@@ -209,7 +217,8 @@ Then tone it with Color Grading for selenium, sepia or split-tone prints.
A library that stays out of your way: **All Photos**, **Recently Added**, **Picks**, **By Date**, **Albums** nested in
**Folders**, and **Recently Deleted**. Rate with 0–5, flag with P / X /
U, colour-label with 6–9. Search understands fields:
-`rating:>3 flag:pick iso:>800 camera:x2 date:2026-04 keyword:mountains`. Every view sorts by capture date,
+`rating:>3 flag:pick iso:>800 camera:x2 date:2026-04 keyword:mountains person:"Jane Doe"`; plain words also match
+the people named on faces, and quotes keep several words together. Every view sorts by capture date,
import date, edit date, name, rating, size or at random (a stable shuffle; View → Sort → Reshuffle for a new one). The justified **Photo Grid** and **Square Grid** views are virtualized,
so they stay smooth whether you have forty photos or forty thousand.
@@ -401,10 +410,12 @@ cargo xtask ci # fmt, clippy, HEIF, tes
CI defaults to line-table debug information and one build job per 1.5 GB of RAM
available when it starts (at most one per CPU; 4 if memory can't be read), so an
8 GB machine with 6 GB free builds with 4, and a busy machine with little free
-builds with fewer. Test threads follow, capped at 4. Full-debuginfo linkers, one
-per CPU, otherwise exhaust RAM before any test runs. GPU coverage is unchanged. Explicit
-`CARGO_PROFILE_DEV_DEBUG`, `CARGO_BUILD_JOBS` and `RUST_TEST_THREADS` settings
-override these defaults. Ordinary development commands keep their own settings.
+builds with fewer. Test threads follow, capped at 4.
+Full-debuginfo linkers, one per CPU, otherwise exhaust RAM before any test runs. GPU coverage is
+unchanged. Explicit `CARGO_PROFILE_DEV_DEBUG`, `CARGO_BUILD_JOBS`, `RUST_TEST_THREADS` and
+`NEXTEST_TEST_THREADS` settings override these defaults. The tests run under
+`cargo test`; `LIGHTCRAFT_NEXTEST=1` runs them under [cargo-nextest](https://nexte.st) instead (one
+process per test, slower here because each regenerates the demo scenes). Ordinary development commands keep their own settings.
**Release builds on memory-constrained machines:** [#1196](https://github.com/storytold/lightcraft/issues/1196)
reports Arch/AUR release-link OOM kills on a 16 GB machine when the desktop and CLI build concurrently
@@ -448,7 +459,7 @@ CRAFT_FONTS_DIR=../craft-fonts cargo run --release -p lightcraft
Without it LightCraft builds and runs the same, but Chinese and Japanese text have no glyphs. Fonts are never committed to this
repo — the standard for what goes there lives with it: see the [craft-fonts README](https://github.com/storytold/craft-fonts#readme).
-**Interface language:** **Edit → Language** (English, 简体中文, 繁體中文（台灣）, 日本語, Português (Brasil), Español, Deutsch, Русский, Français, Українська, Polski, Čeština, Italiano, ქართული) or **Settings → General →
+**Interface language:** **Edit → Language** (English, 简体中文, 繁體中文（台灣）, 日本語, Português (Brasil), Español, Deutsch, Русский, Français, Українська, Polski, Čeština, Italiano, ქართული, Svenska, Suomi, Bahasa Indonesia, Tiếng Việt) or **Settings → General →
Language**; the choice applies immediately and persists. See [docs/localization.md](docs/localization.md).
**Logs:** the desktop app writes its log to standard error and to `logs/lightcraft.log` in its settings folder
diff --git a/README.zh-hans.md b/README.zh-hans.md
index 58e1d627f..bc2f2830e 100644
--- a/README.zh-hans.md
+++ b/README.zh-hans.md
@@ -14,7 +14,8 @@
+
+
+
+## Edit like you mean it
+
+LightCraft 是裝在單一原生應用程式裡的完整暗房。每一項調整都是**非破壞性**的，永遠不會動到原始檔案。
+每個滑桿都經過一條**場景參考、寬色域、32 位元浮點的管線**算繪：亮部像底片一樣柔和過渡，陰影提亮卻不產生光暈，
+色彩從拍攝到匯出始終保持乾淨。
+
+
+
+
+
+## Masking that goes where you point
+
+用**筆刷**塗抹（大小、羽化、流量、濃度、擦除），放置附可拖曳控制點的**線性漸層**與**放射狀漸層**，
+或依**明度範圍**、**色彩範圍**、**天空**、**主體**與**背景**來選取。用**新增／減去／交集**組合各個元件，
+反轉其中任何一個，每個遮色片可設定 15 項局部調整（色溫、色調、曝光、對比、亮部、陰影、白色色階、黑色色階、紋理、
+清晰度、去朦朧、色相、飽和度、銳利化、雜訊抑制），再加上一個整體的強度。
+
+
+
+## Star history
+
+[](https://www.star-history.com/?repos=storytold%2Flightcraft&type=date&legend=top-left)
+
+照片庫、工具與預設集面板可以重新分組、拆分、浮動於應用程式視窗內、關閉與重新開啟。工具面板會保留目前的編輯／裁切／遮色片模式；照片檢視區與底片顯示窗格則維持在一起。拖曳面板標題到某個目標邊緣或另一個標題上即可調整。右鍵選單提供「浮動面板」、「移至群組」與「關閉面板」。既有的面板切換按鈕會在上次儲存的位置重新開啟面板；「重設面板配置」則會還原應用程式的版面配置。浮動面板會保持在目前的應用程式視窗之內。
diff --git a/ROADMAP.md b/ROADMAP.md
index f142cd226..6d8720b6e 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
**Stage: alpha** · next: beta, ~14 points and ~340–600 h away
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-15 · **Change:** minor (RAW: 83% of Adobe's models decode, 38% verified after the camera-coverage sweep #1327) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (Minolta MRW decoded, 6 bodies verified; RAW: 83% of Adobe's models decode, 38% verified after the camera-coverage sweep #1327; German catalog 91% → 97%: interface strings and What's New lines translated) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
One-page summary of how close LightCraft is to Adobe Lightroom. Agents: read this, then pick work
from [docs/gaps.md](docs/gaps.md). The full assessment, method and evidence are in
@@ -49,7 +49,7 @@ Hours are calibrated on this repo's PR history; see
| UI/UX fidelity | ~70% | ~85% | 32–54 h | [ui-parity](docs/ui-parity.md) |
| File formats (non-raw) | ~70% | ~85% | 30–55 h | [file-format-parity](docs/file-format-parity.md) |
| Hardware | ~40% | ~50% | 40–80 h | [hardware-parity](docs/hardware-parity.md) |
-| Localization | ~55% of the 12 key languages | 7 of 12 present | 130–210 h (+145–255 h new scripts) | [localization-parity](docs/localization-parity.md) |
+| Localization | ~64% of the 12 key languages | 8 of 12 present | 130–210 h (+135–239 h new scripts) | [localization-parity](docs/localization-parity.md) |
| Performance | ~70% | ~80% | 30–50 h | [target-app-parity](docs/target-app-parity.md#by-dimension) |
| Stability | ~60% | — | 30–60 h | [target-app-parity](docs/target-app-parity.md#by-dimension) |
| Platforms | ~60% | macOS, Windows, Linux, FreeBSD, web | 25–45 h | [target-app-parity](docs/target-app-parity.md#by-dimension) |
@@ -78,7 +78,7 @@ Weights and evidence: [target-app-parity.md](docs/target-app-parity.md#features)
## Languages
-Measured from `crates/ui-egui/locales` (share of 2,304 catalog messages translated); none is `full`
+Measured from `crates/ui-egui/locales` (share of 2,304 catalog messages translated; German counts 3,644 of 3,754, because its What's New lines add keys); none is `full`
while lower-layer errors stay English. Detail: [localization-parity.md](docs/localization-parity.md).
| Language | Code | Translated | Status |
@@ -90,13 +90,13 @@ while lower-layer errors stay English. Detail: [localization-parity.md](docs/loc
| Arabic | ar | 0% | none (no RTL / shaping) |
| French | fr | 88% | partial |
| Portuguese (Brazil) | pt-br | 85% | partial |
-| Indonesian | id | 0% | none |
+| Indonesian | id | 100% (What's New in English) | partial |
| Japanese | ja | 87% | partial |
-| German | de | 91% | partial |
+| German | de | 97% (3,644/3,754) | partial |
| Korean | ko | 0% | none (no Hangul face) |
| Vietnamese | vi | 0% | none |
-Also shipped: Traditional Chinese (87%), Russian (74%), Ukrainian (99%), Italian (92%), Georgian (100%).
+Also shipped: Traditional Chinese (87%), Russian (74%), Ukrainian (99%), Italian (92%), Georgian (100%), Finnish (79%).
## Upcoming
@@ -117,8 +117,11 @@ Ranked toward beta; detail in [docs/roadmap.md](docs/roadmap.md), gaps in [docs/
- 2026-10-14: Camera-coverage sweep verifies 30 more models on 40 CC0 files, with file and sensor
hashes pinned (`docs/raw/coverage.py`: 515 → 545 verified). Eleven candidates excluded after rechecking
identity, provenance and camera-image agreement. Phone and drone DNG tone differences remain tracked in #1277.
+- 2026-10-18: Minolta / Konica Minolta MRW decodes from sensor data (12-bit packed and 16-bit words,
+ RGGB and GBRG, as-shot WB from `WBG`); DiMAGE 7, 7Hi, A1, A2, A200 and Dynax / Maxxum 7D verified on
+ CC0 files. 551 models verified, 201 preview-only; headline numbers unchanged.
- 2026-10-14: 97 Canon CR2, Pentax and Ricoh models verified, one CC0 raw.pixls.us file each pinned and
- checked against the camera JPEG (`crates/raw/tests/canon_pentax_corpus.rs`). 334 models verified, ~50% of
+ checked against the camera JPEG (`crates/raw/tests/it/canon_pentax_corpus.rs`). 334 models verified, ~50% of
photographers on a verified body; headline numbers unchanged.
- 2026-10-12: Mamiya MEF (ZD) decodes from sensor data and is imported; verified on a CC0 file. 241 models
verified, 35 unsupported; headline numbers unchanged.
@@ -132,7 +135,7 @@ Ranked toward beta; detail in [docs/roadmap.md](docs/roadmap.md), gaps in [docs/
decode. The EOS R6 Mark III gets its as-shot white balance (`ColorData` 66). 259 models verified; RAW
decoding 77% → 83%; mainstream ~49% → ~51%, essentials ~64% → ~65%, full ~61%.
- 2026-10-12: 117 Nikon and Fujifilm bodies verified, one CC0 raw.pixls.us file each pinned and checked
- against the camera JPEG (`crates/raw/tests/body_corpus.rs`); the sweep found COOLPIX 5700 / 8400 / 8800
+ against the camera JPEG (`crates/raw/tests/it/body_corpus.rs`); the sweep found COOLPIX 5700 / 8400 / 8800
decoding wrongly. 354 models verified, ~58% of photographers on a verified body; headline numbers unchanged.
- 2026-10-11: Canon EOS R5 Mark II C-RAW decodes from sensor data (57% of its files opened as a
preview): the CRX QP map's first-symbol literal and limited-length escape; four CC0 R5 Mark II files
@@ -183,17 +186,21 @@ Ranked toward beta; detail in [docs/roadmap.md](docs/roadmap.md), gaps in [docs/
| Date | Change | Summary |
|---|---|---|
+| 2026-10-19 | minor | Indonesian interface (`id`): every plain and formats message, plus 69 command labels, locale, menu command and tests; What's New left in English; Localization ~55% → ~64% (mean of the 12 key languages), 8 of 12 present |
| 2026-10-12 | minor | Italian interface (`it`, #1192): 2,201 of 2,398 messages, locale, menu command and tests; headline numbers unchanged |
| 2026-10-13 | minor | Sony ILCA-99M2 camera colour profile in the log; numbers unchanged |
| 2026-10-14 | minor | Localization ~52% → ~55% (mean of the 12 key languages): de, es, fr, ja and uk catalogs filled |
+| 2026-10-16 | minor | German 91% → 97% (217 interface strings and 862 What's New lines added); headline numbers unchanged |
| 2026-10-14 | minor | 21 Sony and Leica models verified (258 models, 18%); headline numbers unchanged |
| 2026-10-12 | minor | UI/UX remaining 34–58 h → 32–54 h (canvas tools by keyboard); headline numbers unchanged |
| 2026-10-14 | minor | 17 uncompressed Olympus and Samsung models verified on one CC0 file each (254 models verified, 18%); headline numbers unchanged |
| 2026-10-12 | minor | Mamiya MEF decoded and imported: ZD verified (241); headline numbers unchanged |
| 2026-10-12 | minor | Epson ERF decoded: 3 more verified models (240); headline numbers unchanged |
| 2026-10-12 | minor | Georgian (`ka`) interface language added (every catalog message) |
+| 2026-10-17 | minor | Finnish (`fi`) interface language added: 2,610 of 3,308 messages (79%), locale, menu command and tests; headline numbers unchanged |
| 2026-10-14 | minor | Full-resolution zoom (gap 4) closed: soft proofing gets zoom windows; headline numbers unchanged |
| 2026-10-12 | minor | UI/UX remaining 40–70 h → 34–58 h (accessibility audit landed); headline numbers unchanged |
+| 2026-10-18 | minor | Minolta MRW decodes from sensor data; 6 Konica Minolta bodies verified; headline numbers unchanged |
| 2026-10-14 | minor | Camera-coverage sweep (#1327): 30 models verified on 40 CC0 files (coverage.py 515 → 545 verified); sensor verification does not establish colour parity (#1277); headline numbers unchanged |
| 2026-10-12 | minor | 22 more CR3 bodies verified, EOS R6 Mark III white balance: RAW decoding 77% → 83%, RAW ~56% → ~60%; mainstream 49% → 51%, essentials 64% → 65%; full unchanged at ~61% |
| 2026-10-12 | minor | 117 Nikon and Fujifilm bodies verified (354 models, 24%); headline numbers unchanged |
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..6d7340dd5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,54 @@
+# Security Policy
+
+LightCraft reads camera raw files, image formats, metadata and sidecars, imports other photo catalogs, downloads and runs machine-learning models, and exposes CLI, JSON control, and MCP automation. Treat files, paths, metadata, catalogs, model files, automation requests, and command parameters as potentially malicious.
+
+## Reporting a vulnerability
+
+Please give the repository maintainers a reasonable opportunity to investigate and coordinate a fix before publishing exploitable details, proof-of-concept code, or weaponized files.
+
+This repository does not currently document a dedicated private security email or private reporting channel. Contact the repository maintainers through the repository owner/maintainer channels already listed in the project, provide only a minimal non-exploitable summary in public, and ask for an appropriate private transfer method before sharing sensitive details. Do not open a public issue containing a working exploit, secret, sensitive crash dump, or malicious attachment.
+
+If no private channel can be established, withhold weaponized material and report the smallest safe description that allows maintainers to make contact.
+
+## What to include
+
+A useful report includes:
+
+- affected LightCraft version, commit, or release artifact;
+- operating system, architecture, build profile (desktop or web), and relevant feature flags;
+- the affected component or path;
+- security impact and required attacker access;
+- exact reproduction steps;
+- expected behavior and actual behavior;
+- crash logs, backtraces, sanitizer output, or resource measurements when applicable;
+- whether the problem reproduces from a clean checkout;
+- any known workaround or containment.
+
+Remove credentials, personal paths, private photos, and unrelated system information from logs.
+
+## Malicious test files
+
+Do not attach a potentially harmful or non-redistributable file to a public issue. Initially provide its format, size, cryptographic hash, observed effect, provenance category (for example, synthetic or fuzz-generated), and the command needed to reproduce the problem. Coordinate a private transfer method with maintainers before sending the sample.
+
+Test files accepted into the repository must be minimized, free of personal or proprietary data, legally redistributable, and documented with the expected failure behavior. A fixed parser defect should receive a permanent regression test whenever safe and practical.
+
+## Scope
+
+Security reports may cover:
+
+- camera raw, DNG, TIFF, HEIF, JPEG and other image decoding, and EXIF/XMP metadata and sidecar parsing;
+- decompression bombs, oversized dimensions, integer overflow, memory exhaustion, recursion, or hangs;
+- the LightCraft catalog, and importing other catalogs and libraries (such as Lightroom catalogs);
+- import/export and filesystem path handling, including traversal, symlinks, and unsafe overwrite or move behavior;
+- downloading, verifying, unpacking and running machine-learning models (denoise, faces, masks);
+- engine command validation and serialization/deserialization;
+- the desktop control channel, the MCP server, and the MCP-to-app connection;
+- the WebAssembly build;
+- GPU resource validation or driver-facing input handling;
+- dependencies, CI, packaging, signing, checksums, and release artifact integrity.
+
+General bugs without a security impact should use the project's normal issue and contribution process.
+
+## Current limitations
+
+The control channel (`lightcraft --control PORT`) listens on loopback only and has no authentication, so any local process can drive the app while it is enabled; only enable it when you need it ([control-protocol.md](docs/control-protocol.md)).
diff --git a/apps/lightcraft-cli/src/main.rs b/apps/lightcraft-cli/src/main.rs
index 01dae3055..c8371cbb9 100644
--- a/apps/lightcraft-cli/src/main.rs
+++ b/apps/lightcraft-cli/src/main.rs
@@ -732,12 +732,13 @@ fn render(args: &[String]) -> Result<(), String> {
for (k, v) in opts {
p[k] = v;
}
- let mut o = ExportOptions::from_params(&p).map_err(|e| e.to_string())?;
if p.get("format").is_none() {
let ext = Path::new(&output).extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
- o.format = ExportFormat::parse(&ext)
- .ok_or_else(|| format!("{output}: unknown extension (use .jpg .png .tif .webp .avif .dng or --opt format=…)"))?;
+ ExportFormat::parse(&ext).ok_or_else(|| format!("{output}: unknown extension (use .jpg .png .tif .webp .avif .dng or --opt format=…)"))?;
+ // given before validating, so `bitDepth` is checked against the format written (issue #1952)
+ p["format"] = json!(ext);
}
+ let o = ExportOptions::from_params(&p).map_err(|e| e.to_string())?;
// Add to Apple Photos: refused before anything is written when it can't be done
let after = s.after_export(&o)?;
let e = export_photo(&mut s, lightcraft_engine::catalog::PhotoId(id), &o, 1)?;
diff --git a/apps/lightcraft-cli/tests/cli.rs b/apps/lightcraft-cli/tests/it/cli.rs
similarity index 100%
rename from apps/lightcraft-cli/tests/cli.rs
rename to apps/lightcraft-cli/tests/it/cli.rs
diff --git a/apps/lightcraft-cli/tests/it/main.rs b/apps/lightcraft-cli/tests/it/main.rs
new file mode 100644
index 000000000..0c07c6438
--- /dev/null
+++ b/apps/lightcraft-cli/tests/it/main.rs
@@ -0,0 +1,4 @@
+//! The integration tests, one module per file, linked into one test binary.
+
+mod cli;
+mod mcp_shutdown;
diff --git a/apps/lightcraft-cli/tests/mcp_shutdown.rs b/apps/lightcraft-cli/tests/it/mcp_shutdown.rs
similarity index 100%
rename from apps/lightcraft-cli/tests/mcp_shutdown.rs
rename to apps/lightcraft-cli/tests/it/mcp_shutdown.rs
diff --git a/apps/lightcraft-web/src/backend.rs b/apps/lightcraft-web/src/backend.rs
index e20f6dc9c..1dbc2266b 100644
--- a/apps/lightcraft-web/src/backend.rs
+++ b/apps/lightcraft-web/src/backend.rs
@@ -22,6 +22,12 @@ fn err(e: JsValue) -> String {
e.as_string().or_else(|| e.dyn_ref::().map(|e| String::from(e.message()))).unwrap_or_else(|| format!("{e:?}"))
}
+/// Did an OPFS call fail because the entry doesn't exist (`NotFoundError`)? Any other failure
+/// (security, type mismatch, an unreadable or evicted store) is an error, never "absent" (#1507).
+fn not_found(e: &JsValue) -> bool {
+ crate::files::is_not_found(Reflect::get(e, &"name".into()).ok().and_then(|n| n.as_string()).as_deref())
+}
+
/// `navigator.storage` in a window or a worker.
fn storage_manager() -> Option {
let g = js_sys::global();
@@ -134,10 +140,7 @@ impl Backend {
opts.set_create(create);
match JsFuture::from(dir.get_directory_handle_with_options(p, &opts)).await {
Ok(d) => dir = d.unchecked_into(),
- Err(e) if !create => {
- let _ = e;
- return Ok(None);
- }
+ Err(e) if !create && not_found(&e) => return Ok(None),
Err(e) => return Err(err(e)),
}
}
@@ -150,7 +153,7 @@ impl Backend {
opts.set_create(create);
match JsFuture::from(dir.get_file_handle_with_options(&name, &opts)).await {
Ok(h) => Ok(Some(h.unchecked_into())),
- Err(_) if !create => Ok(None),
+ Err(e) if !create && not_found(&e) => Ok(None),
Err(e) => Err(err(e)),
}
}
@@ -250,7 +253,7 @@ impl Backend {
let Some((dir, name)) = Self::parent(root, path, false).await? else { return Ok(()) };
match JsFuture::from(dir.remove_entry(&name)).await {
Ok(_) => Ok(()),
- Err(e) if Reflect::get(&e, &"name".into()).ok().and_then(|n| n.as_string()).as_deref() == Some("NotFoundError") => Ok(()),
+ Err(e) if not_found(&e) => Ok(()),
Err(e) => Err(err(e)),
}
}
diff --git a/apps/lightcraft-web/src/backup.rs b/apps/lightcraft-web/src/backup.rs
index 00ec12a41..281a32296 100644
--- a/apps/lightcraft-web/src/backup.rs
+++ b/apps/lightcraft-web/src/backup.rs
@@ -52,6 +52,18 @@ pub fn valid_hash(h: &str) -> bool {
!h.is_empty() && h.len() <= 128 && h.chars().all(|c| c.is_ascii_alphanumeric())
}
+/// Why a backup can't start yet, given [`lightcraft_engine::Session::unsaved`]: changes applied in
+/// the app but not yet written to browser storage (a save failed). The zip copies the stored
+/// library files, so it would report success while missing them; `None` when everything is saved.
+pub fn unsaved_refusal(unsaved: Option<(usize, &str)>) -> Option {
+ let (ops, why) = unsaved?;
+ let changes = if ops == 1 { "1 change".to_string() } else { format!("{ops} changes") };
+ Some(format!(
+ "Backup not started: {changes} could not be saved to browser storage yet ({why}), so the backup would miss them. \
+ Free up storage space; LightCraft retries the save with every change. Back up once nothing is left unsaved."
+ ))
+}
+
/// Zip entry name for an original.
pub fn original_entry(hash: &str, file_name: &str) -> String {
let name: String = file_name.chars().map(|c| if c == '/' || c == '\\' || c.is_control() { '_' } else { c }).collect();
diff --git a/apps/lightcraft-web/src/files.rs b/apps/lightcraft-web/src/files.rs
index d0c9f348b..9cd934ce5 100644
--- a/apps/lightcraft-web/src/files.rs
+++ b/apps/lightcraft-web/src/files.rs
@@ -198,6 +198,27 @@ impl Store for FilesStore {
/// Names of the library files read at start-up.
pub const LIBRARY_FILES: [&str; 6] = ["catalog.snap", "catalog.log", "presets.json", "view.json", "prefs.json", "ui.json"];
+/// Is a browser storage error, by its `DOMException` name, "the entry doesn't exist"? Only
+/// `NotFoundError` is; anything else (security, type mismatch, an unreadable store) is a failure.
+pub fn is_not_found(dom_exception_name: Option<&str>) -> bool {
+ dom_exception_name == Some("NotFoundError")
+}
+
+/// Preload the library files read at start-up (`None`: the file doesn't exist yet). A file that
+/// exists but couldn't be read stops start-up instead (#1507): opening the library without it
+/// would show an incomplete catalog and then save over the stored copy.
+pub fn preload_library(files: &Files, reads: Vec<(&str, Result>, String>)>) -> Result<(), String> {
+ let mut failed = Vec::new();
+ for (name, read) in reads {
+ match read {
+ Ok(Some(data)) => files.preload(name, data),
+ Ok(None) => {}
+ Err(e) => failed.push(format!("{name}: {e}")),
+ }
+ }
+ if failed.is_empty() { Ok(()) } else { Err(format!("couldn't read the library from browser storage ({})", failed.join("; "))) }
+}
+
#[cfg(test)]
mod tests {
use super::*;
@@ -282,6 +303,66 @@ mod tests {
assert_eq!(s2.catalog.photo(id).unwrap().rating, 5, "the rating survived");
}
+ /// A backup copies the stored library files, so while a save is failing it would miss the
+ /// queued changes: it is refused with the reason until they are written (#1508).
+ #[test]
+ fn backup_is_refused_while_changes_are_unsaved() {
+ let files = Files::default();
+ let mut s = Session::new();
+ let stores = LibraryStores { dir: "browser".into(), catalog: Box::new(files.store()), files: Box::new(files.store()), on_disk: false };
+ s.open_library_in(stores, true).unwrap();
+ assert_eq!(crate::backup::unsaved_refusal(s.unsaved()), None, "everything saved: the backup may start");
+ files.set_error(Some("QuotaExceededError".into()));
+ let _ = s.execute("photo.rate", &json!({"rating": 5}));
+ let refusal = crate::backup::unsaved_refusal(s.unsaved()).expect("refused while the rating is unsaved");
+ assert!(refusal.contains("could not be saved") && refusal.contains("QuotaExceeded"), "{refusal}");
+ files.set_error(None);
+ s.persist_if_dirty();
+ s.persist().unwrap();
+ assert_eq!(crate::backup::unsaved_refusal(s.unsaved()), None, "allowed again once the change is written");
+ }
+
+ #[test]
+ fn unsaved_refusal_counts_changes() {
+ use crate::backup::unsaved_refusal;
+ assert!(unsaved_refusal(Some((1, "quota"))).unwrap().contains("1 change could not"));
+ assert!(unsaved_refusal(Some((3, "quota"))).unwrap().contains("3 changes could not"));
+ }
+
+ /// Start-up only treats a missing file as absent: a stored file that couldn't be read stops
+ /// it, naming the file, instead of opening an incomplete library (#1507).
+ #[test]
+ fn unreadable_library_file_stops_start_up() {
+ let files = Files::default();
+ let reads = vec![
+ ("catalog.snap", Ok(Some(b"snap".to_vec()))),
+ ("catalog.log", Err("NotReadableError: the file could not be read".to_string())),
+ ("presets.json", Ok(None)),
+ ];
+ let e = preload_library(&files, reads).unwrap_err();
+ assert!(e.contains("catalog.log") && e.contains("NotReadableError"), "{e}");
+ }
+
+ /// A new library (nothing stored yet) still starts.
+ #[test]
+ fn missing_library_files_are_a_new_library() {
+ let files = Files::default();
+ let reads = LIBRARY_FILES.iter().map(|n| (*n, Ok(None))).collect();
+ preload_library(&files, reads).unwrap();
+ assert!(files.get("catalog.snap").is_none());
+ let reads = vec![("catalog.snap", Ok(Some(b"snap".to_vec()))), ("catalog.log", Ok(None))];
+ preload_library(&files, reads).unwrap();
+ assert_eq!(files.get("catalog.snap").as_deref(), Some(&b"snap"[..]));
+ }
+
+ #[test]
+ fn only_not_found_errors_mean_absent() {
+ assert!(is_not_found(Some("NotFoundError")));
+ for name in [Some("SecurityError"), Some("TypeMismatchError"), Some("NotReadableError"), Some("InvalidStateError"), None] {
+ assert!(!is_not_found(name), "{name:?}");
+ }
+ }
+
#[test]
fn library_survives_reload_through_flushes() {
let mut disk = BTreeMap::new();
diff --git a/apps/lightcraft-web/src/web.rs b/apps/lightcraft-web/src/web.rs
index 6a4487d09..14a5d050b 100644
--- a/apps/lightcraft-web/src/web.rs
+++ b/apps/lightcraft-web/src/web.rs
@@ -173,6 +173,9 @@ fn services(originals: Originals, backend: Option, files: Files, frozen
screen_profile: None,
backup_library: Some(Box::new(move |session: &mut Session| {
let Some(b) = backup_backend.clone() else { return Err("nothing is stored in this browser session (?store=memory)".into()) };
+ if let Some(why) = crate::backup::unsaved_refusal(session.unsaved()) {
+ return Err(why);
+ }
// the photos' own names for the originals in the zip
let names: std::collections::HashMap = session
.catalog
@@ -280,6 +283,9 @@ struct Boot {
index: ThumbIndex,
/// The library folder in storage (`library`, or a restored backup's).
lib_dir: String,
+ /// Library files that exist but couldn't be read (#1507): the library isn't opened and
+ /// nothing is saved, so the stored copy stays as it was.
+ load_error: Option,
}
async fn boot(opts: Options) -> Boot {
@@ -298,6 +304,7 @@ async fn boot(opts: Options) -> Boot {
let files = Files::default();
let mut index = ThumbIndex::default();
let mut lib_dir = DEFAULT_LIBRARY_DIR.to_string();
+ let mut load_error = None;
if let Some(b) = &backend {
if opts.reset {
// everything this site keeps in the browser, photos included: never without asking
@@ -315,21 +322,32 @@ async fn boot(opts: Options) -> Boot {
}
}
// a restored backup lives in its own folder (see `backup`)
- if let Ok(Some(d)) = b.read(ACTIVE_LIBRARY).await {
- let d = String::from_utf8_lossy(&d).trim().to_string();
- if valid_library_dir(&d) {
- lib_dir = d;
+ match b.read(ACTIVE_LIBRARY).await {
+ Ok(Some(d)) => {
+ let d = String::from_utf8_lossy(&d).trim().to_string();
+ if valid_library_dir(&d) {
+ lib_dir = d;
+ }
+ }
+ Ok(None) => {}
+ // not knowing which library is in use, any library opened could be the wrong one
+ Err(e) => load_error = Some(format!("couldn't read which library is in use from browser storage ({e})")),
+ }
+ if load_error.is_none() {
+ let mut reads = Vec::new();
+ for name in LIBRARY_FILES {
+ reads.push((name, b.read(&library_key(&lib_dir, name)).await));
+ }
+ if let Err(e) = crate::files::preload_library(&files, reads) {
+ log::error!("{e}");
+ load_error = Some(e);
}
}
- for name in LIBRARY_FILES {
- match b.read(&library_key(&lib_dir, name)).await {
- Ok(Some(data)) => files.preload(name, data),
- Ok(None) => {}
- Err(e) => log::error!("reading {name}: {e}"),
- }
- }
- if let Ok(Some(j)) = b.read(THUMB_INDEX).await {
- index = ThumbIndex::from_json(&j);
+ let index_read = b.read(THUMB_INDEX).await;
+ match &index_read {
+ Ok(Some(j)) => index = ThumbIndex::from_json(j),
+ Ok(None) => {}
+ Err(e) => log::warn!("reading the thumbnail index: {e}"),
}
crate::backend::request_persistence(|granted| {
if !granted {
@@ -339,7 +357,8 @@ async fn boot(opts: Options) -> Boot {
);
}
});
- // thumbnails stored without an index entry (index saved late, or lost): delete them
+ // thumbnails stored without an index entry (index saved late, or lost): delete them; not
+ // when the index couldn't be read, which would make every thumbnail look unindexed
let b2 = b.clone();
let known: std::collections::HashSet = b
.list("thumbs")
@@ -349,7 +368,7 @@ async fn boot(opts: Options) -> Boot {
.filter(|n| n.ends_with(".jpg"))
.map(|n| n.trim_end_matches(".jpg").to_string())
.collect();
- let orphans: Vec = known.into_iter().filter(|k| !index.contains(k)).collect();
+ let orphans: Vec = if index_read.is_ok() { known.into_iter().filter(|k| !index.contains(k)).collect() } else { Vec::new() };
if !orphans.is_empty() {
wasm_bindgen_futures::spawn_local(async move {
for k in &orphans {
@@ -366,7 +385,7 @@ async fn boot(opts: Options) -> Boot {
index.len(),
index.total() as f64 / 1e6
);
- Boot { opts, backend, files, index, lib_dir }
+ Boot { opts, backend, files, index, lib_dir, load_error }
}
struct WebApp {
@@ -389,7 +408,7 @@ struct WebApp {
impl WebApp {
fn new(cc: &eframe::CreationContext<'_>, boot: Boot, chinese_font: Vec) -> Self {
- let Boot { opts, backend, files, index, lib_dir } = boot;
+ let Boot { opts, backend, files, index, lib_dir, load_error } = boot;
let originals = Originals::default();
let t = perf_now();
let mut session = Session::new();
@@ -401,7 +420,13 @@ impl WebApp {
on_disk: false,
};
let mut problem = None;
- match session.open_library_in(stores, true).cloned() {
+ // a library that couldn't be read is not opened: it would show incomplete, then save over the stored copy
+ let read_failed = load_error.is_some();
+ let opened = match load_error {
+ Some(e) => Err(format!("{e}. Nothing was changed in storage")),
+ None => session.open_library_in(stores, true).cloned().map_err(|e| e.to_string()),
+ };
+ match opened {
Ok(r) => log::info!(
"lightcraft: library {} in {:.0} ms ({} photos; snapshot seq {}, {} ops replayed)",
if r.created { "created" } else { "loaded" },
@@ -432,7 +457,8 @@ impl WebApp {
}
// previews are large (≤ 2560 px, f32): keep few in a 32-bit address space
session.media.preview_capacity = 3;
- let frozen = Rc::new(Cell::new(false));
+ // nothing is saved while the stored library couldn't be read
+ let frozen = Rc::new(Cell::new(read_failed));
let mut app = LightcraftApp::new(session, services(originals.clone(), backend.clone(), files.clone(), frozen.clone(), cc.egui_ctx.clone()))
.with_chinese_font(chinese_font);
let ui_written = files.get("ui.json").unwrap_or_default();
@@ -667,11 +693,40 @@ impl eframe::App for WebApp {
}
}
+/// "Auto" follows the browser's languages (issue #2085): the first of `navigator.languages` (else
+/// `navigator.language`) that LightCraft ships becomes the UI's default. Every step is fallible
+/// (as in [`crate::safety::acquire_tab_lock`]): without a usable navigator Auto stays English,
+/// as before.
+fn install_browser_language() {
+ let Ok(navigator) = js_sys::Reflect::get(&js_sys::global(), &"navigator".into()) else { return };
+ let mut tags: Vec = Vec::new();
+ if let Ok(languages) = js_sys::Reflect::get(&navigator, &"languages".into())
+ && let Some(languages) = languages.dyn_ref::()
+ {
+ for tag in languages.iter() {
+ if let Some(tag) = tag.as_string() {
+ tags.push(tag);
+ }
+ }
+ }
+ if tags.is_empty()
+ && let Ok(language) = js_sys::Reflect::get(&navigator, &"language".into())
+ && let Some(language) = language.as_string()
+ {
+ tags.push(language);
+ }
+ if let Some(language) = lightcraft_ui_egui::i18n::locale_from_tags(&tags) {
+ lightcraft_ui_egui::i18n::set_default_language(language);
+ log::info!("lightcraft: default language {language:?} from the browser's languages");
+ }
+}
+
/// Start the app with the separately fetched Simplified Chinese font (empty in font-free builds).
#[wasm_bindgen]
pub fn start(chinese_font: Vec) {
eframe::WebLogger::init(log::LevelFilter::Info).ok();
safety::install_panic_hook();
+ install_browser_language();
log::info!("lightcraft: wasm instantiated at {:.0} ms", perf_now());
if chinese_font.is_empty() {
log::warn!("lightcraft: no Simplified Chinese font supplied; Chinese-only glyphs will show as boxes");
diff --git a/apps/lightcraft/Cargo.toml b/apps/lightcraft/Cargo.toml
index 26122c3e6..95e080974 100644
--- a/apps/lightcraft/Cargo.toml
+++ b/apps/lightcraft/Cargo.toml
@@ -26,6 +26,7 @@ lightcraft-raster = { workspace = true }
eframe = { workspace = true, features = ["default_fonts", "wgpu", "glow", "accesskit", "wayland", "x11"] }
egui = { workspace = true }
serde_json = { workspace = true }
+chrono = { workspace = true }
# probing the window's renderer before it opens (`window_gpu`)
pollster = { workspace = true }
log = { workspace = true }
diff --git a/apps/lightcraft/src/control_server.rs b/apps/lightcraft/src/control_server.rs
index 537c75bd1..c7244c703 100644
--- a/apps/lightcraft/src/control_server.rs
+++ b/apps/lightcraft/src/control_server.rs
@@ -39,22 +39,33 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver {
fn accept_loop(listener: TcpListener, tx: Sender, ctx: egui::Context) {
let open = Arc::new(AtomicUsize::new(0));
- for mut stream in listener.incoming().flatten() {
- if open.fetch_add(1, Ordering::SeqCst) >= MAX_CONNECTIONS {
- open.fetch_sub(1, Ordering::SeqCst);
- let _ = writeln!(stream, "{}", json!({"ok": false, "error": "too many control connections"}));
- continue;
- }
- let tx = tx.clone();
- let ctx = ctx.clone();
- let open = Arc::clone(&open);
- std::thread::spawn(move || {
- serve(stream, &tx, &ctx);
- open.fetch_sub(1, Ordering::SeqCst);
- });
+ for stream in listener.incoming().flatten() {
+ let _ = spawn_connection(stream, tx.clone(), ctx.clone(), Arc::clone(&open), IDLE_TIMEOUT);
}
}
+/// Admit and serve one connection, releasing its slot when serving ends.
+fn spawn_connection(
+ mut stream: TcpStream,
+ tx: Sender,
+ ctx: egui::Context,
+ open: Arc,
+ idle_timeout: Duration,
+) -> Option> {
+ if open.fetch_add(1, Ordering::SeqCst) >= MAX_CONNECTIONS {
+ open.fetch_sub(1, Ordering::SeqCst);
+ let _ = writeln!(stream, "{}", json!({"ok": false, "error": "too many control connections"}));
+ return None;
+ }
+ Some(std::thread::spawn(move || {
+ serve(stream, &tx, &ctx, idle_timeout);
+ open.fetch_sub(1, Ordering::SeqCst);
+ }))
+}
+
+/// Five minutes allows pauses between automation commands without retaining abandoned slots forever.
+const IDLE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+
/// How long a request waits for its reply.
const REPLY_TIMEOUT: Duration = Duration::from_secs(60);
/// A request the app has not picked up while it drew no frame for this long is given up: the
@@ -66,9 +77,17 @@ const NO_FRAMES_AFTER: Duration = Duration::from_secs(5);
pub const HIDDEN_WINDOW_ERROR: &str = "the app drew no frame for 5 s, so the request was not run: its window is probably not visible \
(on Wayland a window on a hidden workspace or minimized is not redrawn, which pauses the app). Bring the window on screen and send it again";
-fn serve(stream: TcpStream, tx: &Sender, ctx: &egui::Context) {
- let Ok(read) = stream.try_clone() else { return };
- serve_lines(read, stream, |method, params| {
+/// Reads and writes go through the one `stream` (`&TcpStream` is `Read` and `Write`): no
+/// `try_clone`. On Windows a cloned socket handle is inheritable, so every program the app starts
+/// while a client is connected (a link in the browser, Show in Explorer, an external editor) kept a
+/// copy of the connection: closing it then reached the client only when that program exited, as a
+/// reset instead of a clean close.
+fn serve(stream: TcpStream, tx: &Sender, ctx: &egui::Context, idle_timeout: Duration) {
+ if let Err(e) = stream.set_read_timeout(Some(idle_timeout)) {
+ log::warn!("control connection closed: could not set idle read timeout: {e}");
+ return;
+ }
+ serve_lines(&stream, &stream, |method, params| {
let (req, rrx) = ControlRequest::new(method, params);
let state = Arc::clone(&req.state);
tx.send(req).ok()?;
@@ -157,7 +176,10 @@ fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec, max: usize) -
buf.clear();
// `take` bounds the bytes buffered for one line: a peer can't make us allocate more than `max`.
let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
- let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| e.to_string())?;
+ let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| match e.kind() {
+ std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut => "control connection idle read timed out; closing the connection".to_string(),
+ _ => e.to_string(),
+ })?;
if n == 0 {
return Ok(false);
}
@@ -209,6 +231,103 @@ fn serve_lines(read: R, mut out: W, mut handle: impl FnMut(St
mod tests {
use super::*;
+ /// Own the client and worker together: even a failing timeout assertion closes the socket
+ /// before joining, so the regression cannot leave a worker stuck in a read.
+ struct Connection {
+ client: BufReader,
+ requests: Receiver,
+ worker: Option>,
+ }
+
+ impl Connection {
+ /// `before` acts on the client before the worker starts reading, so what it sends is
+ /// already there however late this thread gets scheduled.
+ fn new(open: &Arc, idle: Duration, before: impl FnOnce(&mut TcpStream)) -> Self {
+ let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+ let mut client = TcpStream::connect(listener.local_addr().unwrap()).unwrap();
+ client.set_read_timeout(Some(Duration::from_secs(3))).unwrap();
+ let (stream, _) = listener.accept().unwrap();
+ before(&mut client);
+ let (tx, requests) = channel();
+ let worker = spawn_connection(stream, tx, egui::Context::default(), Arc::clone(open), idle).unwrap();
+ Self { client: BufReader::new(client), requests, worker: Some(worker) }
+ }
+
+ fn join(&mut self) {
+ if let Some(worker) = self.worker.take() {
+ worker.join().unwrap();
+ }
+ }
+ }
+
+ impl Drop for Connection {
+ fn drop(&mut self) {
+ let _ = self.client.get_ref().shutdown(std::net::Shutdown::Both);
+ while let Ok(req) = self.requests.try_recv() {
+ let _ = req.reply.send(json!({"ok": false, "error": "test closing"}));
+ }
+ self.join();
+ }
+ }
+
+ #[test]
+ fn idle_connections_release_their_slots_without_dispatching() {
+ for input in ["", "{\"method\":\"engine.execute\""] {
+ let open = Arc::new(AtomicUsize::new(0));
+ let mut connection = Connection::new(&open, Duration::from_millis(100), |c| c.write_all(input.as_bytes()).unwrap());
+ assert_eq!(open.load(Ordering::SeqCst), 1);
+ let mut reply = String::new();
+ let closed = connection.client.read_to_string(&mut reply);
+ assert!(closed.is_ok(), "idle connection stayed open: {closed:?}");
+ connection.join();
+ assert_eq!(open.load(Ordering::SeqCst), 0, "the production worker releases its slot");
+ assert!(connection.requests.try_recv().is_err(), "incomplete input never runs");
+ let reply: Value = serde_json::from_str(&reply).unwrap();
+ assert_eq!(reply["ok"], false);
+ assert!(reply["error"].as_str().unwrap().contains("idle read timed out"));
+
+ // A subsequent connection is admitted through the same accounting path.
+ let mut next = Connection::new(&open, Duration::from_secs(1), |c| c.shutdown(std::net::Shutdown::Write).unwrap());
+ let mut eof = String::new();
+ next.client.read_to_string(&mut eof).unwrap();
+ next.join();
+ assert!(eof.is_empty());
+ assert_eq!(open.load(Ordering::SeqCst), 0);
+ }
+ }
+
+ #[test]
+ fn persistent_requests_and_slow_replies_outlive_the_idle_read_timeout() {
+ let open = Arc::new(AtomicUsize::new(0));
+ let request = |id: u64| format!("{}\n", json!({"id": id, "method": "engine.commands"}));
+ // Each request reaches the socket before the worker reads it (the next one while the worker
+ // waits for the reply), so only the reply waits outlast the idle timeout, however slowly
+ // this thread runs.
+ let mut connection = Connection::new(&open, Duration::from_millis(100), |c| c.write_all(request(1).as_bytes()).unwrap());
+ for id in [1, 2] {
+ let req = connection.requests.recv_timeout(Duration::from_secs(10)).unwrap();
+ assert_eq!(req.method, "engine.commands");
+ assert!(req.take());
+ if id == 1 {
+ connection.client.get_mut().write_all(request(2).as_bytes()).unwrap();
+ } else {
+ connection.client.get_mut().shutdown(std::net::Shutdown::Write).unwrap();
+ }
+ // A dispatched command waits for its reply, not for socket input.
+ std::thread::sleep(Duration::from_millis(250));
+ req.reply.send(json!({"ok": true, "result": id})).unwrap();
+ let mut reply = String::new();
+ connection.client.read_line(&mut reply).unwrap();
+ let reply: Value = serde_json::from_str(&reply).unwrap();
+ assert_eq!(reply, json!({"id": id, "ok": true, "result": id}));
+ }
+ let mut eof = String::new();
+ connection.client.read_to_string(&mut eof).unwrap();
+ connection.join();
+ assert!(eof.is_empty());
+ assert_eq!(open.load(Ordering::SeqCst), 0);
+ }
+
/// Issue #718: an app that draws no frames (a hidden Wayland window) gets the request given
/// up with a reason, quickly, and the app then skips it instead of running it late.
#[test]
@@ -216,7 +335,8 @@ mod tests {
let (req, rrx) = ControlRequest::new("ui.inspect", json!({}));
let t0 = std::time::Instant::now();
let r = await_reply(&rrx, &req.state, || 7, || {}, Duration::from_millis(50), Duration::from_secs(10));
- assert!(t0.elapsed() < Duration::from_secs(2));
+ // the frame window (50 ms), not the 10 s timeout; the margin is for a slow machine
+ assert!(t0.elapsed() < Duration::from_secs(5), "{:?}", t0.elapsed());
assert_eq!(r["ok"], false);
assert!(r["error"].as_str().unwrap().contains("not visible"), "{r}");
assert!(!req.take(), "the app does not run it once it shows up");
@@ -337,6 +457,37 @@ mod tests {
assert!(read_bounded_line(&mut &[b'a'; 11][..], &mut buf, 10).is_err());
}
+ /// A program the app starts while a client is connected doesn't keep the connection open:
+ /// when the server closes it, the client sees that at once, not when the program exits.
+ #[cfg(windows)]
+ #[test]
+ fn a_program_started_meanwhile_does_not_hold_the_connection_open() {
+ let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+ let addr = listener.local_addr().unwrap();
+ let (tx, _rx) = channel::();
+ let server = std::thread::spawn(move || {
+ let (s, _) = listener.accept().unwrap();
+ serve(s, &tx, &egui::Context::default(), IDLE_TIMEOUT);
+ });
+ let mut c = TcpStream::connect(addr).unwrap();
+ c.set_read_timeout(Some(Duration::from_secs(20))).unwrap();
+ // the connection is being served: start a program that lives about 4 s
+ std::thread::sleep(Duration::from_millis(200));
+ let mut child = std::process::Command::new("cmd").args(["/c", "ping -n 5 127.0.0.1 >nul"]).spawn().unwrap();
+ std::thread::sleep(Duration::from_millis(200));
+ // junk makes the server answer once and close
+ c.write_all(b"hello\n").unwrap();
+ let t0 = std::time::Instant::now();
+ let mut text = String::new();
+ let read = c.read_to_string(&mut text);
+ let waited = t0.elapsed();
+ server.join().unwrap();
+ let _ = child.wait();
+ assert!(read.is_ok(), "the close must be clean, not a reset: {read:?}");
+ assert!(text.contains("closing the connection"), "{text}");
+ assert!(waited < Duration::from_secs(2), "the client saw the close only after {waited:?}, when the program exited");
+ }
+
#[test]
fn tcp_connection_is_closed_after_junk() {
// End to end over a real loopback socket (the transport the app uses).
diff --git a/apps/lightcraft/src/logging.rs b/apps/lightcraft/src/logging.rs
index 718392f35..6239aded6 100644
--- a/apps/lightcraft/src/logging.rs
+++ b/apps/lightcraft/src/logging.rs
@@ -113,28 +113,36 @@ fn matches(name: &str, target: &str) -> bool {
}
/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch.
+/// A clock far past chrono's year range still converts (the calendar repeats every 400 years), so
+/// logging never panics and never silently resets to the epoch for a convertible instant.
pub fn timestamp(t: SystemTime) -> String {
let since = t.duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
- let secs = since.as_secs();
- let (days, rem) = (secs / 86_400, secs % 86_400);
- let (y, m, d) = civil_from_days(days);
- format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, since.subsec_millis())
+ // Pre-1970 is clamped to the epoch by `unwrap_or_default` above. `as_secs` is `u64`; a value
+ // past `i64::MAX` seconds saturates rather than falling back to the epoch.
+ let secs = i64::try_from(since.as_secs()).unwrap_or(i64::MAX);
+ let (y, t) = utc_parts(secs, since.subsec_nanos());
+ // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+ format!("{y:04}-{}", t.format("%m-%dT%H:%M:%S%.3fZ"))
}
-/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
-/// `civil_from_days`, unsigned because `timestamp` clamps at the epoch). Saturating, so no clock
-/// value can overflow it.
-fn civil_from_days(days: u64) -> (u64, u64, u64) {
- let z = days.saturating_add(719_468);
- let era = z / 146_097;
- let doe = z % 146_097;
- let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
- let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
- let mp = (5 * doy + 2) / 153;
- let d = doy - (153 * mp + 2) / 5 + 1;
- let m = if mp < 10 { mp + 3 } else { mp - 9 };
- let y = era.saturating_mul(400).saturating_add(yoe).saturating_add(u64::from(m <= 2));
- (y, m, d)
+/// Unix seconds (+ nanos) → (proleptic Gregorian year, the same wall-clock instant moved into
+/// chrono's range by whole 400-year cycles). The calendar repeats every 400 years (146_097 days),
+/// so month, day and time of day come from chrono and only the year is carried, which keeps every
+/// `i64` exact. Replaces the old hand-rolled `civil_from_days`; chrono is the only calendar logic.
+fn utc_parts(secs: i64, nanos: u32) -> (i64, chrono::NaiveDateTime) {
+ use chrono::Datelike;
+ let (days, sod) = (secs.div_euclid(86_400), secs.rem_euclid(86_400));
+ let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+ // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+ let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+ let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, nanos.min(999_999_999)));
+ match (date, time) {
+ (Some(d), Some(t)) => {
+ let y = i128::from(d.year()) + i128::from(cycles) * 400;
+ (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.and_time(t))
+ }
+ _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+ }
}
fn numbered(dir: &Path, n: usize) -> PathBuf {
@@ -483,6 +491,20 @@ mod tests {
assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(4_107_542_400)), "2100-03-01T00:00:00.000Z");
// Before the epoch (a clock set wrong) clamps instead of panicking.
assert_eq!(timestamp(UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01T00:00:00.000Z");
+ // Past chrono's year range still converts via the 400-year cycle (the old code did too,
+ // through `civil_from_days`): never a silent reset to the epoch. Platform-safe: Windows'
+ // SystemTime can't hold this instant, so it is only checked where it exists.
+ // `u64::MAX / 2` seconds == `i64::MAX` seconds → year 292277026596 (old output).
+ if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(u64::MAX / 2)) {
+ assert_eq!(timestamp(far), "292277026596-12-04T15:30:07.000Z");
+ }
+ // Years past 9999 keep the plain zero-padded year (no `+`).
+ assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(253_402_300_800)), "10000-01-01T00:00:00.000Z");
+ // 10_000_000_000_000 s is far beyond chrono's range; old output is year 318857.
+ // Windows' SystemTime holds only up to about year 30828, so this is checked where it fits.
+ if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(10_000_000_000_000)) {
+ assert_eq!(timestamp(far), "318857-05-20T17:46:40.000Z");
+ }
}
#[test]
diff --git a/apps/lightcraft/src/native_menu.rs b/apps/lightcraft/src/native_menu.rs
index 4ac40bcac..7f8bd6006 100644
--- a/apps/lightcraft/src/native_menu.rs
+++ b/apps/lightcraft/src/native_menu.rs
@@ -456,10 +456,6 @@ mod tests {
set_language(*language);
assert!(seen.insert(structure_of(&bar)), "{language:?} shares another language's menu structure key");
}
- set_language(Locale::ZhHant);
- assert_eq!(label_text("File"), "檔案");
- assert_eq!(label_text("Settings…"), "設定…");
- assert_eq!(label_text("Quit LightCraft"), "結束 LightCraft");
set_language(Locale::En);
}
diff --git a/assets/ATTRIBUTION.md b/assets/ATTRIBUTION.md
index 7f8a8a719..30eea5654 100644
--- a/assets/ATTRIBUTION.md
+++ b/assets/ATTRIBUTION.md
@@ -33,7 +33,11 @@ covers a whole directory), or if a licence file referenced in the Licence column
| `crates/ui-egui/locales/uk.json`, `crates/ui-egui/locales/uk-formats.json` | Ukrainian interface catalogs | @dmatviichuk with Codex; PhotoCraft, FilmCraft and VectorCraft translation contributors for reused labels | original translations from English source; 337 initial English-key matches reviewed from [PhotoCraft 69c41f3](https://github.com/storytold/photocraft/blob/69c41f3523e147eb215da8c7b4c29b18b35d1c63/crates/ui-egui/src/i18n/uk.tsv), [FilmCraft 4854c27](https://github.com/storytold/filmcraft/blob/4854c277536fe8118257362304b6a7d82d8e704b/crates/ui-egui/src/i18n/uk.tsv), [VectorCraft 4b44265](https://github.com/storytold/vectorcraft/blob/4b44265965fdd6ffedfd6182a892c1a6c360d344/crates/ui-egui/src/i18n/uk.tsv) | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`, also the source repositories' licences) | 2026-10-09 | adapted to LightCraft photo-development context, completed catalogs, reviewed spelling and placeholders |
| `crates/ui-egui/locales/cs.json`, `crates/ui-egui/locales/cs-formats.json` | Czech interface catalogs | @Losminek with AI assistance (Codex) | original work: translations of English source phrases, reviewed against the app UI conventions; no external translation material | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | 2026-10-11 | catalog coverage, Czech dates and count-neutral wording; independent scope/terminology review; native-speaker proofreading pending |
| `crates/ui-egui/locales/it.json`, `crates/ui-egui/locales/it-formats.json` | Italian interface catalogs | @GabrielePecchioli with Claude Code; PhotoCraft, VectorCraft, PdfCraft and WordCraft translation contributors for reused labels | original translations from English source; 410 initial English-key matches reviewed from [PhotoCraft da3da09](https://github.com/storytold/photocraft/blob/da3da0942c14c1159f40c652afcf33584332c733/crates/ui-egui/src/i18n/it.tsv), [VectorCraft 5432821](https://github.com/storytold/vectorcraft/blob/543282148007bcb5633c493a5374cd26b0339c8d/crates/ui-egui/src/i18n/it.tsv), [PdfCraft e8e275c](https://github.com/storytold/pdfcraft/blob/e8e275cbd40ccd0dc6b56f82b16a575571043702/crates/ui-egui/src/i18n/it.tsv) and the Italian WordCraft catalog ([storytold/wordcraft#598](https://github.com/storytold/wordcraft/pull/598)); 46 of them retranslated where the sibling's meaning didn't fit a photo app | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`, also the source repositories' licences) | 2026-10-12 | adapted to LightCraft photo-development context, count-neutral labels for Italian plural agreement, reviewed placeholders |
+| `crates/ui-egui/locales/id.json`, `crates/ui-egui/locales/id-formats.json` | Indonesian interface catalogs | @RevDonz with Claude Code; PhotoCraft, VectorCraft, FilmCraft and FigCraft translation contributors for reused labels | original translations from English source; 356 labels match the sibling apps' Indonesian wording, reviewed from [PhotoCraft c39d752](https://github.com/storytold/photocraft/blob/c39d752758155492bbaba71d802cfaa03206fb4a/crates/ui-egui/src/i18n/id.tsv), [VectorCraft 9fe0f03](https://github.com/storytold/vectorcraft/blob/9fe0f03de2bd29e8c86a1179f977c3e651069424/crates/ui-egui/src/i18n/id.tsv), [FilmCraft fae7f8a](https://github.com/storytold/filmcraft/blob/fae7f8a9be09bd74f95fbe08c3d98adc17fe1030/crates/ui-egui/src/i18n/id.tsv) and [FigCraft 8482c3e](https://github.com/storytold/figcraft/blob/8482c3e85bc5f2a430e2f3be2826674872f6d084/crates/ui-egui/locales/id.toml) | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`, also the source repositories' licences) | 2026-10-19 | adapted to LightCraft's photo context, count-neutral nouns, reviewed placeholders |
| `crates/ui-egui/locales/ka.json`, `crates/ui-egui/locales/ka-formats.json` | Georgian interface catalogs | Davit Matchakhelidze with Claude; WordCraft, GridCraft, PhotoCraft, FilmCraft and VectorCraft Georgian catalogs for reused labels | original translations from the English source (meaning-based, no vendor localization used); 450 English-key matches reused from the sibling Craft apps' Georgian catalogs | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | 2026-10-12 | adapted to LightCraft photo-library and raw-development context; count-neutral numerals; placeholders checked |
+| `crates/ui-egui/locales/sv.json`, `crates/ui-egui/locales/sv-formats.json` | Swedish interface catalogs | LightCraft contributors | original work: clean-room Swedish translations of English source phrases | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | 2026-10-15 | none |
+| `crates/ui-egui/locales/fi.json`, `crates/ui-egui/locales/fi-formats.json` | Finnish interface catalogs | @roopeg with Claude Code (AI-assisted; native-speaker review by @roopeg) | original work: translations of the English source phrases, using common Finnish photo-editing vocabulary; no external translation material | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | 2026-10-17 | count-neutral labels for Finnish partitive agreement, Finnish dates and times (`20.9.2026`, `16:04`), reviewed placeholders |
+| `crates/ui-egui/locales/vi.json`, `crates/ui-egui/locales/vi-formats.json` | Vietnamese interface catalogs | @duydev (DUY Tran Nhat) with AI assistance (Cursor) | original work: translations of English source phrases; no external translation material | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | 2026-10-13 | plural-neutral counts, Vietnamese dates and weekdays, reviewed placeholders |
Notes
- Fonts authored or published by Adobe (Source Sans/Serif/Code, Source Han, …) are not used, even though some are
diff --git a/contributors/people.toml b/contributors/people.toml
index 08d002e8b..4eb002cef 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -57,3 +57,10 @@ sync_github_name = false
[people.egegl]
real_name = "Ege Gursel"
sync_github_name = true
+
+[people.mahmatias]
+display_name = "Márcio Matias de Andrade"
+sync_github_name = true
+
+[people.ronibalthazar]
+sync_github_name = true
diff --git a/crates/catalog/Cargo.toml b/crates/catalog/Cargo.toml
index 97d8868de..27273d5c4 100644
--- a/crates/catalog/Cargo.toml
+++ b/crates/catalog/Cargo.toml
@@ -17,6 +17,7 @@ serde_json = { workspace = true }
thiserror = { workspace = true }
crc32fast = { workspace = true }
log = { workspace = true }
+chrono = { workspace = true }
web-time = { workspace = true }
[dev-dependencies]
diff --git a/crates/catalog/src/dates.rs b/crates/catalog/src/dates.rs
index 4d16c2f4d..2b71049ee 100644
--- a/crates/catalog/src/dates.rs
+++ b/crates/catalog/src/dates.rs
@@ -2,6 +2,7 @@
//! weekday and month names, shifting a time by an offset, and grouping a photo list into runs of
//! the same day / month / year (the date headers of the photo grid).
+use chrono::Datelike;
use serde::{Deserialize, Serialize};
pub use crate::stacks::iso_seconds;
@@ -11,32 +12,32 @@ pub const WEEKDAYS: [&str; 7] = ["Monday", "Tuesday", "Wednesday", "Thursday", "
pub const MONTHS: [&str; 12] =
["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
-/// Unix seconds → `YYYY-MM-DDTHH:MM:SS` (proleptic Gregorian; H. Hinnant's algorithm).
+/// Unix seconds → `YYYY-MM-DDTHH:MM:SS` (UTC, proleptic Gregorian). A time outside chrono's year
+/// range still converts: the calendar repeats every 400 years, so the instant is moved into range
+/// by whole cycles and only the year is carried (matching the old `civil_from_days`), rather than
+/// resetting to the epoch. The callers here stay well inside years 0000–9999.
pub fn civil(secs: i64) -> String {
- let days = secs.div_euclid(86_400);
- let rem = secs.rem_euclid(86_400);
- let (y, m, d) = civil_from_days(days);
- format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}", rem / 3600, rem % 3600 / 60, rem % 60)
-}
-
-/// Days since 1970-01-01 → (year, month 1..=12, day 1..=31).
-pub fn civil_from_days(days: i64) -> (i64, i64, i64) {
- let z = days + 719_468;
- let era = z.div_euclid(146_097);
- let doe = z - era * 146_097;
- let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
- let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
- let mp = (5 * doy + 2) / 153;
- let d = doy - (153 * mp + 2) / 5 + 1;
- let m = if mp < 10 { mp + 3 } else { mp - 9 };
- (yoe + era * 400 + i64::from(m <= 2), m, d)
+ let (days, sod) = (secs.div_euclid(86_400), secs.rem_euclid(86_400));
+ let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+ // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+ let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+ let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+ match (date, time) {
+ (Some(d), Some(t)) => {
+ let y = i128::from(d.year()) + i128::from(cycles) * 400;
+ let y = i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX });
+ // `{:04}` rather than `%Y`, which writes a `+` before years past 9999 (the old `{y:04}` did not).
+ format!("{y:04}-{}", d.and_time(t).format("%m-%dT%H:%M:%S"))
+ }
+ _ => "1970-01-01T00:00:00".to_string(), // unreachable
+ }
}
/// Weekday name of an ISO date (`None` if it doesn't parse).
pub fn weekday(iso: &str) -> Option<&'static str> {
let days = iso_seconds(iso.get(..10)?)?.div_euclid(86_400);
- // 1970-01-01 was a Thursday
- Some(WEEKDAYS[(days + 3).rem_euclid(7) as usize])
+ let date = chrono::NaiveDate::from_num_days_from_ce_opt(i32::try_from(days.checked_add(719_163)?).ok()?)?;
+ Some(WEEKDAYS[date.weekday().num_days_from_monday() as usize])
}
/// Shift an ISO time by `secs`, keeping anything after the seconds (fractions, zone) as it was.
@@ -156,38 +157,56 @@ impl Catalog {
/// never split by a header. Empty for sort keys without a date and for [`GroupBy::None`]
/// ([`GroupBy::Auto`] means days here).
pub fn date_runs(&self, ids: &[PhotoId], key: SortKey, by: GroupBy) -> Vec {
- if by == GroupBy::None || ids.is_empty() {
+ if !groups_by_date(key, by) || ids.is_empty() {
return Vec::new();
}
- let n = by.prefix();
- let date_of = |id: &PhotoId| -> String {
- let Some(p) = self.photo(*id) else { return String::new() };
- let d = match key {
- SortKey::CaptureDate => p.captured.as_deref(),
- SortKey::ImportDate => Some(p.imported.as_str()),
- SortKey::EditDate => p.edited.as_deref(),
- _ => None,
- };
- d.filter(|d| iso_seconds(d.get(..10).unwrap_or("")).is_some()).and_then(|d| d.get(..n)).unwrap_or("").to_string()
- };
- if !matches!(key, SortKey::CaptureDate | SortKey::ImportDate | SortKey::EditDate) {
- return Vec::new();
- }
- let stacks = self.stack_index();
- let mut runs: Vec = Vec::new();
- let mut stack_key: std::collections::HashMap = Default::default();
- for (i, id) in ids.iter().enumerate() {
- let k = match stacks.get(id) {
- Some((sid, _)) => stack_key.entry(*sid).or_insert_with(|| date_of(id)).clone(),
- None => date_of(id),
- };
- match runs.last_mut() {
- Some(r) if r.key == k => r.count += 1,
- _ => runs.push(DateRun { label: group_label(&k), key: k, start: i, count: 1 }),
- }
- }
- runs
+ date_runs_of(ids, &self.stack_index(), |_, id| self.date_group(id, key, by))
}
+
+ /// The date group of photo `id` on its own for [`Catalog::date_runs`] (`2026-09-30` /
+ /// `2026-09` / `2026`; empty without a usable date): a stack's members take the group of its
+ /// first photo in the list there.
+ pub fn date_group(&self, id: PhotoId, key: SortKey, by: GroupBy) -> String {
+ let Some(p) = self.photo(id) else { return String::new() };
+ let d = match key {
+ SortKey::CaptureDate => p.captured.as_deref(),
+ SortKey::ImportDate => Some(p.imported.as_str()),
+ SortKey::EditDate => p.edited.as_deref(),
+ _ => None,
+ };
+ d.filter(|d| iso_seconds(d.get(..10).unwrap_or("")).is_some()).and_then(|d| d.get(..by.prefix())).unwrap_or("").to_string()
+ }
+}
+
+/// Whether [`Catalog::date_runs`] has runs for sort key `key` grouped `by`.
+pub fn groups_by_date(key: SortKey, by: GroupBy) -> bool {
+ by != GroupBy::None && matches!(key, SortKey::CaptureDate | SortKey::ImportDate | SortKey::EditDate)
+}
+
+/// [`Catalog::date_runs`] from each photo's own group (`group(position, id)`, see
+/// [`Catalog::date_group`]) and the stack index ([`Catalog::stack_index`]).
+pub fn date_runs_of>(
+ ids: &[PhotoId],
+ stacks: &std::collections::HashMap,
+ mut group: impl FnMut(usize, PhotoId) -> K,
+) -> Vec {
+ let mut runs: Vec = Vec::new();
+ let mut stack_key: std::collections::HashMap = Default::default();
+ for (i, id) in ids.iter().enumerate() {
+ let own;
+ let k: &str = match stacks.get(id) {
+ Some((sid, _)) => stack_key.entry(*sid).or_insert_with(|| group(i, *id).as_ref().to_string()),
+ None => {
+ own = group(i, *id);
+ own.as_ref()
+ }
+ };
+ match runs.last_mut() {
+ Some(r) if r.key == k => r.count += 1,
+ _ => runs.push(DateRun { label: group_label(k), key: k.to_string(), start: i, count: 1 }),
+ }
+ }
+ runs
}
#[cfg(test)]
@@ -199,6 +218,14 @@ mod tests {
fn calendar() {
assert_eq!(civil(0), "1970-01-01T00:00:00");
assert_eq!(civil(951_782_400), "2000-02-29T00:00:00");
+ // A year past 9999 keeps the plain zero-padded year (no `+`), as the old `{y:04}` did.
+ assert_eq!(civil(253_402_300_800), "10000-01-01T00:00:00");
+ // Beyond chrono's year range the old `civil_from_days` still converted; pin that output
+ // (never the epoch) in both directions and at the i64 extremes.
+ assert_eq!(civil(10_000_000_000_000), "318857-05-20T17:46:40");
+ assert_eq!(civil(-10_000_000_000_000), "-314918-08-13T06:13:20");
+ assert_eq!(civil(i64::MAX), "292277026596-12-04T15:30:07");
+ assert_eq!(civil(i64::MIN), "-292277022657-01-27T08:29:52");
assert_eq!(weekday("2026-09-30"), Some("Wednesday"));
assert_eq!(weekday("2026-10-01T09:00:00"), Some("Thursday"));
assert_eq!(weekday("2000-02-29"), Some("Tuesday"));
@@ -233,6 +260,15 @@ mod tests {
assert_eq!(iso_seconds("2026-01-01T10:00+02:00"), iso_seconds("2026-01-01T10:00"));
}
+ #[test]
+ fn impossible_times_are_rejected_not_rolled_over() {
+ for bad in ["2026-04-01T10:75:00", "2026-04-01 10:00:75", "2026-04-01T10:60", "2026-04-01T24:00:00", "2026-04-01T10:59:60"] {
+ assert_eq!(normalize_iso(bad), None, "{bad}");
+ assert_eq!(shift_iso(bad, 5), None, "{bad}");
+ }
+ assert_eq!(normalize_iso("2026-04-01T23:59:59").as_deref(), Some("2026-04-01T23:59:59"));
+ }
+
#[test]
fn runs_by_day_month_year_keep_stacks_together() {
let mut c = Catalog::new();
diff --git a/crates/catalog/src/model.rs b/crates/catalog/src/model.rs
index 6ac3544ee..b405e1db9 100644
--- a/crates/catalog/src/model.rs
+++ b/crates/catalog/src/model.rs
@@ -329,7 +329,7 @@ pub struct Analysis {
/// file's white balance is edited relative to its as-shot look or in Kelvin depends on the camera:
/// [`relative_wb_camera`].
pub fn relative_wb_format(format: &str) -> bool {
- ["ARW", "NEF", "NRW", "RW2", "RWL", "RAW", "RAF", "CR3", "CR2", "PEF", "SRW", "ORF", "ERF"].iter().any(|f| format.eq_ignore_ascii_case(f))
+ ["ARW", "NEF", "NRW", "RW2", "RWL", "RAW", "RAF", "CR3", "CR2", "PEF", "SRW", "ORF", "ERF", "MRW"].iter().any(|f| format.eq_ignore_ascii_case(f))
}
/// Whether a raw of `format` shot on `camera` (Exif make and model, as [`Meta::camera`] keeps them) is developed
@@ -610,6 +610,7 @@ mod edited_tests {
("a.pef", "pef", true),
("a.orf", "ORF", true),
("a.erf", "ERF", true),
+ ("a.mrw", "MRW", true),
("a.dng", "DNG", false),
] {
let mut p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, name, format, 10, 10, "2026-10-01T00:00:00");
@@ -653,6 +654,7 @@ mod edited_tests {
("SONY ILCE-1", "ARW", true),
("", "ARW", true),
("SONY ILCE-7M3", "DNG", false),
+ ("NIKON CORPORATION NIKON Z5_2", "NEF", false),
] {
let mut p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, "a.raw", format, 10, 10, "2026-10-01T00:00:00");
p.kind = MediaKind::Raw;
diff --git a/crates/catalog/src/query.rs b/crates/catalog/src/query.rs
index 7625c9ab6..a94421369 100644
--- a/crates/catalog/src/query.rs
+++ b/crates/catalog/src/query.rs
@@ -141,9 +141,40 @@ pub(crate) struct Prepared {
only: Option>,
}
+/// The tokens of a search text: split at whitespace, except inside double quotes, so
+/// `person:"Jane Doe"` is one token (issue #1449). An unclosed quote runs to the end of the text; a
+/// backslash is an ordinary character. One pass over the text, nothing allocated.
+fn search_tokens(text: &str) -> impl Iterator {
+ let mut rest = text;
+ std::iter::from_fn(move || {
+ rest = rest.trim_start();
+ if rest.is_empty() {
+ return None;
+ }
+ let mut quoted = false;
+ let end = rest
+ .char_indices()
+ .find(|&(_, c)| {
+ quoted ^= c == '"';
+ !quoted && c.is_whitespace()
+ })
+ .map_or(rest.len(), |(i, _)| i);
+ let (tok, tail) = rest.split_at(end);
+ rest = tail;
+ Some(tok)
+ })
+}
+
+/// `s` without the double quotes around it (a missing closing quote is allowed).
+fn unquote(s: &str) -> &str {
+ s.strip_prefix('"').map_or(s, |inner| inner.strip_suffix('"').unwrap_or(inner))
+}
+
fn token_matches(p: &Photo, tok: &str) -> bool {
let t = tok.to_lowercase();
- if let Some((field, val)) = t.split_once(':') {
+ // a token that starts with a quote is a phrase, even with a colon in it
+ if let Some((field, quoted)) = t.split_once(':').filter(|_| !t.starts_with('"')) {
+ let val = unquote(quoted);
let num = |s: &str| -> Option<(char, f64)> {
let (op, rest) = match s.chars().next()? {
c @ ('>' | '<' | '=') => (c, &s[1..]),
@@ -180,18 +211,22 @@ fn token_matches(p: &Photo, tok: &str) -> bool {
"date" => p.captured.as_deref().is_some_and(|c| c.starts_with(val)),
"copy" | "virtual" => (val == "true" || val == "yes") == p.copy_of.is_some(),
"name" | "file" => p.file_name.to_lowercase().contains(val),
- // Not a known field: the colon is part of a plain word ("10:30", "Re:").
+ // Not a known field: the colon is part of a plain word ("10:30", "Re:"), its value unquoted
+ // (`re:"a b"` is the text `re:a b`).
+ _ if val.len() != quoted.len() => text_matches(p, &format!("{field}:{val}")),
_ => text_matches(p, &t),
};
}
- text_matches(p, &t)
+ text_matches(p, unquote(&t))
}
/// Whether the lower-cased word `t` is in the file name, title, caption, camera, lens, location,
-/// format or a keyword of `p`.
+/// format, a keyword or the name of a person (a named face) of `p`.
fn text_matches(p: &Photo, t: &str) -> bool {
let hay = [&p.file_name, &p.meta.title, &p.meta.caption, &p.meta.camera, &p.meta.lens, &p.meta.location, &p.format];
- hay.iter().any(|h| h.to_lowercase().contains(t)) || p.meta.keywords.iter().any(|k| k.to_lowercase().contains(t))
+ hay.iter().any(|h| h.to_lowercase().contains(t))
+ || p.meta.keywords.iter().any(|k| k.to_lowercase().contains(t))
+ || p.people().iter().any(|n| n.to_lowercase().contains(t))
}
/// Whether `p` has a named face region called `name` (case-insensitive).
@@ -409,7 +444,7 @@ impl Filter {
{
return false;
}
- self.text.split_whitespace().all(|tok| token_matches(p, tok))
+ search_tokens(&self.text).all(|tok| token_matches(p, tok))
}
}
diff --git a/crates/catalog/src/rules.rs b/crates/catalog/src/rules.rs
index a87c9effc..667509d6f 100644
--- a/crates/catalog/src/rules.rs
+++ b/crates/catalog/src/rules.rs
@@ -794,12 +794,90 @@ fn date_op(op: &str, have: Option<&str>, value: &Value) -> bool {
}
}
+/// One byte as the `filePath` rules compare it: `/` and `\` both separate, case doesn't matter.
+fn fold_path_byte(b: u8) -> u8 {
+ if b == b'\\' { b'/' } else { b.to_ascii_lowercase() }
+}
+
+/// Whether `a` and `b` are equal under [`fold_path_byte`].
+fn path_bytes_eq(a: &[u8], b: &[u8]) -> bool {
+ a.len() == b.len() && a.iter().zip(b).all(|(x, y)| fold_path_byte(*x) == fold_path_byte(*y))
+}
+
+/// `needle` inside `hay`, under [`fold_path_byte`]; allocates nothing.
+fn path_bytes_contains(hay: &[u8], needle: &[u8]) -> bool {
+ let Some((&first, rest)) = needle.split_first() else { return true };
+ // the spellings of the needle's first byte that fold to it: a plain two-way compare per byte
+ let (a, b) = match fold_path_byte(first) {
+ b'/' => (b'/', b'\\'),
+ c if c.is_ascii_lowercase() => (c, c.to_ascii_uppercase()),
+ c => (c, c),
+ };
+ let Some(starts) = hay.len().checked_sub(needle.len()).and_then(|last| hay.get(..=last)) else { return false };
+ let at = |i: usize, c: u8| (c == a || c == b) && hay.get(i + 1..i + needle.len()).is_some_and(|tail| path_bytes_eq(tail, rest));
+ // eight bytes at a time: does any of them spell the first byte (a zero byte after xor)?
+ const ONES: u64 = 0x0101_0101_0101_0101;
+ let has_zero = |v: u64| v.wrapping_sub(ONES) & !v & (ONES << 7) != 0;
+ let (chunks, tail) = starts.as_chunks::<8>();
+ let tail_from = starts.len() - tail.len();
+ for (k, chunk) in chunks.iter().enumerate() {
+ let w = u64::from_le_bytes(*chunk);
+ if (has_zero(w ^ (ONES * u64::from(a))) || has_zero(w ^ (ONES * u64::from(b)))) && chunk.iter().enumerate().any(|(j, &c)| at(k * 8 + j, c)) {
+ return true;
+ }
+ }
+ tail.iter().enumerate().any(|(j, &c)| at(tail_from + j, c))
+}
+
+/// A `filePath` rule. The common case (an ASCII path and an ASCII text) is compared in place, folding
+/// case and `\` as it goes, with nothing allocated per photo; any other text takes
+/// [`file_path_matches_slow`], so Unicode lower-casing (ß, İ, final sigma…) behaves as it always did.
+fn file_path_matches(op: &str, source: &Source, value: &Value) -> bool {
+ let path = match source {
+ Source::File { path } => path.as_str(),
+ Source::Demo { .. } => "",
+ };
+ let Value::String(want) = value else { return file_path_matches_slow(op, path, value) };
+ if !path.is_ascii() || !want.is_ascii() {
+ return file_path_matches_slow(op, path, value);
+ }
+ let (path, want) = (path.trim().as_bytes(), want.trim().as_bytes());
+ match op {
+ // the whole string, spaces included (not word by word like the other text fields)
+ "contains" => !want.is_empty() && path_bytes_contains(path, want),
+ "notContains" => want.is_empty() || !path_bytes_contains(path, want),
+ "is" => path_bytes_eq(path, want),
+ "isNot" => !path_bytes_eq(path, want),
+ "startsWith" => path.get(..want.len()).is_some_and(|head| path_bytes_eq(head, want)),
+ "endsWith" => path.len().checked_sub(want.len()).and_then(|from| path.get(from..)).is_some_and(|tail| path_bytes_eq(tail, want)),
+ "isEmpty" => path.is_empty(),
+ "isNotEmpty" => !path.is_empty(),
+ _ => false,
+ }
+}
+
+/// [`file_path_matches`] for any text: the path and the text are normalised into new strings.
+fn file_path_matches_slow(op: &str, path: &str, value: &Value) -> bool {
+ // `/` and `\` both separate, whatever platform the catalog came from; demo photos have no path
+ let path = path.replace('\\', "/");
+ let want = lower(value).replace('\\', "/");
+ match op {
+ // the whole string, spaces included (not word by word like the other text fields)
+ "contains" => !want.trim().is_empty() && path.to_lowercase().contains(want.trim()),
+ "notContains" => want.trim().is_empty() || !path.to_lowercase().contains(want.trim()),
+ _ => text_op(op, &path, &want),
+ }
+}
+
impl Rule {
pub fn matches(&self, p: &Photo, cat: &Catalog) -> bool {
let (field, op, value) = match self {
Rule::Group { group } => return group.matches(p, cat),
Rule::Field { field, op, value } => (field.as_str(), op.as_str(), value),
};
+ if field == "filePath" {
+ return file_path_matches(op, &p.source, value);
+ }
let m = &p.meta;
let want = lower(value);
let text = |have: &str| text_op(op, have, &want);
@@ -854,20 +932,6 @@ impl Rule {
"fileName" => text(&p.file_name),
"extension" => text_op(op, p.extension(), want.trim_start_matches('.')),
"duration" => num_op(op, p.duration.filter(|d| d.is_finite()), value),
- "filePath" => {
- // `/` and `\` both separate, whatever platform the catalog came from; demo photos have no path
- let path = match &p.source {
- Source::File { path } => path.replace('\\', "/"),
- Source::Demo { .. } => String::new(),
- };
- let want = want.replace('\\', "/");
- match op {
- // the whole string, spaces included (not word by word like the other text fields)
- "contains" => !want.trim().is_empty() && path.to_lowercase().contains(want.trim()),
- "notContains" => want.trim().is_empty() || !path.to_lowercase().contains(want.trim()),
- _ => text_op(op, &path, &want),
- }
- }
"format" => text(&p.format),
"title" => text(&m.title),
"caption" => text(&m.caption),
@@ -1693,4 +1757,120 @@ mod tests {
assert_eq!(field_label("filePath"), Some("File Path"));
assert_eq!(field_label("nope"), None);
}
+
+ /// The `filePath` rule exactly as it was before the in-place ASCII path: new strings per photo.
+ fn file_path_old(op: &str, source: &Source, value: &serde_json::Value) -> bool {
+ let want = lower(value);
+ let path = match source {
+ Source::File { path } => path.replace('\\', "/"),
+ Source::Demo { .. } => String::new(),
+ };
+ let want = want.replace('\\', "/");
+ match op {
+ "contains" => !want.trim().is_empty() && path.to_lowercase().contains(want.trim()),
+ "notContains" => want.trim().is_empty() || !path.to_lowercase().contains(want.trim()),
+ _ => text_op(op, &path, &want),
+ }
+ }
+
+ #[test]
+ fn file_path_rules_match_the_old_strings_for_any_path() {
+ let paths = [
+ "",
+ " ",
+ " /a/b.jpg \t",
+ "/Volumes/share/photos/Trip/IMG_0001.jpg",
+ "/Volumes/share/PHOTOS/trip/img_0001.JPG",
+ r"D:\Photos\Lake Como\IMG_0001.JPG",
+ r"d:/photos/lake como/img_0001.jpg",
+ r"\\nas\share\x.jpg",
+ "/photos/Straße/a.jpg",
+ "/photos/STRASSE/a.jpg",
+ "/photos/İstanbul/a.jpg",
+ "/photos/i̇stanbul/a.jpg",
+ "/photos/ΟΔΟΣ/a.jpg",
+ "/photos/οδος/a.jpg",
+ "/photos/ΟΔΌΣ/a.jpg",
+ "/photos/日本/東京.jpg",
+ "/p/\u{0B}x\u{0B}",
+ "/p/\u{85}x\u{85}",
+ "a",
+ ];
+ let wants = [
+ "",
+ " ",
+ "a",
+ "A",
+ "/",
+ r"\",
+ r"\photos\",
+ "/photos/",
+ "photos",
+ "PHOTOS",
+ "Lake Como",
+ " lake como ",
+ "lake como",
+ r"d:\photos\lake",
+ "IMG_0001.JPG",
+ ".jpg",
+ "straße",
+ "STRASSE",
+ "strasse",
+ "İstanbul",
+ "i̇stanbul",
+ "istanbul",
+ "ΟΔΟΣ",
+ "οδος",
+ "οδοσ",
+ "ΟΔΌΣ",
+ "東京",
+ "日本",
+ "x",
+ "\u{0B}x",
+ "/a/b.jpg",
+ "/a/b.jpg \t",
+ "\u{85}x",
+ ];
+ let ops = ["contains", "notContains", "is", "isNot", "startsWith", "endsWith", "isEmpty", "isNotEmpty", "bogus"];
+ let mut values: Vec = wants.iter().map(|w| json!(w)).collect();
+ values.extend([json!(null), json!(5), json!(true), json!(["a", "b"])]);
+ let mut sources: Vec = paths.iter().map(|p| Source::File { path: (*p).into() }).collect();
+ sources.push(Source::Demo { scene: 0 });
+ for source in &sources {
+ for op in ops {
+ for value in &values {
+ assert_eq!(file_path_matches(op, source, value), file_path_old(op, source, value), "{source:?} {op} {value}");
+ }
+ }
+ }
+ }
+
+ #[test]
+ fn file_path_rule_through_a_rule_set_ignores_case_and_slash_direction() {
+ let mut p = photo(1);
+ p.source = Source::File { path: r"D:\Photos\Lake Como\IMG_0001.JPG".into() };
+ let r = rs(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/LAKE como/"}]}));
+ assert!(r.matches(&p, &Catalog::default()));
+ }
+
+ /// Every piece of a long path, in both cases and both slash directions, wherever it starts
+ /// (the search skips eight bytes at a time, so starts and ends at every offset matter).
+ #[test]
+ fn file_path_contains_finds_every_piece_of_a_long_path() {
+ let path = r"D:\Photos\Lake Como\Wedding-Day_2026\IMG_0001 (copy).JPG";
+ let source = Source::File { path: path.into() };
+ let shout = |s: &str| s.to_uppercase();
+ let swap = |s: &str| s.replace('\\', "/");
+ for from in 0..path.len() {
+ for to in from + 1..=path.len() {
+ let piece = &path[from..to];
+ for want in [piece.to_string(), shout(piece), swap(piece), piece.replace('/', r"\"), format!("{piece}x"), format!("x{piece}")] {
+ let value = json!(want);
+ for op in ["contains", "notContains"] {
+ assert_eq!(file_path_matches(op, &source, &value), file_path_old(op, &source, &value), "{op} {want:?}");
+ }
+ }
+ }
+ }
+ }
}
diff --git a/crates/catalog/src/stacks.rs b/crates/catalog/src/stacks.rs
index eb7e89ef4..84e89d124 100644
--- a/crates/catalog/src/stacks.rs
+++ b/crates/catalog/src/stacks.rs
@@ -296,14 +296,15 @@ pub fn iso_seconds(s: &str) -> Option {
}
let (hh, mm, ss) =
if s.len() >= 16 { (num(11, 13)?, num(14, 16)?, if s.get(16..17) == Some(":") { num(17, 19).unwrap_or(0) } else { 0 }) } else { (0, 0, 0) };
- // days from civil (proleptic Gregorian)
- let y2 = if m <= 2 { y - 1 } else { y };
- let era = y2.div_euclid(400);
- let yoe = y2 - era * 400;
- let mp = (m + 9) % 12;
- let doy = (153 * mp + 2) / 5 + d - 1;
- let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
- let days = era * 146_097 + doe - 719_468;
+ if hh >= 24 || mm >= 60 || ss >= 60 {
+ return None;
+ }
+ // Days since 1970-01-01 (proleptic Gregorian). A day past the month's length rolls over the
+ // way the old Hinnant arithmetic did (e.g. 2026-02-30 → 2026-03-02), which `normalize_iso`
+ // relies on to reject impossible dates.
+ let first = chrono::NaiveDate::from_ymd_opt(i32::try_from(y).ok()?, u32::try_from(m).ok()?, 1)?;
+ let date = first.checked_add_days(chrono::Days::new(u64::try_from(d - 1).ok()?))?;
+ let days = (date - chrono::NaiveDate::from_ymd_opt(1970, 1, 1)?).num_days();
Some(days * 86_400 + hh * 3600 + mm * 60 + ss)
}
diff --git a/crates/catalog/src/store.rs b/crates/catalog/src/store.rs
index 2f3dc4912..553eb241f 100644
--- a/crates/catalog/src/store.rs
+++ b/crates/catalog/src/store.rs
@@ -242,7 +242,7 @@ impl Store for MemStore {
}
}
-#[cfg(test)]
+#[cfg(all(test, unix))]
mod tests_staging {
use super::*;
diff --git a/crates/catalog/src/tests.rs b/crates/catalog/src/tests.rs
index a32b5acf5..f8b72dad8 100644
--- a/crates/catalog/src/tests.rs
+++ b/crates/catalog/src/tests.rs
@@ -836,6 +836,71 @@ fn cmp_name_ignores_case_without_allocating() {
assert_eq!(cmp_name("a", "ab"), Less);
}
+/// Search Photos finds named people in free text, and a quoted value keeps a name of several words
+/// together: `person:"Jane Doe"` (issue #1449). Malformed quotes narrow the result or change nothing.
+#[test]
+fn search_text_finds_people_and_quoted_values() {
+ use lightcraft_meta::{Rect, Region, RegionKind};
+ let region = |name: &str, kind: RegionKind| Region {
+ rect: Rect { x0: 0.4, y0: 0.4, x1: 0.6, y1: 0.6 },
+ kind,
+ name: Some(name.to_string()),
+ description: None,
+ };
+ let mut c = Catalog::new();
+ let mut add = |name: &str, regions: Vec, keywords: &[&str]| {
+ let id = c.alloc_photo_id();
+ let mut p = Photo::new(id, Source::Demo { scene: 1 }, name, "JPEG", 6000, 4000, "2026-09-30T10:00:00");
+ p.meta.regions = regions;
+ p.meta.keywords = keywords.iter().map(|k| k.to_string()).collect();
+ c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+ id
+ };
+ let jane = add("a.jpg", vec![region("Jane Doe", RegionKind::Face), region("Rex", RegionKind::Pet)], &[]);
+ let both = add("b.jpg", vec![region("Jane Roe", RegionKind::Face), region("John Doe", RegionKind::Face)], &[]);
+ let zoe = add("c.jpg", vec![region("Zoë Ångström", RegionKind::Face)], &["New York"]);
+ let none = add("lunch 10:30 am.jpg", vec![], &["york minster"]);
+ let q = |text: &str| {
+ let mut ids = c.query(&Filter { text: text.into(), ..Default::default() }, &Sort::default());
+ ids.sort();
+ ids
+ };
+
+ // free text: a person's name, any case, any part of it; pets are not people
+ assert_eq!(q("jane"), vec![jane, both]);
+ assert_eq!(q("DOE"), vec![jane, both]);
+ assert_eq!(q("ångström"), vec![zoe]);
+ assert!(q("rex").is_empty(), "a pet is not a person");
+ // words are still ANDed: b.jpg has a Jane and a Doe, a quoted phrase asks for them together
+ assert_eq!(q("jane doe"), vec![jane, both]);
+ assert_eq!(q("\"jane doe\""), vec![jane]);
+
+ // fielded: the exact name, of several words when quoted
+ assert_eq!(q("person:\"Jane Doe\""), vec![jane]);
+ assert_eq!(q("who:\"jane roe\""), vec![both]);
+ assert_eq!(q("person:\"Zoë Ångström\""), vec![zoe]);
+ assert!(q("person:jane").is_empty(), "person: is the whole name, as before");
+ assert!(q("person:Jane Doe").is_empty(), "unquoted, the second word is its own token, as before");
+ assert_eq!(q("keyword:\"new york\""), vec![zoe], "other fields take quoted values too");
+ assert_eq!(q("person:\"Jane Doe\" a.jpg"), vec![jane], "tokens after a quoted one still count");
+
+ // malformed input never widens the match and never panics
+ assert_eq!(q("person:\"Jane Doe"), vec![jane], "an unclosed quote runs to the end");
+ assert!(q("person:\"Jane Doe a.jpg").is_empty(), "…and takes the rest of the text with it");
+ assert!(q("person:\"\"").is_empty());
+ assert!(q("person:").is_empty());
+ assert_eq!(q("\""), vec![jane, both, zoe, none], "a lone quote is an empty phrase, like an empty search");
+ assert_eq!(q("\"\" jane"), vec![jane, both]);
+ assert!(q("\"jane:doe\"").is_empty(), "a quoted phrase is free text even with a colon");
+ // an unknown field is plain text, its quoted value unquoted (#2099): `10:"30 am"` is the text `10:30 am`
+ assert_eq!(q("10:\"30 am\""), vec![none]);
+ assert!(q("10:\"30 pm\"").is_empty());
+ assert!(q("jane\\\"").is_empty(), "a backslash is an ordinary character");
+ let long = format!("person:\"{}", "é ".repeat(50_000));
+ assert!(q(&long).is_empty());
+ assert_eq!(q(" \t jane \u{3000} "), vec![jane, both], "any whitespace separates tokens");
+}
+
/// What the catalog remembers of its latest ops: which photos each changed and what of them, as long as that can be
/// said photo by photo.
#[test]
diff --git a/crates/codecs/README.md b/crates/codecs/README.md
index 5902243fc..c9d5cec7d 100644
--- a/crates/codecs/README.md
+++ b/crates/codecs/README.md
@@ -100,7 +100,7 @@ jpegxl-rs / imagequant (GPL / C), dav1d / libheif (C).
## Performance (Apple M-series, release, synthetic 24 MP JPEG q90 4:2:0)
-Run `cargo test --release -p lightcraft-codecs --test bench -- --ignored --nocapture`.
+Run `cargo test --release -p lightcraft-codecs --test it bench:: -- --ignored --nocapture`.
| Operation | Time |
|---|---|
diff --git a/crates/codecs/src/convert.rs b/crates/codecs/src/convert.rs
index 836aed548..2cdf67381 100644
--- a/crates/codecs/src/convert.rs
+++ b/crates/codecs/src/convert.rs
@@ -99,9 +99,10 @@ pub(crate) fn check_size(format: Format, w: u64, h: u64, opts: &DecodeOptions) -
}
pub(crate) fn finish(format: Format, raw: Raw, meta: Meta, source_dims: (u32, u32), opts: &DecodeOptions) -> Result {
- let n = raw.width * raw.height;
let ch = raw.model.channels() + raw.alpha as usize;
- if n == 0 || raw.buf.len() < n * ch {
+ let buf_len =
+ crate::checked_sample_buf_len(raw.width, raw.height, ch).ok_or_else(|| Error::Malformed(format, "sample buffer too short".into()))?;
+ if (raw.buf.len() as u64) < buf_len {
return Err(Error::Malformed(format, "sample buffer too short".into()));
}
let float = matches!(raw.buf, Buf::F32(_));
@@ -141,7 +142,9 @@ pub(crate) fn finish(format: Format, raw: Raw, meta: Meta, source_dims: (u32, u3
let (image, alpha) = match opts.max_size {
Some((mw, mh)) if (image.width as u32 > mw || image.height as u32 > mh) && mw > 0 && mh > 0 => {
let factor = (image.width as f64 / mw as f64).max(image.height as f64 / mh as f64);
- let f = if factor >= 2.0 { Filter::Box } else { Filter::Mitchell };
+ // (Lanczos at 2:1 and more as well: a box average there halves the contrast of
+ // detail near the output's resolution limit and aliases what is finer)
+ let f = if factor >= 2.0 { Filter::Lanczos3 } else { Filter::Mitchell };
let img = fit(&image, mw as usize, mh as usize, f);
let alpha = alpha.map(|a| fit(&a, mw as usize, mh as usize, f));
(img, alpha)
diff --git a/crates/codecs/src/lib.rs b/crates/codecs/src/lib.rs
index d14b1812f..a20a47d14 100644
--- a/crates/codecs/src/lib.rs
+++ b/crates/codecs/src/lib.rs
@@ -338,3 +338,29 @@ pub fn decode_thumbnail_with(bytes: &[u8], opts: &ThumbnailOptions) -> Result
+
+ 
+ 
+ 
+ 
+ 
+ 
| **PhotoCraft** | 影像編輯：圖層、遮色片、文字和真正的 PSD 檔案 | [GitHub](https://github.com/storytold/photocraft) | [網站](https://getartcraft.com/apps/photocraft) |
+| 
| **VectorCraft** | 向量插畫 | [GitHub](https://github.com/storytold/vectorcraft) | [網站](https://getartcraft.com/apps/vectorcraft) |
+| 
| **FilmCraft** | 影片剪輯、調色與聲音 | [GitHub](https://github.com/storytold/filmcraft) | [網站](https://getartcraft.com/apps/filmcraft) |
+| 
| **LightCraft** | **照片庫與 raw 顯影 · 你現在在這裡** | [GitHub](https://github.com/storytold/lightcraft) | [網站](https://getartcraft.com/apps/lightcraft) |
+| 
| **PdfCraft** | 閱讀、整理與保護 PDF | [GitHub](https://github.com/storytold/pdfcraft) | [網站](https://getartcraft.com/apps/pdfcraft) |
+| 
| **EffectCraft** | 動態圖形與視覺特效 | [GitHub](https://github.com/storytold/effectcraft) | [網站](https://getartcraft.com/apps/effectcraft) |
+| 
| **DesignCraft** | 版面編排與出版 | [GitHub](https://github.com/storytold/designcraft) | [網站](https://getartcraft.com/apps/designcraft) |
+
+還有 [**ArtCraft**](https://getartcraft.com/) 本身，我們為想要真正掌控創作的人打造的 AI 影像與影片工作室。
+
+