M8: SVG import reads color() and color-mix() colours (#1550) (#1566)

The SVG parser reads neither, so fills came in black and strokes were dropped without a note. They are resolved before parsing: color(srgb|display-p3 ...) converted to the document's profile, color-mix(in srgb|oklab|oklch, ...) evaluated as CSS Color 5 defines it. Other spaces are approximated with a note; unreadable calls become a mid grey with a note. Bounded length, nesting and count.

crates/svg/src/import.rs

@@ -17,6 +17,7 @@
 //! nested clip paths) is left out and reported in the import notes. Linked files are never read: only data URIs.
 
 mod budget;
+mod css_color;
 mod fx;
 mod paint;
 mod shape;
@@ -25,6 +26,8 @@ mod text;
 #[cfg(test)]
 mod budget_tests;
 #[cfg(test)]
+mod css_color_tests;
+#[cfg(test)]
 mod fx_tests;
 #[cfg(test)]
 mod hostile_tests;
@@ -810,6 +813,11 @@ fn import_within(
     if too_deep(&data) {
         return Err(ImportError(format!("elements nested more than {MAX_NESTING} deep")));
     }
+    // usvg reads neither `color()` nor `color-mix()`: they are resolved first.
+    let (data, color_notes) = match css_color::resolve(&data, doc.color_profile) {
+        Some(resolved) => resolved,
+        None => (data, Vec::new()),
+    };
     let tree = usvg::Tree::from_data(&data, &options(&data, limits)).map_err(|e| ImportError(e.to_string()))?;
     let size = tree.size();
     let frame =
@@ -818,6 +826,7 @@ fn import_within(
         f.fills.clear();
     }
     let mut cx = Ctx::new(doc);
+    color_notes.into_iter().for_each(|n| cx.note(n));
     children(&mut cx, tree.root(), frame, Affine::IDENTITY, 0);
     Ok(Imported { frame, notes: cx.notes.into_iter().collect() })
 }

crates/svg/src/import/css_color.rs

@@ -0,0 +1,314 @@
+//! CSS colour functions usvg doesn't read, resolved before it parses the document (it would paint
+//! them black, or leave the stroke out): `color()` in `srgb` or `display-p3`, converted to the
+//! document's profile, and `color-mix()` in `srgb`, `oklab` or `oklch`, evaluated here. Each call
+//! in a colour attribute, a `style` attribute or a `<style>` sheet becomes a hex or `rgba()` colour.
+//! Other colour spaces are approximated (a note says how), and a call that can't be read becomes a
+//! mid grey with a note, never a silent black.
+//!
+//! Colours without a space of their own (hex, `rgb()`, names…) are values in the document's
+//! profile, as everywhere else in an import; `color()` says its space, so it is converted. The
+//! OKLab and OKLCH mixes use the sRGB formulas.
+
+use std::ops::Range;
+
+use figcraft_color::{Color, ColorProfile, Oklch};
+
+/// What a call that can't be read becomes: a mid grey, so it doesn't pass for a black on purpose.
+const FALLBACK: Color = Color::from_rgb8_const(0x80, 0x80, 0x80);
+/// Most calls rewritten in one document.
+const MAX_CALLS: usize = 100_000;
+/// Most `color-mix()` calls inside one another.
+const MAX_NESTING: usize = 8;
+/// Longest call read: a colour is short, so a longer one is garbage.
+const MAX_CALL_LEN: usize = 2048;
+/// Chroma under which an OKLCH hue means nothing (a grey).
+const GREY_CHROMA: f32 = 0.000_2;
+
+/// The attributes that can hold a colour (with `style`, which can hold any property).
+const COLOR_ATTRS: [&str; 8] = ["fill", "stroke", "stop-color", "flood-color", "lighting-color", "color", "solid-color", "style"];
+
+/// A colour read from a call, with why it is only an approximation; or why it can't be read.
+type Eval = Result<(Color, Option<&'static str>), &'static str>;
+
+/// `data` with its `color()` and `color-mix()` calls replaced by colours usvg reads, and notes on
+/// those it read only approximately or not at all; `None` when there are none (or `data` isn't
+/// UTF-8 XML).
+pub(crate) fn resolve(data: &[u8], profile: ColorProfile) -> Option<(Vec<u8>, Vec<String>)> {
+    find_call(data, 0)?;
+    let text = std::str::from_utf8(data).ok()?;
+    let opt = usvg::roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() };
+    let xml = usvg::roxmltree::Document::parse_with_options(text, opt).ok()?;
+    let mut edits: Vec<(Range<usize>, String)> = Vec::new();
+    let mut notes = Vec::new();
+    for range in color_ranges(&xml) {
+        rewrite_calls(text, range, profile, &mut edits, &mut notes);
+    }
+    if edits.len() >= MAX_CALLS {
+        notes.push(format!("only the first {MAX_CALLS} color() and color-mix() colours were read; the rest were left as they were"));
+    }
+    if edits.is_empty() {
+        return None;
+    }
+    edits.sort_by_key(|(r, _)| r.start);
+    let mut out = String::with_capacity(text.len());
+    let mut at = 0;
+    for (r, with) in edits {
+        // Ranges never overlap (one per attribute or sheet); a stray one is skipped.
+        let Some(before) = text.get(at..r.start) else { continue };
+        out.push_str(before);
+        out.push_str(&with);
+        at = r.end;
+    }
+    out.push_str(text.get(at..).unwrap_or_default());
+    Some((out.into_bytes(), notes))
+}
+
+/// Where colours can be: the values of colour and `style` attributes and the text of `<style>`
+/// elements (byte ranges in the document).
+fn color_ranges(xml: &usvg::roxmltree::Document) -> Vec<Range<usize>> {
+    let mut out = Vec::new();
+    for n in xml.descendants().filter(|n| n.is_element()) {
+        out.extend(n.attributes().filter(|a| COLOR_ATTRS.contains(&a.name())).map(|a| a.range_value()));
+        if n.tag_name().name() == "style" {
+            out.extend(n.children().filter(|c| c.is_text()).map(|c| c.range()));
+        }
+    }
+    out
+}
+
+/// Replace the calls in `range` of `text`, up to [`MAX_CALLS`] in all.
+fn rewrite_calls(text: &str, range: Range<usize>, profile: ColorProfile, edits: &mut Vec<(Range<usize>, String)>, notes: &mut Vec<String>) {
+    let Some(s) = text.get(range.clone()) else { return };
+    let mut from = 0;
+    while edits.len() < MAX_CALLS {
+        let Some((start, open)) = find_call(s.as_bytes(), from) else { return };
+        let Some(end) = closing(s, open) else {
+            // An open call takes the rest of the value with it, as a CSS parser drops it.
+            notes.push(note(s.get(start..).unwrap_or_default(), "it isn't closed (or is too long to be a colour)"));
+            edits.push((range.start + start..range.end, FALLBACK.to_css()));
+            return;
+        };
+        let call = s.get(start..end).unwrap_or_default();
+        let color = match eval(call, profile, 0) {
+            Ok((c, None)) => c,
+            Ok((c, Some(why))) => {
+                notes.push(note(call, why));
+                c
+            }
+            Err(why) => {
+                notes.push(note(call, why));
+                FALLBACK
+            }
+        };
+        edits.push((range.start + start..range.start + end, color.to_css()));
+        from = end;
+    }
+}
+
+fn note(call: &str, why: &str) -> String {
+    let shown: String = call.chars().take(80).collect();
+    let more = if shown.len() < call.len() { "…" } else { "" };
+    format!("the colour `{shown}{more}`: {why}")
+}
+
+/// The next `color(` or `color-mix(` (any case) at or after `from` that starts a name: its start
+/// and the index of its `(`.
+fn find_call(s: &[u8], from: usize) -> Option<(usize, usize)> {
+    let mut i = from;
+    while let Some(rest) = s.get(i..) {
+        let k = i + rest.iter().position(|b| b.eq_ignore_ascii_case(&b'c'))?;
+        let starts_name = k == 0 || s.get(k - 1).is_none_or(|b| !(b.is_ascii_alphanumeric() || *b == b'-' || *b == b'_'));
+        let at = |name: &[u8]| s.get(k..k + name.len()).is_some_and(|w| w.eq_ignore_ascii_case(name));
+        if starts_name && at(b"color(") {
+            return Some((k, k + 5));
+        }
+        if starts_name && at(b"color-mix(") {
+            return Some((k, k + 9));
+        }
+        i = k + 1;
+    }
+    None
+}
+
+/// The index just past the `)` that closes the `(` at `open`, within [`MAX_CALL_LEN`].
+fn closing(s: &str, open: usize) -> Option<usize> {
+    let mut depth = 0usize;
+    for (i, b) in s.bytes().enumerate().skip(open).take(MAX_CALL_LEN) {
+        match b {
+            b'(' => depth += 1,
+            b')' => {
+                depth -= 1;
+                if depth == 0 {
+                    return Some(i + 1);
+                }
+            }
+            _ => {}
+        }
+    }
+    None
+}
+
+/// The colour of one `color()` or `color-mix()` call, `depth` mixes deep.
+fn eval(call: &str, profile: ColorProfile, depth: usize) -> Eval {
+    let lower = call.trim().to_ascii_lowercase();
+    if let Some(args) = lower.strip_prefix("color-mix(").and_then(|r| r.strip_suffix(')')) {
+        return mix(args, profile, depth);
+    }
+    match lower.strip_prefix("color(").and_then(|r| r.strip_suffix(')')) {
+        Some(args) => color_fn(args, profile),
+        None => Err("not a colour function"),
+    }
+}
+
+/// `color(<space> r g b [/ alpha])`.
+fn color_fn(args: &str, profile: ColorProfile) -> Eval {
+    let (channels, alpha) = match args.split_once('/') {
+        Some((c, a)) => (c, Some(a.trim())),
+        None => (args, None),
+    };
+    let words: Vec<&str> = channels.split_whitespace().collect();
+    let [space, r, g, b] = words.as_slice() else {
+        return Err(if words.first() == Some(&"from") { "relative colours aren't read" } else { "a colour space and three values were expected" });
+    };
+    let value = |p: &str| number(p).ok_or("a value isn't a number or a percentage");
+    let a = match alpha {
+        Some(a) => value(a)?,
+        None => 1.0,
+    };
+    let c = Color::new(value(r)?, value(g)?, value(b)?, a);
+    let (from, why) = match *space {
+        "srgb" => (ColorProfile::Srgb, None),
+        "display-p3" => (ColorProfile::DisplayP3, None),
+        _ => (ColorProfile::Srgb, Some("only the srgb and display-p3 spaces are read: its values were taken as sRGB")),
+    };
+    Ok((from.conversion_to(profile).apply(c), why))
+}
+
+/// A CSS number, a percentage (100% is 1) or `none` (0); finite only.
+fn number(p: &str) -> Option<f32> {
+    let v = match p.strip_suffix('%') {
+        _ if p == "none" => 0.0,
+        Some(pc) => pc.parse::<f32>().ok()? / 100.0,
+        None => p.parse::<f32>().ok()?,
+    };
+    v.is_finite().then_some(v)
+}
+
+/// The space a `color-mix()` interpolates in.
+#[derive(Clone, Copy)]
+enum Space {
+    Srgb,
+    Oklab,
+    Oklch,
+}
+
+/// `color-mix(in <space>, <colour> [p%], <colour> [q%])`, per CSS Color 5: missing percentages
+/// make up 100% (50% each when both are missing), a sum under 100% lowers the alpha, and the
+/// colours mix premultiplied by their alpha (an OKLCH hue takes the shorter way round).
+fn mix(args: &str, profile: ColorProfile, depth: usize) -> Eval {
+    if depth >= MAX_NESTING {
+        return Err("colour mixes are nested too deep");
+    }
+    let parts = split_top(args, |c| c == ',');
+    let [method, first, second] = parts.as_slice() else { return Err("color-mix() takes a method and two colours") };
+    let words: Vec<&str> = method.split_whitespace().collect();
+    let (space, mut why) = match words.as_slice() {
+        ["in", "srgb"] => (Space::Srgb, None),
+        ["in", "oklab"] => (Space::Oklab, None),
+        ["in", "oklch"] | ["in", "oklch", "shorter", "hue"] => (Space::Oklch, None),
+        ["in", ..] => (Space::Srgb, Some("only srgb, oklab and oklch mixes are read: it was mixed in sRGB")),
+        _ => return Err("color-mix() starts with `in` and a colour space"),
+    };
+    let (a, pa, why_a) = operand(first, profile, depth)?;
+    let (b, pb, why_b) = operand(second, profile, depth)?;
+    why = why.or(why_a).or(why_b);
+    if [pa, pb].into_iter().flatten().any(|p| !(0.0..=100.0).contains(&p)) {
+        return Err("mix percentages are between 0% and 100%");
+    }
+    let (pa, pb) = match (pa, pb) {
+        (None, None) => (50.0, 50.0),
+        (Some(p), None) => (p, 100.0 - p),
+        (None, Some(q)) => (100.0 - q, q),
+        (Some(p), Some(q)) => (p, q),
+    };
+    let sum = pa + pb;
+    if sum <= 0.0 {
+        return Err("mix percentages add up to 0%");
+    }
+    let mixed = interpolate(space, a, b, pb / sum);
+    Ok((mixed.with_alpha(mixed.a * (sum / 100.0).min(1.0)), why))
+}
+
+/// One colour of a mix and its percentage (before or after it).
+fn operand(s: &str, profile: ColorProfile, depth: usize) -> Result<(Color, Option<f32>, Option<&'static str>), &'static str> {
+    let words = split_top(s, char::is_whitespace);
+    let pct = |w: &str| w.strip_suffix('%').and_then(|p| p.parse::<f32>().ok()).filter(|p| p.is_finite());
+    let (color, p) = match words.as_slice() {
+        [c] => (*c, None),
+        [c, p] if pct(p).is_some() => (*c, pct(p)),
+        [p, c] if pct(p).is_some() => (*c, pct(p)),
+        _ => return Err("a mix colour is a colour and an optional percentage"),
+    };
+    let (c, why) = if color.starts_with("color(") || color.starts_with("color-mix(") {
+        eval(color, profile, depth + 1)?
+    } else {
+        (Color::parse_css(color).ok_or("a mix colour isn't read")?, None)
+    };
+    Ok((c, p, why))
+}
+
+/// `a` and `b` mixed `t` of the way to `b`, premultiplied by their alpha.
+fn interpolate(space: Space, a: Color, b: Color, t: f32) -> Color {
+    let alpha = a.a + (b.a - a.a) * t;
+    // Premultiplied, then back; a fully transparent mix keeps the plain mix of the channels.
+    let lerp = |x: f32, y: f32| {
+        let v = x * a.a + (y * b.a - x * a.a) * t;
+        if alpha > 0.0 { v / alpha } else { x + (y - x) * t }
+    };
+    let out = match space {
+        Space::Srgb => Color::new(lerp(a.r, b.r), lerp(a.g, b.g), lerp(a.b, b.b), 1.0),
+        Space::Oklab => {
+            let ([la, xa, ya], [lb, xb, yb]) = (oklab(a), oklab(b));
+            let (l, x, y) = (lerp(la, lb), lerp(xa, xb), lerp(ya, yb));
+            Oklch { l, c: x.hypot(y), h: y.atan2(x).to_degrees() }.to_color()
+        }
+        Space::Oklch => {
+            let (ca, cb) = (Oklch::from_color(a), Oklch::from_color(b));
+            // A grey has no hue: it takes the other colour's.
+            let (mut ha, mut hb) = (if ca.c < GREY_CHROMA { cb.h } else { ca.h }, if cb.c < GREY_CHROMA { ca.h } else { cb.h });
+            if hb - ha > 180.0 {
+                ha += 360.0;
+            } else if ha - hb > 180.0 {
+                hb += 360.0;
+            }
+            Oklch { l: lerp(ca.l, cb.l), c: lerp(ca.c, cb.c), h: (ha + (hb - ha) * t).rem_euclid(360.0) }.to_color()
+        }
+    };
+    out.with_alpha(alpha)
+}
+
+/// OKLab lightness and the two axes of `c`.
+fn oklab(c: Color) -> [f32; 3] {
+    let o = Oklch::from_color(c);
+    let (sin, cos) = o.h.to_radians().sin_cos();
+    [o.l, o.c * cos, o.c * sin]
+}
+
+/// `s` split at the characters `sep` picks outside parentheses (empty parts dropped).
+fn split_top(s: &str, sep: impl Fn(char) -> bool) -> Vec<&str> {
+    let mut out = Vec::new();
+    let (mut depth, mut start) = (0usize, 0);
+    for (i, c) in s.char_indices() {
+        match c {
+            '(' => depth += 1,
+            ')' => depth = depth.saturating_sub(1),
+            _ if depth == 0 && sep(c) => {
+                out.push(s.get(start..i).unwrap_or_default());
+                start = i + c.len_utf8();
+            }
+            _ => {}
+        }
+    }
+    out.push(s.get(start..).unwrap_or_default());
+    out.into_iter().map(str::trim).filter(|p| !p.is_empty()).collect()
+}

crates/svg/src/import/css_color_tests.rs

@@ -0,0 +1,163 @@
+//! `color()` and `color-mix()` colours (#1550): read where they map to a FigCraft colour, a note
+//! and a grey (never a silent black) where they don't, and no panic on garbage.
+
+use figcraft_color::{Color, ColorProfile, Paint};
+use figcraft_doc::{Document, Node};
+
+use super::css_color::resolve;
+use super::import_svg_with_notes;
+
+/// The layers of `body`'s import inside a 100×100 SVG (frame first), and its notes, into a
+/// document in `profile`.
+fn import_in(profile: ColorProfile, body: &str) -> (Vec<Node>, Vec<String>) {
+    let svg = format!(r#"<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">{body}</svg>"#);
+    let mut d = Document::new("t");
+    d.color_profile = profile;
+    let p = d.first_page().unwrap();
+    let i = import_svg_with_notes(&mut d, svg.as_bytes(), p, 0.0, 0.0, "x").unwrap();
+    let nodes = d.subtree(i.frame).into_iter().filter_map(|id| d.node(id).cloned()).collect();
+    (nodes, i.notes)
+}
+
+/// The fill (colour with the paint's opacity) of a rectangle painted `fill`, and the notes.
+fn fill_in(profile: ColorProfile, fill: &str) -> (Option<Color>, Vec<String>) {
+    let (nodes, notes) = import_in(profile, &format!(r#"<rect width="10" height="10" style="fill: {fill}"/>"#));
+    (nodes.get(1).and_then(|n| n.fills.first()).and_then(Paint::solid_color), notes)
+}
+
+fn fill(fill: &str) -> (Option<Color>, Vec<String>) {
+    fill_in(ColorProfile::Srgb, fill)
+}
+
+fn rgba8(c: Option<Color>) -> Option<[u8; 4]> {
+    c.map(Color::to_rgba8)
+}
+
+#[test]
+fn color_srgb_reads_with_and_without_alpha() {
+    let (c, notes) = fill("color(srgb 0.08 0.63 0.24)");
+    assert_eq!(rgba8(c), Some([20, 161, 61, 255]));
+    assert!(notes.is_empty(), "{notes:?}");
+    assert_eq!(rgba8(fill("color(srgb 0.08 0.63 0.24 / 0.6)").0), Some([20, 161, 61, 153]));
+    assert_eq!(rgba8(fill("COLOR(SRGB 100% 0% none / 50%)").0), Some([255, 0, 0, 128]), "percentages, none and any case");
+    // In an attribute too.
+    let (nodes, _) = import_in(ColorProfile::Srgb, r#"<rect width="10" height="10" fill="color(srgb 0 0 1)"/>"#);
+    assert_eq!(rgba8(nodes.get(1).and_then(|n| n.fills.first()).and_then(Paint::solid_color)), Some([0, 0, 255, 255]));
+}
+
+#[test]
+fn display_p3_converts_to_the_documents_profile() {
+    let p3 = Color::new(0.2, 0.6, 0.3, 1.0);
+    let in_srgb = ColorProfile::DisplayP3.conversion_to(ColorProfile::Srgb).apply(p3);
+    assert_eq!(rgba8(fill("color(display-p3 0.2 0.6 0.3)").0), Some(in_srgb.to_rgba8()));
+    assert_ne!(in_srgb.to_rgba8(), p3.to_rgba8());
+    // A Display P3 document keeps the values; an sRGB colour moves into its space.
+    assert_eq!(rgba8(fill_in(ColorProfile::DisplayP3, "color(display-p3 0.2 0.6 0.3)").0), Some(p3.to_rgba8()));
+    let srgb_in_p3 = ColorProfile::Srgb.conversion_to(ColorProfile::DisplayP3).apply(p3);
+    assert_eq!(rgba8(fill_in(ColorProfile::DisplayP3, "color(srgb 0.2 0.6 0.3)").0), Some(srgb_in_p3.to_rgba8()));
+}
+
+#[test]
+fn color_mix_in_srgb_oklab_and_oklch() {
+    // The issue's colour: 60% of #14a03c, the rest white.
+    let (c, notes) = fill("color-mix(in srgb, #14a03c 60%, white)");
+    assert_eq!(rgba8(c), Some([114, 198, 138, 255]));
+    assert!(notes.is_empty(), "{notes:?}");
+    assert_eq!(rgba8(fill("color-mix(in srgb, 40% white, #14a03c)").0), Some([114, 198, 138, 255]), "the percentage before the colour");
+    // OKLab and OKLCH: white and black meet at lightness 0.5 (#636363).
+    assert_eq!(rgba8(fill("color-mix(in oklab, white, black)").0), Some([99, 99, 99, 255]));
+    assert_eq!(rgba8(fill("color-mix(in oklch, white, black)").0), Some([99, 99, 99, 255]));
+    // A hue takes the shorter way round (through 0°, not 180°).
+    let short = Color::parse_css("oklch(0.7 0.1 0)").unwrap();
+    assert_eq!(rgba8(fill("color-mix(in oklch shorter hue, oklch(0.7 0.1 340), oklch(0.7 0.1 20))").0), Some(short.to_rgba8()));
+    // Percentages under 100% lower the alpha; alphas mix premultiplied.
+    assert_eq!(rgba8(fill("color-mix(in srgb, red 20%, blue 20%)").0), Some([128, 0, 128, 102]));
+    assert_eq!(rgba8(fill("color-mix(in srgb, red, transparent)").0), Some([255, 0, 0, 128]));
+    // Nested, with color() inside.
+    assert_eq!(rgba8(fill("color-mix(in srgb, color-mix(in srgb, red, blue), color(srgb 0 1 0) 0%)").0), Some([128, 0, 128, 255]));
+}
+
+#[test]
+fn strokes_stops_and_style_sheets_read_too() {
+    let body = r#"<style>.a { fill: color(srgb 1 0 0); }</style>
+        <linearGradient id="g"><stop offset="0" stop-color="color(srgb 0 1 0)"/><stop offset="1" stop-color="blue"/></linearGradient>
+        <rect class="a" width="10" height="10" stroke="color-mix(in srgb, blue, red)"/>
+        <rect x="20" width="10" height="10" fill="url(#g)"/>"#;
+    let (nodes, notes) = import_in(ColorProfile::Srgb, body);
+    assert!(notes.iter().all(|n| !n.contains("the colour `")), "{notes:?}");
+    let rect = nodes.get(1).unwrap();
+    assert_eq!(rgba8(rect.fills.first().and_then(Paint::solid_color)), Some([255, 0, 0, 255]));
+    assert_eq!(rgba8(rect.strokes.first().and_then(Paint::solid_color)), Some([128, 0, 128, 255]));
+    let stops = match nodes.get(2).and_then(|n| n.fills.first()).map(|p| &p.kind) {
+        Some(figcraft_color::PaintKind::Gradient(g)) => g.stops.clone(),
+        k => panic!("{k:?}"),
+    };
+    assert_eq!(stops.first().map(|s| s.color.to_rgba8()), Some([0, 255, 0, 255]));
+    // Text and other attributes keep their words.
+    let svg = r#"<svg xmlns="http://www.w3.org/2000/svg"><text id="color(srgb 1 0 0)" fill="color(srgb 1 0 0)">color(srgb 1 0 0) <tspan>mycolor(1)</tspan></text></svg>"#;
+    let (out, _) = resolve(svg.as_bytes(), ColorProfile::Srgb).unwrap();
+    assert_eq!(
+        String::from_utf8(out).unwrap(),
+        r##"<svg xmlns="http://www.w3.org/2000/svg"><text id="color(srgb 1 0 0)" fill="#FF0000">color(srgb 1 0 0) <tspan>mycolor(1)</tspan></text></svg>"##
+    );
+}
+
+#[test]
+fn what_isnt_read_gets_a_note_and_a_grey_not_black() {
+    let grey = Some([128, 128, 128, 255]);
+    for call in [
+        "color(srgb a b c)",
+        "color(srgb 1 0)",
+        "color(from red srgb r g b)",
+        "color-mix(in srgb, red)",
+        "color-mix(srgb, red, blue)",
+        "color-mix(in srgb, red 150%, blue)",
+        "color-mix(in srgb, red 0%, blue 0%)",
+        "color-mix(in srgb, currentcolor, blue)",
+        "color(srgb 1 0 0",
+    ] {
+        let (c, notes) = fill(call);
+        assert_eq!(rgba8(c), grey, "{call}");
+        assert!(notes.iter().any(|n| n.contains("the colour `")), "{call}: {notes:?}");
+    }
+    // Spaces and mixes it doesn't know: close, with a note saying how.
+    let (c, notes) = fill("color(rec2020 0 0 1)");
+    assert_eq!(rgba8(c), Some([0, 0, 255, 255]));
+    assert!(notes.iter().any(|n| n.contains("rec2020") && n.contains("sRGB")), "{notes:?}");
+    let (c, notes) = fill("color-mix(in hsl, red, blue)");
+    assert_eq!(rgba8(c), Some([128, 0, 128, 255]));
+    assert!(notes.iter().any(|n| n.contains("mixed in sRGB")), "{notes:?}");
+}
+
+#[test]
+fn garbage_and_deep_nesting_are_bounded() {
+    // Nested deeper than the limit: a note, no stack overflow.
+    let deep = (0..50).fold("red".to_string(), |acc, _| format!("color-mix(in srgb, {acc}, blue)"));
+    let (c, notes) = fill(&deep);
+    assert!(c.is_some() && notes.iter().any(|n| n.contains("nested")), "{notes:?}");
+    // Many calls, unclosed ones, odd bytes: each attribute is read, nothing panics.
+    let many = "color(srgb 0 0 1) ".repeat(5000);
+    assert!(
+        resolve(format!(r#"<svg xmlns="http://www.w3.org/2000/svg"><rect style="fill: {many}"/></svg>"#).as_bytes(), ColorProfile::Srgb).is_some()
+    );
+    let mut seed = 7u64;
+    let pieces = ["color(", "color-mix(", "in ", "srgb", "oklch", ")", "(", ",", " ", "%", "/", "50", "1e40", "NaN", "é", "#fff", "none"];
+    for _ in 0..500 {
+        let junk: String = (0..12)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                pieces[(seed % pieces.len() as u64) as usize]
+            })
+            .collect();
+        let svg = format!(r#"<svg xmlns="http://www.w3.org/2000/svg"><rect width="1" height="1" fill="{junk}" style="stroke: {junk}"/></svg>"#);
+        let _ = resolve(svg.as_bytes(), ColorProfile::Srgb);
+        let mut d = Document::new("t");
+        let p = d.first_page().unwrap();
+        let _ = import_svg_with_notes(&mut d, svg.as_bytes(), p, 0.0, 0.0, "x");
+    }
+    // Nothing to do: the document comes back as it was.
+    assert!(resolve(br#"<svg xmlns="http://www.w3.org/2000/svg"><rect fill="red"/></svg>"#, ColorProfile::Srgb).is_none());
+    assert!(resolve(b"\xff\xfecolor(", ColorProfile::Srgb).is_none());
+}

docs/file-format-parity.md

@@ -1,6 +1,6 @@
 # File format parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** minor (SVG import draws each pattern tile once per scale, within the layer budget (#1080); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); offline Penpot 2.x import/export (#1143); `.sketch` import checked against Sketch's renders: master backgrounds, symbol clipping, tints before Sketch 64, mask opacity, bitmap fills, image overrides on shapes, stretching stacks, blur radii, colour adjustments, OKLab gradients, text growth, shape group borders (#1389); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); image member names are checked on read, and REST image placeholders get archive-safe keys (#1086); Android Vector Drawable (XML) export; `.fig` export: files the incumbent imports, with component set properties, and grid track sizes at its field ids; Save and auto-save don't replace changes another app made to the open file (#1330); `.sketch` import, best effort, Sketch 48 and newer; the PNG row names ignore overlapping layers and where include bounding box is offered; the Fonts table's missing-font row describes the Missing fonts window; `.figcraft` carries the file kind (boards); `.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732)) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); SVG import draws each pattern tile once per scale, within the layer budget (#1080); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); offline Penpot 2.x import/export (#1143); `.sketch` import checked against Sketch's renders: master backgrounds, symbol clipping, tints before Sketch 64, mask opacity, bitmap fills, image overrides on shapes, stretching stacks, blur radii, colour adjustments, OKLab gradients, text growth, shape group borders (#1389); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); image member names are checked on read, and REST image placeholders get archive-safe keys (#1086); Android Vector Drawable (XML) export; `.fig` export: files the incumbent imports, with component set properties, and grid track sizes at its field ids; Save and auto-save don't replace changes another app made to the open file (#1330); `.sketch` import, best effort, Sketch 48 and newer; the PNG row names ignore overlapping layers and where include bounding box is offered; the Fonts table's missing-font row describes the Missing fonts window; `.figcraft` carries the file kind (boards); `.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732)) · **Target:** Figma Design (desktop app 126.10.7)
 
 Every format Figma reads or writes, with FigCraft's support. Sources: `Info.plist` of
 `/Applications/Figma.app` (document types only; nothing inside the bundle's code was read), Figma's
@@ -30,7 +30,7 @@ and prototype interactions are still unchecked there.
 
 | Format | Figma | FigCraft | Notes | Hours |
 |---|---|---|---|---|
-| SVG | editable vectors | **yes**, editable | corpus of 21 synthetic files with hand-computed expected pixels, structure and round-trip checks; gradients, patterns as image fills, clip paths, masks, shadow/blur filters, blend modes, text as text layers; other filters dropped with a warning; text on one path as text on a path (on several paths as outlines); a pattern's tile is drawn once per scale however many layers use it, and its layers count in the import's 100,000-layer budget; fuzzed | 2–4 (filters) |
+| SVG | editable vectors | **yes**, editable | corpus of 21 synthetic files with hand-computed expected pixels, structure and round-trip checks; gradients, `color()` (sRGB, Display P3) and `color-mix()` (sRGB, OKLab, OKLCH) colours, patterns as image fills, clip paths, masks, shadow/blur filters, blend modes, text as text layers; other filters dropped with a warning; text on one path as text on a path (on several paths as outlines); a pattern's tile is drawn once per scale however many layers use it, and its layers count in the import's 100,000-layer budget; fuzzed | 2–4 (filters) |
 | PNG, JPG | yes | yes | embedded ICC profiles (PNG `iCCP`, JPG APP2) and PNG `sRGB` / `gAMA` / `cHRM` chunks convert the image into the file's colour space; no profile (or CMYK, damaged): taken as sRGB | — |
 | GIF | yes (animated) | **yes**, animated | the file is kept as is; the canvas and PNG, JPG and PDF exports show the first frame (SVG exports embed the file, so viewers that animate GIFs animate it), the presenter and the preview play it (frames decoded on first play: at most 500 frames and 128 MB, past that the rest don't play; always loops) | — |
 | WebP | yes | yes | embedded ICC profile honoured | — |
@@ -184,6 +184,7 @@ source paint coordinates.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | minor | M8, #1550: SVG import reads CSS colour functions its SVG parser doesn't (it painted them black, or left strokes out, without a word): `color(srgb …)` and `color(display-p3 …)`, with alpha, converted to the document's profile, and `color-mix(in srgb|oklab|oklch, …)`, evaluated at import (percentages, alpha and nested mixes as CSS Color 5 has them), in colour attributes, `style` attributes and `<style>` sheets. Other colour spaces are taken as sRGB values and other mixes mixed in sRGB, each with an import note; a call that can't be read becomes a mid grey with a note. Bounded: calls over 2,048 characters, mixes nested more than 8 deep and more than 100,000 calls are not read. Tests: `css_color_tests` (svg). Numbers unchanged |
 | 2026-10-29 | minor | M8, #1080: SVG import draws a pattern's tile once per pattern and scale and reuses it for every other layer it fills (1,000 rectangles filled with one pattern: 1,000 tile drawings before, 1 now, same image fill), and the layers inside a tile count in the import's 100,000-layer budget instead of each tile starting a fresh one, so patterns nested in patterns stop at the budget. Tests: `tile_tests` (svg). Numbers unchanged |
 | 2026-10-29 | patch | M8: the progressive JPEG check from #1491 (a frame sampling a component more finely than its first, which the JPEG decoder asserts on, and in the browser a panic aborts the page) moved to `figcraft_format::jpeg` and now also guards the pictures files carry (`thumbnail::decode_thumbnail`: the home screen and recent files), so a crafted `.figcraft`, `.fig` or `.sketch` thumbnail or image file shows no picture instead of crashing. The canvas, exports and SVG/PDF keep it through the renderer. Regression tests in `jpeg_tests` (format) and `jpeg_sampling_tests` (render). Numbers unchanged |
 | 2026-10-29 | minor | Fonts: the missing-font row adds downloading a missing family the font store has (Google Fonts, Noto) from the Missing fonts window, after the user allows it (#754). Replacing a missing font with another is still missing. Numbers unchanged |

docs/roadmap.md

@@ -1,6 +1,6 @@
 # FigCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** minor (the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); M8: mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); M2: components can't contain their own instances, directly or through others; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); M0.9: optional batch continue-on-error with per-step outcomes (#1386); Alt pressed during a drag duplicates (#1385); variables in paint props (M3, #1000); finding layers without selecting them (M0.9, part of #996); the attached MCP server reads the app's replies with a 512 MiB bound (#1113); a failed batch keeps the undo steps it undid (#1410); Arabic draft catalog; Android Vector Drawable export; a selected unfilled shape drags over a filled layer below it (#1370); text truncation fills the last line, survives resizing, and auto height takes Max lines (#1375, #1376, #1377); M11 widget fields and property menus; M12 Boards: timer and voting; Installed weights of an embedded font family (#1246); `.sketch` import, best effort; Adobe Fonts found on macOS (#298); M12 Boards; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** minor (SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); M8: mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); M2: components can't contain their own instances, directly or through others; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); M0.9: optional batch continue-on-error with per-step outcomes (#1386); Alt pressed during a drag duplicates (#1385); variables in paint props (M3, #1000); finding layers without selecting them (M0.9, part of #996); the attached MCP server reads the app's replies with a 512 MiB bound (#1113); a failed batch keeps the undo steps it undid (#1410); Arabic draft catalog; Android Vector Drawable export; a selected unfilled shape drags over a filled layer below it (#1370); text truncation fills the last line, survives resizing, and auto height takes Max lines (#1375, #1376, #1377); M11 widget fields and property menus; M12 Boards: timer and voting; Installed weights of an embedded font family (#1246); `.sketch` import, best effort; Adobe Fonts found on macOS (#298); M12 Boards; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 Forward-looking plan. Where FigCraft stands today: [`ROADMAP.md`](../ROADMAP.md) and
 [`target-app-parity.md`](target-app-parity.md); the full ranked list: [`gaps.md`](gaps.md). Hours
@@ -75,6 +75,7 @@ blockers.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | minor | M8, #1550: SVG import reads CSS colour functions its SVG parser doesn't (it painted them black, or left strokes out, without a word): `color(srgb …)` and `color(display-p3 …)`, with alpha, converted to the document's profile, and `color-mix(in srgb|oklab|oklch, …)`, evaluated at import (percentages, alpha and nested mixes as CSS Color 5 has them), in colour attributes, `style` attributes and `<style>` sheets. Other colour spaces are taken as sRGB values and other mixes mixed in sRGB, each with an import note; a call that can't be read becomes a mid grey with a note. Bounded: calls over 2,048 characters, mixes nested more than 8 deep and more than 100,000 calls are not read. Tests: `css_color_tests` (svg). Numbers unchanged |
 | 2026-10-30 | minor | M1, #1320: settings in portable mode: a `portable` file next to the executable keeps the settings, recovery copies and plugins in `config/` beside it (the Windows portable zip ships one), starting with the platform folder's preferences; the folder comes from craft-settings' rules, and without a marker it is the one every earlier version used. Tests: `settings_dir_tests` |
 | 2026-10-30 | minor | M1, #965, #1438: "Parent device is lost" at start: Direct3D 12 compiles with FXC, no device compiles wgpu's indirect-validation shaders, and when the graphics still fail before the first frame the app starts again with the next of a fixed list of attempts (Windows: Vulkan, OpenGL; Linux and FreeBSD: OpenGL; then lower requirements on the power-saving GPU); the last failure names what was tried. Tests: `graphics_tests`, `startup_tests` |
 | 2026-10-29 | minor | M4, #1219: Thai, Lao, Khmer and Burmese text, written without spaces between words, wraps between words instead of where a line overflows (`พัฒนาซอ|ฟต์แวร์` → `พัฒนา|ซอฟต์แวร์`). `figcraft_text::breaks::word_breaks` finds the word starts inside each run of these scripts with ICU4X's line segmenter (`icu_segmenter` 2.3): its dictionaries on desktop, its LSTM models in the browser (about 0.39 MB of wasm instead of 1.86 MB, which the 24 MiB gate can't take; they split a few compounds the dictionaries keep whole). Where a run meets spaces, Latin or CJK the UAX #14 rules decide as before, and a word wider than its box still takes #1400's emergency break. Text without these scripts does no extra work. Grade unchanged. Evidence: `breaks::tests::thai_lines_break_between_words`, `lao_khmer_and_burmese_lines_break_between_words`, `word_breaks_survive_junk`, `behaviour_tests::thai_lines_break_between_words` (fails on main). |