft_format::sniff(bytes) {
         // A template keeps its meaning from the extension, like .ait.
         return by_name.filter(|f| f.id == "template").or_else(|| format("vectorcraft"));
@@ -127,6 +133,23 @@ pub fn load(name: &str, bytes: &[u8]) -> Result<Loaded> {
     load_with(name, bytes, &LoadOptions::default())
 }
 
+/// A PDF-compatible `.ai` read through the editor's own copy of its art, which it carries: its
+/// layers and hidden objects as they were, and the art outside its artboard (its PDF part has
+/// only what is on the artboards), as an EPS of the editor is read. Anything else as it was.
+fn through_editing_data(bytes: &[u8], opts: &LoadOptions, doc: Document, warnings: Vec<String>) -> (Document, Vec<String>) {
+    if opts.pages.is_some() || !opts.layers {
+        return (doc, warnings);
+    }
+    let Some(private) = vectorcraft_pdf::illustrator_data(bytes, opts.password.as_deref()) else { return (doc, warnings) };
+    let (doc, mut warnings) = vectorcraft_eps::layered_ai(&private, doc, warnings);
+    // The note that the art outside the artboard is lost is the reason the layers weren't read.
+    if warnings.iter().any(|w| w.starts_with("the file's layers weren't read from its editing data")) {
+        return (doc, warnings);
+    }
+    warnings.retain(|w| w != vectorcraft_pdf::OFF_ARTBOARD_NOTE);
+    (doc, warnings)
+}
+
 /// [`load`] with `document.open` options (the PDF pages, box and password; the DXF options).
 pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded> {
     let format = detect(name, bytes).ok_or_else(|| match super::unsupported(&super::extension(name)) {
@@ -135,6 +158,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
     })?;
     let title = file_name(name);
     let mut converted = false;
+    let mut preview_only = false;
     let (mut doc, warnings, restored) = match format.id {
         // EPS and PostScript .ai: the document our EPS files carry, else the PostScript read.
         _ if format.id == "eps" || vectorcraft_pdf::is_postscript(bytes) => {
@@ -164,7 +188,10 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
                 .then(|| vectorcraft_pdf::editing_with(bytes, opts.password.as_deref()))
                 .flatten()
                 .map(|e| (e.intact, move || Some(e.data)));
-            restore_or_import(editing, || super::pdfimport::import(bytes, opts))?
+            restore_or_import(editing, || {
+                let (doc, warnings) = super::pdfimport::import(bytes, opts)?;
+                Ok(through_editing_data(bytes, opts, doc, warnings))
+            })?
         }
         "dxf" => {
             let (doc, warnings) = super::dxfimport::import(bytes, &opts.dxf)?;
@@ -174,6 +201,11 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
             let (doc, warnings) = super::metafile::import(bytes)?;
             (doc, warnings, false)
         }
+        "affinity" => {
+            let i = super::affinity::import(&title, bytes)?;
+            preview_only = i.preview_only;
+            (i.doc, i.warnings, false)
+        }
         _ if format.raster => (raster_doc(&title, bytes)?, vec![], false),
         _ => return Err(err(format!("{} files can't be opened yet", format.label))),
     };
@@ -185,7 +217,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
     if !matches!(format.id, "vectorcraft" | "template") || doc.title.is_empty() {
         doc.title = title;
     }
-    Ok(Loaded { doc, format, warnings, restored, converted })
+    Ok(Loaded { doc, format, warnings, restored, converted, preview_only })
 }
 
 /// Import SVG text, reading the files its images link to (relative links from `folder`, the SVG's
@@ -220,12 +252,21 @@ pub fn open_bytes_with(s: &mut Session, name: &str, bytes: &[u8], path: Option<S
 /// File → New from Template: any readable file (at `path`, if it is one: its links are looked for
 /// from there) as a new untitled document.
 pub fn open_template(s: &mut Session, name: &str, bytes: &[u8], path: Option<&str>) -> Result<Value> {
-    open_loaded(s, load(name, bytes)?, path.map(str::to_string), &LoadOptions::default(), true)
+    let loaded = load(name, bytes)?;
+    if loaded.preview_only {
+        return Err(err(
+            "only this Affinity file's embedded preview could be read: use File › Open to see it with its warning, or export SVG or PDF from Affinity first",
+        ));
+    }
+    open_loaded(s, loaded, path.map(str::to_string), &LoadOptions::default(), true)
 }
 
 /// Make a loaded file the new active document; `opts` are the options it was read with.
 fn open_loaded(s: &mut Session, loaded: Loaded, path: Option<String>, opts: &LoadOptions, as_template: bool) -> Result<Value> {
-    let Loaded { mut doc, format, warnings, restored, converted } = loaded;
+    let Loaded { mut doc, format, warnings, restored, converted, .. } = loaded;
+    // What reading the file left out of the document, if anything.
+    let losses: Vec<String> = warnings.iter().filter(|w| is_loss(w)).cloned().collect();
+    let source_path = path.clone().filter(|_| !losses.is_empty());
     let links = crate::cmd::links::resolve(&mut doc, path.as_deref(), s.prefs.update_links == "automatically");
     // A template (saved by Save as Template, or an .ait/.vctemplate file) opens as a new untitled
     // document.
@@ -248,6 +289,8 @@ fn open_loaded(s: &mut Session, loaded: Loaded, path: Option<String>, opts: &Loa
         st.format = format.id;
     }
     st.converted = converted;
+    st.imported_from = source_path;
+    st.import_losses = losses;
     let title = s.documents()[index].title();
     Ok(super::merge(json!({ "index": index, "title": title, "format": format.id, "warnings": warnings, "restored": restored }), links.to_json()))
 }
@@ -282,10 +325,19 @@ pub(super) fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
     open_template(s, src.name, &src.bytes, src.path)
 }
 
+/// The most memory decoding one image may take: a 60 in print sheet at 300 ppi (18000 × 6600 px)
+/// is ~475 MB as RGBA, past the decoder's 512 MB default once it is converted. The web app keeps
+/// that default: wasm32 has 4 GB to address and aborts when an allocation fails.
+const MAX_RASTER_ALLOC: u64 = if cfg!(target_arch = "wasm32") { 512 << 20 } else { 2 << 30 };
+
 /// Decode an image's header (and, for formats stored as PNG, its pixels). CMYK TIFFs are kept as
-/// they are, with their ink amounts ([`ImageBlob::cmyk`]).
+/// they are, with their ink amounts ([`ImageBlob::cmyk`]); CMYK TIFFs with an alpha channel, which
+/// the decoder can't read, become RGBA in the active colour settings' CMYK.
 pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
-    let reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(err)?;
+    let mut reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(err)?;
+    let mut limits = image::Limits::default();
+    limits.max_alloc = Some(MAX_RASTER_ALLOC);
+    reader.limits(limits);
     let kind = reader.format().ok_or_else(|| err("not an image VectorCraft reads (see document.formats)"))?;
     let f = image_format(kind).ok_or_else(|| err(format!("{kind:?} images can't be opened (see document.formats)")))?;
     let ppi = super::ppi::resolution(bytes);
@@ -293,7 +345,14 @@ pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     let (bytes, mime, (width, height)) = if matches!(f.id, "png" | "jpg" | "gif" | "webp") || (f.id == "tiff" && cmyk()) {
         (bytes.to_vec(), f.mime, reader.into_dimensions().map_err(err)?)
     } else {
-        let img = reader.decode().map_err(err)?.to_rgba8();
+        let cmyka = || {
+            let cms = vectorcraft_color::cms::active();
+            vectorcraft_doc::cmyk::cmyka_tiff_rgba(bytes, |c| cms.cmyk_to_srgb(c, false))
+        };
+        let img = match (f.id == "tiff").then(cmyka).flatten() {
+            Some(img) => img,
+            None => reader.decode().map_err(err)?.to_rgba8(),
+        };
         let size = img.dimensions();
         let mut png = Vec::new();
         img.write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).map_err(err)?;
@@ -311,18 +370,62 @@ pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     Ok(RasterImage { key: blob.content_key(), blob, width, height, ppi })
 }
 
-/// An image as a document of its pixel size (1 px = 1 pt), the image named after the file.
-fn raster_doc(name: &str, bytes: &[u8]) -> Result<Document> {
-    let RasterImage { key, blob, width, height, .. } = raster_image(bytes)?;
-    let mut d = Document::new(width as f64, height as f64);
+/// An image as a document of its physical size at the resolution it declares (as Place sizes it;
+/// 72 ppi, 1 px = 1 pt, when it declares none), the image named after the file.
+pub(super) fn raster_doc(name: &str, bytes: &[u8]) -> Result<Document> {
+    let RasterImage { key, blob, width, height, ppi } = raster_image(bytes)?;
+    let (sx, sy) = crate::cmd::place::pt_per_px(ppi);
+    let mut d = Document::new(width as f64 * sx, height as f64 * sy);
     let layer = d.layers[0].id;
     let id = d.alloc_id();
-    let mut n = Node::new(
-        id,
-        NodeKind::Image(ImageObject { key: key.clone(), width, height, xf: Affine::IDENTITY, link: None, placement: Default::default() }),
-    );
+    let xf = Affine::scale_non_uniform(sx, sy);
+    let mut n = Node::new(id, NodeKind::Image(ImageObject { key: key.clone(), width, height, xf, link: None, placement: Default::default() }));
     n.name = Some(name.to_string());
     d.images.insert(key, blob);
     d.insert(Some(layer), 0, n).map_err(err)?;
     Ok(d)
 }
+
+/// Does this import note say that the file has something the document doesn't?
+fn is_loss(note: &str) -> bool {
+    note == vectorcraft_pdf::OFF_ARTBOARD_NOTE || vectorcraft_eps::is_loss(note)
+}
+
+/// Writing the file `target` for document `st`: not over the file `st` was read from when reading
+/// it left something out (hidden text, art or layers), unless `p` has `acknowledgeLoss: true`.
+/// Another name keeps the original file, with all it has.
+pub(crate) fn check_not_lossy_overwrite(st: &crate::DocState, target: &str, p: &Value, cmd: &str) -> Result<()> {
+    let Some(losses) = overwrite_losses(st, target, p) else { return Ok(()) };
+    let what = losses_summary(losses);
+    Err(bad(
+        cmd,
+        format!(
+            "{target} is the file this document was read from, and reading it left things out ({what}): writing over it would lose them for good. Write another file instead, or pass acknowledgeLoss: true to replace it anyway"
+        ),
+    ))
+}
+
+/// What writing the file `target` for document `st` would lose for good: the notes of what reading
+/// it left out when `target` is the file `st` was read from, unless `p` has `acknowledgeLoss: true`.
+/// The UI asks before such a write and repeats it with `acknowledgeLoss` ([`check_not_lossy_overwrite`]).
+pub fn overwrite_losses<'a>(st: &'a crate::DocState, target: &str, p: &Value) -> Option<&'a [String]> {
+    let source = st.imported_from.as_deref().filter(|_| !st.import_losses.is_empty())?;
+    (!bool_or(p, "acknowledgeLoss", false) && same_file(source, target)).then_some(st.import_losses.as_slice())
+}
+
+/// Up to three of `losses`, quoted, and how many more.
+pub fn losses_summary(losses: &[String]) -> String {
+    let mut what = losses.iter().take(3).map(|n| format!("“{n}”")).collect::<Vec<_>>().join("; ");
+    if losses.len() > 3 {
+        what.push_str(&format!("; {} more", losses.len() - 3));
+    }
+    what
+}
+
+/// Do `a` and `b` name one file (spelled differently, or through a link)?
+fn same_file(a: &str, b: &str) -> bool {
+    match (std::fs::canonicalize(a), std::fs::canonicalize(b)) {
+        (Ok(a), Ok(b)) => a == b,
+        _ => a == b,
+    }
+}

crates/engine/src/cmd/fileio/mod.rs

@@ -19,6 +19,7 @@
 //! [`FORMATS`] is the single list of formats (append-only); open dialogs use [`open_filters`],
 //! agents query `document.formats`.
 
+mod affinity;
 mod batch;
 pub mod dxf;
 pub mod dxfimport;
@@ -46,17 +47,19 @@ pub use encode::{ARTBOARD_PARAMS, ArtboardPick, Encoded, encode, encode_all, enc
 pub(crate) use encode::{anti_alias, background, with_single_artboard};
 pub use export::export_source;
 pub(crate) use export::isolated;
+pub(crate) use load::check_not_lossy_overwrite;
 use load::err;
 pub(crate) use load::import_svg;
 pub(crate) use load::native_file;
 pub(crate) use load::source;
 pub use load::{Loaded, RasterImage, detect, file_name, load, load_with, open_bytes, open_bytes_with, open_template, raster_image};
+pub use load::{losses_summary, overwrite_losses};
 pub use native::with_compression_pref;
 pub use pdfimport::{LoadOptions, page_document};
 pub(crate) use save::job_for;
 pub use save::{
     SAVE_FORMATS, SaveJob, SaveMode, SavePlan, export_folder, save_filters, save_format, save_job, save_plan, save_with, stamp_save_dates,
-    templates_folder,
+    templates_dialog_folder, templates_folder,
 };
 pub use screens::{PRESETS as SCREEN_PRESETS, ScreenSize, preset_rows as screen_preset_rows};
 pub(crate) use screens::{
@@ -78,7 +81,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Open Document",
             [],
             None,
-            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, lines wrapped in a frame as area type where they lay out the same, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does, grays? as there; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its pixel size), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
+            "{path} or {name, dataBase64}, PDF/.ai: pages?: \"2-3, 5\" (1-based, default all; one artboard each) | page?: n, cropTo?: bounding|art|crop (default)|trim|bleed|media (the box each artboard gets; bounding: the art's bounds), password? (encrypted PDFs; see document.pdfInfo), textAs?: text (default: point type per line, lines wrapped in a frame as area type where they lay out the same, in the file's fonts by name; missing ones are listed in warnings) | outlines (glyph paths), layers?: true (default: optional content groups become layers with their visibility, print state and lock — art that is off comes in as a hidden layer; other art goes to a layer per page) | false (one layer per page, without the art that is off; Save then asks for a name), colorMode?: rgb|cmyk (the mode the document opens in, its colours converted as file.documentColorMode does, grays? as there; default: the file's — a PDF keeps CMYK, Gray and spot inks (spot swatches at a tint) and opens in CMYK when painted mostly in CMYK), DXF: dxf?: {layout?: \"Model\" (default) | a paper layout's name (document.dxfInfo lists them), unit?, scale? (the ratio: 1 unit of the art = scale drawing units; default: the drawing at 1:1 in its own unit), fit?: false (scale to fit an artboard of fitTo?: [612, 792], turned to the art's orientation), scaleLineweights?: false (lineweights scale with the art), center?: true (false: the drawing's origin on the artboard's bottom-left corner; fitted art's bottom-left corner), mergeLayers?: false (all art on one layer)} → {index, title, format, warnings, restored, missingLinks, modifiedLinks, updatedLinks: [{name, path, ids}]}; any readable format (see document.formats): .vectorcraft/.drawcraft, .svg/.svgz, .pdf/.ai, .ait, ASCII .dxf (each DXF layer with art a layer; blocks symbols; what can't come in is listed in warnings), PNG/JPEG/GIF/WebP/TIFF/BMP (an image opens as a document of its size at the resolution it declares, as file.place sizes it; 72 ppi, 1 px = 1 pt, when it declares none), .emf/.wmf (one artboard, the picture's frame; records VectorCraft doesn't read are skipped with one warning), .eps and PostScript .ai (one artboard, the bounding box: an EPS file VectorCraft wrote restores the document it carries, restored: true; other files are read by a PostScript interpreter — paths, colours and spot inks, clips, gradients, images, type in the fonts named — and come in as their TIFF preview, with a warning, when their PostScript can't be read). A PDF/.ai/.ait or SVG saved with Preserve Editing restores the native document it carries (restored: true; a PDF only when no pages are picked), unless the file was changed elsewhere since or the data can't be read: then its artwork is imported and the first warning says why. Templates (native templates, .ait) open as a new untitled document; a restored .ai keeps its path (Save writes .ai again). Linked images are read from their files (looked for at their path, then relative to the document): missing ones show their saved preview (links.relink), modified ones are read again only with Preferences › Update Links: Automatically (else links.update). An SVG's <image> files (relative links from the SVG's folder) stay linked, SVG files become art, missing ones a placeholder in their box (a warning and missingLinks)",
             always,
             load::open
         ),
@@ -555,6 +558,9 @@ pub const FORMATS: &[Format] = &[
     Format { id: "wmf", label: "WMF", extensions: &["wmf"], mime: "image/wmf", read: true, write: true, raster: false, options: metafile::OPTIONS },
     Format { id: "tga", label: "Targa", extensions: &["tga"], mime: "image/x-tga", read: false, write: true, raster: true, options: TGA_OPTIONS },
     Format { id: "psd", label: "PSD", extensions: &["psd"], mime: "image/x-psd", read: false, write: true, raster: true, options: PSD_OPTIONS },
+    // Affinity Photo's `.afphoto` opens by its content but isn't listed: Finder shouldn't offer a
+    // vector app for a raster editor's documents.
+    reader("affinity", "Affinity", &["af", "afdesign", "afpub"], "application/vnd.affinity", false),
 ];
 
 /// Every extension `document.open` reads (the "All readable files" filter of open dialogs).
@@ -579,6 +585,9 @@ pub const OPEN_EXTS: &[&str] = &[
     "emf",
     "wmf",
     "eps",
+    "af",
+    "afdesign",
+    "afpub",
 ];
 
 /// The extension that picks each writable format when exporting (the format's first; PNG-8 shares
@@ -618,6 +627,9 @@ pub const PLACE_EXTS: &[&str] = &[
     "emf",
     "wmf",
     "eps",
+    "af",
+    "afdesign",
+    "afpub",
     "txt",
 ];
 
@@ -638,9 +650,11 @@ pub fn open_filters() -> impl Iterator<Item = (&'static str, &'static [&'static
         .chain(std::iter::once(("Plug-ins", super::plugin::EXTS)))
 }
 
-/// File → Place dialog filters: "All placeable files", then one per readable format, then text.
+/// File → Place dialog filters: "All placeable files", then one per placeable format, then text.
 pub fn place_filters() -> impl Iterator<Item = (&'static str, &'static [&'static str])> {
-    std::iter::once(("All placeable files", PLACE_EXTS)).chain(format_filters()).chain(std::iter::once(("Text", TEXT_EXTS)))
+    std::iter::once(("All placeable files", PLACE_EXTS))
+        .chain(format_filters().filter(|(_, exts)| exts.iter().all(|ext| PLACE_EXTS.contains(ext))))
+        .chain(std::iter::once(("Text", TEXT_EXTS)))
 }
 
 /// A format by id or extension (any case, leading dot allowed; `jpeg` finds `jpg`).
@@ -860,6 +874,8 @@ pub(crate) fn write_or_return(path: Option<&str>, bytes: &[u8], extra: Value) ->
 #[cfg(test)]
 mod tests;
 #[cfg(test)]
+mod tests_affinity;
+#[cfg(test)]
 mod tests_pdf;
 #[cfg(test)]
 mod tests_pdfcolor;
@@ -922,6 +938,9 @@ mod tests_psd;
 #[cfg(test)]
 mod tests_epsimport;
 
+#[cfg(test)]
+mod tests_aiimport;
+
 #[cfg(test)]
 mod tests_pdflayers;
 

crates/engine/src/cmd/fileio/pdf.rs

@@ -356,6 +356,9 @@ fn without_non_printing(layers: &[Arc<Node>]) -> Option<Vec<Arc<Node>>> {
 }
 
 fn export_pdf(s: &mut Session, p: &Value) -> Result<Value> {
+    if let Some(path) = str_param(p, "path") {
+        super::check_not_lossy_overwrite(s.doc()?, path, p, C)?;
+    }
     let expanded = expand_preset(s, C, p)?;
     let p = &*expanded;
     let (bytes, warnings) = encode(C, &s.doc()?.doc, p)?;

crates/engine/src/cmd/fileio/save.rs

@@ -98,13 +98,52 @@ pub fn stamp_save_dates(st: &mut DocState, at: i64) {
     d.metadata.modified = Some(at);
 }
 
-/// The Templates folder: the `templatesFolder` preference, else `Documents/VectorCraft Templates`
-/// in the user's home (none where there is no home folder, as on the web).
+/// The Templates folder: the `templatesFolder` preference, else `VectorCraft Templates` in the
+/// user's documents folder (none where there is no home folder, as on the web).
 pub fn templates_folder(prefs: &Prefs) -> Option<String> {
     if !prefs.templates_folder.is_empty() {
         return Some(prefs.templates_folder.clone());
     }
-    Some(std::path::Path::new(&home_folder()?).join("Documents").join("VectorCraft Templates").to_string_lossy().to_string())
+    Some(documents_folder()?.join("VectorCraft Templates").to_string_lossy().to_string())
+}
+
+/// The Templates folder for a file dialog to start in (#703): made when it's missing; where it
+/// can't be, the nearest folder above it that exists, else the home folder. A dialog asked to
+/// start in a folder that isn't there shows an error on some desktops.
+pub fn templates_dialog_folder(prefs: &Prefs) -> Option<String> {
+    let folder = std::path::PathBuf::from(templates_folder(prefs)?);
+    if !folder.is_dir() {
+        // Best effort: a folder that can't be made leaves the nearest one that exists.
+        let _ = std::fs::create_dir_all(&folder);
+    }
+    folder.ancestors().find(|a| a.is_dir()).map(|a| a.to_string_lossy().into_owned()).or_else(home_folder)
+}
+
+/// The user's documents folder: on Linux and the BSDs the one the desktop names
+/// (`XDG_DOCUMENTS_DIR` in `user-dirs.dirs`: `~/Documenti`, `~/Dokumente`…), elsewhere `Documents`
+/// in the home folder.
+fn documents_folder() -> Option<std::path::PathBuf> {
+    let home = std::path::PathBuf::from(home_folder()?);
+    if cfg!(all(unix, not(target_os = "macos"))) {
+        let config =
+            std::env::var_os("XDG_CONFIG_HOME").map(std::path::PathBuf::from).filter(|p| p.is_absolute()).unwrap_or_else(|| home.join(".config"));
+        if let Some(dir) = std::fs::read_to_string(config.join("user-dirs.dirs")).ok().and_then(|t| xdg_documents(&t, &home)) {
+            return Some(dir);
+        }
+    }
+    Some(home.join("Documents"))
+}
+
+/// `XDG_DOCUMENTS_DIR` in a `user-dirs.dirs` file's `text`, `$HOME` being `home`. None when it isn't
+/// set, is relative, or is the home folder itself (the spec's way of turning it off).
+fn xdg_documents(text: &str, home: &std::path::Path) -> Option<std::path::PathBuf> {
+    let line = text.lines().map(str::trim).find(|l| l.starts_with("XDG_DOCUMENTS_DIR="))?;
+    let value = line.split_once('=')?.1.trim().trim_matches('"');
+    let dir = match value.strip_prefix("$HOME") {
+        Some(rest) => home.join(rest.trim_start_matches('/')),
+        None => std::path::PathBuf::from(value),
+    };
+    (dir.has_root() && dir != home).then_some(dir)
 }
 
 /// The user's home folder (`HOME`, else `USERPROFILE` on Windows; none on the web).
@@ -189,10 +228,13 @@ pub fn save_plan(s: &Session, mode: SaveMode, p: &Value) -> Result<SavePlan> {
         SaveMode::Save | SaveMode::SaveAs => format!("{stem}.{ext}"),
     };
     let folder = match mode {
-        SaveMode::Template => templates_folder(&s.prefs),
+        SaveMode::Template => templates_dialog_folder(&s.prefs),
         _ => st.path.as_deref().and_then(parent_folder),
     };
     let modified = date_param(p, "modified", cmd)?;
+    if let Some(path) = &path {
+        super::check_not_lossy_overwrite(st, path, p, cmd)?;
+    }
     Ok(SavePlan { mode, path, format, options, name, folder, modified })
 }
 
@@ -614,3 +656,40 @@ pub(super) fn specs() -> Vec<CommandSpec> {
         ),
     ]
 }
+
+#[cfg(test)]
+mod tests_folders {
+    use std::path::{Path, PathBuf};
+
+    /// #703: the documents folder a desktop names in `user-dirs.dirs`, not an English `Documents`.
+    #[test]
+    fn the_desktops_documents_folder_is_read_from_user_dirs() {
+        let home = Path::new("/home/david");
+        let file = "# comment\nXDG_DESKTOP_DIR=\"$HOME/Scrivania\"\nXDG_DOCUMENTS_DIR=\"$HOME/Documenti\"\n";
+        assert_eq!(super::xdg_documents(file, home), Some(PathBuf::from("/home/david/Documenti")));
+        assert_eq!(super::xdg_documents("XDG_DOCUMENTS_DIR=\"/data/docs\"", home), Some(PathBuf::from("/data/docs")));
+        // "$HOME/" turns it off; a relative or missing one isn't used.
+        assert_eq!(super::xdg_documents("XDG_DOCUMENTS_DIR=\"$HOME/\"", home), None);
+        assert_eq!(super::xdg_documents("XDG_DOCUMENTS_DIR=\"docs\"", home), None);
+        assert_eq!(super::xdg_documents("XDG_MUSIC_DIR=\"$HOME/Musica\"", home), None);
+    }
+
+    /// #703: the Templates folder a dialog starts in exists: made when missing, else the nearest
+    /// folder above it.
+    #[test]
+    fn the_templates_dialog_folder_exists() {
+        let base = std::env::temp_dir().join(format!("vc-templates-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        std::fs::create_dir_all(&base).unwrap();
+        let mut prefs = crate::Prefs::default();
+        let wanted = base.join("Modelli").join("VectorCraft Templates");
+        prefs.templates_folder = wanted.to_string_lossy().into_owned();
+        assert_eq!(super::templates_dialog_folder(&prefs).map(PathBuf::from), Some(wanted.clone()));
+        assert!(wanted.is_dir(), "made");
+        // A file in the way: the nearest folder that exists.
+        std::fs::write(base.join("blocked"), b"x").unwrap();
+        prefs.templates_folder = base.join("blocked").join("Templates").to_string_lossy().into_owned();
+        assert_eq!(super::templates_dialog_folder(&prefs).map(PathBuf::from), Some(base.clone()));
+        let _ = std::fs::remove_dir_all(&base);
+    }
+}

crates/engine/src/cmd/fileio/svg.rs

@@ -153,6 +153,9 @@ pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Enco
     let (opts, boards, chosen) = plan(doc, p)?;
     // Preserve editing embeds the native document (once, shared by every file).
     let native = opts.preserve_editing.then(|| vectorcraft_format::save(doc, false));
+    // SVG has no filters for the Photoshop-style effects: their objects go in as images.
+    let flat = crate::cmd::rasterfx::flatten_pixel_effects(doc);
+    let doc = flat.as_ref().unwrap_or(doc);
     let mut enc = Encoded::default();
     for artboard in boards {
         // A chosen artboard's file holds the art over it (#550).

crates/engine/src/cmd/fileio/tests_affinity.rs

@@ -0,0 +1,331 @@
+//! Affinity documents: native import (layers, artboards, curves, paints) through Open, Place and
+//! templates, and the embedded preview only as an explicitly warned fallback.
+
+use super::*;
+use proptest::prelude::*;
+use serde_json::json;
+use std::io::Cursor;
+
+fn png() -> Vec<u8> {
+    let im = image::RgbaImage::from_fn(2, 1, |x, _| if x == 0 { image::Rgba([220, 40, 60, 255]) } else { image::Rgba([0, 0, 0, 0]) });
+    let mut bytes = Vec::new();
+    im.write_to(&mut Cursor::new(&mut bytes), image::ImageFormat::Png).unwrap();
+    bytes
+}
+
+/// Synthetic envelope without a native object graph; not a native Affinity writer.
+fn file(png: &[u8]) -> Vec<u8> {
+    let mut b = vec![0; 72];
+    b[..4].copy_from_slice(vectorcraft_affinity::MAGIC);
+    b[4..6].copy_from_slice(&12u16.to_le_bytes());
+    b[8..12].copy_from_slice(b"nsrP");
+    b[12..16].copy_from_slice(b"#Inf");
+    b[24..32].copy_from_slice(&72u64.to_le_bytes());
+    b[64..68].copy_from_slice(b"Prot");
+    b.extend(b"\xff\xff\xff\xffThmb");
+    b.extend(1u32.to_le_bytes());
+    b.extend((png.len() as u32 + 13).to_le_bytes());
+    b.extend(29u32.to_le_bytes());
+    b.extend(0u32.to_le_bytes());
+    b.extend((png.len() as u32).to_le_bytes());
+    b.push(1);
+    b.extend(png);
+    b
+}
+
+#[test]
+fn preview_opens_with_a_warning_and_never_saves_to_the_source() {
+    let mut s = Session::new();
+    let bytes = file(&png());
+    for name in ["drawing.af", "renamed.png", "unknown"] {
+        let result = open_bytes(&mut s, name, &bytes, Some(format!("/source/{name}"))).unwrap();
+        assert_eq!(result["format"], "affinity");
+        let w = result["warnings"][0].as_str().unwrap();
+        assert!(w.contains("2×1") && w.contains("native Affinity document could not be read") && w.contains("no layers"), "{w}");
+        let st = s.doc().unwrap();
+        assert!(st.path.is_none());
+        assert_eq!(st.format, "vectorcraft");
+        assert_eq!((st.doc.artboards[0].rect.width(), st.doc.artboards[0].rect.height()), (2.0, 1.0));
+        assert_eq!(st.doc.images.values().next().unwrap().bytes.as_slice(), png());
+        let saved = vectorcraft_format::save_file(&st.doc);
+        let reopened = vectorcraft_format::load_file(&saved).unwrap();
+        assert_eq!(reopened.doc.images, st.doc.images);
+        let plan = save_plan(&s, SaveMode::Save, &json!({})).unwrap();
+        assert!(plan.path.is_none(), "Save must ask for a new destination");
+        assert_eq!(plan.format.id, "vectorcraft");
+        assert!(plan.name.ends_with(".vectorcraft"));
+    }
+    let f = format("affinity").unwrap();
+    assert!(f.read && !f.write);
+    for ext in ["af", "afdesign", "afpub"] {
+        assert!(OPEN_EXTS.contains(&ext) && PLACE_EXTS.contains(&ext), "{ext}");
+    }
+    assert!(!SAVE_FORMATS.contains(&"affinity"));
+    assert!(s.execute("document.serialize", &json!({"format":"af"})).is_err());
+    assert!(s.execute("document.export", &json!({"format":"affinity"})).is_err());
+    assert!(save_format(None, Some("drawing.af")).is_err());
+}
+
+#[test]
+fn preview_reaches_the_document_open_command() {
+    let mut s = Session::new();
+    let r = s.execute("document.open", &json!({"name":"test.af", "dataBase64":vectorcraft_format::base64_encode(&file(&png()))})).unwrap();
+    assert_eq!(r["format"], "affinity");
+    assert_eq!(r["warnings"].as_array().unwrap().len(), 1);
+}
+
+#[test]
+fn placing_a_preview_is_rejected_even_when_renamed_or_queued() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width":100,"height":100})).unwrap();
+    let original = s.doc().unwrap().doc.clone();
+    for name in ["test.af", "renamed.png", "renamed.txt"] {
+        let p = json!({"name":name, "dataBase64":vectorcraft_format::base64_encode(&file(&png())), "link":true});
+        for cmd in ["file.place", "file.place.info"] {
+            let e = s.execute(cmd, &p).unwrap_err().to_string();
+            assert!(e.contains("File › Open") && e.contains("embedded preview"), "{e}");
+        }
+        let e = s.execute("file.place.queue", &json!({"files":[p]})).unwrap_err().to_string();
+        assert!(e.contains("File › Open") && e.contains("embedded preview"), "{e}");
+    }
+    assert_eq!(s.doc().unwrap().doc, original);
+}
+
+#[test]
+fn templates_and_libraries_cannot_silently_extract_preview_content() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width":100,"height":100})).unwrap();
+    let original = s.doc().unwrap().doc.clone();
+    for name in ["test.af", "renamed.svg"] {
+        let p = json!({"name":name, "dataBase64":vectorcraft_format::base64_encode(&file(&png()))});
+        for cmd in ["file.newFromTemplate", "swatch.library.load", "graphicStyle.loadLibrary"] {
+            let e = s.execute(cmd, &p).unwrap_err().to_string();
+            assert!(e.contains("File › Open"), "{cmd}: {e}");
+        }
+    }
+    assert_eq!(s.documents().len(), 1);
+    assert_eq!(s.doc().unwrap().doc, original);
+}
+
+#[test]
+fn malformed_crc_and_every_truncation_fail() {
+    let b = file(&png());
+    for end in 0..b.len() {
+        assert!(load("bad.af", &b[..end]).is_err(), "{end}");
+    }
+    let mut crc = b.clone();
+    crc[130] ^= 1;
+    assert!(load("bad.af", &crc).is_err());
+    // Affinity 1 and 2 (container versions 8 to 11) store the same preview record.
+    let mut legacy = b.clone();
+    legacy[4..6].copy_from_slice(&10u16.to_le_bytes());
+    assert!(load("old.afdesign", &legacy).is_ok());
+    let mut unknown = b.clone();
+    unknown[4..6].copy_from_slice(&13u16.to_le_bytes());
+    assert!(load("new.af", &unknown).err().unwrap().to_string().contains("unknown container version"));
+}
+
+#[test]
+fn end_and_post_image_chunk_crcs_cannot_escape_pixel_decoding() {
+    let mut end_crc = png();
+    *end_crc.last_mut().unwrap() ^= 1;
+    assert!(load("bad-end.af", &file(&end_crc)).is_err());
+
+    let body = b"Note\0Synthetic";
+    let mut text = (body.len() as u32).to_be_bytes().to_vec();
+    text.extend(b"tEXt");
+    text.extend(body);
+    let mut h = crc32fast::Hasher::new();
+    h.update(b"tEXt");
+    h.update(body);
+    text.extend(h.finalize().to_be_bytes());
+    let mut post_image = png();
+    let at = post_image.len() - 12;
+    post_image.splice(at..at, text);
+    assert!(load("valid-text.af", &file(&post_image)).is_ok());
+    post_image[at + 8 + body.len()] ^= 1;
+    assert!(load("bad-text.af", &file(&post_image)).is_err());
+}
+
+#[test]
+fn a_previewless_file_fails_without_replacing_the_active_document() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width":100,"height":100})).unwrap();
+    let original = s.doc().unwrap().doc.clone();
+    let mut bytes = file(&png());
+    bytes[24..32].copy_from_slice(&0u64.to_le_bytes());
+    let e = s.execute("document.open", &json!({"name":"no-preview.af", "dataBase64":vectorcraft_format::base64_encode(&bytes)})).unwrap_err();
+    assert!(e.to_string().contains("no embedded preview"));
+    assert_eq!(s.documents().len(), 1);
+    assert_eq!(s.doc().unwrap().doc, original);
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(128))]
+    #[test]
+    fn bounded_mutations_do_not_panic(edits in prop::collection::vec((0usize..300, any::<u8>()), 0..16)) {
+        let mut b = file(&png());
+        for (i, value) in edits { if let Some(byte) = b.get_mut(i) { *byte = value; } }
+        let _ = load("mutated.af", &b);
+    }
+}
+
+mod native {
+    use super::*;
+    use vectorcraft_affinity::synth::{self, F, Method, tag};
+    use vectorcraft_doc::{NodeKind, appearance::AppearanceItem};
+
+    fn rgba(r: f32, g: f32, b: f32, a: f32) -> F {
+        F::Struct([r, g, b, a].iter().flat_map(|v| v.to_le_bytes()).collect())
+    }
+
+    fn solid(id: u32, c: F) -> F {
+        F::Def(
+            id,
+            vec![tag(b"FDsc")],
+            vec![(
+                tag(b"FDeF"),
+                F::Def(id + 1, vec![tag(b"FilS")], vec![(tag(b"Colr"), F::Def(id + 2, vec![tag(b"RGBA")], vec![(tag(b"_col"), c)]))]),
+            )],
+        )
+    }
+
+    fn node(x: f64, y: f64, kind: u8, role: u8) -> Vec<u8> {
+        let mut r = x.to_le_bytes().to_vec();
+        r.extend(y.to_le_bytes());
+        r.extend([kind, role]);
+        r
+    }
+
+    /// A version-12 document at 144 ppi: an artboard "Board" (moved 20, 10) holding a closed
+    /// triangle with a red fill and a 4 px blue stroke, and a hidden ellipse on a layer.
+    pub(super) fn document(method: Method) -> Vec<u8> {
+        let triangle = F::Def(
+            20,
+            vec![tag(b"PCrv"), tag(b"VNod"), tag(b"Node")],
+            vec![
+                (tag(b"Desc"), F::Str("Triangle".into())),
+                (
+                    tag(b"Crvs"),
+                    F::Obj(
+                        tag(b"PCvD"),
+                        vec![(
+                            tag(b"Data"),
+                            F::Pos(vec![
+                                F::U8(0),
+                                F::U32(1),
+                                F::Bool(true),
+                                F::Records(18, vec![node(0.0, 0.0, 1, 0), node(100.0, 0.0, 1, 0), node(50.0, 80.0, 1, 0), node(0.0, 0.0, 1, 0)]),
+                            ]),
+                        )],
+                    ),
+                ),
+                (tag(b"BFFl"), F::Shared(vec![solid(21, rgba(1.0, 0.0, 0.0, 1.0))])),
+                (tag(b"LIFl"), F::Shared(vec![solid(24, rgba(0.0, 0.0, 1.0, 1.0))])),
+                (
+                    tag(b"LILn"),
+                    F::Shared(vec![F::Def(
+                        27,
+                        vec![tag(b"LDsc")],
+                        vec![(tag(b"LDeL"), F::Def(28, vec![tag(b"LSty")], vec![(tag(b"Wght"), F::F64(4.0))])), (tag(b"LDSc"), F::Bool(true))],
+                    )]),
+                ),
+            ],
+        );
+        let board = F::Def(
+            10,
+            vec![tag(b"ShpN"), tag(b"VNod"), tag(b"Node")],
+            vec![
+                (tag(b"Desc"), F::Str("Board".into())),
+                (tag(b"ABEn"), F::Bool(true)),
+                (tag(b"Shpe"), F::Def(11, vec![tag(b"ShNR")], vec![])),
+                (tag(b"ShpB"), F::F64s(vec![0.0, 0.0, 200.0, 100.0])),
+                (tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 20.0, 0.0, 1.0, 10.0])),
+                (tag(b"BFFl"), F::Shared(vec![solid(12, rgba(1.0, 1.0, 1.0, 1.0))])),
+                (tag(b"Chld"), F::Shared(vec![triangle])),
+            ],
+        );
+        let ellipse = F::Def(
+            40,
+            vec![tag(b"ShpN")],
+            vec![
+                (tag(b"Visi"), F::Bool(false)),
+                (tag(b"Shpe"), F::Def(41, vec![tag(b"ShpE")], vec![])),
+                (tag(b"ShpB"), F::F64s(vec![300.0, 0.0, 400.0, 50.0])),
+                (tag(b"BFFl"), F::Shared(vec![F::Def(42, vec![tag(b"FDsc")], vec![(tag(b"FDeF"), F::Def(43, vec![tag(b"FilN")], vec![]))])])),
+            ],
+        );
+        let layer = F::Def(30, vec![tag(b"Scop")], vec![(tag(b"Desc"), F::Str("Shapes".into())), (tag(b"Chld"), F::Shared(vec![ellipse]))]);
+        let spread =
+            F::Def(2, vec![tag(b"Sprd")], vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 420.0, 120.0])), (tag(b"Chld"), F::Shared(vec![board, layer]))]);
+        let doc = synth::stream(&[
+            (tag(b"UVCn"), F::Obj(tag(b"UVCn"), vec![(tag(b"UPPI"), F::F64(144.0))])),
+            (tag(b"DocR"), F::Def(1, vec![tag(b"DocN")], vec![(tag(b"Chld"), F::Shared(vec![spread]))])),
+        ]);
+        synth::container(&[("doc.dat", &doc, method)], Some(&png()))
+    }
+
+    #[test]
+    fn layers_artboards_curves_and_paints_open_as_editable_art() {
+        for method in [Method::Stored, Method::Zlib, Method::Zstd] {
+            let mut s = Session::new();
+            let r = open_bytes(&mut s, "native.af", &document(method), Some("/source/native.af".into())).unwrap();
+            assert_eq!(r["format"], "affinity");
+            // Affinity Photo's extension isn't listed, but its documents still open by their content.
+            assert_eq!(open_bytes(&mut Session::new(), "native.afphoto", &document(method), None).unwrap()["format"], "affinity");
+            assert!(r["warnings"].as_array().unwrap().iter().all(|w| !w.as_str().unwrap().contains("preview")), "{r}");
+            let st = s.doc().unwrap();
+            assert!(st.path.is_none(), "Save must not write back over the Affinity file");
+            let d = &st.doc;
+            // 144 ppi: two document pixels per point.
+            assert_eq!(d.artboards.len(), 1);
+            assert_eq!(d.artboards[0].name, "Board");
+            assert_eq!(d.artboards[0].rect, kurbo::Rect::new(10.0, 5.0, 110.0, 55.0));
+            let names: Vec<_> = d.layers.iter().map(|l| l.name.clone().unwrap()).collect();
+            assert_eq!(names, ["Board", "Shapes"]);
+            let NodeKind::Layer { children, .. } = &d.layers[0].kind else { panic!() };
+            let NodeKind::Group { children: clipped, clip: true } = &children[0].kind else { panic!("{:?}", children[0].kind) };
+            let NodeKind::Path { clipping: true, .. } = &clipped[0].kind else { panic!() };
+            let tri = &clipped[1];
+            assert_eq!(tri.name.as_deref(), Some("Triangle"));
+            let NodeKind::Path { path, .. } = &tri.kind else { panic!() };
+            let pts: Vec<_> = path.subpaths[0].anchors.iter().map(|a| (a.p.x, a.p.y)).collect();
+            assert_eq!(pts, [(10.0, 5.0), (60.0, 5.0), (35.0, 45.0)]);
+            assert!(path.subpaths[0].closed);
+            let [AppearanceItem::Fill(f), AppearanceItem::Stroke(k)] = tri.appearance.items.as_slice() else { panic!("{:?}", tri.appearance) };
+            assert_eq!(f.paint, vectorcraft_color::Paint::solid(vectorcraft_color::Color::Rgb { r: 1.0, g: 0.0, b: 0.0 }));
+            assert_eq!(k.width, 2.0);
+            let NodeKind::Layer { children, .. } = &d.layers[1].kind else { panic!() };
+            assert!(!children[0].visible, "hidden layers stay hidden");
+        }
+    }
+
+    #[test]
+    fn native_documents_save_reopen_export_place_and_template() {
+        let bytes = document(Method::Zstd);
+        let mut s = Session::new();
+        open_bytes(&mut s, "native.af", &bytes, None).unwrap();
+        let doc = s.doc().unwrap().doc.clone();
+        let reopened = vectorcraft_format::load_file(&vectorcraft_format::save_file(&doc)).unwrap();
+        assert_eq!(reopened.doc.layers, doc.layers);
+        for format in ["svg", "pdf", "png"] {
+            assert!(s.execute("document.export", &json!({"format": format})).is_ok(), "{format}");
+        }
+        let p = json!({"name":"native.afdesign", "dataBase64":vectorcraft_format::base64_encode(&bytes)});
+        s.execute("file.new", &json!({"width":100,"height":100})).unwrap();
+        s.execute("file.place", &p).unwrap();
+        assert!(s.doc().unwrap().doc.layers.iter().any(|l| !l.children().unwrap().is_empty()));
+        s.execute("file.newFromTemplate", &p).unwrap();
+        assert!(s.doc().unwrap().path.is_none());
+    }
+
+    #[test]
+    fn a_damaged_native_document_falls_back_to_its_preview_with_the_reason() {
+        let mut bytes = document(Method::Zlib);
+        // Break the doc.dat CRC: the preview still opens, saying why.
+        bytes[80] ^= 0xFF;
+        let r = load("broken.af", &bytes).unwrap();
+        assert!(r.preview_only);
+        assert!(r.warnings[0].contains("could not be read (damaged Affinity file"), "{}", r.warnings[0]);
+    }
+}

crates/engine/src/cmd/fileio/tests_aiimport.rs

@@ -0,0 +1,93 @@
+//! Illustrator EPS and `.ai` files open from the editing data they carry: layers, groups, names,
+//! hidden objects, artboards, colours and images as they were; what the reader doesn't read yet
+//! opens as before, with a warning saying why.
+
+use std::io::Write as _;
+use std::sync::Arc;
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{Node, NodeKind};
+use vectorcraft_testkit::ai;
+
+use super::*;
+
+fn open(s: &mut Session, name: &str, bytes: &[u8], params: Value) -> Result<Value> {
+    let mut p = json!({"name": name, "dataBase64": vectorcraft_format::base64_encode(bytes)});
+    if let (Some(p), Some(extra)) = (p.as_object_mut(), params.as_object()) {
+        p.extend(extra.clone());
+    }
+    s.execute("document.open", &p)
+}
+
+/// The `.ai` private data of `data`, compressed as older `.ai` files compress it.
+fn compressed(data: &[u8]) -> Vec<u8> {
+    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    e.write_all(data).unwrap();
+    [&b"%AI12_CompressedData"[..], &e.finish().unwrap()].concat()
+}
+
+fn names(nodes: &[Arc<Node>]) -> Vec<String> {
+    nodes.iter().map(|n| n.name.clone().unwrap_or_default()).collect()
+}
+
+/// The sample's structure, as [`ai::sample_data`] builds it.
+fn check_sample(s: &Session) {
+    let doc = &s.doc().unwrap().doc;
+    assert_eq!(names(&doc.layers), ["Art", "Hidden"]);
+    assert_eq!(doc.artboards.len(), 1);
+    assert_eq!(doc.artboards[0].rect, vectorcraft_geom::Rect::new(0.0, 0.0, 200.0, 100.0));
+    let art = doc.layers[0].children().unwrap();
+    assert_eq!(names(art), ["Pair", "Ring", "Window"]);
+    let pair = art[0].children().unwrap();
+    assert_eq!(names(pair), ["Red", ""]);
+    assert!(pair[0].visible && !pair[1].visible, "the hidden member stays hidden");
+    assert!(matches!(art[1].kind, NodeKind::Compound { .. }));
+    assert!(matches!(&art[2].kind, NodeKind::Group { clip: true, children } if matches!(children[0].kind, NodeKind::Path { clipping: true, .. })));
+    let hidden = &doc.layers[1];
+    assert!(!hidden.visible);
+    let kids = hidden.children().unwrap();
+    assert_eq!(names(kids), ["Shaded", "", "Sub", ""]);
+    assert!(matches!(kids[0].appearance.fill().map(|f| &f.paint), Some(vectorcraft_color::Paint::Gradient(_))));
+    assert_eq!((kids[1].opacity, kids[1].blend), (0.5, vectorcraft_color::BlendMode::Screen));
+    assert!(kids[2].locked && matches!(kids[2].kind, NodeKind::Layer { .. }));
+    let NodeKind::Image(im) = &kids[3].kind else { panic!("an image") };
+    assert_eq!((im.width, im.height), (2, 1));
+}
+
+#[test]
+fn an_illustrator_eps_opens_with_its_layers() {
+    let mut s = Session::new();
+    let r = open(&mut s, "art.eps", &ai::eps(&ai::sample_data(), ai::page_ps()), json!({})).unwrap();
+    assert_eq!((&r["format"], &r["warnings"]), (&json!("eps"), &json!([])), "{r}");
+    check_sample(&s);
+    // Saved as EPS and opened again, it comes back the same.
+    let eps = s.execute("document.exportEps", &json!({})).unwrap();
+    let bytes = vectorcraft_format::base64_decode(eps["dataBase64"].as_str().unwrap()).unwrap();
+    let r = open(&mut s, "again.eps", &bytes, json!({})).unwrap();
+    assert_eq!(r["restored"], json!(true), "{r}");
+    check_sample(&s);
+}
+
+#[test]
+fn an_illustrator_ai_file_opens_from_its_editing_data() {
+    let mut s = Session::new();
+    let file = ai::ai(&compressed(&ai::sample_data()), ai::page_pdf());
+    let r = open(&mut s, "art.ai", &file, json!({})).unwrap();
+    assert_eq!(r["format"], json!("ai"), "{r}");
+    assert!(r["warnings"].as_array().unwrap().iter().all(|w| !w.as_str().unwrap().contains("weren't read")), "{r}");
+    check_sample(&s);
+    // Pages picked: the PDF's.
+    open(&mut s, "art.ai", &file, json!({"pages": "1"})).unwrap();
+    assert_ne!(names(&s.doc().unwrap().doc.layers), ["Art", "Hidden"]);
+}
+
+#[test]
+fn what_the_reader_doesnt_read_opens_as_before_with_a_warning() {
+    let symbols = ai::editing_data(200.0, 100.0, &ai::layer("Art", "/SymbolInstance :\n(Dot) /SymbolRef ,\n;\n"));
+    let mut s = Session::new();
+    let r = open(&mut s, "symbols.eps", &ai::eps(symbols.as_bytes(), ai::page_ps()), json!({})).unwrap();
+    assert!(r["warnings"].to_string().contains("layers weren't read") && r["warnings"].to_string().contains("symbols"), "{r}");
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Layer 1"]);
+    let r = open(&mut s, "symbols.ai", &ai::ai(&compressed(symbols.as_bytes()), ai::page_pdf()), json!({})).unwrap();
+    assert!(r["warnings"].to_string().contains("symbols") && r["warnings"].to_string().contains("PDF part"), "{r}");
+}

crates/engine/src/cmd/fileio/tests_dxf.rs

@@ -52,7 +52,7 @@ fn export_writes_dxf_of_the_chosen_version() {
     let dxf = text(&r);
     assert_eq!(header(&dxf, "$ACADVER").as_deref(), Some("AC1032"));
     assert_eq!(header(&dxf, "$INSUNITS").as_deref(), Some("4"), "millimetres by default");
-    assert_eq!(entities(&dxf), ["HATCH", "HATCH"], "the whole document, origin at the first artboard");
+    assert_eq!(entities(&dxf), ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "HATCH"], "the whole document, origin at the first artboard");
     for (v, acadver) in [("R12", "AC1009"), ("R14", "AC1014"), ("2000", "AC1015"), ("2004", "AC1018"), ("2013", "AC1027")] {
         let r = s.execute("document.exportDxf", &json!({"version": v})).unwrap();
         assert_eq!(header(&text(&r), "$ACADVER").as_deref(), Some(acadver), "{v}");
@@ -71,11 +71,11 @@ fn use_artboards_writes_one_drawing_per_artboard() {
     let names: Vec<&str> = files.iter().map(|f| f["name"].as_str().unwrap()).collect();
     assert_eq!(names, ["Untitled-1-Artboard-1.dxf", "Untitled-1-Artboard-2.dxf"]);
     for f in files {
-        assert_eq!(entities(&text(f)), ["HATCH"], "each holds the art over its artboard");
+        assert_eq!(entities(&text(f)), ["LWPOLYLINE", "HATCH"], "each holds the art over its artboard");
     }
     let r = s.execute("document.export", &json!({"format": "dxf", "useArtboards": true, "range": "2"})).unwrap();
     assert!(r.get("files").is_none());
-    assert_eq!(entities(&text(&r)), ["HATCH"]);
+    assert_eq!(entities(&text(&r)), ["LWPOLYLINE", "HATCH"]);
     // Without artboards: the origin at the art's bounds.
     let r = s.execute("document.export", &json!({"format": "dxf", "useArtboards": false, "unit": "pt"})).unwrap();
     let dxf = text(&r);

crates/engine/src/cmd/fileio/tests_raster.rs

@@ -147,3 +147,19 @@ fn the_document_background_is_the_default_export_background() {
     assert_eq!(png(&mut s, json!({"format": "png", "background": "transparent"})).get_pixel(0, 0)[3], 0, "the option wins");
     assert_eq!(png(&mut s, json!({"format": "webp", "background": "black"})).get_pixel(0, 0).0, [0, 0, 0, 255]);
 }
+
+#[test]
+fn an_image_opens_at_the_size_its_resolution_declares() {
+    let mut s = session(72.0, 36.0, 1);
+    let hi = b64(&s.execute("document.export", &json!({"format": "png", "ppi": 300, "background": "white"})).unwrap());
+    let lo = b64(&s.execute("document.export", &json!({"format": "png", "background": "white"})).unwrap());
+    let lo = super::ppi::with_png_resolution(&lo, (72.0, 72.0));
+    for (png, w, h, what) in [(hi, 72.0, 36.0, "300 ppi: 300 x 150 px is 1 x 0.5 in"), (lo, 72.0, 36.0, "72 ppi: 1 px = 1 pt")] {
+        s.execute("document.open", &json!({"name": "art.png", "dataBase64": vectorcraft_format::base64_encode(&png)})).unwrap();
+        let doc = &s.doc().unwrap().doc;
+        let ab = doc.artboards[0].rect;
+        assert!((ab.width() - w).abs() < 1e-6 && (ab.height() - h).abs() < 1e-6, "{what}: artboard {ab:?}");
+        let art = doc.art_bounds().expect("the image");
+        assert!((art.width() - w).abs() < 1e-6 && (art.height() - h).abs() < 1e-6, "{what}: the image fills it, {art:?}");
+    }
+}

crates/engine/src/cmd/flatten.rs

@@ -1265,11 +1265,11 @@ fn reach(n: &Node) -> Option<Rect> {
     if !n.visible {
         return None;
     }
-    let fx = n.appearance.items.iter().map(|i| effects::outset(i.effects())).fold(effects::outset(&n.appearance.effects), f64::max);
     let b = match n.children() {
         Some(ch) if !n.clips() && !matches!(n.kind, NodeKind::Compound { .. }) => ch.iter().filter_map(|c| reach(c)).reduce(|a, b| a.union(b))?,
         _ => n.visual_bounds()?,
     };
+    let fx = n.appearance.items.iter().map(|i| effects::outset(i.effects(), b)).fold(effects::outset(&n.appearance.effects, b), f64::max);
     Some(b.inflate(fx + 1.0, fx + 1.0))
 }
 

crates/engine/src/cmd/fonts.rs

@@ -247,7 +247,7 @@ fn font_list(_: &mut Session, p: &Value) -> Result<Value> {
     }
 }
 
-fn rescan(s: &mut Session, _: &Value) -> Result<Value> {
+pub(crate) fn rescan(s: &mut Session, _: &Value) -> Result<Value> {
     let db = vectorcraft_text::FontDb::global();
     #[cfg(not(target_arch = "wasm32"))]
     let faces = db.load_system_fonts();
@@ -283,6 +283,21 @@ fn rescan(s: &mut Session, _: &Value) -> Result<Value> {
 mod tests {
     use super::*;
 
+    /// Type › Options › Additional Fonts Folder (#683) adds its folder to the system font scan,
+    /// trimmed; clearing it takes the folder out again.
+    #[test]
+    fn the_additional_fonts_folder_joins_the_font_scan() {
+        let mut s = Session::new();
+        let dir = std::env::temp_dir().join("vectorcraft-fonts-folder-pref");
+        s.execute("prefs.set", &json!({"key": "fontsFolder", "value": format!("  {}  ", dir.display())})).unwrap();
+        assert_eq!(vectorcraft_text::user_font_dirs(), std::slice::from_ref(&dir));
+        if !cfg!(target_arch = "wasm32") {
+            assert!(vectorcraft_text::system_font_dirs().contains(&dir));
+        }
+        s.execute("prefs.set", &json!({"key": "fontsFolder", "value": ""})).unwrap();
+        assert!(vectorcraft_text::user_font_dirs().is_empty() && !vectorcraft_text::system_font_dirs().contains(&dir));
+    }
+
     #[test]
     fn list_flag_missing_replace_and_select() {
         let mut s = Session::new();

crates/engine/src/cmd/menucmds.rs

@@ -111,7 +111,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Crop Image",
             ["Object"],
             None,
-            "{rect?: [x, y, width, height]} crop the selected image (default: to the artboard it sits on) → {id, width, height}",
+            "{rect?: [x, y, width, height] | trim?: true (to the pixels that aren't fully transparent, pixel for pixel; an image with none to cut is left as it is, trimmed: false)} crop the selected image (default: to the artboard it sits on) → {id, width, height, trimmed? (with trim)}",
             has_image,
             crop_image
         ),
@@ -156,7 +156,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Rearrange All Artboards…",
             ["Object", "Artboards"],
             None,
-            "{columns?: n (2), spacing?: pt (20), byColumn?: false, moveArtwork?: true (locked and hidden art only with prefs moveLockedWithArtboard)} lay artboards out in a grid",
+            "{layout?: gridByRow|gridByColumn|row|column (gridByRow; byColumn?: true is gridByColumn), order?: leftToRight|rightToLeft (leftToRight: right-to-left mirrors the order along the rows), columns?: n (2; the rows for gridByColumn; row and column ignore it), spacing?: pt (20), moveArtwork?: true (locked and hidden art only with prefs moveLockedWithArtboard)} lay the artboards out in their order, the grid's top-left at the first artboard's → {artboards, rows, columns}",
             has_doc,
             rearrange_artboards
         ),
@@ -541,6 +541,9 @@ fn crop_image(s: &mut Session, p: &Value) -> Result<Value> {
         .ok_or_else(|| bad(C, "select an image"))?;
     let node = st.doc.node(id).cloned().ok_or(EngineError::NoNode(id))?;
     let NodeKind::Image(im) = &node.kind else { return Err(bad(C, "select an image")) };
+    if p.get("trim").and_then(Value::as_bool) == Some(true) {
+        return trim_image(s, id, im.clone());
+    }
     let ib = node.geometric_bounds().ok_or_else(|| bad(C, "image has no bounds"))?;
     let rect = match p.get("rect").and_then(Value::as_array) {
         Some(a) if a.len() == 4 => {
@@ -594,6 +597,49 @@ fn crop_image(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "id": id.0, "width": w, "height": h }))
 }
 
+/// Crop Image's trim: the image cut to the box of its pixels that aren't fully transparent, the
+/// pixels copied as they are (no resampling) and placed where they were.
+fn trim_image(s: &mut Session, id: NodeId, im: ImageObject) -> Result<Value> {
+    const C: &str = "object.cropImage";
+    let st = s.doc()?;
+    let blob = st.doc.images.get(&im.key).ok_or_else(|| bad(C, "the image's pixels are missing"))?;
+    let px = image::load_from_memory(&blob.bytes).map_err(|_| bad(C, "the image's pixels can't be read"))?.to_rgba8();
+    let (w, h) = px.dimensions();
+    let (mut x0, mut y0, mut x1, mut y1) = (w, h, 0, 0);
+    for (x, y, p) in px.enumerate_pixels() {
+        if p[3] > 0 {
+            (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x + 1), y1.max(y + 1));
+        }
+    }
+    if x1 <= x0 || y1 <= y0 {
+        return Err(bad(C, "the image is fully transparent"));
+    }
+    if (x0, y0, x1, y1) == (0, 0, w, h) {
+        // Already trimmed: not an error, so a script can trim every image it opens.
+        return Ok(json!({ "id": id.0, "width": w, "height": h, "trimmed": false }));
+    }
+    let cut = image::imageops::crop_imm(&px, x0, y0, x1 - x0, y1 - y0).to_image();
+    let mut png = Vec::new();
+    cut.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).map_err(|e| bad(C, e.to_string()))?;
+    let (cw, ch) = (x1 - x0, y1 - y0);
+    s.edit("Crop Image", |d, _| {
+        let key = unique_key(d, "crop");
+        d.images.insert(key.clone(), vectorcraft_doc::ImageBlob::new("image/png", png));
+        if let Some(n) = d.node_mut(id) {
+            n.kind = NodeKind::Image(ImageObject {
+                key,
+                width: cw,
+                height: ch,
+                xf: im.xf * Affine::translate((f64::from(x0), f64::from(y0))),
+                link: None,
+                placement: Default::default(),
+            });
+        }
+        Ok(())
+    })?;
+    Ok(json!({ "id": id.0, "width": cw, "height": ch, "trimmed": true }))
+}
+
 /// The Control bar's Mask for an image: a clip group of the image and a clipping path on its
 /// outline, with that path selected so dragging its handles crops the image.
 fn mask_image(s: &mut Session, _: &Value) -> Result<Value> {
@@ -777,10 +823,32 @@ fn convert_to_artboards(s: &mut Session, _: &Value) -> Result<Value> {
 }
 
 fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
-    let n_ab = s.doc()?.doc.artboards.len().max(1);
-    let cols = (f64_or(p, "columns", 2.0).clamp(1.0, n_ab as f64)) as usize;
+    const CMD: &str = "artboard.rearrange";
+    use super::newdoc::ArtboardLayout as L;
+    // A value given (not null) must be one of the names.
+    let named = |key: &str| p.get(key).filter(|v| !v.is_null()).map(|v| v.as_str().unwrap_or_default());
+    let layout = match named("layout") {
+        Some(l) => L::parse(l).ok_or_else(|| bad(CMD, "layout must be gridByRow, gridByColumn, row or column"))?,
+        None if bool_or(p, "byColumn", false) => L::GridByColumn,
+        None => L::GridByRow,
+    };
+    let rtl = match named("order") {
+        None => false,
+        Some(o) if o.eq_ignore_ascii_case("leftToRight") => false,
+        Some(o) if o.eq_ignore_ascii_case("rightToLeft") => true,
+        Some(_) => return Err(bad(CMD, "order must be leftToRight or rightToLeft")),
+    };
+    let count = s.doc()?.doc.artboards.len();
+    let n_ab = count.max(1);
+    // Columns of a grid by row, rows of a grid by column (NaN casts to 0).
+    let lines = (f64_or(p, "columns", 2.0).clamp(1.0, n_ab as f64) as usize).max(1);
+    let (rows, cols) = match layout {
+        L::GridByRow => (n_ab.div_ceil(lines), lines),
+        L::GridByColumn => (lines, n_ab.div_ceil(lines)),
+        L::Row => (1, n_ab),
+        L::Column => (n_ab, 1),
+    };
     let spacing = f64_or(p, "spacing", 20.0).clamp(-1.0e5, 1.0e5);
-    let by_col = bool_or(p, "byColumn", false);
     let move_art = bool_or(p, "moveArtwork", true);
     let locked_and_hidden = s.prefs.move_locked_with_artboard;
     let scale_strokes = false;
@@ -788,7 +856,7 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
         let rects: Vec<Rect> = d.artboards.iter().map(|a| a.rect).collect();
         let Some(first) = rects.first().copied() else { return Ok(()) };
         let sizes: Vec<(f64, f64)> = rects.iter().map(|r| (r.width(), r.height())).collect();
-        let origins = super::newdoc::grid_origins(&sizes, first.origin(), cols, spacing, by_col, false);
+        let origins = super::newdoc::grid_origins_rc(&sizes, first.origin(), (rows, cols), spacing, layout == L::GridByColumn, rtl);
         let deltas: Vec<Vec2> = rects.iter().zip(origins).map(|(r, o)| o - r.origin()).collect();
         if move_art {
             let tops: Vec<(NodeId, Point)> = d
@@ -800,11 +868,11 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
                 .filter_map(|n| Some((n.id, n.geometric_bounds()?.center())))
                 .collect();
             for (id, c) in tops {
-                if let Some(i) = rects.iter().position(|r| r.contains(c))
-                    && deltas[i] != Vec2::ZERO
+                if let Some(&dl) = rects.iter().position(|r| r.contains(c)).and_then(|i| deltas.get(i))
+                    && dl != Vec2::ZERO
                     && let Some(n) = d.node_mut(id)
                 {
-                    n.transform(Affine::translate(deltas[i]), scale_strokes);
+                    n.transform(Affine::translate(dl), scale_strokes);
                 }
             }
         }
@@ -818,5 +886,5 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
         }
         Ok(())
     })?;
-    ok()
+    Ok(json!({ "artboards": count, "rows": rows, "columns": cols }))
 }

crates/engine/src/cmd/newdoc.rs

@@ -345,9 +345,22 @@ pub fn color_mode_id(m: ColorMode) -> &'static str {
 /// each column as wide and each row as tall as its largest artboard; `by_column` fills columns
 /// top to bottom first, `rtl` puts the first column at the right.
 pub(crate) fn grid_origins(sizes: &[(f64, f64)], origin: Point, columns: usize, spacing: f64, by_column: bool, rtl: bool) -> Vec<Point> {
-    let n = sizes.len();
-    let cols = columns.clamp(1, n.max(1));
-    let rows = n.div_ceil(cols).max(1);
+    let n = sizes.len().max(1);
+    let cols = columns.clamp(1, n);
+    grid_origins_rc(sizes, origin, (n.div_ceil(cols), cols), spacing, by_column, rtl)
+}
+
+/// [`grid_origins`] on a grid of `rows` × `cols` cells (at least enough for every artboard when
+/// filled the `by_column` way).
+pub(crate) fn grid_origins_rc(
+    sizes: &[(f64, f64)],
+    origin: Point,
+    (rows, cols): (usize, usize),
+    spacing: f64,
+    by_column: bool,
+    rtl: bool,
+) -> Vec<Point> {
+    let (rows, cols) = (rows.max(1), cols.max(1));
     // Grid cell (row, column) of artboard i.
     let cell = |i: usize| {
         let (r, c) = if by_column { (i % rows, i / rows) } else { (i / cols, i % cols) };
@@ -362,7 +375,7 @@ pub(crate) fn grid_origins(sizes: &[(f64, f64)], origin: Point, columns: usize,
         }
     }
     let offset = |spans: &[f64], k: usize| spans.iter().take(k).map(|s| s + spacing).sum::<f64>();
-    (0..n)
+    (0..sizes.len())
         .map(|i| {
             let (r, c) = cell(i);
             Point::new(origin.x + offset(&col_w, c), origin.y + offset(&row_h, r))

crates/engine/src/cmd/panelcmds.rs

@@ -43,7 +43,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character / Paragraph",
             [],
             None,
-            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt (±1296), hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (where characters smaller than the largest on their line line up with it), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\"), composer?: \"singleLine\"|\"everyLine\" (line breaking, Every-line by default), start?: byte, end?: byte} (with a range: the character attributes style that range and the paragraph attributes apply to the paragraphs it touches; without: all the text)",
+            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt (±1296), hyphenate?: bool, mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), kinsoku?: \"none\"|\"hard\"|\"soft\" (Kinsoku Set: Soft lets 々, ー and small kana start a line), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (where characters smaller than the largest on their line line up with it), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\"), composer?: \"singleLine\"|\"everyLine\" (line breaking, Every-line by default), start?: byte, end?: byte} (with a range: the character attributes style that range and the paragraph attributes apply to the paragraphs it touches; without: all the text)",
             has_doc,
             set_format
         ),
@@ -218,6 +218,7 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
         "spaceAfter",
         "hyphenate",
         "mojikumi",
+        "kinsoku",
         "direction",
         "leadingModel",
         "charAlign",
@@ -245,6 +246,15 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
             _ => return Err(bad(C, "`mojikumi` must be \"none\" or \"lineEndHalf\"")),
         }),
     };
+    let kinsoku = match p.get("kinsoku") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("none") => vectorcraft_doc::Kinsoku::None,
+            Some("hard") => vectorcraft_doc::Kinsoku::Hard,
+            Some("soft") => vectorcraft_doc::Kinsoku::Soft,
+            _ => return Err(bad(C, "`kinsoku` must be \"none\", \"hard\" or \"soft\"")),
+        }),
+    };
     let direction = match p.get("direction") {
         None => None,
         Some(v) => Some(match v.as_str() {
@@ -333,6 +343,9 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
                 if let Some(v) = mojikumi {
                     para.mojikumi = v;
                 }
+                if let Some(v) = kinsoku {
+                    para.kinsoku = v;
+                }
                 if let Some(v) = direction {
                     para.direction = v;
                 }

crates/engine/src/cmd/place/mod.rs

@@ -136,7 +136,8 @@ pub(crate) fn pt_per_px(ppi: Option<(f64, f64)>) -> (f64, f64) {
 fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
     let src = fileio::source(p, cmd)?;
     let name = fileio::file_name(src.name);
-    if fileio::TEXT_EXTS.contains(&fileio::extension(src.name).as_str()) {
+    // An Affinity file is recognised by its signature, whatever its name says.
+    if fileio::TEXT_EXTS.contains(&fileio::extension(src.name).as_str()) && !vectorcraft_affinity::is_affinity(&src.bytes) {
         let text = text::import(&src.bytes, text::TextOptions::parse(p, cmd)?, cmd)?;
         if text.trim().is_empty() {
             return Err(bad(cmd, format!("`{name}` has no text to place")));
@@ -196,6 +197,16 @@ fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
             // Of the open options, only a DXF drawing's apply (the colour mode stays the file's).
             let o = fileio::LoadOptions { dxf: opts.dxf, ..Default::default() };
             let mut l = fileio::load_with(src.name, &src.bytes, &o)?;
+            // An Affinity file whose native document couldn't be read is only its preview: it
+            // must never silently stand in for the art.
+            if l.preview_only {
+                return Err(bad(
+                    cmd,
+                    format!(
+                        "{name}: only this Affinity file's embedded preview could be read; use File › Open to see it with its warning, or export SVG or PDF from Affinity before placing"
+                    ),
+                ));
+            }
             // Linked images show their files, found from its folder.
             super::links::resolve(&mut l.doc, src.path, false);
             (l.doc, l.warnings)

crates/engine/src/cmd/prefscmds.rs

@@ -187,6 +187,7 @@ pub const PREF_SPECS: &[PrefSpec] = &[
     p!("missingGlyphProtection", "Type", "Options", "Enable Missing Glyph Protection", bool),
     p!("highlightAlternateGlyphs", "Type", "Options", "Highlight Alternate Glyphs", bool),
     p!("placeholderText", "Type", "Options", "Fill New Type Objects With Placeholder Text", bool),
+    p!("fontsFolder", "Type", "Options", "Additional Fonts Folder", text),
     // Units
     p!("unitsGeneral", "Units", "", "General", choice(UNITS)),
     p!("unitsStroke", "Units", "", "Stroke", choice(UNITS)),
@@ -260,8 +261,21 @@ pub const PREF_SPECS: &[PrefSpec] = &[
         "Brightness",
         choice(&[("dark", "Dark"), ("mediumDark", "Medium Dark"), ("mediumLight", "Medium Light"), ("light", "Light")])
     ),
-    p!("canvasColor", "User Interface", "", "Canvas Color", choice(&[("matchUi", "Match User Interface Brightness"), ("white", "White")])),
+    p!(
+        "canvasColor",
+        "User Interface",
+        "",
+        "Canvas Color",
+        choice(&[
+            ("matchUi", "Match User Interface Brightness"),
+            ("white", "White"),
+            ("lightGray", "Light Gray"),
+            ("mediumGray", "Medium Gray"),
+            ("darkGray", "Dark Gray")
+        ])
+    ),
     p!("autoCollapseIconPanels", "User Interface", "", "Auto-Collapse Iconic Panels", bool),
+    p!("toolGroupLabels", "User Interface", "", "Show Tool Group Labels", bool),
     p!("openDocumentsAsTabs", "User Interface", "", "Open Documents As Tabs", bool),
     p!("largeTabs", "User Interface", "", "Large Tabs", bool),
     p!("uiScaling", "User Interface", "UI Scaling", "Scale", num(0.75, 2.0, "×")),
@@ -460,7 +474,18 @@ impl Session {
         let grid_changed = p.gridline_every != self.prefs.gridline_every || p.grid_subdivisions != self.prefs.grid_subdivisions;
         let history_changed = p.history_states != self.prefs.history_states;
         let tile_edge_changed = p.pattern_tile_edge_color != self.prefs.pattern_tile_edge_color;
+        let fonts_folder_changed = p.fonts_folder != self.prefs.fonts_folder;
         self.prefs = p;
+        if fonts_folder_changed {
+            let folder = self.prefs.fonts_folder.trim();
+            vectorcraft_text::set_user_font_dirs(if folder.is_empty() { vec![] } else { vec![folder.into()] });
+            // Once the fonts were scanned, scan again now: the folder's fonts appear (or go) in the
+            // font menus, and type in them lays out again. The first scan reads it anyway.
+            if vectorcraft_text::FontDb::global().installed_fonts_changed() {
+                // Its result only counts the faces cataloged.
+                let _ = super::fonts::rescan(self, &serde_json::Value::Null);
+            }
+        }
         vectorcraft_render::set_default_threads(u16::try_from(self.prefs.render_threads).ok());
         for st in &mut self.docs {
             if history_changed {

crates/engine/src/cmd/print.rs

@@ -109,6 +109,9 @@ fn to_postscript(p: &Value) -> Result<bool> {
 }
 
 fn print(s: &mut Session, p: &Value) -> Result<Value> {
+    if let Some(path) = str_param(p, "path") {
+        super::fileio::check_not_lossy_overwrite(s.doc()?, path, p, PRINT)?;
+    }
     let postscript = to_postscript(p)?;
     let doc = &s.doc()?.doc;
     let mut set = settings(PRINT, doc, p)?;

crates/engine/src/cmd/rasterfx.rs

@@ -7,6 +7,10 @@
 //! effect: the image (with the object's own area knocked out) goes under the untouched vector
 //! object. Effects that change the object itself (inner glow, feather, Gaussian blur) replace it
 //! with the image. Expand Appearance makes its images with the same helpers.
+//!
+//! SVG has filters for shadows, glows, blurs and feathers but none for the Photoshop-style
+//! effects (Radial Blur, Unsharp Mask…): SVG export turns only the objects carrying one of those
+//! into images the same way ([`flatten_pixel_effects`]).
 
 use std::sync::Arc;
 
@@ -167,7 +171,7 @@ pub(crate) fn effect_image(out: &mut Document, whole: &Node, knockout: Option<&N
     // effects reach beyond that.
     let b = vectorcraft_render::painted_bounds(whole)?;
     let look = out.raster_effects.clone();
-    let reach = whole.appearance.items.iter().map(|i| effects::outset(i.effects())).fold(0.0, f64::max) + 2.0 + look.add_around;
+    let reach = whole.appearance.items.iter().map(|i| effects::outset(i.effects(), b)).fold(0.0, f64::max) + 2.0 + look.add_around;
     let b = b.inflate(reach, reach);
     // Whole pixels, and no larger than 64 Mpx.
     let scale = scale.min((64.0e6 / (b.width() * b.height()).max(1.0)).sqrt());
@@ -337,20 +341,39 @@ fn placed_symbol(d: &Document, n: &Node) -> Option<Node> {
     Some(Node { kind: NodeKind::Group { children: vec![Arc::new(art)], clip: false }, ..n.clone() })
 }
 
-/// Does `n` hold raster effects PDF export draws: its own, its fills' and strokes', its opacity
-/// mask's or (groups and layers) its members'? Hidden objects and template layers aren't drawn.
-fn needs(n: &Node) -> bool {
+/// Which objects' raster effects become images.
+#[derive(Clone, Copy, PartialEq)]
+enum Which {
+    /// Every raster effect (PDF).
+    All,
+    /// Objects with a Photoshop-style effect, which SVG can't draw (with all their raster effects).
+    Pixel,
+}
+
+/// Has `n` (its own, its fills' or strokes') raster effects `which` turns into an image?
+fn imaged(n: &Node, which: Which) -> bool {
+    let fx = raster_fx(n);
+    match which {
+        Which::All => !fx.is_empty(),
+        Which::Pixel => fx.iter().any(|f| matches!(f, RasterFx::Pixel(_))),
+    }
+}
+
+/// Does `n` hold raster effects that `which` turns into images: its own, its fills' and strokes',
+/// its opacity mask's or (groups and layers) its members'? Hidden objects and template layers
+/// aren't drawn.
+fn needs(n: &Node, which: Which) -> bool {
     n.visible
         && !matches!(n.kind, NodeKind::Layer { template: true, .. })
-        && (!raster_fx(n).is_empty()
-            || n.mask.as_ref().is_some_and(|m| needs(&m.art))
-            || (is_container(n) && n.children().is_some_and(|ch| ch.iter().any(|c| needs(c)))))
+        && (imaged(n, which)
+            || n.mask.as_ref().is_some_and(|m| needs(&m.art, which))
+            || (is_container(n) && n.children().is_some_and(|ch| ch.iter().any(|c| needs(c, which)))))
 }
 
 /// The art of `n`'s opacity mask with its raster effects as images.
-fn walk_mask(out: &mut Document, n: &mut Node) {
+fn walk_mask(out: &mut Document, n: &mut Node, which: Which) {
     if let Some(m) = n.mask.as_mut()
-        && let Some(art) = walk(out, &m.art)
+        && let Some(art) = walk(out, &m.art, which)
     {
         m.art = Arc::new(art);
     }
@@ -359,15 +382,15 @@ fn walk_mask(out: &mut Document, n: &mut Node) {
 /// `n` with its raster effects (and its members' and its opacity mask's) as images, `None` when it
 /// has none. An object whose effects all paint below it keeps its vector art over an image of
 /// them; one whose effects change it (blur, feather, inner glow) becomes the image.
-fn walk(out: &mut Document, n: &Node) -> Option<Node> {
-    if !needs(n) {
+fn walk(out: &mut Document, n: &Node, which: Which) -> Option<Node> {
+    if !needs(n, which) {
         return None;
     }
-    if raster_fx(n).is_empty() {
+    if !imaged(n, which) {
         let mut m = n.clone();
-        walk_mask(out, &mut m);
+        walk_mask(out, &mut m, which);
         if is_container(&m)
-            && let Some(ch) = walk_all(out, n.children()?)
+            && let Some(ch) = walk_all(out, n.children()?, which)
             && let Some(slot) = m.children_mut()
         {
             *slot = ch;
@@ -375,30 +398,30 @@ fn walk(out: &mut Document, n: &Node) -> Option<Node> {
         return Some(m);
     }
     if let Some(g) = placed_symbol(out, n) {
-        return Some(walk(out, &g).unwrap_or(g));
+        return Some(walk(out, &g, which).unwrap_or(g));
     }
     let below = below_only(n);
     if !below && let Some(g) = split_items(out, n) {
-        return Some(walk(out, &g).unwrap_or(g));
+        return Some(walk(out, &g, which).unwrap_or(g));
     }
     // An image that can't be made leaves the object as it is (the writer reports its effects).
     let image = raster_image(out, n, below, false)?;
     let mut v = n.clone();
     strip_raster(&mut v, false);
     let mut m = if below {
-        let mut m = walk(out, &v).unwrap_or(v);
+        let mut m = walk(out, &v, which).unwrap_or(v);
         put_below(out, &mut m, image);
         m
     } else {
         replace_with_image(v, image)
     };
-    walk_mask(out, &mut m);
+    walk_mask(out, &mut m, which);
     Some(m)
 }
 
 /// `nodes` with their raster effects as images, `None` when none has any.
-fn walk_all(out: &mut Document, nodes: &[Arc<Node>]) -> Option<Vec<Arc<Node>>> {
-    nodes.iter().any(|n| needs(n)).then(|| nodes.iter().map(|n| walk(out, n).map(Arc::new).unwrap_or_else(|| n.clone())).collect())
+fn walk_all(out: &mut Document, nodes: &[Arc<Node>], which: Which) -> Option<Vec<Arc<Node>>> {
+    nodes.iter().any(|n| needs(n, which)).then(|| nodes.iter().map(|n| walk(out, n, which).map(Arc::new).unwrap_or_else(|| n.clone())).collect())
 }
 
 /// A copy of `doc` with raster effects turned into images at the document's raster effects
@@ -406,26 +429,37 @@ fn walk_all(out: &mut Document, nodes: &[Arc<Node>]) -> Option<Vec<Arc<Node>>> {
 /// type, images, symbol instances, live objects) and on single fills and strokes, in the layers,
 /// opacity masks, symbol definitions and pattern tiles.
 pub fn flatten_raster_effects(doc: &Document) -> Option<Document> {
-    let any = |nodes: &[Arc<Node>]| nodes.iter().any(|n| needs(n));
-    if !any(&doc.layers) && !doc.symbols.iter().any(|s| needs(&s.art)) && !doc.patterns.iter().any(|p| any(&p.art)) {
+    flatten(doc, Which::All)
+}
+
+/// A copy of `doc` in which the objects with Photoshop-style raster effects (Radial Blur, Unsharp
+/// Mask…) are images as [`flatten_raster_effects`] makes them (SVG export: its filters draw the
+/// other raster effects live), or `None` when there are none.
+pub fn flatten_pixel_effects(doc: &Document) -> Option<Document> {
+    flatten(doc, Which::Pixel)
+}
+
+fn flatten(doc: &Document, which: Which) -> Option<Document> {
+    let any = |nodes: &[Arc<Node>]| nodes.iter().any(|n| needs(n, which));
+    if !any(&doc.layers) && !doc.symbols.iter().any(|s| needs(&s.art, which)) && !doc.patterns.iter().any(|p| any(&p.art)) {
         return None;
     }
     // Geometry effects first, so the vector objects kept above shadows are final.
     let baked = effects::bake_document(doc);
     let src = baked.as_ref().unwrap_or(doc);
     let mut out = src.clone();
-    if let Some(layers) = walk_all(&mut out, &src.layers) {
+    if let Some(layers) = walk_all(&mut out, &src.layers, which) {
         out.layers = layers;
     }
     for i in 0..out.symbols.len() {
-        if let Some(art) = out.symbols.get(i).map(|s| s.art.clone()).and_then(|a| walk(&mut out, &a))
+        if let Some(art) = out.symbols.get(i).map(|s| s.art.clone()).and_then(|a| walk(&mut out, &a, which))
             && let Some(s) = out.symbols.get_mut(i)
         {
             s.art = Arc::new(art);
         }
     }
     for i in 0..out.patterns.len() {
-        if let Some(art) = out.patterns.get(i).map(|p| p.art.clone()).and_then(|a| walk_all(&mut out, &a))
+        if let Some(art) = out.patterns.get(i).map(|p| p.art.clone()).and_then(|a| walk_all(&mut out, &a, which))
             && let Some(p) = out.patterns.get_mut(i)
         {
             p.art = art;

crates/engine/src/cmd/recovery.rs

@@ -523,6 +523,10 @@ struct Meta {
     format: String,
     /// When the copy was written (Unix seconds; none without a clock).
     saved: Option<i64>,
+    /// The file it was read from when that import left things out of the document, and what
+    /// (see [`crate::DocState::import_losses`]): a restored copy still refuses to replace it.
+    imported_from: Option<String>,
+    import_losses: Vec<String>,
 }
 
 fn read_meta(store: &dyn RecoveryStore, file: &str) -> Meta {
@@ -651,7 +655,14 @@ pub fn jobs(s: &mut Session, store: &Arc<dyn RecoveryStore>) -> Result<(Vec<Reco
             modified: None,
         };
         let save = fileio::job_for(s, st, plan)?;
-        let meta = Meta { title: title.clone(), path: st.path.clone(), format: st.format.to_string(), saved };
+        let meta = Meta {
+            title: title.clone(),
+            path: st.path.clone(),
+            format: st.format.to_string(),
+            saved,
+            imported_from: st.imported_from.clone(),
+            import_losses: st.import_losses.clone(),
+        };
         out.push(RecoveryJob { uid: st.uid, file, title, meta, save });
     }
     Ok((out, skipped))
@@ -839,6 +850,8 @@ fn restore_one(s: &mut Session, store: &Arc<dyn RecoveryStore>, file: &str) -> R
     let index = s.add_document(doc, meta.path.clone());
     let st = s.doc_mut()?;
     st.recovered = true;
+    st.imported_from = meta.imported_from.clone();
+    st.import_losses = meta.import_losses.clone();
     st.format = SAVE_FORMATS.iter().copied().find(|f| *f == meta.format).unwrap_or("vectorcraft");
     st.mark_unsaved();
     // The copy stays until the document is saved or closed.

crates/engine/src/cmd/stylelib.rs

@@ -222,8 +222,11 @@ fn load(s: &mut Session, p: &Value) -> Result<Value> {
         match std::str::from_utf8(bytes).ok().filter(|t| style_libs::sniff(t)) {
             Some(t) => style_libs::read(t, stem(file)).map_err(|e| bad(C, e)),
             None => {
-                let doc = super::fileio::load(file, bytes).map_err(|e| bad(C, e.to_string()))?.doc;
-                StyleLibrary::from_document(&doc, &[], stem(file).to_string()).map_err(|e| bad(C, e))
+                let loaded = super::fileio::load(file, bytes).map_err(|e| bad(C, e.to_string()))?;
+                if loaded.preview_only {
+                    return Err(bad(C, "only this Affinity file's embedded preview could be read; use File › Open to see it with its warning"));
+                }
+                StyleLibrary::from_document(&loaded.doc, &[], stem(file).to_string()).map_err(|e| bad(C, e))
             }
         }
     })?;

crates/engine/src/cmd/swatchlib.rs

@@ -276,11 +276,18 @@ pub const DOCUMENT_SWATCHES: &str = "document";
 /// [`DOCUMENT_SWATCHES`], of the active document's swatches and colour groups. `None` when there is
 /// no such library (or document).
 pub fn limit_palette(s: &Session, key: &str) -> Option<Palette> {
+    Some(Palette::new(library_colors(s, key)?))
+}
+
+/// The solid colours of library `key` (an id or name) or, for [`DOCUMENT_SWATCHES`], of the
+/// active document's swatches and colour groups. `None` when there is no such library (or
+/// document).
+pub fn library_colors(s: &Session, key: &str) -> Option<Vec<Color>> {
     let colors = |sw: &Swatch| sw.paint.color();
     if key == DOCUMENT_SWATCHES {
-        return Some(Palette::new(s.active()?.doc.swatches_iter().filter_map(colors)));
+        return Some(s.active()?.doc.swatches_iter().filter_map(colors).collect());
     }
-    Some(Palette::new(library(s, key)?.1.iter().filter_map(colors)))
+    Some(library(s, key)?.1.iter().filter_map(colors).collect())
 }
 
 /// The `limitTo` parameter's palette ([`limit_palette`]); `None` without one (or for "").
@@ -355,8 +362,11 @@ fn load(s: &mut Session, p: &Value) -> Result<Value> {
         if palette_io::sniff_bytes(bytes) {
             palette_io::read_bytes(bytes, stem(file)).map_err(|e| bad(C, e))
         } else {
-            let doc = super::fileio::load(file, bytes).map_err(|e| bad(C, e.to_string()))?.doc;
-            document_library(&doc, &[], stem(file).to_string(), C)
+            let loaded = super::fileio::load(file, bytes).map_err(|e| bad(C, e.to_string()))?;
+            if loaded.preview_only {
+                return Err(bad(C, "only this Affinity file's embedded preview could be read; use File › Open to see it with its warning"));
+            }
+            document_library(&loaded.doc, &[], stem(file).to_string(), C)
         }
     })?;
     Ok(json!({"library": info.id, "name": info.name, "count": lib.len()}))

crates/engine/src/cmd/typecmd.rs

@@ -147,6 +147,8 @@ fn auto_height(t: &mut TextObject) -> bool {
     let col_w = if cols > 1 { ((b.width() - t.area.gutter.max(0.0) * (cols - 1) as f64) / cols as f64).max(1.0) } else { b.width() };
     with_size(&mut probe, col_w, tall);
     probe.area.columns = 1;
+    // Measured from the top: aligned in the tall probe the lines would sit far below.
+    probe.area.vertical_align = vectorcraft_doc::VerticalAlign::Top;
     let lay = vectorcraft_text::layout(db, &probe);
     let inset = t.area.inset.max(0.0);
     let Some(bottom) = lay.lines.iter().map(|l| l.baseline + l.descent).filter(|y| y.is_finite()).reduce(f64::max) else { return false };
@@ -640,6 +642,36 @@ fn reshape_area(s: &mut Session, p: &Value) -> Result<Value> {
 mod area_tests {
     use super::*;
 
+    #[test]
+    fn kinsoku_set_is_set_per_paragraph_and_saved_only_when_not_hard() {
+        use vectorcraft_doc::Kinsoku;
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+        let id = s.execute("text.create", &json!({"x": 10, "y": 10, "text": "あカッ", "area": {"width": 40, "height": 100}})).unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        let para = |s: &Session| match &s.doc().unwrap().doc.node(NodeId(id)).unwrap().kind {
+            NodeKind::Text(t) => t.para.clone(),
+            _ => panic!("text"),
+        };
+        // New type: Hard, today's set.
+        assert_eq!(para(&s).kinsoku, Kinsoku::Hard);
+        assert!(serde_json::to_value(para(&s)).unwrap().get("kinsoku").is_none());
+        s.execute("select.set", &json!({"ids": [id]})).unwrap();
+        assert!(s.execute("text.setFormat", &json!({"kinsoku": "strict"})).is_err());
+        s.execute("text.setFormat", &json!({"kinsoku": "soft"})).unwrap();
+        assert_eq!(para(&s).kinsoku, Kinsoku::Soft);
+        assert_eq!(serde_json::to_value(para(&s)).unwrap()["kinsoku"], "soft");
+        s.execute("text.setFormat", &json!({"kinsoku": "none"})).unwrap();
+        assert_eq!(para(&s).kinsoku, Kinsoku::None);
+        s.execute("edit.undo", &json!({})).unwrap();
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(para(&s).kinsoku, Kinsoku::Hard);
+        // Documents from before it read as Hard.
+        let old: vectorcraft_doc::ParaStyle = serde_json::from_value(json!({"justify": "Left"})).unwrap();
+        assert_eq!(old.kinsoku, Kinsoku::Hard);
+    }
+
     #[test]
     fn burasagari_is_set_per_paragraph_and_saved_only_when_on() {
         use vectorcraft_doc::Burasagari;
@@ -742,7 +774,8 @@ mod area_tests {
         use vectorcraft_doc::LeadingModel;
         let mut s = Session::new();
         s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
-        let id = s.execute("text.create", &json!({"x": 10, "y": 10, "text": "一\n二", "area": {"width": 200, "height": 100}})).unwrap()["id"]
+        // Exercise ink bounds with bundled glyphs; Japanese outlines require optional craft-fonts.
+        let id = s.execute("text.create", &json!({"x": 10, "y": 10, "text": "A\nB", "area": {"width": 200, "height": 100}})).unwrap()["id"]
             .as_u64()
             .unwrap();
         let text = |s: &Session| match &s.doc().unwrap().doc.node(NodeId(id)).unwrap().kind {

crates/engine/src/lib.rs

@@ -155,6 +155,11 @@ pub struct DocState {
     pub print_tiling: bool,
     /// The rows open in the Layers panel (view state: not undoable; native files keep it).
     pub layers_open: OpenRows,
+    /// The file this document was read from, and what reading it left out (hidden text, art or
+    /// layers it could not read): writing the document over that file would lose those for good,
+    /// so an export or save to it asks first ([`cmd::fileio::check_not_lossy_overwrite`]). Not saved.
+    pub imported_from: Option<String>,
+    pub import_losses: Vec<String>,
     /// Transform Again after a perspective move or scale (Perspective Selection tool): the
     /// `perspective.transform` params it repeats. `None` once an ordinary transform follows.
     pub last_perspective: Option<Value>,
@@ -243,6 +248,8 @@ impl DocState {
             recovery: None,
             print_tiling: false,
             layers_open,
+            imported_from: None,
+            import_losses: vec![],
             last_perspective: None,
         }
     }
@@ -480,6 +487,9 @@ pub struct Prefs {
     // Hyphenation
     pub hyphenation_language: String,
     pub hyphenation_exceptions: String,
+    /// Type › Options › Additional Fonts Folder: a folder (read with its subfolders) whose fonts
+    /// are listed and used as if installed (#683); empty for none.
+    pub fonts_folder: String,
     // Performance & Storage (Plug-ins & Scratch Disks)
     pub plugins_folder: String,
     pub scratch_primary: String,
@@ -488,6 +498,9 @@ pub struct Prefs {
     pub ui_brightness: String,
     pub canvas_color: String,
     pub auto_collapse_icon_panels: bool,
+    /// User Interface › Show Tool Group Labels: the toolbar's group names (Select, Shapes, Draw…);
+    /// off, a faint dash separates the groups instead (#663).
+    pub tool_group_labels: bool,
     pub open_documents_as_tabs: bool,
     pub large_tabs: bool,
     pub ui_scaling: f64,
@@ -696,12 +709,14 @@ impl Default for Prefs {
             slice_line_color: s("#ff3f3f"),
             hyphenation_language: s("English: USA"),
             hyphenation_exceptions: String::new(),
+            fonts_folder: String::new(),
             plugins_folder: String::new(),
             scratch_primary: s("Startup"),
             scratch_secondary: s("None"),
             ui_brightness: s("mediumDark"),
             canvas_color: s("matchUi"),
             auto_collapse_icon_panels: false,
+            tool_group_labels: true,
             open_documents_as_tabs: true,
             large_tabs: false,
             ui_scaling: 1.0,
@@ -1008,6 +1023,8 @@ impl Session {
         st.format = old.format;
         st.save_options = old.save_options.clone();
         st.converted = old.converted;
+        st.imported_from = old.imported_from.clone();
+        st.import_losses = old.import_losses.clone();
         st.view = old.view.clone();
         st.layers_open = old.layers_open.clone();
         let old = std::mem::replace(&mut self.docs[index], st);
@@ -1544,6 +1561,8 @@ mod tests_proxyitems;
 #[cfg(test)]
 mod tests_puppetwarp;
 #[cfg(test)]
+mod tests_rasterfilters;
+#[cfg(test)]
 mod tests_rastersettings;
 #[cfg(test)]
 mod tests_recolor;
@@ -1586,6 +1605,8 @@ mod tests_swatchlib;
 #[cfg(test)]
 mod tests_targeting;
 #[cfg(test)]
+mod tests_textcombos;
+#[cfg(test)]
 mod tests_textedit;
 #[cfg(test)]
 mod tests_textimport;

crates/engine/src/tests_build.rs

@@ -669,6 +669,49 @@ fn image_trace_make_and_expand_and_color_presets() {
     assert!(s.execute("imageTrace.make", &json!({"params": {"mode": "rainbow"}})).is_err());
 }
 
+#[test]
+fn image_trace_palettes_and_swatch_libraries() {
+    let mut s = session();
+    let quads = vectorcraft_trace::Raster::from_fn(60, 60, |x, y| match (x < 30, y < 30) {
+        (true, true) => [230, 20, 20, 255],
+        (false, true) => [20, 200, 30, 255],
+        (true, false) => [20, 30, 220, 255],
+        (false, false) => [250, 230, 10, 255],
+    });
+    add_image(&mut s, &quads, Affine::IDENTITY);
+    let fills = |s: &Session, id: &Value| -> Vec<Color> {
+        traced_paths(&node(s, NodeId(id.as_u64().unwrap()))).iter().filter_map(|n| n.appearance.fill_paint().color()).collect()
+    };
+    // Document Library: every fill is one of the document's swatch colours, as it is.
+    let r = s.execute("imageTrace.make", &json!({"preset": "6 Colors", "params": {"palette": "documentLibrary"}})).unwrap();
+    let doc = crate::cmd::swatchlib::library_colors(&s, "document").unwrap();
+    let got = fills(&s, &r["id"]);
+    assert!(!got.is_empty() && got.iter().all(|c| doc.contains(c)), "{got:?}");
+    let t = node(&s, NodeId(r["id"].as_u64().unwrap())).trace.unwrap();
+    assert_eq!((t["params"]["palette"].as_str(), t["params"]["library"].as_str()), (Some("documentLibrary"), Some("document")));
+    assert!(t["params"].get("swatches").is_none(), "looked up again at every trace");
+    // A swatch library by id: the web-safe colours.
+    let r = s
+        .execute(
+            "imageTrace.make",
+            &json!({"id": r["id"], "preset": "6 Colors", "params": {"palette": "documentLibrary", "library": "web-safe-216", "colors": 3}}),
+        )
+        .unwrap();
+    let got = fills(&s, &r["id"]);
+    assert!((1..=3).contains(&got.len()), "{got:?}");
+    assert!(got.iter().all(|c| c.to_rgba8(1.0)[..3].iter().all(|v| v % 51 == 0)), "{got:?}");
+    // Full Tone and Automatic keep the four flat colours.
+    let mut id = r["id"].clone();
+    for palette in ["fullTone", "automatic"] {
+        let r = s.execute("imageTrace.make", &json!({"id": id, "preset": "6 Colors", "params": {"palette": palette, "colorDetail": 50}})).unwrap();
+        assert_eq!(r["colors"], 4, "{palette}");
+        id = r["id"].clone();
+    }
+    let mut bad = |p: Value| s.execute("imageTrace.make", &json!({"preset": "6 Colors", "params": p})).is_err();
+    assert!(bad(json!({"palette": "documentLibrary", "library": "No Such Library"})));
+    assert!(bad(json!({"palette": "rainbow"})));
+}
+
 #[test]
 fn image_trace_create_strokes_makes_stroked_centre_lines() {
     let mut s = session();
@@ -707,14 +750,61 @@ fn image_trace_presets_query_and_errors() {
     let mut s = session();
     let r = s.execute("imageTrace.presets", &json!({})).unwrap();
     let names: Vec<&str> = r["presets"].as_array().unwrap().iter().map(|p| p["name"].as_str().unwrap()).collect();
-    assert_eq!(names.len(), 12);
-    assert!(names.contains(&"Technical Drawing") && names.contains(&"Shades of Gray"));
+    assert_eq!(names.len(), 13);
+    assert!(names.contains(&"Technical Drawing") && names.contains(&"Shades of Gray") && names.contains(&"Flat Logo"));
     let a = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
     assert!(s.execute("imageTrace.make", &json!({"id": a.0})).is_err(), "not an image");
     assert!(find_command("imageTrace.make").unwrap().menu == ["Object", "Image Trace"]);
     assert!(find_command("livePaint.make").unwrap().menu == ["Object", "Live Paint"]);
 }
 
+/// A soft-edged red disc (r = 30 px at (50.3, 49.6)) on transparency, placed at (50, 50) scaled ×2.
+fn soft_logo_doc(s: &mut Session) -> NodeId {
+    let r = vectorcraft_trace::Raster::from_fn(100, 100, |x, y| {
+        let d = (x as f64 + 0.5 - 50.3).hypot(y as f64 + 0.5 - 49.6);
+        let cover = (0.5 + (30.0 - d) * 0.7).clamp(0.0, 1.0);
+        [200, 40, 60, (cover * 255.0).round() as u8]
+    });
+    add_image(s, &r, Affine::translate((50.0, 50.0)) * Affine::scale(2.0))
+}
+
+#[test]
+fn image_trace_flat_logo_preset_makes_a_true_circle() {
+    let mut s = session();
+    soft_logo_doc(&mut s);
+    let r = s.execute("imageTrace.make", &json!({"preset": "Flat Logo"})).unwrap();
+    assert_eq!((r["paths"].as_u64(), r["colors"].as_u64()), (Some(1), Some(1)));
+    assert!(r["anchors"].as_u64().unwrap() <= 6, "a circle is four anchors: {r}");
+    let g = NodeId(r["id"].as_u64().unwrap());
+    let n = node(&s, g);
+    let t = n.trace.clone().expect("settings stored");
+    assert_eq!((t["preset"].as_str(), t["params"]["mode"].as_str()), (Some("Flat Logo"), Some("logo")));
+    let paths = traced_paths(&n);
+    let (p, rule) = outline(&paths[0]);
+    let want = std::f64::consts::PI * 60.0 * 60.0;
+    let got = vectorcraft_pathops::area(&p, rule);
+    assert!((got - want).abs() / want < 0.01, "area {got} vs {want}");
+    let bb = p.bounds().unwrap();
+    // The disc is at (50.3, 49.6) in a x2 image placed at (50, 50): centre (150.6, 149.2).
+    assert!((bb.center().x - 150.6).abs() < 0.3 && (bb.center().y - 149.2).abs() < 0.3, "{bb:?}");
+}
+
+#[test]
+fn image_trace_flat_logo_refuses_a_gradient_and_a_bad_palette() {
+    let mut s = session();
+    let grad = vectorcraft_trace::Raster::from_fn(64, 32, |x, y| [(x * 4) as u8, 255 - (x * 4) as u8, (y * 6) as u8, 255]);
+    add_image(&mut s, &grad, Affine::IDENTITY);
+    let e = s.execute("imageTrace.make", &json!({"preset": "Flat Logo"})).unwrap_err().to_string();
+    assert!(e.contains("flat-colour") && e.contains("Color mode"), "{e}");
+    let mut s = session();
+    soft_logo_doc(&mut s);
+    let e = s.execute("imageTrace.make", &json!({"preset": "Flat Logo", "params": {"logoColors": ["crimson"]}})).unwrap_err().to_string();
+    assert!(e.contains("#rrggbb"), "{e}");
+    // The named colours are used as given.
+    let r = s.execute("imageTrace.makeAndExpand", &json!({"preset": "Flat Logo", "params": {"logoColors": ["#c8283c"]}})).unwrap();
+    assert_eq!(r["colors"], 1);
+}
+
 #[test]
 fn image_trace_object_remembers_its_settings() {
     let mut s = session();
@@ -738,6 +828,85 @@ fn image_trace_object_remembers_its_settings() {
     assert!(st.doc.node(id).unwrap().trace.is_none());
 }
 
+/// A black disc (r = 30 px) on light blue, 100 × 100 px, placed at 2× from (50, 50): traced in
+/// Black and White with Ignore White, the blue drops out and one disc (r = 60 pt at (150, 150))
+/// remains.
+fn disc_on_blue(s: &mut Session) -> NodeId {
+    let r = vectorcraft_trace::Raster::from_fn(100, 100, |x, y| {
+        let (dx, dy) = (x as f64 + 0.5 - 50.0, y as f64 + 0.5 - 50.0);
+        if dx * dx + dy * dy <= 900.0 { [0, 0, 0, 255] } else { [170, 210, 255, 255] }
+    });
+    add_image(s, &r, Affine::translate((50.0, 50.0)) * Affine::scale(2.0));
+    let r = s.execute("imageTrace.make", &json!({"params": {"ignoreWhite": true}})).unwrap();
+    assert_eq!(r["paths"], 1);
+    NodeId(r["id"].as_u64().unwrap())
+}
+
+/// The document rendered as the canvas draws it (`trace_views`) or as exports do.
+fn render_doc(s: &Session, trace_views: bool) -> vectorcraft_render::Rendered {
+    let opts = vectorcraft_render::RenderOptions { background: Some([255, 255, 255, 255]), trace_views, ..Default::default() };
+    vectorcraft_render::Renderer::new().render(&s.doc().unwrap().doc, 300, 300, Affine::IDENTITY, &opts)
+}
+
+#[test]
+fn image_trace_view_is_stored_kept_and_validated() {
+    let mut s = session();
+    let g = disc_on_blue(&mut s);
+    assert_eq!(node(&s, g).trace.unwrap()["view"], "tracingResult");
+    let r = s.execute("imageTrace.setView", &json!({"view": "outlinesWithSourceImage"})).unwrap();
+    assert_eq!((ids(&r), r["view"].as_str()), (vec![g], Some("outlinesWithSourceImage")));
+    assert_eq!(node(&s, g).trace_view(), vectorcraft_doc::TraceView::OutlinesWithSource);
+    // Setting the view it has already adds no undo step.
+    let steps = s.doc().unwrap().history.undo.len();
+    s.execute("imageTrace.setView", &json!({"id": g.0, "view": "outlinesWithSourceImage"})).unwrap();
+    assert_eq!(s.doc().unwrap().history.undo.len(), steps);
+    // Tracing again keeps it, unless another one is asked for; it survives save and open.
+    let g = NodeId(s.execute("imageTrace.make", &json!({"id": g.0, "params": {"ignoreWhite": true, "noise": 30}})).unwrap()["id"].as_u64().unwrap());
+    assert_eq!(node(&s, g).trace_view(), vectorcraft_doc::TraceView::OutlinesWithSource);
+    let g = NodeId(s.execute("imageTrace.make", &json!({"id": g.0, "view": "SourceImage"})).unwrap()["id"].as_u64().unwrap());
+    let back = vectorcraft_format::load(&vectorcraft_format::save(&s.doc().unwrap().doc, false)).unwrap();
+    assert_eq!(back.node(g).unwrap().trace_view(), vectorcraft_doc::TraceView::Source);
+    // Bad views and other objects are refused.
+    assert!(s.execute("imageTrace.setView", &json!({"view": "sepia"})).is_err());
+    assert!(s.execute("imageTrace.setView", &json!({})).is_err());
+    assert!(s.execute("imageTrace.make", &json!({"view": 3})).is_err());
+    let a = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    assert!(s.execute("imageTrace.setView", &json!({"id": a.0, "view": "outlines"})).is_err());
+}
+
+#[test]
+fn image_trace_views_draw_on_screen_only_and_expand_to_the_result() {
+    let mut s = session();
+    let g = disc_on_blue(&mut s);
+    let dark = |p: [u8; 4]| p[0] < 60 && p[1] < 60 && p[2] < 60;
+    let white = |p: [u8; 4]| p[0] > 245 && p[1] > 245 && p[2] > 245;
+    let blue = |p: [u8; 4]| p[0] < 200 && p[2] > 245;
+    let (centre, beside) = ((150, 150), (70, 70));
+    let at = |img: &vectorcraft_render::Rendered, (x, y): (u32, u32)| img.pixel(x, y);
+    // The outline is a 1 px line where the disc's right side is (x = 210, anti-aliased).
+    let outlined = |img: &vectorcraft_render::Rendered| (205..=215).any(|x| img.pixel(x, 150)[0] < 128);
+    let mut expanded = None;
+    for view in vectorcraft_doc::TraceView::ALL {
+        s.execute("imageTrace.setView", &json!({"id": g.0, "view": view.id()})).unwrap();
+        let screen = render_doc(&s, true);
+        let (c, b) = (at(&screen, centre), at(&screen, beside));
+        assert_eq!(dark(c), view.shows_result() || view.shows_source(), "{view:?}: the disc's middle {c:?}");
+        assert_eq!(blue(b), view.shows_source(), "{view:?}: the image's background {b:?}");
+        assert!(view.shows_source() || white(b), "{view:?}: nothing beside the disc {b:?}");
+        if view == vectorcraft_doc::TraceView::Outlines {
+            assert!(outlined(&screen), "{view:?}: the disc's outline");
+        }
+        // Exports draw the tracing result whatever the view.
+        let export = render_doc(&s, false);
+        assert!(dark(at(&export, centre)) && white(at(&export, beside)), "{view:?}: export");
+        // Expand keeps the traced shapes, as traced, whatever the view.
+        s.execute("imageTrace.expand", &json!({"id": g.0})).unwrap();
+        let shapes: Vec<_> = node(&s, g).children().unwrap().iter().map(|c| (c.path_data().cloned(), c.appearance.clone())).collect();
+        assert_eq!(*expanded.get_or_insert_with(|| shapes.clone()), shapes, "{view:?}: expanded");
+        s.execute("edit.undo", &json!({})).unwrap();
+    }
+}
+
 /// #569: merging the regions of a rosette of unfilled ellipses (each off the centre, petals
 /// overlapping) merges every region the drags touch into one shape whose outline is only the
 /// merged area's border: no edge between merged regions stays in, as a stray line or a spur.

crates/engine/src/tests_clipboard.rs

@@ -551,6 +551,26 @@ fn paste_on_all_artboards_keeps_the_offset_to_the_source_artboard() {
     }
 }
 
+/// Paste in Place, in Front and in Back onto the active artboard (#693): where the objects were on
+/// the artboard they were copied from, on the one named; without it, where they were.
+#[test]
+fn in_place_pastes_go_onto_the_artboard_named() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 100, "artboards": 3})).unwrap();
+    let boards: Vec<Rect> = doc(&s).artboards.iter().map(|a| a.rect).collect();
+    let r = rect(&mut s, boards[0].x0 + 10.0, boards[0].y0 + 15.0, 20.0, 20.0);
+    copy(&mut s, &[r]);
+    for cmd in ["edit.pasteInPlace", "edit.pasteInFront", "edit.pasteInBack"] {
+        let ids = ids_of(&s.execute(cmd, &json!({"artboard": 2})).unwrap());
+        assert_eq!(doc(&s).bounds_of(&ids, false).unwrap().origin(), Point::new(boards[2].x0 + 10.0, boards[2].y0 + 15.0), "{cmd}");
+        let ids = ids_of(&s.execute(cmd, &json!({})).unwrap());
+        assert_eq!(doc(&s).bounds_of(&ids, false).unwrap().origin(), Point::new(boards[0].x0 + 10.0, boards[0].y0 + 15.0), "{cmd} without one");
+        // An artboard that isn't there: where they were.
+        let ids = ids_of(&s.execute(cmd, &json!({"artboard": 9})).unwrap());
+        assert_eq!(doc(&s).bounds_of(&ids, false).unwrap().origin(), Point::new(boards[0].x0 + 10.0, boards[0].y0 + 15.0), "{cmd} on no artboard");
+    }
+}
+
 #[test]
 fn paste_remembers_layers_restores_the_source_layers() {
     let mut s = session();

crates/engine/src/tests_menucmds.rs

@@ -1159,3 +1159,35 @@ fn saved_selection_names_are_trimmed_and_capped() {
     let list = s.execute("select.savedList", &json!({})).unwrap();
     assert_eq!(list[0].as_str().map(|n| n.chars().count()), Some(vectorcraft_doc::SavedSelection::MAX_NAME));
 }
+
+#[test]
+fn crop_image_trim_cuts_to_the_opaque_pixels_as_they_are() {
+    // 100 × 80 px, transparent but for a block at (20, 10)–(50, 40) px; placed at 2 pt a pixel.
+    let mut px = image::RgbaImage::new(100, 80);
+    for y in 10..40 {
+        for x in 20..50 {
+            px.put_pixel(x, y, image::Rgba([x as u8, y as u8, 7, if x == 20 { 1 } else { 255 }]));
+        }
+    }
+    let mut png = Vec::new();
+    px.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut s = Session::new();
+    s.execute("document.open", &json!({"name": "art.png", "dataBase64": vectorcraft_format::base64_encode(&png)})).unwrap();
+    s.execute("select.all", &json!({})).unwrap();
+    let img = selected(&s)[0];
+    s.execute("object.scale", &json!({"sx": 200, "origin": [0, 0]})).unwrap();
+    let r = s.execute("object.cropImage", &json!({"trim": true})).unwrap();
+    assert_eq!((r["width"].as_u64().unwrap(), r["height"].as_u64().unwrap()), (30, 30), "{r}");
+    // Placed where those pixels were: (40, 20) pt, 60 × 60 pt at 2 pt a pixel.
+    let b = bounds(&s, img);
+    assert!(close(b.x0, 40.0) && close(b.y0, 20.0) && close(b.width(), 60.0) && close(b.height(), 60.0), "{b:?}");
+    // Pixel for pixel, a barely visible (alpha 1) edge included.
+    let NodeKind::Image(im) = &node(&s, img).kind else { panic!("an image") };
+    let out = image::load_from_memory(&s.doc().unwrap().doc.images[&im.key].bytes).unwrap().to_rgba8();
+    assert_eq!(out, image::imageops::crop_imm(&px, 20, 10, 30, 30).to_image());
+    assert_eq!(r["trimmed"], true);
+    // Nothing transparent left to cut: left as it is, and not an error (scripts trim every image).
+    let r = s.execute("object.cropImage", &json!({"trim": true})).unwrap();
+    assert_eq!((r["trimmed"].as_bool(), r["width"].as_u64()), (Some(false), Some(30)), "{r}");
+    assert_eq!(bounds(&s, img), b);
+}

crates/engine/src/tests_newdoc.rs

@@ -223,3 +223,63 @@ fn rearrange_keeps_its_grid() {
     s.execute("artboard.rearrange", &json!({"columns": 2, "spacing": 5})).unwrap();
     assert_eq!(boards(&s).iter().map(|r| (r.x0, r.y0)).collect::<Vec<_>>(), [(0.0, 0.0), (105.0, 0.0), (0.0, 55.0)]);
 }
+
+/// #681: every layout and order of Rearrange All Artboards, five 100 × 50 artboards 10 pt apart
+/// with Columns (the rows of a grid by column) 2: each artboard lands in its (row, column) cell, the
+/// art on it rides along, and it all undoes in one step.
+#[test]
+fn rearrange_lays_out_by_layout_and_order() {
+    type Cells = [(u32, u32); 5];
+    let cells: [(&str, &str, Cells); 8] = [
+        ("gridByRow", "leftToRight", [(0, 0), (0, 1), (1, 0), (1, 1), (2, 0)]),
+        ("gridByRow", "rightToLeft", [(0, 1), (0, 0), (1, 1), (1, 0), (2, 1)]),
+        ("gridByColumn", "leftToRight", [(0, 0), (1, 0), (0, 1), (1, 1), (0, 2)]),
+        ("gridByColumn", "rightToLeft", [(0, 2), (1, 2), (0, 1), (1, 1), (0, 0)]),
+        ("row", "leftToRight", [(0, 0), (0, 1), (0, 2), (0, 3), (0, 4)]),
+        ("row", "rightToLeft", [(0, 4), (0, 3), (0, 2), (0, 1), (0, 0)]),
+        ("column", "leftToRight", [(0, 0), (1, 0), (2, 0), (3, 0), (4, 0)]),
+        ("column", "rightToLeft", [(0, 0), (1, 0), (2, 0), (3, 0), (4, 0)]),
+    ];
+    for (layout, order, want) in cells {
+        // One row, 20 pt apart; a 10 pt square 10 pt into each artboard.
+        let mut s = new_doc(json!({"width": 100, "height": 50, "artboards": 5}));
+        let art: Vec<u64> = boards(&s)
+            .iter()
+            .map(|r| {
+                s.execute("shape.rectangle", &json!({"x": r.x0 + 10.0, "y": r.y0 + 10.0, "width": 10, "height": 10})).unwrap()["id"].as_u64().unwrap()
+            })
+            .collect();
+        let before = boards(&s);
+        let undo = s.doc().unwrap().history.undo.len();
+        let p = json!({"layout": layout, "order": order, "columns": 2, "spacing": 10});
+        let r = s.execute("artboard.rearrange", &p).unwrap();
+        let (rows, cols) = want.iter().fold((0, 0), |(r, c), (wr, wc)| (r.max(wr + 1), c.max(wc + 1)));
+        assert_eq!(r, json!({"artboards": 5, "rows": rows, "columns": cols}), "{layout} {order}");
+        let got: Vec<(f64, f64)> = boards(&s).iter().map(|r| (r.x0, r.y0)).collect();
+        let cells: Vec<(f64, f64)> = want.iter().map(|&(r, c)| (f64::from(c) * 110.0, f64::from(r) * 60.0)).collect();
+        assert_eq!(got, cells, "{layout} {order}");
+        assert!(boards(&s).iter().all(|r| r.width() == 100.0 && r.height() == 50.0));
+        for (id, (x, y)) in art.iter().zip(&got) {
+            let b = s.doc().unwrap().doc.node(NodeId(*id)).unwrap().geometric_bounds().unwrap();
+            assert_eq!((b.x0, b.y0), (x + 10.0, y + 10.0), "{layout} {order}: the art moves with its artboard");
+        }
+        assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1, "one undo step");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(boards(&s), before);
+    }
+}
+
+/// `byColumn: true` is Grid by Column; without `moveArtwork` the art stays; bad values are errors.
+#[test]
+fn rearrange_aliases_and_rejects_bad_values() {
+    let mut s = new_doc(json!({"width": 100, "height": 50, "artboards": 3}));
+    let id = s.execute("shape.rectangle", &json!({"x": 130, "y": 10, "width": 10, "height": 10})).unwrap()["id"].as_u64().unwrap();
+    s.execute("artboard.rearrange", &json!({"byColumn": true, "columns": 2, "spacing": 0, "moveArtwork": false})).unwrap();
+    assert_eq!(boards(&s).iter().map(|r| (r.x0, r.y0)).collect::<Vec<_>>(), [(0.0, 0.0), (0.0, 50.0), (100.0, 0.0)]);
+    assert_eq!(s.doc().unwrap().doc.node(NodeId(id)).unwrap().geometric_bounds().unwrap().x0, 130.0, "the art stays");
+    let before = boards(&s);
+    for p in [json!({"layout": "diagonal"}), json!({"order": "upward"}), json!({"layout": 3}), json!({"order": true})] {
+        assert!(s.execute("artboard.rearrange", &p).is_err(), "{p}");
+    }
+    assert_eq!(boards(&s), before, "nothing moved");
+}

crates/engine/src/tests_prefs.rs

@@ -282,6 +282,33 @@ fn snap_to_point_lands_a_dragged_selection_on_anchors() {
     assert_eq!(drag(&mut s, ViewInfo { snap_to_point: false, ..v }), (276.5, 76.0), "View › Snap to Point off");
 }
 
+/// Smart Guides › Spacing Guides (#394): a square dragged 21 pt to the right of a row of two
+/// squares 20 pt apart lands 20 pt from it, with the gaps marked; off, it stays at 21.
+#[test]
+fn spacing_guides_space_a_dragged_square_like_its_row() {
+    use vectorcraft_tools::PointerKind::{Down, Drag, Up};
+    let mut s = new_doc();
+    square(&mut s, 20.0, 300.0);
+    square(&mut s, 90.0, 300.0);
+    let m = square(&mut s, 200.0, 305.0);
+    let v = ViewInfo::default();
+    s.select_tool("selection", v).unwrap();
+    // `m` grabbed by its centre and dragged so its left edge is 21 pt from the second square.
+    let drag = |s: &mut Session| {
+        gesture(s, v, &[(Down, 225.0, 330.0), (Drag, 200.0, 330.0), (Drag, 186.0, 330.0)]);
+        let marks = s.overlays(v).iter().filter(|o| matches!(o, vectorcraft_tools::Overlay::Line { a, b, .. } if a.y == b.y)).count();
+        gesture(s, v, &[(Up, 186.0, 330.0)]);
+        let at = top_left(s, m).0;
+        s.execute("edit.undo", &json!({})).unwrap();
+        (at, marks)
+    };
+    let (at, marks) = drag(&mut s);
+    assert_eq!(at, 160.0, "20 pt from it");
+    assert!(marks >= 2, "both gaps marked");
+    set_pref(&mut s, "spacingGuides", json!(false));
+    assert_eq!(drag(&mut s), (161.0, 0), "off: where it was dragged");
+}
+
 /// Preferences › Smart Guides (#394): Color, Alignment Guides, Anchor/Path Labels, Measurement
 /// Labels, Transform Tools and Snapping Tolerance change what the Selection tool shows while a
 /// square is dragged into line with another, and how far the pull reaches; a hidden guide still

crates/engine/src/tests_rasterfilters.rs

@@ -0,0 +1,133 @@
+//! The Photoshop-style raster effects (Effect › Blur › Radial Blur and Smart Blur, Sharpen ›
+//! Unsharp Mask): applied and edited as commands, listed in the catalogue, drawn on the canvas,
+//! and written to PDF and SVG as images of the effected object.
+
+use serde_json::{Value, json};
+use vectorcraft_doc::NodeKind;
+use vectorcraft_geom::Rect;
+use vectorcraft_render::{Rendered, Renderer};
+
+use super::*;
+
+/// The new effects with parameters that change a striped square visibly.
+const EFFECTS: [(&str, &str); 3] = [
+    ("blur.radial", r#"{"amount": 30, "quality": "draft"}"#),
+    ("blur.smart", r#"{"radius": 8, "threshold": 100}"#),
+    ("sharpen.unsharpMask", r#"{"amount": 300, "radius": 3}"#),
+];
+
+/// A group of a red square and a darker red stripe across it; returns the group's id.
+fn striped() -> (Session, u64) {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    let id = s.execute("shape.rectangle", &json!({"x": 50, "y": 50, "width": 100, "height": 100})).unwrap()["id"].as_u64().unwrap();
+    s.execute("paint.setFill", &json!({"color": "#e03020", "ids": [id]})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true, "ids": [id]})).unwrap();
+    let stripe = s.execute("shape.rectangle", &json!({"x": 90, "y": 50, "width": 20, "height": 100})).unwrap()["id"].as_u64().unwrap();
+    s.execute("paint.setFill", &json!({"color": "#b04848", "ids": [stripe]})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true, "ids": [stripe]})).unwrap();
+    s.execute("select.set", &json!({"ids": [id, stripe]})).unwrap();
+    let g = s.execute("object.group", &json!({})).unwrap()["id"].as_u64().unwrap();
+    (s, g)
+}
+
+fn render(s: &Session) -> Rendered {
+    Renderer::new().render_region(&s.doc().unwrap().doc, Rect::new(0.0, 0.0, 200.0, 200.0), 1.0, true)
+}
+
+fn mean_diff(a: &Rendered, b: &Rendered) -> f64 {
+    let sum: u64 = a.pixels.iter().zip(&b.pixels).map(|(x, y)| x.abs_diff(*y) as u64).sum();
+    sum as f64 / a.pixels.len() as f64 / 255.0
+}
+
+#[test]
+fn listed_applied_edited_and_undone() {
+    let (mut s, g) = striped();
+    let list = s.execute("effect.list", &json!({})).unwrap();
+    for (id, _) in EFFECTS {
+        let e = list["catalog"].as_array().unwrap().iter().find(|e| e["id"] == id).unwrap_or_else(|| panic!("{id} listed"));
+        assert_eq!(e["raster"], json!(true), "{id}");
+        assert!(e["params"].as_str().unwrap().contains("radius") || id == "blur.radial", "{id}");
+    }
+    let menus: Vec<Value> =
+        EFFECTS.iter().map(|(id, _)| list["catalog"].as_array().unwrap().iter().find(|e| e["id"] == *id).unwrap()["menu"].clone()).collect();
+    assert_eq!(menus, [json!(["Effect", "Blur"]), json!(["Effect", "Blur"]), json!(["Effect", "Sharpen"])]);
+    // Junk parameters are stored as given and read clamped; the canvas still draws.
+    for (id, _) in EFFECTS {
+        s.execute("effect.apply", &json!({"effect": id, "ids": [g], "params": {"amount": 1e308, "radius": -1e308, "threshold": "x", "quality": 7}}))
+            .unwrap();
+    }
+    let _ = render(&s);
+    let n = s.doc().unwrap().doc.node(NodeId(g)).unwrap().clone();
+    assert_eq!(n.appearance.effects.len(), 3);
+    assert_eq!(n.appearance.effects[0].params["method"], json!("spin"), "defaults fill the rest");
+    s.execute("effect.setParams", &json!({"index": 0, "ids": [g], "params": {"method": "zoom"}})).unwrap();
+    assert_eq!(s.doc().unwrap().doc.node(NodeId(g)).unwrap().appearance.effects[0].params["method"], json!("zoom"));
+    for _ in 0..4 {
+        s.execute("edit.undo", &json!({})).unwrap();
+    }
+    assert!(s.doc().unwrap().doc.node(NodeId(g)).unwrap().appearance.effects.is_empty());
+}
+
+#[test]
+fn each_effect_changes_the_canvas_and_draws_the_same_twice() {
+    for (id, params) in EFFECTS {
+        let (mut s, g) = striped();
+        let plain = render(&s);
+        let params: Value = serde_json::from_str(params).unwrap();
+        s.execute("effect.apply", &json!({"effect": id, "ids": [g], "params": params})).unwrap();
+        let a = render(&s);
+        assert!(mean_diff(&plain, &a) > 0.0005, "{id} shows: {}", mean_diff(&plain, &a));
+        assert_eq!(a.pixels, render(&s).pixels, "{id} is deterministic");
+        // The multithreaded pipeline draws the same.
+        let mut mt = Renderer::new();
+        mt.threads = 4;
+        let b = mt.render_region(&s.doc().unwrap().doc, Rect::new(0.0, 0.0, 200.0, 200.0), 1.0, true);
+        assert!(mean_diff(&a, &b) < 0.002, "{id}: multithreaded differs by {}", mean_diff(&a, &b));
+    }
+}
+
+#[test]
+fn spin_blur_reaches_past_the_corners() {
+    let (mut s, g) = striped();
+    s.execute("effect.apply", &json!({"effect": "blur.radial", "ids": [g], "params": {"amount": 60, "quality": "good"}})).unwrap();
+    let img = render(&s);
+    // Turned corners sweep beyond the square's sides (centre 100, 100; corner 70.7 pt out).
+    let p = img.pixel(100, 46);
+    assert!(p[1] < 250, "the arc of the corners reaches above the square: {p:?}");
+    assert!(img.pixel(100, 20)[1] > 250, "but not beyond the corners' circle");
+}
+
+#[test]
+fn pdf_and_svg_write_the_effected_object_as_an_image() {
+    for (id, params) in EFFECTS {
+        let (mut s, g) = striped();
+        let params: Value = serde_json::from_str(params).unwrap();
+        s.execute("effect.apply", &json!({"effect": id, "ids": [g], "params": params})).unwrap();
+        let doc = s.doc().unwrap().doc.clone();
+        // PDF: an image that reads back as the canvas shows it.
+        let r = crate::cmd::rasterfx::export_pdf_with_report(&doc, &Default::default()).unwrap();
+        assert!(r.warnings.is_empty(), "{id}: {:?}", r.warnings);
+        let back = vectorcraft_pdf::import(&r.bytes).unwrap();
+        let diff = mean_diff(&render(&s), &Renderer::new().render_region(&back, Rect::new(0.0, 0.0, 200.0, 200.0), 1.0, true));
+        assert!(diff < 0.03, "{id}: PDF reads back {:.2}% off", diff * 100.0);
+        // SVG: the object becomes an image; a Gaussian Blur alone stays a live filter.
+        let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap()["text"].as_str().unwrap().to_string();
+        assert!(svg.contains("<image") && !svg.contains("<filter"), "{id}: {svg}");
+        let flat = crate::cmd::rasterfx::flatten_pixel_effects(&doc).unwrap();
+        assert!(matches!(flat.layers[0].children().unwrap()[0].kind, NodeKind::Image(_)), "{id}");
+    }
+    let (mut s, g) = striped();
+    s.execute("effect.apply", &json!({"effect": "blur.gaussian", "ids": [g]})).unwrap();
+    assert!(crate::cmd::rasterfx::flatten_pixel_effects(&s.doc().unwrap().doc).is_none());
+    let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap()["text"].as_str().unwrap().to_string();
+    assert!(svg.contains("feGaussianBlur") && !svg.contains("<image"));
+}
+
+#[test]
+fn expand_appearance_makes_an_image() {
+    let (mut s, g) = striped();
+    s.execute("effect.apply", &json!({"effect": "sharpen.unsharpMask", "ids": [g]})).unwrap();
+    s.execute("effect.expandAppearance", &json!({"ids": [g]})).unwrap();
+    assert!(matches!(s.doc().unwrap().doc.node(NodeId(g)).unwrap().kind, NodeKind::Image(_)));
+}

crates/engine/src/tests_recovery.rs

@@ -122,6 +122,22 @@ fn a_crash_leaves_copies_that_restore_modified_and_titled() {
     assert!(s.execute("file.recovery.restore", &json!({"file": format!("{mine}/Poster-1")})).is_err(), "an open document's copy");
 }
 
+#[test]
+fn a_restored_copy_still_refuses_to_replace_the_file_an_import_left_things_out_of() {
+    let (mut s, store) = session();
+    s.doc_mut().unwrap().path = Some("/art/Poster.eps".into());
+    s.doc_mut().unwrap().imported_from = Some("/art/Poster.eps".into());
+    s.doc_mut().unwrap().import_losses = vec!["hidden layers have art this can't read".into()];
+    s.execute("file.recovery.save", &json!({})).unwrap();
+    drop(s);
+
+    let mut s = relaunch(&store);
+    s.execute("file.recovery.restore", &json!({})).unwrap();
+    let st = s.doc().unwrap();
+    assert_eq!(st.imported_from.as_deref(), Some("/art/Poster.eps"));
+    assert_eq!(st.import_losses, ["hidden layers have art this can't read"]);
+}
+
 #[test]
 fn another_running_apps_copies_are_never_offered() {
     let store = Arc::new(MemoryStore::default());

crates/engine/src/tests_textcombos.rs

@@ -0,0 +1,310 @@
+//! The text engine's newer features combined through commands: Auto Size and Shrink Text to Fit
+//! with inline graphics, per-paragraph attributes, the paragraph composer and vertical
+//! alignment; editing and undo across them; and a save round trip with all of them on.
+//! (`vectorcraft_text`'s `tests_combos` covers the layout side.)
+
+use serde_json::{Value, json};
+use vectorcraft_doc::text::INLINE_CHAR;
+use vectorcraft_doc::{AreaFit, Composer, Justify, NodeKind, TextKind, TextObject, VerticalAlign};
+use vectorcraft_geom::Rect;
+
+use super::*;
+
+const STORY: &str = "The quick brown fox jumps over the lazy dog. A second sentence follows the first one here. Then a third one ends it.";
+
+fn session() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 800, "height": 600})).unwrap();
+    s
+}
+
+/// A symbol `name`: a circle `d` points across, its instance deleted.
+fn circle_symbol(s: &mut Session, name: &str, d: f64) {
+    s.execute("shape.ellipse", &json!({"x": 600, "y": 500, "width": d, "height": d})).unwrap();
+    s.execute("symbol.new", &json!({"name": name})).unwrap();
+    s.execute("edit.clear", &json!({})).unwrap();
+}
+
+/// Area type at (40, 40), `w` × `h`, size 12, with `extra` area options; selected.
+fn area(s: &mut Session, w: f64, h: f64, text: &str, extra: Value) -> NodeId {
+    let mut a = json!({"width": w, "height": h});
+    if let (Some(a), Some(e)) = (a.as_object_mut(), extra.as_object()) {
+        a.extend(e.clone());
+    }
+    let id = NodeId(s.execute("text.create", &json!({"x": 40, "y": 40, "size": 12, "area": a, "text": text})).unwrap()["id"].as_u64().unwrap());
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    id
+}
+
+fn text(s: &Session, id: NodeId) -> TextObject {
+    match &s.doc().unwrap().doc.node(id).unwrap().kind {
+        NodeKind::Text(t) => (**t).clone(),
+        k => panic!("not text: {k:?}"),
+    }
+}
+
+fn frame(s: &Session, id: NodeId) -> Rect {
+    match text(s, id).kind {
+        TextKind::Area { frame } => frame.bounds().unwrap(),
+        k => panic!("not area type: {k:?}"),
+    }
+}
+
+fn lay(t: &TextObject) -> vectorcraft_text::TextLayout {
+    vectorcraft_text::layout(vectorcraft_text::FontDb::global(), t)
+}
+
+/// Auto Size's frame is tight: the text fits, and a point less overflows.
+fn assert_tight(s: &Session, id: NodeId, what: &str) {
+    let t = text(s, id);
+    assert!(!lay(&t).overflow, "{what}: the frame holds the text");
+    let b = frame(s, id);
+    let mut less = t.clone();
+    less.area.fit = AreaFit::None;
+    less.kind = TextKind::Area {
+        frame: vectorcraft_geom::PathData::from_bezpath(&vectorcraft_geom::Shape::to_path(&Rect::new(b.x0, b.y0, b.x1, b.y1 - 1.0), 0.1)),
+    };
+    assert!(lay(&less).overflow, "{what}: a point less overflows ({b:?})");
+}
+
+fn undo(s: &mut Session) {
+    s.execute("edit.undo", &json!({})).unwrap();
+}
+
+fn redo(s: &mut Session) {
+    s.execute("edit.redo", &json!({})).unwrap();
+}
+
+fn query(s: &mut Session) -> Value {
+    s.execute("text.areaOptions", &json!({})).unwrap()
+}
+
+#[test]
+fn auto_height_x_inline_graphics() {
+    let mut s = session();
+    circle_symbol(&mut s, "Tap", 10.0);
+    let id = area(&mut s, 200.0, 300.0, "Tap: add one mana.", json!({"fit": "autoHeight"}));
+    let one = frame(&s, id);
+    assert_tight(&s, id, "one line");
+    // Art taller than the line makes the line, and so the frame, taller: in the same undo step.
+    let n = s.doc().unwrap().history.undo.len();
+    s.execute("text.insertInline", &json!({"id": id.0, "at": 0, "symbol": "Tap", "scale": 3})).unwrap();
+    assert_eq!(s.doc().unwrap().history.undo.len(), n + 1);
+    let tall = frame(&s, id);
+    assert!(tall.height() > one.height() + 5.0, "{one:?} → {tall:?}");
+    assert_tight(&s, id, "tall art");
+    // Enough art to wrap: another line.
+    for _ in 0..12 {
+        s.execute("text.insertInline", &json!({"id": id.0, "at": 0, "symbol": "Tap", "scale": 1})).unwrap();
+    }
+    assert!(lay(&text(&s, id)).lines.len() > 1);
+    assert_tight(&s, id, "wrapped art");
+    // Deleting the art shrinks it back; undo restores each step exactly.
+    let wrapped = frame(&s, id);
+    let all = text(&s, id).plain_text().rfind(INLINE_CHAR).unwrap() + INLINE_CHAR.len_utf8();
+    s.execute("text.editRange", &json!({"id": id.0, "start": 0, "end": all})).unwrap();
+    assert_eq!(text(&s, id).plain_text(), "Tap: add one mana.");
+    assert_eq!(frame(&s, id), one);
+    undo(&mut s);
+    assert_eq!(frame(&s, id), wrapped);
+    for _ in 0..13 {
+        undo(&mut s);
+    }
+    assert_eq!(frame(&s, id), one);
+    redo(&mut s);
+    assert_eq!(frame(&s, id), tall);
+}
+
+#[test]
+fn auto_height_x_paragraph_attrs() {
+    let mut s = session();
+    let id = area(&mut s, 200.0, 300.0, "One\nTwo", json!({"fit": "autoHeight"}));
+    let h0 = frame(&s, id).height();
+    // Space before on the second paragraph only: the frame grows by exactly that.
+    s.execute("text.setFormat", &json!({"ids": [id.0], "spaceBefore": 30, "start": 4, "end": 4})).unwrap();
+    let t = text(&s, id);
+    assert_eq!((t.para_at(0).space_before, t.para_at(1).space_before), (0.0, 30.0));
+    let h1 = frame(&s, id).height();
+    assert!((h1 - h0 - 30.0).abs() < 1e-6, "{h0} → {h1}");
+    assert_tight(&s, id, "space before");
+    // Return in the spaced paragraph: the new one inherits the spacing, the frame follows.
+    s.execute("text.editRange", &json!({"id": id.0, "start": 7, "end": 7, "insert": "\nThree"})).unwrap();
+    let t = text(&s, id);
+    assert_eq!(t.paragraph_styles().iter().map(|p| p.space_before).collect::<Vec<_>>(), [0.0, 30.0, 30.0]);
+    assert!(frame(&s, id).height() > h1 + 30.0);
+    assert_tight(&s, id, "three paragraphs");
+    // Merging paragraphs: the first one's attributes win, the frame shrinks.
+    s.execute("text.editRange", &json!({"id": id.0, "start": 3, "end": 4})).unwrap();
+    let t = text(&s, id);
+    assert_eq!(t.paragraph_styles().iter().map(|p| p.space_before).collect::<Vec<_>>(), [0.0, 30.0]);
+    assert_tight(&s, id, "merged");
+    undo(&mut s);
+    undo(&mut s);
+    assert!((frame(&s, id).height() - h1).abs() < 1e-9);
+    undo(&mut s);
+    assert!((frame(&s, id).height() - h0).abs() < 1e-9);
+    assert!(text(&s, id).paras.is_empty(), "back to one style for all");
+}
+
+#[test]
+fn auto_height_x_composer() {
+    // Switching the composer of one paragraph rebreaks it; Auto Size follows either way.
+    let mut s = session();
+    let story = format!("{STORY} {STORY}\n{STORY}");
+    let id = area(&mut s, 130.0, 100.0, &story, json!({"fit": "autoHeight"}));
+    assert_tight(&s, id, "every-line");
+    for composer in ["singleLine", "everyLine", "singleLine"] {
+        s.execute("text.setFormat", &json!({"ids": [id.0], "composer": composer, "start": 0, "end": 0})).unwrap();
+        let t = text(&s, id);
+        assert_eq!(t.para_at(1).composer, Composer::EveryLine, "the second paragraph keeps its own");
+        assert_tight(&s, id, composer);
+    }
+    s.execute("text.setFormat", &json!({"ids": [id.0], "composer": "singleLine"})).unwrap();
+    s.execute("text.setStyle", &json!({"id": id.0, "justify": "justifyAll"})).unwrap();
+    assert!(text(&s, id).paragraph_styles().iter().all(|p| p.composer == Composer::SingleLine && p.justify == Justify::JustifyAll));
+    assert_tight(&s, id, "justified");
+}
+
+#[test]
+fn auto_height_x_vertical_align() {
+    // An Auto Size frame has no space to spare: every alignment sets the lines as Top does, and
+    // the frame is as tall as with Top.
+    let mut s = session();
+    let id = area(&mut s, 160.0, 100.0, STORY, json!({"fit": "autoHeight"}));
+    let top_frame = frame(&s, id);
+    let top = lay(&text(&s, id));
+    for a in ["center", "bottom", "justify"] {
+        s.execute("text.areaOptions", &json!({"verticalAlign": a})).unwrap();
+        assert_eq!(frame(&s, id), top_frame, "{a}");
+        let l = lay(&text(&s, id));
+        for (li, l0) in l.lines.iter().zip(&top.lines) {
+            assert!((li.baseline - l0.baseline).abs() < 1e-6, "{a}: {} vs {}", li.baseline, l0.baseline);
+        }
+        assert_tight(&s, id, a);
+    }
+    // Editing with the alignment on keeps the frame tight.
+    s.execute("text.editRange", &json!({"id": id.0, "start": 0, "end": 0, "insert": format!("{STORY} ")})).unwrap();
+    assert_eq!(text(&s, id).area.vertical_align, VerticalAlign::Justify);
+    assert_tight(&s, id, "longer, justified");
+}
+
+#[test]
+fn shrink_text_x_inline_graphics_and_paragraphs() {
+    let mut s = session();
+    circle_symbol(&mut s, "Dot", 8.0);
+    let id = area(&mut s, 160.0, 60.0, "Short rules.\nFlavor.", json!({"fit": "shrinkText", "fitMinPercent": 20}));
+    assert_eq!(query(&mut s)["fitScale"], 1.0);
+    // Inline art and per-paragraph spacing push it over; shrinking makes it fit.
+    s.execute("text.setFormat", &json!({"ids": [id.0], "spaceBefore": 12, "start": 13, "end": 13})).unwrap();
+    for i in 0..10 {
+        s.execute("text.insertInline", &json!({"id": id.0, "at": 0, "symbol": "Dot", "scale": 1.0 + i as f64 * 0.2})).unwrap();
+        s.execute("text.editRange", &json!({"id": id.0, "start": 0, "end": 0, "insert": "Add "})).unwrap();
+    }
+    let q = query(&mut s);
+    assert_eq!(q["overflow"], false, "{q}");
+    let f = q["fitScale"].as_f64().unwrap();
+    assert!((0.2..1.0).contains(&f), "{f}");
+    let t = text(&s, id);
+    assert_eq!(t.paragraph_count(), 2);
+    assert_eq!(t.para_at(1).space_before, 12.0, "inserting in the first paragraph keeps the second's attributes");
+    assert_eq!(t.runs[0].style.size, 12.0, "the stored size stays");
+    let l = lay(&t);
+    assert_eq!(l.inlines.len(), 10);
+    assert!(l.inlines.iter().all(|i| i.bounds.height() < 12.0 * 2.8 * f + 1e-6));
+    // Undo walks the fit back up.
+    for _ in 0..20 {
+        undo(&mut s);
+    }
+    assert_eq!(query(&mut s)["fitScale"], 1.0);
+}
+
+#[test]
+fn paragraph_attrs_x_inline_editing() {
+    // An inline graphic opening a paragraph belongs to it: inserting it keeps the paragraph's
+    // attributes, deleting it with the paragraph break merges into the paragraph before.
+    let mut s = session();
+    circle_symbol(&mut s, "Tap", 10.0);
+    let id = area(&mut s, 300.0, 200.0, "Rules\nFlavor", json!({}));
+    s.execute("text.setStyle", &json!({"id": id.0, "justify": "center", "start": 6, "end": 6})).unwrap();
+    s.execute("text.setFormat", &json!({"ids": [id.0], "composer": "singleLine", "start": 6, "end": 6})).unwrap();
+    s.execute("text.insertInline", &json!({"id": id.0, "at": 6, "symbol": "Tap"})).unwrap();
+    let t = text(&s, id);
+    assert_eq!(t.plain_text(), format!("Rules\n{INLINE_CHAR}Flavor"));
+    assert_eq!((t.para_at(0).justify, t.para_at(1).justify), (Justify::Auto, Justify::Center));
+    assert_eq!(t.para_at(1).composer, Composer::SingleLine);
+    // The art's line is centred.
+    let l = lay(&t);
+    let g = &l.glyphs[l.inlines[0].glyph];
+    let line = &l.lines[g.line];
+    assert!(((line.x0 + line.x1) * 0.5 - 150.0).abs() < 1e-6, "centred in the 300 pt frame: {line:?}");
+    assert!((l.inlines[0].bounds.x0 - g.origin.x).abs() < 1e-6);
+    // Return just before the art: the new paragraph (holding the art) continues the centred one.
+    s.execute("text.editRange", &json!({"id": id.0, "start": 6, "end": 6, "insert": "Text\n"})).unwrap();
+    let t = text(&s, id);
+    assert_eq!(t.paragraph_styles().iter().map(|p| p.justify).collect::<Vec<_>>(), [Justify::Auto, Justify::Center, Justify::Center]);
+    undo(&mut s);
+    // Delete the break and the art together: one paragraph, the first one's attributes.
+    let end = 6 + INLINE_CHAR.len_utf8();
+    s.execute("text.editRange", &json!({"id": id.0, "start": 5, "end": end})).unwrap();
+    let t = text(&s, id);
+    assert_eq!(t.plain_text(), "RulesFlavor");
+    assert!(t.paras.is_empty() && t.para.justify == Justify::Auto && t.para.composer == Composer::EveryLine);
+    assert!(t.runs.iter().all(|r| r.inline.is_none()));
+    undo(&mut s);
+    let t = text(&s, id);
+    assert_eq!(t.plain_text(), format!("Rules\n{INLINE_CHAR}Flavor"));
+    assert_eq!(t.para_at(1).justify, Justify::Center);
+    assert_eq!(t.runs.iter().filter(|r| r.inline.is_some()).count(), 1);
+}
+
+#[test]
+fn vertical_align_x_inline_graphics_in_the_document() {
+    // The art the renderer draws (the layout's inline placements) moves with centred lines.
+    let mut s = session();
+    circle_symbol(&mut s, "Tap", 10.0);
+    let id = area(&mut s, 300.0, 200.0, "Add one mana.", json!({}));
+    s.execute("text.insertInline", &json!({"id": id.0, "at": 0, "symbol": "Tap"})).unwrap();
+    let top = lay(&text(&s, id));
+    s.execute("text.areaOptions", &json!({"verticalAlign": "center"})).unwrap();
+    let l = lay(&text(&s, id));
+    let d = l.lines[0].baseline - top.lines[0].baseline;
+    assert!(d > 50.0, "{d}");
+    assert!((l.inlines[0].bounds.y0 - top.inlines[0].bounds.y0 - d).abs() < 1e-6, "{:?} vs {:?}", l.inlines[0].bounds, top.inlines[0].bounds);
+    // The cached bounds (hit testing, selection) include the moved art.
+    let cached = text(&s, id).cached_bounds.unwrap();
+    assert!(cached.contains(l.inlines[0].bounds.center()), "{cached:?}");
+}
+
+#[test]
+fn every_feature_saves_and_reopens() {
+    let mut s = session();
+    circle_symbol(&mut s, "Tap", 10.0);
+    let id = area(
+        &mut s,
+        220.0,
+        70.0,
+        &format!(": Add one mana of any color. {STORY}\n{STORY}"),
+        json!({"verticalAlign": "center", "fit": "shrinkText", "fitMinPercent": 30}),
+    );
+    s.execute("text.insertInline", &json!({"id": id.0, "at": 0, "symbol": "Tap", "scale": 0.8, "shift": 0.5})).unwrap();
+    let flavor = text(&s, id).plain_text().find('\n').unwrap() + 1;
+    s.execute("text.setFormat", &json!({"ids": [id.0], "spaceBefore": 8, "composer": "singleLine", "start": flavor, "end": flavor})).unwrap();
+    s.execute("text.setStyle", &json!({"id": id.0, "justify": "justifyAll", "start": flavor, "end": flavor})).unwrap();
+    s.execute("text.setStyle", &json!({"id": id.0, "tracking": 20})).unwrap();
+    let t = text(&s, id);
+    let l = lay(&t);
+    assert!(!l.overflow && l.fit_scale < 1.0, "{}", l.fit_scale);
+    assert_eq!(l.inlines.len(), 1);
+    let doc = s.doc().unwrap().doc.clone();
+    let back = vectorcraft_format::load(&vectorcraft_format::save(&doc, false)).unwrap();
+    let NodeKind::Text(t2) = &back.node(id).unwrap().kind else { panic!("not text") };
+    let mut t2 = (**t2).clone();
+    // Resolved art bounds and layout caches aren't saved: resolve them as opening does.
+    back.resolve_text_inline(&mut t2);
+    assert_eq!(t2.runs, t.runs);
+    assert_eq!(t2.paragraph_styles(), t.paragraph_styles());
+    assert_eq!(t2.area, t.area);
+    let l2 = lay(&t2);
+    assert_eq!((l2.fit_scale, l2.lines.len()), (l.fit_scale, l.lines.len()));
+    assert_eq!(l2.inlines.iter().map(|i| i.bounds).collect::<Vec<_>>(), l.inlines.iter().map(|i| i.bounds).collect::<Vec<_>>());
+}

crates/engine/src/tooling.rs

@@ -223,6 +223,7 @@ impl Session {
             anchor_path_labels: self.prefs.anchor_path_labels,
             measurement_labels: self.prefs.measurement_labels,
             transform_tools_guides: self.prefs.transform_tools_guides,
+            spacing_guides: self.prefs.spacing_guides,
             snapping_tolerance: self.prefs.snapping_tolerance,
             construction_angles: if self.prefs.construction_guides {
                 vectorcraft_tools::guides::construction_angles(&self.prefs.construction_angles)

crates/engine/tests/affinity_corpus.rs

@@ -0,0 +1,91 @@
+//! Public Affinity documents (`cargo xtask corpus --affinity`, pinned and sha256-verified) open
+//! natively, and their art renders like Affinity's own picture of them: every document embeds a
+//! thumbnail Affinity rendered when saving it. Each file's mean difference from that thumbnail
+//! (0–255 per channel, both flattened on white, at the thumbnail's size) must stay under its
+//! ceiling, which sits just above the difference measured when the importer landed.
+//!
+//! Skips when `corpus/affinity` is absent.
+// Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::PathBuf;
+
+/// (file, ceiling). Measured differences when the importer landed are in the comments.
+const FILES: &[(&str, f64)] = &[
+    ("affinity3-mexican-guy.af", 3.0),          // 1.80: brush strokes as plain strokes
+    ("affinity3-mexican-man.af", 3.5),          // 2.24
+    ("affinity3-mexican-woman.af", 3.5),        // 2.55
+    ("affinity3-playing-cards.af", 5.5),        // 4.32: layer effects
+    ("designer-beer.afdesign", 4.0),            // 2.90
+    ("designer-cactus.afdesign", 1.5),          // 0.33
+    ("designer-car.afdesign", 1.5),             // 0.40
+    ("designer-flowers.afdesign", 3.0),         // 2.01
+    ("designer-lion-track.afdesign", 5.5),      // 4.34
+    ("afdesignload-color.afdesign", 1.0),       // 0.00
+    ("afdesignload-layer_mode.afdesign", 1.0),  // 0.00
+    ("afdesignload-layer_test.afdesign", 1.0),  // 0.00
+    ("afdesignload-margins.afdesign", 1.0),     // 0.00
+    ("afdesignload-raster_test.afdesign", 2.0), // 0.72: pixel layer
+    ("afdesignload-revision_test.afdesign", 1.0),
+    ("afdesignload-shape_test.afdesign", 4.5), // 3.50: cloud and heart shapes as ellipses
+    ("afdesignload-slice_test.afdesign", 1.0),
+    ("afdesignload-test_path.afdesign", 1.5), // 0.26
+    ("jac21-SimpleLogo.afdesign", 1.5),       // 0.19
+    ("jac21-SimpleLogoBanner.afdesign", 5.5), // 4.42: placed images in a Display P3 document
+    ("eviltwo-AssetStore.aftemplate", 1.0),   // 0.00: artboards
+    ("leakcanary-vector_icon.afdesign", 3.5), // 2.33
+];
+
+fn corpus() -> Option<PathBuf> {
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
+    dir.join("SOURCES.md").exists().then_some(dir)
+}
+
+/// Mean absolute difference of two RGBA8 images of one size, both composited on white.
+fn difference(a: &[u8], b: &[u8]) -> f64 {
+    let white = |p: &[u8]| -> [f64; 3] {
+        let al = f64::from(p[3]) / 255.0;
+        [0, 1, 2].map(|i| f64::from(p[i]) * al + 255.0 * (1.0 - al))
+    };
+    let (mut sum, mut n) = (0.0, 0usize);
+    for (p, q) in a.chunks_exact(4).zip(b.chunks_exact(4)) {
+        let (x, y) = (white(p), white(q));
+        sum += (0..3).map(|i| (x[i] - y[i]).abs()).sum::<f64>();
+        n += 3;
+    }
+    sum / n.max(1) as f64
+}
+
+#[test]
+fn public_affinity_documents_render_like_their_affinity_thumbnails() {
+    let Some(dir) = corpus() else {
+        eprintln!("corpus/affinity is absent: run `cargo xtask corpus --affinity`");
+        return;
+    };
+    let mut failures = Vec::new();
+    for (name, ceiling) in FILES {
+        let bytes = std::fs::read(dir.join(name)).unwrap();
+        let loaded = vectorcraft_engine::cmd::fileio::load(name, &bytes).unwrap();
+        assert!(!loaded.preview_only, "{name} opened as its preview: {:?}", loaded.warnings);
+        let d = &loaded.doc;
+        let thumb = image::load_from_memory(vectorcraft_affinity::preview(&bytes).unwrap().png).unwrap().to_rgba8();
+        // The thumbnail shows the first page, or every artboard: compare the largest artboard
+        // with its part of the thumbnail.
+        let union = d.artboards.iter().map(|a| a.rect).reduce(|a, b| a.union(b)).unwrap();
+        let scale = f64::from(thumb.width()) / union.width();
+        let board = d.artboards.iter().max_by(|a, b| a.rect.area().total_cmp(&b.rect.area())).unwrap().rect;
+        let crop = |v: f64| (v * scale).round().max(0.0) as u32;
+        let (x, y) = (crop(board.x0 - union.x0), crop(board.y0 - union.y0));
+        let (w, h) = (crop(board.width()).min(thumb.width() - x), crop(board.height()).min(thumb.height() - y));
+        let expected = image::imageops::crop_imm(&thumb, x, y, w, h).to_image();
+        let rendered = vectorcraft_render::Renderer::new().render_region(d, board, scale, false);
+        let got = image::RgbaImage::from_raw(rendered.width, rendered.height, rendered.to_straight()).unwrap();
+        let got = image::imageops::resize(&got, w, h, image::imageops::FilterType::Triangle);
+        let diff = difference(expected.as_raw(), got.as_raw());
+        eprintln!("{name}: {diff:.2} (ceiling {ceiling})");
+        if diff > *ceiling {
+            failures.push(format!("{name}: {diff:.2} > {ceiling}"));
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}

crates/engine/tests/command_sweep.rs

@@ -98,13 +98,19 @@ fn known_bug(id: &str, p: &Value) -> bool {
     KNOWN_BUGS.iter().any(|(c, k)| *c == id && p.get(*k).is_some())
 }
 
-/// Regression: huge column counts used to panic with `capacity overflow`.
+/// Regression: huge column counts used to panic with `capacity overflow`; in every layout and
+/// order (#681), with huge and negative spacing too.
 #[test]
 fn artboard_rearrange_huge_columns() {
     for fx in Fixture::ALL {
-        for cols in [json!(u64::MAX), json!(1e308)] {
-            let p = json!({ "columns": cols });
-            assert_eq!(probe(fx, "artboard.rearrange", &p), None);
+        for layout in ["gridByRow", "gridByColumn", "row", "column"] {
+            for order in ["leftToRight", "rightToLeft"] {
+                for (cols, spacing) in [(json!(u64::MAX), json!(1e308)), (json!(1e308), json!(-1e308)), (json!(0), json!(0)), (json!(-5), json!(20))]
+                {
+                    let p = json!({ "layout": layout, "order": order, "columns": cols, "spacing": spacing });
+                    assert_eq!(probe(fx, "artboard.rearrange", &p), None);
+                }
+            }
         }
     }
 }
@@ -251,6 +257,9 @@ fn structured_junk() {
         ("effect.apply", json!({"effect": "distort.zigZag", "params": {"size": 1e308, "ridges": 100}})),
         ("effect.apply", json!({"effect": "distort.transform", "params": {"copies": 1e308}})),
         ("effect.apply", json!({"effect": "stylize.dropShadow", "params": {"blur": 1e308, "opacity": -1}})),
+        ("effect.apply", json!({"effect": "blur.radial", "params": {"amount": 1e308, "method": 5, "quality": "best"}})),
+        ("effect.apply", json!({"effect": "blur.smart", "params": {"radius": 1e308, "threshold": -1e308, "quality": null}})),
+        ("effect.apply", json!({"effect": "sharpen.unsharpMask", "params": {"amount": -1, "radius": "1e999", "threshold": 1e308}})),
         ("effect.apply", json!({"effect": "no.such.effect"})),
         ("effect.remove", json!({"index": 99})),
         ("effect.setParams", json!({"index": 0, "params": null})),

crates/engine/tests/import_fuzz.rs

@@ -4,7 +4,9 @@
 //! must load as an error or as a document that then renders and exports, without a panic; nor may
 //! bitmaps, PDF and text pasted from other apps, nor EMF and WMF pictures (damaged files, records
 //! of every kind with random contents) opened, placed or pasted, nor EPS and PostScript files
-//! (damaged ones, hostile programs) read by the PostScript interpreter.
+//! (damaged ones, hostile programs) read by the PostScript interpreter, nor the editing data of
+//! Illustrator EPS and `.ai` files (the layers they carry, damaged or hostile), nor Affinity documents
+//! (mutated object streams, archives and indexed PNG previews, hostile image dimensions).
 //!
 //! `PROPTEST_CASES=20000 cargo test -p vectorcraft-engine --test import_fuzz` runs a deeper search.
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
@@ -25,6 +27,244 @@ fn config() -> ProptestConfig {
     c
 }
 
+// ---------- Affinity previews ----------
+
+/// Original pixels in a synthetic container envelope, not an Affinity document writer.
+fn affinity_preview_sample() -> Vec<u8> {
+    let im = image::RgbaImage::from_pixel(2, 1, image::Rgba([220, 40, 60, 255]));
+    let mut png = Vec::new();
+    im.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut b = vec![0; 72];
+    b[..4].copy_from_slice(vectorcraft_affinity::MAGIC);
+    b[4..6].copy_from_slice(&12u16.to_le_bytes());
+    b[8..12].copy_from_slice(b"nsrP");
+    b[12..16].copy_from_slice(b"#Inf");
+    b[24..32].copy_from_slice(&72u64.to_le_bytes());
+    b[64..68].copy_from_slice(b"Prot");
+    b.extend(b"\xff\xff\xff\xffThmb");
+    b.extend(1u32.to_le_bytes());
+    b.extend((png.len() as u32 + 13).to_le_bytes());
+    b.extend(29u32.to_le_bytes());
+    b.extend(0u32.to_le_bytes());
+    b.extend((png.len() as u32).to_le_bytes());
+    b.push(1);
+    b.extend(png);
+    b
+}
+
+/// A synthetic native document exercising the reader's paths: curves (with live corners), every
+/// parametric shape it knows, a compound, gradients, a stroke, text, a mask and an artboard. Not
+/// an Affinity writer: the layout is the one the reader accepts.
+fn affinity_native_stream() -> Vec<u8> {
+    use vectorcraft_affinity::synth::{self, F, tag};
+    let f32s = |v: &[f32]| F::Struct(v.iter().flat_map(|x| x.to_le_bytes()).collect());
+    let rec = |x: f64, y: f64, role: u8| {
+        let mut r = x.to_le_bytes().to_vec();
+        r.extend(y.to_le_bytes());
+        r.extend([1, role]);
+        r
+    };
+    let mut id = 100;
+    let mut next = || {
+        id += 1;
+        id
+    };
+    let colour = |id: u32| F::Def(id, vec![tag(b"RGBA")], vec![(tag(b"_col"), f32s(&[0.2, 0.4, 0.6, 0.8]))]);
+    let gradient = |a: u32, b: u32, c: u32, kind: u16| {
+        F::Def(
+            a,
+            vec![tag(b"FDsc")],
+            vec![
+                (
+                    tag(b"FDeF"),
+                    F::Def(
+                        b,
+                        vec![tag(b"FilG")],
+                        vec![
+                            (tag(b"Type"), F::Enum(kind, 0)),
+                            (tag(b"Grad"), F::Obj(tag(b"Grad"), vec![(tag(b"Cols"), F::Shared(vec![colour(c), F::Ref(c)]))])),
+                        ],
+                    ),
+                ),
+                (tag(b"FDeX"), F::F64s(vec![10.0, 0.0, 5.0, 0.0, 20.0, 5.0])),
+            ],
+        )
+    };
+    let curve = F::Obj(
+        tag(b"PCvD"),
+        vec![(
+            tag(b"Data"),
+            F::Pos(vec![
+                F::U8(0),
+                F::U32(1),
+                F::Bool(true),
+                F::Records(18, vec![rec(0.0, 0.0, 0), rec(5.0, 0.0, 1), rec(10.0, 5.0, 2), rec(10.0, 10.0, 0), rec(0.0, 10.0, 0), rec(0.0, 0.0, 0)]),
+            ]),
+        )],
+    );
+    let mut kids = vec![F::Def(
+        next(),
+        vec![tag(b"PCrv")],
+        vec![(tag(b"Crvs"), curve.clone()), (tag(b"BFFl"), F::Shared(vec![gradient(next(), next(), next(), 0)]))],
+    )];
+    for (i, class) in [b"ShNR", b"ShpE", b"ShPy", b"ShSt", b"ShSS", b"ShPi", b"ShpT", b"ShTz", b"ShCl"].into_iter().enumerate() {
+        let fields = vec![
+            (tag(b"Side"), F::U32(6)),
+            (tag(b"Smth"), F::Bool(i % 2 == 0)),
+            (tag(b"Curv"), F::F32(0.5)),
+            (tag(b"CTyp"), F::Raw(vec![0xaa, b'p', b'y', b'T', b'C', 4, 0, 0, 0, 0, 0, 0, 0, 4, 0, 4, 0, 4, 0])),
+            (tag(b"ShCR"), f32s(&[0.25, 0.0, 0.0, 0.0])),
+            (tag(b"AngE"), F::F32(1.0)),
+        ];
+        kids.push(F::Def(
+            next(),
+            vec![tag(b"ShpN")],
+            vec![
+                (tag(b"Shpe"), F::Def(next(), vec![tag(class)], fields)),
+                (tag(b"ShpB"), F::F64s(vec![0.0, 0.0, 40.0 + i as f64, 30.0])),
+                (tag(b"Xfrm"), F::F64s(vec![1.0, 0.2, i as f64 * 10.0, 0.0, 1.0, 5.0])),
+                (tag(b"BFFl"), F::Shared(vec![gradient(next(), next(), next(), (i % 4) as u16)])),
+                (tag(b"AdCh"), F::Shared(vec![F::Def(next(), vec![tag(b"PCrv")], vec![(tag(b"Crvs"), curve.clone())])])),
+            ],
+        ));
+    }
+    kids.push(F::Def(
+        next(),
+        vec![tag(b"Comp")],
+        vec![(tag(b"Chld"), F::Shared(vec![F::Def(next(), vec![tag(b"PCrv")], vec![(tag(b"Crvs"), curve.clone()), (tag(b"ComO"), F::Enum(2, 0))])]))],
+    ));
+    let run = F::Def(
+        next(),
+        vec![tag(b"GAtt")],
+        vec![(tag(b"Doub"), F::Raw(vec![0x8a, b'b', b'u', b'o', b'D', 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x28, 0x40]))],
+    );
+    let block = F::Def(
+        next(),
+        vec![tag(b"StBl")],
+        vec![
+            (tag(b"Glyp"), F::Obj(tag(b"GStr"), vec![(tag(b"Utf8"), F::Str("Hi\u{2029}there\0".into()))])),
+            (
+                tag(b"GAtt"),
+                F::Obj(tag(b"GlAS"), vec![(tag(b"Runs"), F::Objs(tag(b"GlAR"), vec![vec![(tag(b"Indx"), F::I32(9)), (tag(b"Item"), run)]]))]),
+            ),
+        ],
+    );
+    kids.push(F::Def(
+        next(),
+        vec![tag(b"TxtA")],
+        vec![
+            (tag(b"StSt"), F::Def(next(), vec![tag(b"Stry")], vec![(tag(b"Blok"), F::Shared(vec![block]))])),
+            (
+                tag(b"TxtH"),
+                F::Def(next(), vec![tag(b"ArFr")], vec![(tag(b"FrmB"), F::F64s(vec![0.0, -10.0, 30.0, 0.0])), (tag(b"ArtV"), F::F64(10.0))]),
+            ),
+        ],
+    ));
+    let board = F::Def(
+        next(),
+        vec![tag(b"ShpN")],
+        vec![
+            (tag(b"ABEn"), F::Bool(true)),
+            (tag(b"Shpe"), F::Def(next(), vec![tag(b"ShNR")], vec![])),
+            (tag(b"ShpB"), F::F64s(vec![0.0, 0.0, 200.0, 100.0])),
+            (tag(b"Chld"), F::Shared(kids)),
+        ],
+    );
+    synth::stream(&[
+        (tag(b"UVCn"), F::Obj(tag(b"UVCn"), vec![(tag(b"UPPI"), F::F64(96.0))])),
+        (
+            tag(b"DocR"),
+            F::Def(
+                1,
+                vec![tag(b"DocN")],
+                vec![(tag(b"Chld"), F::Shared(vec![F::Def(2, vec![tag(b"Sprd")], vec![(tag(b"Chld"), F::Shared(vec![board]))])]))],
+            ),
+        ),
+    ])
+}
+
+fn affinity_native(stream: &[u8], method: vectorcraft_affinity::synth::Method) -> Vec<u8> {
+    vectorcraft_affinity::synth::container(&[("doc.dat", stream, method)], None)
+}
+
+#[test]
+fn the_native_affinity_sample_reaches_every_reader_path() {
+    let bytes = affinity_native(&affinity_native_stream(), vectorcraft_affinity::synth::Method::Zstd);
+    let l = vectorcraft_engine::cmd::fileio::load("x.af", &bytes).unwrap();
+    assert!(!l.preview_only, "{:?}", l.warnings);
+    let kinds = l.doc.layers.iter().flat_map(|l| l.children().into_iter().flatten()).count();
+    assert!(kinds > 0);
+    let all = format!("{:?}", l.doc.layers);
+    for want in ["Path", "Text", "Compound"].iter().take(2) {
+        assert!(all.contains(want), "{want} missing");
+    }
+    assert_eq!(l.doc.artboards.len(), 1);
+}
+
+proptest! {
+    #![proptest_config(config())]
+
+    #[test]
+    fn affinity_native_documents_with_mutated_streams_render_and_export(
+        cut in 0usize..4096,
+        edits in prop::collection::vec((0usize..4096, any::<u8>()), 0..24),
+    ) {
+        let mut stream = affinity_native_stream();
+        let n = stream.len();
+        for (at, b) in edits { stream[at % n] = b; }
+        stream.truncate(cut.max(16));
+        let bytes = affinity_native(&stream, vectorcraft_affinity::synth::Method::Stored);
+        survive("Affinity native stream", || vectorcraft_engine::cmd::fileio::load("x.af", &bytes).ok().map(|l| l.doc))?;
+    }
+
+    #[test]
+    fn affinity_native_containers_with_mutated_bytes_render_and_export(
+        edits in prop::collection::vec((0usize..8192, any::<u8>()), 1..16),
+        method in 0u8..3,
+    ) {
+        use vectorcraft_affinity::synth::Method;
+        let m = [Method::Stored, Method::Zlib, Method::Zstd][usize::from(method)];
+        let mut bytes = affinity_native(&affinity_native_stream(), m);
+        let n = bytes.len();
+        for (at, b) in edits { bytes[at % n] = b; }
+        survive("Affinity native container", || vectorcraft_engine::cmd::fileio::load("x.af", &bytes).ok().map(|l| l.doc))?;
+    }
+
+    #[test]
+    fn affinity_garbage_never_panics(tail in prop::collection::vec(any::<u8>(), 0..2048)) {
+        let mut bytes = vectorcraft_affinity::MAGIC.to_vec();
+        bytes.extend(tail);
+        survive("Affinity garbage", || vectorcraft_engine::cmd::fileio::load("x.af", &bytes).ok().map(|l| l.doc))?;
+    }
+
+    #[test]
+    fn affinity_mutated_previews_render_and_export_without_panicking(
+        cut in 0usize..400,
+        edits in prop::collection::vec((0usize..400, any::<u8>()), 0..16),
+    ) {
+        let mut bytes = affinity_preview_sample();
+        for (at, b) in edits {
+            if let Some(byte) = bytes.get_mut(at) { *byte = b; }
+        }
+        bytes.truncate(cut);
+        survive("Affinity preview", || vectorcraft_engine::cmd::fileio::load("x.af", &bytes).ok().map(|l| l.doc))?;
+    }
+
+    #[test]
+    fn affinity_placement_is_rejected_without_panicking(tail in prop::collection::vec(any::<u8>(), 0..2048)) {
+        let mut bytes = vectorcraft_affinity::MAGIC.to_vec();
+        bytes.extend(tail);
+        let r = catch_quiet(|| {
+            let mut s = vectorcraft_engine::Session::new();
+            s.execute("file.new", &json!({"width":100,"height":100})).unwrap();
+            let p = json!({"name":"renamed.png", "dataBase64":vectorcraft_format::base64_encode(&bytes)});
+            for cmd in ["file.place", "file.place.info"] { assert!(s.execute(cmd, &p).is_err()); }
+            assert!(s.execute("file.place.queue", &json!({"files":[p]})).is_err());
+        });
+        prop_assert!(r.is_ok(), "Affinity placement panicked: {:?}", r.err());
+    }
+}
+
 /// Import must not panic; whatever comes back must render and export without panicking either.
 fn survive(what: &str, import: impl FnOnce() -> Option<Document>) -> Result<(), TestCaseError> {
     let r = catch_quiet(|| {
@@ -1345,3 +1585,302 @@ proptest! {
         perspective_presets("mutated perspective presets", &mutate_text(&text, cut, &edits))?;
     }
 }
+
+// ---------- the editing data of Illustrator files ----------
+
+/// `data` as ASCII85, up to the `~>`.
+fn ascii85(data: &[u8]) -> String {
+    let mut out = String::new();
+    for chunk in data.chunks(4) {
+        let mut x = chunk.iter().enumerate().fold(0u32, |v, (i, b)| v | u32::from(*b) << (24 - 8 * i));
+        let mut d = [0u8; 5];
+        for c in d.iter_mut().rev() {
+            *c = (x % 85) as u8 + b'!';
+            x /= 85;
+        }
+        out.extend(d.iter().take(chunk.len() + 1).map(|c| char::from(*c)));
+    }
+    out.push_str("~>");
+    out
+}
+
+/// The editing data of a file with every sort of object the layers reader knows, and some it doesn't.
+fn editing_text() -> String {
+    let square = |x: u32| format!("0 0 1 0 k\n{x} 10 m\n{} 10 L\n{} 14 L\n{x} 14 L\nf", x + 4, x + 4);
+    let body = [
+        "u".to_string(),
+        square(10),
+        "U".into(),
+        "*u".into(),
+        square(20),
+        square(30),
+        "*U".into(),
+        "q".into(),
+        square(40),
+        "50 10 m 60 10 L 60 20 L 50 20 L h W f".into(),
+        "Q".into(),
+        "1 Xw".into(),
+        "u".into(),
+        "/AI11Text :\n0 /FreeUndo ,\n;".into(),
+        "U".into(),
+        "0 Xw".into(),
+        "1 0 0 0 1 0 Bg".into(),
+        "0 1 w 2 J 0 j 4 M [3 2]0 d 1 D".into(),
+    ]
+    .join("\n");
+    let layer = |name: &str, visible: u8, body: &str| {
+        format!("%AI5_BeginLayer\n{visible} 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n({name}) Ln\n{body}\nLB\n%AI5_EndLayer--\n")
+    };
+    format!(
+        "%!PS-Adobe-3.0 \n%%BoundingBox: 0 0 100 100\n%%HiResBoundingBox: 0 0 100 100\n%AI3_Cropmarks: 0 0 100 100\n{}{}%%Trailer\n",
+        layer("One", 1, &format!("{body}\n{}", layer("Sub", 1, &square(70)))),
+        layer("Two", 0, &square(80))
+    )
+}
+
+fn zstd(text: &str) -> Vec<u8> {
+    ruzstd::encoding::compress_to_vec(text.as_bytes(), ruzstd::encoding::CompressionLevel::Fastest)
+}
+
+/// An EPS drawing a square whose private data holds `editing`.
+fn editing_eps(editing: &str) -> Vec<u8> {
+    let lines: Vec<String> = ascii85(&zstd(editing)).as_bytes().chunks(60).map(|c| format!("%{}", String::from_utf8_lossy(c))).collect();
+    format!(
+        "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n0 0 1 0 setcmykcolor 10 10 moveto 14 10 lineto 14 14 lineto closepath fill\nshowpage\n%%EOF\n%AI9_PrivateDataBegin\n%AI24_DataStream\n{}\n%AI9_PrivateDataEnd\n",
+        lines.join("\n")
+    )
+    .into_bytes()
+}
+
+/// The text document of a story of centred type with two styles, as an editing copy keeps it.
+fn text_document_text() -> String {
+    "/0 << /1 << /0 [ << /0 << /0 << /0 (Helvetica) >> >> >> ] >> /8 << /0 [ << /0 << /0 [ 0 0 ] /2 << /2 [ 1 0 0 1 3 4 ] >> >> >> ] >> >>\n\
+     /1 << /1 [ << /0 << /0 (Hi\\rthere\\r) /5 << /0 [ << /0 << /0 << /0 () /5 << /0 2 >> /6 0 >> >> /1 9 >> ] >> \
+     /6 << /0 [ << /0 << /0 << /0 () /5 0 /6 << /0 0 /1 14.0 /53 << /99 /CAITextPaint /0 << /0 2 /1 [ 1.0 0.0 1.0 0.0 0.0 ] >> >> >> >> >> /1 9 >> ] >> >> \
+     /1 << /0 [ << /0 0 >> ] /2 [ << /99 /PC /6 [ << /99 /F /0 << /0 [ 8200.0 8180.0 ] >> /6 [ << /99 /R /6 [ << /99 /R /6 [ << /99 /L /6 [ \
+     << /99 /S /0 << /0 [ -5.0 0.0 ] >> /15 << /0 3 >> >> ] >> << /99 /L /0 << /0 [ 0.0 16.8 ] >> /6 [ << /99 /S /0 << /0 [ -9.0 0.0 ] >> /15 << /0 6 >> >> ] >> ] >> ] >> ] >> ] >> ] >> >> ] /2 << /1 12.0 >> >>\n"
+        .to_string()
+}
+
+/// An EPS with a hidden text object whose story is in `document`.
+fn text_eps(document: &str) -> Vec<u8> {
+    let lines: Vec<String> = ascii85(document.as_bytes()).as_bytes().chunks(60).map(|c| format!("%{}", String::from_utf8_lossy(c))).collect();
+    let editing = format!(
+        "%!PS-Adobe-3.0 \n%%BoundingBox: 0 0 100 100\n%%HiResBoundingBox: 0 0 100 100\n%AI3_Cropmarks: 0 0 100 100\n%AI3_TemplateBox: 50 50 50 50\n\
+         %AI5_BeginLayer\n0 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(Spare) Ln\n/AI11Text :\n0 /FrameIndex ,\n0 /StoryIndex ,\n;\nLB\n%AI5_EndLayer--\n\
+         %AI11_BeginTextDocument\n/AI11TextDocument : /ASCII85Decode ,\n{}\n%AI11_EndTextDocument\n%%Trailer\n",
+        lines.join("\n")
+    );
+    editing_eps(&editing)
+}
+
+proptest! {
+    #![proptest_config(config())]
+
+    /// An Illustrator EPS whose text document is damaged or hostile: read as its type, or without it.
+    #[test]
+    fn eps_text_document_never_panics(cut in 0usize..1_500, edits in prop::collection::vec((0usize..1_500, prop::sample::select(vec!['0', '9', '-', '.', ' ', '\n', '(', ')', '/', '[', ']', '<', '>', '\\', 'e', '1'])), 0..12)) {
+        let text = mutate_text(&text_document_text(), cut, &edits);
+        let bytes = text_eps(&text);
+        survive("mutated EPS text document", || vectorcraft_eps::import(&bytes).ok().map(|r| r.document))?;
+    }
+
+    /// An Illustrator EPS whose editing data is damaged or hostile: read as its layers, or as its page.
+    #[test]
+    fn eps_editing_data_never_panics(cut in 0usize..3_000, edits in prop::collection::vec((0usize..3_000, prop::sample::select(vec!['0', '9', '-', '.', ' ', '\n', '(', ')', '/', ':', ';', '[', ']', '%', 'q', 'Q', 'W', 'u', 'U', 'L', 'k', 'x'])), 0..12)) {
+        let text = mutate_text(&editing_text(), cut, &edits);
+        let bytes = editing_eps(&text);
+        survive("mutated EPS editing data", || vectorcraft_eps::import(&bytes).ok().map(|r| r.document))?;
+    }
+
+    /// A `.ai` whose editing data is damaged or hostile.
+    #[test]
+    fn ai_editing_data_never_panics(cut in 0usize..3_000, edits in prop::collection::vec((0usize..3_000, prop::sample::select(vec!['0', '9', '-', '.', ' ', '\n', '(', ')', '/', ':', ';', '[', ']', '%', 'q', 'Q', 'W', 'u', 'U', 'L', 'k', 'x'])), 0..12), damage in prop::collection::vec((0usize..4_000, any::<u8>()), 0..4)) {
+        let text = mutate_text(&editing_text(), cut, &edits);
+        let mut private = [b"%AI24_ZStandard_Data".as_slice(), &zstd(&text)].concat();
+        for (at, b) in damage {
+            let n = private.len();
+            if let Some(x) = private.get_mut(at % n) {
+                *x = b;
+            }
+        }
+        survive("mutated .ai editing data", || Some(vectorcraft_eps::layered_ai(&private, Document::new(100.0, 100.0), vec![]).0))?;
+    }
+}
+
+/// The operators, operands and section comments of hostile editing data.
+fn arb_ai_token() -> impl Strategy<Value = String> {
+    prop_oneof![
+        arb_num(),
+        prop::sample::select(vec![
+            "m",
+            "l",
+            "L",
+            "c",
+            "C",
+            "v",
+            "V",
+            "y",
+            "Y",
+            "h",
+            "H",
+            "N",
+            "n",
+            "F",
+            "f",
+            "S",
+            "s",
+            "B",
+            "b",
+            "W",
+            "(b) *",
+            "u",
+            "U",
+            "*u",
+            "*U",
+            "q",
+            "Q",
+            "LB",
+            "Lb",
+            "Ln",
+            "(name) Ln",
+            "g",
+            "G",
+            "k",
+            "K",
+            "x",
+            "X",
+            "Xa",
+            "XA",
+            "Xx",
+            "XX",
+            "(Ink) 0.5 x",
+            "O",
+            "R",
+            "XR",
+            "w",
+            "J",
+            "j",
+            "M",
+            "d",
+            "[6 3] 0 d",
+            "[]0 d",
+            "Xy",
+            "2 0.5 1 1 1 Xy",
+            "99 -4 Xy",
+            "Xw",
+            "1 Xw",
+            "A",
+            "1 A",
+            "Ae",
+            "XW",
+            "1 (style) XW",
+            "9 () XW",
+            "Bd",
+            "(G) 1 3 Bd",
+            "Bs",
+            "0 0 0 0 1 0 0 2 1 6 50 0 Bs",
+            "BD",
+            "Bb",
+            "1 Bb",
+            "BB",
+            "2 BB",
+            "1 (G) 0 0 0 1 1 0 0 1 0 0 1 Bg",
+            "Bg",
+            "Bm",
+            "1e308 0 0 1e-308 0 0 Bm",
+            "Bh",
+            "XN",
+            "/DeviceCMYK XN",
+            "/DeviceGray XN",
+            "[ 1 0 0 1 0 0 ] 0 0 2 2 2 2 8 3 1 0 1 0",
+            "[ 1 0 0 1 0 0 ] 0 0 99999 99999 99999 99999 1 1 0 0 0 0",
+            "[",
+            "]",
+            "/Name",
+            "(text)",
+            "<ff00>",
+            ":",
+            ";",
+            ",",
+            "/ArtDictionary :",
+            "/XMLUID : (A_x41_) ; (AI10_ArtUID) ,",
+            "(n) /String (AIArtName) ,",
+            "/Document :",
+            "/Array :",
+            "/Dictionary :",
+            "0 0 /RealPoint (PositionPoint1) ,",
+            "/AI11Text :",
+            "0 /StoryIndex ,",
+            "/SymbolInstance :",
+            "/Binary : /ASCII85Decode ,",
+            "~>",
+            "p",
+            "To",
+            "frobnicate",
+            "\n%AI5_BeginLayer\n",
+            "\n%AI5_EndLayer--\n",
+            "\n%_",
+            "\n%AI5_BeginRaster\n",
+            "\n%AI5_EndRaster\n",
+            "\n%%BeginData: 12\rXI\n",
+            "\n%%EndData\n",
+            "\n%AI5_BeginGradient: (G)\n",
+            "\n%AI14_BeginSymbol\n",
+            "\n%AI10_EndSymbol\n",
+            "\n%AI17_Begin_Content_if_version_gt:24 4\n",
+            "\n%AI17_Alternate_Content\n",
+            "\n%AI17_End_Versioned_Content\n",
+            "\n%AI3_Cropmarks: 0 0 1e308 -1e308\n",
+            "\n%AI5_ArtSize: 0 0\n",
+            "\n%AI9_ColorModel: 2\n",
+            "\n%AI5_BeginPlace\n",
+            "\n%AI26_BeginPlacedObjectPreview\n",
+            "\n%%PageTrailer\n",
+        ])
+        .prop_map(str::to_string),
+    ]
+}
+
+/// The testkit's sample editing data, compressed as older `.ai` files compress it.
+fn ai_sample_compressed() -> Vec<u8> {
+    use std::io::Write as _;
+    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    e.write_all(&vectorcraft_testkit::ai::sample_data()).unwrap();
+    [&b"%AI12_CompressedData"[..], &e.finish().unwrap()].concat()
+}
+
+proptest! {
+    #![proptest_config(config())]
+
+    /// Hostile editing data in Illustrator EPS and `.ai` files: operators in any order with any
+    /// operands, sections and dictionaries left open, images of any size.
+    #[test]
+    fn ai_hostile_editing_data_never_panics(tokens in prop::collection::vec(arb_ai_token(), 0..80)) {
+        use vectorcraft_testkit::ai;
+        let data = ai::editing_data(200.0, 100.0, &format!("%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(L) Ln\n{}\nLB\n", tokens.join(" ")));
+        survive("hostile editing data", || Some(vectorcraft_eps::layered_ai(data.as_bytes(), Document::new(200.0, 100.0), vec![]).0))?;
+        let eps = ai::eps(data.as_bytes(), ai::page_ps());
+        survive("hostile editing data in an EPS", || vectorcraft_engine::cmd::fileio::load("x.eps", &eps).ok().map(|l| l.doc))?;
+    }
+
+    /// The testkit's sample damaged, as it is and compressed, in EPS and `.ai` files.
+    #[test]
+    fn ai_mutated_sample_never_panics(cut in 0usize..4_000, edits in prop::collection::vec((0usize..4_000, any::<u8>()), 0..12)) {
+        use vectorcraft_testkit::ai;
+        static PLAIN: std::sync::OnceLock<Vec<u8>> = std::sync::OnceLock::new();
+        static PACKED: std::sync::OnceLock<Vec<u8>> = std::sync::OnceLock::new();
+        for (what, sample) in [("editing data", PLAIN.get_or_init(ai::sample_data)), ("compressed editing data", PACKED.get_or_init(ai_sample_compressed))] {
+            let mut bytes = sample.clone();
+            for &(at, b) in &edits {
+                let n = bytes.len();
+                bytes[at % n] = b;
+            }
+            bytes.truncate(cut.max(4));
+            let file = ai::ai(&bytes, ai::page_pdf());
+            survive(what, || vectorcraft_engine::cmd::fileio::load("x.ai", &file).ok().map(|l| l.doc))?;
+            let file = ai::eps(&bytes, ai::page_ps());
+            survive(what, || vectorcraft_engine::cmd::fileio::load("x.eps", &file).ok().map(|l| l.doc))?;
+        }
+    }
+}

crates/engine/tests/lossy_overwrite.rs

@@ -0,0 +1,110 @@
+//! A file whose import left something out isn't written over silently: its hidden text, art or
+//! layers would be gone for good.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use serde_json::json;
+use vectorcraft_engine::Session;
+
+fn ascii85(data: &[u8]) -> String {
+    let mut out = String::new();
+    for chunk in data.chunks(4) {
+        let mut x = chunk.iter().enumerate().fold(0u32, |v, (i, b)| v | u32::from(*b) << (24 - 8 * i));
+        let mut d = [0u8; 5];
+        for c in d.iter_mut().rev() {
+            *c = (x % 85) as u8 + b'!';
+            x /= 85;
+        }
+        out.extend(d.iter().take(chunk.len() + 1).map(|c| char::from(*c)));
+    }
+    out.push_str("~>");
+    out
+}
+
+/// A square drawn with an operator the layers' reader doesn't know and flat on the page: the file
+/// comes in as its page, and its hidden layer is left out.
+fn lossy_eps() -> Vec<u8> {
+    let layer = |name: &str, visible: u8, body: &str| {
+        format!("%AI5_BeginLayer\n{visible} 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n({name}) Ln\n{body}\nLB\n%AI5_EndLayer--\n")
+    };
+    let editing = format!(
+        "%!PS-Adobe-3.0 \n%%BoundingBox: 0 0 100 100\n%%HiResBoundingBox: 0 0 100 100\n%AI3_Cropmarks: 0 0 100 100\n{}{}%%Trailer\n",
+        layer("Art", 1, "1 0 0 0 1 0 Zq\n0 0 1 0 k\n10 10 m\n14 10 L\n14 14 L\n10 14 L\nf"),
+        layer("Hidden", 0, "0 0 1 0 k\n50 50 m\n54 50 L\n54 54 L\n50 54 L\nf"),
+    );
+    let packed = ruzstd::encoding::compress_to_vec(editing.as_bytes(), ruzstd::encoding::CompressionLevel::Fastest);
+    let lines: Vec<String> = ascii85(&packed).as_bytes().chunks(60).map(|c| format!("%{}", String::from_utf8_lossy(c))).collect();
+    format!(
+        "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n0 0 1 0 setcmykcolor 10 10 moveto 14 10 lineto 14 14 lineto 10 14 lineto closepath fill\nshowpage\n%%EOF\n%AI9_PrivateDataBegin\n%AI24_DataStream\n{}\n%AI9_PrivateDataEnd\n",
+        lines.join("\n")
+    )
+    .into_bytes()
+}
+
+fn dir(name: &str) -> std::path::PathBuf {
+    let d = std::env::temp_dir().join(format!("vc-lossy-{name}-{}", std::process::id()));
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+#[test]
+fn a_file_the_import_left_things_out_of_is_not_written_over_unasked() {
+    let d = dir("a");
+    let src = d.join("art.eps");
+    let original = lossy_eps();
+    std::fs::write(&src, &original).unwrap();
+    let mut s = Session::new();
+    let opened = s.execute("document.open", &json!({ "path": src.to_string_lossy() })).unwrap();
+    assert!(opened["warnings"].to_string().contains("layers weren't read"), "{opened}");
+
+    // Over the same file: refused, and the file is as it was.
+    let e = s.execute("document.export", &json!({ "path": src.to_string_lossy(), "format": "eps" })).unwrap_err().to_string();
+    assert!(e.contains("left things out") && e.contains("acknowledgeLoss"), "{e}");
+    assert_eq!(std::fs::read(&src).unwrap(), original);
+    // However the path is spelled.
+    let spelled = d.join(".").join("art.eps");
+    assert!(s.execute("document.export", &json!({ "path": spelled.to_string_lossy(), "format": "eps" })).is_err());
+
+    // Another name is fine, and so is replacing the file when asked to.
+    let other = d.join("art copy.eps");
+    s.execute("document.export", &json!({ "path": other.to_string_lossy(), "format": "eps" })).unwrap();
+    assert!(other.exists());
+    s.execute("document.export", &json!({ "path": src.to_string_lossy(), "format": "eps", "acknowledgeLoss": true })).unwrap();
+    assert_ne!(std::fs::read(&src).unwrap(), original);
+    std::fs::remove_dir_all(d).ok();
+}
+
+#[test]
+fn a_file_the_import_read_whole_is_written_over_as_before() {
+    let d = dir("b");
+    let src = d.join("plain.eps");
+    std::fs::write(&src, "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n0 0 1 0 setcmykcolor 10 10 moveto 14 10 lineto 14 14 lineto closepath fill\nshowpage\n%%EOF\n").unwrap();
+    let mut s = Session::new();
+    s.execute("document.open", &json!({ "path": src.to_string_lossy() })).unwrap();
+    s.execute("document.export", &json!({ "path": src.to_string_lossy(), "format": "eps" })).unwrap();
+    std::fs::remove_dir_all(d).ok();
+}
+
+#[test]
+fn the_other_ways_of_writing_a_file_ask_too() {
+    let d = dir("c");
+    let src = d.join("art.eps");
+    let original = lossy_eps();
+    std::fs::write(&src, &original).unwrap();
+    let mut s = Session::new();
+    s.execute("document.open", &json!({ "path": src.to_string_lossy() })).unwrap();
+    s.execute("select.all", &json!({})).unwrap();
+    for (cmd, params) in [
+        ("document.exportPdf", json!({})),
+        ("document.exportSelection", json!({ "format": "eps" })),
+        ("document.exportForOffice", json!({})),
+        ("file.print", json!({ "format": "pdf" })),
+    ] {
+        let mut p = params;
+        p["path"] = json!(src.to_string_lossy());
+        let e = s.execute(cmd, &p).unwrap_err().to_string();
+        assert!(e.contains("left things out"), "{cmd}: {e}");
+        assert_eq!(std::fs::read(&src).unwrap(), original, "{cmd}");
+    }
+    std::fs::remove_dir_all(d).ok();
+}

crates/eps/Cargo.toml

@@ -22,6 +22,7 @@ vectorcraft-render = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
 flate2 = { workspace = true }
+ruzstd = { workspace = true }
 
 [dev-dependencies]
 vectorcraft-testkit = { workspace = true }

crates/eps/src/import/ai/lex.rs

@@ -0,0 +1,333 @@
+//! The scanner of the editing data: PostScript-like tokens, read line by line.
+//!
+//! - A line starting with `%_` holds tokens like any other line (they are marked [`Token::hidden`]:
+//!   readers of the printed format skip them as comments).
+//! - Any other line starting with `%` is a [`Tok::Comment`] (the section markers).
+//! - `%` later in a line starts a comment that is skipped.
+//! - The binary image data after `%%BeginData:` is one [`Tok::Data`]; the binary previews of placed
+//!   files are skipped.
+
+use super::super::lex::{find, hex_decode};
+
+/// A token.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Tok<'a> {
+    Num(f64),
+    /// A literal `(…)` string, escapes undone.
+    Str(Vec<u8>),
+    /// A hexadecimal `<…>` string.
+    Hex(Vec<u8>),
+    /// A literal `/name`.
+    Name(&'a [u8]),
+    /// An operator (any other word, `[` and `]` included).
+    Word(&'a [u8]),
+    /// A comment line, without its first `%`.
+    Comment(&'a [u8]),
+    /// An image's samples: what follows `XI` in a `%%BeginData:` section.
+    Data(&'a [u8]),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Token<'a> {
+    pub tok: Tok<'a>,
+    /// Read from a `%_` line.
+    pub hidden: bool,
+}
+
+/// Binary sections skipped whole: (begin, end) markers.
+const SKIPPED: [(&[u8], &[u8]); 2] = [(b"%AI26_BeginPlacedObjectPreview", b"%AI26_EndPlacedObjectPreview"), (b"%%BeginDocument", b"%%EndDocument")];
+
+fn is_space(b: u8) -> bool {
+    matches!(b, b' ' | b'\t' | b'\r' | b'\n' | b'\x0c' | b'\0')
+}
+
+fn is_delim(b: u8) -> bool {
+    matches!(b, b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%')
+}
+
+fn is_eol(b: u8) -> bool {
+    matches!(b, b'\r' | b'\n')
+}
+
+pub(super) struct Lexer<'a> {
+    src: &'a [u8],
+    pos: usize,
+    /// The current line started with `%_`.
+    hidden: bool,
+}
+
+impl<'a> Lexer<'a> {
+    pub fn new(src: &'a [u8]) -> Self {
+        Self { src, pos: 0, hidden: false }
+    }
+
+    fn peek(&self) -> Option<u8> {
+        self.src.get(self.pos).copied()
+    }
+
+    fn rest(&self) -> &'a [u8] {
+        self.src.get(self.pos..).unwrap_or_default()
+    }
+
+    fn at_line_start(&self) -> bool {
+        self.pos == 0 || self.src.get(self.pos - 1).is_some_and(|b| is_eol(*b))
+    }
+
+    /// The rest of the current line (without its end), the position moved past it.
+    fn line(&mut self) -> &'a [u8] {
+        let rest = self.rest();
+        let n = rest.iter().position(|b| is_eol(*b)).unwrap_or(rest.len());
+        self.pos += n;
+        rest.get(..n).unwrap_or_default()
+    }
+
+    /// Skip past the next `needle` (the end of data that isn't tokens) → what was skipped.
+    pub fn skip_past(&mut self, needle: &[u8]) -> &'a [u8] {
+        let rest = self.rest();
+        let n = find(rest, needle).map_or(rest.len(), |i| i + needle.len());
+        self.pos += n;
+        rest.get(..n).unwrap_or_default()
+    }
+
+    /// The next token; `None` at the end.
+    pub fn next_token(&mut self) -> Option<Token<'a>> {
+        loop {
+            let b = self.peek()?;
+            if is_eol(b) {
+                self.pos += 1;
+                self.hidden = false;
+                continue;
+            }
+            if is_space(b) {
+                self.pos += 1;
+                continue;
+            }
+            if b == b'%' {
+                if self.at_line_start() {
+                    if self.rest().starts_with(b"%_") {
+                        self.pos += 2;
+                        self.hidden = true;
+                        continue;
+                    }
+                    let line = self.line();
+                    if let Some(t) = self.special(line) {
+                        return Some(t);
+                    }
+                    return Some(Token { tok: Tok::Comment(line.get(1..).unwrap_or_default()), hidden: false });
+                }
+                // A comment later in a line.
+                self.line();
+                continue;
+            }
+            let hidden = self.hidden;
+            self.pos += 1;
+            let tok = match b {
+                b'(' => Tok::Str(self.string()),
+                b'<' => {
+                    let rest = self.rest();
+                    let end = rest.iter().position(|b| *b == b'>').unwrap_or(rest.len());
+                    self.pos += (end + 1).min(rest.len());
+                    // Malformed digits read as an empty string.
+                    Tok::Hex(rest.get(..end).and_then(hex_decode).unwrap_or_default())
+                }
+                b'[' | b']' | b'{' | b'}' | b')' | b'>' => Tok::Word(self.src.get(self.pos - 1..self.pos).unwrap_or_default()),
+                b'/' => Tok::Name(self.word()),
+                _ => {
+                    self.pos -= 1;
+                    let w = self.word();
+                    match number(w) {
+                        Some(v) => Tok::Num(v),
+                        None => Tok::Word(w),
+                    }
+                }
+            };
+            return Some(Token { tok, hidden });
+        }
+    }
+
+    /// The token a comment line stands for when it starts a section read differently: image data
+    /// (`%%BeginData:` followed by `XI`) and skipped binary sections.
+    fn special(&mut self, line: &'a [u8]) -> Option<Token<'a>> {
+        if let Some((_, end)) = SKIPPED.iter().find(|(b, _)| line.starts_with(b)) {
+            let after = find(self.rest(), end).map_or(self.src.len(), |i| self.pos + i);
+            self.pos = after;
+            self.line();
+            return Some(Token { tok: Tok::Comment(line.get(1..).unwrap_or_default()), hidden: false });
+        }
+        let n = line.strip_prefix(b"%%BeginData:")?;
+        let n: usize = std::str::from_utf8(n).ok()?.split_whitespace().next()?.parse().ok()?;
+        // The count starts after the comment's line end character (a following `\n` counts).
+        let from = self.pos + 1;
+        let region = self.src.get(from..)?;
+        let skip = region.iter().take_while(|b| is_space(**b)).count();
+        if !region.get(skip..)?.starts_with(b"XI") {
+            return None;
+        }
+        let mut data = from + skip + 2;
+        match (self.src.get(data), self.src.get(data + 1)) {
+            (Some(b'\r'), Some(b'\n')) => data += 2,
+            (Some(b'\r' | b'\n'), _) => data += 1,
+            _ => {}
+        }
+        // The count leaves out an alpha channel: the data ends where `%%EndData` starts.
+        let declared = from.saturating_add(n).min(self.src.len()).max(data);
+        let window =
+            self.src.get(declared.saturating_sub(4).max(data)..declared.saturating_add(n.saturating_mul(2)).saturating_add(64).min(self.src.len()));
+        let end = match window.and_then(|w| find(w, b"%%EndData")) {
+            Some(i) => declared.saturating_sub(4).max(data) + i,
+            None => declared,
+        };
+        self.pos = end;
+        Some(Token { tok: Tok::Data(self.src.get(data..end).unwrap_or_default()), hidden: false })
+    }
+
+    /// A regular token's characters.
+    fn word(&mut self) -> &'a [u8] {
+        let start = self.pos;
+        while let Some(b) = self.peek() {
+            if is_space(b) || is_delim(b) {
+                break;
+            }
+            self.pos += 1;
+        }
+        self.src.get(start..self.pos).unwrap_or_default()
+    }
+
+    /// A literal string after its `(` (an unterminated one ends with the data).
+    fn string(&mut self) -> Vec<u8> {
+        let mut out = vec![];
+        let mut depth = 0usize;
+        while let Some(b) = self.peek() {
+            self.pos += 1;
+            match b {
+                b'(' => {
+                    depth += 1;
+                    out.push(b);
+                }
+                b')' if depth == 0 => break,
+                b')' => {
+                    depth -= 1;
+                    out.push(b);
+                }
+                b'\\' => {
+                    let Some(e) = self.peek() else { break };
+                    self.pos += 1;
+                    match e {
+                        b'n' => out.push(b'\n'),
+                        b'r' => out.push(b'\r'),
+                        b't' => out.push(b'\t'),
+                        b'b' => out.push(8),
+                        b'f' => out.push(12),
+                        b'\r' => {
+                            if self.peek() == Some(b'\n') {
+                                self.pos += 1;
+                            }
+                        }
+                        b'\n' => {}
+                        b'0'..=b'7' => {
+                            let mut v = u32::from(e - b'0');
+                            for _ in 0..2 {
+                                match self.peek() {
+                                    Some(d @ b'0'..=b'7') => {
+                                        v = v * 8 + u32::from(d - b'0');
+                                        self.pos += 1;
+                                    }
+                                    _ => break,
+                                }
+                            }
+                            out.push((v & 0xff) as u8);
+                        }
+                        other => out.push(other),
+                    }
+                }
+                _ => out.push(b),
+            }
+        }
+        out
+    }
+}
+
+/// A finite number token (`12`, `-3.5`, `.5`, `1e-3`), or `None`.
+fn number(w: &[u8]) -> Option<f64> {
+    let first = *w.first()?;
+    if !(first.is_ascii_digit() || matches!(first, b'+' | b'-' | b'.')) {
+        return None;
+    }
+    if w.iter().any(|b| b.is_ascii_alphabetic() && !matches!(b, b'e' | b'E')) {
+        return None;
+    }
+    let v: f64 = std::str::from_utf8(w).ok()?.parse().ok()?;
+    v.is_finite().then_some(v)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn all(src: &[u8]) -> Vec<Token<'_>> {
+        let mut l = Lexer::new(src);
+        std::iter::from_fn(|| l.next_token()).collect()
+    }
+
+    fn t(tok: Tok<'_>, hidden: bool) -> Token<'_> {
+        Token { tok, hidden }
+    }
+
+    #[test]
+    fn hidden_lines_and_comments() {
+        let toks = all(b"%AI5_BeginLayer\r\n1 (a\\)b) Ln\r%_/X : ;\n0 %_BS\n<4142>\n");
+        assert_eq!(
+            toks,
+            vec![
+                t(Tok::Comment(b"AI5_BeginLayer"), false),
+                t(Tok::Num(1.0), false),
+                t(Tok::Str(b"a)b".to_vec()), false),
+                t(Tok::Word(b"Ln"), false),
+                t(Tok::Name(b"X"), true),
+                t(Tok::Word(b":"), true),
+                t(Tok::Word(b";"), true),
+                t(Tok::Num(0.0), false),
+                t(Tok::Hex(b"AB".to_vec()), false),
+            ]
+        );
+    }
+
+    #[test]
+    fn image_data_is_one_token() {
+        // The count starts after the comment's `\r`: `\nXI\n` and 3 samples; an alpha channel
+        // after them isn't counted.
+        let src = b"[1 0 0 1 0 0] XI\r\n%%BeginData: 7\r\nXI\n(%)A%%EndData\r\nXH\r\n";
+        let toks = all(src);
+        assert!(toks.contains(&t(Tok::Data(b"(%)A"), false)), "{toks:?}");
+        assert_eq!(toks.last(), Some(&t(Tok::Word(b"XH"), false)));
+        // A section of hex lines is comments.
+        let toks = all(b"%%BeginData: 9 Hex Bytes\r\n%00FF\r\n%%EndData\r\n1\r\n");
+        assert_eq!(toks.last(), Some(&t(Tok::Num(1.0), false)));
+    }
+
+    #[test]
+    fn binary_previews_are_skipped() {
+        let toks = all(b"%AI26_BeginPlacedObjectPreview\r\n2 1 (\x00\xff\r\n%AI26_EndPlacedObjectPreview\r\nN\r\n");
+        assert_eq!(toks.last(), Some(&t(Tok::Word(b"N"), false)));
+        assert_eq!(toks.len(), 2);
+    }
+
+    #[test]
+    fn skip_past_data() {
+        let mut l = Lexer::new(b"/Binary : /ASCII85Decode ,\r\n%_(abc[%\r\n%x~>\r\n%_; 1");
+        for _ in 0..4 {
+            l.next_token();
+        }
+        assert_eq!(l.skip_past(b"~>"), b"\r\n%_(abc[%\r\n%x~>");
+        assert_eq!(l.next_token().map(|t| t.tok), Some(Tok::Word(b";")));
+        assert_eq!(l.next_token().map(|t| t.tok), Some(Tok::Num(1.0)));
+    }
+
+    #[test]
+    fn hostile_input_ends() {
+        for src in [&b"(unterminated \\"[..], b"<12", b"%%BeginData: 99999999999\r\nXI", b"%%BeginData: 5\rXI\r", b"/", b"1e999 nan"] {
+            let toks = all(src);
+            assert!(toks.len() < 10);
+        }
+    }
+}

crates/eps/src/import/ai/mod.rs

@@ -0,0 +1,163 @@
+//! Illustrator's editing data: the document as the app keeps it, which an Illustrator EPS carries
+//! after its printed page and a `.ai` file (PDF compatible or not) in its first page's
+//! `/PieceInfo /Illustrator /Private` streams.
+//!
+//! - In an EPS it starts at the `%AI9_PrivateDataBegin` comment: header comments, then
+//!   `%AI24_DataStream` (Zstandard) or `%AI9_DataStream` (zlib) and the compressed data as ASCII85
+//!   on comment lines, up to `%AI9_PrivateDataEnd`. Data that isn't compressed follows the header
+//!   as it is.
+//! - In a `.ai` file the streams joined start with `%AI24_ZStandard_Data` (Zstandard) or
+//!   `%AI12_CompressedData` (zlib), else are the data itself ([`decode_private`]).
+//!
+//! The data is a PostScript-like program of the legacy Illustrator format's operators (layers,
+//! groups, paths, colours, gradients, images) with newer ones (transparency, hidden objects) and
+//! dictionaries (names, artboards, type). `lex` scans it, `read` builds the document.
+//!
+//! Reading is bounded: the data decompresses to at most [`MAX_DATA`], and the reader caps nesting,
+//! objects and points. Anything it doesn't read is an error: the caller opens the file the way it
+//! did before (the printed page, or the PDF), with a warning saying why.
+
+mod lex;
+mod obj;
+mod paint;
+mod read;
+
+use std::io::Read as _;
+
+use super::lex::find;
+use crate::ps;
+
+pub(crate) use read::slot_of;
+pub use read::{Structure, read};
+
+#[cfg(test)]
+mod tests;
+
+/// Largest editing data read, decompressed (bytes).
+pub const MAX_DATA: u64 = 256 << 20;
+/// Largest Zstandard window accepted (a frame asking for more is damaged data).
+const MAX_ZSTD_WINDOW: u64 = 64 << 20;
+/// Most Zstandard frames read (the app writes one).
+const MAX_FRAMES: usize = 4096;
+
+const EPS_BEGIN: &[u8] = b"%AI9_PrivateDataBegin";
+const EPS_END: &[u8] = b"%AI9_PrivateDataEnd";
+
+/// The editing data an Illustrator EPS carries (`ps`: its PostScript), decoded: `None` without
+/// one, an error when it can't be decoded.
+pub fn eps_data(ps: &[u8]) -> Option<Result<Vec<u8>, String>> {
+    let start = find(ps, EPS_BEGIN)? + EPS_BEGIN.len();
+    let rest = ps.get(start..)?;
+    let section = rest.get(..find(rest, EPS_END).unwrap_or(rest.len())).unwrap_or_default();
+    Some(eps_section(section))
+}
+
+/// The editing data between the EPS markers: header comments, then the data (encoded or not).
+fn eps_section(section: &[u8]) -> Result<Vec<u8>, String> {
+    let mut header = Vec::new();
+    let mut lines = section.split(|b| matches!(b, b'\n' | b'\r')).filter(|l| !l.is_empty());
+    let mut codec = None;
+    for line in lines.by_ref() {
+        if line.starts_with(b"%AI24_DataStream") {
+            codec = Some(Codec::Zstd);
+            break;
+        }
+        if line.starts_with(b"%AI9_DataStream") {
+            codec = Some(Codec::Zlib);
+            break;
+        }
+        header.extend_from_slice(line);
+        header.extend_from_slice(b"\n");
+        if header.len() as u64 > MAX_DATA {
+            return Err(too_large());
+        }
+    }
+    let Some(codec) = codec else {
+        // Not compressed: the section is the data, as it is (images' samples are binary).
+        if section.len() as u64 > MAX_DATA {
+            return Err(too_large());
+        }
+        return Ok(section.to_vec());
+    };
+    let mut text = String::new();
+    for line in lines {
+        let body = line.strip_prefix(b"%").unwrap_or(line);
+        text.push_str(std::str::from_utf8(body).map_err(|_| damaged("its ASCII85 encoding"))?);
+        if text.len() as u64 > MAX_DATA {
+            return Err(too_large());
+        }
+    }
+    if !text.contains("~>") {
+        text.push_str("~>");
+    }
+    let packed = ps::ascii85_decode(&text).ok_or_else(|| damaged("its ASCII85 encoding"))?;
+    let mut data = header;
+    data.extend(codec.decode(&packed, MAX_DATA.saturating_sub(data.len() as u64))?);
+    Ok(data)
+}
+
+/// The editing data of a `.ai` file: its `AIPrivateData` streams joined (`raw`), decompressed. The
+/// compressed data may follow header comments that aren't.
+pub fn decode_private(raw: &[u8]) -> Result<Vec<u8>, String> {
+    if raw.len() as u64 > MAX_DATA {
+        return Err(too_large());
+    }
+    for (marker, codec) in [(&b"%AI24_ZStandard_Data"[..], Codec::Zstd), (b"%AI12_CompressedData", Codec::Zlib)] {
+        if let Some(at) = find(raw, marker) {
+            let (header, body) = raw.split_at(at);
+            let mut data = header.to_vec();
+            data.extend(codec.decode(body.get(marker.len()..).unwrap_or_default(), MAX_DATA.saturating_sub(header.len() as u64))?);
+            return Ok(data);
+        }
+    }
+    Ok(raw.to_vec())
+}
+
+#[derive(Clone, Copy)]
+enum Codec {
+    Zstd,
+    Zlib,
+}
+
+impl Codec {
+    /// `data` decompressed, at most `max` bytes.
+    fn decode(self, data: &[u8], max: u64) -> Result<Vec<u8>, String> {
+        let mut out = Vec::new();
+        match self {
+            Codec::Zlib => {
+                flate2::read::ZlibDecoder::new(data).take(max + 1).read_to_end(&mut out).map_err(|_| damaged("its zlib compression"))?;
+            }
+            Codec::Zstd => {
+                // The data may be several frames one after the other, padded with zeros.
+                let end = data.iter().rposition(|b| *b != 0).map_or(0, |i| i + 1);
+                let mut src = data.get(..end).unwrap_or_default();
+                let mut frames = 0usize;
+                while !src.is_empty() {
+                    frames += 1;
+                    if frames > MAX_FRAMES {
+                        return Err(damaged("its Zstandard compression"));
+                    }
+                    let left = (max + 1).saturating_sub(out.len() as u64);
+                    if left == 0 {
+                        break;
+                    }
+                    let d = ruzstd::decoding::StreamingDecoder::new_with_max_window_size(&mut src, MAX_ZSTD_WINDOW)
+                        .map_err(|_| damaged("its Zstandard compression"))?;
+                    d.take(left).read_to_end(&mut out).map_err(|_| damaged("its Zstandard compression"))?;
+                }
+            }
+        }
+        if out.len() as u64 > max {
+            return Err(too_large());
+        }
+        Ok(out)
+    }
+}
+
+fn damaged(what: &str) -> String {
+    format!("{what} is damaged")
+}
+
+fn too_large() -> String {
+    format!("it decompresses to more than {} MB", MAX_DATA >> 20)
+}

crates/eps/src/import/ai/obj.rs

@@ -0,0 +1,208 @@
+//! Operand values, and the dictionaries the editing data writes postfix: `/Type :` opens one,
+//! `values key ,` adds an entry (a type name such as `/Real` may stand before the key; in an
+//! `/Array` there is no key), `;` closes it (after a last `values /key` entry, or a bare value: its
+//! content), leaving it as a value.
+
+use std::rc::Rc;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum V {
+    Num(f64),
+    Str(Vec<u8>),
+    Name(String),
+    Arr(Vec<V>),
+    Obj(Rc<Obj>),
+    /// `[`, until its `]`.
+    Mark,
+}
+
+impl V {
+    pub fn num(&self) -> Option<f64> {
+        match self {
+            V::Num(v) => Some(*v),
+            _ => None,
+        }
+    }
+    pub fn obj(&self) -> Option<&Obj> {
+        match self {
+            V::Obj(o) => Some(o),
+            _ => None,
+        }
+    }
+    /// A string's or name's text.
+    pub fn text(&self) -> Option<String> {
+        match self {
+            V::Str(s) => Some(text(s)),
+            V::Name(n) => Some(n.clone()),
+            _ => None,
+        }
+    }
+}
+
+/// Text from the data's bytes: UTF-8, else Windows-1252 (Latin-1 for its gaps).
+pub(super) fn text(bytes: &[u8]) -> String {
+    match std::str::from_utf8(bytes) {
+        Ok(s) => s.to_string(),
+        Err(_) => bytes.iter().map(|b| cp1252(*b)).collect(),
+    }
+}
+
+fn cp1252(b: u8) -> char {
+    const HIGH: [char; 32] = [
+        '€', '\u{81}', '‚', 'ƒ', '„', '…', '†', '‡', 'ˆ', '‰', 'Š', '‹', 'Œ', '\u{8d}', 'Ž', '\u{8f}', '\u{90}', '‘', '’', '“', '”', '•', '–', '—',
+        '˜', '™', 'š', '›', 'œ', '\u{9d}', 'ž', 'Ÿ',
+    ];
+    match b {
+        0x80..=0x9f => HIGH.get(usize::from(b - 0x80)).copied().unwrap_or('?'),
+        _ => char::from(b),
+    }
+}
+
+/// A dictionary.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(super) struct Obj {
+    pub ty: String,
+    /// Entries in order: the key (`None` in an array) and the values before it.
+    pub entries: Vec<(Option<String>, Vec<V>)>,
+    /// Values closed without a key.
+    pub content: Vec<V>,
+}
+
+impl Obj {
+    /// The values of entry `key` (the first one).
+    pub fn get(&self, key: &str) -> Option<&[V]> {
+        self.entries.iter().find(|(k, _)| k.as_deref() == Some(key)).map(|(_, v)| v.as_slice())
+    }
+    /// The numbers of entry `key`.
+    pub fn nums(&self, key: &str) -> Vec<f64> {
+        self.get(key).unwrap_or_default().iter().filter_map(V::num).collect()
+    }
+    /// The first text value of entry `key`.
+    pub fn text(&self, key: &str) -> Option<String> {
+        self.get(key)?.iter().find(|v| matches!(v, V::Str(_))).and_then(V::text)
+    }
+    /// The dictionary value of entry `key`.
+    pub fn obj(&self, key: &str) -> Option<&Obj> {
+        self.get(key)?.iter().find_map(V::obj)
+    }
+    /// The dictionaries an array holds, in order.
+    pub fn items(&self) -> impl Iterator<Item = &Obj> {
+        self.entries.iter().flat_map(|(_, v)| v.iter()).chain(self.content.iter()).filter_map(V::obj)
+    }
+    /// The first text of the content.
+    pub fn content_text(&self) -> Option<String> {
+        self.content.iter().find_map(V::text)
+    }
+}
+
+/// Add the values on `stack` above `base` to `o` as one entry (`,`): the last is the key, except
+/// in an array.
+pub(super) fn add_entry(o: &mut Obj, stack: &mut Vec<V>, base: usize) {
+    let mut vals: Vec<V> = stack.drain(base.min(stack.len())..).collect();
+    if o.ty == "Array" {
+        o.entries.push((None, vals));
+        return;
+    }
+    let key = match vals.last() {
+        Some(V::Str(_) | V::Name(_)) => vals.pop().and_then(|k| k.text()),
+        _ => None,
+    };
+    o.entries.push((key, vals));
+}
+
+/// Close `o` (`;`): a last entry ending with a name is an entry, other values are its content.
+pub(super) fn close(o: &mut Obj, stack: &mut Vec<V>, base: usize) {
+    if stack.len() <= base {
+        return;
+    }
+    if o.ty != "Array" && matches!(stack.last(), Some(V::Name(_))) {
+        add_entry(o, stack, base);
+    } else {
+        let vals: Vec<V> = stack.drain(base.min(stack.len())..).collect();
+        o.content.extend(vals);
+    }
+}
+
+/// An object name from its XML id (`AI10_ArtUID`): `_` stands for a space and `_xHH_` for a
+/// character; ids made unique end with `_` and 20 or more digits.
+pub(super) fn xml_name(id: &str) -> String {
+    let id = strip_unique(id);
+    let mut out = String::with_capacity(id.len());
+    let mut rest = id;
+    while let Some(c) = rest.chars().next() {
+        if c == '_' {
+            if let Some((ch, n)) = escaped(rest) {
+                out.push(ch);
+                rest = rest.get(n..).unwrap_or_default();
+                continue;
+            }
+            out.push(' ');
+        } else {
+            out.push(c);
+        }
+        rest = rest.get(c.len_utf8()..).unwrap_or_default();
+    }
+    out
+}
+
+/// `_xHHHH_` at the start of `s`: the character and the escape's length.
+fn escaped(s: &str) -> Option<(char, usize)> {
+    let body = s.strip_prefix("_x")?;
+    let end = body.find('_')?;
+    let hex = body.get(..end)?;
+    if hex.is_empty() || hex.len() > 6 {
+        return None;
+    }
+    let c = char::from_u32(u32::from_str_radix(hex, 16).ok()?)?;
+    Some((c, end + 3))
+}
+
+/// `id` without the `_000…_` suffix that makes it unique.
+fn strip_unique(id: &str) -> &str {
+    let Some(body) = id.strip_suffix('_') else { return id };
+    let Some(at) = body.rfind('_') else { return id };
+    let digits = body.get(at + 1..).unwrap_or_default();
+    if digits.len() >= 20 && digits.bytes().all(|b| b.is_ascii_digit()) { body.get(..at).unwrap_or(id) } else { id }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn names_from_xml_ids() {
+        assert_eq!(xml_name("Layer_1"), "Layer 1");
+        assert_eq!(xml_name("My_Rect__x23_2"), "My Rect #2");
+        assert_eq!(xml_name("_x31_abc__x28_paren_x29_"), "1abc (paren)");
+        assert_eq!(xml_name("Ünï_日本"), "Ünï 日本");
+        assert_eq!(xml_name("S_00000092429200007574234970000005974767392385616558_"), "S");
+        assert_eq!(xml_name("a_x_"), "a x ");
+        assert_eq!(xml_name("_xD800_"), " xD800 ");
+    }
+
+    #[test]
+    fn entries_and_content() {
+        let mut o = Obj { ty: "XMLUID".into(), ..Obj::default() };
+        let mut st = vec![V::Num(9.0), V::Str(b"Main".to_vec())];
+        close(&mut o, &mut st, 1);
+        assert_eq!(o.content_text().as_deref(), Some("Main"));
+        assert_eq!(st, vec![V::Num(9.0)]);
+        let mut d = Obj { ty: "Dictionary".into(), ..Obj::default() };
+        let mut st = vec![V::Num(1.0), V::Num(2.0), V::Name("RealPoint".into()), V::Str(b"P".to_vec())];
+        add_entry(&mut d, &mut st, 0);
+        let mut st = vec![V::Name("Def".into())];
+        close(&mut d, &mut st, 0);
+        assert_eq!(d.nums("P"), vec![1.0, 2.0]);
+        assert_eq!(d.get("Def"), Some(&[][..]));
+        let mut a = Obj { ty: "Array".into(), ..Obj::default() };
+        let mut st = vec![V::Obj(Rc::new(d.clone()))];
+        add_entry(&mut a, &mut st, 0);
+        assert_eq!(a.items().count(), 1);
+    }
+
+    #[test]
+    fn latin_text() {
+        assert_eq!(text(b"caf\xe9 \x80"), "café €");
+        assert_eq!(text("ü".as_bytes()), "ü");
+    }
+}

crates/eps/src/import/ai/paint.rs

@@ -0,0 +1,277 @@
+//! Colours and gradients of the editing data.
+//!
+//! - Colours: `g`/`G` grey (1 is white), `k`/`K` CMYK, `x`/`X` a named CMYK colour at a tint
+//!   (`c m y k (name) tint`; tint 0 is the full colour), `Xa`/`XA` RGB (`c m y k r g b`, the CMYK
+//!   values its equivalent), `Xx`/`XX` a named colour of either model
+//!   (`c m y k [r g b] (name) tint type`). Lower case paints fills, upper case strokes.
+//! - Gradient definitions: `(name) type stops Bd`, its stops as `colour style [opacity 6]
+//!   midpoint ramp Bs` (style 0 grey, 1 CMYK, 2 RGB with its CMYK, 3 and 4 named colours), `BD`.
+//! - A gradient on an object: `[flag] Bb` (1: the stroke), `flag (name) x y angle length a b c d
+//!   tx ty Bg`, the gradient matrix `a b c d tx ty Bm`, the focal point `x y angle length Bh`,
+//!   `flag BB`.
+
+use std::collections::HashMap;
+
+use kurbo::{Affine, Point, Vec2};
+use vectorcraft_color::gradient::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+use vectorcraft_color::{Color, Paint};
+
+use super::obj::V;
+
+/// Largest number of stops read in one gradient.
+const MAX_STOPS: usize = 256;
+
+/// A colour read with the swatch it names (spot and global colours).
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Named {
+    pub name: String,
+    /// The full colour.
+    pub color: Color,
+    pub tint: f32,
+}
+
+/// The paint of a colour operator's operands (`op`: its name, lower case or not), with the named
+/// colour it uses. `None` when the operands don't fit.
+pub(super) fn color_op(op: &str, vals: &[V]) -> Option<(Paint, Option<Named>)> {
+    let nums: Vec<f32> = vals.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let last = |n: usize| nums.get(nums.len().checked_sub(n)?..);
+    match op.to_ascii_lowercase().as_str() {
+        "g" => Some((Paint::solid(Color::gray(1.0 - unit(*nums.last()?))), None)),
+        "k" => {
+            let [c, m, y, k] = last(4)? else { return None };
+            Some((Paint::solid(Color::cmyk(unit(*c), unit(*m), unit(*y), unit(*k))), None))
+        }
+        "xa" => {
+            let [r, g, b] = last(3)? else { return None };
+            Some((Paint::solid(Color::rgb(unit(*r), unit(*g), unit(*b))), None))
+        }
+        "x" => named(vals, Some(false)),
+        "xx" => named(vals, None),
+        _ => None,
+    }
+}
+
+/// `c m y k (name) tint x` or `c m y k [r g b] (name) tint type Xx` (type 1: RGB); `rgb` forces
+/// the model.
+fn named(vals: &[V], rgb: Option<bool>) -> Option<(Paint, Option<Named>)> {
+    let at = vals.iter().rposition(|v| matches!(v, V::Str(_)))?;
+    let name = vals.get(at)?.text()?;
+    let before: Vec<f32> = vals.get(..at)?.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let after: Vec<f32> = vals.get(at + 1..)?.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let tint = 1.0 - unit(*after.first()?);
+    let n = before.len();
+    let color = if rgb.unwrap_or(after.get(1).is_some_and(|t| *t == 1.0)) {
+        let [r, g, b] = before.get(n.checked_sub(3)?..)? else { return None };
+        Color::rgb(unit(*r), unit(*g), unit(*b))
+    } else {
+        // The CMYK values come first (an RGB equivalent may follow them).
+        let from = if n >= 7 { n - 7 } else { n.checked_sub(4)? };
+        let [c, m, y, k] = before.get(from..from + 4)? else { return None };
+        Color::cmyk(unit(*c), unit(*m), unit(*y), unit(*k))
+    };
+    let paint = Paint::Solid { color: color.tinted(tint), swatch: Some(name.clone()), tint };
+    Some((paint, Some(Named { name, color, tint })))
+}
+
+/// The colour of a gradient stop's colour values and style.
+fn stop_color(style: f64, comps: &[V]) -> Option<(Color, Option<Named>)> {
+    let nums: Vec<f32> = comps.iter().filter_map(V::num).map(|v| v as f32).collect();
+    let unit = |v: f32| v.clamp(0.0, 1.0);
+    let tail = |n: usize| nums.get(nums.len().checked_sub(n)?..);
+    Some(match style as i64 {
+        0 => (Color::gray(1.0 - unit(*nums.last()?)), None),
+        1 => {
+            let [c, m, y, k] = tail(4)? else { return None };
+            (Color::cmyk(unit(*c), unit(*m), unit(*y), unit(*k)), None)
+        }
+        2 => {
+            let [r, g, b] = tail(3)? else { return None };
+            (Color::rgb(unit(*r), unit(*g), unit(*b)), None)
+        }
+        _ => {
+            let (paint, named) = named(comps, Some(style as i64 == 4))?;
+            (paint.color()?, named)
+        }
+    })
+}
+
+/// A gradient definition being read.
+#[derive(Debug)]
+pub(super) struct GradientDef {
+    pub name: String,
+    pub gradient: Gradient,
+}
+
+impl GradientDef {
+    /// `(name) type stops Bd`.
+    pub fn begin(vals: &[V]) -> Option<Self> {
+        let name = vals.iter().find_map(|v| if let V::Str(_) = v { v.text() } else { None })?;
+        let nums: Vec<f64> = vals.iter().filter_map(V::num).collect();
+        let kind = if nums.first().copied() == Some(1.0) { GradientKind::Radial } else { GradientKind::Linear };
+        Some(Self { name, gradient: Gradient { kind, stops: vec![] } })
+    }
+
+    /// A stop (`Bs`).
+    pub fn stop(&mut self, vals: &[V], spots: &mut Vec<Named>) {
+        if self.gradient.stops.len() >= MAX_STOPS {
+            return;
+        }
+        let n = vals.len();
+        let num = |i: usize| vals.get(i).and_then(V::num);
+        let (Some(ramp), Some(mid)) = (n.checked_sub(1).and_then(num), n.checked_sub(2).and_then(num)) else { return };
+        // Newer stops have an opacity and the marker 6 before the midpoint.
+        let newer = n >= 5 && n.checked_sub(3).and_then(num) == Some(6.0);
+        let (style_at, opacity) = if newer { (n.checked_sub(5), n.checked_sub(4).and_then(num).unwrap_or(1.0)) } else { (n.checked_sub(3), 1.0) };
+        let (Some(style_at), Some(style)) = (style_at, style_at.and_then(num)) else { return };
+        let Some((color, named)) = stop_color(style, vals.get(..style_at).unwrap_or_default()) else { return };
+        let mut stop = GradientStop::new((ramp / 100.0).clamp(0.0, 1.0) as f32, color);
+        stop.opacity = opacity.clamp(0.0, 1.0) as f32;
+        stop.midpoint = (mid / 100.0).clamp(0.13, 0.87) as f32;
+        if let Some(n) = named {
+            stop.set_color(n.color.tinted(n.tint), Some((n.name.clone(), n.tint)));
+            spots.push(n);
+        }
+        self.gradient.stops.push(stop);
+    }
+
+    /// The finished gradient (`BD`): stops in order of their ramp points.
+    pub fn finish(mut self) -> Option<(String, Gradient)> {
+        if self.gradient.stops.is_empty() {
+            return None;
+        }
+        self.gradient.stops.sort_by(|a, b| a.offset.total_cmp(&b.offset));
+        Some((self.name, self.gradient))
+    }
+}
+
+/// A gradient instance on an object, between `Bb` and `BB`.
+#[derive(Clone, Debug, Default)]
+pub(super) struct Instance {
+    pub stroke: bool,
+    pub name: Option<String>,
+    origin: Point,
+    angle: f64,
+    length: f64,
+    /// `Bg`'s own matrix.
+    bg: Affine,
+    /// The gradient matrix (`Bm`), when there is one.
+    bm: Option<Affine>,
+    /// The focal point's offset from the origin (`Bh`).
+    hilight: Vec2,
+}
+
+fn affine(n: &[f64]) -> Option<Affine> {
+    let [a, b, c, d, e, f] = n else { return None };
+    let m = Affine::new([*a, *b, *c, *d, *e, *f]);
+    (m.as_coeffs().iter().all(|v| v.is_finite())).then_some(m)
+}
+
+impl Instance {
+    pub fn begin(vals: &[V]) -> Self {
+        let stroke = vals.iter().filter_map(V::num).next_back() == Some(1.0);
+        Self { stroke, length: 1.0, ..Self::default() }
+    }
+
+    /// `flag (name) x y angle length a b c d tx ty Bg`.
+    pub fn bg(&mut self, vals: &[V]) {
+        let Some(at) = vals.iter().rposition(|v| matches!(v, V::Str(_))) else { return };
+        self.name = vals.get(at).and_then(V::text);
+        let n: Vec<f64> = vals.get(at + 1..).unwrap_or_default().iter().filter_map(V::num).collect();
+        if let [x, y, angle, length, m @ ..] = n.as_slice() {
+            self.origin = Point::new(*x, *y);
+            self.angle = *angle;
+            self.length = *length;
+            self.bg = affine(m).unwrap_or(Affine::IDENTITY);
+        }
+    }
+
+    /// `a b c d tx ty Bm`.
+    pub fn bm(&mut self, vals: &[V]) {
+        let n: Vec<f64> = vals.iter().filter_map(V::num).collect();
+        self.bm = n.get(n.len().saturating_sub(6)..).and_then(affine).filter(|m| m.determinant().abs() > 1e-12);
+    }
+
+    /// `x y angle length Bh`.
+    pub fn bh(&mut self, vals: &[V]) {
+        let n: Vec<f64> = vals.iter().filter_map(V::num).collect();
+        if let [x, y, ..] = n.as_slice() {
+            self.hilight = Vec2::new(*x, *y);
+        }
+    }
+
+    /// The paint, through `to_doc` (art space → the document), when the gradient is defined.
+    pub fn paint(&self, defs: &HashMap<String, Gradient>, to_doc: Affine) -> Option<Paint> {
+        let name = self.name.as_ref()?;
+        let gradient = defs.get(name)?.clone();
+        let m = to_doc * self.bm.unwrap_or(Affine::IDENTITY) * self.bg;
+        let a = self.angle.to_radians();
+        let dir = Vec2::new(a.cos(), a.sin()) * self.length;
+        let start = m * self.origin;
+        let end = m * (self.origin + dir);
+        if !(start.is_finite() && end.is_finite()) || start.distance(end) < 1e-9 {
+            return None;
+        }
+        // Across the vector, for an elliptical radial gradient.
+        let across = m * (self.origin + Vec2::new(-dir.y, dir.x));
+        let aspect = (across.distance(start) / start.distance(end)).clamp(0.01, 100.0);
+        let focal = (self.hilight.hypot() > 1e-9).then(|| m * (self.origin + self.hilight)).filter(|p| p.is_finite());
+        let radial = gradient.kind == GradientKind::Radial;
+        let geom = GradientGeom { start, end, aspect: if radial { aspect } else { 1.0 }, focal: if radial { focal } else { None } };
+        let angle = -(end - start).atan2().to_degrees();
+        Some(Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), angle, swatch: Some(name.clone()), ..GradientPaint::new(gradient) })))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn nums(v: &[f64]) -> Vec<V> {
+        v.iter().map(|n| V::Num(*n)).collect()
+    }
+
+    #[test]
+    fn colours() {
+        let (p, _) = color_op("g", &nums(&[0.7])).unwrap();
+        assert!(matches!(p.color(), Some(Color::Gray { k }) if (k - 0.3).abs() < 1e-6));
+        let (p, _) = color_op("XA", &nums(&[0.0, 0.99, 1.0, 0.0, 1.0, 0.0, 0.0])).unwrap();
+        assert_eq!(p.color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+        let mut v = nums(&[0.0, 0.5, 1.0, 0.0]);
+        v.push(V::Str(b"MySpot".to_vec()));
+        v.push(V::Num(0.4));
+        let (p, named) = color_op("x", &v).unwrap();
+        let named = named.unwrap();
+        assert_eq!(named.name, "MySpot");
+        assert!((named.tint - 0.6).abs() < 1e-6);
+        assert!(matches!(p, Paint::Solid { swatch: Some(_), .. }));
+        assert!(color_op("k", &nums(&[1.0])).is_none());
+    }
+
+    #[test]
+    fn gradient_definition_and_instance() {
+        let mut d = GradientDef::begin(&[V::Str(b"G".to_vec()), V::Num(1.0), V::Num(2.0)]).unwrap();
+        let mut spots = vec![];
+        d.stop(&nums(&[0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 2.0, 0.5, 6.0, 30.0, 100.0]), &mut spots);
+        d.stop(&nums(&[0.81, 0.0, 1.0, 6.0, 50.0, 0.0]), &mut spots);
+        let (name, g) = d.finish().unwrap();
+        assert_eq!(name, "G");
+        assert_eq!(g.kind, GradientKind::Radial);
+        assert_eq!(g.stops.len(), 2);
+        assert_eq!(g.stops[1].opacity, 0.5);
+        assert!(matches!(g.stops[0].color, Color::Gray { k } if (k - 0.19).abs() < 1e-6));
+        let defs = HashMap::from([(name, g)]);
+        let mut i = Instance::begin(&[]);
+        let mut bg = vec![V::Num(1.0), V::Str(b"G".to_vec())];
+        bg.extend(nums(&[0.0, 0.0, 0.0, 1.0, 1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
+        i.bg(&bg);
+        i.bm(&nums(&[50.0, 0.0, 0.0, -50.0, 100.0, 100.0]));
+        let Some(Paint::Gradient(gp)) = i.paint(&defs, Affine::IDENTITY) else { panic!() };
+        let geom = gp.geom.unwrap();
+        assert_eq!(geom.start, Point::new(100.0, 100.0));
+        assert_eq!(geom.end, Point::new(150.0, 100.0));
+        assert!((geom.aspect - 1.0).abs() < 1e-9);
+        assert!(i.paint(&HashMap::new(), Affine::IDENTITY).is_none());
+    }
+}

crates/eps/src/import/ai/tests.rs

@@ -0,0 +1,428 @@
+//! The editing data reader on synthetic data, written from the format as `read` documents it.
+
+use std::sync::Arc;
+
+use kurbo::{Point, Rect};
+use vectorcraft_color::gradient::GradientKind;
+use vectorcraft_color::{BlendMode, Color, Paint};
+use vectorcraft_doc::{ColorMode, Document, Knockout, LayerColor, LineCap, LineJoin, Node, NodeKind};
+
+use super::*;
+
+/// Editing data: header comments (crop marks 0 0 200 100), then `body`.
+fn stream(body: &str) -> String {
+    format!(
+        "%!PS-Adobe-3.0\n%%Creator: test\n%AI5_FileFormat 14.0\n%AI3_Cropmarks: 0 0 200 100\n%%EndComments\n%%BeginProlog\n%%EndProlog\n%%BeginSetup\n%%EndSetup\n{body}\n%%PageTrailer\ngsave annotatepage grestore showpage\n%%Trailer\n%%EOF\n"
+    )
+}
+
+/// One layer named `L` holding `art`.
+fn layer(art: &str) -> String {
+    format!("%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(L) Ln\n0 A\n0 Xw\n{art}\nLB\n%AI5_EndLayer--\n")
+}
+
+fn read_ok(body: &str) -> Structure {
+    match read(stream(body).as_bytes()) {
+        Ok(i) => i,
+        Err(e) => panic!("{e}"),
+    }
+}
+
+/// The children of the first layer.
+fn art(doc: &Document) -> Vec<Arc<Node>> {
+    doc.layers.first().and_then(|l| l.children()).cloned().unwrap_or_default()
+}
+
+fn fill(n: &Node) -> Paint {
+    n.appearance.fill().map(|f| f.paint.clone()).unwrap_or_default()
+}
+
+fn rect_path(x0: f64, y0: f64, x1: f64, y1: f64) -> String {
+    format!("{x0} {y0} m\n{x0} {y1} L\n{x1} {y1} L\n{x1} {y0} L\n{x0} {y0} L\n")
+}
+
+const RED: &str = "0 1 1 0 1 0 0 Xa\n";
+
+#[test]
+fn layers_and_sublayers() {
+    let body = format!(
+        "%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(Bottom) Ln\n{RED}{}f\n\
+         %AI5_BeginLayer\n0 1 0 0 0 0 0 -1 10 200 30 0 50 0 Lb\n(Inner) Ln\n{}f\nLB\n%AI5_EndLayer--\nLB\n%AI5_EndLayer--\n\
+         %AI5_BeginLayer\n1 0 1 1 1 0 1 3 79 79 255 0 70 0 Lb\n(Top) Ln\n{}f\nLB\n%AI5_EndLayer--\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+        rect_path(40.0, 0.0, 50.0, 10.0)
+    );
+    let doc = read_ok(&body).doc;
+    let names: Vec<_> = doc.layers.iter().map(|l| l.name.clone().unwrap_or_default()).collect();
+    assert_eq!(names, ["Bottom", "Top"], "bottom first");
+    let bottom = &doc.layers[0];
+    assert!(bottom.visible && !bottom.locked);
+    let kids = bottom.children().unwrap();
+    assert_eq!(kids.len(), 2);
+    let inner = &kids[1];
+    assert_eq!(inner.name.as_deref(), Some("Inner"));
+    assert!(!inner.visible && inner.locked);
+    let NodeKind::Layer { color, printable, .. } = &inner.kind else { panic!("a sublayer") };
+    assert_eq!((*color, *printable), (LayerColor::Custom([10, 200, 30]), false));
+    let NodeKind::Layer { color, preview, dim_images, .. } = &doc.layers[1].kind else { panic!() };
+    assert_eq!((*color, *preview, *dim_images), (LayerColor::Preset(3), false, Some(70)));
+}
+
+#[test]
+fn groups_names_hidden_and_locked() {
+    let art_ = format!(
+        "0 Ae\nu\n{RED}{}f\n%_/ArtDictionary :\n%_/XMLUID : (My_Rect__x23_2) ; (AI10_ArtUID) ,\n%_;\n%_\n\
+         1 A\n0 Ae\nu\n0 A\n1 Xw\n{}f\n0 Xw\nU\n%_/ArtDictionary :\n%_(Inner group) /String (AIArtName) ,\n%_;\n9 () XW\n\
+         0 A\nU\n%_/ArtDictionary :\n%_/XMLUID : (Outer) ; (AI10_ArtUID) ,\n%_;\n%_\n9 () XW\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let top = art(&doc);
+    assert_eq!(top.len(), 1);
+    let outer = &top[0];
+    assert_eq!(outer.name.as_deref(), Some("Outer"));
+    let kids = outer.children().unwrap();
+    assert_eq!(kids[0].name.as_deref(), Some("My Rect #2"));
+    let inner = &kids[1];
+    assert_eq!(inner.name.as_deref(), Some("Inner group"));
+    assert!(inner.locked, "locked when it opened");
+    let hidden = &inner.children().unwrap()[0];
+    assert!(!hidden.visible);
+}
+
+#[test]
+fn paths_colours_and_strokes() {
+    let art_ = format!(
+        "{RED}0 R\n0 0 1 0 0 0 1 XA\n1 J 2 j 3 w 4 M [6 3 ]1 d\n1 XR\n{}b\n\
+         0.1 0.2 0.3 0.4 k\n{}f\n0.7 g\n{}F\n0 0.5 1 0 (Ink) 0.4 x\n{}f\n\
+         10 50 m\n20 60 30 60 40 50 c\n50 40 60 40 v\n70 60 80 60 y\nS\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+        rect_path(40.0, 0.0, 50.0, 10.0),
+        rect_path(60.0, 0.0, 70.0, 10.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let a = art(&doc);
+    assert_eq!(a.len(), 5);
+    // y up from the crop marks' top: (0, 0)-(10, 10) is at y 90-100.
+    let NodeKind::Path { path, rule, .. } = &a[0].kind else { panic!() };
+    assert_eq!(path.bounds(), Some(Rect::new(0.0, 90.0, 10.0, 100.0)));
+    assert!(path.subpaths[0].closed);
+    assert_eq!(path.subpaths[0].anchors.len(), 4, "the closing point merges with the first");
+    assert_eq!(*rule, vectorcraft_geom::FillRule::EvenOdd);
+    assert_eq!(fill(&a[0]).color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+    let st = a[0].appearance.stroke().unwrap();
+    assert_eq!((st.width, st.cap, st.join, st.miter_limit), (3.0, LineCap::Round, LineJoin::Bevel, 4.0));
+    assert_eq!(st.paint.color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+    let dash = st.dash.clone().unwrap();
+    assert_eq!((dash.pattern, dash.offset), (vec![6.0, 3.0], 1.0));
+    assert_eq!(fill(&a[1]).color(), Some(Color::cmyk(0.1, 0.2, 0.3, 0.4)));
+    assert!(matches!(fill(&a[2]).color(), Some(Color::Gray { k }) if (k - 0.3).abs() < 1e-6));
+    assert!(!matches!(&a[2].kind, NodeKind::Path { path, .. } if path.subpaths[0].closed), "F leaves the path open");
+    let Paint::Solid { swatch, tint, .. } = fill(&a[3]) else { panic!() };
+    assert_eq!(swatch.as_deref(), Some("Ink"));
+    assert!((tint - 0.6).abs() < 1e-6);
+    let ink = doc.swatch("Ink").unwrap();
+    assert!(ink.spot && ink.global);
+    // Curves: `c`, `v` (first control at the current point) and `y` (second at the end).
+    let NodeKind::Path { path, .. } = &a[4].kind else { panic!() };
+    assert_eq!(path.subpaths[0].anchors.len(), 4);
+    assert!(a[4].appearance.fill().is_none() && a[4].appearance.stroke().is_some());
+}
+
+#[test]
+fn compound_paths_and_clipping() {
+    let art_ = format!(
+        "0 Ae\n*u\n{RED}{}f\n{}f\n*U\n%_/ArtDictionary :\n%_/XMLUID : (Donut) ; (AI10_ArtUID) ,\n%_;\n\
+         0 Ae\nq\n{}f\n{}h\nW\nn\nQ\n%_/ArtDictionary :\n%_/XMLUID : (Clipped) ; (AI10_ArtUID) ,\n%_;\n9 () XW\n",
+        rect_path(0.0, 0.0, 30.0, 30.0),
+        rect_path(10.0, 10.0, 20.0, 20.0),
+        rect_path(40.0, 0.0, 80.0, 40.0),
+        rect_path(50.0, 10.0, 60.0, 20.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let a = art(&doc);
+    let NodeKind::Compound { children, .. } = &a[0].kind else { panic!("{:?}", a[0].kind) };
+    assert_eq!((children.len(), a[0].name.as_deref()), (2, Some("Donut")));
+    assert_eq!(fill(&a[0]).color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+    let NodeKind::Group { children, clip: true } = &a[1].kind else { panic!("a clipping group") };
+    assert_eq!(a[1].name.as_deref(), Some("Clipped"));
+    // The clipping path goes first.
+    assert!(matches!(children[0].kind, NodeKind::Path { clipping: true, .. }));
+    assert!(matches!(children[1].kind, NodeKind::Path { clipping: false, .. }));
+    // A clipping path in a layer clips the layer.
+    let doc = read_ok(&layer(&format!("{}f\n{}W\nn\n", rect_path(0.0, 0.0, 9.0, 9.0), rect_path(0.0, 0.0, 5.0, 5.0)))).doc;
+    let NodeKind::Layer { clip, children, .. } = &doc.layers[0].kind else { panic!() };
+    assert!(*clip && matches!(children[0].kind, NodeKind::Path { clipping: true, .. }));
+}
+
+#[test]
+fn transparency_of_objects_and_groups() {
+    let art_ = format!(
+        "{RED}1 0.5 0 0 0 Xy\n{}f\n0 Ae\nu\n0 1 0 0 0 Xy\n{}f\nU\n2 0.7 1 1 0 Xy\n0 0 Xd\n6 () XW\n0 1 0 0 0 Xy\n{}f\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(20.0, 0.0, 30.0, 10.0),
+        rect_path(40.0, 0.0, 50.0, 10.0),
+    );
+    let doc = read_ok(&layer(&art_)).doc;
+    let a = art(&doc);
+    assert_eq!((a[0].opacity, a[0].blend), (0.5, BlendMode::Multiply));
+    assert_eq!((a[1].opacity, a[1].blend, a[1].isolate, a[1].knockout), (0.7, BlendMode::Screen, true, Knockout::On));
+    let inner = &a[1].children().unwrap()[0];
+    assert_eq!(inner.opacity, 1.0);
+    assert_eq!((a[2].opacity, a[2].blend), (1.0, BlendMode::Normal), "the next object's state isn't the group's");
+}
+
+#[test]
+fn gradients() {
+    let defs = "%AI5_BeginGradient: (G)\n(G) 1 2 Bd\n[\n<00FF>\n0\n0 0 0 0 1 0 0 2 1 6 %_BS\n\
+                %_0 0 0 0 1 0 0 2 1 6 40 0 Bs\n%_0 0 0 0 0 0 1 2 0.5 6 50 100 Bs\nBD\n%AI5_EndGradient\n";
+    let art_ = format!(
+        "{RED}{}Bb\n0 0 0 0 Bh\n1 (G) 0 0 0 1 1 0 0 1 0 0 1 Bg\n50 0 0 -50 100 50 Bm\nf\n0 BB\n{}f\n",
+        rect_path(50.0, 0.0, 150.0, 100.0),
+        rect_path(0.0, 0.0, 10.0, 10.0),
+    );
+    let doc = read_ok(&format!("{defs}{}", layer(&art_))).doc;
+    let a = art(&doc);
+    let Paint::Gradient(g) = fill(&a[0]) else { panic!("{:?}", fill(&a[0])) };
+    assert_eq!(g.gradient.kind, GradientKind::Radial);
+    assert_eq!(g.gradient.stops.len(), 2);
+    assert!((g.gradient.stops[0].midpoint - 0.4).abs() < 1e-6);
+    assert_eq!(g.gradient.stops[1].opacity, 0.5);
+    let geom = g.geom.unwrap();
+    assert_eq!((geom.start, geom.end), (Point::new(100.0, 50.0), Point::new(150.0, 50.0)));
+    // The gradient was the one object's.
+    assert_eq!(fill(&a[1]).color(), Some(Color::rgb(1.0, 0.0, 0.0)));
+}
+
+#[test]
+fn artboards() {
+    let data = "%_/Document :\n%_/Dictionary :\n%_/Array :\n\
+                %_/Dictionary :\n%_0 200 /RealPointRelToROrigin\n%_ (PositionPoint1) ,\n%_300 0 /RealPointRelToROrigin\n%_ (PositionPoint2) ,\n%_(One) /UnicodeString (Name) ,\n%_; ,\n\
+                %_/Dictionary :\n%_400 0 /RealPointRelToROrigin\n%_ (PositionPoint1) ,\n%_600 -150 /RealPointRelToROrigin\n%_ (PositionPoint2) ,\n%_; ,\n\
+                %_; (ArtboardArray) ,\n%_; /NotRecorded ,\n%_;\n";
+    let art_ = rect_path(420.0, -70.0, 470.0, -20.0) + "f\n";
+    let doc = read_ok(&format!("{data}{}", layer(&art_))).doc;
+    let boards: Vec<_> = doc.artboards.iter().map(|a| (a.name.clone(), a.rect)).collect();
+    assert_eq!(boards, [("One".to_string(), Rect::new(0.0, 0.0, 300.0, 200.0)), ("Artboard 2".to_string(), Rect::new(400.0, 200.0, 600.0, 350.0))]);
+    let NodeKind::Path { path, .. } = &art(&doc)[0].kind else { panic!() };
+    assert_eq!(path.bounds(), Some(Rect::new(420.0, 220.0, 470.0, 270.0)));
+    // Without artboards or crop marks: the art size around the template box's centre.
+    let old = format!(
+        "%!PS-Adobe-3.0\n%AI5_ArtSize: 600 400\n%AI3_TemplateBox: 300.5 199.5 300.5 199.5\n%%EndComments\n{}",
+        layer("10 10 m\n20 20 L\nS\n")
+    );
+    let doc = read(old.as_bytes()).unwrap().doc;
+    assert_eq!(doc.artboards[0].rect, Rect::new(0.0, 0.0, 600.0, 400.0));
+}
+
+#[test]
+fn a_drawn_look_stands_for_its_object() {
+    // The look (a group, with a part on `%_` lines for newer readers), then the object on `%_`
+    // lines and its style.
+    let hidden_rect = rect_path(0.0, 0.0, 10.0, 10.0).replace('\n', "\n%_");
+    let art_ = format!(
+        "0 Ae\nu\n%_0 Ae\n%_u\n%_{hidden_rect}S\n%_U\n{RED}{}f\n0 0 0 0 0 0 1 XA\n{}S\nU\n\
+         %_/ArtDictionary :\n%_/XMLUID : (Neon_00000092429200007574234970000005974767392385616558_) ; (AI10_ArtUID) ,\n%_;\n\
+         0 0.4 0 0 0 Xy\n0 0 Xd\n6 () XW\n%_{hidden_rect}n\n%_/ArtDictionary :\n%_/XMLUID : (Neon) ; (AI10_ArtUID) ,\n%_;\n1 (Neon style) XW\n\
+         0 1 0 0 0 Xy\n{}f\n",
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(0.0, 0.0, 10.0, 10.0),
+        rect_path(30.0, 0.0, 40.0, 10.0),
+    );
+    let r = read_ok(&layer(&art_));
+    let a = art(&r.doc);
+    assert_eq!(a.len(), 2, "{a:#?}");
+    assert_eq!(a[0].name.as_deref(), Some("Neon"));
+    assert_eq!(a[0].opacity, 0.4);
+    assert_eq!(a[0].children().unwrap().len(), 2, "the newer readers' part is left out");
+    assert!(r.warnings.iter().any(|w| w.contains("drawn look (1)")), "{:?}", r.warnings);
+}
+
+/// Editing data with one layer holding an image: `matrix` (`[a b c d tx ty]`), its size, colour
+/// space, kind and alpha channels, its samples, and the size the data comment declares.
+fn image(matrix: &str, (w, h): (u32, u32), (space, kind, alpha): (&str, u32, u32), data: &[u8], declared: usize) -> Vec<u8> {
+    let mut s = format!(
+        "%AI5_BeginLayer\n1 1 1 1 0 0 1 0 79 128 255 0 50 0 Lb\n(L) Ln\n%AI5_File:\n%AI5_BeginRaster\n() 1 XG\n/{space} XN\n{matrix} {w} {h} 0 Xh\n\
+         {matrix} 0 0 {w} {h} {w} {h} 8 {kind} {alpha} 0 1 0 4 4 0 0\n%%BeginData: {declared}\rXI\n"
+    )
+    .into_bytes();
+    s.extend_from_slice(data);
+    s.extend_from_slice(b"%%EndData\r\nXH\r\n%AI5_EndRaster\r\nN\r\nLB\r\n%AI5_EndLayer--\r\n");
+    let mut out = stream("").into_bytes();
+    let at = out.windows(14).position(|w| w == b"%%PageTrailer\n").unwrap();
+    out.splice(at..at, s);
+    out
+}
+
+fn pixels(doc: &Document) -> (image::RgbaImage, kurbo::Affine) {
+    let a = art(doc);
+    let NodeKind::Image(im) = &a[0].kind else { panic!("{:?}", a[0].kind) };
+    let blob = doc.images.get(&im.key).unwrap();
+    (image::load_from_memory(&blob.bytes).unwrap().to_rgba8(), im.xf)
+}
+
+#[test]
+fn images_with_alpha_channels() {
+    // RGB samples, then the alpha channel (not counted in the data's size).
+    let data = [255, 0, 0, 0, 255, 0, 255, 128];
+    let doc = read(&image("[ 10 0 0 10 50 90 ]", (2, 1), ("DeviceRGB", 3, 1), &data, 10)).unwrap().doc;
+    let (img, xf) = pixels(&doc);
+    assert_eq!((img.get_pixel(0, 0).0, img.get_pixel(1, 0).0), ([255, 0, 0, 255], [0, 255, 0, 128]));
+    // Pixel space (y down) to the top left at (50, 90) in art space: (50, 10) on the page.
+    assert_eq!(xf * Point::ZERO, Point::new(50.0, 10.0));
+    assert_eq!(xf * Point::new(2.0, 1.0), Point::new(70.0, 20.0));
+    // CMYK and grey.
+    let doc = read(&image("[ 1 0 0 1 0 100 ]", (1, 1), ("DeviceCMYK", 4, 0), &[0, 0, 0, 255], 6)).unwrap().doc;
+    let px = pixels(&doc).0.get_pixel(0, 0).0;
+    assert!(px[0] < 64 && px[3] == 255, "100% black is dark: {px:?}");
+    let doc = read(&image("[ 1 0 0 1 0 100 ]", (2, 1), ("DeviceGray", 1, 0), &[0, 200], 6)).unwrap().doc;
+    assert_eq!(pixels(&doc).0.get_pixel(1, 0).0, [200, 200, 200, 255]);
+    // Data cut short: the image goes, with a warning.
+    let r = read(&image("[ 1 0 0 1 0 100 ]", (4, 4), ("DeviceRGB", 3, 0), &[1, 2, 3], 6)).unwrap();
+    assert!(art(&r.doc).is_empty() && r.warnings.iter().any(|w| w.contains("cut short")));
+}
+
+#[test]
+fn text_objects_are_slots_named_after_their_story() {
+    let words = "/AI11Text :\n0 /FreeUndo ,\n0 /FrameIndex ,\n3 /StoryIndex ,\n;\n%_/ArtDictionary :\n%_/XMLUID : (Title) ; (AI10_ArtUID) ,\n%_;\n";
+    let r = read_ok(&layer(&format!("1 Xw\n{words}0 Xw\n")));
+    let a = art(&r.doc);
+    assert_eq!(slot_of(a[0].name.as_deref()), Some(Some(3)));
+    assert!(!a[0].visible);
+    assert_eq!(r.slot_names.get(&a[0].id).map(String::as_str), Some("Title"));
+    // A copy on `%_` lines of a story that has a plain text object goes; one without stays.
+    let commented = |story: u32| -> String { format!("/AI11Text :\n{story} /StoryIndex ,\n;\n").lines().map(|l| format!("%_{l}\n")).collect() };
+    let r = read_ok(&layer(&format!("/AI11Text :\n0 /StoryIndex ,\n;\n{}{}", commented(0), commented(1))));
+    let stories: Vec<_> = art(&r.doc).iter().map(|n| slot_of(n.name.as_deref())).collect();
+    assert_eq!(stories, [Some(Some(0)), Some(Some(1))]);
+}
+
+#[test]
+fn what_it_doesnt_read_is_an_error_where_it_shows() {
+    let e = read(stream(&layer("1 2 frobnicate\n")).as_bytes()).unwrap_err();
+    assert!(e.contains("`frobnicate`"), "{e}");
+    let e = read(stream(&layer("(Jive) 0 0 1 1 0 0 0 0 0 [1 0 0 1 0 0] p\n")).as_bytes()).unwrap_err();
+    assert!(e.contains("pattern fills"), "{e}");
+    let e = read(stream(&layer("/SymbolInstance :\n(Dot) /SymbolRef ,\n;\n")).as_bytes()).unwrap_err();
+    assert!(e.contains("symbols"), "{e}");
+    // On a layer that doesn't show, it is left out of it.
+    let hidden = "%AI5_BeginLayer\n0 1 1 1 0 0 0 1 255 79 79 0 50 0 Lb\n(Off) Ln\n1 2 frobnicate\n(J) 0 0 1 1 0 0 0 0 0 [1 0 0 1 0 0] p\nLB\n%AI5_EndLayer--\n";
+    let r = read_ok(hidden);
+    assert_eq!(r.hidden_unread.iter().cloned().collect::<Vec<_>>(), ["`frobnicate`", "pattern fills"]);
+    // Unbalanced containers, a layer that doesn't end, no layers.
+    assert!(read(stream(&layer("U\n")).as_bytes()).is_err());
+    assert!(read(stream("%AI5_BeginLayer\n(L) Ln\n0 Ae\nu\n").as_bytes()).is_err());
+    assert!(read(stream("").as_bytes()).is_err());
+    // The setup's procedures and what follows the page don't count.
+    read_ok(&format!("Adobe_level2_AI5 /initialize get exec\n{}", layer("")));
+}
+
+#[test]
+fn sections_it_skips() {
+    let body = "%AI5_Begin_NonPrinting\n%AI14_BeginSymbol\n0 Ae\nu\nfrobnicate\n%AI10_EndSymbol\n%AI3_BeginPattern: (P)\nU\nU\n%AI3_EndPattern\n%AI5_End_NonPrinting--\n\
+                %AI17_Begin_Content_if_version_gt:24 4\n%AI17_Alternate_Content\n%AI17_Begin_Content_if_version_gt:23 1\nfrobnicate\n%AI17_End_Versioned_Content\nfrobnicate\n%AI17_End_Versioned_Content\n\
+                %_/Document :\n%_/Binary : /ASCII85Decode ,\n%_(]<[%\n%;;;~>\n%_; (Profile) ,\n%_;\n";
+    let doc = read_ok(&format!("{body}{}", layer(&(rect_path(0.0, 0.0, 1.0, 1.0) + "f\n")))).doc;
+    assert_eq!(art(&doc).len(), 1);
+}
+
+#[test]
+fn cmyk_documents() {
+    let doc = read_ok(&format!("%AI9_ColorModel: 2\n{}", layer(""))).doc;
+    assert_eq!(doc.color_mode, ColorMode::Cmyk);
+}
+
+#[test]
+fn hostile_data_ends_without_panics() {
+    let deep = "0 Ae\nu\n".repeat(300) + &"U\n".repeat(300);
+    assert!(read(stream(&layer(&deep)).as_bytes()).unwrap_err().contains("nested too deeply"));
+    let keys = "/X :\n".repeat(300);
+    assert!(read(stream(&layer(&keys)).as_bytes()).is_err());
+    for junk in [
+        &b"%AI5_BeginLayer\n(\xff\xfe"[..],
+        b"%AI5_BeginLayer\n<zz",
+        b"]]]] [ [ ; , : : ;",
+        b"1e308 1e308 m 1e308 -1e308 L f",
+        b"%%BeginData: 5\rXI\n",
+    ] {
+        let _ = read(junk);
+    }
+    // Images with absurd sizes are left out.
+    let r = read(&image("[ 1 0 0 1 0 0 ]", (1 << 20, 1 << 20), ("DeviceRGB", 3, 0), &[0; 12], 12)).unwrap();
+    assert!(art(&r.doc).is_empty());
+}
+
+fn zstd(data: &[u8]) -> Vec<u8> {
+    ruzstd::encoding::compress_to_vec(data, ruzstd::encoding::CompressionLevel::Fastest)
+}
+
+/// An EPS whose page draws a line, and the editing data `packed` after it (`marker`: its codec).
+fn eps(marker: &str, packed: &[u8]) -> Vec<u8> {
+    let lines: String = crate::ps::ascii85(packed).lines().map(|l| format!("%{l}\n")).collect();
+    format!(
+        "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 200 100\n%%EndComments\n0 0 moveto 10 10 lineto stroke\nshowpage\n%%EOF\n\
+         %AI9_PrivateDataBegin\n%!PS-Adobe-3.0 EPSF-3.0\n%AI3_Cropmarks: 0 0 200 100\n%AI5_FileFormat 14.0\n{marker}\n{lines}%AI9_PrivateDataEnd\n"
+    )
+    .into_bytes()
+}
+
+#[test]
+fn eps_containers() {
+    let body = stream(&layer(&(rect_path(0.0, 0.0, 10.0, 10.0) + "f\n")));
+    let body = body.as_bytes();
+    for file in [eps("%AI24_DataStream", &zstd(body)), eps("%AI9_DataStream", &crate::ps::deflate(body))] {
+        let (ps, _) = crate::sections(&file).unwrap();
+        let data = eps_data(ps).unwrap().unwrap();
+        assert!(data.starts_with(b"%!PS-Adobe-3.0 EPSF-3.0\n%AI3_Cropmarks"), "the header comes first");
+        assert!(data.ends_with(body));
+        assert_eq!(read(&data).unwrap().doc.layers.len(), 1);
+    }
+    // Damaged data says why.
+    let (ps, _) = crate::sections(&eps("%AI24_DataStream", b"not zstd")).map(|(p, t)| (p.to_vec(), t.map(<[u8]>::to_vec))).unwrap();
+    assert!(eps_data(&ps).unwrap().unwrap_err().contains("Zstandard"));
+    // Data that isn't compressed is used as it is.
+    let plain = format!("%!PS-Adobe-3.0\n%%EOF\n%AI9_PrivateDataBegin\n{}%AI9_PrivateDataEnd\n", stream(&layer("")));
+    assert!(read(&eps_data(plain.as_bytes()).unwrap().unwrap()).is_ok());
+    // An EPS without editing data has none.
+    let other = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 10 10\n%%EndComments\n0 0 moveto 10 10 lineto stroke\nshowpage\n";
+    assert!(eps_data(other).is_none());
+}
+
+#[test]
+fn ai_private_data() {
+    let body = stream(&layer(""));
+    let body = body.as_bytes();
+    let header = b"%%BoundingBox: 0 0 1 1\r\n";
+    for raw in [
+        [&b"%AI24_ZStandard_Data"[..], &zstd(body)].concat(),
+        [&header[..], b"%AI12_CompressedData", &crate::ps::deflate(body)].concat(),
+        body.to_vec(),
+    ] {
+        let data = decode_private(&raw).unwrap();
+        assert!(data.ends_with(b"%%EOF\n"));
+        assert!(read(&data).is_ok());
+    }
+    assert!(decode_private(b"%AI12_CompressedDataxx").is_err());
+}
+
+#[test]
+fn many_zstandard_frames_are_read_in_one_pass_and_capped() {
+    let frame = zstd(b" ");
+    let frames = |n: usize| -> Vec<u8> { [&b"%AI24_ZStandard_Data"[..], &frame.repeat(n), &[0; 64]].concat() };
+    let started = std::time::Instant::now();
+    assert_eq!(decode_private(&frames(4000)).unwrap().len(), 4000);
+    assert!(decode_private(&frames(50_000)).unwrap_err().contains("Zstandard"));
+    assert!(started.elapsed() < std::time::Duration::from_secs(20), "{:?}", started.elapsed());
+}
+
+#[test]
+fn closing_brackets_without_their_opening_dont_rescan_the_stack() {
+    let n = 200_000;
+    let body = format!("{}\n{}\n", "1 ".repeat(n), "] ".repeat(n));
+    let started = std::time::Instant::now();
+    let _ = read(stream(&layer(&body)).as_bytes());
+    assert!(started.elapsed() < std::time::Duration::from_secs(20), "{:?}", started.elapsed());
+}

crates/eps/src/import/ate.rs

@@ -0,0 +1,552 @@
+//! The text of an Illustrator editing copy.
+//!
+//! The editing copy of a file keeps the characters of its text objects, with their fonts, sizes,
+//! colours and where they sit, in one text document of its own: between `%AI11_BeginTextDocument`
+//! and `%AI11_EndTextDocument`, ASCII85 of nested dictionaries with numbers for keys. A text object
+//! in a layer is only a stub naming its story in it (`/StoryIndex`).
+//!
+//! The format isn't documented. What is read here was worked out from the files of the project's
+//! users, used locally and never committed, by comparing it with the type their pages draw: the
+//! meaning of each key below was checked against the page's own type in more than a thousand text
+//! objects, and it is only used for the keys that matched. A story the reader doesn't recognise (area
+//! type, type on a path, anything with a frame that has more than a point and a matrix) is left
+//! alone: it has no text, and the importer says so.
+//!
+//! Where type sits: a story lays its lines out round a point `F` (the anchor: the start of a line of
+//! left-aligned type, the middle of a centred one, the end of a right-aligned one), each line with an
+//! offset from it. The frame of the story gives a matrix that carries that layout onto the canvas of
+//! the app, which is 16383 points a side; the canvas's centre, 8191.5, is the centre of the file's
+//! `%AI3_TemplateBox`. See [`Story::place`].
+
+use std::collections::BTreeMap;
+
+use vectorcraft_color::{Color, Paint};
+use vectorcraft_doc::{CharStyle, Justify, Node, NodeId, NodeKind, ParaStyle, TextObject, TextRun};
+use vectorcraft_geom::{Affine, Point};
+
+/// Longest story read (bytes).
+const MAX_STORY: usize = 1 << 20;
+/// Biggest text document read (bytes, decoded).
+const MAX_BYTES: usize = 64 << 20;
+/// Deepest nesting read.
+const MAX_DEPTH: usize = 64;
+/// Most values read.
+const MAX_VALUES: usize = 4_000_000;
+/// The centre of the app's canvas, in the units of its text document.
+const CANVAS_CENTRE: f64 = 8191.5;
+
+/// A value of the text document.
+#[derive(Debug, Clone, PartialEq)]
+pub(super) enum Val {
+    Num(f64),
+    Str(String),
+    Name(String),
+    Bool(bool),
+    List(Vec<Val>),
+    Dict(BTreeMap<String, Val>),
+}
+
+impl Val {
+    fn get(&self, key: &str) -> Option<&Val> {
+        match self {
+            Val::Dict(d) => d.get(key),
+            _ => None,
+        }
+    }
+
+    fn at(&self, i: usize) -> Option<&Val> {
+        match self {
+            Val::List(l) => l.get(i),
+            _ => None,
+        }
+    }
+
+    fn num(&self) -> Option<f64> {
+        match self {
+            Val::Num(n) if n.is_finite() => Some(*n),
+            _ => None,
+        }
+    }
+
+    fn str(&self) -> Option<&str> {
+        match self {
+            Val::Str(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    fn list(&self) -> &[Val] {
+        match self {
+            Val::List(l) => l,
+            _ => &[],
+        }
+    }
+
+    fn nums(&self) -> Option<Vec<f64>> {
+        self.list().iter().map(Val::num).collect()
+    }
+
+    /// The `name` entry of a dictionary that is a typed node (`/99 /name`).
+    fn is_node(&self, name: &str) -> bool {
+        matches!(self.get("99"), Some(Val::Name(n)) if n == name)
+    }
+}
+
+struct Reader<'a> {
+    b: &'a [u8],
+    at: usize,
+    budget: usize,
+}
+
+impl Reader<'_> {
+    fn skip_space(&mut self) {
+        while self.b.get(self.at).is_some_and(u8::is_ascii_whitespace) {
+            self.at += 1;
+        }
+    }
+
+    fn value(&mut self, depth: usize) -> Option<Val> {
+        self.skip_space();
+        self.budget = self.budget.checked_sub(1)?;
+        let c = *self.b.get(self.at)?;
+        match c {
+            b'<' if self.b.get(self.at + 1) == Some(&b'<') => {
+                if depth > MAX_DEPTH {
+                    return None;
+                }
+                self.at += 2;
+                let mut d = BTreeMap::new();
+                loop {
+                    self.skip_space();
+                    if self.b.get(self.at..self.at + 2) == Some(b">>") {
+                        self.at += 2;
+                        return Some(Val::Dict(d));
+                    }
+                    let key = self.key()?;
+                    let v = self.value(depth + 1)?;
+                    d.insert(key, v);
+                }
+            }
+            b'[' => {
+                if depth > MAX_DEPTH {
+                    return None;
+                }
+                self.at += 1;
+                let mut l = vec![];
+                loop {
+                    self.skip_space();
+                    if self.b.get(self.at) == Some(&b']') {
+                        self.at += 1;
+                        return Some(Val::List(l));
+                    }
+                    l.push(self.value(depth + 1)?);
+                }
+            }
+            b'(' => self.string(),
+            b'/' => Some(Val::Name(self.key()?)),
+            _ => {
+                let start = self.at;
+                while self.b.get(self.at).is_some_and(|c| !c.is_ascii_whitespace() && !matches!(c, b'<' | b'>' | b'[' | b']' | b'(' | b')' | b'/')) {
+                    self.at += 1;
+                }
+                let word = std::str::from_utf8(self.b.get(start..self.at)?).ok()?;
+                match word {
+                    "true" => Some(Val::Bool(true)),
+                    "false" => Some(Val::Bool(false)),
+                    "" => None,
+                    w => Some(Val::Num(w.parse().ok()?)),
+                }
+            }
+        }
+    }
+
+    /// A `/name`, without its slash.
+    fn key(&mut self) -> Option<String> {
+        self.skip_space();
+        if self.b.get(self.at) != Some(&b'/') {
+            return None;
+        }
+        self.at += 1;
+        let start = self.at;
+        while self.b.get(self.at).is_some_and(|c| !c.is_ascii_whitespace() && !matches!(c, b'<' | b'>' | b'[' | b']' | b'(' | b')' | b'/')) {
+            self.at += 1;
+        }
+        Some(String::from_utf8_lossy(self.b.get(start..self.at)?).into_owned())
+    }
+
+    /// A string: up to the first `)` that isn't escaped; UTF-16 when it starts with a byte order mark.
+    fn string(&mut self) -> Option<Val> {
+        self.at += 1;
+        let mut bytes = vec![];
+        loop {
+            let c = *self.b.get(self.at)?;
+            self.at += 1;
+            match c {
+                b')' => break,
+                b'\\' => {
+                    let e = *self.b.get(self.at)?;
+                    self.at += 1;
+                    bytes.push(match e {
+                        b'n' => b'\n',
+                        b'r' => b'\r',
+                        b't' => b'\t',
+                        b'b' => 8,
+                        b'f' => 12,
+                        b'0'..=b'7' => {
+                            let mut v = u32::from(e - b'0');
+                            for _ in 0..2 {
+                                match self.b.get(self.at) {
+                                    Some(d @ b'0'..=b'7') => {
+                                        v = v * 8 + u32::from(d - b'0');
+                                        self.at += 1;
+                                    }
+                                    _ => break,
+                                }
+                            }
+                            (v & 0xff) as u8
+                        }
+                        other => other,
+                    });
+                }
+                c => bytes.push(c),
+            }
+            if bytes.len() > MAX_BYTES {
+                return None;
+            }
+        }
+        Some(Val::Str(match bytes.strip_prefix(&[0xfe, 0xff]) {
+            Some(rest) => {
+                let units: Vec<u16> = rest.as_chunks::<2>().0.iter().map(|p| u16::from_be_bytes(*p)).collect();
+                String::from_utf16_lossy(&units)
+            }
+            None => bytes.iter().map(|b| char::from(*b)).collect(),
+        }))
+    }
+}
+
+/// The values of a text document: its top-level `/key value` pairs.
+fn read(bytes: &[u8]) -> Option<Val> {
+    let mut r = Reader { b: bytes, at: 0, budget: MAX_VALUES };
+    let mut d = BTreeMap::new();
+    loop {
+        r.skip_space();
+        if r.at >= bytes.len() {
+            return Some(Val::Dict(d));
+        }
+        let key = r.key()?;
+        let v = r.value(0)?;
+        d.insert(key, v);
+    }
+}
+
+/// How a paragraph's lines sit against its anchor.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Align {
+    Left,
+    Center,
+    Right,
+}
+
+/// The text of one story, in the units of the text document.
+#[derive(Debug)]
+pub(super) struct Story {
+    /// The characters, with `\r` ending paragraphs and `\x03` ending lines.
+    text: String,
+    /// The anchor of the layout.
+    anchor: (f64, f64),
+    /// Where each line starts, from the anchor.
+    lines: Vec<(f64, f64)>,
+    /// Carries the layout onto the canvas.
+    matrix: [f64; 6],
+    align: Align,
+    /// `(characters, style)` in order.
+    runs: Vec<(usize, Style)>,
+}
+
+#[derive(Clone, Debug)]
+struct Style {
+    font: Option<String>,
+    size: f64,
+    fill: Option<[f64; 4]>,
+    stroke: Option<[f64; 4]>,
+    stroke_width: f64,
+}
+
+/// The text document of an editing copy.
+pub(super) struct Texts {
+    stories: Vec<Val>,
+    fonts: Vec<String>,
+    /// The character style a story starts from.
+    defaults: Val,
+    frames: Vec<Val>,
+}
+
+impl Texts {
+    /// The text document in the editing copy `data`, if it has one that can be read.
+    pub(super) fn read(data: &[u8]) -> Option<Texts> {
+        fn find(h: &[u8], n: &[u8], from: usize) -> Option<usize> {
+            h.get(from..)?.windows(n.len()).position(|w| w == n).map(|p| p + from)
+        }
+        let start = find(data, b"%AI11_BeginTextDocument", 0)?;
+        let from = find(data, b"/ASCII85Decode", start)? + b"/ASCII85Decode".len();
+        let end = find(data, b"~>", from)? + 2;
+        // Each line after the first starts with a `%`.
+        // ASCII85 makes at most four bytes of a character (`z`): more than this would be over `MAX_BYTES`.
+        if end - from > MAX_BYTES / 4 {
+            return None;
+        }
+        let packed: String = String::from_utf8_lossy(data.get(from..end)?)
+            .split(['\r', '\n'])
+            .enumerate()
+            .map(|(i, l)| if i > 0 { l.strip_prefix('%').unwrap_or(l) } else { l })
+            .collect::<String>()
+            .trim_start_matches([' ', ','])
+            .to_string();
+        let bytes = crate::ps::ascii85_decode(&packed)?;
+        if bytes.len() > MAX_BYTES {
+            return None;
+        }
+        let doc = read(&bytes)?;
+        let fonts = doc
+            .get("0")?
+            .get("1")?
+            .get("0")?
+            .list()
+            .iter()
+            .map(|f| f.get("0").and_then(|f| f.get("0")).and_then(|f| f.get("0")).and_then(Val::str).unwrap_or_default().to_string())
+            .collect();
+        let main = doc.get("1")?;
+        Some(Texts {
+            stories: main.get("1")?.list().to_vec(),
+            fonts,
+            defaults: main.get("2")?.clone(),
+            frames: doc.get("0")?.get("8")?.get("0")?.list().to_vec(),
+        })
+    }
+
+    /// Story `i`, if it is one of point type this reads.
+    pub(super) fn story(&self, i: usize) -> Option<Story> {
+        let s = self.stories.get(i)?;
+        let text = s.get("0")?.get("0")?.str().filter(|t| t.len() <= MAX_STORY)?.to_string();
+        // The frame the story is in: a matrix and nothing else but its place.
+        let frame = self.frames.get(s.get("1")?.get("0")?.at(0)?.get("0")?.num()? as usize)?.get("0")?;
+        let carries = frame.get("2")?;
+        if carries.get("2").is_none() || carries.as_dict().is_some_and(|d| d.keys().any(|k| k != "2")) {
+            return None;
+        }
+        let matrix: [f64; 6] = carries.get("2")?.nums()?.try_into().ok()?;
+        let f = find_node(s.get("1")?.get("2")?, "F")?;
+        let anchor = f.get("0")?.get("0")?.nums()?;
+        let anchor = (*anchor.first()?, *anchor.get(1)?);
+        let mut lines = vec![];
+        let mut found = vec![];
+        find_nodes(f, "L", &mut found);
+        for l in found {
+            let off = l.get("0").and_then(|o| o.get("0")).and_then(Val::nums).unwrap_or_else(|| vec![0.0, 0.0]);
+            let seg = l.get("6")?.list().iter().find(|c| c.is_node("S"))?;
+            let so = seg.get("0").and_then(|o| o.get("0")).and_then(Val::nums).unwrap_or_else(|| vec![0.0, 0.0]);
+            lines.push((off.first()? + so.first()?, *off.get(1)?));
+        }
+        if lines.is_empty() {
+            return None;
+        }
+        let align = match s
+            .get("0")
+            .and_then(|t| t.get("5"))
+            .and_then(|p| p.get("0"))
+            .and_then(|p| p.at(0))
+            .and_then(|p| p.get("0"))
+            .and_then(|p| p.get("0"))
+            .and_then(|p| p.get("5"))
+            .and_then(|p| p.get("0"))
+            .and_then(Val::num)
+        {
+            Some(1.0) => Align::Right,
+            Some(2.0) => Align::Center,
+            _ => Align::Left,
+        };
+        let mut runs = vec![];
+        for run in s.get("0")?.get("6")?.get("0")?.list() {
+            let n = run.get("1")?.num()? as usize;
+            let style = run.get("0")?.get("0")?.get("6")?;
+            runs.push((n, self.style(style)));
+        }
+        Some(Story { text, anchor, lines, matrix, align, runs })
+    }
+
+    /// A character style: its own keys, else the document's.
+    fn style(&self, s: &Val) -> Style {
+        let pick = |k: &str| s.get(k).or_else(|| self.defaults.get(k));
+        let paint = |k: &str| -> Option<[f64; 4]> {
+            let p = pick(k)?.get("0")?;
+            // Kind 2 is CMYK: an opacity, then the four inks.
+            (p.get("0")?.num()? == 2.0).then(|| p.get("1")?.nums()).flatten().and_then(|v| Some([*v.get(1)?, *v.get(2)?, *v.get(3)?, *v.get(4)?]))
+        };
+        let on = |k: &str| !matches!(pick(k), Some(Val::Bool(false)));
+        let font = pick("0").and_then(Val::num).and_then(|i| self.fonts.get(i as usize)).filter(|f| !f.is_empty()).cloned();
+        Style {
+            font,
+            size: pick("1").and_then(Val::num).filter(|v| *v > 0.0).unwrap_or(12.0),
+            fill: if on("56") { Some(paint("53").unwrap_or([0.0, 0.0, 0.0, 1.0])) } else { None },
+            stroke: if matches!(pick("57"), Some(Val::Bool(true))) { paint("54") } else { None },
+            stroke_width: pick("63").and_then(Val::num).filter(|v| *v >= 0.0).unwrap_or(1.0),
+        }
+    }
+}
+
+impl Val {
+    fn as_dict(&self) -> Option<&BTreeMap<String, Val>> {
+        match self {
+            Val::Dict(d) => Some(d),
+            _ => None,
+        }
+    }
+}
+
+fn find_node<'a>(v: &'a Val, name: &str) -> Option<&'a Val> {
+    let mut out = vec![];
+    find_nodes(v, name, &mut out);
+    out.into_iter().next()
+}
+
+/// The typed nodes called `name` in `v`, in order, outermost first.
+fn find_nodes<'a>(v: &'a Val, name: &str, out: &mut Vec<&'a Val>) {
+    match v {
+        Val::Dict(d) => {
+            if v.is_node(name) {
+                out.push(v);
+            }
+            for x in d.values() {
+                find_nodes(x, name, out);
+            }
+        }
+        Val::List(l) => {
+            for x in l {
+                find_nodes(x, name, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Where a story's first line starts: on the canvas of the app (what [`Story::place`] gives).
+impl Story {
+    /// How many bytes of text the story has.
+    pub(super) fn len(&self) -> usize {
+        self.text.len()
+    }
+
+    /// The anchor of the story on the file's canvas: `(x, y)` in the units of the art, y up, given
+    /// the centre `(tx, ty)` of the file's template box.
+    pub(super) fn place(&self, template: (f64, f64)) -> (f64, f64) {
+        let [a, b, c, d, e, f] = self.matrix;
+        let (x, y) = (a * self.anchor.0 + c * self.anchor.1 + e, b * self.anchor.0 + d * self.anchor.1 + f);
+        (x - CANVAS_CENTRE + template.0, CANVAS_CENTRE + template.1 - y)
+    }
+
+    /// Each line's characters and where it starts (in the units of the art, y up): where the page
+    /// draws the line when the type is shown.
+    pub(super) fn line_starts(&self, template: (f64, f64)) -> Vec<(String, (f64, f64))> {
+        let [a, b, c, d, e, f] = self.matrix;
+        let text: Vec<&str> = self.text.split(['\r', '\x03']).collect();
+        self.lines
+            .iter()
+            .enumerate()
+            .map(|(i, (lx, ly))| {
+                let (x, y) = (self.anchor.0 + lx, self.anchor.1 + ly);
+                let (x, y) = (a * x + c * y + e, b * x + d * y + f);
+                (text.get(i).copied().unwrap_or_default().to_string(), (x - CANVAS_CENTRE + template.0, CANVAS_CENTRE + template.1 - y))
+            })
+            .collect()
+    }
+
+    /// The story as a text object whose anchor is at `at` on the document (`to_doc` takes the art's
+    /// units onto it), or `None` for type that is mirrored or has no size.
+    pub(super) fn node(&self, id: NodeId, template: (f64, f64), to_doc: Affine) -> Option<Node> {
+        let [a, b, c, d, ..] = self.matrix;
+        let scale = (a * d - b * c).abs().sqrt();
+        if !(scale.is_finite() && scale > 1e-6 && a * d - b * c > 0.0) {
+            return None;
+        }
+        let (x, y) = self.place(template);
+        let at = to_doc * Point::new(x, y);
+        let text: String = self.text.trim_end_matches('\r').chars().map(|c| if matches!(c, '\r' | '\x03') { '\n' } else { c }).collect();
+        if text.trim().is_empty() {
+            return None;
+        }
+        let leading = self.lines.windows(2).map(|w| (w[1].1 - w[0].1) * scale).find(|l| l.is_finite() && *l > 0.0);
+        let chars: Vec<char> = text.chars().collect();
+        let mut runs = vec![];
+        let mut from = 0usize;
+        let styles: Vec<&(usize, Style)> = self.runs.iter().collect();
+        for (n, st) in styles {
+            let to = from.saturating_add(*n).min(chars.len());
+            let piece: String = chars.get(from..to).unwrap_or_default().iter().collect();
+            from = to;
+            if piece.is_empty() {
+                continue;
+            }
+            runs.push(TextRun::new(piece, char_style(st, scale, leading)));
+        }
+        if from < chars.len() {
+            let last = self.runs.last().map(|r| &r.1)?;
+            runs.push(TextRun::new(chars.get(from..).unwrap_or_default().iter().collect::<String>(), char_style(last, scale, leading)));
+        }
+        if runs.is_empty() {
+            return None;
+        }
+        let mut t = TextObject::point(Point::ZERO, "", runs.first()?.style.clone());
+        t.runs = runs;
+        t.para = ParaStyle {
+            justify: match self.align {
+                Align::Left => Justify::Left,
+                Align::Center => Justify::Center,
+                Align::Right => Justify::Right,
+            },
+            ..ParaStyle::default()
+        };
+        t.xf = Affine::new([a / scale, b / scale, c / scale, d / scale, at.x, at.y]);
+        Some(Node::new(id, NodeKind::Text(Box::new(t))))
+    }
+}
+
+fn char_style(s: &Style, scale: f64, leading: Option<f64>) -> CharStyle {
+    let (family, style) = s.font.as_deref().map_or_else(|| (CharStyle::default().font_family, "Regular".to_string()), crate::family_style);
+    let family = vectorcraft_text::FontDb::global().find_family(&family).unwrap_or(family);
+    let ink = |c: [f64; 4]| Paint::solid(Color::cmyk(c[0] as f32, c[1] as f32, c[2] as f32, c[3] as f32));
+    CharStyle {
+        font_family: family,
+        font_style: style,
+        size: s.size * scale,
+        leading,
+        fill: s.fill.map_or(Paint::None, ink),
+        stroke: s.stroke.map_or(Paint::None, ink),
+        stroke_width: if s.stroke.is_some() { s.stroke_width * scale } else { 0.0 },
+        ..CharStyle::default()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn values_read_nested_dictionaries_lists_and_utf16_strings() {
+        let v = read(b" /1 << /0 [ 1 2.5 -3 ] /2 (\xfe\xff\x00h\x00i) /3 true /99 /Name >> /0 (a\\)b\\n)").unwrap();
+        let one = v.get("1").unwrap();
+        assert_eq!(one.get("0").unwrap().nums(), Some(vec![1.0, 2.5, -3.0]));
+        assert_eq!(one.get("2").unwrap().str(), Some("hi"));
+        assert_eq!(one.get("3"), Some(&Val::Bool(true)));
+        assert!(one.is_node("Name"));
+        assert_eq!(v.get("0").unwrap().str(), Some("a)b\n"));
+    }
+
+    #[test]
+    fn damaged_documents_are_not_read() {
+        for bad in [&b"/0 << /1"[..], b"/0 [ 1 2", b"/0 (abc", b"/0 nope", b"0 1"] {
+            assert!(read(bad).is_none(), "{}", String::from_utf8_lossy(bad));
+        }
+        let deep = format!("/0 {}", "[".repeat(200));
+        assert!(read(deep.as_bytes()).is_none());
+    }
+}

crates/eps/src/import/graphics.rs

@@ -35,8 +35,8 @@ const MAX_DRAWN: usize = 1 << 24;
 /// Samples taken of a shading function that isn't a plain interpolation.
 const SHADING_SAMPLES: usize = 32;
 
-const FAR_AWAY: &str = "objects far outside the page were left out";
-const TOO_MUCH: &str = "the file draws more than VectorCraft reads: the rest was left out";
+pub(super) const FAR_AWAY: &str = "objects far outside the page were left out";
+pub(super) const TOO_MUCH: &str = "the file draws more than VectorCraft reads: the rest was left out";
 const NESTED_PATTERNS: &str = "patterns nested too deeply are filled with mid-grey";
 /// Deepest patterns and glyph procedures drawn inside each other's art.
 pub(crate) const MAX_APART: u32 = 8;

crates/eps/src/import/mod.rs

@@ -10,6 +10,7 @@
 //! - `data`: data the program reads from itself through decoding filters, and images.
 //! - `text`: fonts by name and type as point type; Type 3 fonts' glyphs drawn by their procedures.
 //! - `preview`: the previews a file carries, for when its PostScript can't be read.
+//! - `native`: the layers of an Illustrator file, from the editing copy of its art that it carries.
 //!
 //! Clipped art comes in as clipping groups. In a file in the legacy Illustrator format (versions
 //! 3–8, with the prolog that defines its operators), the group operators `u` … `U` (nested) come in
@@ -24,10 +25,13 @@
 //! error, the operator and the procedures it ran in; without a preview, what was drawn before the
 //! error is kept (with that warning), else the file is refused.
 
+mod ai;
+mod ate;
 mod data;
 mod graphics;
 mod interp;
 mod lex;
+mod native;
 mod obj;
 mod preview;
 mod shading;
@@ -43,6 +47,8 @@ mod tests_generators;
 mod tests_illustrator;
 #[cfg(test)]
 mod tests_images;
+#[cfg(test)]
+mod tests_native;
 
 use std::sync::Arc;
 
@@ -55,6 +61,7 @@ use graphics::{GState, Out};
 use interp::{Fault, Interp};
 use obj::PsError;
 
+pub use native::{is_loss, layered_ai};
 pub use text::family_style;
 
 /// The page of a PostScript file without a bounding box (US Letter).
@@ -182,7 +189,7 @@ pub fn import(bytes: &[u8]) -> Result<Imported, String> {
     }
     let drew = !out.drawn.is_empty();
     let why = match (&result, drew) {
-        (Ok(()), true) => return Ok(finish(out)),
+        (Ok(()), true) => return Ok(native::layered(ps, finish(out))),
         (Ok(()), false) => "it draws nothing VectorCraft's PostScript reader can show".to_string(),
         (Err(e), _) => reason(e, fault.as_ref()),
     };
@@ -211,6 +218,16 @@ fn finish(mut out: Out) -> Imported {
     if !out.shadings.is_empty() {
         graphics::collapse(&mut children, &out.shadings);
     }
+    let mut layer = Node::layer(out.doc.alloc_id(), "Layer 1", LayerColor::Preset(0));
+    if let Some(c) = layer.children_mut() {
+        *c = children;
+    }
+    finish_with(out, vec![Arc::new(layer)])
+}
+
+/// The document of what `out` drew, as `layers`: the spot inks as spot swatches, in CMYK when
+/// most process colours were.
+fn finish_with(out: Out, layers: Vec<Arc<Node>>) -> Imported {
     let mut doc = out.doc;
     if out.cmyk > out.rgb {
         doc.color_mode = ColorMode::Cmyk;
@@ -227,10 +244,6 @@ fn finish(mut out: Out) -> Imported {
             doc.swatches.push(Swatch { paint: Paint::Pattern { pattern: name.clone(), xf: Affine::IDENTITY }, name, global: false, spot: false });
         }
     }
-    let mut layer = Node::layer(doc.alloc_id(), "Layer 1", LayerColor::Preset(0));
-    if let Some(c) = layer.children_mut() {
-        *c = children;
-    }
-    doc.layers = vec![Arc::new(layer)];
+    doc.layers = layers;
     Imported { document: doc, warnings: out.warnings, preview: false }
 }

crates/eps/src/import/native.rs

@@ -0,0 +1,828 @@
+//! The layers of an Illustrator EPS or `.ai`.
+//!
+//! Besides the page it prints, such a file carries the app's own copy of the art: an EPS after its
+//! `%%EOF`, a `.ai` in its `AIPrivateData` streams (see `ai` for the containers). It has what the
+//! page doesn't: the layers with their names and options, the groups, compound paths and clipping
+//! groups, the objects' names, the hidden objects and layers, the art outside the artboards and
+//! every artboard. `ai` reads that structure into a document, with the colours, gradients,
+//! transparency and images of the art.
+//!
+//! Text objects are slots in that document: their characters, fonts and places are in the file's
+//! text document (see `ate`). Type that shows comes from the page, which draws it, into the slot
+//! whose text is where the page has it. Type that doesn't show (a hidden layer or object, or off
+//! the page) is made from the text document; where that can't be read (area type, type on a path)
+//! it's left out, with a warning.
+//!
+//! What a layer that shows has that `ai` doesn't read makes the file come in as its page, as it did
+//! before; on a layer that doesn't show it is left out of that layer, with a warning. The page is
+//! also the safety net: when the layers' art looks different from it, the page is used.
+//!
+//! Where a file doesn't match what this module expects, it is left alone and its page is imported.
+
+use std::collections::BTreeSet;
+use std::sync::Arc;
+
+use vectorcraft_doc::{AppearanceItem, Document, Node, NodeId, NodeKind};
+use vectorcraft_geom::{Affine, Point, Rect, Vec2};
+
+use super::Imported;
+use super::ai::{self, Structure, slot_of};
+use super::ate::{Story, Texts};
+
+/// The notes that say the import left out something the file has (see [`is_loss`]).
+const TEXT_LEFT_OUT: &str = "text objects on hidden layers or hidden objects couldn't be read, so they are left out";
+const ART_LEFT_OUT: &str = "hidden layers have art this can't read";
+const LAYERS_UNREAD: &str = "the file's layers weren't read";
+
+/// Does this import note say that the file has something the document doesn't (hidden text, art or
+/// layers that could not be read)? Writing the document over the file would lose it for good.
+pub fn is_loss(note: &str) -> bool {
+    note.ends_with(TEXT_LEFT_OUT)
+        || [ART_LEFT_OUT, LAYERS_UNREAD, super::graphics::TOO_MUCH, super::graphics::FAR_AWAY].iter().any(|n| note.starts_with(n))
+}
+
+/// Most text objects in the layers, and most pieces of type in one place on the page, that are matched
+/// to each other (more than this and the layers aren't used).
+const MAX_SLOTS: usize = 5000;
+const MAX_PIECES: usize = 2000;
+/// Most bytes of text in the text objects of the layers (a story named twice counts twice).
+const MAX_TEXT: usize = 16 << 20;
+/// Most pairs of a text object and a piece of the page's type compared.
+const MAX_PAIRS: usize = 4_000_000;
+
+/// `names` for a note: the first few, and how many more.
+fn few(names: BTreeSet<String>) -> String {
+    const SHOWN: usize = 5;
+    let more = names.len().saturating_sub(SHOWN);
+    let mut list: Vec<String> = names.into_iter().take(SHOWN).collect();
+    if more > 0 {
+        list.push(format!("{more} more"));
+    }
+    list.join(", ")
+}
+
+/// A text slot of the layers.
+struct SlotInfo {
+    story: Option<u32>,
+    /// It, its layer and the objects round it show.
+    shown: bool,
+}
+
+/// The text slots of the layers and objects, in order.
+fn collect_slots(nodes: &[Arc<Node>], shown: bool, out: &mut Vec<SlotInfo>) {
+    for n in nodes {
+        let shown = shown && n.visible;
+        if let Some(story) = slot_of(n.name.as_deref()) {
+            out.push(SlotInfo { story, shown });
+        } else if let Some(c) = n.children().filter(|_| !matches!(n.kind, NodeKind::Compound { .. })) {
+            collect_slots(c, shown, out);
+        }
+    }
+}
+
+/// How far from a text object's own extent the strokes drawn around it reach (points).
+const OUTLINE_REACH: f64 = 6.0;
+
+/// Does `n` look like part of a text object's outline: a path with a stroke, inside `around`?
+fn outlines(n: &Node, around: Rect) -> bool {
+    matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. })
+        && n.appearance.items.iter().any(|i| matches!(i, AppearanceItem::Stroke(s) if s.visible && s.width > 0.0))
+        && n.visual_bounds().is_some_and(|b| {
+            let a = around.inflate(OUTLINE_REACH, OUTLINE_REACH);
+            b.x0 >= a.x0 && b.y0 >= a.y0 && b.x1 <= a.x1 && b.y1 <= a.y1
+        })
+}
+
+/// How far apart (points) the baselines of two text nodes may be for them to be on one line.
+const SAME_LINE: f64 = 0.5;
+
+/// Where `n`'s baseline lies across the direction it runs in (points), if it is text.
+fn baseline(n: &Node) -> Option<f64> {
+    let NodeKind::Text(t) = &n.kind else { return None };
+    let [a, b, _, _, e, f] = t.xf.as_coeffs();
+    let len = a.hypot(b);
+    (len > 1e-9).then(|| (a * f - b * e) / len)
+}
+
+/// The text objects the page paints, each as the run of nodes that make it up (its text, once for
+/// each fill and stroke it has, with the paths of its strokes), in painting order: those that
+/// show in `shown`, those of hidden layers and objects (a PDF has them) in `hidden`.
+fn text_objects(nodes: &[Arc<Node>], on: bool, shown: &mut Vec<Vec<Arc<Node>>>, hidden: &mut Vec<Vec<Arc<Node>>>) {
+    let is_text = |n: &Node| matches!(n.kind, NodeKind::Text(_));
+    let (mut i, mut free) = (0, 0);
+    while let Some(n) = nodes.get(i) {
+        if !is_text(n) {
+            if let Some(c) = n.children().filter(|_| !matches!(n.kind, NodeKind::Compound { .. })) {
+                text_objects(c, on && n.visible, shown, hidden);
+                free = i + 1;
+            }
+            i += 1;
+            continue;
+        }
+        let mut bounds = n.visual_bounds().unwrap_or_default();
+        let (mut start, mut end) = (i, i);
+        while start > free
+            && let Some(p) = nodes.get(start - 1)
+            && outlines(p, bounds)
+        {
+            start -= 1;
+            bounds = bounds.union(p.visual_bounds().unwrap_or_default());
+        }
+        while let Some(next) = nodes.get(end + 1)
+            && let Some(b) = next.visual_bounds()
+            && (is_text(next)
+                && !b.intersect(bounds.inflate(OUTLINE_REACH, OUTLINE_REACH)).is_zero_area()
+                && baseline(next)
+                    .zip(nodes.get(start..=end).unwrap_or_default().iter().find_map(|m| baseline(m)))
+                    .is_some_and(|(x, y)| (x - y).abs() <= SAME_LINE)
+                || outlines(next, bounds))
+        {
+            end += 1;
+            bounds = bounds.union(b);
+        }
+        let object = nodes.get(start..=end).unwrap_or_default().to_vec();
+        let into = if on && n.visible { &mut *shown } else { &mut *hidden };
+        into.push(object);
+        i = end + 1;
+        free = i;
+    }
+}
+
+/// `n` and what it holds with ids of `doc`.
+fn reid(doc: &mut Document, n: &Arc<Node>) -> Arc<Node> {
+    let mut n = n.as_ref().clone();
+    n.id = doc.alloc_id();
+    if let Some(children) = n.children_mut() {
+        for c in children.iter_mut() {
+            *c = reid(doc, c);
+        }
+    }
+    Arc::new(n)
+}
+
+/// The page's text objects given to each of `slots` text slots: in painting order, and when there
+/// are more of one than of the other (a label may be a few text objects, or one with several
+/// strokes), each goes where the share of the order it is at falls.
+fn assign(objects: &[Vec<Arc<Node>>], slots: usize) -> Vec<Vec<&[Arc<Node>]>> {
+    let mut given: Vec<Vec<&[Arc<Node>]>> = vec![vec![]; slots];
+    for (j, o) in objects.iter().enumerate() {
+        if let Some(at) = given.get_mut(((2 * j + 1) * slots / (2 * objects.len())).min(slots.saturating_sub(1))) {
+            at.push(o);
+        }
+    }
+    given
+}
+
+/// What goes into a text slot.
+enum Content {
+    /// Text objects (with the strokes round them) of the page.
+    Page(Vec<Arc<Node>>),
+    /// A text object made from the file's text document.
+    Made(Box<Node>),
+    /// Nothing the file lets this read.
+    Empty,
+    /// Its type is on the page with another text object's; there is nothing to put here.
+    Merged,
+}
+
+/// Replace the text slots in `nodes` with what `content` has for each, in order (a slot given none is
+/// left out): the page's type takes its place as it is, made type keeps the slot's name. `empty`
+/// counts those left out.
+fn fill_slots(
+    doc: &mut Document,
+    nodes: &mut Vec<Arc<Node>>,
+    content: &mut std::vec::IntoIter<Content>,
+    names: &std::collections::HashMap<NodeId, String>,
+    empty: &mut usize,
+) {
+    let mut i = 0;
+    while i < nodes.len() {
+        let Some(n) = nodes.get(i) else { break };
+        if slot_of(n.name.as_deref()).is_some() {
+            let visible = n.visible;
+            let name = names.get(&n.id);
+            let replacement = match content.next() {
+                Some(Content::Page(parts)) if !parts.is_empty() => {
+                    // The page's type (and the strokes round it) take the slot's place as they are.
+                    let parts: Vec<Arc<Node>> = parts
+                        .iter()
+                        .map(|p| {
+                            let mut p = reid(doc, p);
+                            if !visible {
+                                Arc::make_mut(&mut p).visible = false;
+                            }
+                            if let Some(name) = name.filter(|_| matches!(p.kind, NodeKind::Text(_))) {
+                                Arc::make_mut(&mut p).name = Some(name.clone());
+                            }
+                            p
+                        })
+                        .collect();
+                    let n = parts.len();
+                    nodes.splice(i..=i, parts);
+                    i += n;
+                    continue;
+                }
+                Some(Content::Made(mut text)) => {
+                    text.id = doc.alloc_id();
+                    text.visible = visible;
+                    text.name = Some(format!("{MADE}{}", name.map_or("", String::as_str)));
+                    Some(*text)
+                }
+                Some(Content::Merged) => {
+                    nodes.remove(i);
+                    continue;
+                }
+                _ => None,
+            };
+            match replacement {
+                Some(node) => {
+                    if let Some(slot) = nodes.get_mut(i) {
+                        *slot = Arc::new(node);
+                    }
+                    i += 1;
+                }
+                None => {
+                    *empty += 1;
+                    nodes.remove(i);
+                }
+            }
+        } else {
+            if n.children().is_some()
+                && !matches!(n.kind, NodeKind::Compound { .. })
+                && let Some(c) = nodes.get_mut(i).map(Arc::make_mut).and_then(Node::children_mut)
+            {
+                fill_slots(doc, c, content, names, empty);
+            }
+            i += 1;
+        }
+    }
+}
+
+/// How far, in points, the page's type may be from where the file's text document puts it for the
+/// two to be the same type.
+const SAME_PLACE: f64 = 0.75;
+
+/// Its letters and digits, which is what is compared of type (the page may spell a mark another way).
+fn letters(s: &str) -> String {
+    s.chars().filter(char::is_ascii_alphanumeric).collect()
+}
+
+/// Does `n` hold type that is where `story` lays one of its lines out: the line, or a piece of it
+/// (the page splits a line where its kerning or its styles change), on that line's baseline and
+/// after its start? How far from where the line starts it is, if so.
+fn same_type(n: &Node, lines: &[(String, Point)]) -> Option<f64> {
+    let NodeKind::Text(t) = &n.kind else { return None };
+    let have = letters(&t.plain_text());
+    let [a, b, _, _, e, f] = t.xf.as_coeffs();
+    let len = a.hypot(b);
+    if have.is_empty() || len < 1e-9 {
+        return None;
+    }
+    let (ux, uy) = (a / len, b / len);
+    // About how far a character of it advances, to say how far along a line a piece may be.
+    let advance = n.visual_bounds().map_or(0.0, |r| r.width().max(r.height())) / have.len() as f64;
+    lines
+        .iter()
+        .filter_map(|(text, at)| {
+            let line = letters(text);
+            let skipped = line.find(&have)?;
+            if skipped == 0 {
+                return Some(((at.x - e).powi(2) + (at.y - f).powi(2)).sqrt()).filter(|d| *d <= SAME_PLACE);
+            }
+            let (dx, dy) = (e - at.x, f - at.y);
+            let (along, across) = (dx * ux + dy * uy, (dx * uy - dy * ux).abs());
+            ((have.len() > 1 || skipped + 1 == line.len())
+                && across <= SAME_PLACE
+                && along >= -SAME_PLACE
+                && along <= line.len() as f64 * advance * 2.0 + 4.0)
+                .then_some(across + 0.001 * along)
+        })
+        .min_by(f64::total_cmp)
+}
+
+/// The page draws a line in pieces where its kerning or styles change ("swe", "ep"), and the file
+/// has it as one line of one text object: the pieces that on one baseline add up to a line of
+/// `lines` become one text (each keeping its own style, the line's spaces between them).
+fn join_pieces(parts: &mut Vec<Arc<Node>>, lines: &[(String, Point)]) {
+    let text_of = |n: &Arc<Node>| if let NodeKind::Text(t) = &n.kind { Some(t.plain_text()) } else { None };
+    let texts: Vec<usize> = parts.iter().enumerate().filter(|(_, n)| matches!(n.kind, NodeKind::Text(_))).map(|(i, _)| i).collect();
+    // A page with this many pieces of type in one place isn't one of lines of a story.
+    if texts.len() > MAX_PIECES {
+        return;
+    }
+    let mut taken = vec![false; parts.len()];
+    // The first piece of each line to join, the others, and the spaces to put after each piece.
+    let mut joins: Vec<(usize, Vec<usize>, Vec<String>)> = vec![];
+    for &i in &texts {
+        if taken.get(i).copied().unwrap_or(true) {
+            continue;
+        }
+        let Some(line) = parts.get(i).and_then(|n| baseline(n)) else { continue };
+        let group: Vec<usize> = texts
+            .iter()
+            .copied()
+            .filter(|j| {
+                !taken.get(*j).copied().unwrap_or(true) && parts.get(*j).and_then(|n| baseline(n)).is_some_and(|b| (b - line).abs() <= SAME_LINE)
+            })
+            .collect();
+        for j in &group {
+            if let Some(t) = taken.get_mut(*j) {
+                *t = true;
+            }
+        }
+        let pieces: Vec<String> = group.iter().filter_map(|j| parts.get(*j).and_then(text_of)).collect();
+        let places: Vec<(f64, f64)> = group
+            .iter()
+            .filter_map(|j| parts.get(*j))
+            .filter_map(|n| if let NodeKind::Text(t) = &n.kind { Some((t.xf.as_coeffs()[4], t.xf.as_coeffs()[5])) } else { None })
+            .collect();
+        let distinct = places.iter().enumerate().all(|(a, p)| places.iter().skip(a + 1).all(|q| (p.0 - q.0).hypot(p.1 - q.1) > 0.01));
+        let joined: String = pieces.iter().map(|p| letters(p)).collect();
+        if group.len() < 2 || !distinct || joined.is_empty() {
+            continue;
+        }
+        let Some((whole, _)) = lines.iter().find(|(text, _)| letters(text) == joined) else { continue };
+        // Where the line has spaces after a piece's last character that the page doesn't draw.
+        let line_chars: Vec<char> = whole.chars().collect();
+        let mut at = 0;
+        let mut gaps = vec![];
+        for (k, piece) in pieces.iter().enumerate() {
+            for _ in piece.chars().filter(|c| !c.is_whitespace()) {
+                while line_chars.get(at).is_some_and(|c| c.is_whitespace()) {
+                    at += 1;
+                }
+                at += 1;
+            }
+            let space: String = line_chars.iter().skip(at).take_while(|c| c.is_whitespace()).collect();
+            let next = pieces.get(k + 1);
+            let drawn = piece.ends_with(char::is_whitespace) || next.is_none_or(|n| n.starts_with(char::is_whitespace));
+            gaps.push(if drawn { String::new() } else { space });
+        }
+        if at <= line_chars.len() {
+            joins.push((group[0], group[1..].to_vec(), gaps));
+        }
+    }
+    let mut gone: BTreeSet<usize> = BTreeSet::new();
+    for (first, rest, gaps) in &joins {
+        let mut runs: Vec<Vec<vectorcraft_doc::TextRun>> = [first]
+            .into_iter()
+            .chain(rest)
+            .filter_map(|j| parts.get(*j))
+            .filter_map(|n| if let NodeKind::Text(t) = &n.kind { Some(t.runs.clone()) } else { None })
+            .collect();
+        for (r, gap) in runs.iter_mut().zip(gaps) {
+            if let Some(last) = r.last_mut() {
+                last.text.push_str(gap);
+            }
+        }
+        if let Some(node) = parts.get_mut(*first).map(Arc::make_mut)
+            && let NodeKind::Text(t) = &mut node.kind
+        {
+            t.runs = runs.into_iter().flatten().collect();
+            // The layout cached for the first piece is not this text's.
+            t.cached_bounds = None;
+            t.cached_baselines.clear();
+        }
+        gone.extend(rest);
+    }
+    // The pieces that went into a text, removed once the joins are done: removing as each is made
+    // would move the places of the pieces that the others still name.
+    let mut keep = 0;
+    parts.retain(|_| {
+        keep += 1;
+        !gone.contains(&(keep - 1))
+    });
+}
+
+/// The box round `parts`.
+fn extent(parts: &[Arc<Node>]) -> Option<Rect> {
+    parts.iter().filter_map(|n| n.visual_bounds()).reduce(|a, b| a.union(b))
+}
+
+/// What goes into each of `infos`' slots: the page's type that the file's text document puts where the
+/// page has it, else type made from the text document, else (for a file whose text document can't say)
+/// the page's type in painting order.
+fn plan(
+    infos: &[SlotInfo],
+    stories: &[Option<Arc<Story>>],
+    template: Option<(f64, f64)>,
+    to_doc: Affine,
+    pages: [&[Vec<Arc<Node>>]; 2],
+    warn: &mut Vec<String>,
+) -> Vec<Content> {
+    let [shown, hidden] = pages;
+    let lines: Vec<Option<Vec<(String, Point)>>> = stories
+        .iter()
+        .map(|s| {
+            let (s, t) = (s.as_ref()?, template?);
+            Some(s.line_starts(t).into_iter().map(|(text, (x, y))| (text, to_doc * Point::new(x, y))).collect())
+        })
+        .collect();
+    // The page's objects that are where a shown slot's lines are, nearest first.
+    let mut pairs: Vec<(f64, usize, usize)> = vec![];
+    for (k, info) in infos.iter().enumerate() {
+        let Some(l) = lines.get(k).and_then(Option::as_ref).filter(|_| info.shown) else { continue };
+        for (j, object) in shown.iter().enumerate() {
+            if let Some(d) = object.iter().filter_map(|n| same_type(n, l)).min_by(f64::total_cmp) {
+                pairs.push((d, k, j));
+            }
+        }
+    }
+    pairs.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let mut owner: Vec<Option<usize>> = vec![None; shown.len()];
+    for (_, k, j) in pairs {
+        if let Some(o) = owner.get_mut(j).filter(|o| o.is_none()) {
+            *o = Some(k);
+        }
+    }
+    // The file's text document is trusted where it agrees with the page about something, or where the
+    // page has no type to disagree with.
+    let trusted = owner.iter().any(Option::is_some) || shown.is_empty();
+    let readable = |k: usize| trusted && lines.get(k).is_some_and(Option::is_some);
+    let mut content: Vec<Content> = infos.iter().map(|_| Content::Empty).collect();
+    let mut spare: Vec<Vec<Arc<Node>>> = vec![];
+    for (j, object) in shown.iter().enumerate() {
+        match owner.get(j).copied().flatten().filter(|_| trusted) {
+            Some(k) => match content.get_mut(k) {
+                Some(Content::Page(p)) => p.extend(object.iter().cloned()),
+                Some(c) => *c = Content::Page(object.clone()),
+                None => {}
+            },
+            None => spare.push(object.clone()),
+        }
+    }
+    for (k, c) in content.iter_mut().enumerate() {
+        if let (Content::Page(parts), Some(Some(l))) = (c, lines.get(k)) {
+            join_pieces(parts, l);
+        }
+    }
+    // Type of the text document where the page has none: hidden type, and shown type off the page.
+    for (k, c) in content.iter_mut().enumerate() {
+        if matches!(c, Content::Empty)
+            && readable(k)
+            && let (Some(Some(story)), Some(t)) = (stories.get(k), template)
+            && let Some(node) = story.node(NodeId(0), t, to_doc)
+        {
+            *c = Content::Made(Box::new(node));
+        }
+    }
+    // What is left of the page goes by painting order into the shown slots the file can't say.
+    let loose: Vec<usize> = infos
+        .iter()
+        .enumerate()
+        .filter(|(k, i)| i.shown && matches!(content.get(*k), Some(Content::Empty)) && !readable(*k))
+        .map(|(k, _)| k)
+        .collect();
+    if loose.is_empty() {
+        // Type of the page that no text object says it owns goes with the nearest text object that has
+        // type of the page; with none, it is left out.
+        let mut left_out = false;
+        for object in &spare {
+            let (centre, near) = (extent(object).map(|r| r.center()), |c: &Content| match c {
+                Content::Page(parts) => extent(parts).map(|r| r.center()),
+                _ => None,
+            });
+            let nearest = content
+                .iter_mut()
+                .filter_map(|c| near(c).zip(centre).map(|(p, q)| ((p.x - q.x).hypot(p.y - q.y), c)))
+                .min_by(|a, b| a.0.total_cmp(&b.0));
+            match nearest {
+                Some((_, Content::Page(parts))) => parts.extend(object.iter().cloned()),
+                _ => left_out = true,
+            }
+        }
+        if !spare.is_empty() {
+            warn.push(
+                if left_out {
+                    "some of the page's type has no text object in the layers, so it is left out"
+                } else {
+                    "some of the page's type has no text object of its own in the layers, so it is with another's"
+                }
+                .into(),
+            );
+        }
+    } else {
+        for (slot, parts) in loose.iter().zip(assign(&spare, loose.len())) {
+            if let Some(c) = content.get_mut(*slot) {
+                // A text object the page shows as part of another's has nothing to hold of its own.
+                *c = if parts.is_empty() && !spare.is_empty() {
+                    Content::Merged
+                } else {
+                    Content::Page(parts.into_iter().flat_map(|p| p.iter().cloned()).collect())
+                };
+            }
+        }
+        if spare.len() != loose.len() {
+            warn.push("the text is on the layers in the order the page paints it, so a text object may be in another group than it was".into());
+        }
+    }
+    // The same for the slots that don't show.
+    let unread: Vec<usize> =
+        infos.iter().enumerate().filter(|(k, i)| !i.shown && matches!(content.get(*k), Some(Content::Empty))).map(|(k, _)| k).collect();
+    for (slot, parts) in unread.iter().zip(assign(hidden, unread.len())) {
+        if let Some(c) = content.get_mut(*slot) {
+            *c = Content::Page(parts.into_iter().flat_map(|p| p.iter().cloned()).collect());
+        }
+    }
+    content
+}
+
+/// `doc` with its layers that don't print hidden, when it has any.
+fn as_printed(doc: &Document) -> Option<Document> {
+    fn hide(nodes: &mut [Arc<Node>]) -> bool {
+        let mut any = false;
+        for n in nodes {
+            if matches!(n.kind, NodeKind::Layer { printable: false, .. }) && n.visible {
+                Arc::make_mut(n).visible = false;
+                any = true;
+            } else if matches!(n.kind, NodeKind::Layer { .. })
+                && let Some(c) = Arc::make_mut(n).children_mut()
+            {
+                any |= hide(c);
+            }
+        }
+        any
+    }
+    let mut d = doc.clone();
+    hide(&mut d.layers).then_some(d)
+}
+
+/// The lightness (0 to 255, Rec. 601 weights) of a premultiplied pixel seen on white.
+fn lightness(p: &[u8; 4]) -> u8 {
+    let on_white = |c: u8| u32::from(c) + 255 - u32::from(p[3]).min(255);
+    ((on_white(p[0]) * 299 + on_white(p[1]) * 587 + on_white(p[2]) * 114) / 1000).min(255) as u8
+}
+
+/// How much two documents draw differently (0 to 1), `a` on `ra` and `b` on `rb` (rectangles of
+/// the same size), each seen on white. Pixels are compared by lightness: the page of an RGB
+/// document is written in the colours' CMYK equivalents, and what the comparison looks for is art
+/// that is missing or out of place.
+fn difference(a: &Document, ra: Rect, b: &Document, rb: Rect) -> f64 {
+    // The page doesn't print what isn't printed.
+    let printed = as_printed(b);
+    let b = printed.as_ref().unwrap_or(b);
+    let scale = (400.0 / ra.width().max(ra.height()).max(1.0)).min(4.0);
+    let mut r = vectorcraft_render::Renderer::new();
+    // Drawn on nothing and then seen on white: blending modes have no page to blend with, as in
+    // the app that wrote the file.
+    let (x, y) = (r.render_region(a, ra, scale, false), r.render_region(b, rb, scale, false));
+    if x.width != y.width || x.height != y.height {
+        return 1.0;
+    }
+    let differing =
+        x.pixels.as_chunks::<4>().0.iter().zip(y.pixels.as_chunks::<4>().0).filter(|(p, q)| lightness(p).abs_diff(lightness(q)) > 48).count();
+    differing as f64 / (f64::from(x.width) * f64::from(x.height)).max(1.0)
+}
+
+/// More of the page than this differing between the layers' art and the page's own, and the
+/// layers aren't used.
+const MAX_DIFFERENCE: f64 = 0.05;
+/// More than this and the import says so.
+const NOTABLE_DIFFERENCE: f64 = 0.002;
+
+/// Which box of the editing copy is the page.
+#[derive(Clone, Copy)]
+enum Page {
+    /// An EPS's page is its art's bounding box.
+    Art,
+    /// A `.ai` is read on its (first and only) artboard.
+    Artboard,
+}
+
+/// The page (`visible`, the file read as its page) and the place of its area in the layers'
+/// document.
+struct Frame<'a> {
+    page: &'a Document,
+    /// The page's area in `page`.
+    page_rect: Rect,
+    /// The same area in the layers' document.
+    rect: Rect,
+}
+
+/// The document of the editing copy `data`, with the text (and strokes round it) of `visible`, the
+/// file read as its page, put in its text objects → the document, its notes and where the page is
+/// in it.
+fn build(data: &[u8], visible: &Document, page: Page) -> Result<(Document, Vec<String>, Rect), String> {
+    let Structure { mut doc, to_doc, bbox, artboard, template, hidden_unread, slot_names, warnings } = ai::read(data)?;
+    let art_box = match page {
+        Page::Art => bbox.map(|[a, b, c, d]| Rect::new(a, b, c, d)).ok_or("its editing data doesn't say where its art is")?,
+        Page::Artboard => artboard.ok_or("its editing data doesn't say where its artboard is")?,
+    };
+    let page_rect = visible.artboards.first().map(|a| a.rect).ok_or("it has no page")?;
+    if (art_box.width() - page_rect.width()).abs() > 0.5 || (art_box.height() - page_rect.height()).abs() > 0.5 {
+        return Err("its editing data is for a different page".into());
+    }
+    // The page's area in the layers' document, and the page's type moved there.
+    let rect = to_doc.transform_rect_bbox(art_box);
+    let shift = Affine::translate(Vec2::new(rect.x0 - page_rect.x0, rect.y0 - page_rect.y0));
+    let (mut shown, mut hidden) = (vec![], vec![]);
+    for l in &visible.layers {
+        if let Some(c) = l.children() {
+            text_objects(c, l.visible, &mut shown, &mut hidden);
+        }
+    }
+    for object in shown.iter_mut().chain(hidden.iter_mut()) {
+        for n in object.iter_mut() {
+            Arc::make_mut(n).transform(shift, false);
+        }
+    }
+    let mut infos = vec![];
+    collect_slots(&doc.layers, true, &mut infos);
+    if infos.iter().all(|i| !i.shown) && !shown.is_empty() {
+        return Err("its page has text, and its layers have no text objects to put it in".into());
+    }
+    // The page's type is compared with every text object of the layers: that has its limits.
+    if infos.len() > MAX_SLOTS || infos.len().saturating_mul(shown.len()) > MAX_PAIRS {
+        return Err("it has too many text objects".into());
+    }
+    let texts = Texts::read(data);
+    // Each story is read once, however many text objects name it.
+    let mut read: std::collections::BTreeMap<u32, Option<Arc<Story>>> = Default::default();
+    let stories: Vec<Option<Arc<Story>>> = infos
+        .iter()
+        .map(|i| {
+            let n = i.story?;
+            read.entry(n).or_insert_with(|| texts.as_ref().and_then(|t| t.story(n as usize)).map(Arc::new)).clone()
+        })
+        .collect();
+    if stories.iter().flatten().map(|s| s.len()).sum::<usize>() > MAX_TEXT {
+        return Err("it has too much text".into());
+    }
+    let template = template.map(|t| ((t[0] + t[2]) / 2.0, (t[1] + t[3]) / 2.0));
+    let mut notes = warnings;
+    let content = plan(&infos, &stories, template, to_doc, [&shown, &hidden], &mut notes);
+    let mut empty = 0;
+    let mut layers = std::mem::take(&mut doc.layers);
+    fill_slots(&mut doc, &mut layers, &mut content.into_iter(), &slot_names, &mut empty);
+    doc.layers = layers;
+    if empty > 0 {
+        notes.push(format!("{empty} {TEXT_LEFT_OUT}"));
+    }
+    if !hidden_unread.is_empty() {
+        notes.push(format!("{ART_LEFT_OUT} ({}), left out of them", few(hidden_unread)));
+    }
+    let frame = Frame { page: visible, page_rect, rect };
+    let unseen = prune_unseen(&frame, &mut doc);
+    if unseen > 0 {
+        notes.push(format!("{unseen} {UNSEEN_TEXT}"));
+    }
+    notes.extend(compare(&frame, &doc)?);
+    Ok((doc, notes, rect))
+}
+
+/// Marks (in a node's name, until [`prune_unseen`] has looked) the text objects made from the file's
+/// text document.
+const MADE: &str = "\u{1}made";
+/// How many such objects are weighed against the page (each takes a render of the page's size).
+const MAX_WEIGHED: usize = 12;
+/// The text objects the file keeps that the page doesn't draw.
+const UNSEEN_TEXT: &str = "text objects that the file keeps but its page doesn't draw (what is left of type turned to outlines) are left out";
+/// How much more of the page (0 to 1) the layers may differ without a text object and still look no worse.
+const UNSEEN_MARGIN: f64 = 5e-5;
+
+/// Clear the marks in `nodes` and say which marked objects show, by id.
+fn unmark(nodes: &mut [Arc<Node>], shown: bool, found: &mut Vec<(NodeId, Option<Rect>)>) {
+    for n in nodes {
+        let shown = shown && n.visible;
+        if let Some(name) = n.name.as_deref().and_then(|m| m.strip_prefix(MADE)) {
+            if shown {
+                found.push((n.id, n.visual_bounds()));
+            }
+            let name = (!name.is_empty()).then(|| name.to_string());
+            Arc::make_mut(n).name = name;
+        } else if !matches!(n.kind, NodeKind::Compound { .. })
+            && let Some(c) = Arc::make_mut(n).children_mut()
+        {
+            unmark(c, shown, found);
+        }
+    }
+}
+
+/// Take object `id` out of `nodes` (`hide`: leave it, hidden); whether it was there.
+fn take_out(nodes: &mut Vec<Arc<Node>>, id: NodeId, hide: bool) -> bool {
+    if let Some(i) = nodes.iter().position(|n| n.id == id) {
+        if hide {
+            if let Some(n) = nodes.get_mut(i) {
+                Arc::make_mut(n).visible = false;
+            }
+        } else {
+            nodes.remove(i);
+        }
+        return true;
+    }
+    nodes.iter_mut().any(|n| !matches!(n.kind, NodeKind::Compound { .. }) && Arc::make_mut(n).children_mut().is_some_and(|c| take_out(c, id, hide)))
+}
+
+/// The text objects made from the file's text document that show on the page's area, where the page
+/// has no type to match them, and that the layers look no worse without, are not drawn by the app
+/// that wrote the file (which paints every shown text object; it keeps the type of what was turned
+/// to outlines): they are taken out. How many.
+fn prune_unseen(frame: &Frame<'_>, doc: &mut Document) -> usize {
+    let mut found = vec![];
+    unmark(&mut doc.layers, true, &mut found);
+    let rect = frame.rect;
+    if found.is_empty() || found.len() > MAX_WEIGHED {
+        return 0;
+    }
+    let mut with = difference(frame.page, frame.page_rect, doc, rect);
+    let mut removed = 0;
+    for (id, bounds) in found {
+        if bounds.is_none_or(|b| b.intersect(rect).is_zero_area()) {
+            continue;
+        }
+        let mut without = doc.clone();
+        if !take_out(&mut without.layers, id, true) {
+            continue;
+        }
+        let d = difference(frame.page, frame.page_rect, &without, rect);
+        if d - with <= UNSEEN_MARGIN {
+            take_out(&mut doc.layers, id, false);
+            with = d;
+            removed += 1;
+        }
+    }
+    removed
+}
+
+/// Do the layers' art and the page's own look alike? An error says they don't; `Ok` has the note
+/// to give when they differ a little.
+fn compare(frame: &Frame<'_>, layered: &Document) -> Result<Option<String>, String> {
+    let diff = difference(frame.page, frame.page_rect, layered, frame.rect);
+    if diff > MAX_DIFFERENCE {
+        return Err(format!("the art on them differs from the page's in {:.0}% of it", diff * 100.0));
+    }
+    Ok((diff > NOTABLE_DIFFERENCE).then(|| {
+        format!(
+            "the art on the layers differs from the file's own page in about {:.1}% of it (brush strokes, live effects and the like that the layers' data doesn't describe)",
+            diff * 100.0
+        )
+    }))
+}
+
+/// The EPS `visible` (read as its page) read through its editing copy instead: its layers (the
+/// hidden ones too), groups, compound paths, clipping groups and artboards, with the text and the
+/// strokes around it of the page. When the file has no editing copy, `visible` as it was; when it
+/// has one that can't be used, `visible` with a warning that says why.
+pub(super) fn layered(ps: &[u8], visible: Imported) -> Imported {
+    let Some(data) = ai::eps_data(ps) else { return visible };
+    let result = data.and_then(|data| build(&data, &visible.document, Page::Art));
+    match result {
+        Ok((document, mut warnings, _)) => {
+            for w in &visible.warnings {
+                if !warnings.contains(w) {
+                    warnings.push(w.clone());
+                }
+            }
+            Imported { document, warnings, preview: false }
+        }
+        Err(why) => {
+            let mut v = visible;
+            v.warnings.push(format!("{LAYERS_UNREAD} ({why}): it comes in as its page, in one layer"));
+            v
+        }
+    }
+}
+
+/// The `.ai` `visible` (read as its PDF part) read through its editing copy (`private`, the joined
+/// `AIPrivateData` streams) instead, as [`layered`] reads an EPS: with the layers and objects of the
+/// file, its artboards, and the art that lies outside them, which its PDF part doesn't have.
+/// `warnings` are the notes of reading the PDF part; the notes returned are those, and the layers'.
+pub fn layered_ai(private: &[u8], visible: Document, warnings: Vec<String>) -> (Document, Vec<String>) {
+    let Ok(data) = ai::decode_private(private) else { return (visible, warnings) };
+    if !data.windows(15).any(|w| w == b"%AI5_BeginLayer") {
+        return (visible, warnings);
+    }
+    match build(&data, &visible, Page::Artboard) {
+        Ok((done, notes, _)) => {
+            let mut all = warnings;
+            all.extend(notes.into_iter().filter(|n| !all.contains(n)).collect::<Vec<_>>());
+            (done, all)
+        }
+        Err(why) => {
+            let mut all = warnings;
+            all.push(format!("{LAYERS_UNREAD} from its editing data ({why}): they come from its PDF part"));
+            (visible, all)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vectorcraft_doc::{CharStyle, TextObject};
+
+    fn piece(text: &str, x: f64, y: f64) -> Arc<Node> {
+        Arc::new(Node::new(NodeId(0), NodeKind::Text(Box::new(TextObject::point(Point::new(x, y), text, CharStyle::default())))))
+    }
+
+    /// Lines that the page draws in pieces, the pieces of one between those of the other, are each
+    /// joined, and only their own pieces go.
+    #[test]
+    fn interleaved_lines_are_joined_without_taking_each_others_pieces() {
+        let mut parts = vec![piece("He", 0.0, 0.0), piece("ab", 0.0, -20.0), piece("cd", 16.0, -20.0), piece("llo", 20.0, 0.0)];
+        let lines = [("Hello".to_string(), Point::new(0.0, 0.0)), ("abcd".to_string(), Point::new(0.0, -20.0))];
+        join_pieces(&mut parts, &lines);
+        let texts: Vec<String> = parts.iter().filter_map(|n| if let NodeKind::Text(t) = &n.kind { Some(t.plain_text()) } else { None }).collect();
+        assert_eq!(texts, ["Hello", "abcd"]);
+    }
+}