From bba31c17b6e3116916b46272cec906a90a054ff7 Mon Sep 17 00:00:00 2001 From: KnottyDyes <47539659+KnottyDyes@users.noreply.github.com> Date: Wed, 14 Oct 2026 11:17:34 -0600 Subject: [PATCH] PDF: report visible unembedded fonts in PDF/X-4 (#909) Track text state through graphics saves and drawn forms; exempt invisible text. Report font names and pages in export warnings and validation without embedding or outlining placed fonts. --- ROADMAP.md | 6 + apps/designcraft-cli/src/main.rs | 2 +- crates/pdf/src/pdfx.rs | 116 ++++++++++++++++++- crates/pdf/src/pdfx/fonts.rs | 172 +++++++++++++++++++++++++++++ crates/pdf/src/pdfx/fonts/tests.rs | 153 +++++++++++++++++++++++++ docs/agents.md | 10 ++ docs/file-format-parity.md | 11 +- docs/gaps.md | 15 ++- docs/target-app-parity.md | 12 +- 9 files changed, 489 insertions(+), 8 deletions(-) create mode 100644 crates/pdf/src/pdfx/fonts.rs create mode 100644 crates/pdf/src/pdfx/fonts/tests.rs diff --git a/ROADMAP.md b/ROADMAP.md index d3ef17e4..b3cc76a6 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -354,6 +354,12 @@ Newest first. - **2026-10-22** · macOS menu bar: the menus keep working after the interface language or Show CJK Features changes (a rebuilt menu bar lost every click, Quit included), and its key equivalents are the shortcuts in effect, so a shortcut moved in the Keyboard Shortcuts editor leaves its old menu item. No readiness percentage change. - **2026-10-22** · Paragraph rules: Rule Above's offset is measured from the first line's baseline to the rule's bottom edge, as in InDesign. Rules sat one ascent too high and crossed the previous paragraph's text (reported from an imported INDD document). No readiness percentage change. - **2026-10-21** · Ruler guides are selected like objects (#1282): a click with the Selection tools selects a guide (also where it crosses an object), Shift-click adds or removes one, a new guide from the rulers is selected, a marquee that touches no object selects the guides it crosses, and Edit › Select All Guides (⌥⌘G, `guide.selectAll`) selects every unlocked guide on the spread. Selected guides draw thicker in their layer's color, drag together (all of them shown moving), nudge with the arrow keys and go with Delete, each as one undo step (`guide.select`, `guide.deselect`, `guide.moveBy`, `guide.delete {}`). With one guide selected the Control bar's X (vertical guide) or Y (horizontal guide) field and Properties › Transform show where it is, as the rulers measure, and typing a value moves it there. No readiness percentage change. +- **2026-10-17** · PDF/X-4 export warns about fonts drawing visible text without an embedded + font program, including placed PDF forms; `validate-pdf` reports the font and page (#909). + Invisible OCR text is exempt. Detection only: fonts are not embedded or outlined automatically. + Repeated forms reuse context-aware font findings; a document-wide operation limit and a form-nesting depth limit + report incomplete checks instead of allowing excessive nested-form traversal. + No readiness percentage change. - **2026-10-16** · Selection: drag a column guide to move its gutter, as in InDesign (#1096). Both guides of the gutter move together and keep its width, stop at the neighbouring guides and the margins, and snap to the document grid, guides and objects, or with Shift to the ruler's tick marks; Escape cancels and the drag is one undo step. Locked column guides (the default) are not picked. A document page takes the result as its own columns; on a parent page it passes to the pages that follow it. `layout.moveColumnGuide` does the same over the control channel and MCP. No readiness percentage change. - **2026-10-16** · Layout: autoflow, inserted pages and new parents follow dragged column guides (#1096). Autoflow sets one frame per dragged column and counts the pages it adds from them; Insert Pages and New Parent keep the custom positions with the column count and gutter; a page that moves to the other side of the spine (inserted, deleted or moved pages, Duplicate Spread, a new parent's other page) has them mirrored across its margin box, as InDesign does; `document.inspect` reports each page's gutter, column rects and whether its columns are custom. No readiness percentage change. - **2026-10-16** · Layout: Margins and Columns keeps dragged column guides unless the column count or gutter changes (#1096). The dialog sends every field on OK, so a margin-only change re-divided the columns evenly. Margin changes keep the positions; the columns follow them only while they fit the margin box. No readiness percentage change. diff --git a/apps/designcraft-cli/src/main.rs b/apps/designcraft-cli/src/main.rs index 71e05a48..0c0a1526 100644 --- a/apps/designcraft-cli/src/main.rs +++ b/apps/designcraft-cli/src/main.rs @@ -39,7 +39,7 @@ use designcraft_engine::Session; use serde_json::{Value, json}; /// The usage block. Shared by `--help` (stdout, success) and an unknown command (stderr, failure). -const USAGE: &str = "usage: designcraft-cli run [--in FILE | --sample] [--cmd ID[=JSON]]... [--page N] [--scale S] [--pdf-options JSON] [--export OUT] [--all-pages DIR]\n (--page, --scale and --pdf-options apply to the exports that follow them)\n designcraft-cli commands [FILTER]\n designcraft-cli describe COMMAND\n designcraft-cli script [FILE|-] [--in FILE | --sample] [--connect PORT] [--save OUT] [--export OUT] [--keep-going]\n designcraft-cli app [--port PORT] COMMAND [JSON] | --method METHOD [JSON]\n designcraft-cli mcp [--connect PORT] [--sample] [--automation-read-root DIR] [--automation-write-root DIR]\n the two roots confine every file the agent's commands read (open, placed images, data sources, libraries) and\n write (save, export, package) to those folders, links followed. A root left out grants none of its access.\n They run the in-process server, so they conflict with --connect (a running app is not confined by them).\n designcraft-cli perf [--pages N] [--runs N] [--strict]\n designcraft-cli bench FILE [--runs N]\n designcraft-cli links\n designcraft-cli --version"; +const USAGE: &str = "usage: designcraft-cli run [--in FILE | --sample] [--cmd ID[=JSON]]... [--page N] [--scale S] [--pdf-options JSON] [--export OUT] [--all-pages DIR]\n (--page, --scale and --pdf-options apply to the exports that follow them)\n designcraft-cli commands [FILTER]\n designcraft-cli describe COMMAND\n designcraft-cli script [FILE|-] [--in FILE | --sample] [--connect PORT] [--save OUT] [--export OUT] [--keep-going]\n designcraft-cli app [--port PORT] COMMAND [JSON] | --method METHOD [JSON]\n designcraft-cli mcp [--connect PORT] [--sample] [--automation-read-root DIR] [--automation-write-root DIR]\n the two roots confine every file the agent's commands read (open, placed images, data sources, libraries) and\n write (save, export, package) to those folders, links followed. A root left out grants none of its access.\n They run the in-process server, so they conflict with --connect (a running app is not confined by them).\n designcraft-cli perf [--pages N] [--runs N] [--strict]\n designcraft-cli bench FILE [--runs N]\n designcraft-cli validate-pdf FILE.pdf # built-in PDF/X-4 checks (including visible unembedded fonts)\n designcraft-cli links\n designcraft-cli --version"; /// `script --help`: the script syntax, otherwise only in `describe script.run` and docs/agents.md. const SCRIPT_HELP: &str = r#"usage: designcraft-cli script [FILE|-] [--in FILE | --sample] [--connect PORT] [--save OUT] [--export OUT] [--keep-going] diff --git a/crates/pdf/src/pdfx.rs b/crates/pdf/src/pdfx.rs index 534886f1..3303ca87 100644 --- a/crates/pdf/src/pdfx.rs +++ b/crates/pdf/src/pdfx.rs @@ -10,6 +10,8 @@ use hayro_syntax::page::Resources; use crate::transitions::{find, int_after, object, rfind}; +mod fonts; + /// Escape a PDF literal string. fn lit(s: &str) -> String { let mut o = String::from("("); @@ -246,6 +248,7 @@ pub fn check_pdfx4(pdf: &[u8]) -> Vec { issues.push("Type 3 fonts aren't allowed".into()); } issues.extend(device_rgb(pdf)); + issues.extend(fonts::unembedded_fonts(pdf)); issues } @@ -480,7 +483,7 @@ mod tests { use crate::{ExportReport, PdfOptions, Standard, check_pdfx4, export_pdf_with_report}; - fn place(d: &mut Document, name: &str, data: Vec, size: (f64, f64), at: (f64, f64)) { + pub(super) fn place(d: &mut Document, name: &str, data: Vec, size: (f64, f64), at: (f64, f64)) { let asset = AssetId(d.alloc()); let mime = designcraft_images::mime(&data).into(); let pixels = designcraft_images::pixel_size(&data); @@ -579,7 +582,7 @@ mod tests { pdf.finish().unwrap() } - fn x4(d: &Document) -> ExportReport { + pub(super) fn x4(d: &Document) -> ExportReport { export_pdf_with_report(d, &Cache::new(), &PdfOptions { standard: Standard::PdfX4, ..Default::default() }).unwrap() } @@ -645,13 +648,18 @@ mod tests { /// A minimal PDF with a CMYK (N 4) PDF/X output intent and one page with `entries` (its /// resources, a group…) and `content`. fn tiny_pdf(entries: &str, content: &str) -> Vec { + tiny_pdf_with(entries, content, "<>\nstream\n\nendstream") + } + + /// [`tiny_pdf`] with `extra` as object 6 (an RGB profile in [`tiny_pdf`]). + pub(super) fn tiny_pdf_with(entries: &str, content: &str, extra: &str) -> Vec { let objects = [ "<>]>>".to_string(), "<>".to_string(), format!("<>"), "<>\nstream\n\nendstream".to_string(), format!("<>\nstream\n{content}\nendstream", content.len()), - "<>\nstream\n\nendstream".to_string(), + extra.to_string(), ]; let mut out = b"%PDF-1.6\n".to_vec(); let mut offsets = Vec::new(); @@ -682,6 +690,108 @@ mod tests { assert!(!cmyk.iter().any(rgb), "{cmyk:?}"); } + /// Every font that draws visible text must be embedded (#909): a base-14 font with no font + /// file, a CID font whose descendant has none, and one drawn from inside a form are reported; + /// an embedded font, an unused one and invisible text (render mode 3, as in OCR layers) are not. + #[test] + fn unembedded_fonts_are_flagged() { + let fonts = |entries: &str, content: &str| -> Vec { + check_pdfx4(&tiny_pdf(entries, content)).into_iter().filter(|i| i.contains("font")).collect() + }; + let helvetica = "/Resources<>>>>>"; + assert_eq!( + fonts(helvetica, "BT /F1 24 Tf 20 50 Td (Base14 text) Tj ET"), + ["the font Helvetica isn't embedded (page 1): PDF/X-4 needs every font used for visible text embedded"] + ); + assert!(fonts(helvetica, "BT /F1 24 Tf 3 Tr 20 50 Td (OCR) Tj ET").is_empty(), "invisible text needs no embedded font"); + assert!(fonts(helvetica, "0 0 0 1 k 0 0 10 10 re f").is_empty(), "an unused font is not reported"); + let restored = fonts(helvetica, "BT /F1 24 Tf q 3 Tr Q 20 50 Td (shown) Tj ET"); + assert_eq!(restored.len(), 1, "Q restores the visible render mode: {restored:?}"); + + let embedded = "/Resources<>>>>>>>"; + assert!(fonts(embedded, "BT /F1 12 Tf (x) Tj ET").is_empty()); + let cid = "/Resources<>>>]>>>>>>"; + assert_eq!(fonts(cid, "BT /F1 12 Tf <0001> Tj ET").len(), 1); + let cid_embedded = cid.replace("/FontName/KozMin>>", "/FontName/KozMin/FontFile3 6 0 R>>"); + assert!(fonts(&cid_embedded, "BT /F1 12 Tf <0001> Tj ET").is_empty()); + + let draw = "BT /T 9 Tf (in a form) Tj ET"; + let form = format!( + "<>>>>>/Length {}>>\nstream\n{draw}\nendstream", + draw.len() + ); + let pdf = tiny_pdf_with("/Resources<>>>", "/X1 Do", &form); + let issues: Vec = check_pdfx4(&pdf).into_iter().filter(|i| i.contains("font")).collect(); + assert_eq!(issues.len(), 1, "{issues:?}"); + assert!(issues[0].starts_with("the font Times-Roman isn't embedded"), "{issues:?}"); + } + + /// A placed PDF that draws with an unembedded font: the PDF/X-4 export warns about it (#909). + #[test] + fn placed_pdf_with_an_unembedded_font_is_reported() { + let mut d = Document::new(&NewDocument::default()); + let placed = tiny_pdf( + "/Resources<>>>>>", + "BT /F1 24 Tf 0 0 0 1 k 20 50 Td (Base14 text) Tj ET", + ); + place(&mut d, "helvetica.pdf", placed, (100.0, 100.0), (72.0, 72.0)); + let r = x4(&d); + assert!(r.warnings.iter().any(|w| w.starts_with("PDF/X-4: the font Helvetica isn't embedded (page 1)")), "{:?}", r.warnings); + } + + #[test] + fn unembedded_fonts_are_reported_by_every_text_show_operator() { + let entries = "/Resources<>>>>>"; + for show in ["(x) Tj", "[(x) 20 (y)] TJ", "(x) '", "0 0 (x) \""] { + let pdf = tiny_pdf(entries, &format!("BT /F1 12 Tf {show} ET")); + let issues = check_pdfx4(&pdf); + assert_eq!(issues.iter().filter(|i| i.contains("isn't embedded")).count(), 1, "{show}: {issues:?}"); + } + } + + #[test] + fn unembedded_fonts_in_forms_inherit_and_restore_text_state() { + let entries = "/Resources<>>>/XObject<>>>"; + let draw = "BT (inherited font) Tj /F1 10 Tf 3 Tr ET"; + let form = format!("<>\nstream\n{draw}\nendstream", draw.len()); + for (content, count) in [ + ("/F1 12 Tf /X1 Do", 1), + ("/F1 12 Tf 3 Tr /X1 Do", 0), + ("/F1 12 Tf 3 Tr /X1 Do 0 Tr /X1 Do", 1), + ("/F1 12 Tf /X1 Do BT (still visible) Tj ET", 1), + ] { + let pdf = tiny_pdf_with(entries, content, &form); + let issues = check_pdfx4(&pdf); + assert_eq!(issues.iter().filter(|i| i.contains("isn't embedded")).count(), count, "{content}: {issues:?}"); + } + } + + #[test] + fn unembedded_fonts_in_recursive_forms_are_bounded() { + let draw = "BT /F1 12 Tf (x) Tj ET /X1 Do"; + let form = format!( + "<>>>/XObject<>>>/Length {}>>\nstream\n{draw}\nendstream", + draw.len() + ); + let pdf = tiny_pdf_with("/Resources<>>>", "/X1 Do", &form); + let issues = check_pdfx4(&pdf); + assert_eq!(issues.iter().filter(|i| i.contains("isn't embedded")).count(), 1, "{issues:?}"); + } + + #[test] + fn unembedded_fonts_are_reported_after_form_text_state_is_restored() { + let entries = "/Resources<>>>/XObject<>>>"; + let draw = "BT /F2 10 Tf 3 Tr (hidden) Tj ET"; + let form = format!( + "<>>>>>/Length {}>>\nstream\n{draw}\nendstream", + draw.len() + ); + let pdf = tiny_pdf_with(entries, "/F1 12 Tf /X1 Do BT (visible) Tj ET", &form); + let issues: Vec = check_pdfx4(&pdf).into_iter().filter(|i| i.contains("isn't embedded")).collect(); + assert_eq!(issues.len(), 1, "{issues:?}"); + assert!(issues[0].starts_with("the font Helvetica isn't embedded"), "{issues:?}"); + } + /// An RGB blending space on the page group and an RGB inline image are device RGB too. #[test] fn rgb_groups_and_inline_images_are_flagged() { diff --git a/crates/pdf/src/pdfx/fonts.rs b/crates/pdf/src/pdfx/fonts.rs new file mode 100644 index 00000000..5dc149b7 --- /dev/null +++ b/crates/pdf/src/pdfx/fonts.rs @@ -0,0 +1,172 @@ +use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet}; + +use hayro_syntax::content::UntypedIter; +use hayro_syntax::object::{Array, Dict, Name, Object, ObjectIdentifier}; +use hayro_syntax::page::Resources; + +use super::MAX_DEPTH; + +#[cfg(test)] +mod tests; + +const MAX_OPERATIONS: usize = 100_000; +const LIMIT_WARNING: &str = "font scan operation limit reached: PDF/X-4 font embedding checks are incomplete"; +const DEPTH_WARNING: &str = "font scan nesting depth limit reached: PDF/X-4 font embedding checks are incomplete"; + +pub(super) fn unembedded_fonts(pdf: &[u8]) -> Vec { + let Ok(file) = hayro_syntax::Pdf::new(pdf.to_vec()) else { return Vec::new() }; + let mut found: BTreeMap> = BTreeMap::new(); + let mut scan = FontScan::default(); + for (i, page) in file.pages().iter().enumerate() { + scan.font = None; + scan.mode = 0; + if let Some(content) = page.page_stream() { + scan.content(content, page.resources(), 0); + } + for name in std::mem::take(&mut scan.found) { + found.entry(name).or_default().push(i + 1); + } + if scan.limited { + break; + } + } + let mut warnings: Vec = found + .into_iter() + .map(|(name, pages)| { + let list: Vec = pages.iter().take(10).map(|p| p.to_string()).collect(); + let more = if pages.len() > 10 { ", …" } else { "" }; + let s = if pages.len() == 1 { "" } else { "s" }; + format!("the font {name} isn't embedded (page{s} {}{more}): PDF/X-4 needs every font used for visible text embedded", list.join(", ")) + }) + .collect(); + if scan.limited { + warnings.push(LIMIT_WARNING.to_string()); + } + if scan.depth_limited { + warnings.push(DEPTH_WARNING.to_string()); + } + warnings +} + +fn font_embedded(font: &Dict<'_>) -> bool { + let descriptor = match font.get::>(b"Subtype").as_deref() { + Some(b"Type3") => return true, + Some(b"Type0") => { + font.get::>(b"DescendantFonts").and_then(|a| a.iter::>().next()).and_then(|d| d.get::>(b"FontDescriptor")) + } + _ => font.get::>(b"FontDescriptor"), + }; + descriptor.is_some_and(|d| d.contains_key(b"FontFile") || d.contains_key(b"FontFile2") || d.contains_key(b"FontFile3")) +} + +#[derive(Default)] +struct FontScan<'a> { + found: BTreeSet, + active: HashSet, + path: Vec, + completed: HashMap, BTreeSet>, + font: Option>, + mode: i32, + operations: usize, + limited: bool, + // A form nested too deeply to follow. The scan goes on (unlike `limited`), and the flag is + // never cleared, so a memoized subtree that was cut short can't hide it. + depth_limited: bool, +} + +// Forms inherit text state and missing resource names. Depth and ancestors also affect +// which descendants the depth/cycle guards permit; only identical contexts may share results. +#[derive(Hash, PartialEq, Eq)] +struct FormContext<'a> { + form: ObjectIdentifier, + font: Option<&'a [u8]>, + mode: i32, + resources: Vec<(&'a [u8], &'a [u8])>, + ancestors: Vec, +} + +impl<'a> FontScan<'a> { + fn content(&mut self, data: &[u8], res: &Resources<'a>, depth: usize) { + if depth > MAX_DEPTH { + return; + } + let mut saved = Vec::new(); + let mut ops = UntypedIter::new(data); + while let Some(op) = ops.next() { + if self.operations == MAX_OPERATIONS { + self.limited = true; + return; + } + self.operations += 1; + let operator: &[u8] = op.operator; + match operator { + b"q" => saved.push((self.font.clone(), self.mode)), + b"Q" => { + if let Some(state) = saved.pop() { + (self.font, self.mode) = state; + } + } + b"Tf" => self.font = op.operands().next().cloned().and_then(Object::into_name).and_then(|n| res.get_font(&n)), + b"Tr" => { + if let Some(mode) = op.operands().next().cloned().and_then(|n| i32::try_from(n).ok()) { + self.mode = mode; + } + } + b"Tj" | b"TJ" | b"'" | b"\"" if self.mode != 3 => { + if let Some(font) = self.font.as_ref().filter(|f| !font_embedded(f)) { + let name = font.get::>(b"BaseFont").map_or_else(|| "(unnamed)".to_string(), |n| n.as_str().to_string()); + self.found.insert(name); + } + } + b"Do" => { + let xo = op.operands().last().cloned().and_then(Object::into_name).and_then(|n| res.get_x_object(&n)); + if let Some(form) = xo.filter(|x| x.dict().get::>(b"Subtype").as_deref() == Some(b"Form")) + && (depth < MAX_DEPTH || { + // A form already being scanned is a cycle: it can't hide new content. + self.depth_limited |= !self.active.contains(&form.obj_id()); + false + }) + && self.active.insert(form.obj_id()) + { + let mut resources = Vec::new(); + let mut parent = Some(res); + while let Some(r) = parent { + resources.push((r.fonts.data(), r.x_objects.data())); + parent = r.parent(); + } + let key = FormContext { + form: form.obj_id(), + font: self.font.as_ref().map(Dict::data), + mode: self.mode, + resources, + ancestors: self.path.clone(), + }; + if let Some(found) = self.completed.get(&key) { + self.found.extend(found.iter().cloned()); + self.active.remove(&form.obj_id()); + continue; + } + let inner = Resources::from_parent(form.dict().get::>(b"Resources").unwrap_or_default(), res.clone()); + let state = (self.font.clone(), self.mode); + let outer_found = std::mem::take(&mut self.found); + self.path.push(form.obj_id()); + if let Ok(data) = form.decoded() { + self.content(&data, &inner, depth + 1); + } + self.path.pop(); + if !self.limited { + self.completed.insert(key, self.found.clone()); + } + self.found.extend(outer_found); + (self.font, self.mode) = state; + self.active.remove(&form.obj_id()); + if self.limited { + return; + } + } + } + _ => {} + } + } + } +} diff --git a/crates/pdf/src/pdfx/fonts/tests.rs b/crates/pdf/src/pdfx/fonts/tests.rs new file mode 100644 index 00000000..c148cb07 --- /dev/null +++ b/crates/pdf/src/pdfx/fonts/tests.rs @@ -0,0 +1,153 @@ +use std::time::{Duration, Instant}; + +use super::{DEPTH_WARNING, FontScan, LIMIT_WARNING, MAX_OPERATIONS, unembedded_fonts}; +use crate::check_pdfx4; +use crate::pdfx::tests::{place, tiny_pdf_with, x4}; +use designcraft_doc::{Document, build::NewDocument}; + +fn stream(entries: &str, content: &str) -> String { + format!("<<{entries}/Length {}>>\nstream\n{content}\nendstream", content.len()) +} + +fn fanout_pdf(levels: usize) -> Vec { + let mut objects = vec![ + "<>".to_string(), + "<>".to_string(), + "<>>>/Contents 4 0 R>>".to_string(), + stream("", "/Next Do"), + ]; + for level in 0..levels { + let resources = if level + 1 == levels { + "/Font<>>>".to_string() + } else { + format!("/XObject<>", level + 6) + }; + let content = if level + 1 == levels { "BT /F1 12 Tf (bottom) Tj ET".to_string() } else { "/Next Do\n".repeat(10) }; + objects.push(stream(&format!("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<<{resources}>>"), &content)); + } + pdf_objects(&objects) +} + +fn pdf_objects(objects: &[String]) -> Vec { + let mut bytes = b"%PDF-1.6\n".to_vec(); + let mut offsets = Vec::new(); + for (i, object) in objects.iter().enumerate() { + offsets.push(bytes.len()); + bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes()); + } + let xref = bytes.len(); + bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f\r\n", objects.len() + 1).as_bytes()); + for offset in offsets { + bytes.extend_from_slice(format!("{offset:010} 00000 n\r\n").as_bytes()); + } + bytes.extend_from_slice(format!("trailer\n<>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes()); + bytes +} + +#[test] +fn nested_form_fanout_is_memoized_and_reports_bottom_font() { + let bytes = fanout_pdf(16); + let pdf = hayro_syntax::Pdf::new(bytes.clone()).unwrap(); + let page = pdf.pages().first().unwrap(); + let mut scan = FontScan::default(); + let start = Instant::now(); + scan.content(page.page_stream().unwrap(), page.resources(), 0); + assert!(start.elapsed() < Duration::from_millis(500)); + assert_eq!(scan.operations, 155); + assert_eq!(scan.completed.len(), 16); + assert!(!scan.limited); + assert!(!scan.depth_limited); + assert_eq!(scan.found.into_iter().collect::>(), ["Helvetica"]); + assert!(check_pdfx4(&bytes).iter().any(|w| w.contains("Helvetica isn't embedded"))); +} + +#[test] +fn placed_pdf_nested_form_fanout_reports_unembedded_font() { + let mut doc = Document::new(&NewDocument::default()); + place(&mut doc, "fanout.pdf", fanout_pdf(14), (100.0, 100.0), (72.0, 72.0)); + let report = x4(&doc); + assert!(report.warnings.iter().any(|w| w.contains("Helvetica isn't embedded")), "{:?}", report.warnings); +} + +#[test] +fn form_memo_resolves_resource_names_in_each_parent_context() { + let wrapper = |font: &str| { + stream( + &format!("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<>>>>>"), + "/Shared Do", + ) + }; + let bytes = pdf_objects(&[ + "<>".into(), + "<>".into(), + "<>>>/Contents 4 0 R>>".into(), + stream("", "/A Do /B Do"), + wrapper("Helvetica"), + wrapper("Times-Roman"), + stream("/Type/XObject/Subtype/Form/BBox[0 0 100 100]", "BT /F1 12 Tf (shared) Tj ET"), + ]); + let issues = unembedded_fonts(&bytes); + assert_eq!(issues.len(), 2, "{issues:?}"); + assert!(issues.iter().any(|w| w.contains("Helvetica isn't embedded"))); + assert!(issues.iter().any(|w| w.contains("Times-Roman isn't embedded"))); +} + +#[test] +fn form_memo_replays_font_findings_on_each_page() { + let page = "<>>>/Contents 5 0 R>>"; + let bytes = pdf_objects(&[ + "<>".into(), + "<>".into(), + page.into(), + page.into(), + stream("", "/Shared Do"), + stream( + "/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<>>>>>", + "BT /F1 12 Tf (shared) Tj ET", + ), + ]); + let issues = unembedded_fonts(&bytes); + assert_eq!(issues.len(), 1, "{issues:?}"); + assert!(issues[0].contains("(pages 1, 2)"), "{issues:?}"); +} + +#[test] +fn form_memo_keeps_inherited_font_and_resource_contexts_distinct() { + let draw = "BT (inherited) Tj /F1 12 Tf (resource) Tj ET"; + let form = stream("/Type/XObject/Subtype/Form/BBox[0 0 100 100]", draw); + let entries = "/Resources<>/F2<>>>/XObject<>>>"; + let bytes = tiny_pdf_with(entries, "/F1 12 Tf /X1 Do /F2 12 Tf /X1 Do", &form); + let issues = unembedded_fonts(&bytes); + assert_eq!(issues.len(), 2, "{issues:?}"); + assert!(issues.iter().any(|w| w.contains("Times-Roman isn't embedded"))); +} + +#[test] +fn font_scan_operation_budget_warns_instead_of_silently_truncating() { + let content = "q Q\n".repeat(MAX_OPERATIONS); + let bytes = tiny_pdf_with("/Resources<<>>", &content, "<<>>"); + assert_eq!(unembedded_fonts(&bytes), [LIMIT_WARNING]); +} + +#[test] +fn font_scan_depth_limit_warns_instead_of_silently_truncating() { + // The font is two levels below the deepest form followed, and every level draws the next + // ten times: memo replays of the cut-short subtree still give one warning. + assert_eq!(unembedded_fonts(&fanout_pdf(18)), [DEPTH_WARNING]); +} + +#[test] +fn font_scan_cycles_are_not_reported_as_incomplete() { + let font = "/Font<>>>"; + let bytes = pdf_objects(&[ + "<>".to_string(), + "<>".to_string(), + "<>>>/Contents 4 0 R>>".to_string(), + stream("", "/A Do"), + stream(&format!("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<<{font}/XObject<>>>"), "BT /F1 12 Tf (a) Tj ET /B Do"), + stream("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<>>>", "/A Do /B Do"), + ]); + let warnings = unembedded_fonts(&bytes); + assert_eq!(warnings.len(), 1, "{warnings:?}"); + assert!(warnings[0].contains("Helvetica isn't embedded"), "{warnings:?}"); +} diff --git a/docs/agents.md b/docs/agents.md index 2b8d6e51..566357fb 100644 --- a/docs/agents.md +++ b/docs/agents.md @@ -63,6 +63,16 @@ The image must contain at most 16 million pixels. PDF/SVG graphics are unsupport not Adobe's palette algorithm. In the UI, click an image with the Color Theme Tool (Shift+I), or choose Color Theme… in the Swatches panel menu with one image selected. Cancel keeps the document unchanged. +## PDF/X-4 validation + +`designcraft-cli validate-pdf FILE.pdf` prints JSON with `valid` and `issues`, and exits non-zero +when a built-in check fails. Checks cover PDF version, output intent and profile, Info and XMP +identification, image interpolation, encryption, trim boxes, Type 3 fonts, device RGB under a CMYK +output intent, and unembedded fonts drawing visible text (including placed PDF forms). Render +mode 3 (invisible OCR text) is exempt from the font-embedding check. PDF/X-4 export reports these +issues as warnings; it does not embed or outline placed fonts. These checks are not a complete +external PDF/X certification. + ## Data merge `data.source.select {path, sheet?}` links a CSV/TSV/`.xlsx` file to the document (`data.source.update` re-reads it, diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md index 381498fb..2a05973a 100644 --- a/docs/file-format-parity.md +++ b/docs/file-format-parity.md @@ -1,6 +1,6 @@ # File format parity -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-15 · **Change:** minor (IDML liquid guide types, #872; .indd and .indt open through indd-utils; XLSX cached values preserve numeric precision and text; shared print spooler; Windows CI passes; content-indexed asset deduplication, #727) · **Target:** Adobe InDesign 2026 (21.6) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-19 · **Change:** minor (PDF/X-4 visible unembedded font detection, #909; IDML liquid guide types, #872; .indd and .indt open through indd-utils; XLSX cached values preserve numeric precision and text; shared print spooler; Windows CI passes; content-indexed asset deduplication, #727) · **Target:** Adobe InDesign 2026 (21.6) Every format InDesign 2026 reads or writes, with DesignCraft's support, fidelity and tests. The InDesign list comes from its bundle's `Info.plist` (`CFBundleDocumentTypes`, @@ -55,6 +55,14 @@ layer survive interchange; literal XML and round-trip tests are in | Print / PostScript | | ✓ printers, PPDs, separations | ~ PDF to CUPS/Windows (craft-print; no PostScript) | | 3% | | Package | folder | ✓ fonts, links, IDML, PDF, report | ✓ (#340: IDML inside links to absolute paths) | | 2% | +PDF/X-4 export warns about unembedded fonts that draw visible text, including inside placed PDF +forms; `designcraft-cli validate-pdf FILE.pdf` reports the same issues, with font names and pages +(#909). Invisible text (render mode 3) is exempt from this font-embedding check. Detection does not +automatically embed or outline fonts; embedding, substitution or outlining of placed-PDF fonts +remains missing. A document-wide operation limit and a form-nesting depth limit report incomplete +font checks rather than traversing pathological nesting. These built-in checks are not complete +external PDF/X certification. + ## Placed and imported content | Format | Ext | InDesign | DesignCraft | Notes | Weight | @@ -114,6 +122,7 @@ up to 30 points. | Date | Change | Summary | |---|---|---| +| 2026-10-19 | minor | PDF/X-4 export and `validate-pdf` report visible unembedded fonts by name and page, including placed forms; invisible text is exempt, operation- or depth-limited checks report incompleteness, and automatic font repair remains missing (#909) | | 2026-10-15 | minor | IDML retains liquid versus ruler guide types on document and parent pages, with literal XML and mixed-guide round-trip coverage; object liquid constraints remain unsupported (#872) | | 2026-10-13 | minor | Asset loading and compaction use content fingerprints with exact equality checks; tests cover equal-sized distinct buffers, shared copies, independent links and missing data (#727) | | 2026-10-13 | minor | `.indd` and `.indt` read through storytold/indd-utils; INDD remaining work is a real-file corpus (10–30 h); score unchanged until it is measured | diff --git a/docs/gaps.md b/docs/gaps.md index 5738d14c..1076f621 100644 --- a/docs/gaps.md +++ b/docs/gaps.md @@ -1,6 +1,6 @@ # Where DesignCraft falls short of InDesign -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (gap 6 shrunk: Type › Reload Fonts reads fonts installed, edited or removed while running (#328); gap 3: Package links are relative, #340; gap 27 closed: the loaded text cursor threads into a frame inside a group (#1075); .indd and .indt open through indd-utils; gap 0 shrunk: text threads by hand; threading gaps added; Optical kerning from outlines (#181); gap 6: macOS lists fonts that font services and managers activate; shared print spooler; image clipping paths from IDML; Tabs panel listed as present (#343); book chapter update safety; gap 16: Based on Parent leftovers; bounded control click/drag input; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-19 · **Change:** minor (gap 28 added: placed-PDF font repair remains after visible unembedded font detection, #909; gap 6 shrunk: Type › Reload Fonts reads fonts installed, edited or removed while running (#328); gap 3: Package links are relative, #340; gap 27 closed: the loaded text cursor threads into a frame inside a group (#1075); .indd and .indt open through indd-utils; gap 0 shrunk: text threads by hand; threading gaps added; Optical kerning from outlines (#181); gap 6: macOS lists fonts that font services and managers activate; shared print spooler; image clipping paths from IDML; Tabs panel listed as present (#343); book chapter update safety; gap 16: Based on Parent leftovers; bounded control click/drag input; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6) Every known shortfall against InDesign 2026, one entry each, ranked by how much it stops an InDesign professional from doing real work. This is the work list: agents pick from the top. @@ -123,6 +123,18 @@ Kind: **F** feature · **U** UI/UX · **T** typography · **FF** file format · spot, marks and bleed, the options dialog with remembered settings (#196). - **Estimate:** 40–70 h. **Doc:** [file-format-parity.md](file-format-parity.md) +### 28. Placed-PDF font repair for PDF/X-4 (FF) +- **Missing:** embedding, substitution or outlining of unembedded fonts in placed PDFs; export + does not automatically embed or outline them. +- **Have:** PDF/X-4 export warnings and `validate-pdf` report unembedded fonts drawing visible + text, including inside placed PDF forms, with font names and pages (#909). Invisible text + (render mode 3) is exempt from this font-embedding check. A document-wide operation limit and a + form-nesting depth limit report incomplete font checks rather than traversing pathological + nesting. +- **Impact:** detection now ships, but a placed PDF with visible unembedded fonts still needs + font repair before it can meet PDF/X-4 requirements. +- **Doc:** [file-format-parity.md](file-format-parity.md) + ### 10. Printing (H, F) - **Missing:** PostScript, a printer-driver options UI, separations to device, print presets, or trapping. - **Have:** `file.print` exports selected pages/spreads with marks and bleed, then submits through @@ -249,6 +261,7 @@ Cue. These are excluded from every percentage. | Date | Change | Summary | |---|---|---| +| 2026-10-19 | minor | Gap 28 added for remaining placed-PDF font embedding, substitution or outlining; visible unembedded font detection now ships in PDF/X-4 export and `validate-pdf`, with invisible text exempt and operation- or depth-limited checks reported incomplete (#909) | | 2026-10-16 | minor | Gap 27 closed: the loaded text cursor threads into a text frame inside a group (#1075) | | 2026-10-16 | trivial | Gap 13 shrunk: Greek hyphenates, so five languages do (#1077) | | 2026-10-13 | minor | Gap 16: Parent Options dialog and overrides of base items on a parent spread | diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index bb7c5eb8..53c0f284 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -1,6 +1,6 @@ # DesignCraft parity with Adobe InDesign -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (File ▸ Open Recent; .indd and .indt open through indd-utils; text threads by hand; image clipping paths from IDML; anchored objects wrap text; Tabs panel listed as present (#343); spring-loaded Zoom navigation; recovery checkpoint retention; cancelable macOS Dock Quit; Based on Parent; object styles carry effects; colour management on craft-cms, Coated FOGRA39 default CMYK; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6.0.57, macOS) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-19 · **Change:** minor (PDF/X-4 visible unembedded font detection, #909; File ▸ Open Recent; .indd and .indt open through indd-utils; text threads by hand; image clipping paths from IDML; anchored objects wrap text; Tabs panel listed as present (#343); spring-loaded Zoom navigation; recovery checkpoint retention; cancelable macOS Dock Quit; Based on Parent; object styles carry effects; colour management on craft-cms, Coated FOGRA39 default CMYK; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6.0.57, macOS) The authoritative assessment of how close DesignCraft is to Adobe InDesign. [ROADMAP.md](../ROADMAP.md) summarizes it; [gaps.md](gaps.md) lists every known shortfall one at a time; the feature-by-feature @@ -217,12 +217,19 @@ table is the one summed. | Tables | 100% | 55% | 25–40 | anchored objects in cells not drawn (#163); Table ▸ Table Options submenus, Diagonal Lines, Edit Header/Footer | | Long documents | 100% | 45% | 30–50 | Books are shallow (sync, book pagination, book PDF/TOC/index); Table of Contents Styles | | Interactivity & digital | 100% | 40% | 30–50 | HTML export basic (#314); fixed-layout EPUB is page images; no animation, timing, media playback | -| Output & production | 92% | 55% | 40–70 | PDF/X-4 only (no X-1a/X-3), no PDF/print presets or `.joboptions`, print via craft-print (CUPS/Windows), no trapping; Output Preview panel | +| Output & production | 92% | 55% | 40–70 | PDF/X-4 only (no X-1a/X-3), with visible unembedded font detection (below); no PDF/print presets or `.joboptions`, print via craft-print (CUPS/Windows), no trapping; Output Preview panel | | XML & automation | 100% | 35% | (ecosystem dimension) | no ExtendScript/UXP; XML structure depth | | View & navigation | 100% | 65% | 10–20 | Navigator, display badges, Show/Hide extras (content grabber, live corners) | | Undo, history, saving | 100% | 70% | 5–10 | Undo/Redo name the action | | Accessibility | 100% | 50% | 15–25 | tagged PDF exists; PDF/UA validation, reading order depth, screen-reader support in the UI | +PDF/X-4 export warnings and `validate-pdf` report unembedded fonts drawing visible text, including +inside placed PDF forms, with font names and pages (#909). Invisible text (render mode 3) is exempt +from the font-embedding check. Fonts are not embedded or outlined automatically; embedding, +substitution or outlining of placed-PDF fonts remains missing ([gap 28](gaps.md#28-placed-pdf-font-repair-for-pdfx-4-ff)). +A document-wide operation limit and a form-nesting depth limit report incomplete font checks rather +than traversing pathological nesting. This is detection, not complete external PDF/X certification. + ## Remaining effort and calibration **Calibrated against this repo's history.** The first commit was 2026-10-01 09:00; by 2026-10-10 @@ -463,6 +470,7 @@ Task notes that headed ROADMAP.md: | Date | Change | Summary | |---|---|---| +| 2026-10-19 | minor | Output assessment records visible unembedded font detection in PDF/X-4 export and `validate-pdf`, the invisible-text exemption, incomplete-check reporting at the operation and nesting-depth limits, and remaining placed-PDF font repair (#909); readiness and hours unchanged | | 2026-10-13 | minor | `.indd` and `.indt` open through storytold/indd-utils; INDD remaining work 10–30 h (real-file corpus); readiness unchanged until it is measured | | 2026-10-12 | minor | Text threads by hand; stage note and distance to alpha follow the gate (5–7 h, #165); percentages unchanged | | 2026-10-11 | minor | Spring-loaded Zoom navigation added to the working feature inventory (DC-1); readiness estimates unchanged |