A nested altChunk DOCX adds its records past its 256-entry list to the outer
total. file.strictReport's params doc lists source_part, the snake_case codes
and the totals. The human line says "300 characters cannot be drawn (first 256
listed)" when a list is cut. README gains the picture stderr line and the
possible source_part values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
JSON reasons are snake_case codes (missing_part, external_target, link_only,
undecodable, unsupported_format); "in" becomes "source_part" (full story part);
total_missing_glyphs and total_missing_pictures count past the 256 caps (code
point bitset, saturating picture counter). Human lines unchanged. README
documents the schema. Layout missing_glyphs tests call test_fonts().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
main() prints Failure::Error raw again, so the CLI's own multi-line messages (usage
after "missing argument" / "unknown command") keep their line breaks. A new
engine_error helper escapes control, bidi and invisible characters in text that
comes from the engine or a file, and every such conversion goes through it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
main() prints Failure::Error through escape_text (control, bidi and invisible
characters; backslashes kept, since errors quote paths), so engine errors that
carry file text (run --cmd with strict:true) can't forge or spoof a line.
escape_peer and the JSON report line also escape soft hyphen, zero-width, word
joiner, BOM and tag characters (surrogate pairs above U+FFFF). A picture's part and
story are capped at 1024 characters in MissingPictures::push.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
A DOCX altChunk's own dropped pictures are merged into the parent through
MissingPictures::push, named "<chunk part> > <story>". The strict report's human
lines go through escape_peer, and the JSON line escapes C1, line separator and bidi
characters (serde leaves them raw), so a crafted picture target can't forge or
spoof a terminal line.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
render --strict passes strict to file.exportPng and, on refusal, prints the
report for the same page (human lines, then the JSON line) on stderr, exits 3,
and prints nothing on stdout. convert and render share one refusal helper.
Adds the engine guard that file.exportPng with strict off is byte-identical.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
Page background picture and watermark text are checked like the display list
(watermark shaped by one shared helper used by the PDF export, the page raster and
the check). Picture side limit is per output (PDF 30000, PNG 65535). Separate
truncation flags per list. Glossary pictures name the glossary part.
MissingPictures::push dedupes in O(1). Hostile params cover strict, README note,
ToUnicode regression test for chart and equation runs.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
Engine: StrictReport (missing glyphs + missing pictures, schema-1 JSON), pure
file.strictReport, and strict: true on file.save/saveAs/exportPdf/exportPng that
refuses with "strict: ..." before any write. PDF strict lays out once through
wordcraft_pdf::export_layout; PdfOptions now owns the display/layout options the
exporter and the check share. CLI: --strict, exit 3, report plus JSON line on
stderr; a non-pdf/png output is rejected before the input is read.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
doc: Document.missing_pictures (MissingPicture, MissingPictureReason), capped at 256,
never saved, ignored by ==.
docx reader: records a missing part, an external target, and r:link / VML r:href
only pictures with their story part; nothing is fetched.
geom: decode_for_drawing / check_for_drawing, the one decision pdf and render now
take (output unchanged, pinned by golden hash tests); layout: media_check and
undecodable_pictures walk a layout's drawn pictures per story.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
Walks the display list (as the PDF and PNG exports draw it) for glyph id 0
and names each by code point, capped at 256 distinct. Chart/SmartArt label
runs and equation runs now carry per-glyph text ranges.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8G9hbs6XYZFsgjbL
* fix(render): skip drawing paths far past every canvas before flattening
* fix(render): refuse paths with non-finite points too
---------
Co-authored-by: Martin Ball <martin.ball@ucscaregroup.co.uk>
* fix(docx): collect an embedded object's relationship ids in a set on save
* style: rustfmt
---------
Co-authored-by: Martin Ball <martin.ball@ucscaregroup.co.uk>
* Charts: an automatic series colour follows the series' c:idx (#5963)
A series without its own colour took the accent for its place in the
file. Word picks it by the series' c:idx (c:order doesn't matter), so a
chart whose series aren't numbered 0, 1, 2... in file order, such as a
lone series with idx 2 after a deletion, got different colours.
c:idx is read strictly as the unsignedInt the schema says; a missing or
invalid value falls back to the place in the file.
* Charts: the renumbered test helper fails if ser's layout changes (#5963)
---------
Co-authored-by: kiwi4boy <kiwi4boy@gmail.com>
Co-authored-by: Martin Ball <martin.ball@ucscaregroup.co.uk>
