* security(anim): index slides and shapes once, share paragraph targets and motion paths
Custom-show resolution, timeline target lookup and by-paragraph builds scaled with the product
of two document-controlled counts, and paragraph expansion deep-copied the parsed motion path
into every effect.
- show_order / custom_indices resolve slide ids through one id->index map.
- Timeline::with indexes shapes once (same first-wins order as Slide::shape) for animation
targets and base colours, and records each animated shape's colour with a set.
- Paragraph targets are worked out once per shape and shared across its animations.
- Effects share their EffectSpec (and so the motion path) by Rc instead of cloning it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(anim): use Arc for EffectSpec to satisfy Sync and early return on empty animations
---------
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(pptx): harden import resource budgets, deduplication, and lookup caching
- Chart sidecars (Finding 2): Enforce an import-wide retained byte budget
and cache captured sidecars by chart part to prevent memory amplification.
- Content types cache (Finding 6): Cache parsed [Content_Types].xml defaults
and overrides in Package.ct_cache.
- Text run splitting and font lengths (Finding 8): Bound typeface attribute
lengths and cap paragraph runs to prevent multiplication on text splitting.
- Inner namespace decls (Finding 15): Use HashSet/HashMap indexing and cap
inner declarations to 1,000.
- Slide and notes deduplication (Finding 16): Deduplicate slide paths and
cache parsed notes slide bodies by target.
- Diagram media caching (Finding 22): Cache diagram media payloads in
imp.media_by_part.
- Master slide deduplication (Finding 28): Deduplicate master paths before
loading.
- Layout target deduplication (Finding 30): Deduplicate layout targets
across master slides.
- Chart value axis indexing (Finding 32): Index valAx by axId using a HashMap.
- ChartEx series output budget (Finding 34): Charge series point vectors
against an aggregate output budget and cap series count.
- ChartEx point allocation bounds (Finding 36): Allocate point vectors
only to actual point span bounded by budget rather than declared ptCount.
- SmartArt recursion depth (Finding 38): Limit SmartArt recursion depth to 8.
* fix(pptx): address review feedback on sidecar cache, series budget, and inner decls
* fix(pptx): preserve cached sidecar bytes and non-empty category fallback
- Row 31: Use HashMap for comment author lookup in author_slot
- Row 37: Index preserved parts by ID before resolving graphic frame relationships
- Row 10: Index kept chart parts by normalized path and avoid duplicate payload scans
- Row 39: Update existing relationship parts instead of appending duplicates in PackageOut
* fix(metafile): harden EMF+ parsing, clipping complexity, and memory accounting
- Row 72: Use checked tail slicing in comment header offset calculations
- Row 78: Break FillRects and DrawRects loops early when canvas is full
- Row 75: Pre-check dimensions in decode_compressed before RGBA pixel allocation
- Row 85: Account for EMF+ object table image/path memory against MAX_BYTES
- Row 42: Replace O(N^2) prefix copying in wrap_line with linear measurement
- Row 43 & 54: Share immutable clip regions Arc across placed items and charge canvas regions
- Row 48: Bound text transformation scale and glyph curve geometry in Picture::place and draw_text
- Row 52 & 68: Impose work budget bounds on Sutherland-Hodgman polygon clipping and bitmap masking
* fix(metafile): collapse nested if statement per clippy
Skipped where the receiver type is generic or not evident without a compiler (wrapping_neg, total_cmp, exists, to_vec, as_ref, split_first, Option::into_inner).
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Preserve current-main document and PDF behavior alongside the reviewed input, capture, font, ribbon and notice-packaging migration.
Validation: cargo xtask ci passed all eight stages, with 1,877 workspace tests and three doctests passed, six tests ignored, strict native lint and 23 WASM crates checked. Native GUI, platform and performance qualification remains separate.
ROADMAP.md: union of log rows. docs/animation-parity.md: main's header; the by-paragraph row from the PR, the triggers row from main; both revision rows.
skylartaylor