i18n(ka): the pdfInfo thumbnail page error (#2914)

#2784 made zh-hant a language that translates every status and error message while #2930 added the shared parameter-check errors to the others; main's shared_param_check_errors_are_translated failed on zh-hant.

.github/workflows/freebsd.yml

@@ -35,5 +35,5 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
       require-craft-fonts: true
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
       run-package-check: true

.github/workflows/release.yml

@@ -26,7 +26,8 @@ jobs:
     with:
       app-name: vectorcraft
       app-title: VectorCraft
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      web-craft-fonts: true
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}

Cargo.lock

@@ -806,6 +806,11 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-docpath"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
@@ -4507,7 +4512,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "arboard",
  "block2 0.6.2",
@@ -4531,6 +4536,7 @@ dependencies = [
  "vectorcraft-engine",
  "vectorcraft-text",
  "vectorcraft-ui-egui",
+ "wayland-backend",
  "wayland-client",
  "wayland-protocols",
  "webbrowser",
@@ -4538,11 +4544,12 @@ dependencies = [
  "winit",
  "winresource",
  "winsafe",
+ "zbus",
 ]
 
 [[package]]
 name = "vectorcraft-affinity"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "crc32fast",
  "flate2",
@@ -4553,7 +4560,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-brush"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "kurbo 0.13.1",
  "serde",
@@ -4565,7 +4572,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cad"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4581,7 +4588,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cli"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "log",
  "objc2-core-foundation",
@@ -4603,7 +4610,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-color"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "kurbo 0.13.1",
  "moxcms",
@@ -4615,8 +4622,9 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-doc"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
+ "hayro-ccitt",
  "image",
  "jpeg-encoder",
  "kurbo 0.13.1",
@@ -4632,7 +4640,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-effects"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4648,14 +4656,16 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-engine"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
+ "craft-docpath",
  "crc32fast",
  "flate2",
  "image",
  "kurbo 0.13.1",
  "log",
  "proptest",
+ "roxmltree 0.21.1",
  "ruzstd",
  "serde",
  "serde_json",
@@ -4684,9 +4694,11 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-eps"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
+ "fax",
  "flate2",
+ "hayro-ccitt",
  "image",
  "kurbo 0.13.1",
  "ruzstd",
@@ -4705,7 +4717,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-format"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "flate2",
  "proptest",
@@ -4720,7 +4732,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-geom"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "kurbo 0.13.1",
  "proptest",
@@ -4732,7 +4744,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-mcp"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "image",
  "log",
@@ -4751,7 +4763,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-metafile"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4765,7 +4777,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pathops"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "kurbo 0.13.1",
  "linesweeper",
@@ -4777,7 +4789,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pdf"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "aes",
  "craft-pdf",
@@ -4807,7 +4819,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-plugins"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "serde",
  "serde_json",
@@ -4821,7 +4833,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-render"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "flate2",
  "gif",
@@ -4848,15 +4860,16 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-scriptcheck"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "proptest",
 ]
 
 [[package]]
 name = "vectorcraft-svg"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
+ "craft-docpath",
  "flate2",
  "image",
  "kurbo 0.13.1",
@@ -4879,8 +4892,9 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-testkit"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
+ "fax",
  "image",
  "kurbo 0.13.1",
  "proptest",
@@ -4896,7 +4910,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-text"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "harfrust 0.13.3",
  "icu_segmenter",
@@ -4916,7 +4930,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-three-d"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "vectorcraft-geom",
  "vectorcraft-pathops",
@@ -4924,7 +4938,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-tools"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4940,7 +4954,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-trace"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4952,7 +4966,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-ui-egui"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "craft-ui",
  "egui",
@@ -4986,13 +5000,14 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-web"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "eframe",
  "egui",
  "js-sys",
  "log",
  "rfd",
+ "serde_json",
  "vectorcraft-engine",
  "vectorcraft-format",
  "vectorcraft-text",
@@ -6096,7 +6111,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/vectorcraft", "apps/vectorcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.12.0"
+version = "0.13.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,6 +13,7 @@ repository = "https://github.com/storytold/vectorcraft"
 [workspace.dependencies]
 craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d", default-features = false, features = ["interpret", "write"] }
 craft-print = { git = "https://github.com/storytold/craft-libs", rev = "d991bf6792f8ade99c51358bf3c1d902c8cd96b5" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
 craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
 # internal
 vectorcraft-geom = { path = "crates/geom" }
@@ -64,7 +65,7 @@ wat = "1.228"
 # Without `text` (glyph runs, through glifo and a second skrifa): the renderer draws the outlines
 # vectorcraft-text gives it. The other default features stay.
 vello_cpu = { version = "0.2", default-features = false, features = ["std", "png", "u8_pipeline", "f32_pipeline"] }
-image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp", "tga"] }
 # Without `text` and the system fonts (fontdb, harfrust and skrifa, at other versions than ours):
 # SVG import reads `<text>` from the XML itself and never gives usvg a font. A test of the SVG
 # crate turns `text` on.
@@ -79,6 +80,9 @@ flate2 = { version = "1", default-features = false, features = ["rust_backend"]
 rustix = { version = "1.1", default-features = false }
 # Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
 ruzstd = { version = "0.9.1", default-features = false, features = ["std"] }
+# CCITT Group 3 and Group 4 decoder (ITU-T T.4 and T.6): EPS images read through
+# `CCITTFaxDecode`. The PDF reader's hayro-syntax uses the same version.
+hayro-ccitt = "0.3"
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
 # CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG

README.md

@@ -11,11 +11,11 @@
 <h1 align="center">VectorCraft</h1>
 
 <p align="center">
-  <b>Vector illustration; an open-source, clean-room reimplementation of Adobe Illustrator, rebuilt in pure Rust.</b>
+  <b>Vector illustration; an open-source, modern vector art application, built in pure Rust.</b>
 </p>
 
 <p align="center">
-  A fast, open-source, clean-room take on the Adobe Illustrator workflow. It runs natively on
+  A fast, open-source vector illustration workflow. It runs natively on
   macOS, Windows, Linux and FreeBSD, and in the browser via WebAssembly. Built by the ArtCraft team.
 </p>
 
@@ -147,7 +147,7 @@ exposes to agents, and exported by VectorCraft's own renderer. The source files
 
 ## Why VectorCraft
 
-- **Familiar.** Illustrator's layout, tools, menus, panels and shortcuts: the Pen, Direct Selection,
+- **Familiar.** A familiar layout, tools, menus, panels and shortcuts: the Pen, Direct Selection,
   Pathfinder, Smart Guides, Appearance, Swatches, Layers and more. You already know how to use it.
 - **Fast.** Multithreaded SIMD rendering off the UI thread. 20,000 shapes render in about 27 ms at
   full retina resolution while the interface stays at 120 fps.
@@ -194,8 +194,10 @@ drag-and-drop, set **Preferences › Performance › Linux Display Server** to *
 the app with `WAYLAND_DISPLAY= vectorcraft`: the window then opens through XWayland, where drops work
 (see [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
 
-On Linux under KDE Plasma 6.3 or later with Wayland, a drawing tablet's pen moves the cursor but VectorCraft doesn't
-respond to it yet (#491). Open the window through XWayland instead, with the same preference or `WAYLAND_DISPLAY= vectorcraft` (see
+On Linux with Wayland, under KDE Plasma 6.3 or later and under GNOME, VectorCraft doesn't respond to a drawing tablet's
+pen yet (#491, #2028). Open the window through XWayland instead, where the pen works as a mouse: set the same
+preference to **X11 (XWayland)**, or to **X11 (XWayland) When a Pen Is Attached** to use XWayland only when a pen is
+attached as VectorCraft starts, and restart; or start the app with `WAYLAND_DISPLAY= vectorcraft` (see
 [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
 
 ### Use it from Claude Code and other agents
@@ -222,9 +224,8 @@ VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) has the st
 and what's next; [`docs/target-app-parity.md`](docs/target-app-parity.md) the full parity assessment and
 [`docs/gaps.md`](docs/gaps.md) the ranked list of what's missing.
 
-**Where we are (2026-10-10): alpha.** About 88% of Illustrator 2026's menu items, tools, effects and formats exist
-(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% "ready for real work" for a mainstream illustrator (~62% against
-all of Illustrator): everyday
+**Where we are (2026-10-10): alpha.** About 88% of core menu items, tools, effects and formats exist
+(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% ready for real work for a mainstream illustrator (~62% across all tracked features): everyday
 vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
 files (SVG, PDF and PDF-compatible `.ai` with PDF/X, legacy version 7 `.ai` keeping layers, groups and type, EPS, DXF, EMF/WMF, raster formats, PSD out and PSD/PSB in as their merged image, Print, Package).
@@ -236,22 +237,22 @@ doesn't write Affinity files. Current `.af` validation includes 33 pinned files,
 and every-board SVG/PDF/PSD export, with fixes for Affinity 3 artboards, source-backed JPEGs and text runs.
 [Scope and limits](crates/affinity/README.md); [source audit and remaining gaps](docs/affinity-validation.md).
 The interface
-speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Brazilian Portuguese, Russian, Swedish, Ukrainian, Finnish, Bulgarian, Greek and Czech;
+speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Brazilian Portuguese, Russian, Swedish, Ukrainian, Finnish, Bulgarian, Greek, Czech and Georgian;
 [localization-parity.md](docs/localization-parity.md) has the details.
-The scores are self-assessed from our code against Illustrator's public documentation;
+The scores are self-assessed from our code against public documentation;
 [target-app-parity.md](docs/target-app-parity.md#how-this-was-measured-2026-10-10) explains how far to trust them.
 
 **What's missing:**
-- reliable exchange of Illustrator's own `.ai` files (layer structure in real files; Illustrator's editing data isn't written);
+- reliable exchange of .ai files (layer structure in real files; proprietary editing data isn't written);
 - an interaction-fidelity pass covering every tool's modifiers and small behaviours;
 - 3D and Materials beyond the initial live Revolve (Extrude & Bevel, Inflate, Rotate, materials);
-- about half of the Photoshop-style raster effects (27 of 57 still missing; Film Grain is available under Artistic, Halftone Pattern under Sketch) and the Effect Gallery;
+- about half of the raster effects (24 of 57 still missing; Cutout, Film Grain, Neon Glow and Poster Edges are available under Artistic, Halftone Pattern under Sketch) and the Effect Gallery;
 - CJK composition for vertical type (vertical type itself has initial support, with a Japanese interface);
 - scripting, and the rest of Variables (image and graph kinds, dataset import);
 - generative AI features.
 
 **Where we're going:** next is the interaction-fidelity pass, `.ai` files from real users and start-up stability,
-alongside the raster-effects package; then type, the Illustrator 2026 additions and 3D. The ranked list is in
+alongside the raster-effects package; then type, recent additions and 3D. The ranked list is in
 [`docs/gaps.md`](docs/gaps.md).
 
 **Workspace:** `crates/{geom, color, doc, pathops, text, effects, three-d, trace, brush, render, svg, pdf, eps, cad, metafile, format, tools, engine, ui-egui, mcp, testkit}`
@@ -370,8 +371,6 @@ ArtCraft Team and are not covered by this license. They may be used only unmodif
 part of this repository and VectorCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
 Forks and modified versions must remove them.
 
-<sub>Adobe, Photoshop, Illustrator, Premiere Pro, Lightroom, Acrobat, After Effects and InDesign are trademarks or registered trademarks of Adobe Inc. in the United States and/or other countries. VectorCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Adobe Inc.; these names are used only to describe the workflows it is compatible with.</sub>
-
 <p align="center">
   <a href="https://getartcraft.com/"><img alt="ArtCraft" src="docs/brand/artcraft-mark.svg" width="28"></a><br>
   <sub>Made by the <a href="https://getartcraft.com/">ArtCraft</a> team and community.</sub>

ROADMAP.md

@@ -9,7 +9,7 @@
 
 **Stage: alpha** · next: beta, ~13 points (ready for real work ~62% → ~75%, and reliable `.ai` exchange) and ~170–270 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (about 160 community PRs of 2026-10-15/16: PDF import crash fixes, Dimension tool, legacy `.ai` save, Intertwine, web pen input, Image Trace fixes, `.ai`/EPS/PDF import fidelity, Bulgarian, Greek, Swedish and Finnish catalogs; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (Background Export progress dialog with Cancel, #2564; about 85 community PRs of 2026-10-18: Justification…, Word .docx placed as area type, CCITT Group 3 TIFF, Roman Hanging Punctuation, blend spines edited with the Anchor Point tool, shadows and glows in stack order, coloured 3D lights, a Dutch catalog completed; 3D lighting: one to ten colored lights, smooth colored Inflate, legacy white-light appearance preserved; surface batching and restored seam minimum; scores and estimates unchanged; about 145 community PRs of 2026-10-17: image-decode overflow guards, opaque floating panels, MCP export cancel and progress, editable Illustrator EPS import, scoped `doc_inspect`, Dutch, Danish and Indonesian, Simplified Chinese messages, screen-reader names; headline numbers unchanged; about 160 community PRs of 2026-10-15/16: PDF import crash fixes, Dimension tool, legacy `.ai` save, Intertwine, web pen input, Image Trace fixes, `.ai`/EPS/PDF import fidelity, Bulgarian, Greek, Swedish and Finnish catalogs; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
 
 VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs
 on macOS, Windows, Linux, FreeBSD and the web (WASM), and agents can drive all of it over MCP, the CLI and a JSON
@@ -29,7 +29,7 @@ blocking it ([Alpha gate](docs/roadmap.md#alpha-gate)).
 
 | | Value | Kind |
 |---|---|---|
-| **Feature breadth** (Illustrator's menu items, tools, effects, formats exist) | **~88%** | measured in part: menu items 348/375 wired (92.8%), tools 89/92, Illustrator effects 44/50, Photoshop effects 30/57, 3D 4/4 (initial types, no materials) |
+| **Feature breadth** (Illustrator's menu items, tools, effects, formats exist) | **~88%** | measured in part: menu items 348/375 wired (92.8%), tools 89/92, Illustrator effects 46/50, Photoshop effects 33/57, 3D 4/4 (initial types, no materials) |
 | **Feature depth** (weighted by use, scored by behaviour) | **~75%** | estimated |
 | **To beta** | **~170–270 h** one agent · ~50–80 h with 4–6 agents | estimated |
 | **To full parity** | **~360–590 h** one agent · ~95–165 h with 4–6 agents | estimated |
@@ -76,7 +76,7 @@ The dimension hours overlap (feature rows hold some UI, format and AI work), so
 | Strokes, brushes, width profiles | 88% | 8–15 |
 | Appearance, transparency, graphic styles, masks | 97% | 1–2 |
 | Live vector effects | 85% | 6–10 |
-| Raster effects (Effect Gallery) — [effects-parity.md](docs/effects-parity.md) | 49% | 23–39 |
+| Raster effects (Effect Gallery) — [effects-parity.md](docs/effects-parity.md) | 49% | 21–35 |
 | 3D and Materials | ~25% | 30–55 |
 | Type core — [type-parity.md](docs/type-parity.md) | 80% | 14–19 |
 | Type advanced (CJK, spelling, Touch Type) | 50% | 20–28 |
@@ -112,8 +112,8 @@ Weights, evidence and the missing items per area: [target-app-parity.md](docs/ta
 | Korean | `ko` | full | 100% |
 | Vietnamese | `vi` | full | 100% |
 
-Also shipped: Traditional Chinese (partial, 80%), Bulgarian, Finnish, Greek, Hungarian, Italian, Polish, Russian, Swedish and Ukrainian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
-No catalog has had a native speaker's review. Details: [localization-parity.md](docs/localization-parity.md).
+Also shipped: Traditional Chinese (partial, 80%), Bulgarian, Finnish, Greek, Hungarian, Italian, Polish, Russian, Swedish, Ukrainian and Georgian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
+The Georgian catalog has had a native speaker's review; no other catalog has. Details: [localization-parity.md](docs/localization-parity.md).
 
 ## Upcoming
 
@@ -123,7 +123,7 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 2. **`.ai` files from real users** (G9): layer structure, guides, speed: 10–20 h.
 3. **Launch and stability on real machines** (G10): 20–35 h.
 4. **Core-tool correctness** (G11: Shape Builder regions, Asset Export borders): 8–15 h.
-5. **Raster effects** (G2) alongside: 28 filters and the Effect Gallery, 23–39 h.
+5. **Raster effects** (G2) alongside: 24 filters and the Effect Gallery, 21–35 h.
 6. **Then:** type core and advanced type (G4), the Illustrator 2026 additions (G13), 3D (G3).
 
 ## Progress log
@@ -134,6 +134,9 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 
 | Date | What landed |
 |---|---|
+| 2026-10-18 | About 85 community PRs landed in two batches through the full gate, with our fixes on top. New: Word `.docx` files place as area type with their formatting (#2766), CCITT Group 3 TIFF files open (#2770), Paragraph panel menu › Roman Hanging Punctuation (#2775), the Anchor Point tool edits blend spine points and handles (#2643, fixes #2544), shadows and glows each draw from the art with the effects before them, without the old exponential cost (#2395), one to ten coloured lights in 3D effects (#2706), Artboard Options X and Y with a reference point (#2739), more Contextual Task Bar actions (#2471), Optical Margin Alignment for a whole thread (#2773), History panel Step Backward/Forward and Set History Limit (#2764), Edit › Undo and Redo name the step as the History panel does (#2774), bounding-box handles snap to the grid, pixels and guides (#2715), Ctrl/Cmd+A in the Artboards panel (#2761), Tabs panel menu items (#2742), Import Data Sets defines variables from header cells (#2736), a Linux option to use X11 when a pen is attached (#2717). Fidelity and robustness: variable fonts named by their default weight and fallback glyphs keep bold and italic (#2733, #2732), legacy `.ai` layer names in Windows Latin-1 (#2722), WMF window mapping (#2721), Magic Wand inside isolation (#2720), type values out of range in files are clamped (#2728, #2757), raster effects stay responsive in drags (#2745), exports and Save for Web report undecodable images (#2762, #2737, #2684), Windows-safe exported file names (#2738), a marquee skips a Shaper Group's originals (#2772). Second batch: an export progress dialog with Cancel on the shared cancel token (#2564), CMYK gradient meshes drawn several times faster within a 16 MB cap (#2802), Paragraph panel menu › Justification… with file values clamped (#2771), Edit › Clear History (#2843), SVG image links keep their spelling (#2837, fixes main's Windows test failures), the Linux save dialog through the XDG portal (#2783), RGB input stored as CMYK in CMYK documents (#2812), legacy `.ai` export of images and radial highlights (#2801, #2807), `.ai` import notes for damaged editing data, page sizes and variable libraries (#2799, #2800, #2842), PDF and `.ai` keep their creation date (#2838), undecodable images left out of PDF exports with a note (#2790), MCP input waits for queue room (#2776), slice, snapping, selection, type and accessibility fixes (#2794–#2797, #2805, #2806, #2809, #2815, #2844–#2846), dropdowns close after a keyboard pick (#2824), plug-in dialogs scroll (#2840). Languages: the Dutch catalog completed (#2730). Headline numbers unchanged (estimated). |
+| 2026-10-17 | Background Export shows a progress dialog: the file being exported, the artboard count and a bar, Cancel (Esc) and Continue in Background. It runs on the shared cancel token of #2546, so a cancelled export writes no file and keeps no half-drawn pattern tile or effect raster; translated in every language with complete menus (#2564). Headline numbers unchanged. |
+| 2026-10-17 | About 145 community PRs landed in six batches, each through the full gate, plus our fixes on top. Crashes and hostile input: an image's RGBA size is checked from its header before decoding, without overflowing, in the renderer, sampling, recoloring and Crop Image (#2442, #2468, #2407), PDF Add Around and huge art are clamped (#2440), graph axis labels past i64, `+` in hex colours and XML ids are handled (#2610, #2470, #2447), Document Raster Effects resolutions open in range (#2579), Batch names stay in their folder (#2504). Regressions: floating panel groups are opaque again while the docked card keeps its rounded corners (#2499), the Wayland pointer returns over panels (#2502). New: MCP cancels long exports, answers while one runs and reports progress (#2546), `doc_inspect` takes ids, kind and paging (#2543), raster export of a page rectangle (#2511), `text.create` returns bounds (#2478), PDF presets and ICC profiles persist (#2547), screen-reader names for widgets (#2611), Expand on Intertwine (#2622, fixes #2540), Duplicate/Copy/Cut of several artboards (#2567), print presets by name (#2607), TSV data sets (#2608), planar TIFF (#2598), Alt-click a swatch onto a gradient stop (#2623), Shift-click ranges in Links, Graphic Styles and Libraries (#2612, #2613, #2618), Space+Shift rotates the view (#2601), Presentation Mode keys (#2583), Small Caps and super/subscript buttons (#2508). Fidelity: editable vector art from Illustrator EPS (#2571), `.ai` Drop Shadow Darkness (#2513), overprint preview with Darken (#2514), Generic CMYK black round-trips (#2503), PNG sRGB chunk (#2519), kerning at a caret (#2518), tab widths in justified area type (#2487), Transform copies keep their own gradients (#2486), smooth Zig Zag (#2475), Live Corners round up to their neighbours (#2484), kerning across style runs (#2554), SVG letter spacing on justified lines (#2574), Dimension tool snapping (#2482), gradient chips (#2495), Transform panel flips and percentages (#2400, #2404). Later the same day: PostScript `.ps` and `.epsf` files open (#2461), EPS images with CCITTFax compression draw (#2445), Illustrator 3 EPS without layers (#2436), `.ai` type opacity and blend modes (#2420), envelope meshes and compound holes in `.ai` (#2410, #2444), CMYK image soft masks in PDF export (#2448), Show Transparency Grid saved with the document (#2488), Save Selection in the Layers panel menu (#2483), Character and Paragraph Reset Panel (#2479, #2438), Cmd/Ctrl+Shift double-click releases a guide (#2467), Shift+Enter keeps a field active (#2431), Shift keeps reshaped handles perpendicular (#2425), emptied type keeps its style (#2464), Smart Blur radius (#2443), freeform gradients recolour (#2397), mesh slivers (#2456), Recolor wheel handles in CMYK (#2454), and six Image Trace fixes (#2387, #2584, #2586–#2589). Fifth batch: Optical Margin Alignment (#2563), Window › Blend panel (#2573), graph column designs (#2406), Live Paint Gap Options (#2424), the SVG Interactivity panel (#2437), RTF placed as area type (#2524), the Touch Type tool (#2469), pattern fills expand into clipped tiles (#2616), Save and Export ask before replacing a file an added extension names (#2619), the Artboard tool's Control bar and Contextual Task Bar (#2559, #2556), Alt-click New Artboard for its options (#2496), Shift-click in Brushes (#2562), the Move dialog remembers the last move (#2542), PDF export uses the document's assigned profiles (#2536), Printer Setup opens the selected printer's preferences on Windows (#2577). Sixth batch: Effect › Artistic › Cutout, Neon Glow and Poster Edges (#2453), View › Rulers › Change to Global / Artboard Rulers (#2416), Symbol Options 9-slice guides (#2512), Create Gradient Mesh on an embedded image (#2538), Rotate View cursors and the Mac trackpad rotation gesture (#2594, #2644), choice parameters as dropdowns in the inline effect editor (#2582), Group Selection picks and moves one path of a compound path (part of #2441), Shift-click ranges in the Artboards panel (#2626), Lock Variables (#2631), a layer dropped under the last row goes to the bottom (#2632), and robustness work: huge selections draw bounded overlays (#2635, #2645, part of #2460), values out of range in presets and files are clamped (#2656), whole-number checks for counts (#2638, #2659), exports warn about overset type (#2628), symbol instances measured by their art (#2614), colour-managed Eyedropper in CMYK documents (#2664). Later: Effect › Rasterize (#2409), variable-font axis sliders in the Character panel (#2710), Image Trace Create Strokes on an exact distance transform with Guo–Hall thinning and a skeleton graph (#2703–#2705), Auto Color keeps rare colours (#2702), large images trace with a warning (#2700), a 1e9 pt input bound on Reshape Segment, Convert Anchor Point and the Pencil (#2709), task-bar Connect, Corner and Smooth for selected anchors (#2697), PDF 0 w strokes import as hairlines (#2696), threading text from theLine truncated
 | 2026-10-16 | Symbol Options › Export Type (Graphic or Movie Clip, default Movie Clip) with Registration; `symbol.options` / `symbol.list` (G5).
 | 2026-10-15 | Cursors: 36 more tool states get cursors of their own. Node editing follows the public manual (Direct Selection's anchor squares, Reshape Segment, Group Selection's plus, the arrow hollow on a snap, the Alt-copy arrowheads), the Anchor Point caret, the Curvature pen and Free Transform's side-shear arrows are drawn; Lasso, the freehand, symbolism and other tools borrow a drawn cursor until theirs is drawn. `crates/tools/src/cursors.toml` lists every cursor for whoever draws them, and `cargo xtask cursors` warns about one missing from it. Scores unchanged. |
 | 2026-10-16 | About 160 community PRs landed, each through the full gate. Crashes and hostile files: damaged PDF dictionaries and arrays no longer crash import (#2133, #2240, #2244, #2271), area type with huge row or column counts opens (#2109), hostile mesh edges are bounded (#2051). New: Dimension tool (#1788), legacy version 7 `.ai` save (#1794), Object › Intertwine (#2095), Apple Pencil and touch input on the web (#1740), Sample Color from Screen (#2257), Drop Shadow Darkness (#2252), Smart Blur edge modes (#2154), Scribble variations (#2180), Free Distort corners in its dialog (#2134), Rotate View presets (#2106), tritanopia proofing (#2234), Layers panel filters (#2087), Hide Template (#2117), File › Automate Batch through the Actions panel (#1938), dataset and graph CSV (#1929, #1941), Reset Tracking and Kerning (#2274), Alt+Enter copies in Transform fields (#2236), Shift+Tab panels (#2254), Control bar isolation, Recolor and image Replace (#2258, #2079, #2081). Revolve renders smooth with Cap on by default (#1193); Image Trace keeps tiny parts, thin outlines and shared corners, and Grayscale gradients are grey (#2012, #2025, #2263, #2264, #2265, #1879). Import: many `.ai`, EPS and PDF fidelity fixes (#2014–#2016, #2029, #2030, #2044, #2046, #2050–#2052, #2058, #2129, #2199, #2202, #2218), images up to 1 GB decoded (#2060), `.ai`/`.ait`/`.svgz` files paste from a file manager (#2148, #2201). Fixes across fields (arithmetic #2069, #2209, #2022; caret #1403), New Document (#2158, #2176), menus (#2232), shortcuts (#2235, #2146), Transform Each axes (#2227), Paste in Place (#1926), Color Picker tab order (#1937, #1939) and more. Languages: Bulgarian, Greek, Swedish and Finnish complete under the tests, pt-br completed. Details per PR in the PRs; headline numbers unchanged (estimated). |
@@ -161,6 +164,7 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 | 2026-10-12 | A `.ai` file with placed (linked) pictures opens from its editing data, with its guides, sublayers and hidden objects: each picture is a linked image in its place, showing the low-resolution preview the file keeps until its file is found or relinked (#1264). Scores unchanged. |
 | 2026-10-12 | Desktop printing adopts the shared `craft-print` spooler with exact physical sheet sizes. Windows 7 retains its WMI/viewer transport and excludes the shared backend; compatibility CI checks the dependency tree and PE imports. Scores unchanged. |
 | 2026-10-12 | Graphs: Object › Graph › Design… and Marker… (designs with a preview, New Design, Rename, Delete Design, Paste Design, Select Unused, and markers drawn with a design or None) (#1092); Graph Data opens as a worksheet with Import Data…, column width and decimals (#1138), and takes Transpose, Switch x/y, `|` line breaks in labels and the pie Legend, Position and Sort options (#1115); Graph Type adds Add Drop Shadow and Add Legend Across Top (#1119), widths past 100%, First Row and First Column in Front, and Draw Filled Lines (#1136); graphs keep their label formatting when drawn again (#1137). Align: a Horizontal & Vertical Align Center button (#1073); Align to Key Object makes the topmost selected object the key (#1221), and the palette's key entry reads Cancel Key Object (#1224). Pen: the nearest end wins over snapping, Alt on the last anchor edits it, and Enter, Escape or a tool switch finish a handle preview as one undo step (#821). Direct Selection: a click on an anchor of an already selected path selects that anchor alone (#1237). Make Compound Path keeps the backmost object's paint, and a selected member reads and changes the compound's fill rule (#1225). Shape Builder and Live Paint no longer turn a line's loose end past a crossing into a piece that runs out and back (#1230). Art moved or duplicated with an artboard follows Transform Pattern Tiles (#1219). A click with the Rectangular Grid tool opens its options dialog (#1169). Commands that change nothing (Lock, Hide, Transform Each, Rearrange Artboards and others) add no undo step (#1233). Saving with missing placed files keeps their relink data, and .ai export honours the chosen artboards (#718). SVG export keeps Unicode data-attribute names, and SVG Options refuses an invalid artboard range (#989). CMYK colours given in percent with a component under 1 keep their scale (#1249). Colour Image Trace keeps close dark tones apart (#1247). macOS: the Save sheet has a Format menu (#1235). The Hand and Zoom tools show drawn cursors on every platform (#1238). Czech: the remaining strings are translated, and Pathfinder's Add reads "Sjednotit" (#1226). MCP: a lost reply reports that the edit may have happened instead of replaying it (#1246); `select.key` checks its id and agents can read the key object (#1222). Tests: the command sweeps and import fuzz tests fail on a panic caught by the engine's guard (#1218), and the envelope export test ignores PDF dates and file IDs (#1220). Effect › Artistic › Film Grain (Grain, Highlight Area, Intensity; Photoshop-style filters 29/57) (#1282), and Craquelure, Mosaic Tiles and Stained Glass redraw 25–30% faster with identical pixels (#1265). Direct Selection: clicking a segment selects only that segment, and Delete removes just it (#1300); Shift-click deselects one anchor of a path selected whole (#1263). Pen + Alt converts anchors of paths inside a selected group or compound path (#1306). The Curvature tool shows circular point markers without direction handles (#1284). Snap to Point: pressing near an anchor drags by that anchor, with Smart Guides on or off (#1313). Transform Again repeats the options of the transform it repeats (#1303). Aligning anchors that are already aligned adds no undo step (#1276), and type commands that change nothing record none either (#1316). Simplify keeps the path selected with its new anchors, and its dialog previews and shows the anchor count (#1305). Adding a stroke colour to an unpainted zero-width stroke gives it a visible 1 pt width (#1256). The Eyedropper samples locked objects, template layers and art outside isolation mode (#1260), and shows a pipette cursor (#1288). Fonts named by their full name resolve to the right face (#1267), and Proportional Metrics brings the matching kerning (`apkn`, `vkrn`, `vapk`) (#1291). Artboards: Escape leaves Artboard editing (#1296), Document Setup's Edit Artboards switches to the Artboard tool (#1294), and the Artboard tool starts on the active artboard (#1309). New and imported documents use the Gridline every and Subdivisions preferences (#1314). Send to Current Layer refuses a hidden or locked current layer (#1301), and layer row commands check explicit ids (#1255). Links: Find in Folder… finds missing linked files in a folder and its subfolders and can copy them into the document's folder (#1287). Image Trace traces images over 64 megapixels scaled down instead of refusing them (#1315). DXF export marks closed curves as closed SPLINE entities (#1320). EPS import: closepath respects the path size limit (#1311). The interface is available in Hungarian (#1302), and more Czech labels are translated (#1259). Linux RPMs declare shared-library capabilities (#1290). CI pins every third-party action to a verified commit (#1321). Select menu commands skip hidden and locked art and stay inside the isolated group in isolation mode (#1325). Fill, stroke, gradient and Appearance panel commands that change nothing add no undLine truncated
+| 2026-10-12 | Georgian interface (`ka`, ქართული): the whole catalog, plurals and messages, tested complete; Georgian letters come from an installed font (SF Georgian, Sylfaen, Noto Sans Georgian, DejaVu Sans) from the first frame; Type › Change Case › Title Case and Sentence case leave Georgian lower case instead of turning it into Mtavruli. |
 | 2026-10-11 | Effect › Brush Strokes: Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes, Sumi-e (G2). Command parameters from agents and files checked before anything changes (paint, place, cuts, dashes, crop, asset ids, anchors, paths, distort; #984–#999); command dialogs keep whole numbers whole, so Create Object Mosaic takes the tiles typed (#1000); stepper arrows take Shift (×10) and Ctrl/Cmd (÷10) like the arrow keys (#991). Exports and Rasterize supersample Art Optimized edges, so shapes meeting edge to edge leave no seam (#983). Character and paragraph styles take leading, kerning, mojikumi and the other attributes left out at their defaults (#1001). Drawing, typing and pasting with no layer shown and unlocked is refused instead of adding art to a hidden or locked layer (#1002). MCP `add_text` gives type on or in a path the colour asked for (#1003). MCP `screenshot` of a connected app renders the artboard asked for (#1004). `vectorcraft-cli run` ends quietly when its reader closes early (#1005). Select › All on Active Artboard selects on the artboard made active, not always the first (#1006). Reverse Gradient keeps off-centre midpoints, mirrored (#1007). A polar grid with no radial dividers draws none (#1008). Use Precise Cursors also covers the Pen's join pointer (#1009). SVGs with one absolute and one unitless root side import at their size, unstretched (#1010). DXF US survey inches, yards and miles open at their size and name (#1011). A file placed into a document with no other links follows its first change even while the app sits idle (#1031). PDF import keeps the style a font name says when the file doesn't embed the font (#1023). Shift selects ruler guides and art together, and Delete removes both (#1022). Open filled paths are hit by their fill on every side, the rotate cursor bows around the corner it is at, the flip icons match their flips, the Color Picker previews on the selection, and Properties › Transform reaches Scale Corners and Scale Strokes & Effects (#1036). Offset Path and the other booleans finish on outlines where the sweep used to loop until memory ran out (linesweeper 0.5, #1028). Floating panel groups stack into sets that move together, collapse to their tabs and dock as extra dock columns that scroll (#1020). Ruler guides live on layers: listed in the Layers panel, shown, hidden, locked, duplicated, merged and deleted with their layer, and moved between layers (#1021). A `.ai` whose editing data uses global process colours (`Xk`/`XK`) or pattern fills keeps its sublayers: the colours come in as global swatches at their tint, the patterns as pattern swatches (#1025). A `.ai` in PostScript form opens through its layers, read from the program itself, also when it names the prolog defining its operators without including it, as Rhino and other CAD apps write it (#1027). A fill or stroke chosen while the Type tool has characters selected colours just those characters (#1063). Scaled type shows its scaled font size, leading, baseline shift and horizontal scale in the Character panel, and a size typed there is the size you get (#1034). Character panel menu › Proportional Metrics sets Japanese and Chinese full-width glyphs on the font's proportional widths in horizontal type (#966). Align, Distribute, Move, Arrange, Lock, Hide, Ungroup and other Object commands that would change nothing no longer record an undo step or mark the document changed (#1060). Spot colours defined in Lab open with their Lab values from `.ai` and PDF files, instead of as wrong RGB colours or their CMYK equivalents (#1032). Build scripts leave a generated source they wouldn't change untouched, so the next build doesn't compile most of the workspace again where file times lose their sub-second part (#1051). A fill colour recolours the gradient mesh point last clicked with the Mesh tool or Direct Selection, and a Mesh tool click on a mesh's point selects that mesh (#1052). The All Tools drawer stays two tools wide instead of filling a wide window (#1054). Text Wrap's Make, Release and Options refuse a list of object ids with a malformed or unknown id instead of skipping it (#1055). A freeform gradient line with a malformed point index is refused instead of being shortened to the indices that are valid (#1056). The Corners dialog (`ui.corners`) refuses a malformed object id or a listed anchor that isn't a corner instead of editing the selection or the other corners (#1057). New View refuses a centre that isn't exactly [x, y] and a rotation that isn't a number, instead of trimming the one and saving the other as 0° (#1058). The command sweeps try junk scale, spacing and artboard values too, which they had skipped since before those bugs were fixed (#1059). EPS and PostScript `arc` and `arcn` with huge angles no longer hang the import, and an arc whose angles are whole turns apart is empty, as the PostScript reference defines it (#1062). Align and DisLine truncated
 | 2026-10-10 | Initial live Revolve (Effect › 3D and Materials, #846, #605), in its own `three-d` crate. Progress docs re-measured and restructured to the craftrules standard (this page, `docs/target-app-parity.md`, `gaps.md`, `ui-parity.md`, the format, hardware, localization, effects and type checklists). Same day: v0.8.0; Effect › Distort, Pixelate and Texture filters (13); German interface; Variables (data merge); Graph Type value axes and tick marks; restart when the first frame never reaches the screen (#964) |
 | 2026-10-09 | Radial Blur, Smart Blur, Unsharp Mask (gap 2 begins); 340 commits, the busiest day |
@@ -178,6 +182,10 @@ The full pre-standard record of what landed is kept in [docs/roadmap.md](docs/ro
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-17 | minor | Colored Inflate: shared membrane normals and smooth RGB vector ramps replace flat polygon bands; channel groups are batched per solid-fill surface. White-light Inflate retains its original polygons, paint composition and seam joins; the 0.05 seam minimum is restored. Scores and hour estimates unchanged. |
+| 2026-10-16 | minor | 3D lighting: one to ten directional lights, a selectable light list, Add Light and Delete Light, independent settings and artboard gestures; ambient applied once and smooth RGB vector export; scores and hour estimates unchanged |
+| 2026-10-16 | minor | 3D lighting: opaque RGB Color for the shared directional light, with neutral ambient, preview/reset controls and smooth vector Revolve shading; scores and hour estimates unchanged |
+| 2026-10-17 | minor | Progress log row for the Background Export progress dialog (#2564); headline numbers unchanged. |
 | 2026-10-14 | minor | G11: open-path anchor Delete removes adjoining segments without bridging the gap; explicit Remove Anchors keeps its reconnect/refit behavior. Scores and hours unchanged. |
 | 2026-10-14 | minor | Document fonts register every explicitly supplied craft-fonts family after the existing Japanese, Arabic and Thai prefix; optional empty input remains supported. Headline scores and estimates are unchanged. |
 | 2026-10-14 | minor | Progress log rows for the later merges of 2026-10-14 (#1630–#1875 as listed there); headline numbers unchanged. |

apps/vectorcraft-cli/src/main.rs

@@ -78,16 +78,20 @@ USAGE:
 
   vectorcraft-cli run [--in FILE] [--cmd ID [--params JSON]]... [--export FILE]... [--scale N]
       Headless batch: open FILE (any readable format) or start a new document, run commands in
-      order, export each FILE in the format its extension picks (see Writable formats). Prints one
-      JSON result per step.
+      order, export each FILE in the format its extension picks (see Writable formats; a .ait FILE
+      is a template, written as file.saveAsTemplate writes it). --scale sizes raster exports
+      (pixels per point, default 1); other formats leave it out. Prints one JSON result per step.
 
   vectorcraft-cli commands
       Print the command catalogue as JSON.
 
   vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text] [--decimals N] [--replace-lossy] [--editing-data] [--ai-version 7|pdf] [--hidden-objects layer|omit|visible] [--transparent-images flatten|omit]
       Open IN (any readable format) and export OUT in the format its extension picks (see Writable
-      formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
+      formats). --scale sizes a raster OUT (pixels per point, default 1); other formats leave it
+      out. --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
       unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
+      A .ait OUT is a template of every artboard, written as file.saveAsTemplate writes it (not with
+      --artboard or --range).
       Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
       SVG's data-* attributes; --outline-text writes SVG text as paths, --decimals sets SVG's coordinate
       precision (1–7, default 3). OUT may not be IN when reading
@@ -159,6 +163,16 @@ fn main() -> ExitCode {
     }
 }
 
+/// A headless session that remembers what the user keeps between runs: the PDF presets saved, the
+/// ICC profiles loaded and the plug-ins installed (#2168, #2174, #2541), in the folders next to the preferences that the desktop
+/// app uses too. `VECTORCRAFT_NO_PREFS` and `VECTORCRAFT_CONFIG_DIR` apply as they do there.
+fn with_stores(mut h: Headless) -> Headless {
+    prefs_dir::attach_profile_store(&mut h.session);
+    prefs_dir::attach_plugin_store(&mut h.session);
+    prefs_dir::attach_pdf_preset_store(&mut h.session);
+    h
+}
+
 fn mcp(args: &[String]) -> Result<(), String> {
     let mut connect: Option<String> = None;
     let mut headless = false;
@@ -198,14 +212,14 @@ fn mcp(args: &[String]) -> Result<(), String> {
         eprintln!("vectorcraft-cli: files confined: read root {}, write root {}", show(roots.read_root()), show(roots.write_root()));
         Box::new(Headless::with_document().with_automation_roots(Some(roots)))
     } else if headless {
-        Box::new(Headless::with_document())
+        Box::new(with_stores(Headless::with_document()))
     } else if let Some(addr) = connect {
         // Explicit address: fail loudly if the app isn't there.
         Box::new(Remote::connect(&addr).map_err(|e| format!("cannot connect to {addr}: {e}"))?)
     } else {
         match Remote::connect(DEFAULT_ADDR) {
             Ok(r) => Box::new(r),
-            Err(_) => Box::new(Headless::with_document()),
+            Err(_) => Box::new(with_stores(Headless::with_document())),
         }
     };
     eprintln!("vectorcraft-cli: MCP server on stdio ({})", backend.describe());
@@ -213,8 +227,8 @@ fn mcp(args: &[String]) -> Result<(), String> {
     // uses `vectorcraft_mcp` free to bring its own. Silent until a client sends logging/setLevel.
     vectorcraft_mcp::logging::install();
     let stdin = std::io::stdin();
-    let stdout = std::io::stdout();
-    Server::new(backend).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
+    // The server reads and writes from threads of its own, so it takes the handles, not locks held here.
+    Server::new(backend).serve(std::io::BufReader::new(stdin), std::io::stdout()).map_err(|e| e.to_string())
 }
 
 fn commands() -> Result<(), String> {
@@ -249,6 +263,10 @@ fn convert(args: &[String]) -> Result<(), String> {
         }
     }
     let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
+    let template = is_template(&output);
+    if template && (artboard.is_some() || range.is_some()) {
+        return Err("a .ait template holds every artboard: --artboard and --range don't apply".into());
+    }
     let mut h = Headless::new();
     let opened = if editing_data {
         let params = json!({"path": input, "editingData": "always"});
@@ -256,16 +274,23 @@ fn convert(args: &[String]) -> Result<(), String> {
     } else {
         h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?
     };
-    // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
-    // PSD).
-    let mut params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
-    if let Some(decimals) = decimals {
-        params["decimals"] = json!(decimals);
-    }
+    let (command, mut params) = if template {
+        // Save as Template writes every artboard, with the .ai options.
+        ("file.saveAsTemplate", json!({"path": output, "format": "ait", "outlineText": outline_text, "acknowledgeLoss": replace_lossy}))
+    } else {
+        // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
+        // PSD).
+        let params = json!({"path": output, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
+        let mut params = with_pixel_scale(params, &output, scale);
+        if let Some(decimals) = decimals {
+            params["decimals"] = json!(decimals);
+        }
+        ("document.export", params)
+    };
     for (key, value) in legacy {
         params[key] = json!(value);
     }
-    let mut r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
+    let mut r = h.call("engine.execute", json!({"command": command, "params": params})).map_err(|e| format!("export {output}: {e}"))?;
     // What reading the input left out (a missing linked file, an unsupported filter…) matters as
     // much as what writing the output did.
     if let (Some(w), Some(out)) = (opened.get("warnings").filter(|w| w.as_array().is_some_and(|a| !a.is_empty())), r.as_object_mut()) {
@@ -275,6 +300,21 @@ fn convert(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// Is `path` a `.ait` template? `file.saveAsTemplate` writes it; exports don't.
+fn is_template(path: &str) -> bool {
+    vectorcraft_engine::cmd::fileio::format_for_name(path).is_some_and(|f| f.id == "ait")
+}
+
+/// The export `params` for `path`, with `--scale` (pixels per point) when its format is raster.
+/// DXF has a `scale` of its own (drawing units per unit), which would resize the drawing and leave
+/// its units unset.
+fn with_pixel_scale(mut params: Value, path: &str, scale: f64) -> Value {
+    if vectorcraft_engine::cmd::fileio::writable_format(None, Some(path)).is_ok_and(|f| f.raster) {
+        params["scale"] = json!(scale);
+    }
+    params
+}
+
 fn info(args: &[String]) -> Result<(), String> {
     let file = args.first().ok_or("info needs a FILE")?;
     let mut h = Headless::new();
@@ -327,7 +367,7 @@ fn run(args: &[String]) -> Result<(), String> {
         }
     }
 
-    let mut h = Headless::new();
+    let mut h = with_stores(Headless::new());
     let mut out = std::io::stdout().lock();
     // A reader that stopped early (a closed pipe) isn't an error, and the batch goes on: its later
     // steps (an export…) still run, unprinted.
@@ -361,7 +401,12 @@ fn run(args: &[String]) -> Result<(), String> {
                 r
             }
             Step::Export(path) => {
-                let r = h.call("app.export", json!({"path": path, "scale": scale})).map_err(|e| format!("export {path}: {e}"))?;
+                let r = if is_template(&path) {
+                    h.call("engine.execute", json!({"command": "file.saveAsTemplate", "params": {"path": path, "format": "ait"}}))
+                } else {
+                    h.call("app.export", with_pixel_scale(json!({"path": path}), &path, scale))
+                };
+                let r = r.map_err(|e| format!("export {path}: {e}"))?;
                 emit(json!({"step": "export", "result": r}))?;
                 r
             }

apps/vectorcraft-cli/tests/cli.rs

@@ -58,6 +58,28 @@ fn run_batch_exports() {
     assert_eq!(last["result"]["artboards"][0]["width"], 200.0);
 }
 
+#[test]
+fn scale_sizes_raster_exports_only() {
+    // --scale is pixels per point. DXF has a `scale` of its own (drawing units per mm) that would
+    // resize the drawing and leave its units unset.
+    let svg = tmp("scale.svg");
+    std::fs::write(&svg, r#"<svg xmlns="http://www.w3.org/2000/svg" width="100" height="50"><rect x="10" y="10" width="30" height="20"/></svg>"#)
+        .unwrap();
+    let svg = svg.to_str().unwrap();
+    let (plain, scaled, png) = (tmp("plain.dxf"), tmp("scaled.dxf"), tmp("scaled.png"));
+    let ok = |args: &[&str]| {
+        let out = Command::new(BIN).args(args).output().unwrap();
+        assert!(out.status.success(), "{args:?}: {}", String::from_utf8_lossy(&out.stderr));
+    };
+    ok(&["convert", svg, plain.to_str().unwrap()]);
+    ok(&["convert", svg, scaled.to_str().unwrap(), "--scale", "2"]);
+    assert!(std::fs::read(&scaled).unwrap() == std::fs::read(&plain).unwrap(), "convert --scale 2 changed the DXF");
+    ok(&["run", "--in", svg, "--export", scaled.to_str().unwrap(), "--export", png.to_str().unwrap(), "--scale", "2"]);
+    assert!(std::fs::read(&scaled).unwrap() == std::fs::read(&plain).unwrap(), "run --scale 2 changed the DXF");
+    // 100 pt at scale 2 → 200 px (IHDR width).
+    assert_eq!(std::fs::read(&png).unwrap()[16..20], 200u32.to_be_bytes());
+}
+
 #[test]
 fn run_reports_errors() {
     let out = Command::new(BIN).args(["run", "--cmd", "nope.nothing"]).output().unwrap();
@@ -367,3 +389,97 @@ fn run_with_a_closed_stdout_ends_quietly_and_finishes_the_batch() {
     let out = Command::new(BIN).args(["run", "--cmd", "not-a-command"]).stdout(Stdio::null()).output().unwrap();
     assert!(!out.status.success());
 }
+
+/// A fresh settings folder for one test (`VECTORCRAFT_CONFIG_DIR`), so no run reads or writes the
+/// developer's real profile.
+fn config_dir(name: &str) -> std::path::PathBuf {
+    let dir = tmp(&format!("config-{name}"));
+    let _ = std::fs::remove_dir_all(&dir);
+    dir
+}
+
+/// One `vectorcraft-cli run` with `steps` ((command, params)) against the settings folder `config`;
+/// the result of each step.
+fn run_in(config: &std::path::Path, steps: &[(&str, Value)]) -> Vec<Value> {
+    let mut cmd = Command::new(BIN);
+    cmd.arg("run").env("VECTORCRAFT_CONFIG_DIR", config).env_remove("VECTORCRAFT_NO_PREFS");
+    for (id, params) in steps {
+        cmd.args(["--cmd", id, "--params", &params.to_string()]);
+    }
+    let out = cmd.output().unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    String::from_utf8(out.stdout).unwrap().lines().map(|l| serde_json::from_str::<Value>(l).unwrap()["result"].clone()).collect()
+}
+
+/// An ICC file of an RGB profile named `name` (a built-in one with its description replaced by a
+/// name of the same length).
+fn icc_file_named(path: &std::path::Path, name: &str) {
+    let builtin = "Display P3";
+    assert_eq!(builtin.len(), name.len());
+    let utf16 = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+    let mut bytes = vectorcraft_color::cms::icc_bytes(builtin).unwrap().to_vec();
+    let (from, to) = (utf16(builtin), utf16(name));
+    let at = bytes.windows(from.len()).position(|w| w == from).expect("the description in the profile");
+    bytes[at..at + to.len()].copy_from_slice(&to);
+    std::fs::write(path, bytes).unwrap();
+}
+
+fn profile_names(settings: &Value) -> Vec<&str> {
+    settings["profiles"].as_array().unwrap().iter().map(|p| p["name"].as_str().unwrap()).collect()
+}
+
+/// #2168, #2174: the PDF presets saved and the ICC profiles loaded in one headless run are there in
+/// the next run, and gone again once deleted.
+#[test]
+fn saved_pdf_presets_and_loaded_profiles_survive_a_restart() {
+    let config = config_dir("restart");
+    let icc = tmp("studio-p3.icc");
+    icc_file_named(&icc, "StudioRGB3");
+    let r = run_in(
+        &config,
+        &[
+            ("pdf.preset.save", json!({"name": "Press", "description": "for the printer"})),
+            ("color.loadProfile", json!({"path": icc.to_str().unwrap()})),
+        ],
+    );
+    assert_eq!(r[1]["name"], "StudioRGB3");
+
+    let r = run_in(&config, &[("pdf.preset.list", json!({})), ("edit.colorSettings", json!({}))]);
+    let presets: Vec<&str> =
+        r[0]["presets"].as_array().unwrap().iter().filter(|p| p["builtIn"] == false).map(|p| p["name"].as_str().unwrap()).collect();
+    assert_eq!(presets, ["Press"]);
+    assert_eq!(r[0]["presets"].as_array().unwrap().iter().find(|p| p["name"] == "Press").unwrap()["description"], "for the printer");
+    assert!(profile_names(&r[1]).contains(&"StudioRGB3"), "{:?}", profile_names(&r[1]));
+    // The profile works as a working space, and the file it came from can go.
+    std::fs::remove_file(&icc).unwrap();
+    let steps = [
+        ("edit.colorSettings", json!({"rgb": "StudioRGB3"})),
+        ("pdf.preset.delete", json!({"name": "Press"})),
+        ("edit.colorSettings", json!({"rgb": vectorcraft_color::cms::SRGB})),
+        ("color.removeProfile", json!({"name": "StudioRGB3"})),
+    ];
+    let r = run_in(&config, &steps);
+    assert_eq!(r[0]["rgb"], "StudioRGB3");
+    assert_eq!(r[3]["removed"], "StudioRGB3");
+
+    let r = run_in(&config, &[("pdf.preset.list", json!({})), ("edit.colorSettings", json!({}))]);
+    assert!(r[0]["presets"].as_array().unwrap().iter().all(|p| p["builtIn"] == true));
+    assert!(!profile_names(&r[1]).contains(&"StudioRGB3"));
+}
+
+/// Runs without preferences (`VECTORCRAFT_NO_PREFS`) keep what they save for the run only, and
+/// leave nothing in the settings folder.
+#[test]
+fn runs_without_preferences_remember_nothing() {
+    let config = config_dir("noprefs");
+    let out = Command::new(BIN)
+        .args(["run", "--cmd", "pdf.preset.save", "--params", r#"{"name":"Press"}"#])
+        .env("VECTORCRAFT_CONFIG_DIR", &config)
+        .env("VECTORCRAFT_NO_PREFS", "1")
+        .output()
+        .unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    assert!(!config.exists(), "nothing written");
+    let r = run_in(&config, &[("pdf.preset.list", json!({}))]);
+    assert!(r[0]["presets"].as_array().unwrap().iter().all(|p| p["builtIn"] == true));
+}

apps/vectorcraft-cli/tests/fileio.rs

@@ -179,3 +179,28 @@ fn convert_writes_legacy_ai_with_its_options() {
     assert!(!bad.status.success());
     assert!(String::from_utf8_lossy(&bad.stderr).contains("hiddenObjects"), "{}", String::from_utf8_lossy(&bad.stderr));
 }
+
+/// convert and `run --export` write a `.ait` as Save as Template does: a PDF-compatible template of
+/// every artboard that opens as a new untitled document.
+#[test]
+fn convert_and_run_write_ait_templates() {
+    let pdf = tmp("template-in.pdf");
+    make(&pdf, 120, 80);
+    let (converted, exported) = (tmp("converted.ait"), tmp("exported.ait"));
+    let r: Value = serde_json::from_str(&ok(&["convert", &pdf, &converted])).unwrap();
+    assert_eq!((&r["format"], &r["path"]), (&Value::from("ait"), &Value::from(converted.as_str())), "{r}");
+    let r: Value = serde_json::from_str(ok(&["run", "--in", &pdf, "--export", &exported]).lines().nth(1).unwrap()).unwrap();
+    assert_eq!(r["result"]["format"], "ait", "{r}");
+    for ait in [&converted, &exported] {
+        assert!(std::fs::read(ait).unwrap().starts_with(b"%PDF"), "{ait}");
+        let opened: Value = serde_json::from_str(ok(&["run", "--in", ait]).lines().next().unwrap()).unwrap();
+        let opened = &opened["result"];
+        assert_eq!((&opened["format"], &opened["restored"]), (&Value::from("ait"), &Value::from(true)), "{opened}");
+        assert!(opened["title"].as_str().is_some_and(|t| t.starts_with("Untitled-")), "{opened}");
+        assert_eq!(info(ait)["artboards"].as_array().unwrap().len(), 2, "{ait}");
+    }
+    // A template holds every artboard: one can't be picked.
+    let one = Command::new(BIN).args(["convert", &pdf, &tmp("one.ait"), "--artboard", "0"]).output().unwrap();
+    assert!(!one.status.success());
+    assert!(String::from_utf8_lossy(&one.stderr).contains("every artboard"), "{}", String::from_utf8_lossy(&one.stderr));
+}

apps/vectorcraft-web/Cargo.toml

@@ -26,6 +26,7 @@ log = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 rfd = { workspace = true }
 wasm-bindgen = "0.2"
+serde_json = { workspace = true }
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
 web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "PointerEvent", "TouchEvent", "AddEventListenerOptions", "DomRect", "DragEvent", "Storage", "Navigator", "RequestInit", "Response", "AbortController", "AbortSignal"] }

apps/vectorcraft-web/src/api.rs

@@ -0,0 +1,184 @@
+//! `window.vectorcraft`: the control channel for the page, as promises.
+//!
+//! The same JSON methods as the desktop control server (`docs/control-protocol.md`), so an agent
+//! driving VectorCraft in a browser tab (or an `<iframe>` in another app) uses the same commands as
+//! the CLI and the MCP server:
+//!
+//! ```js
+//! await vectorcraft.execute("object.rectangle", {x: 0, y: 0, width: 100, height: 50})  // engine command → its result
+//! await vectorcraft.request("ui.inspect")                      // control method → its result
+//! await vectorcraft.commands()                                 // command list
+//! const {base64} = await vectorcraft.screenshot()              // the canvas as PNG (base64)
+//! await vectorcraft.openFile("logo.svg", bytes)               // opened as a dropped file is
+//! vectorcraft.captureDownloads(true)                           // saves stay in the page…
+//! vectorcraft.files(); await vectorcraft.readFile("logo.png")  // …to be read back
+//! ```
+//!
+//! Results resolve with the method's `result`; errors reject with an `Error`.
+
+use std::cell::{Cell, RefCell};
+use std::sync::mpsc::{Receiver, Sender, TryRecvError};
+
+use serde_json::{Value, json};
+use vectorcraft_ui_egui::ControlRequest;
+use wasm_bindgen::prelude::*;
+
+use crate::saved_files::SavedFiles;
+
+use crate::web::Inbox;
+
+type Waiting = (Receiver<Value>, js_sys::Function, js_sys::Function);
+
+thread_local! {
+    static TX: RefCell<Option<Sender<ControlRequest>>> = const { RefCell::new(None) };
+    static WAITING: RefCell<Vec<Waiting>> = const { RefCell::new(Vec::new()) };
+    static CTX: RefCell<Option<egui::Context>> = const { RefCell::new(None) };
+    static INBOX: RefCell<Option<Inbox>> = const { RefCell::new(None) };
+    static CAPTURE: Cell<bool> = const { Cell::new(false) };
+    static SAVED: RefCell<SavedFiles> = RefCell::new(SavedFiles::default());
+}
+
+/// Wire the page's requests to the app: control requests go to `tx`, opened files to `inbox`.
+/// After a graphics restart the app keeps its channel: `tx` is `None` and only the context changes.
+pub fn connect(tx: Option<Sender<ControlRequest>>, inbox: Inbox, ctx: egui::Context) {
+    if let Some(tx) = tx {
+        TX.with(|t| *t.borrow_mut() = Some(tx));
+    }
+    INBOX.with(|i| *i.borrow_mut() = Some(inbox));
+    CTX.with(|c| *c.borrow_mut() = Some(ctx));
+}
+
+fn repaint() {
+    CTX.with(|c| {
+        if let Some(ctx) = c.borrow().as_ref() {
+            ctx.request_repaint();
+        }
+    });
+}
+
+/// Keep a save instead of downloading it, when the page asked for that. True when kept.
+pub fn capture(path: &str, bytes: &[u8]) -> bool {
+    if !CAPTURE.with(Cell::get) {
+        return false;
+    }
+    SAVED.with(|s| s.borrow_mut().keep(path, bytes));
+    true
+}
+
+fn to_js(v: &Value) -> JsValue {
+    js_sys::JSON::parse(&v.to_string()).unwrap_or(JsValue::NULL)
+}
+
+fn from_js(v: &JsValue) -> Value {
+    if v.is_undefined() || v.is_null() {
+        return json!({});
+    }
+    js_sys::JSON::stringify(v).ok().and_then(|s| s.as_string()).and_then(|s| serde_json::from_str(&s).ok()).unwrap_or(json!({}))
+}
+
+/// Settle the promises of answered requests (called every frame).
+pub fn poll_replies() {
+    WAITING.with(|w| {
+        w.borrow_mut().retain(|(rx, resolve, reject)| match rx.try_recv() {
+            Ok(v) => {
+                if v.get("ok").and_then(Value::as_bool) == Some(true) {
+                    let _ = resolve.call1(&JsValue::NULL, &to_js(v.get("result").unwrap_or(&Value::Null)));
+                } else {
+                    let msg = v.get("error").and_then(Value::as_str).unwrap_or("error").to_string();
+                    let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new(&msg));
+                }
+                false
+            }
+            Err(TryRecvError::Empty) => true,
+            Err(TryRecvError::Disconnected) => {
+                let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new("request dropped"));
+                false
+            }
+        });
+    });
+}
+
+fn request(method: &str, params: Value) -> js_sys::Promise {
+    let method = method.to_string();
+    let p = js_sys::Promise::new(&mut |resolve, reject| {
+        let (req, rx) = ControlRequest::new(method.clone(), params.clone());
+        let sent = TX.with(|t| t.borrow().as_ref().is_some_and(|tx| tx.send(req).is_ok()));
+        if sent {
+            WAITING.with(|w| w.borrow_mut().push((rx, resolve, reject)));
+        } else {
+            let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new("VectorCraft is not running yet"));
+        }
+    });
+    repaint();
+    p
+}
+
+fn set_fn(obj: &js_sys::Object, name: &str, f: JsValue) -> Result<(), JsValue> {
+    js_sys::Reflect::set(obj, &name.into(), &f).map(|_| ())
+}
+
+/// Install `window.vectorcraft`.
+pub fn install() -> Result<(), JsValue> {
+    let obj = js_sys::Object::new();
+    set_fn(
+        &obj,
+        "request",
+        Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(|method: String, params: JsValue| request(&method, from_js(&params)))
+            .into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "execute",
+        Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(|command: String, params: JsValue| {
+            request("engine.execute", json!({"command": command, "params": from_js(&params)}))
+        })
+        .into_js_value(),
+    )?;
+    set_fn(&obj, "commands", Closure::<dyn Fn() -> js_sys::Promise>::new(|| request("engine.commands", json!({}))).into_js_value())?;
+    set_fn(&obj, "inspect", Closure::<dyn Fn() -> js_sys::Promise>::new(|| request("ui.inspect", json!({}))).into_js_value())?;
+    set_fn(
+        &obj,
+        "screenshot",
+        Closure::<dyn Fn(JsValue) -> js_sys::Promise>::new(|params: JsValue| request("ui.screenshot", from_js(&params))).into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "openFile",
+        Closure::<dyn Fn(String, js_sys::Uint8Array) -> JsValue>::new(|name: String, bytes: js_sys::Uint8Array| {
+            let queued = INBOX.with(|i| {
+                i.borrow().as_ref().is_some_and(|inbox| {
+                    inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes.to_vec()));
+                    true
+                })
+            });
+            repaint();
+            JsValue::from_bool(queued)
+        })
+        .into_js_value(),
+    )?;
+    set_fn(&obj, "captureDownloads", Closure::<dyn Fn(bool)>::new(|on: bool| CAPTURE.with(|c| c.set(on))).into_js_value())?;
+    set_fn(
+        &obj,
+        "files",
+        Closure::<dyn Fn() -> JsValue>::new(|| {
+            SAVED.with(|s| to_js(&Value::Array(s.borrow().list().map(|(n, size)| json!({"path": n, "size": size})).collect())))
+        })
+        .into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "readFile",
+        Closure::<dyn Fn(String) -> Result<JsValue, JsValue>>::new(|name: String| {
+            SAVED.with(|s| {
+                s.borrow()
+                    .get(&name)
+                    .map(|b| js_sys::Uint8Array::from(b).into())
+                    .ok_or_else(|| js_sys::Error::new(&format!("{name}: not found")).into())
+            })
+        })
+        .into_js_value(),
+    )?;
+    let w = web_sys::window().ok_or("no window")?;
+    js_sys::Reflect::set(&w, &"vectorcraft".into(), &obj)?;
+    Ok(())
+}

apps/vectorcraft-web/src/main.rs

@@ -16,12 +16,16 @@
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
 //! language code) stands in for the browser's languages when the interface language is Automatic.
 
+#[cfg(target_arch = "wasm32")]
+mod api;
 #[cfg(target_arch = "wasm32")]
 mod fonts;
 #[cfg(target_arch = "wasm32")]
 mod locks;
 #[cfg(any(target_arch = "wasm32", test))]
 mod pencil;
+#[cfg(any(target_arch = "wasm32", test))]
+mod saved_files;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/vectorcraft-web/src/saved_files.rs

@@ -0,0 +1,70 @@
+//! What the page keeps of the app's saves (`api.rs`): `readFile` reads them back.
+
+/// Saved files kept (the oldest go first).
+pub const MAX_SAVED: usize = 16;
+
+/// The last component of a `/` or `\` path.
+fn file_name(path: &str) -> &str {
+    path.rsplit(['/', '\\']).next().filter(|n| !n.is_empty()).unwrap_or(path)
+}
+
+/// Files by name, newest last: saving a name again replaces it.
+#[derive(Default)]
+pub struct SavedFiles(Vec<(String, Vec<u8>)>);
+
+impl SavedFiles {
+    /// Keep `bytes` under the last component of `path`.
+    pub fn keep(&mut self, path: &str, bytes: &[u8]) {
+        let name = file_name(path).to_string();
+        self.0.retain(|(n, _)| *n != name);
+        self.0.push((name, bytes.to_vec()));
+        let extra = self.0.len().saturating_sub(MAX_SAVED);
+        self.0.drain(..extra);
+    }
+
+    /// A kept file by its name, or by a path ending in it.
+    pub fn get(&self, name: &str) -> Option<&[u8]> {
+        let wanted = file_name(name);
+        self.0.iter().find(|(n, _)| n == wanted).map(|(_, b)| b.as_slice())
+    }
+
+    /// `(name, size)` of each kept file, oldest first.
+    pub fn list(&self) -> impl Iterator<Item = (&str, usize)> {
+        self.0.iter().map(|(n, b)| (n.as_str(), b.len()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn keeps_by_name_replaces_and_reads_back_by_path() {
+        let mut s = SavedFiles::default();
+        s.keep("exports/poster.png", b"one");
+        s.keep(r"C:\out\poster.png", b"two");
+        s.keep("notes.txt", b"three");
+        assert_eq!(s.list().collect::<Vec<_>>(), vec![("poster.png", 3), ("notes.txt", 5)]);
+        assert_eq!(s.get("poster.png"), Some(&b"two"[..]));
+        assert_eq!(s.get("/exports/poster.png"), Some(&b"two"[..]));
+        assert_eq!(s.get("missing.png"), None);
+    }
+
+    #[test]
+    fn drops_the_oldest_past_the_cap() {
+        let mut s = SavedFiles::default();
+        for i in 0..MAX_SAVED + 3 {
+            s.keep(&format!("f{i}.png"), &[0]);
+        }
+        assert_eq!(s.list().count(), MAX_SAVED);
+        assert_eq!(s.get("f0.png"), None);
+        assert!(s.get(&format!("f{}.png", MAX_SAVED + 2)).is_some());
+    }
+
+    #[test]
+    fn a_trailing_separator_keeps_the_whole_name() {
+        let mut s = SavedFiles::default();
+        s.keep("odd/", b"x");
+        assert_eq!(s.get("odd/"), Some(&b"x"[..]));
+    }
+}

apps/vectorcraft-web/src/web.rs

@@ -19,7 +19,7 @@ use wasm_bindgen::JsCast as _;
 use crate::locks::WebLocks;
 use crate::pencil::SharedPointers;
 
-type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
+pub(crate) type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
 /// whether Shift was held: where dropped files land.
@@ -122,9 +122,18 @@ async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Movi
                         // The old services asked the old context for frames.
                         app.services = services;
                         app.status("The graphics were lost and have been restarted");
+                        crate::api::connect(None, host.inbox.clone(), ctx.clone());
                         app
                     }
-                    None => VectorcraftApp::new(Session::new(), services),
+                    None => {
+                        // `window.vectorcraft`: the page's control channel (crate::api).
+                        let (control_tx, control_rx) = std::sync::mpsc::channel();
+                        crate::api::connect(Some(control_tx), host.inbox.clone(), ctx.clone());
+                        if let Err(e) = crate::api::install() {
+                            log::error!("vectorcraft-web: couldn't install window.vectorcraft: {}", js_err(e));
+                        }
+                        VectorcraftApp::new(Session::new(), services).with_control(control_rx)
+                    }
                 };
                 Ok(Box::new(WebShell { app: Some(app), host, canvas: page, loss }))
             }),
@@ -386,6 +395,7 @@ impl eframe::App for WebShell {
             }
         }
         app.logic(ctx);
+        crate::api::poll_replies();
     }
 
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
@@ -399,6 +409,7 @@ impl eframe::App for WebShell {
         if let Some(app) = &mut self.app {
             app.ui(ui);
         }
+        crate::api::poll_replies();
     }
 }
 
@@ -544,6 +555,9 @@ impl RecoveryStore for BrowserStore {
 
 /// Trigger a browser download of `bytes` named after the last component of `path`.
 fn download(path: &str, bytes: &[u8]) -> Result<(), String> {
+    if crate::api::capture(path, bytes) {
+        return Ok(());
+    }
     let js = |e: wasm_bindgen::JsValue| format!("{e:?}");
     let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "vectorcraft".into());
     let window = web_sys::window().ok_or("no window")?;

apps/vectorcraft/Cargo.toml

@@ -75,7 +75,17 @@ pollster = "1"
 # Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback, src/compositor_gpu.rs),
 # so Automatic draws on that one. Both are already in the build through winit.
 wayland-client = "0.31"
-wayland-protocols = { version = "0.32", features = ["client"] }
+wayland-protocols = { version = "0.32", features = ["client", "unstable"] }
+# The save dialog's parent window on Wayland (src/portal_save.rs): an xdg-foreign handle (in
+# wayland-protocols' `unstable` set) made on the window's own connection. MIT, already in the build
+# through winit and rfd.
+wayland-backend = { version = "0.3", features = ["client_system"] }
+
+# The save dialog's file type (src/portal_save.rs, #2679): the desktop portal over D-Bus, on the
+# systems where rfd shows the portal's dialog. MIT, already in the build through accesskit. Pinned
+# exactly: review the diff before bumping.
+[target.'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))'.dependencies]
+zbus = "=5.19.0"
 
 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.
@@ -84,3 +94,5 @@ winresource = "0.1"
 [dev-dependencies]
 # Bound socket buffers in real loopback transport deadline regressions.
 socket2 = { workspace = true }
+# src/portal_save.rs's tests build and read the portal's D-Bus values on every system.
+zbus = "=5.19.0"

apps/vectorcraft/src/control_server.rs

@@ -383,7 +383,10 @@ mod tests {
         });
         let mut reader = BufReader::new(client.try_clone().unwrap());
         for id in [1, 2] {
-            writeln!(client, "{}", json!({"id": id, "method": "inspect"})).unwrap();
+            // The client sends each line in one write. `writeln!` on the socket sends the JSON in many
+            // small writes, and when the machine is busy, a pause of more than the 120 ms line deadline
+            // between two of them closes the connection.
+            client.write_all(format!("{}\n", json!({"id": id, "method": "inspect"})).as_bytes()).unwrap();
             let mut line = String::new();
             reader.read_line(&mut line).unwrap();
             assert_eq!(serde_json::from_str::<Value>(&line).unwrap(), json!({"id": id, "ok": true}));

apps/vectorcraft/src/main.rs

@@ -43,6 +43,8 @@ mod mac_screen_color;
 mod mac_window;
 #[cfg(target_os = "macos")]
 mod open_documents;
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd", test))]
+mod portal_save;
 mod prefs_dir;
 mod printing;
 #[cfg(all(windows, not(target_vendor = "win7")))]
@@ -359,10 +361,20 @@ fn make_folder(request: &PickRequest) {
     }
 }
 
-/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked.
+/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked. On
+/// Linux and the BSDs a save dialog with two or more file types is the desktop portal's, over
+/// `parent`, and its answer also names the file type picked ([`portal_save`]); `dialog` shows when
+/// the portal can't.
 #[cfg(not(target_os = "macos"))]
-fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
+#[cfg_attr(windows, allow(unused_variables))]
+fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest, parent: &Parent) -> Vec<String> {
     make_folder(request);
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    if let PickRequest::Save(pick) = request
+        && let Some(answer) = portal_save::pick(pick, parent.as_deref())
+    {
+        return answer;
+    }
     let paths = match request {
         PickRequest::Open(_) => dialog.pick_file().into_iter().collect(),
         PickRequest::OpenMany => dialog.pick_files().unwrap_or_default(),
@@ -375,7 +387,7 @@ fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
 /// Show the dialog for `request` over `parent` now → the paths picked.
 #[cfg(not(target_os = "macos"))]
 fn pick_now(request: PickRequest, parent: &Parent) -> Vec<String> {
-    show_dialog(file_dialog(&request, parent), &request)
+    show_dialog(file_dialog(&request, parent), &request, parent)
 }
 
 /// macOS shows no dialog in line: its modal loop would run inside winit's event handler, and an
@@ -389,6 +401,7 @@ fn pick_now(request: PickRequest, _parent: &Parent) -> Vec<String> {
 
 /// File → Show in Folder: select `path` in Finder / Explorer, or open its folder elsewhere.
 fn reveal(path: &str) -> Result<(), String> {
+    explorer_safe(path)?;
     reveal_command(path).spawn().map(|_| ()).map_err(|e| format!("can't show {path}: {e}"))
 }
 
@@ -430,11 +443,12 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
     let dialog = file_dialog(&request, parent);
     let (tx, rx) = std::sync::mpsc::channel();
     let ui = ui.clone();
+    let parent = parent.clone();
     std::thread::Builder::new()
         .name("file-dialog".into())
         .spawn(move || {
             // The app gone meanwhile has no use for the answer.
-            let _ = tx.send(show_dialog(dialog, &request));
+            let _ = tx.send(show_dialog(dialog, &request, &parent));
             ui.request_repaint();
         })
         .ok()?;
@@ -529,6 +543,7 @@ fn services(parent: Parent, ui: egui::Context) -> Services {
         no_cursor_theme: wayland && cursor_theme::theme_missing(),
         read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))),
         write: Some(Box::new(write_file)),
+        exists: Some(Box::new(|p: &str| std::path::Path::new(p).exists())),
         // Background Save and Export write from a worker thread.
         write_shared: Some(std::sync::Arc::new(write_file)),
         // Native saves stream into the file as they are encoded.
@@ -558,8 +573,15 @@ fn services(parent: Parent, ui: egui::Context) -> Services {
     }
 }
 
+/// Windows passes `path` to Explorer inside quotes it adds itself, so a path holding a quote (which
+/// no Windows file name has) is refused rather than split into other arguments.
+fn explorer_safe(path: &str) -> Result<(), String> {
+    if cfg!(windows) && path.contains('"') { Err(format!("can't open {path}: the path contains a quotation mark")) } else { Ok(()) }
+}
+
 /// Edit Original, Show Package: open `path` (a file or a folder) in the system's default app for it.
 fn open_file(path: &str) -> Result<(), String> {
+    explorer_safe(path)?;
     #[cfg(windows)]
     let mut c = {
         use std::os::windows::process::CommandExt as _;
@@ -787,14 +809,19 @@ fn main() -> std::process::ExitCode {
     let custom_titlebar = custom_titlebar(saved.as_ref());
     let options = native_options(custom_titlebar);
     // winit picks Wayland whenever `WAYLAND_DISPLAY` is set; Preferences › Performance › Linux
-    // Display Server › X11 opens the window through XWayland instead, where file drops work (#1151).
+    // Display Server › X11 opens the window through XWayland instead, where file drops work (#1151),
+    // and X11 (XWayland) When a Pen Is Attached does so when a pen is attached, where the pen draws (#2028).
     #[cfg(target_os = "linux")]
     let options = {
         let mut options = options;
         let pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("linuxDisplayServer")).and_then(serde_json::Value::as_str);
-        if xwayland::wanted(pref, |name| std::env::var_os(name)) {
+        if xwayland::wanted(pref, |name| std::env::var_os(name), xwayland::pen_attached) {
             if xwayland::x11_libraries_found() {
-                log::info!("opening the window through XWayland (Preferences › Performance › Linux Display Server)");
+                if pref == Some("x11WithPen") {
+                    log::info!("pen found: opening the window through XWayland (Preferences › Performance › Linux Display Server)");
+                } else {
+                    log::info!("opening the window through XWayland (Preferences › Performance › Linux Display Server)");
+                }
                 use winit::platform::x11::EventLoopBuilderExtX11 as _;
                 options.event_loop_builder = Some(Box::new(|builder| {
                     builder.with_x11();
@@ -854,8 +881,15 @@ fn main() -> std::process::ExitCode {
             "VectorCraft",
             options,
             Box::new(move |cc| {
-                let mut app = VectorcraftApp::new(Session::new(), services(cc.winit_window().cloned(), cc.egui_ctx.clone()));
+                let mut session = Session::new();
+                // The profiles loaded before come back before the preferences name any of them.
+                prefs_dir::attach_profile_store(&mut session);
+                prefs_dir::attach_plugin_store(&mut session);
+                let mut app = VectorcraftApp::new(session, services(cc.winit_window().cloned(), cc.egui_ctx.clone()));
                 load_prefs(&mut app, saved);
+                // The saved PDF presets live in their own folder (also read by vectorcraft-cli),
+                // which takes over from the copy the preferences file used to hold.
+                prefs_dir::attach_pdf_preset_store(&mut app.session);
                 // Fit the window to its monitor, or put it back where it was (still hidden).
                 if let Some(w) = cc.winit_window() {
                     app.ui.window = Some(window::restore(w, saved_window));
@@ -867,6 +901,8 @@ fn main() -> std::process::ExitCode {
                 app.session.swatch_libraries.set_user_dir(swatches);
                 let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
                 app.session.style_libraries.set_user_dir(styles);
+                // With the User Defined libraries listed, the persistent library panels reopen.
+                vectorcraft_ui_egui::panels::library_panel::restore(&mut app);
                 // So do the Libraries panel's libraries; runs without preferences (agents' test
                 // runs) keep theirs for the session only, never touching the user's.
                 if prefs_enabled() {
@@ -1036,9 +1072,9 @@ mod tests {
             .collect()
     }
 
-    /// Finder offers the app for every file File › Open reads (#295, #354) but Photoshop documents
-    /// (`UNASSOCIATED_EXTS`), takes over no other app's files, and hands them to the app rather than
-    /// to AppKit's document machinery.
+    /// Finder offers the app for every file File › Open reads (#295, #354) but those with an
+    /// extension in `UNASSOCIATED_EXTS`, takes over no other app's files, and hands them to the app
+    /// rather than to AppKit's document machinery.
     #[test]
     fn the_macos_bundle_opens_every_readable_format() {
         let plist = include_str!("../../../packaging/macos/Info.plist.in");

apps/vectorcraft/src/portal_save.rs

@@ -0,0 +1,529 @@
+//! Linux and the BSDs: the save dialog of a save with two or more file types (Save, Save As, Save a
+//! Copy, Save as Template; #2679), asked of the XDG desktop portal here
+//! (<https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.FileChooser.html>).
+//! rfd 0.17 sends no `current_filter` with `SaveFile` and reads only `uris` from the answer
+//! (PolyMeilex/rfd#341), and the GTK file chooser behind the portal keeps the typed name when the
+//! user picks another file type, so the type picked was lost. This call sends the first file type as
+//! `current_filter`, reads the one picked back, and answers its first extension after the path
+//! ([`vectorcraft_ui_egui::picks::PickAnswer`]); the app gives the name that type's extension.
+//! rfd shows the dialog when the portal can't (no session bus, no file chooser), with zenity as its
+//! own fallback. PhotoCraft's `portal_save.rs` (storytold/photocraft#6151) makes the same call.
+//!
+//! The dialog's parent is the window: `x11:<window id>` on X11, and on Wayland (Linux) a handle
+//! from the compositor's xdg-foreign protocol, as rfd names it (its `window_identifier`).
+
+use std::collections::HashMap;
+
+use vectorcraft_ui_egui::FilePick;
+use zbus::zvariant::{OwnedValue, Value};
+
+/// A file type in the dialog: its label and its extensions without the dot.
+type Filter = (String, Vec<String>);
+
+/// A save dialog to show.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+struct SaveRequest {
+    /// The portal's identifier of the parent window, or empty.
+    parent: String,
+    /// The suggested name; empty for none.
+    name: String,
+    folder: Option<String>,
+    /// The file types, labeled in the interface's language; the dialog starts on the first.
+    filters: Vec<Filter>,
+}
+
+impl SaveRequest {
+    /// The dialog for `pick` over the window `parent` names.
+    fn new(pick: &FilePick, parent: String) -> Self {
+        let lang = vectorcraft_ui_egui::i18n::current();
+        let filters = pick
+            .filters
+            .iter()
+            .map(|(label, exts)| {
+                (vectorcraft_ui_egui::i18n::tr_ctx(lang, "file-filter", label).to_string(), exts.iter().map(|e| e.to_string()).collect())
+            })
+            .collect();
+        Self { parent, name: pick.name.clone(), folder: pick.folder.clone(), filters }
+    }
+}
+
+/// What the dialog answered: the path, as typed, and the label of the file type picked.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Saved {
+    path: String,
+    filter: Option<String>,
+}
+
+/// `filter` as the portal takes it: its label and a `*.ext` pattern for each extension (`*` for
+/// every file), as rfd sends them.
+fn wire(filter: &Filter) -> (String, Vec<(u32, String)>) {
+    let globs = filter.1.iter().map(|e| (0, if e.is_empty() || e == "*" { "*".to_string() } else { format!("*.{e}") })).collect();
+    (filter.0.clone(), globs)
+}
+
+/// The `SaveFile` options for `request`, answering on `token`.
+fn options<'a>(request: &'a SaveRequest, token: &'a str) -> HashMap<&'static str, Value<'a>> {
+    let mut o = HashMap::from([("handle_token", Value::from(token))]);
+    if !request.name.is_empty() {
+        o.insert("current_name", Value::from(request.name.as_str()));
+    }
+    if let Some(folder) = &request.folder {
+        // A byte string ending in NUL, as the portal specifies.
+        let mut bytes = folder.as_bytes().to_vec();
+        bytes.push(0);
+        o.insert("current_folder", Value::from(bytes));
+    }
+    if let Some(first) = request.filters.first() {
+        o.insert("filters", Value::from(request.filters.iter().map(wire).collect::<Vec<_>>()));
+        o.insert("current_filter", Value::from(wire(first)));
+    }
+    o
+}
+
+/// The portal's `Response`: code 0 with the first of its `uris` and the label of its
+/// `current_filter`. Any other code ends the dialog without a file (1 is Cancel, 2 a dialog closed
+/// some other way), as rfd reads it.
+fn answer(code: u32, results: &HashMap<String, OwnedValue>) -> Result<Option<Saved>, String> {
+    if code != 0 {
+        return Ok(None);
+    }
+    let uris: Vec<String> = results
+        .get("uris")
+        .ok_or("no file in the portal's answer")?
+        .try_clone()
+        .map_err(|e| e.to_string())?
+        .try_into()
+        .map_err(|e: zbus::zvariant::Error| e.to_string())?;
+    let uri = uris.first().ok_or("no file in the portal's answer")?;
+    let path = file_uri_path(uri).ok_or_else(|| format!("not a local file: {uri}"))?;
+    let filter = results.get("current_filter").and_then(|v| {
+        let (label, _globs): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+        Some(label)
+    });
+    Ok(Some(Saved { path, filter }))
+}
+
+/// `file:///home/me/A%20b.svg` → `/home/me/A b.svg`; `None` for a file elsewhere (`file://host/`)
+/// or another scheme.
+fn file_uri_path(uri: &str) -> Option<String> {
+    let rest = uri.strip_prefix("file://")?;
+    let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+    if !rest.starts_with('/') {
+        return None;
+    }
+    let mut out = Vec::with_capacity(rest.len());
+    let mut rest = rest.as_bytes();
+    while let Some((&b, tail)) = rest.split_first() {
+        let hex = tail.get(..2).filter(|h| b == b'%' && h.iter().all(u8::is_ascii_hexdigit));
+        match hex.and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok()) {
+            Some(decoded) => {
+                out.push(decoded);
+                rest = tail.get(2..).unwrap_or_default();
+            }
+            None => {
+                out.push(b);
+                rest = tail;
+            }
+        }
+    }
+    // `show_dialog` makes rfd's path a string with `to_string_lossy` too.
+    Some(String::from_utf8_lossy(&out).into_owned())
+}
+
+/// `saved` as the answer of the save dialog for `request`: the path, then the first extension of
+/// the file type picked, found by its label. Empty when the dialog was canceled.
+fn pick_answer(saved: Option<Saved>, request: &SaveRequest) -> Vec<String> {
+    let Some(saved) = saved else { return Vec::new() };
+    let picked = saved.filter.and_then(|label| request.filters.iter().find(|(l, _)| *l == label)).and_then(|(_, exts)| exts.first().cloned());
+    std::iter::once(saved.path).chain(picked).collect()
+}
+
+/// The portal's identifier of an X11 window.
+fn x11_parent(window: impl std::fmt::LowerHex) -> String {
+    format!("x11:{window:x}")
+}
+
+/// Show the portal's save dialog for `pick` over `window` and wait for it → the answer (see the
+/// module's comment). `None` when `pick` offers fewer than two file types, or the portal couldn't
+/// show the dialog; rfd shows it then.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+pub fn pick(pick: &FilePick, window: Option<&winit::window::Window>) -> Option<Vec<String>> {
+    if pick.filters.len() < 2 {
+        return None;
+    }
+    // The export stays until the dialog has answered: the handle is valid while it lives.
+    let (parent, _export) = window.map(parent).unwrap_or_default();
+    let request = SaveRequest::new(pick, parent);
+    let saved = zbus::blocking::Connection::session().map_err(|e| e.to_string()).and_then(|conn| save_file(&conn, &request));
+    match saved {
+        Ok(saved) => Some(pick_answer(saved, &request)),
+        Err(e) => {
+            log::info!("the portal's save dialog failed ({e}): rfd shows it");
+            None
+        }
+    }
+}
+
+/// Ask the portal on `conn` for the save dialog of `request` and wait for its answer.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn save_file(conn: &zbus::blocking::Connection, request: &SaveRequest) -> Result<Option<Saved>, String> {
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    use zbus::blocking::Proxy;
+    use zbus::zvariant::OwnedObjectPath;
+
+    const DESKTOP: &str = "org.freedesktop.portal.Desktop";
+    const REQUEST: &str = "org.freedesktop.portal.Request";
+    static NEXT: AtomicU32 = AtomicU32::new(0);
+    let sender = conn.unique_name().ok_or("no name on the session bus")?.as_str().trim_start_matches(':').replace('.', "_");
+    let token = format!("vectorcraft_save_{}_{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed));
+    let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+    // Listen before asking, so that an answer that comes at once is not missed.
+    let mut replies = Proxy::new(conn, DESKTOP, path.as_str(), REQUEST).and_then(|p| p.receive_signal("Response")).map_err(|e| e.to_string())?;
+    let chooser = Proxy::new(conn, DESKTOP, "/org/freedesktop/portal/desktop", "org.freedesktop.portal.FileChooser").map_err(|e| e.to_string())?;
+    // The title is empty, as rfd sends it for a save.
+    let handle: OwnedObjectPath = chooser.call("SaveFile", &(request.parent.as_str(), "", options(request, &token))).map_err(|e| e.to_string())?;
+    // A portal older than version 0.9 ignores `handle_token` and answers on the request path it
+    // returns.
+    let reply = if handle.as_str() == path {
+        replies.next()
+    } else {
+        Proxy::new(conn, DESKTOP, handle.as_str(), REQUEST).and_then(|p| p.receive_signal("Response")).map_err(|e| e.to_string())?.next()
+    }
+    .ok_or("the save dialog closed without an answer")?;
+    let (code, results): (u32, HashMap<String, OwnedValue>) = reply.body().deserialize().map_err(|e| e.to_string())?;
+    answer(code, &results)
+}
+
+/// The portal's identifier of `window` when it is an X11 window.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn x11_window(window: &winit::window::Window) -> Option<String> {
+    use winit::raw_window_handle::{HasWindowHandle as _, RawWindowHandle};
+    match window.window_handle().ok()?.as_raw() {
+        RawWindowHandle::Xlib(h) => Some(x11_parent(h.window)),
+        RawWindowHandle::Xcb(h) => Some(x11_parent(h.window.get())),
+        _ => None,
+    }
+}
+
+/// The portal's identifier of `window`, and on Wayland the export that keeps it valid; empty when
+/// the window has neither an X11 id nor a Wayland handle.
+#[cfg(target_os = "linux")]
+fn parent(window: &winit::window::Window) -> (String, Option<wayland::Export>) {
+    if let Some(id) = x11_window(window) {
+        return (id, None);
+    }
+    match wayland::export(window) {
+        Some(export) => (format!("wayland:{}", export.handle), Some(export)),
+        None => (String::new(), None),
+    }
+}
+
+/// The portal's identifier of `window`: its X11 id, else empty (no Wayland export is made off
+/// Linux).
+#[cfg(any(target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn parent(window: &winit::window::Window) -> (String, Option<()>) {
+    (x11_window(window).unwrap_or_default(), None)
+}
+
+/// The Wayland window's handle for the portal: an xdg-foreign v2 export of its surface
+/// (<https://wayland.app/protocols/xdg-foreign-unstable-v2>), made as rfd's `window_identifier`
+/// makes it.
+#[cfg(target_os = "linux")]
+mod wayland {
+    use wayland_client::globals::{GlobalListContents, registry_queue_init};
+    use wayland_client::protocol::wl_registry::{self, WlRegistry};
+    use wayland_client::protocol::wl_surface::WlSurface;
+    use wayland_client::{Connection, Dispatch, Proxy, QueueHandle};
+    use wayland_protocols::xdg::foreign::zv2::client::zxdg_exported_v2::{self, ZxdgExportedV2};
+    use wayland_protocols::xdg::foreign::zv2::client::zxdg_exporter_v2::{self, ZxdgExporterV2};
+
+    /// A window exported for the portal: `handle` names it until this is dropped.
+    pub struct Export {
+        pub handle: String,
+        exported: ZxdgExportedV2,
+        conn: Connection,
+    }
+
+    impl Drop for Export {
+        fn drop(&mut self) {
+            self.exported.destroy();
+            let _ = self.conn.flush();
+        }
+    }
+
+    /// The events the export waits for.
+    #[derive(Default)]
+    struct State {
+        handle: Option<String>,
+    }
+
+    impl Dispatch<WlRegistry, GlobalListContents> for State {
+        fn event(_: &mut Self, _: &WlRegistry, _: wl_registry::Event, _: &GlobalListContents, _: &Connection, _: &QueueHandle<Self>) {}
+    }
+
+    impl Dispatch<ZxdgExporterV2, ()> for State {
+        fn event(_: &mut Self, _: &ZxdgExporterV2, _: zxdg_exporter_v2::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {}
+    }
+
+    impl Dispatch<ZxdgExportedV2, ()> for State {
+        fn event(state: &mut Self, _: &ZxdgExportedV2, event: zxdg_exported_v2::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {
+            if let zxdg_exported_v2::Event::Handle { handle } = event {
+                state.handle = Some(handle);
+            }
+        }
+    }
+
+    /// Export `window`'s surface on the window's own Wayland connection, with an event queue of its
+    /// own → `None` when the compositor has no xdg-foreign v2 or answers no handle.
+    pub fn export(window: &winit::window::Window) -> Option<Export> {
+        let (conn, surface) = surface(window)?;
+        let (globals, mut queue) = registry_queue_init::<State>(&conn).ok()?;
+        let qh = queue.handle();
+        let exporter: ZxdgExporterV2 = globals.bind(&qh, 1..=1, ()).ok()?;
+        let exported = exporter.export_toplevel(&surface, &qh, ());
+        let mut state = State::default();
+        let answered = queue.roundtrip(&mut state);
+        exporter.destroy();
+        match (answered, state.handle) {
+            (Ok(_), Some(handle)) => Some(Export { handle, exported, conn }),
+            _ => {
+                exported.destroy();
+                let _ = conn.flush();
+                log::info!("the compositor gave no xdg-foreign handle: the save dialog has no parent window");
+                None
+            }
+        }
+    }
+
+    /// `window`'s Wayland connection and surface, from its raw handles.
+    #[allow(unsafe_code)]
+    fn surface(window: &winit::window::Window) -> Option<(Connection, WlSurface)> {
+        use wayland_backend::sys::client::{Backend, ObjectId};
+        use winit::raw_window_handle::{HasDisplayHandle as _, HasWindowHandle as _, RawDisplayHandle, RawWindowHandle};
+        let (RawWindowHandle::Wayland(w), RawDisplayHandle::Wayland(d)) =
+            (window.window_handle().ok()?.as_raw(), window.display_handle().ok()?.as_raw())
+        else {
+            return None;
+        };
+        // SAFETY: the display is winit's open `wl_display`, which outlives `window` (the caller
+        // holds it until the export is dropped); a backend made from a foreign display does not
+        // close it when dropped.
+        let backend = unsafe { Backend::from_foreign_display(d.display.as_ptr().cast()) };
+        let conn = Connection::from_backend(backend);
+        // SAFETY: the pointer is the window's live `wl_surface` proxy on that display.
+        let id = unsafe { ObjectId::from_ptr(WlSurface::interface(), w.surface.as_ptr().cast()) }.ok()?;
+        let surface = WlSurface::from_id(&conn, id).ok()?;
+        Some((conn, surface))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn request() -> SaveRequest {
+        let pick = FilePick {
+            name: "Untitled-1.vectorcraft".into(),
+            folder: Some("/home/me/Art".into()),
+            filters: vec![("VectorCraft", &["vectorcraft"]), ("SVG", &["svg"]), ("PDF-compatible .ai", &["ai"])],
+        };
+        SaveRequest::new(&pick, "x11:3a0000f".into())
+    }
+
+    /// The dialog starts on the first file type (the document's format) and shows the suggested
+    /// name in its folder.
+    #[test]
+    fn the_request_names_the_file_type_the_dialog_starts_on() {
+        let request = request();
+        let o = options(&request, "t1");
+        assert_eq!(o.get("current_filter"), Some(&Value::from(("VectorCraft".to_string(), vec![(0u32, "*.vectorcraft".to_string())]))));
+        let filters = vec![
+            ("VectorCraft".to_string(), vec![(0u32, "*.vectorcraft".to_string())]),
+            ("SVG".to_string(), vec![(0u32, "*.svg".to_string())]),
+            ("PDF-compatible .ai".to_string(), vec![(0u32, "*.ai".to_string())]),
+        ];
+        assert_eq!(o.get("filters"), Some(&Value::from(filters)));
+        assert_eq!(o.get("current_name"), Some(&Value::from("Untitled-1.vectorcraft")));
+        assert_eq!(o.get("current_folder"), Some(&Value::from(b"/home/me/Art\0".to_vec())));
+        assert_eq!(o.get("handle_token"), Some(&Value::from("t1")));
+        let bare = SaveRequest { name: String::new(), folder: None, filters: Vec::new(), ..request };
+        let o = options(&bare, "t2");
+        assert_eq!(o.keys().copied().collect::<Vec<_>>(), ["handle_token"]);
+    }
+
+    /// The portal's answer as a D-Bus dictionary: `uris` and `current_filter`.
+    fn results(uri: &str, filter: Option<&str>) -> HashMap<String, OwnedValue> {
+        let mut r = HashMap::new();
+        r.insert("uris".to_string(), OwnedValue::try_from(Value::from(vec![uri.to_string()])).unwrap());
+        if let Some(label) = filter {
+            let picked = Value::from((label.to_string(), vec![(0u32, "*.ai".to_string())]));
+            r.insert("current_filter".to_string(), OwnedValue::try_from(picked).unwrap());
+        }
+        r
+    }
+
+    /// The file type picked comes back with the path as typed, and its first extension follows
+    /// the path in the answer.
+    #[test]
+    fn the_answer_carries_the_file_type_picked() {
+        let request = request();
+        let saved = answer(0, &results("file:///home/me/Art/poster", Some("PDF-compatible .ai"))).unwrap();
+        assert_eq!(saved, Some(Saved { path: "/home/me/Art/poster".into(), filter: Some("PDF-compatible .ai".into()) }));
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster", "ai"]);
+        // A portal that names no file type, or one the dialog did not offer: the path alone.
+        let saved = answer(0, &results("file:///home/me/Art/poster.svg", None)).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster.svg"]);
+        let saved = answer(0, &results("file:///home/me/Art/poster", Some("PNG"))).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster"]);
+    }
+
+    /// Cancel (1) and a dialog closed another way (2) answer no file; an answer without a local file
+    /// is an error, and rfd shows the dialog instead.
+    #[test]
+    fn a_canceled_dialog_answers_no_file() {
+        let request = request();
+        for code in [1, 2] {
+            assert_eq!(answer(code, &HashMap::new()), Ok(None));
+            assert!(pick_answer(None, &request).is_empty());
+        }
+        assert!(answer(0, &HashMap::new()).is_err());
+        assert!(answer(0, &results("sftp://host/poster.svg", Some("SVG"))).is_err());
+    }
+
+    #[test]
+    fn file_uris_become_local_paths() {
+        assert_eq!(file_uri_path("file:///home/me/Untitled-1.vectorcraft").as_deref(), Some("/home/me/Untitled-1.vectorcraft"));
+        assert_eq!(file_uri_path("file:///home/me/A%20b%C3%A9.svg").as_deref(), Some("/home/me/A bé.svg"));
+        assert_eq!(file_uri_path("file://localhost/tmp/x.pdf").as_deref(), Some("/tmp/x.pdf"));
+        // A `%` without two hex digits after it stays as it is.
+        assert_eq!(file_uri_path("file:///tmp/100%+1%2").as_deref(), Some("/tmp/100%+1%2"));
+        assert_eq!(file_uri_path("file://host/x.svg"), None);
+        assert_eq!(file_uri_path("sftp://host/x.svg"), None);
+    }
+
+    #[test]
+    fn x11_windows_are_named_by_their_id() {
+        assert_eq!(x11_parent(0x3a0000f), "x11:3a0000f");
+    }
+
+    /// What the mock portal answers to each `SaveFile` call: the response code, and the file and
+    /// the label of the file type "picked".
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    type Script = Vec<(u32, Option<(&'static str, &'static str)>)>;
+
+    /// What each `SaveFile` call carried: `current_name` and the label of `current_filter`.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    type Seen = std::sync::Arc<std::sync::Mutex<Vec<(Option<String>, Option<String>)>>>;
+
+    /// A session bus of its own (`dbus-daemon`) with a mock `org.freedesktop.portal.FileChooser`
+    /// that answers `SaveFile` from `script`, as PhotoCraft's portal tests run it. With `own_paths`
+    /// it is a portal older than 0.9, which answers on a request path of its own. `None` when there
+    /// is no `dbus-daemon` to run.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    fn mock_portal(script: Script, own_paths: bool) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+        use std::io::BufRead as _;
+
+        use zbus::zvariant::OwnedObjectPath;
+        let mut daemon = std::process::Command::new("dbus-daemon")
+            .args(["--session", "--nofork", "--print-address=1"])
+            .stdout(std::process::Stdio::piped())
+            .spawn()
+            .ok()?;
+        let mut address = String::new();
+        std::io::BufReader::new(daemon.stdout.take()?).read_line(&mut address).ok()?;
+        let address = address.trim().to_string();
+        let server =
+            zbus::blocking::connection::Builder::address(address.as_str()).ok()?.name("org.freedesktop.portal.Desktop").ok()?.build().ok()?;
+        let seen = Seen::default();
+        let log = seen.clone();
+        std::thread::spawn(move || {
+            let mut script = script.into_iter();
+            for msg in zbus::blocking::MessageIterator::from(&server) {
+                let Ok(msg) = msg else { break };
+                let header = msg.header();
+                if header.message_type() != zbus::message::Type::MethodCall || header.member().map(|m| m.as_str()) != Some("SaveFile") {
+                    continue;
+                }
+                let Ok((_parent, _title, options)) = msg.body().deserialize::<(String, String, HashMap<String, OwnedValue>)>() else { break };
+                let text = |key: &str| options.get(key).and_then(|v| String::try_from(v.try_clone().ok()?).ok());
+                let filter = options.get("current_filter").and_then(|v| {
+                    let (label, _): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+                    Some(label)
+                });
+                let calls = log.lock().map(|mut l| {
+                    l.push((text("current_name"), filter));
+                    l.len()
+                });
+                let Some(sender) = header.sender().map(|s| s.as_str().trim_start_matches(':').replace('.', "_")) else { break };
+                let token = if own_paths { format!("old{}", calls.unwrap_or_default()) } else { text("handle_token").unwrap_or_default() };
+                let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+                let Ok(handle) = OwnedObjectPath::try_from(path.as_str()) else { break };
+                if server.reply(&header, &handle).is_err() {
+                    break;
+                }
+                if own_paths {
+                    // As a person answers the dialog: after the caller listened on the path returned.
+                    std::thread::sleep(std::time::Duration::from_millis(300));
+                }
+                let (code, pick) = script.next().unwrap_or((2, None));
+                let mut results: HashMap<&str, Value<'_>> = HashMap::new();
+                if let Some((uri, label)) = pick {
+                    results.insert("uris", Value::from(vec![uri.to_string()]));
+                    results.insert("current_filter", Value::from((label.to_string(), vec![(0u32, "*.x".to_string())])));
+                }
+                let to = header.sender().cloned().map(zbus::names::BusName::from);
+                if server.emit_signal(to, path.as_str(), "org.freedesktop.portal.Request", "Response", &(code, results)).is_err() {
+                    break;
+                }
+            }
+        });
+        let client = zbus::blocking::connection::Builder::address(address.as_str()).ok()?.build().ok()?;
+        Some((client, seen, daemon))
+    }
+
+    /// Through a real D-Bus: the call starts the dialog on the first file type with the suggested
+    /// name, and the answer names the file and the type picked; Cancel answers no file.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    #[test]
+    fn the_portal_is_asked_on_the_first_file_type_and_answers_the_one_picked() {
+        let script = vec![(0, Some(("file:///home/me/Art/poster", "PDF-compatible .ai"))), (1, None)];
+        let Some((conn, seen, mut daemon)) = mock_portal(script, false) else {
+            eprintln!("no dbus-daemon: skipped");
+            return;
+        };
+        let request = request();
+        let saved = save_file(&conn, &request).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster", "ai"]);
+        assert_eq!(save_file(&conn, &request), Ok(None));
+        let seen = seen.lock().map(|s| s.clone()).unwrap_or_default();
+        assert_eq!(seen.first(), Some(&(Some("Untitled-1.vectorcraft".to_string()), Some(request.filters[0].0.clone()))));
+        let _ = daemon.kill();
+    }
+
+    /// A portal older than 0.9 answers on the request path it returns, and the answer is awaited
+    /// there.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    #[test]
+    fn the_answer_is_awaited_on_the_path_the_portal_returns() {
+        let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some(("file:///tmp/card", "SVG")))], true) else {
+            eprintln!("no dbus-daemon: skipped");
+            return;
+        };
+        let request = request();
+        assert_eq!(pick_answer(save_file(&conn, &request).unwrap(), &request), ["/tmp/card", "svg"]);
+        let _ = daemon.kill();
+    }
+
+    /// The labels go to the dialog in the interface's language, which is how the answer is matched.
+    #[test]
+    fn the_file_types_are_labeled_as_the_other_dialogs_label_them() {
+        let request = request();
+        let labels: Vec<&str> = request.filters.iter().map(|(l, _)| l.as_str()).collect();
+        let lang = vectorcraft_ui_egui::i18n::current();
+        let expected: Vec<&str> =
+            ["VectorCraft", "SVG", "PDF-compatible .ai"].iter().map(|l| vectorcraft_ui_egui::i18n::tr_ctx(lang, "file-filter", l)).collect();
+        assert_eq!(labels, expected);
+        assert_eq!(request.parent, "x11:3a0000f");
+    }
+}

apps/vectorcraft/src/prefs_dir.rs

@@ -24,6 +24,39 @@ pub fn install_fonts() {
     }
 }
 
+/// The folder `name` next to the settings, for what the user keeps: none in a run without
+/// preferences (`VECTORCRAFT_NO_PREFS`), which keeps nothing.
+fn store_dir(name: &str) -> Option<PathBuf> {
+    if std::env::var_os("VECTORCRAFT_NO_PREFS").is_some() {
+        return None;
+    }
+    Some(prefs_path_for("VectorCraft", "vectorcraft")?.parent()?.join(name))
+}
+
+/// Register the ICC profiles `color.loadProfile` kept in the `Color Profiles` folder (#2174), and
+/// keep the ones loaded from now on there. Before anything names a profile.
+pub fn attach_profile_store(session: &mut vectorcraft_engine::Session) {
+    if let Some(dir) = store_dir("Color Profiles") {
+        session.attach_profile_store(dir);
+    }
+}
+
+/// Install the plug-ins Install Plug-in kept in the `Plug-ins` folder (#2541), and keep the ones
+/// installed from now on there.
+pub fn attach_plugin_store(session: &mut vectorcraft_engine::Session) {
+    if let Some(dir) = store_dir("Plug-ins") {
+        session.attach_plugin_store(dir);
+    }
+}
+
+/// Take the saved PDF presets from the `PDF Presets` folder (#2168), and keep the ones saved from
+/// now on there. After the preferences were restored: the folder is the one place the presets live.
+pub fn attach_pdf_preset_store(session: &mut vectorcraft_engine::Session) {
+    if let Some(dir) = store_dir("PDF Presets") {
+        session.attach_pdf_preset_store(dir);
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

apps/vectorcraft/src/printing.rs

@@ -43,11 +43,32 @@ mod system {
         let settings = craft_print::Job { printer: job.printer.map(str::to_string), title: job.title.into(), ..Default::default() };
         craft_print::submit(job.pdf, &settings).map(|note| if note.is_empty() { note } else { format!(" ({note})") }).map_err(|e| e.to_string())
     }
+    #[cfg(windows)]
+    pub(crate) fn setup_command(printer: Option<&str>, default_printer: Option<&str>) -> Command {
+        let target = printer.map(str::trim).filter(|p| !p.is_empty()).or_else(|| default_printer.map(str::trim).filter(|p| !p.is_empty()));
+        if let Some(name) = target {
+            let mut cmd = Command::new("rundll32.exe");
+            cmd.args(["printui.dll,PrintUIEntry", "/e", "/n", name]);
+            cmd
+        } else {
+            let mut cmd = Command::new("explorer");
+            cmd.arg("ms-settings:printers");
+            cmd
+        }
+    }
     pub fn setup(printer: Option<&str>) -> Result<(), String> {
         #[cfg(windows)]
         {
-            let _ = printer;
-            Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string())
+            let list = printers();
+            let default = list.iter().find(|p| p.default).or_else(|| list.first()).map(|p| p.name.as_str());
+            // Only an installed printer's own name reaches the command line: `printer` can come
+            // from a command or MCP, and PrintUIEntry reads options from its arguments.
+            let printer = printer.map(str::trim).filter(|p| list.iter().any(|q| q.name == *p));
+            let mut cmd = setup_command(printer, default);
+            match cmd.spawn() {
+                Ok(_) => Ok(()),
+                Err(_) => Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string()),
+            }
         }
         #[cfg(target_os = "macos")]
         {
@@ -68,3 +89,41 @@ mod system {
         }
     }
 }
+
+#[cfg(all(test, windows, not(any(feature = "windows7", target_vendor = "win7"))))]
+mod tests {
+    use super::system::setup_command;
+    use std::ffi::OsStr;
+
+    #[test]
+    fn setup_command_uses_printui_for_specified_printer() {
+        let cmd = setup_command(Some("Office Laser"), None);
+        assert_eq!(cmd.get_program(), "rundll32.exe");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["printui.dll,PrintUIEntry", "/e", "/n", "Office Laser"]);
+    }
+
+    #[test]
+    fn setup_command_falls_back_to_default_printer() {
+        let cmd = setup_command(None, Some("Default Proofer"));
+        assert_eq!(cmd.get_program(), "rundll32.exe");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["printui.dll,PrintUIEntry", "/e", "/n", "Default Proofer"]);
+    }
+
+    #[test]
+    fn setup_command_trims_whitespace_and_skips_empty() {
+        let cmd = setup_command(Some("  "), Some("Default Proofer"));
+        assert_eq!(cmd.get_program(), "rundll32.exe");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["printui.dll,PrintUIEntry", "/e", "/n", "Default Proofer"]);
+    }
+
+    #[test]
+    fn setup_command_falls_back_to_settings_when_no_printer() {
+        let cmd = setup_command(None, None);
+        assert_eq!(cmd.get_program(), "explorer");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["ms-settings:printers"]);
+    }
+}

apps/vectorcraft/src/xwayland.rs

@@ -1,11 +1,15 @@
 //! Linux: Preferences › Performance › Linux Display Server › X11 opens the window through XWayland
 //! on a Wayland session, where dropped files arrive (winit 0.30 has no Wayland drag and drop,
-//! #1151). Only when XWayland can run the window: an X display is set and the X11 libraries winit
-//! loads at runtime are installed. Otherwise the window opens on Wayland, so a missing library
-//! never keeps the app from starting.
+//! #1151). X11 (XWayland) When a Pen Is Attached does so only when a pen is attached as the app
+//! starts: winit 0.30 doesn't bind the Wayland tablet protocol, and XWayland hands the pen to X11
+//! windows as a pointer (#2028). Only when XWayland can run the window: an X display is set and
+//! the X11 libraries winit loads at runtime are installed. Otherwise the window opens on Wayland,
+//! so a missing library never keeps the app from starting.
 //!
 //! The library check comes from PhotoCraft's `linux_libs.rs`: no `dlopen` (that needs `unsafe`),
-//! just the dynamic linker's cache (`ldconfig -p`) and the usual library directories.
+//! just the dynamic linker's cache (`ldconfig -p`) and the usual library directories. The pen
+//! check comes from PhotoCraft's `tablet.rs`: the input devices the kernel lists in
+//! `/proc/bus/input/devices`.
 #![cfg_attr(not(target_os = "linux"), allow(dead_code))]
 
 use std::ffi::OsString;
@@ -16,12 +20,50 @@ use std::path::{Path, PathBuf};
 const X11_LIBS: &[&str] =
     &["libX11.so.6", "libX11-xcb.so.1", "libxcb.so.1", "libXcursor.so.1", "libXi.so.6", "libxkbcommon.so.0", "libxkbcommon-x11.so.0"];
 
-/// Whether the saved `linuxDisplayServer` and the environment ask for XWayland: `x11` chosen, a
-/// Wayland session (winit picks Wayland whenever `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set)
-/// and an X display to open.
-pub fn wanted(pref: Option<&str>, var: impl Fn(&str) -> Option<OsString>) -> bool {
+/// Whether the saved `linuxDisplayServer` and the environment ask for XWayland: `x11` chosen, or
+/// `x11WithPen` chosen and `pen` finding a pen; a Wayland session (winit picks Wayland whenever
+/// `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set); and an X display to open. `pen` runs only for
+/// `x11WithPen`, after the session checks.
+pub fn wanted(pref: Option<&str>, var: impl Fn(&str) -> Option<OsString>, pen: impl FnOnce() -> bool) -> bool {
     let set = |name: &str| var(name).is_some_and(|v| !v.is_empty());
-    pref == Some("x11") && (set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET")) && set("DISPLAY")
+    let session = (set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET")) && set("DISPLAY");
+    match pref {
+        Some("x11") => session,
+        Some("x11WithPen") => session && pen(),
+        _ => false,
+    }
+}
+
+/// `BTN_TOOL_PEN` (linux/input-event-codes.h): the key that a pen tablet's stylus, a pen display's
+/// pen or a pen-enabled touchscreen's pen reports.
+const BTN_TOOL_PEN: u32 = 0x140;
+/// `ABS_X` and `ABS_Y` (linux/input-event-codes.h): the absolute axes every pen reports.
+const ABS_X: u32 = 0x00;
+const ABS_Y: u32 = 0x01;
+
+/// Is a pen attached? Reads `/proc/bus/input/devices`; a file that can't be read has no pen.
+pub fn pen_attached() -> bool {
+    std::fs::read_to_string("/proc/bus/input/devices").is_ok_and(|devices| has_pen(&devices))
+}
+
+/// Is a pen among the input devices `/proc/bus/input/devices` lists? A pen is a device whose
+/// `B: KEY=` bitmap has `BTN_TOOL_PEN` and whose `B: ABS=` bitmap has `ABS_X` and `ABS_Y`, as
+/// libinput asks of a tablet tool. A virtual keyboard made with uinput can claim every key code,
+/// `BTN_TOOL_PEN` included, but has no absolute axes.
+fn has_pen(devices: &str) -> bool {
+    devices.split("\n\n").any(|device| {
+        let bitmap = |name: &str| device.lines().find_map(|l| l.strip_prefix(name));
+        bitmap("B: KEY=").is_some_and(|keys| bit_set(keys, BTN_TOOL_PEN))
+            && bitmap("B: ABS=").is_some_and(|axes| bit_set(axes, ABS_X) && bit_set(axes, ABS_Y))
+    })
+}
+
+/// Bit `bit` of a `/proc/bus/input/devices` bitmap: hex words of the kernel's `long`, most
+/// significant first. Short or malformed bitmaps have no bits set.
+fn bit_set(bitmap: &str, bit: u32) -> bool {
+    let bits = usize::BITS;
+    let word = usize::try_from(bit / bits).unwrap_or(usize::MAX);
+    bitmap.split_whitespace().rev().nth(word).and_then(|w| u64::from_str_radix(w, 16).ok()).is_some_and(|w| (w >> (bit % bits)) & 1 == 1)
 }
 
 /// Are all the libraries an X11 window needs found on this system? Libraries the check can't find
@@ -98,18 +140,88 @@ mod tests {
         move |k| pairs.iter().find(|(name, _)| *name == k).map(|(_, v)| OsString::from(v))
     }
 
+    fn no_probe() -> bool {
+        panic!("the pen check ran")
+    }
+
     #[test]
     fn xwayland_only_when_chosen_on_wayland_with_an_x_display() {
         let wayland = env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", ":0")]);
-        assert!(wanted(Some("x11"), &wayland));
-        assert!(wanted(Some("x11"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")])));
-        assert!(!wanted(Some("automatic"), &wayland));
-        assert!(!wanted(None, &wayland));
-        assert!(!wanted(Some("wayland"), &wayland));
+        assert!(wanted(Some("x11"), &wayland, no_probe));
+        assert!(wanted(Some("x11"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")]), no_probe));
+        assert!(!wanted(Some("automatic"), &wayland, no_probe));
+        assert!(!wanted(None, &wayland, no_probe));
+        assert!(!wanted(Some("wayland"), &wayland, no_probe));
         // An X11 session already opens on X11; without an X display there is no XWayland to use.
-        assert!(!wanted(Some("x11"), env(&[("DISPLAY", ":0")])));
-        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")])));
-        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0")])));
+        assert!(!wanted(Some("x11"), env(&[("DISPLAY", ":0")]), no_probe));
+        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")]), no_probe));
+        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0")]), no_probe));
+    }
+
+    /// X11 (XWayland) When a Pen Is Attached (#2028): XWayland on a Wayland session with an X
+    /// display when a pen is found, the session's own display server otherwise. The pen check
+    /// runs only on such a session.
+    #[test]
+    fn the_pen_choice_opens_xwayland_only_with_a_pen() {
+        let wayland = env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", ":0")]);
+        assert!(wanted(Some("x11WithPen"), &wayland, || true));
+        assert!(wanted(Some("x11WithPen"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")]), || true));
+        assert!(!wanted(Some("x11WithPen"), &wayland, || false));
+        assert!(!wanted(Some("x11WithPen"), env(&[("DISPLAY", ":0")]), no_probe));
+        assert!(!wanted(Some("x11WithPen"), env(&[("WAYLAND_DISPLAY", "wayland-0")]), no_probe));
+        assert!(!wanted(Some("x11WithPen"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")]), no_probe));
+    }
+
+    /// `/proc/bus/input/devices` of a laptop with a Wacom Intuos Pro attached (64-bit longs: the
+    /// pen's `KEY=1c03 0 0 0 0 0` has bit 0x140, `BTN_TOOL_PEN`), from PhotoCraft's tests.
+    const WITH_PEN: &str = "I: Bus=0011 Vendor=0001 Product=0001 Version=ab83\n\
+        N: Name=\"AT Translated Set 2 keyboard\"\n\
+        H: Handlers=sysrq kbd event3 leds\n\
+        B: KEY=402000000 3803078f800d001 feffffdfffefffff fffffffffffffffe\n\
+        \n\
+        I: Bus=0018 Vendor=06cb Product=ce26 Version=0100\n\
+        N: Name=\"SYNA2B33:00 06CB:CE26 Touchpad\"\n\
+        H: Handlers=mouse1 event7\n\
+        B: KEY=e520 10000 0 0 0 0\n\
+        B: ABS=2e0800000000003\n\
+        \n\
+        I: Bus=0003 Vendor=056a Product=0357 Version=0110\n\
+        N: Name=\"Wacom Intuos Pro M Pen\"\n\
+        H: Handlers=mouse2 event10\n\
+        B: KEY=1c03 0 0 0 0 0\n\
+        B: ABS=1000f000003\n";
+
+    /// A uinput virtual keyboard that claims every key code, `BTN_TOOL_PEN` included, and has no
+    /// absolute axes (`EV=20013`, no `B: ABS=` line), from PhotoCraft's tests.
+    const VIRTUAL_KEYBOARD: &str = "I: Bus=0003 Vendor=1234 Product=5678 Version=0111\n\
+        N: Name=\"Virtual Keyboard\"\n\
+        H: Handlers=sysrq rfkill kbd event256 leds \n\
+        B: EV=20013\n\
+        B: KEY=ffffffffff 0 7ffffff000301ff 1000f7fffffff 7fe001fffff000f 7ffffffffffffff ffffffff0003fdff 7fff8fff00ff03ff 1ffffffffffff07 ffffffffffffffff ffffffffffefffff fffffffffffffffe\n";
+
+    #[test]
+    fn a_pen_is_a_device_with_btn_tool_pen_and_absolute_axes() {
+        assert!(has_pen(WITH_PEN));
+        let without = WITH_PEN.split("\n\n").take(2).collect::<Vec<_>>().join("\n\n");
+        assert!(!has_pen(&without), "a touchpad's BTN_TOOL_FINGER (0x145) is not a pen");
+        // A pen display reports the pen with its own axes.
+        assert!(has_pen("N: Name=\"Wacom One Pen\"\nB: KEY=1c03 0 0 0 0 0\nB: ABS=3\n"));
+        // Axes without ABS_X or ABS_Y, or no axes at all, are no pen.
+        assert!(!has_pen("B: KEY=1c03 0 0 0 0 0\nB: ABS=1000f000002\n"));
+        assert!(!has_pen("B: KEY=1c03 0 0 0 0 0\nB: ABS=1000f000001\n"));
+        let pen_without_axes = WITH_PEN.lines().filter(|l| !l.starts_with("B: ABS=1000f")).collect::<Vec<_>>().join("\n");
+        assert!(!has_pen(&pen_without_axes));
+        // The virtual keyboard claims the key but is no pen, and a real pen beside it is still found.
+        assert!(VIRTUAL_KEYBOARD.lines().find_map(|l| l.strip_prefix("B: KEY=")).is_some_and(|k| bit_set(k, BTN_TOOL_PEN)));
+        assert!(!has_pen(VIRTUAL_KEYBOARD));
+        assert!(has_pen(&format!("{VIRTUAL_KEYBOARD}\n{WITH_PEN}")));
+        // Short or malformed bitmaps are no pen, never a panic.
+        for keys in ["", "B: KEY=", "B: KEY=1", "B: KEY=zz 0 0 0 0 0", "B: KEY=ffffffffffffffffff 0 0 0 0 0", "B: KEY=0 0 0 0 0 0 0 0"] {
+            assert!(!has_pen(&format!("{keys}\nB: ABS=3")), "{keys:?}");
+        }
+        for abs in ["B: ABS=", "B: ABS=zz", "B: ABS=ffffffffffffffffff", "B: ABS=0 0"] {
+            assert!(!has_pen(&format!("B: KEY=1c03 0 0 0 0 0\n{abs}")), "{abs:?}");
+        }
     }
 
     #[test]

contributors/people.toml

@@ -120,3 +120,12 @@ sync_github_name = false
 real_name = "Marco Arnulfo"
 display_name = "Marco Arnulfo"
 sync_github_name = false
+
+[people.theromis]
+sync_github_name = true
+
+[people.dennismutuku2005]
+sync_github_name = true
+
+[people.makesomethingshit]
+sync_github_name = true

crates/color/src/cms/icc.rs

@@ -320,9 +320,14 @@ fn labelled(mut p: ColorProfile, name: &str) -> ColorProfile {
 /// Grid points per input channel of the CMYK → Lab table and of the Lab → CMYK table.
 const A2B_GRID: usize = 9;
 const B2A_GRID: usize = 17;
+/// Grid points per Lab channel of the gamut table.
+const GAMUT_GRID: usize = 9;
 
 /// A CMYK output profile sampled from a conversion: `to_lab` (CMYK → media-relative Lab) in a
 /// 9⁴ table, `from_lab` (Lab → CMYK, gamut-mapped) in a 17³ table, Lab PCS (ICC v4 encoding).
+/// It carries every tag ICC.1 requires of an output profile: the tables for all three intents
+/// and the gamut tag (Windows rejects a CMYK profile without them, so Photos couldn't show a CMYK
+/// TIFF that embedded one, #2707).
 pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, from_lab: impl Fn(lab::Lab) -> [f32; 4]) -> ColorProfile {
     let unit = |i: usize, n: usize| i as f32 / (n - 1) as f32;
     let q = |v: f32| (v.clamp(0.0, 1.0) * 65535.0).round() as u16;
@@ -337,6 +342,13 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
         let [l, a, b] = [2, 1, 0].map(|d| unit(i / B2A_GRID.pow(d) % B2A_GRID, B2A_GRID));
         b2a.extend(from_lab(lab::Lab::new(l * 100.0, a * 255.0 - 128.0, b * 255.0 - 128.0)).map(q));
     }
+    // Gamut: 0 where a colour separates and comes back within a ΔE of 3, else out of gamut.
+    let mut gamut = Vec::with_capacity(GAMUT_GRID.pow(3));
+    for i in 0..GAMUT_GRID.pow(3) {
+        let [l, a, b] = [2, 1, 0].map(|d| unit(i / GAMUT_GRID.pow(d) % GAMUT_GRID, GAMUT_GRID));
+        let want = lab::Lab::new(l * 100.0, a * 255.0 - 128.0, b * 255.0 - 128.0);
+        gamut.push(if lab::delta_e2000(want, to_lab(from_lab(want))) <= 3.0 { 0 } else { u16::MAX });
+    }
     let identity = |n: usize| vec![ToneReprCurve::Parametric(vec![1.0]); n];
     let table = |inputs: usize, outputs: usize, grid: usize, clut: Vec<u16>| {
         let mut grid_points = [0u8; 16];
@@ -346,8 +358,9 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
             num_output_channels: outputs as u8,
             grid_points,
             clut: Some(LutStore::Store16(clut)),
-            // A curves sit on the device side, B curves on the PCS side.
-            a_curves: identity(4),
+            // A curves sit on the device side (the gamut tag's is its one output), B curves on the
+            // PCS side.
+            a_curves: identity(inputs + outputs - 3),
             b_curves: identity(3),
             m_curves: vec![],
             matrix: Matrix3d::IDENTITY,
@@ -356,6 +369,7 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
     };
     let a2b = table(4, 3, A2B_GRID, a2b);
     let b2a = table(3, 4, B2A_GRID, b2a);
+    let gamut = table(3, 1, GAMUT_GRID, gamut);
     let mut p = ColorProfile::default();
     p.profile_class = ProfileClass::OutputDevice;
     p.color_space = DataColorSpace::Cmyk;
@@ -364,9 +378,12 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
     p.white_point = moxcms::WHITE_POINT_D50.to_xyzd();
     p.media_white_point = Some(p.white_point);
     p.lut_a_to_b_perceptual = Some(a2b.clone());
+    p.lut_a_to_b_saturation = Some(a2b.clone());
     p.lut_a_to_b_colorimetric = Some(a2b);
     p.lut_b_to_a_perceptual = Some(b2a.clone());
+    p.lut_b_to_a_saturation = Some(b2a.clone());
     p.lut_b_to_a_colorimetric = Some(b2a);
+    p.gamut = Some(gamut);
     labelled(p, name)
 }
 

crates/color/src/cms/mod.rs

@@ -257,9 +257,25 @@ pub fn register_icc(bytes: &[u8], name: Option<String>) -> Result<ProfileInfo, C
     Ok(info)
 }
 
-/// A number that changes whenever [`register_icc`] registers a profile: conversions through a
-/// profile looked up by name, such as those of a [`ProofTarget::Cmyk`] proof, give the same colors
-/// as long as the number stays the same.
+/// Forget a profile [`register_icc`] registered (by its name); `false` when there is none of that
+/// name (the built-in profiles can't be removed). Settings that name it no longer resolve, so a
+/// caller checks [`active_settings`] first.
+pub fn unregister_icc(name: &str) -> bool {
+    let mut u = USER.write().unwrap_or_else(|e| e.into_inner());
+    let before = u.len();
+    u.retain(|x| x.name != name);
+    let removed = u.len() != before;
+    drop(u);
+    if removed {
+        clear_proof_cache();
+        PROFILES_GENERATION.fetch_add(1, Ordering::Relaxed);
+    }
+    removed
+}
+
+/// A number that changes whenever [`register_icc`] registers a profile or [`unregister_icc`]
+/// removes one: conversions through a profile looked up by name, such as those of a
+/// [`ProofTarget::Cmyk`] proof, give the same colors as long as the number stays the same.
 pub fn profiles_generation() -> u64 {
     PROFILES_GENERATION.load(Ordering::Relaxed)
 }

crates/color/src/cms/tests_icc.rs

@@ -135,3 +135,20 @@ fn written_profiles_align_their_tags() {
         }
     }
 }
+
+/// #2707: the CMYK profiles written here carry every tag ICC.1 requires of an output profile (the
+/// tables of all three intents and the gamut tag): Windows rejects one without them, and Photos
+/// then can't show a CMYK TIFF that embeds it.
+#[test]
+fn cmyk_profiles_have_the_tags_of_an_output_profile() {
+    for name in BUILTIN_CMYK {
+        let icc = icc_bytes(name).unwrap();
+        let be = |at: usize| u32::from_be_bytes([icc[at], icc[at + 1], icc[at + 2], icc[at + 3]]) as usize;
+        let tags: Vec<&[u8]> = (0..be(128)).map(|i| &icc[132 + 12 * i..136 + 12 * i]).collect();
+        for want in [b"desc", b"cprt", b"wtpt", b"A2B0", b"A2B1", b"A2B2", b"B2A0", b"B2A1", b"B2A2", b"gamt"] {
+            assert!(tags.contains(&&want[..]), "{name}: no {}", String::from_utf8_lossy(want));
+        }
+        let p = parse(&icc);
+        assert!(p.lut_a_to_b_saturation.is_some() && p.lut_b_to_a_saturation.is_some() && p.gamut.is_some(), "{name}");
+    }
+}

crates/color/src/freeform.rs

@@ -11,6 +11,7 @@
 use kurbo::{Affine, BezPath, CubicBez, ParamCurve, ParamCurveNearest, Point, Rect};
 use serde::{Deserialize, Serialize};
 
+use crate::cms::{self, Model};
 use crate::{Color, Gradient, GradientStop};
 
 /// The spread a new point gets.
@@ -157,11 +158,12 @@ impl Freeform {
         f
     }
 
-    /// Colour the points along `g`, first to last.
+    /// Color the points along `g`, first to last, mixing neighboring stops in the model they share
+    /// ([`Color::lerp_keep_model`]).
     pub fn recolor(&mut self, g: &Gradient) {
         let n = self.points.len();
         for (k, p) in self.points.iter_mut().enumerate() {
-            (p.color, p.opacity) = g.sample(k as f32 / (n - 1).max(1) as f32);
+            (p.color, p.opacity) = g.sample_with(k as f32 / (n - 1).max(1) as f32, Color::lerp_keep_model);
         }
     }
 
@@ -230,10 +232,10 @@ impl Freeform {
         best
     }
 
-    /// The colour and opacity at `p` for a painted box whose [`spread_scale`] is `scale`.
+    /// The color and opacity at `p` for a painted box whose [`spread_scale`] is `scale`, as
+    /// [`Self::model_field`] mixes them.
     pub fn sample(&self, p: Point, scale: f64) -> (Color, f32) {
-        let ([r, g, b], a) = self.field(scale).sample(p);
-        (Color::rgb(r, g, b), a)
+        self.model_field(scale).sample(p)
     }
 
     /// The colour field, with colours converted and lines tessellated once (for sampling many
@@ -265,6 +267,32 @@ impl Freeform {
         Field { points, pieces, eps: 1e-9 * (scale.abs() + 1.0) }
     }
 
+    /// [`Self::field`] mixing the colors in the model every point shares instead of display RGB:
+    /// the C, M, Y and K inks (as a CMYK document drawn by ink planes mixes them), the Gray ink,
+    /// or the RGB or Lab components. Points in different models mix in display RGB, as
+    /// [`Self::field`] mixes them, and the field gives that color in the working RGB space.
+    pub fn model_field(&self, scale: f64) -> ModelField {
+        let Some(model) = self.shared_model() else { return ModelField { model: None, first: self.field(scale), k: None } };
+        let parts = |c: &Color| match *c {
+            Color::Rgb { r, g, b } => [r, g, b, 0.0],
+            Color::Cmyk { c, m, y, k } => [c, m, y, k],
+            Color::Gray { k } => [k, 0.0, 0.0, 0.0],
+            Color::Lab { l, a, b } => [l, a, b, 0.0],
+        };
+        let first = self.field_with(scale, &|c| {
+            let [x, y, z, _] = parts(c);
+            [x, y, z]
+        });
+        let k = (model == Model::Cmyk).then(|| self.field_with(scale, &|c| [parts(c)[3], 0.0, 0.0]));
+        ModelField { model: Some(model), first, k }
+    }
+
+    /// The color model every point is in (`None` without points or when their models differ).
+    pub fn shared_model(&self) -> Option<Model> {
+        let m = self.points.first()?.color.model();
+        self.points.iter().all(|p| p.color.model() == m).then_some(m)
+    }
+
     /// Add a point; returns its index.
     pub fn add_point(&mut self, p: FreeformPoint) -> usize {
         self.points.push(p);
@@ -324,8 +352,9 @@ impl Freeform {
         true
     }
 
-    /// Insert a point on segment `segment` of line `line` at curve parameter `t`, with the colour,
-    /// opacity and spread between the segment's ends. Returns the new point's index.
+    /// Insert a point on segment `segment` of line `line` at curve parameter `t`, with the color
+    /// (in the model the ends share, [`Color::lerp_keep_model`]), opacity and spread between the
+    /// segment's ends. Returns the new point's index.
     pub fn split_line(&mut self, line: usize, segment: usize, t: f64) -> Option<usize> {
         let c = *self.segments(line).get(segment)?;
         let l = &self.lines[line];
@@ -334,7 +363,7 @@ impl Freeform {
         let u = t as f32;
         let p = FreeformPoint {
             at: c.eval(t),
-            color: a.color.lerp(&b.color, u),
+            color: a.color.lerp_keep_model(&b.color, u),
             opacity: a.opacity + (b.opacity - a.opacity) * u,
             spread: a.spread + (b.spread - a.spread) * u,
         };
@@ -440,6 +469,41 @@ impl Field {
     }
 }
 
+/// A freeform gradient ready to sample in its points' color model ([`Freeform::model_field`]).
+#[derive(Clone, Debug)]
+pub struct ModelField {
+    /// The model the points share (`None` when their models differ).
+    model: Option<Model>,
+    /// The first three components (C, M and Y; R, G and B; L, a and b; display RGB when the
+    /// models differ), or the Gray ink as the first of the three values.
+    first: Field,
+    /// The K ink of a CMYK field.
+    k: Option<Field>,
+}
+
+impl ModelField {
+    /// The model the points share (`None` when their models differ).
+    pub fn model(&self) -> Option<Model> {
+        self.model
+    }
+
+    /// The color and opacity at `p`: in the points' shared model, else in the working RGB space.
+    pub fn sample(&self, p: Point) -> (Color, f32) {
+        let ([x, y, z], a) = self.first.sample(p);
+        let c = match self.model {
+            None => {
+                let [r, g, b] = cms::active().srgb_to_rgb([x, y, z]);
+                Color::rgb(r, g, b)
+            }
+            Some(Model::Rgb) => Color::rgb(x, y, z),
+            Some(Model::Cmyk) => Color::cmyk(x, y, z, self.k.as_ref().map_or(0.0, |k| k.sample(p).0[0])),
+            Some(Model::Gray) => Color::gray(x),
+            Some(Model::Lab) => Color::lab(x, y, z),
+        };
+        (c, a)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -477,6 +541,31 @@ mod tests {
         assert!(close(c.to_rgb(), [0.5, 0.0, 0.5]) && (o - 0.75).abs() < 1e-6, "{c:?}");
     }
 
+    #[test]
+    fn the_sample_mixes_in_the_model_the_points_share() {
+        let halfway = |a: Color, b: Color| {
+            let mut f = two(0.0);
+            (f.points[0].color, f.points[1].color) = (a, b);
+            f.sample(Point::new(50.0, 0.0), 50.0).0
+        };
+        let near = |a: Color, b: Color| match (a, b) {
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => {
+                [c - c2, m - m2, y - y2, k - k2].iter().all(|d| d.abs() < 1e-5)
+            }
+            (Color::Gray { k }, Color::Gray { k: k2 }) => (k - k2).abs() < 1e-5,
+            (Color::Lab { l, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => [l - l2, a - a2, b - b2].iter().all(|d| d.abs() < 1e-4),
+            _ => false,
+        };
+        let c = halfway(Color::cmyk(1.0, 0.0, 0.0, 0.0), Color::cmyk(0.0, 0.0, 0.0, 1.0));
+        assert!(near(c, Color::cmyk(0.5, 0.0, 0.0, 0.5)), "{c:?}");
+        let c = halfway(Color::gray(0.2), Color::gray(0.6));
+        assert!(near(c, Color::gray(0.4)), "{c:?}");
+        let c = halfway(Color::lab(50.0, 10.0, -20.0), Color::lab(70.0, 30.0, 0.0));
+        assert!(near(c, Color::lab(60.0, 20.0, -10.0)), "{c:?}");
+        // Points in different models mix in RGB.
+        assert!(matches!(halfway(Color::cmyk(1.0, 0.0, 0.0, 0.0), red()), Color::Rgb { .. }));
+    }
+
     #[test]
     fn spread_keeps_the_colour_pure_inside_and_falls_off_outside() {
         // Scale 100: a 0.2 spread is a 20 pt disc.

crates/color/src/lib.rs

@@ -241,6 +241,17 @@ impl Color {
         let b = other.to_rgb();
         Color::rgb(a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, a[2] + (b[2] - a[2]) * t)
     }
+    /// Linear interpolation in the model both colors share when it is CMYK, Gray or Lab, else in
+    /// display RGB ([`Color::lerp`]).
+    pub fn lerp_keep_model(&self, other: &Color, t: f32) -> Color {
+        let l = |x: f32, y: f32| x + (y - x) * t;
+        match (*self, *other) {
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => Color::cmyk(l(c, c2), l(m, m2), l(y, y2), l(k, k2)),
+            (Color::Gray { k }, Color::Gray { k: k2 }) => Color::gray(l(k, k2)),
+            (Color::Lab { l: l1, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => Color::lab(l(l1, l2), l(a, a2), l(b, b2)),
+            _ => self.lerp(other, t),
+        }
+    }
     /// The colour model this colour is authored in.
     pub fn model(&self) -> cms::Model {
         match self {
@@ -387,7 +398,9 @@ impl Paint {
     }
     /// Apply `f` to the colours of this paint that can link to a swatch (a solid colour, each
     /// gradient stop) with their link and tint; `f` returns true when it changed them. A colour
-    /// left without a link gets tint 1. Returns whether anything changed.
+    /// left without a link gets tint 1. A freeform gradient's points, which it draws from, go
+    /// through `f` too, as unlinked colours (a link `f` gives them is dropped). Returns whether
+    /// anything changed.
     pub fn map_links(&mut self, f: &mut dyn FnMut(&mut Color, &mut Option<String>, &mut f32) -> bool) -> bool {
         let mut one = |c: &mut Color, link: &mut Option<String>, tint: &mut f32| {
             let changed = f(c, link, tint);
@@ -398,7 +411,12 @@ impl Paint {
         };
         match self {
             Paint::Solid { color, swatch, tint } => one(color, swatch, tint),
-            Paint::Gradient(g) => g.gradient.stops.iter_mut().fold(false, |ch, s| one(&mut s.color, &mut s.swatch, &mut s.tint) | ch),
+            Paint::Gradient(g) => {
+                let stops = g.gradient.stops.iter_mut().fold(false, |ch, s| one(&mut s.color, &mut s.swatch, &mut s.tint) | ch);
+                let points =
+                    g.freeform.iter_mut().flat_map(|ff| ff.points.iter_mut()).fold(false, |ch, p| one(&mut p.color, &mut None, &mut 1.0) | ch);
+                stops | points
+            }
             _ => false,
         }
     }

crates/doc/Cargo.toml

@@ -14,6 +14,8 @@ vectorcraft-color = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
 tiff = { workspace = true }
+# 1-bit TIFFs compressed with CCITT Group 3 (Compression 2 and 3).
+hayro-ccitt = { workspace = true }
 zune-jpeg = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/doc/src/blend.rs

@@ -33,13 +33,7 @@ use crate::text::TextObject;
 
 /// Interpolate two colours in their shared model (display RGB when the models differ).
 pub fn lerp_color(a: &Color, b: &Color, t: f32) -> Color {
-    let l = |x: f32, y: f32| x + (y - x) * t;
-    match (*a, *b) {
-        (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => Color::cmyk(l(c, c2), l(m, m2), l(y, y2), l(k, k2)),
-        (Color::Gray { k }, Color::Gray { k: k2 }) => Color::gray(l(k, k2)),
-        (Color::Lab { l: l1, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => Color::lab(l(l1, l2), l(a, a2), l(b, b2)),
-        _ => a.lerp(b, t),
-    }
+    a.lerp_keep_model(b, t)
 }
 
 fn lerp_f32(x: f32, y: f32, t: f32) -> f32 {

crates/doc/src/cancel.rs

@@ -0,0 +1,142 @@
+//! Cooperative cancellation and progress for long-running work (exports, flattening, baking).
+//!
+//! A host that wants to be able to stop a call (the MCP server, on `notifications/cancelled`)
+//! runs it inside [`scope`] with a [`CancelToken`]. Code deep below, which has no handle on the
+//! host, calls [`check`] (or [`is_cancelled`] where it can't return an error) at points where
+//! stopping is safe, and returns [`Cancelled`] up through the same `Result`s it already has. The
+//! token is tied to the thread that entered the scope, so concurrent sessions on other threads
+//! (and tests running in parallel) never see each other's cancellation, and code outside any
+//! scope is never cancelled.
+//!
+//! Work that stops early leaves nothing behind: callers drop whatever was half built and report
+//! the error, so a cancelled command changes nothing.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+/// A flag one thread raises and another polls. Cloning shares the flag.
+#[derive(Clone, Debug, Default)]
+pub struct CancelToken(Arc<AtomicBool>);
+
+impl CancelToken {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Ask for the work holding this token to stop.
+    pub fn cancel(&self) {
+        self.0.store(true, Ordering::Relaxed);
+    }
+
+    pub fn is_cancelled(&self) -> bool {
+        self.0.load(Ordering::Relaxed)
+    }
+}
+
+/// The error of work that stopped because it was cancelled.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Cancelled;
+
+impl std::fmt::Display for Cancelled {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("cancelled")
+    }
+}
+
+impl std::error::Error for Cancelled {}
+
+/// Receives progress: `(done, total, what is being done)`. `total` is 0 when it isn't known.
+pub type ProgressSink = Rc<dyn Fn(u64, u64, &str)>;
+
+struct Scope {
+    token: CancelToken,
+    sink: Option<ProgressSink>,
+}
+
+thread_local! {
+    static CURRENT: RefCell<Option<Scope>> = const { RefCell::new(None) };
+}
+
+/// Puts the previous scope back, also when the work inside unwinds.
+struct Restore(Option<Scope>);
+
+impl Drop for Restore {
+    fn drop(&mut self) {
+        let previous = self.0.take();
+        // `try_with`: during thread teardown the slot may be gone; nothing to restore then.
+        let _ = CURRENT.try_with(|c| *c.borrow_mut() = previous);
+    }
+}
+
+/// Run `f` with `token` (and an optional progress `sink`) in effect on this thread.
+pub fn scope<T>(token: &CancelToken, sink: Option<ProgressSink>, f: impl FnOnce() -> T) -> T {
+    let previous = CURRENT.with(|c| c.borrow_mut().replace(Scope { token: token.clone(), sink }));
+    let _restore = Restore(previous);
+    f()
+}
+
+/// Has the work running on this thread been cancelled? Always false outside a [`scope`].
+pub fn is_cancelled() -> bool {
+    CURRENT.with(|c| c.borrow().as_ref().is_some_and(|s| s.token.is_cancelled()))
+}
+
+/// Is this thread running inside a [`scope`], so that a cancel can reach it?
+pub fn is_cancellable() -> bool {
+    CURRENT.with(|c| c.borrow().is_some())
+}
+
+/// `Err(Cancelled)` when the work running on this thread has been cancelled.
+pub fn check() -> Result<(), Cancelled> {
+    if is_cancelled() { Err(Cancelled) } else { Ok(()) }
+}
+
+/// Report that `done` of `total` steps (0: unknown) are finished. A no-op outside a [`scope`]
+/// that has a sink.
+pub fn progress(done: u64, total: u64, what: &str) {
+    // The sink runs outside the borrow, so it may itself call back into this module.
+    let sink = CURRENT.with(|c| c.borrow().as_ref().and_then(|s| s.sink.clone()));
+    if let Some(sink) = sink {
+        sink(done, total, what);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_work_inside_the_scope_is_cancelled() {
+        let t = CancelToken::new();
+        assert_eq!(check(), Ok(()));
+        scope(&t, None, || {
+            assert_eq!(check(), Ok(()));
+            t.cancel();
+            assert_eq!(check(), Err(Cancelled));
+            // A nested scope with its own token shadows, then restores.
+            scope(&CancelToken::new(), None, || assert_eq!(check(), Ok(())));
+            assert!(is_cancelled());
+        });
+        assert!(!is_cancelled(), "the scope ended");
+    }
+
+    #[test]
+    fn progress_reaches_the_sink_and_the_scope_survives_a_panic() {
+        let seen = Rc::new(RefCell::new(vec![]));
+        let sink: ProgressSink = {
+            let seen = seen.clone();
+            Rc::new(move |d, t, w| seen.borrow_mut().push((d, t, w.to_string())))
+        };
+        let t = CancelToken::new();
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            scope(&t, Some(sink), || {
+                progress(1, 3, "page");
+                panic!("boom");
+            })
+        }));
+        assert!(r.is_err());
+        progress(2, 3, "after");
+        assert_eq!(*seen.borrow(), vec![(1, 3, "page".to_string())]);
+    }
+}

crates/doc/src/cmyk.rs

@@ -2,10 +2,12 @@
 //!
 //! Two encodings hold them: a four-component JPEG, whose samples are stored inverted with Adobe's
 //! marker (the convention JPEG readers and PDF writers take a CMYK JPEG to follow), and a CMYK
-//! TIFF (8 or 16 bits, chunky, ink amounts as they are). [`ImageBlob::cmyk_tiff`] writes the
-//! latter, Deflate-compressed. Every other image decodes to RGB(A) only.
+//! TIFF (8 or 16 bits, ink amounts as they are, each pixel's inks together or one plane per ink).
+//! [`ImageBlob::cmyk_tiff`] writes the latter, inks together, Deflate-compressed. Every other image
+//! decodes to RGB(A) only.
 
 use std::io::Cursor;
+use std::sync::Arc;
 
 use zune_jpeg::zune_core::bytestream::ZCursor;
 use zune_jpeg::zune_core::colorspace::ColorSpace;
@@ -54,25 +56,136 @@ fn is_tiff(bytes: &[u8]) -> bool {
     bytes.starts_with(b"II*\0") || bytes.starts_with(b"MM\0*")
 }
 
-/// The colour type of TIFF `bytes` and its decoder.
+/// The width and height of the first image of TIFF `bytes` when it has more strips or tiles than
+/// the `tiff` decoder can count: strips per plane times planes past `u32::MAX`, or tiles per plane
+/// times planes past `usize::MAX`. A file that stores one plane per channel (PlanarConfiguration 2)
+/// has a plane for each channel; other files have one. The decoder multiplies these counts without
+/// a check, which panics where overflow checks are on. Such an image, when it is at least a pixel
+/// wide, claims at least 2^32 samples.
+/// Where a tag repeats, the value giving the most strips or tiles counts. `None` for other images
+/// and for bytes that aren't a TIFF.
+pub fn oversized_tiff(bytes: &[u8]) -> Option<(u32, u32)> {
+    let le = bytes.starts_with(b"II*\0");
+    if !le && !bytes.starts_with(b"MM\0*") {
+        return None;
+    }
+    let u16_at = |at: usize| -> Option<u16> {
+        let b: [u8; 2] = bytes.get(at..at.checked_add(2)?)?.try_into().ok()?;
+        Some(if le { u16::from_le_bytes(b) } else { u16::from_be_bytes(b) })
+    };
+    let u32_at = |at: usize| -> Option<u32> {
+        let b: [u8; 4] = bytes.get(at..at.checked_add(4)?)?.try_into().ok()?;
+        Some(if le { u32::from_le_bytes(b) } else { u32::from_be_bytes(b) })
+    };
+    let ifd = usize::try_from(u32_at(4)?).ok()?;
+    // (tag, the entry's single BYTE, SHORT, LONG or IFD value, which sits in the entry, or its
+    // single LONG8 or IFD8 value that fits in 32 bits, which sits where the entry points)
+    let entry = |i: usize| -> Option<(u16, Option<u32>)> {
+        let e = ifd.checked_add(i.checked_mul(12)?.checked_add(2)?)?;
+        let (ty, count, at) = (u16_at(e.checked_add(2)?)?, u32_at(e.checked_add(4)?)?, e.checked_add(8)?);
+        let value = match (ty, count) {
+            (1, 1) => bytes.get(at).map(|&b| u32::from(b)),
+            (3, 1) => u16_at(at).map(u32::from),
+            (4 | 13, 1) => u32_at(at),
+            (16 | 18, 1) => {
+                let at = usize::try_from(u32_at(at)?).ok()?;
+                let (lo, hi) = (u32_at(at)?, u32_at(at.checked_add(4)?)?);
+                let wide = if le { u64::from(hi) << 32 | u64::from(lo) } else { u64::from(lo) << 32 | u64::from(hi) };
+                u32::try_from(wide).ok()
+            }
+            _ => None,
+        };
+        Some((u16_at(e)?, value))
+    };
+    let (mut width, mut height, mut planes, mut planar) = (0u32, 0u32, 1u32, false);
+    let (mut rows, mut tile_w, mut tile_h) = (None::<u32>, None::<u32>, None::<u32>);
+    let least = |was: Option<u32>, v: u32| Some(was.map_or(v, |w| w.min(v)));
+    for i in 0..usize::from(u16_at(ifd)?) {
+        let Some((tag, value)) = entry(i) else { break };
+        let Some(v) = value else { continue };
+        match tag {
+            256 => width = width.max(v),
+            257 => height = height.max(v),
+            277 => planes = planes.max(v),
+            278 => rows = least(rows, v),
+            284 => planar |= v == 2,
+            322 => tile_w = least(tile_w, v),
+            323 => tile_h = least(tile_h, v),
+            _ => {}
+        }
+    }
+    let planes = if planar { u128::from(planes) } else { 1 };
+    let tiles = match (tile_w, tile_h) {
+        (Some(tw @ 1..), Some(th @ 1..)) => u128::from(width.div_ceil(tw)) * u128::from(height.div_ceil(th)) * planes > usize::MAX as u128,
+        _ => false,
+    };
+    let rows = rows.unwrap_or(height);
+    let strips = rows > 0 && u128::from(height.saturating_sub(1) / rows + 1) * planes > u128::from(u32::MAX);
+    (tiles || strips).then_some((width, height))
+}
+
+/// The color type of TIFF `bytes` and its decoder; `None` for [`oversized_tiff`] images too.
 fn tiff(bytes: &[u8]) -> Option<(tiff::ColorType, tiff::decoder::Decoder<Cursor<&[u8]>>)> {
-    if !is_tiff(bytes) {
+    if !is_tiff(bytes) || oversized_tiff(bytes).is_some() {
         return None;
     }
     let mut d = tiff::decoder::Decoder::new(Cursor::new(bytes)).ok()?;
     Some((d.colortype().ok()?, d))
 }
 
+/// Does the TIFF `d` reads store one plane per channel (PlanarConfiguration 2)?
+fn planar(d: &mut tiff::decoder::Decoder<Cursor<&[u8]>>) -> bool {
+    d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1)
+}
+
+/// The samples of the `n` pixels of the TIFF `d` reads, `per` to a pixel (the number its color
+/// type has), pixel by pixel and 8 bits each (16-bit samples to their high byte), whether the file
+/// stores each pixel's samples together or one plane per channel. `None` when they don't decode to
+/// that many samples, which includes images whose planes together need more than the decoder's
+/// limit (256 MB of samples).
+fn read_samples(d: &mut tiff::decoder::Decoder<Cursor<&[u8]>>, n: usize, per: usize) -> Option<Vec<u8>> {
+    let mut buf = tiff::decoder::DecodingResult::U8(Vec::new());
+    let layout = d.read_image_to_buffer(&mut buf).ok()?;
+    let data = match buf {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    if Some(data.len()) != n.checked_mul(per) {
+        return None;
+    }
+    if layout.planes <= 1 {
+        return Some(data);
+    }
+    if layout.planes != per {
+        return None;
+    }
+    let planes: Vec<&[u8]> = data.chunks_exact(n).collect();
+    Some((0..n).flat_map(|i| planes.iter().map(move |p| p.get(i).copied().unwrap_or(0))).collect())
+}
+
 impl ImageBlob {
     /// A CMYK TIFF of ink amounts `inks` (Deflate-compressed); `None` when it can't be written.
     pub fn cmyk_tiff(inks: &Inks) -> Option<Self> {
-        use tiff::encoder::{Compression, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        Self::cmyk_tiff_at(inks, None)
+    }
+
+    /// [`ImageBlob::cmyk_tiff`], declaring the resolution `ppi` (horizontal, vertical pixels per
+    /// inch) when it is given and both are finite and above 0.
+    pub fn cmyk_tiff_at(inks: &Inks, ppi: Option<(f64, f64)>) -> Option<Self> {
+        use tiff::encoder::{Compression, Rational, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        use tiff::tags::{ResolutionUnit, Tag};
         let mut out = Cursor::new(Vec::new());
-        TiffEncoder::new(&mut out)
-            .ok()?
-            .with_compression(Compression::Deflate(DeflateLevel::Balanced))
-            .write_image::<CMYK8>(inks.width, inks.height, &inks.data)
-            .ok()?;
+        let mut enc = TiffEncoder::new(&mut out).ok()?.with_compression(Compression::Deflate(DeflateLevel::Balanced));
+        let mut img = enc.new_image::<CMYK8>(inks.width, inks.height).ok()?;
+        if let Some((x, y)) = ppi.filter(|(x, y)| [x, y].iter().all(|v| v.is_finite() && **v > 0.0)) {
+            // Ten-thousandths of a pixel per inch.
+            let r = |v: f64| Rational { n: (v * 10_000.0).round() as u32, d: 10_000 };
+            img.encoder().write_tag(Tag::XResolution, r(x)).ok()?;
+            img.encoder().write_tag(Tag::YResolution, r(y)).ok()?;
+            img.encoder().write_tag(Tag::ResolutionUnit, ResolutionUnit::Inch).ok()?;
+        }
+        img.write_data(&inks.data).ok()?;
         Some(Self::new("image/tiff", out.into_inner()))
     }
 
@@ -88,6 +201,53 @@ impl ImageBlob {
         let bytes = self.bytes.as_slice();
         if bytes.starts_with(&[0xFF, 0xD8]) { jpeg_inks(bytes) } else { tiff_inks(bytes) }
     }
+
+    /// The ink amounts around pixel (`x`, `y`) of a CMYK image, in the pixel space of an image
+    /// object of `object` (width, height) pixels: the average of the `size` × `size` pixels centered
+    /// on it, clipped to the image, as C, M, Y and K bytes. `None` outside the image and for images
+    /// [`Self::cmyk`] doesn't read. The inks of the last CMYK image are kept for the next sample
+    /// (the Eyedropper samples one image click after click), as [`Self::sample_object`] keeps its
+    /// pixels.
+    pub fn sample_cmyk_object(&self, x: f64, y: f64, object: (u32, u32), size: u32) -> Option<[u8; 4]> {
+        thread_local! {
+            static LAST: std::cell::RefCell<Option<(String, Arc<Inks>)>> = const { std::cell::RefCell::new(None) };
+        }
+        if !self.is_cmyk() {
+            return None;
+        }
+        let key = self.content_key();
+        let inks = LAST.with_borrow_mut(|last| match last {
+            Some((k, inks)) if *k == key => Some(inks.clone()),
+            _ => {
+                let inks = Arc::new(self.cmyk()?);
+                *last = Some((key, inks.clone()));
+                Some(inks)
+            }
+        })?;
+        let k = |n: u32, of: u32| n as f64 / of.max(1) as f64;
+        sample_inks(&inks, x * k(inks.width, object.0), y * k(inks.height, object.1), size)
+    }
+}
+
+/// [`ImageBlob::sample_cmyk_object`] of `inks` at (`x`, `y`) in their own pixel space.
+fn sample_inks(inks: &Inks, x: f64, y: f64, size: u32) -> Option<[u8; 4]> {
+    let (w, h) = (i64::from(inks.width), i64::from(inks.height));
+    let (cx, cy) = (x.floor() as i64, y.floor() as i64);
+    if !(0..w).contains(&cx) || !(0..h).contains(&cy) {
+        return None;
+    }
+    let r = i64::from(size.max(1)) / 2;
+    let (mut sum, mut n) = ([0u64; 4], 0u64);
+    for py in (cy - r).max(0)..=(cy + r).min(h - 1) {
+        for px in (cx - r).max(0)..=(cx + r).min(w - 1) {
+            let i = usize::try_from((py * w + px) * 4).ok()?;
+            let p = inks.data.get(i..i + 4)?;
+            sum.iter_mut().zip(p).for_each(|(s, v)| *s += u64::from(*v));
+            n += 1;
+        }
+    }
+    let c = |v: u64| ((v + n / 2) / n) as u8;
+    Some(sum.map(c))
 }
 
 /// The ink amounts of a four-component JPEG (its samples inverted back; YCCK converted to CMYK
@@ -119,34 +279,42 @@ fn jpeg_inks(bytes: &[u8]) -> Option<Inks> {
     Inks::new(w, h, data)
 }
 
-/// The ink amounts of a chunky CMYK TIFF (16-bit samples to 8 bits).
+/// The ink amounts of a CMYK TIFF (16-bit samples to 8 bits), its inks stored together or one plane
+/// per ink.
 fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
     let (kind, mut d) = tiff(bytes)?;
     let (w, h) = d.dimensions().ok()?;
-    // Planar samples (one plane per ink) would read as interleaved.
-    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
-    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) || planar || pixels(w, h).is_none() {
+    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) {
         return None;
     }
-    let data = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    Inks::new(w, h, data)
+    let n = usize::try_from(pixels(w, h)?).ok()?;
+    Inks::new(w, h, read_samples(&mut d, n, 4)?)
+}
+
+/// CMYK TIFF `bytes` as Open and Place store them: as they are, or, when they store one plane per
+/// ink, which the image decoder doesn't read, their ink amounts written again by
+/// [`ImageBlob::cmyk_tiff_at`] with the resolution `ppi`. `None` for other images and for CMYK
+/// TIFFs whose inks [`ImageBlob::cmyk`] doesn't read.
+pub fn stored_cmyk_tiff(bytes: &[u8], ppi: Option<(f64, f64)>) -> Option<Vec<u8>> {
+    let inks = tiff_inks(bytes)?;
+    let (_, mut d) = tiff(bytes)?;
+    if !planar(&mut d) {
+        return Some(bytes.to_vec());
+    }
+    ImageBlob::cmyk_tiff_at(&inks, ppi).map(|b| Arc::unwrap_or_clone(b.bytes))
 }
 
 /// A TIFF whose pixels have samples after their colour, which the image decoder doesn't read at
 /// all, as RGBA pixels: CMYK with an alpha channel (5 samples), each colour converted by `rgb` (ink
 /// amounts 0..1 → sRGB 0..1; the inks can't be kept with the transparency, so they show as RGB),
 /// and grayscale with extra samples, of which the first is the alpha when the file says so (other
-/// channels are left out). Associated (premultiplied) alpha is divided back out. `None` for other
-/// images, planar ones and ones larger than [`MAX_CMYK_PIXELS`].
+/// channels are left out). Associated (premultiplied) alpha is divided back out. The samples may be
+/// stored together or one plane per channel. `None` for other images and ones larger than
+/// [`MAX_CMYK_PIXELS`].
 pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3]) -> Option<image::RgbaImage> {
     use tiff::tags::Tag;
     let (kind, mut d) = tiff(bytes)?;
     let (w, h) = d.dimensions().ok()?;
-    let planar = d.find_tag_unsigned::<u16>(Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
     // 0: white is zero, 1: black is zero (the two grayscales).
     let photometric = d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten();
     // ExtraSamples 1: associated alpha (premultiplied colour), 2: unassociated alpha, 0: not alpha.
@@ -159,18 +327,8 @@ pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3])
         }
         _ => return None,
     };
-    if planar {
-        return None;
-    }
     let n = usize::try_from(pixels(w, h)?).ok()?;
-    let data: Vec<u8> = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    if Some(data.len()) != n.checked_mul(samples) {
-        return None;
-    }
+    let data = read_samples(&mut d, n, samples)?;
     let mut out = Vec::with_capacity(n * 4);
     for p in data.chunks_exact(samples) {
         let opacity = if alpha { p.get(colour).copied().unwrap_or(u8::MAX) } else { u8::MAX };
@@ -191,6 +349,162 @@ pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3])
     image::RgbaImage::from_raw(w, h, out)
 }
 
+/// Why a TIFF compressed with CCITT Group 3 wasn't read ([`group3_tiff_rgba`]).
+#[derive(Clone, Debug, PartialEq, thiserror::Error)]
+pub enum Group3Error {
+    /// Its pixels would take more than [`crate::MAX_RASTER_ALLOC`] as RGBA.
+    #[error("an image of {w} × {h} pixels is too large to draw")]
+    TooLarge { w: u32, h: u32 },
+    /// A strip or tile ends before its last row or can't be decoded (it holds a code the decoder
+    /// doesn't read, such as T.4's uncompressed mode, or a row of the wrong width), or a tile is
+    /// larger than [`crate::MAX_RASTER_ALLOC`] allows as RGBA.
+    #[error("could not decode image: {0}")]
+    Damaged(hayro_ccitt::DecodeError),
+}
+
+/// The pixels of a 1-bit TIFF compressed with CCITT Group 3, which the image decoder doesn't read,
+/// as RGBA. Compression 2 is modified Huffman coding with each row starting at a byte and no EOL
+/// codes. Compression 3 is ITU-T T.4 coding with an EOL code before each row: one-dimensional rows,
+/// or with T4Options bit 0, rows that a tag bit marks as one-dimensional or as coded against the
+/// row above. Fill bits before an EOL are skipped. Rows in T.4's uncompressed mode (T4Options
+/// bit 1) can't be decoded. Each strip or tile is coded on its own. White runs are 0 bits and black
+/// runs are 1 bits, as libtiff writes them, and PhotometricInterpretation 0 shows 0 bits as white
+/// and 1 shows them as black. FillOrder 2 (each byte's lowest bit first) is read too. Together, the
+/// strips and tiles are read from at most as many bytes as the file has. `None` for other images;
+/// an error when the pixels would take more than [`crate::MAX_RASTER_ALLOC`] as RGBA, a tile is
+/// larger than that allowance, or a strip or tile can't be decoded or ends before its last row.
+pub fn group3_tiff_rgba(bytes: &[u8]) -> Option<Result<image::RgbaImage, Group3Error>> {
+    use hayro_ccitt::{DecodeError, DecodeSettings, DecoderContext, EncodingMode};
+    use tiff::tags::Tag;
+    let (kind, mut d) = tiff(bytes)?;
+    let compression = d.find_tag_unsigned::<u16>(Tag::Compression).ok().flatten()?;
+    let (w, h) = d.dimensions().ok()?;
+    if kind != tiff::ColorType::Gray(1) || !matches!(compression, 2 | 3) || w == 0 || h == 0 {
+        return None;
+    }
+    // The level of a 0 bit (a white run): white when white is zero (0), black when black is zero (1).
+    let zero = match d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten() {
+        Some(0) => u8::MAX,
+        Some(1) => 0,
+        _ => return None,
+    };
+    if u64::from(w) * u64::from(h) > crate::MAX_RASTER_ALLOC / 4 {
+        return Some(Err(Group3Error::TooLarge { w, h }));
+    }
+    let t4_options = d.find_tag_unsigned::<u32>(Tag::Unknown(292)).ok().flatten().unwrap_or(0);
+    let lsb_first = d.find_tag_unsigned::<u16>(Tag::FillOrder).ok().flatten() == Some(2);
+    let encoding = if compression == 3 && t4_options & 1 != 0 {
+        // Each row's tag bit says how it is coded.
+        EncodingMode::Group3_2D { k: 2 }
+    } else {
+        EncodingMode::Group3_1D
+    };
+    // The width and height of each strip or tile, and the tags of their offsets and byte counts.
+    let tiled = d.get_chunk_type() == tiff::decoder::ChunkType::Tile;
+    let (cw, ch, offsets, counts) = if tiled {
+        let tw = d.find_tag_unsigned::<u32>(Tag::TileWidth).ok().flatten().filter(|&v| v > 0)?;
+        let th = d.find_tag_unsigned::<u32>(Tag::TileLength).ok().flatten().filter(|&v| v > 0)?;
+        (tw, th, Tag::TileOffsets, Tag::TileByteCounts)
+    } else {
+        let rows = d.find_tag_unsigned::<u32>(Tag::RowsPerStrip).ok().flatten().filter(|&v| v > 0).map_or(h, |r| r.min(h));
+        (w, rows, Tag::StripOffsets, Tag::StripByteCounts)
+    };
+    let damaged = |e: DecodeError| Some(Err(Group3Error::Damaged(e)));
+    // A tile is held to the allowance the image is held to; a strip is no larger than the image.
+    if u64::from(cw) * u64::from(ch) > crate::MAX_RASTER_ALLOC / 4 {
+        return damaged(DecodeError::Overflow);
+    }
+    let offsets = d.find_tag_unsigned_vec::<u64>(offsets).ok().flatten().unwrap_or_default();
+    let counts = d.find_tag_unsigned_vec::<u64>(counts).ok().flatten().unwrap_or_default();
+    let across = w.div_ceil(cw);
+    let chunks = u64::from(across) * u64::from(h.div_ceil(ch));
+    if chunks > offsets.len().min(counts.len()) as u64 {
+        return damaged(DecodeError::UnexpectedEof);
+    }
+    let mut gray = vec![zero; usize::try_from(u64::from(w) * u64::from(h)).ok()?];
+    let mut budget = bytes.len();
+    for (i, (&offset, &count)) in (0..chunks).zip(offsets.iter().zip(&counts)) {
+        let (x0, y0) = (u32::try_from(i % u64::from(across)).ok()? * cw, u32::try_from(i / u64::from(across)).ok()? * ch);
+        let Some(start) = usize::try_from(offset).ok().filter(|&s| s <= bytes.len()) else {
+            return damaged(DecodeError::UnexpectedEof);
+        };
+        let len = usize::try_from(count).unwrap_or(usize::MAX).min(bytes.len() - start).min(budget);
+        budget -= len;
+        let data = bytes.get(start..start + len)?;
+        let data: std::borrow::Cow<[u8]> = if lsb_first { data.iter().map(|b| b.reverse_bits()).collect() } else { data.into() };
+        let settings = DecodeSettings {
+            columns: cw,
+            // A tile is coded whole; the last strip only has the image's remaining rows.
+            rows: if tiled { ch } else { ch.min(h - y0) },
+            end_of_block: compression == 3,
+            end_of_line: compression == 3,
+            rows_are_byte_aligned: compression == 2,
+            encoding,
+            invert_black: false,
+        };
+        let mut rows = Rows { out: &mut gray, width: w, height: h, x0, y0, x: 0, y: 0, zero };
+        if let Err(e) = hayro_ccitt::decode(&data, &mut rows, &mut DecoderContext::new(settings)) {
+            return damaged(e);
+        }
+        // The data ended, or six EOL codes came, before the strip's or tile's last row.
+        if rows.y < settings.rows {
+            return damaged(DecodeError::UnexpectedEof);
+        }
+    }
+    let gray = image::GrayImage::from_raw(w, h, gray)?;
+    Some(Ok(image::DynamicImage::ImageLuma8(gray).to_rgba8()))
+}
+
+/// Where a strip or tile of a Group 3 TIFF ([`group3_tiff_rgba`]) puts its decoded pixels: `out`
+/// holds the image's levels row by row, `width` × `height`, and the strip or tile starts at (`x0`,
+/// `y0`). Pixels past the image's right or bottom edge (a tile's padding) are dropped.
+struct Rows<'a> {
+    out: &'a mut [u8],
+    width: u32,
+    height: u32,
+    x0: u32,
+    y0: u32,
+    /// The next pixel in the strip or tile.
+    x: u64,
+    y: u32,
+    /// The level of a white run.
+    zero: u8,
+}
+
+impl Rows<'_> {
+    /// The next `n` pixels of the row, a white run's or a black run's.
+    fn run(&mut self, white: bool, n: u64) {
+        let level = if white { self.zero } else { u8::MAX - self.zero };
+        let row = u64::from(self.y0) + u64::from(self.y);
+        let left = u64::from(self.x0) + self.x;
+        let right = left.saturating_add(n).min(u64::from(self.width));
+        if row < u64::from(self.height) && left < right {
+            let at = row * u64::from(self.width);
+            if let (Ok(a), Ok(b)) = (usize::try_from(at + left), usize::try_from(at + right))
+                && let Some(px) = self.out.get_mut(a..b)
+            {
+                px.fill(level);
+            }
+        }
+        self.x = self.x.saturating_add(n);
+    }
+}
+
+impl hayro_ccitt::Decoder for Rows<'_> {
+    fn push_pixel(&mut self, white: bool) {
+        self.run(white, 1);
+    }
+
+    fn push_pixel_chunk(&mut self, white: bool, chunk_count: u32) {
+        self.run(white, u64::from(chunk_count) * 8);
+    }
+
+    fn next_line(&mut self) {
+        self.y = self.y.saturating_add(1);
+        self.x = 0;
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -246,6 +560,64 @@ mod tests {
         assert_eq!(gray(0), [255, 255, 255, 255, 51, 51, 51, 255, 0, 0, 0, 255], "a channel that isn't alpha: opaque");
     }
 
+    /// A header claiming more tiles than can be counted: (2^32 − 1)² pixels in tiles of one pixel,
+    /// times 2 planes.
+    #[test]
+    fn tiffs_with_more_tiles_than_can_be_counted_are_oversized() {
+        let header = |planar: u32| {
+            let mut f = b"II*\0\x08\0\0\0".to_vec();
+            let entries = [(256u16, u32::MAX), (257, u32::MAX), (258, 8), (262, 1), (277, 2), (284, planar), (322, 1), (323, 1), (324, 0), (325, 0)];
+            f.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+            for (tag, v) in entries {
+                f.extend([tag.to_le_bytes(), 4u16.to_le_bytes()].concat());
+                f.extend([1u32.to_le_bytes(), v.to_le_bytes()].concat());
+            }
+            f.extend([0; 4]);
+            f
+        };
+        assert_eq!(oversized_tiff(&header(2)), Some((u32::MAX, u32::MAX)));
+        assert_eq!(oversized_tiff(&header(1)), None, "one plane: (2^32 − 1)² tiles can be counted in 64 bits");
+        assert!(tiff(&header(2)).is_none(), "not decoded");
+    }
+
+    /// A header claiming more strips than can be counted: 2^31 + 1 rows, a strip each, times 2
+    /// planes. The decoder counts strips when the file has strip offsets, tile sizes or not, and
+    /// reads a LONG8 value from where the entry points.
+    #[test]
+    fn tiffs_with_more_strips_than_can_be_counted_are_oversized() {
+        // Each entry holds one value of type 3 (SHORT), 4 (LONG) or 16 (LONG8, after the directory).
+        let header = |entries: &[(u16, u16, u32)]| {
+            let after = 8 + 2 + 12 * entries.len() + 4;
+            let mut f = b"II*\0\x08\0\0\0".to_vec();
+            f.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+            let mut wide = vec![];
+            for &(tag, ty, v) in entries {
+                f.extend([tag.to_le_bytes(), ty.to_le_bytes()].concat());
+                f.extend(1u32.to_le_bytes());
+                if ty == 16 {
+                    f.extend(u32::try_from(after + wide.len()).unwrap().to_le_bytes());
+                    wide.extend(u64::from(v).to_le_bytes());
+                } else {
+                    f.extend(v.to_le_bytes());
+                }
+            }
+            f.extend([0; 4]);
+            f.extend(wide);
+            f
+        };
+        let tall = 1u32 << 31 | 1;
+        let strips = [(256, 4, 1), (257, 4, tall), (258, 3, 8), (262, 3, 1), (273, 4, 0), (277, 3, 2), (278, 4, 1), (279, 4, 0), (284, 3, 2)];
+        assert_eq!(oversized_tiff(&header(&strips)), Some((1, tall)));
+        let tile_sizes = [&strips[..], &[(322, 4, u32::MAX), (323, 4, u32::MAX)]].concat();
+        assert_eq!(oversized_tiff(&header(&tile_sizes)), Some((1, tall)), "tile sizes without tile offsets");
+        let mut long8 = strips;
+        long8[1] = (257, 16, tall);
+        assert_eq!(oversized_tiff(&header(&long8)), Some((1, tall)), "ImageLength as a LONG8");
+        for h in [header(&tile_sizes), header(&long8)] {
+            assert!(tiff(&h).is_none(), "not decoded");
+        }
+    }
+
     fn inks() -> Inks {
         Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
     }
@@ -261,6 +633,20 @@ mod tests {
         assert_eq!(rgb.get_pixel(1, 0).0, [0, 255, 255]);
     }
 
+    #[test]
+    fn a_cmyk_image_samples_its_ink_amounts() {
+        let b = ImageBlob::cmyk_tiff(&inks()).unwrap();
+        assert_eq!(b.sample_cmyk_object(0.5, 0.5, (3, 2), 1), Some([0, 40, 100, 0]));
+        // An object of 6 × 4 pixels showing these 3 × 2: (5, 3) is the last pixel.
+        assert_eq!(b.sample_cmyk_object(5.0, 3.0, (6, 4), 1), Some([12, 34, 56, 78]));
+        // 3 × 3 around (1, 0), clipped to the image: all six pixels averaged.
+        assert_eq!(b.sample_cmyk_object(1.5, 0.5, (3, 2), 3), Some([45, 55, 69, 56]));
+        assert_eq!(b.sample_cmyk_object(3.5, 0.5, (3, 2), 1), None, "outside");
+        let mut png = Vec::new();
+        image::RgbaImage::new(2, 2).write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        assert_eq!(ImageBlob::png(png).sample_cmyk_object(0.5, 0.5, (2, 2), 1), None, "an RGB image has no inks");
+    }
+
     #[test]
     fn a_cmyk_jpeg_reads_back_as_ink_amounts() {
         // A flat CMYK JPEG: Adobe's inverted samples with its marker.

crates/doc/src/corners.rs

@@ -5,7 +5,7 @@
 use std::borrow::Cow;
 use std::collections::BTreeSet;
 
-use vectorcraft_geom::corners::{Corner, cut_corners, path_corners};
+use vectorcraft_geom::corners::{Corner, cut_corners, fitted_radii, path_corners};
 use vectorcraft_geom::shapes::{self, CornerKind};
 use vectorcraft_geom::{Affine, PathData, Rect};
 
@@ -23,6 +23,8 @@ pub struct LiveCorners<'a> {
     /// The corners that can be cut, in anchor order ([`path_corners`] of `base`).
     pub corners: Vec<Corner>,
     radii: Vec<f64>,
+    /// The radius each of `corners` is drawn with ([`fitted_radii`]).
+    drawn: Vec<f64>,
     kinds: Vec<CornerKind>,
     /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
     sources: Vec<Vec<usize>>,
@@ -54,7 +56,9 @@ impl<'a> LiveCorners<'a> {
                 })
                 .collect()
         };
-        Some(Self { corners: path_corners(&base), base, xf, radii, kinds, sources })
+        let corners = path_corners(&base);
+        let drawn = fitted_radii(&corners, &radii);
+        Some(Self { corners, base, xf, radii, drawn, kinds, sources })
     }
 
     /// The Live Corners of a path object.
@@ -73,6 +77,11 @@ impl<'a> LiveCorners<'a> {
         self.radii.get(index).copied().unwrap_or(0.0)
     }
 
+    /// The radius corner `index` is drawn with, in document units: its own, no larger than its
+    /// neighbours leave room for (0 for an anchor that is no corner).
+    pub fn drawn_radius(&self, index: usize) -> f64 {
+        self.corners.binary_search_by_key(&index, |c| c.index).ok().and_then(|i| self.drawn.get(i)).copied().unwrap_or(0.0)
+    }
     /// The kind corner `index` is cut with.
     pub fn kind(&self, index: usize) -> CornerKind {
         self.kinds.get(index).copied().unwrap_or_default()

crates/doc/src/graph.rs

@@ -196,6 +196,57 @@ macro_rules! ids {
 ids!(PiePosition { Even => "even", Ratio => "ratio", Stacked => "stacked" });
 ids!(PieSort { None => "none", All => "all", First => "first" });
 
+/// Object › Graph › Column › Column Type: how a column design fills a column or bar. Vertically Scaled stretches it
+/// along the value axis to the column's length at the column's width; Uniformly Scaled scales it both ways to that
+/// length, centered on the column; Repeating stacks copies that each stand for [`ColumnDesign::each`]; Sliding scales the
+/// part above its guide line (in a bar, right of it) in proportion to the column's width and stretches the rest.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ColumnType {
+    #[default]
+    Vertical,
+    Uniform,
+    Repeating,
+    Sliding,
+}
+
+/// Object › Graph › Column › For Fractions: a repeating design's last copy, for the part of a value less than one
+/// design, is cut off (Chop) or scaled down along the value axis (Scale).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Fractions {
+    #[default]
+    Chop,
+    Scale,
+}
+
+ids!(ColumnType { Vertical => "vertical", Uniform => "uniform", Repeating => "repeating", Sliding => "sliding" });
+ids!(Fractions { Chop => "chop", Scale => "scale" });
+
+/// Object › Graph › Column: the graph design a series' columns or bars are drawn with, and how it fills them.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ColumnDesign {
+    pub design: String,
+    #[serde(skip_serializing_if = "ColumnType::is_default")]
+    pub column_type: ColumnType,
+    /// Repeating: the value one copy of the design stands for (Each Design Represents).
+    pub each: f64,
+    #[serde(skip_serializing_if = "Fractions::is_default")]
+    pub fractions: Fractions,
+}
+
+impl ColumnDesign {
+    /// Each Design Represents for a new column design.
+    pub const EACH: f64 = 10.0;
+}
+
+impl Default for ColumnDesign {
+    fn default() -> Self {
+        Self { design: String::new(), column_type: ColumnType::Vertical, each: Self::EACH, fractions: Fractions::Chop }
+    }
+}
+
 /// Graph Type › Value Axis: which side of the plot the value axis is drawn on.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -345,6 +396,11 @@ pub struct GraphSpec {
     /// series index, for line, scatter and radar series; `None` and missing entries draw the default square.
     #[serde(skip_serializing_if = "Vec::is_empty")]
     pub series_markers: Vec<Option<String>>,
+    /// Object › Graph › Column: the graph design each series' columns or bars (and legend swatch) are drawn with, by
+    /// series index, for column, stacked column, bar and stacked bar series; `None` and missing entries draw plain
+    /// columns.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub series_columns: Vec<Option<ColumnDesign>>,
     /// Graph Type › Tick Marks for the value axis (the left one, or the bottom one of bar graphs) and the right one:
     /// length, and tick marks per division (0 and 1 = one, at the labels).
     #[serde(skip_serializing_if = "TickLength::is_short")]
@@ -479,6 +535,7 @@ impl Default for GraphSpec {
             right_axis_min: None,
             right_axis_max: None,
             series_markers: vec![],
+            series_columns: vec![],
             label_styles: LabelStyles::default(),
             first_row_in_front: false,
             first_column_in_front: false,

crates/doc/src/hit.rs

@@ -294,19 +294,24 @@ fn edits_contents(n: &Node) -> bool {
 /// Is `p` inside the region `clip` clips to ([`Node::clip_shapes`])? Text counts by its frame:
 /// glyph outlines need the font engine, above this crate.
 fn clip_contains(clip: &Node, p: Point) -> bool {
+    clip_regions(clip).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
+}
+
+/// The regions `clip` clips to ([`Node::clip_shapes`]), text counted by its frame as in
+/// [`clip_contains`].
+fn clip_regions(clip: &Node) -> Vec<(vectorcraft_geom::BezPath, vectorcraft_geom::FillRule)> {
     let frame = |n: &Node| {
         let b = n.geometric_bounds()?;
         Some(Node::path(n.id, vectorcraft_geom::shapes::rectangle(b), Default::default()))
     };
-    clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
+    clip.clip_shapes(Some(&frame))
 }
 
 /// Can a click at `p` hit `c`, the child `i` of `parent`, or something inside it? Not when it is
 /// hidden, when it can't be edited (`editable_only`), when it is the part of a Shaper group that
 /// isn't shown, or when `p` is outside its reach.
 fn may_hit(parent: &Node, i: usize, c: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes, editable_only: bool) -> bool {
-    let source_isolated = |n: &Node| n.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == opt.scope);
-    if parent.extras().shaper.is_some() && (i == 0) != source_isolated(parent) {
+    if shaper_hides(parent, i, opt.scope) {
         return false;
     }
     // Read-only samples can read locked/template art; hidden art never participates.
@@ -315,10 +320,22 @@ fn may_hit(parent: &Node, i: usize, c: &Node, p: Point, opt: HitOptions, symbols
     }
     // (An envelope's content sits where it was, not where the envelope draws it.)
     edits_contents(c)
-        || c.extras().shaper.is_some() && source_isolated(c)
+        || c.extras().shaper.is_some() && source_of(c, opt.scope)
         || c.reach_bounds_with(symbols).is_none_or(|b| b.inflate(opt.tol, opt.tol).contains(p))
 }
 
+/// Is the first child of `n` the isolated container `scope`?
+fn source_of(n: &Node, scope: Option<NodeId>) -> bool {
+    n.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == scope)
+}
+
+/// Do clicks and marquees skip the child `i` of `parent` with `scope` isolated? For a Shaper
+/// Group that is its original shapes (its first child), or, in Construction mode, when they are
+/// isolated, the art the group shows.
+fn shaper_hides(parent: &Node, i: usize, scope: Option<NodeId>) -> bool {
+    parent.extras().shaper.is_some() && (i == 0) != source_of(parent, scope)
+}
+
 fn hit_children(
     parent: &Node,
     p: Point,
@@ -464,15 +481,39 @@ fn hit_any(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> Option
     }
 }
 
+/// The path of compound path `n` under `p`, for the Group Selection tool: the one whose outline is
+/// within `tol`, else the innermost one whose area holds `p` (a hole inside an outer shape, an
+/// island inside a hole). `None` when `n` isn't a compound path or no part is under `p`.
+pub fn compound_part_at(n: &Node, p: Point, tol: f64) -> Option<NodeId> {
+    let NodeKind::Compound { children, rule } = &n.kind else { return None };
+    let parts: Vec<_> = children.iter().rev().filter_map(|c| c.path_data().map(|pd| (c.id, pd.to_bezpath(), pd.bounds()))).collect();
+    if let Some((id, ..)) = parts.iter().find(|(_, bp, _)| stroke_contains(bp, 0.0, tol, p)) {
+        return Some(*id);
+    }
+    // The innermost by the size of its box.
+    let size = |b: &Option<Rect>| b.map_or(f64::INFINITY, |b| b.area());
+    parts.iter().filter(|(_, bp, _)| fill_contains(bp, *rule, p)).min_by(|a, b| size(&a.2).total_cmp(&size(&b.2))).map(|(id, ..)| *id)
+}
+
 /// Objects (children of layers, or of `scope` in isolation mode) touched by a marquee rect. Symbol
-/// instances are measured by their art ([`Node::geometric_bounds_with`]).
+/// instances are measured by their art ([`Node::geometric_bounds_with`]). The art of a clip group
+/// or of a layer with a clipping mask counts only when the marquee meets the region its clipping
+/// path clips to, and then only within that region's bounds.
 pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) -> Vec<NodeId> {
     let mut out = Vec::new();
-    let tops: Vec<&std::sync::Arc<Node>> = match scope.and_then(|s| doc.node(s)) {
-        Some(s) => match s.children() {
-            Some(c) => c.iter().collect(),
+    // `tops` pairs each object with the part of `r` in which the marquee can touch it.
+    let tops: Vec<(&std::sync::Arc<Node>, Rect)> = match scope.and_then(|s| doc.node(s)) {
+        Some(s) => match (s.children(), marquee_in(s, r)) {
+            (Some(c), Some(r)) => c.iter().enumerate().filter(|(i, _)| !shaper_hides(s, *i, scope)).map(|(_, c)| (c, r)).collect(),
+            (Some(_), None) => vec![],
             // A single object isolated: only it.
-            None => doc.parent_of(s.id).and_then(|p| doc.node(p)).and_then(Node::children).into_iter().flatten().filter(|c| c.id == s.id).collect(),
+            (None, _) => doc
+                .parent_of(s.id)
+                .and_then(|p| doc.node(p))
+                .and_then(|p| Some((p.children()?, marquee_in(p, r)?)))
+                .into_iter()
+                .flat_map(|(c, r)| c.iter().filter(|c| c.id == s.id).map(move |c| (c, r)))
+                .collect(),
         },
         // The objects of the layers, looking through sublayers (hidden, locked and template ones
         // are left out).
@@ -480,28 +521,36 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
             .layers
             .iter()
             .filter(|l| l.visible && !l.locked && !l.is_template() && doc.pattern_edit.as_ref().is_none_or(|e| e.layer == l.id))
-            .flat_map(|l| layer_objects(l))
+            .flat_map(|l| layer_objects(l, r))
             .collect(),
     };
-    fn layer_objects(l: &Node) -> Vec<&std::sync::Arc<Node>> {
+    /// The objects of layer `l`, each with the part of `r` that the clipping masks of `l` and of
+    /// the sublayers it is in leave.
+    fn layer_objects(l: &Node, r: Rect) -> Vec<(&std::sync::Arc<Node>, Rect)> {
         let mut out = vec![];
+        let Some(r) = marquee_in(l, r) else { return out };
         for c in l.children().into_iter().flatten() {
             if c.is_layer() {
                 if c.visible && !c.locked && !c.is_template() {
-                    out.extend(layer_objects(c));
+                    out.extend(layer_objects(c, r));
                 }
             } else {
-                out.push(c);
+                out.push((c, r));
             }
         }
         out
     }
-    fn touches(n: &Node, s: &SymbolBoxes, r: Rect) -> bool {
+    /// Does the marquee `r` touch `n`? It skips the children of a Shaper Group that clicks skip
+    /// ([`shaper_hides`]). An Intertwine group is touched by its members, and a repeat is touched
+    /// by the copies it draws, as clicks hit them. Objects of every other kind except paths,
+    /// compound paths, layers and groups are touched by their box.
+    fn touches(n: &Node, s: &SymbolBoxes, r: Rect, scope: Option<NodeId>) -> bool {
         match &n.kind {
             NodeKind::Path { path, .. } => vectorcraft_geom::hit::intersects_rect(path, r),
-            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Compound { children, .. } => {
-                children.iter().any(|c| c.visible && touches(c, s, r))
-            }
+            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Intertwine { children } => marquee_in(n, r)
+                .is_some_and(|r| children.iter().enumerate().any(|(i, c)| c.visible && !shaper_hides(n, i, scope) && touches(c, s, r, scope))),
+            NodeKind::Compound { children, .. } => children.iter().any(|c| c.visible && touches(c, s, r, scope)),
+            NodeKind::Repeat(spec) => spec.expand().iter().any(|copy| touches(copy, s, r, scope)),
             // A box with no width or no height (an instance of a symbol that draws a straight
             // line) is touched where the marquee crosses it.
             _ => n.geometric_bounds_with(s).is_some_and(|b| {
@@ -510,36 +559,67 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
             }),
         }
     }
-    fn collect_leaves(n: &Node, s: &SymbolBoxes, r: Rect, out: &mut Vec<NodeId>) {
+    fn collect_leaves(n: &Node, s: &SymbolBoxes, r: Rect, scope: Option<NodeId>, out: &mut Vec<NodeId>) {
         match &n.kind {
-            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => {
-                for c in children {
-                    if c.visible && !c.locked {
-                        collect_leaves(c, s, r, out);
+            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Intertwine { children } => {
+                let Some(r) = marquee_in(n, r) else { return };
+                for (i, c) in children.iter().enumerate() {
+                    if c.visible && !c.locked && !shaper_hides(n, i, scope) {
+                        collect_leaves(c, s, r, scope, out);
                     }
                 }
             }
             _ => {
-                if touches(n, s, r) {
+                if touches(n, s, r, scope) {
                     out.push(n.id);
                 }
             }
         }
     }
     let symbols = doc.symbol_boxes();
-    for t in tops {
+    for (t, r) in tops {
         if !t.visible || t.locked {
             continue;
         }
         if leaves {
-            collect_leaves(t, &symbols, r, &mut out);
-        } else if touches(t, &symbols, r) {
+            collect_leaves(t, &symbols, r, scope, &mut out);
+        } else if touches(t, &symbols, r, scope) {
             out.push(t.id);
         }
     }
     out
 }
 
+/// The part of a marquee `r` in which it can touch the children of `parent`. For a clip group or a
+/// layer with a clipping mask, this is what [`marquee_in_clip`] returns for its clipping path (None
+/// when the marquee misses it); otherwise it is all of `r`.
+fn marquee_in(parent: &Node, r: Rect) -> Option<Rect> {
+    match parent.children().and_then(|c| c.first()) {
+        Some(clip) if parent.clips() => marquee_in_clip(clip, r),
+        _ => Some(r),
+    }
+}
+
+/// The part of a marquee `r` in which it can touch the art that `clip` clips (the clipping path of
+/// a clip group or of a layer with a clipping mask): `r` cut to the bounds of the regions `clip`
+/// clips to ([`clip_regions`]), or `None` when `r` meets none of those regions. Within those
+/// bounds, art outside a region that is not a rectangle still counts.
+fn marquee_in_clip(clip: &Node, r: Rect) -> Option<Rect> {
+    use vectorcraft_geom::kurbo::Shape;
+    let regions = clip_regions(clip);
+    // The edge of a region is its outline with each open subpath closed, as `fill_contains` fills it.
+    let meets = |(bp, rule): &(vectorcraft_geom::BezPath, vectorcraft_geom::FillRule)| {
+        let mut edge = vectorcraft_geom::PathData::from_bezpath(bp);
+        edge.subpaths.iter_mut().for_each(|sp| sp.closed = true);
+        fill_contains(bp, *rule, r.center()) || vectorcraft_geom::hit::intersects_rect(&edge, r)
+    };
+    if !regions.iter().any(meets) {
+        return None;
+    }
+    let bounds = regions.iter().map(|(bp, _)| bp.bounding_box()).reduce(|a, b| a.union(b))?;
+    Some(r.intersect(bounds))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -613,6 +693,224 @@ mod tests {
         assert!(marquee(&d, Rect::new(100.0, 100.0, 105.0, 105.0), None, false).is_empty());
     }
 
+    /// The art of a 200 pt wide rectangle clipped to its left half (0..100 × 0..100): the mask and
+    /// the art, in that order.
+    fn half_clipped(d: &mut Document) -> (Node, Node) {
+        let mask = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default());
+        let art = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 200.0, 100.0)), Appearance::default_art());
+        (mask, art)
+    }
+
+    /// #2345: a marquee touches a clip group only where its art shows. Over the clipped-away
+    /// half alone it selects nothing, and around a rectangle drawn beside the group's mask it
+    /// takes that rectangle alone; reaching into the mask takes the group. The same holds for
+    /// Group Selection's leaves and in isolation mode.
+    #[test]
+    fn a_marquee_leaves_a_clip_group_by_its_clipped_away_art() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        let (mask, art) = half_clipped(&mut d);
+        let (g, art_id, beside) = (d.alloc_id(), art.id, d.alloc_id());
+        let mut clip = Node::group(g, vec![Arc::new(mask), Arc::new(art)]);
+        clip.set_clips(true);
+        d.insert(Some(l), 0, clip).unwrap();
+        d.insert(Some(l), 1, Node::path(beside, shapes::rectangle(Rect::new(150.0, 80.0, 190.0, 130.0)), Appearance::default_art())).unwrap();
+        // This marquee crosses only the hidden art's top and right edges.
+        let hidden = Rect::new(150.0, -10.0, 210.0, 50.0);
+        assert!(marquee(&d, hidden, None, false).is_empty());
+        assert!(marquee(&d, hidden, None, true).is_empty());
+        assert!(marquee(&d, hidden, Some(g), false).is_empty());
+        assert!(marquee(&d, hidden, Some(art_id), false).is_empty());
+        // This marquee surrounds the rectangle beside and crosses the hidden art's bottom edge.
+        assert_eq!(marquee(&d, Rect::new(140.0, 70.0, 195.0, 140.0), None, false), vec![beside]);
+        // This marquee crosses the shown half's top edge and goes on into the hidden half.
+        let shown = Rect::new(50.0, -10.0, 160.0, 10.0);
+        assert_eq!(marquee(&d, shown, None, false), vec![g]);
+        assert!(marquee(&d, shown, None, true).contains(&art_id));
+        assert_eq!(marquee(&d, shown, Some(g), false).len(), 2, "the mask and the art");
+    }
+
+    /// #2345: in the corner of a diamond mask's box, outside the diamond, a marquee over the
+    /// clipped art's corner leaves the clip group. An open mask clips to its area closed by a
+    /// straight line, and a marquee across that line takes the art it reaches inside.
+    #[test]
+    fn a_marquee_must_meet_the_clipping_path_itself() {
+        // A clip group of a mask through `pts` (closed or open) over the art `art`.
+        let clipped = |pts: &[(f64, f64)], closed: bool, art: Rect| {
+            let mut d = Document::new(200.0, 200.0);
+            let l = d.layers[0].id;
+            let mut mask = vectorcraft_geom::BezPath::new();
+            mask.move_to(pts[0]);
+            for &p in &pts[1..] {
+                mask.line_to(p);
+            }
+            if closed {
+                mask.close_path();
+            }
+            let mask = Node::path(d.alloc_id(), vectorcraft_geom::PathData::from_bezpath(&mask), Appearance::default());
+            let art = Node::path(d.alloc_id(), shapes::rectangle(art), Appearance::default_art());
+            let g = d.alloc_id();
+            let mut clip = Node::group(g, vec![Arc::new(mask), Arc::new(art)]);
+            clip.set_clips(true);
+            d.insert(Some(l), 0, clip).unwrap();
+            (d, g)
+        };
+        let (d, g) = clipped(&[(50.0, 0.0), (100.0, 50.0), (50.0, 100.0), (0.0, 50.0)], true, Rect::new(0.0, 0.0, 100.0, 100.0));
+        assert!(marquee(&d, Rect::new(-10.0, -10.0, 10.0, 10.0), None, false).is_empty());
+        assert_eq!(marquee(&d, Rect::new(-10.0, 40.0, 10.0, 60.0), None, false), vec![g], "over the diamond's left point");
+        // The mask is the triangle above the line from (0, 0) to (100, 100), and the art lies inside it.
+        let (d, g) = clipped(&[(0.0, 0.0), (100.0, 0.0), (100.0, 100.0)], false, Rect::new(55.0, 40.0, 70.0, 50.0));
+        assert_eq!(marquee(&d, Rect::new(40.0, 45.0, 60.0, 70.0), None, false), vec![g]);
+    }
+
+    /// #2345: the objects of a layer or sublayer with a clipping mask are touched only where the
+    /// mask shows them, as in a clip group.
+    #[test]
+    fn a_marquee_leaves_art_a_layer_clips_away() {
+        for sublayer in [false, true] {
+            let mut d = Document::new(300.0, 200.0);
+            let l = d.layers[0].id;
+            let beside = d.alloc_id();
+            d.insert(Some(l), 0, Node::path(beside, shapes::rectangle(Rect::new(150.0, 80.0, 190.0, 130.0)), Appearance::default_art())).unwrap();
+            let masked = d.alloc_id();
+            let mut layer = Node::layer(masked, "Masked", crate::LayerColor::Preset(2));
+            layer.set_clips(true);
+            d.insert(sublayer.then_some(l), 9, layer).unwrap();
+            let (mask, art) = half_clipped(&mut d);
+            let (mask_id, art_id) = (mask.id, art.id);
+            d.insert(Some(masked), 0, mask).unwrap();
+            d.insert(Some(masked), 1, art).unwrap();
+            assert!(marquee(&d, Rect::new(150.0, -10.0, 210.0, 50.0), None, false).is_empty(), "sublayer: {sublayer}");
+            assert_eq!(marquee(&d, Rect::new(140.0, 70.0, 195.0, 140.0), None, false), vec![beside], "sublayer: {sublayer}");
+            assert_eq!(marquee(&d, Rect::new(50.0, -10.0, 160.0, 10.0), None, false), vec![mask_id, art_id], "sublayer: {sublayer}");
+        }
+    }
+
+    /// A marquee touches a Shaper Group only by the art it shows, as clicks do ([`may_hit`]): over
+    /// the original shape of a face the group erased it selects nothing, with Group Selection's
+    /// leaves too, and over a face it shows it takes the group. With the original shapes isolated
+    /// (Construction mode) it takes the original shape it reaches.
+    #[test]
+    fn a_marquee_leaves_a_shaper_group_by_its_original_shapes() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        // Two original squares, 0..100 and 50..150; the group shows only the first one's face.
+        let square = |x: f64| shapes::rectangle(Rect::new(x, 0.0, x + 100.0, 100.0));
+        let a = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        let b = Node::path(d.alloc_id(), square(50.0), Appearance::default_art());
+        let b_id = b.id;
+        let mut sources = Node::group(d.alloc_id(), vec![Arc::new(a), Arc::new(b)]);
+        sources.name = Some(crate::shaper::SOURCES.into());
+        sources.opacity = 0.0;
+        let sources_id = sources.id;
+        let mut face = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        face.name = Some(format!("{}0", crate::shaper::FILL_PREFIX));
+        let face_id = face.id;
+        let g = d.alloc_id();
+        let mut group = Node::group(g, vec![Arc::new(sources), Arc::new(face)]);
+        group.extras_mut().shaper = Some(Box::default());
+        d.insert(Some(l), 0, group).unwrap();
+        // This marquee crosses only the right edge of the second square, whose face is erased.
+        let erased = Rect::new(140.0, 40.0, 160.0, 60.0);
+        assert!(hit_test(&d, Point::new(150.0, 50.0), HitOptions::default()).is_none(), "a click there misses");
+        assert!(marquee(&d, erased, None, false).is_empty());
+        assert!(marquee(&d, erased, None, true).is_empty());
+        assert!(marquee(&d, erased, Some(g), false).is_empty());
+        // This marquee crosses the shown face's left edge.
+        let shown = Rect::new(-10.0, 40.0, 10.0, 60.0);
+        assert_eq!(marquee(&d, shown, None, false), vec![g]);
+        assert_eq!(marquee(&d, shown, None, true), vec![face_id]);
+        assert_eq!(marquee(&d, shown, Some(g), false), vec![face_id]);
+        // Construction mode: the original shapes are the objects.
+        assert_eq!(marquee(&d, erased, Some(sources_id), false), vec![b_id]);
+    }
+
+    /// A marquee touches an Intertwine group by its members, as it touches a plain group (#1103) and
+    /// as clicks do: in the gap between two members, or inside one member's fill, it selects nothing.
+    /// Across a member's edge it selects the group, and with the leaves that Direct and Group
+    /// Selection take, or in isolation mode, it selects the member.
+    #[test]
+    fn a_marquee_meets_an_intertwine_group_by_its_members() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        // Two squares, 0..100 and 150..250, with a gap between them inside the group's box.
+        let square = |x: f64| shapes::rectangle(Rect::new(x, 0.0, x + 100.0, 100.0));
+        let mut a = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        a.extras_mut().intertwine = Some(Box::new(shapes::rectangle(Rect::new(50.0, 0.0, 100.0, 100.0))));
+        let b = Node::path(d.alloc_id(), square(150.0), Appearance::default_art());
+        let (a_id, g) = (a.id, d.alloc_id());
+        d.insert(Some(l), 0, Node::new(g, NodeKind::Intertwine { children: vec![Arc::new(a), Arc::new(b)] })).unwrap();
+        let gap = Rect::new(110.0, 40.0, 140.0, 60.0);
+        assert!(hit_test(&d, gap.center(), HitOptions::default()).is_none(), "a click in the gap misses");
+        assert!(marquee(&d, gap, None, false).is_empty());
+        assert!(marquee(&d, gap, None, true).is_empty());
+        assert!(marquee(&d, gap, Some(g), false).is_empty());
+        assert!(marquee(&d, Rect::new(20.0, 20.0, 40.0, 40.0), None, false).is_empty(), "inside a member's fill");
+        // This marquee crosses the first square's left edge.
+        let edge = Rect::new(-10.0, 40.0, 10.0, 60.0);
+        assert_eq!(marquee(&d, edge, None, false), vec![g]);
+        assert_eq!(marquee(&d, edge, None, true), vec![a_id]);
+        assert_eq!(marquee(&d, edge, Some(g), false), vec![a_id]);
+    }
+
+    /// A marquee touches a repeat by the copies it draws, as clicks do: between two copies of a
+    /// grid repeat it selects nothing, and across a copy's edge it takes the repeat.
+    #[test]
+    fn a_marquee_meets_a_repeat_by_its_copies() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        let source = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 20.0, 20.0)), Appearance::default_art());
+        // Copies at 0..20, 40..60 and 80..100.
+        let kind = crate::pattern::RepeatKind::Grid {
+            h_spacing: 20.0,
+            v_spacing: 20.0,
+            rows: 1,
+            cols: 3,
+            grid_type: crate::pattern::TileType::Grid,
+            flip_rows: false,
+            flip_cols: false,
+        };
+        let r = d.alloc_id();
+        d.insert(Some(l), 0, Node::new(r, NodeKind::Repeat(crate::pattern::RepeatSpec { kind, source: vec![Arc::new(source)] }))).unwrap();
+        let gap = Rect::new(25.0, 5.0, 35.0, 15.0);
+        assert!(hit_test(&d, gap.center(), HitOptions::default()).is_none(), "a click between copies misses");
+        assert!(marquee(&d, gap, None, false).is_empty());
+        assert!(marquee(&d, gap, None, true).is_empty());
+        assert_eq!(marquee(&d, Rect::new(35.0, 5.0, 45.0, 15.0), None, false), vec![r], "across the second copy's left edge");
+        assert_eq!(marquee(&d, Rect::new(35.0, 5.0, 45.0, 15.0), None, true), vec![r]);
+    }
+
+    /// A blend and an envelope are clicked anywhere in their box, and a marquee touches them there
+    /// too: inside the box, away from every key object's and the content's outline, it takes them.
+    #[test]
+    fn a_marquee_meets_blends_and_envelopes_by_their_box() {
+        let mut d = Document::new(300.0, 300.0);
+        let l = d.layers[0].id;
+        let square = |id, x: f64, y: f64| Arc::new(Node::path(id, shapes::rectangle(Rect::new(x, y, x + 20.0, y + 20.0)), Appearance::default_art()));
+        let blend = d.alloc_id();
+        let keys = vec![square(d.alloc_id(), 0.0, 0.0), square(d.alloc_id(), 100.0, 0.0)];
+        d.insert(Some(l), 0, Node::new(blend, NodeKind::Blend { children: keys, spec: Default::default() })).unwrap();
+        let envelope = d.alloc_id();
+        let content = vec![Arc::new(Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 150.0, 100.0, 250.0)), Appearance::default_art()))];
+        let e = Node::new(
+            envelope,
+            NodeKind::Envelope {
+                content,
+                kind: Box::new(crate::live::EnvelopeKind::Warp { style: "arc".to_string(), bend: 0.0, h: 0.0, v: 0.0, horizontal: true }),
+                fidelity: 100.0,
+                editing: false,
+                options: Default::default(),
+                frame: Box::new(vectorcraft_geom::Affine::IDENTITY),
+            },
+        );
+        d.insert(Some(l), 1, e).unwrap();
+        for (r, id) in [(Rect::new(50.0, 5.0, 60.0, 15.0), blend), (Rect::new(40.0, 190.0, 60.0, 210.0), envelope)] {
+            assert_eq!(hit_test(&d, r.center(), HitOptions::default()).map(|h| h.leaf), Some(id));
+            assert_eq!(marquee(&d, r, None, false), vec![id]);
+            assert_eq!(marquee(&d, r, None, true), vec![id]);
+        }
+    }
+
     /// Art in a sublayer is an object of its own: a click or a marquee takes it, not the
     /// sublayer; hidden, locked and template sublayers block both.
     #[test]

crates/doc/src/lib.rs

@@ -8,6 +8,7 @@
 pub mod appearance;
 pub mod assets;
 pub mod blend;
+pub mod cancel;
 pub mod clipnest;
 pub mod cmyk;
 pub mod corners;
@@ -21,13 +22,16 @@ mod inline;
 pub mod intertwine;
 pub mod shared;
 mod symbol_export_type;
+mod symbol_nine_slice;
 mod symbol_registration;
 pub use inline::{SYMBOL_HALF, SYMBOL_SIZES};
 pub use shared::Shared;
 pub use symbol_export_type::{SYMBOL_EXPORT_TYPE, SymbolExportType};
+pub use symbol_nine_slice::{SYMBOL_NINE_SLICE, SymbolNineSlice};
 pub use symbol_registration::{SYMBOL_REGISTRATION, SymbolRegistration};
 pub mod links;
 pub mod live;
+pub mod live_paint;
 pub mod marks;
 mod mem;
 pub mod metadata;
@@ -89,17 +93,18 @@ pub use assets::ExportAsset;
 pub use corners::LiveCorners;
 pub use depth::MAX_DEPTH;
 pub use graph::{
-    GraphDesign, GraphKind, GraphSpec, LabelStyles, MAX_GRAPH_CATEGORIES, MAX_GRAPH_SERIES, PiePosition, PieSort, SeriesPaint, TickLength,
-    ValueAxisSide,
+    ColumnDesign, ColumnType, Fractions, GraphDesign, GraphKind, GraphSpec, LabelStyles, MAX_GRAPH_CATEGORIES, MAX_GRAPH_SERIES, PiePosition,
+    PieSort, SeriesPaint, TickLength, ValueAxisSide,
 };
 pub use hit::{Hit, HitKind};
 pub use links::{LinkInfo, PlacementOptions};
 pub use live::{BlendOrientation, BlendSpacing, BlendSpec, EnvelopeKind, GradientMesh, MeshPoint};
+pub use live_paint::{GapOptions, GapSize};
 pub use metadata::{CopyrightStatus, DocMetadata};
 pub use node::Knockout;
 pub use node::Scaling;
 pub use node::{Extras, ExtrasMut, ImageObject, LAYER_COLORS, LayerColor, LiveShape, Node, NodeExtras, NodeId, NodeKind, OpacityMask};
-pub use node::{ImageMap, ObjectAttributes};
+pub use node::{ImageMap, MAX_SVG_SCRIPTS, ObjectAttributes, SVG_EVENTS};
 pub use orient::OrientedBox;
 pub use pattern::{Overlap, PatternDef, PatternEdit, RepeatKind, RepeatSpec, TileType};
 pub use perspective::PerspectiveAttachment;
@@ -112,9 +117,9 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, Digits, FirstBaseline, HyphenationOptions, InlineArt, Justify,
-    Kinsoku, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject,
-    TextRun, TextStyleDef, TextWrap, VerticalAlign, WrapShape,
+    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, Digits, FirstBaseline, HyphenationOptions, InlineArt,
+    JustificationOptions, Justify, Kinsoku, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics,
+    SingleWordJustify, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, VerticalAlign, WrapShape,
 };
 pub use trace::TraceView;
 pub use variables::{DataSet, DataValue, Variable, VariableKind, Variables};
@@ -269,7 +274,12 @@ impl Unit {
     pub fn named(name: &str) -> Option<Unit> {
         let letters = |s: &'static str| s.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_lowercase());
         let given = || name.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_lowercase());
-        Unit::ALL.into_iter().find(|u| letters(u.label()).eq(given()) || u.suffix().chars().eq(given()))
+        // Feet and Feet & Inches share the suffix `ft`: it names the plain unit, so Feet & Inches
+        // is left to its label and key.
+        Unit::ALL
+            .into_iter()
+            .find(|u| letters(u.label()).eq(given()))
+            .or_else(|| Unit::ALL.into_iter().filter(|u| *u != Unit::FeetInches).find(|u| u.suffix().chars().eq(given())))
     }
     /// A point value as the canvas measurement labels show it: two decimals and the suffix
     /// (`12.50 mm`).
@@ -591,6 +601,23 @@ pub struct ImageBlob {
     pub proxy: Option<Arc<Vec<u8>>>,
 }
 
+/// What the rulers measure from (View › Rulers): the active artboard's origin, the default of a
+/// new document, or one origin for the whole document.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RulerMode {
+    #[default]
+    Artboard,
+    Global,
+}
+
+impl RulerMode {
+    /// The mode of a document saved before the choice existed: global, as its rulers measured.
+    pub fn legacy() -> Self {
+        Self::Global
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Document {
     pub version: u32,
@@ -604,6 +631,15 @@ pub struct Document {
     /// The rulers' zero point in document coordinates. Moving it changes measurements, never art.
     #[serde(default, skip_serializing_if = "skip::is_default")]
     pub ruler_origin: Point,
+    /// View › Rulers › Change to Global / Artboard Rulers: whether the rulers and position fields
+    /// measure from [`Self::ruler_origin`] (global) or from the active artboard's own origin.
+    /// Documents saved before the choice existed measured globally and open that way.
+    #[serde(default = "RulerMode::legacy")]
+    pub rulers: RulerMode,
+    /// Artboard rulers' zero point of each artboard (by [`Artboard::id`]), as an offset from its
+    /// top-left corner; an artboard not listed measures from that corner.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub artboard_ruler_origins: BTreeMap<u32, Vec2>,
     #[serde(default)]
     pub color_mode: ColorMode,
     pub artboards: Vec<Artboard>,
@@ -694,6 +730,10 @@ pub struct Document {
     /// save time only, so changing the view never marks the document modified.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_view: Option<SavedView>,
+    /// View → Show Transparency Grid when the document was saved. Written at save time only,
+    /// like [`Document::last_view`]; older files open with the grid hidden.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub transparency_grid: bool,
     /// The layers, sublayers and groups open in the Layers panel when the document was saved; they
     /// reopen that way. `None`: the default, only the top-level layers open. Written at save time
     /// only, like [`Document::last_view`].
@@ -726,6 +766,10 @@ pub struct Document {
     /// export settings are Export for Screens' ([`Document::export_settings`]).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub assets: Vec<ExportAsset>,
+    /// Window › SVG Interactivity › Link JavaScript Files: the JavaScript files (paths or URLs, as
+    /// given) SVG export links with `<script>` elements, in order.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub svg_scripts: Vec<String>,
     /// Puppet Warp pins on the selected artwork while the tool edits it ([`PuppetPins`]): editing
     /// state, never saved.
     #[serde(skip)]
@@ -747,6 +791,14 @@ fn yes() -> bool {
     true
 }
 
+/// Is point `p` on the artboard at `rect`, its edges included, within a millionth of a point? This
+/// is the rule [`Document::art_on_artboard`] applies to art flush with an edge (#890), where
+/// `Rect::contains` leaves out the right and bottom edges.
+pub fn artboard_holds(rect: Rect, p: Point) -> bool {
+    let r = rect.inflate(1e-6, 1e-6);
+    r.x0 <= p.x && p.x <= r.x1 && r.y0 <= p.y && p.y <= r.y1
+}
+
 /// Listed nodes by parent: the parent's index path (empty for the top-level layers), then the index
 /// of each listed child in it, in order, with the child's place in the list.
 type Places = BTreeMap<Vec<usize>, Vec<(usize, usize)>>;
@@ -754,6 +806,12 @@ type Places = BTreeMap<Vec<usize>, Vec<(usize, usize)>>;
 pub const FORMAT_VERSION: u32 = 1;
 
 impl Document {
+    /// Document Raster Effects Settings › Resolution in ppi, 1 to 2400 (72 when the stored value
+    /// isn't a number).
+    pub fn raster_ppi(&self) -> f64 {
+        Some(self.raster_effects_ppi).filter(|v| v.is_finite()).unwrap_or(72.0).clamp(1.0, 2400.0)
+    }
+
     /// The ruler zero point, or zero on both axes when either stored coordinate is invalid.
     /// Rulers, coordinate fields and guide snapping use the same supported range.
     pub fn ruler_origin_or_zero(&self) -> Point {
@@ -761,6 +819,27 @@ impl Document {
         if origin.is_finite() && origin.x.abs() <= MAX_COORD && origin.y.abs() <= MAX_COORD { origin } else { Point::ZERO }
     }
 
+    /// Where the rulers measure from with artboard `index` active: [`Self::ruler_origin_or_zero`]
+    /// with global rulers; with artboard rulers that artboard's top-left corner moved by its own
+    /// offset (the first artboard's when `index` is out of range, the global zero point when the
+    /// document has no artboard or the result is out of the supported range).
+    pub fn ruler_origin_for(&self, index: usize) -> Point {
+        if self.rulers == RulerMode::Global {
+            return self.ruler_origin_or_zero();
+        }
+        let Some(ab) = self.artboards.get(index).or_else(|| self.artboards.first()) else { return self.ruler_origin_or_zero() };
+        let corner = Point::new(ab.rect.x0, ab.rect.y0);
+        let offset = self.artboard_ruler_origins.get(&ab.id).copied().unwrap_or(Vec2::ZERO);
+        let origin = corner + offset;
+        if origin.is_finite() && origin.x.abs() <= MAX_COORD && origin.y.abs() <= MAX_COORD {
+            origin
+        } else if corner.is_finite() && corner.x.abs() <= MAX_COORD && corner.y.abs() <= MAX_COORD {
+            corner
+        } else {
+            Point::ZERO
+        }
+    }
+
     /// A new RGB document with one artboard of `size` and one layer ("Layer 1").
     pub fn new(width: f64, height: f64) -> Self {
         Self::new_with_mode(width, height, ColorMode::Rgb)
@@ -775,6 +854,8 @@ impl Document {
             template: false,
             units: Unit::Points,
             ruler_origin: Point::ZERO,
+            rulers: RulerMode::Artboard,
+            artboard_ruler_origins: BTreeMap::new(),
             color_mode: mode,
             artboards: vec![Artboard {
                 id: 1,
@@ -812,6 +893,7 @@ impl Document {
             metadata: DocMetadata::default(),
             raster_effects: RasterEffectsSettings::default(),
             last_view: None,
+            transparency_grid: false,
             layers_open: None,
             color_profiles: ColorProfiles::default(),
             export_settings: Default::default(),
@@ -820,6 +902,7 @@ impl Document {
             slices_clip_to_artboard: true,
             print_setup: None,
             assets: vec![],
+            svg_scripts: vec![],
             puppet: None,
             dimensions: false,
             index: Default::default(),
@@ -1292,9 +1375,24 @@ impl Document {
         let symbols = self.symbol_boxes();
         self.layers.iter().fold(None, |acc, l| vectorcraft_geom::union_opt(acc, l.visual_bounds_with(&symbols)))
     }
-    /// Artboard index containing point `p` (topmost = last).
+    /// Artboard index containing point `p` (topmost = last), its edges included
+    /// ([`Document::artboard_holding`]).
     pub fn artboard_at(&self, p: Point) -> Option<usize> {
-        self.artboards.iter().rposition(|a| a.rect.contains(p))
+        self.artboard_holding(p, true)
+    }
+    /// Index of the artboard that holds point `p`: the first (the last when `topmost`) that holds it
+    /// inside or on its left or top edge, else the first (the last) that holds it by
+    /// [`artboard_holds`]: on its right or bottom edge, or within a millionth of a point outside an
+    /// edge. On an edge two artboards share, the artboard to the right of it or below it holds the
+    /// point, except at the end of the edge that lies on that artboard's bottom or right edge, such
+    /// as the point where both artboards' bottom edges meet; there the first (the last) holds it.
+    pub fn artboard_holding(&self, p: Point, topmost: bool) -> Option<usize> {
+        let pick = |on: &dyn Fn(Rect) -> bool| {
+            let on = |i: &usize| self.artboards.get(*i).is_some_and(|a| on(a.rect));
+            let mut all = 0..self.artboards.len();
+            if topmost { all.rfind(on) } else { all.find(on) }
+        };
+        pick(&|r| r.contains(p)).or_else(|| pick(&|r| artboard_holds(r, p)))
     }
     /// The art that moves with an artboard at `rect`: top-level objects (children of layers and
     /// sublayers) lying entirely inside it, with symbol instances measured by their art. Locked and
@@ -1626,6 +1724,37 @@ impl Document {
         self.clear_symbol_export_type(from);
         self.set_symbol_export_type(to, kind);
     }
+
+    /// Symbol Options › 9-slice guides for `name`: `None` when 9-slice scaling is off (default).
+    pub fn symbol_nine_slice(&self, name: &str) -> Option<SymbolNineSlice> {
+        self.unknown.get(SYMBOL_NINE_SLICE).and_then(|m| m.get(name)).and_then(SymbolNineSlice::from_value)
+    }
+
+    /// Turn 9-slice scaling on with `guides`, or off with `None`, for `name`.
+    pub fn set_symbol_nine_slice(&mut self, name: &str, guides: Option<SymbolNineSlice>) {
+        let Some(g) = guides else {
+            let Some(o) = self.unknown.get_mut(SYMBOL_NINE_SLICE).and_then(|m| m.as_object_mut()) else { return };
+            o.remove(name);
+            if o.is_empty() {
+                self.unknown.remove(SYMBOL_NINE_SLICE);
+            }
+            return;
+        };
+        let m = self.unknown.entry(SYMBOL_NINE_SLICE.to_string()).or_insert_with(|| serde_json::json!({}));
+        if let Some(o) = m.as_object_mut() {
+            o.insert(name.into(), g.to_value());
+        }
+    }
+
+    /// Move the stored 9-slice guides when a symbol is renamed.
+    pub fn rename_symbol_nine_slice(&mut self, from: &str, to: &str) {
+        if from == to {
+            return;
+        }
+        let g = self.symbol_nine_slice(from);
+        self.set_symbol_nine_slice(from, None);
+        self.set_symbol_nine_slice(to, g);
+    }
 }
 
 fn default_graphic_styles() -> Vec<GraphicStyle> {
@@ -1744,6 +1873,44 @@ mod tests {
         assert_eq!(d.art_on_artboard(Rect::new(0.0, 0.0, 15.0, 15.0), false), vec![id]);
     }
 
+    #[test]
+    fn artboard_at_counts_the_right_and_bottom_edges() {
+        // Artboard 0 is (0, 0) to (100, 100), artboard 1 is to its right and artboard 2 below it.
+        let mut d = Document::new(100.0, 100.0);
+        for rect in [Rect::new(100.0, 0.0, 200.0, 100.0), Rect::new(0.0, 100.0, 100.0, 200.0)] {
+            let mut a = d.artboards[0].clone();
+            a.rect = rect;
+            d.artboards.push(a);
+        }
+        let held = |d: &Document, x: f64, y: f64| (d.artboard_at(Point::new(x, y)), d.artboard_holding(Point::new(x, y), false));
+        // Each artboard's own right and bottom edges, edges with roundoff, and points beyond them.
+        assert_eq!(held(&d, 200.0, 50.0), (Some(1), Some(1)), "right edge");
+        assert_eq!(held(&d, 150.0, 100.0), (Some(1), Some(1)), "bottom edge");
+        assert_eq!(held(&d, 200.0, 100.0), (Some(1), Some(1)), "bottom right corner");
+        assert_eq!(held(&d, 100.0, 150.0), (Some(2), Some(2)), "right edge");
+        assert_eq!(held(&d, 50.0, 200.0 + 1e-9), (Some(2), Some(2)), "roundoff past the bottom edge");
+        assert_eq!(held(&d, -1e-9, 50.0), (Some(0), Some(0)), "roundoff past the left edge");
+        assert_eq!(held(&d, 200.001, 50.0), (None, None));
+        assert_eq!(held(&d, 50.0, 200.001), (None, None));
+        // On an edge two artboards share, the artboard to the right of it or below it holds the
+        // point, in either list order, except at the end of the edge that lies on that artboard's
+        // bottom or right edge.
+        assert_eq!(held(&d, 100.0, 50.0), (Some(1), Some(1)));
+        assert_eq!(held(&d, 50.0, 100.0), (Some(2), Some(2)));
+        // The bottom edges of artboards 0 and 1 meet at (100, 100), which is also artboard 2's top
+        // right corner: the first holds the point, or the last when `topmost`.
+        assert_eq!(held(&d, 100.0, 100.0), (Some(2), Some(0)), "shared corner");
+        d.artboards.swap(0, 1);
+        assert_eq!(held(&d, 100.0, 50.0), (Some(0), Some(0)));
+        // Where two artboards overlap, the topmost holds the point, or the first one when not
+        // `topmost`.
+        let mut inner = d.artboards[1].clone();
+        inner.rect = Rect::new(10.0, 10.0, 90.0, 90.0);
+        d.artboards.push(inner);
+        assert_eq!(held(&d, 50.0, 50.0), (Some(3), Some(1)));
+        assert_eq!(held(&d, 90.0, 50.0), (Some(1), Some(1)), "inside artboard 1, on the right edge of artboard 3");
+    }
+
     #[test]
     fn find_and_paths() {
         let (d, a, b) = doc_with_rects();

crates/doc/src/live.rs

@@ -730,19 +730,35 @@ impl GradientMesh {
             .to_point()
     }
 
-    /// Bilinear colour and opacity of patch (r, c) at local (u, v).
+    /// Bilinear colour and opacity of patch (r, c) at local (u, v). Corners all in CMYK (or all
+    /// grey) mix in that space, as a PDF shading mixes in its own colour space: the inks come out
+    /// exact, and a CMYK document separates no colour to draw them. Other corners mix in RGB.
     pub fn color_at(&self, r: usize, c: usize, u: f64, v: f64) -> (Color, f32) {
         let q =
             [&self.points[self.idx(r, c)], &self.points[self.idx(r, c + 1)], &self.points[self.idx(r + 1, c)], &self.points[self.idx(r + 1, c + 1)]];
         let w = [(1.0 - u) * (1.0 - v), u * (1.0 - v), (1.0 - u) * v, u * v];
+        let op = q.iter().zip(w).map(|(p, w)| p.opacity * w as f32).sum();
+        let cmyk: Option<Vec<[f32; 4]>> =
+            q.iter().map(|p| if let Color::Cmyk { c, m, y, k } = p.color { Some([c, m, y, k]) } else { None }).collect();
+        if let Some(inks) = cmyk {
+            let mut mix = [0.0f32; 4];
+            for (ink, w) in inks.iter().zip(w) {
+                for (m, x) in mix.iter_mut().zip(ink) {
+                    *m += x * w as f32;
+                }
+            }
+            let [c, m, y, k] = mix;
+            return (Color::Cmyk { c, m, y, k }, op);
+        }
+        let grey: Option<Vec<f32>> = q.iter().map(|p| if let Color::Gray { k } = p.color { Some(k) } else { None }).collect();
+        if let Some(ks) = grey {
+            return (Color::Gray { k: ks.iter().zip(w).map(|(k, w)| k * w as f32).sum() }, op);
+        }
         let mut rgb = [0.0f32; 3];
-        let mut op = 0.0f32;
-        for k in 0..4 {
-            let c = q[k].color.to_rgb();
-            for (ch, x) in rgb.iter_mut().zip(c) {
-                *ch += x * w[k] as f32;
+        for (p, w) in q.iter().zip(w) {
+            for (ch, x) in rgb.iter_mut().zip(p.color.to_rgb()) {
+                *ch += x * w as f32;
             }
-            op += q[k].opacity * w[k] as f32;
         }
         (Color::rgb(rgb[0], rgb[1], rgb[2]), op)
     }
@@ -1823,4 +1839,19 @@ mod tests {
         assert!(m.remove_point_lines(i));
         assert_eq!((m.rows, m.cols), (1, 1));
     }
+
+    /// Corners all in CMYK mix in CMYK (the inks halfway), not in RGB.
+    #[test]
+    fn a_cmyk_mesh_mixes_its_inks() {
+        let cyan = Color::Cmyk { c: 1.0, m: 0.0, y: 0.0, k: 0.0 };
+        let mut m = GradientMesh::for_path(&shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), 1, 1, cyan, MeshAppearance::Flat, 0.0).unwrap();
+        m.points[0].color = Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k: 1.0 };
+        let (c, op) = m.color_at(0, 0, 0.0, 0.0);
+        assert_eq!((c, op), (Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k: 1.0 }, 1.0));
+        let Color::Cmyk { c, k, .. } = m.color_at(0, 0, 0.5, 0.5).0 else { panic!("mixed out of CMYK") };
+        assert!((c - 0.75).abs() < 1e-6 && (k - 0.25).abs() < 1e-6, "{c} {k}");
+        // A corner in another space mixes them all in RGB.
+        m.points[1].color = Color::rgb(1.0, 0.0, 0.0);
+        assert!(matches!(m.color_at(0, 0, 0.5, 0.5).0, Color::Rgb { .. }));
+    }
 }

crates/doc/src/live_paint.rs

@@ -0,0 +1,130 @@
+//! Live Paint groups' Gap Options (Object › Live Paint › Gap Options): whether paint stops at small
+//! gaps between the group's paths, how wide a gap it stops at, and the color gaps preview in.
+//! A group without options has Gap Detection off.
+
+use serde::{Deserialize, Serialize};
+
+use crate::node::{LAYER_COLORS, Node};
+
+/// Paint Stops At: the widest gap Gap Detection closes.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum GapSize {
+    /// Small Gaps: [`GapSize::SMALL`] points.
+    #[default]
+    Small,
+    /// Medium Gaps: [`GapSize::MEDIUM`] points.
+    Medium,
+    /// Large Gaps: [`GapSize::LARGE`] points.
+    Large,
+    /// Custom: this many points, over 0 up to [`GapSize::MAX`].
+    Custom(f64),
+}
+
+impl GapSize {
+    pub const SMALL: f64 = 3.0;
+    pub const MEDIUM: f64 = 6.0;
+    pub const LARGE: f64 = 12.0;
+    /// The widest custom gap.
+    pub const MAX: f64 = 72.0;
+
+    /// The preset sizes with their ids, smallest first.
+    pub const PRESETS: [(Self, &'static str); 3] = [(Self::Small, "small"), (Self::Medium, "medium"), (Self::Large, "large")];
+
+    /// The widest gap it closes, in points.
+    pub fn points(self) -> f64 {
+        match self {
+            Self::Small => Self::SMALL,
+            Self::Medium => Self::MEDIUM,
+            Self::Large => Self::LARGE,
+            Self::Custom(pt) => pt,
+        }
+    }
+
+    /// The id of a preset size (`small`, `medium` or `large`); None for a custom size.
+    pub fn id(self) -> Option<&'static str> {
+        Self::PRESETS.iter().find(|(s, _)| *s == self).map(|(_, id)| *id)
+    }
+
+    /// A preset size by its id (any case), or a custom size from a number of points over 0 up to
+    /// [`GapSize::MAX`].
+    pub fn parse(v: &serde_json::Value) -> Option<Self> {
+        match v {
+            serde_json::Value::String(id) => Self::PRESETS.iter().find(|(_, i)| i.eq_ignore_ascii_case(id.trim())).map(|(s, _)| *s),
+            v => v.as_f64().filter(|pt| *pt > 0.0 && *pt <= Self::MAX).map(Self::Custom),
+        }
+    }
+}
+
+/// Gap Preview Color for a group that has none set: the layer color Red.
+pub const DEFAULT_GAP_COLOR: [u8; 3] = LAYER_COLORS[1].1;
+
+/// A Live Paint group's Gap Options.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct GapOptions {
+    /// Gap Detection: paint stops at gaps up to `size` wide.
+    pub detect: bool,
+    /// Paint Stops At.
+    pub size: GapSize,
+    /// Gap Preview Color: the color gaps show in.
+    pub color: [u8; 3],
+}
+
+impl Default for GapOptions {
+    fn default() -> Self {
+        Self { detect: false, size: GapSize::Small, color: DEFAULT_GAP_COLOR }
+    }
+}
+
+impl GapOptions {
+    /// The widest gap paint stops at, in points; None with Gap Detection off.
+    pub fn max_gap(&self) -> Option<f64> {
+        self.detect.then(|| self.size.points())
+    }
+}
+
+impl Node {
+    /// The Gap Options of a Live Paint group (the defaults when it has none set).
+    pub fn gap_options(&self) -> GapOptions {
+        self.extras().live_paint_gaps.as_deref().copied().unwrap_or_default()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn sizes_parse_from_ids_and_points() {
+        for (size, id) in GapSize::PRESETS {
+            assert_eq!(GapSize::parse(&json!(id)), Some(size));
+            assert_eq!(GapSize::parse(&json!(id.to_ascii_uppercase())), Some(size));
+            assert_eq!(size.id(), Some(id));
+        }
+        assert_eq!(GapSize::parse(&json!("Medium")).map(GapSize::points), Some(6.0));
+        assert_eq!(GapSize::parse(&json!("large")).map(GapSize::points), Some(12.0));
+        assert_eq!(GapSize::parse(&json!(4.5)), Some(GapSize::Custom(4.5)));
+        assert_eq!(GapSize::Custom(4.5).points(), 4.5);
+        assert_eq!(GapSize::Custom(4.5).id(), None);
+        for bad in [json!(0), json!(-1), json!(72.5), json!("tiny"), json!(null), json!(true)] {
+            assert_eq!(GapSize::parse(&bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn options_round_trip_and_default_to_no_detection() {
+        let mut g = Node::group(crate::NodeId(1), vec![]);
+        assert_eq!(g.gap_options(), GapOptions::default());
+        assert_eq!(g.gap_options().max_gap(), None);
+        let set = GapOptions { detect: true, size: GapSize::Custom(5.0), color: [1, 2, 3] };
+        g.extras_mut().live_paint_gaps = Some(Box::new(set));
+        assert_eq!(g.gap_options().max_gap(), Some(5.0));
+        let text = serde_json::to_string(&g).unwrap();
+        let back: Node = serde_json::from_str(&text).unwrap();
+        assert_eq!(back.gap_options(), set);
+        let bare: GapOptions = serde_json::from_value(json!({"detect": true})).unwrap();
+        assert_eq!(bare, GapOptions { detect: true, ..GapOptions::default() });
+    }
+}

crates/doc/src/mem.rs

@@ -250,6 +250,7 @@ fn node_bytes(n: &Node, other: Option<&Node>) -> usize {
     if let Some(e) = n.extras_box() {
         b += ALLOC + size_of::<NodeExtras>();
         b += boxed(&e.mask) + boxed(&e.graph) + boxed(&e.shaper) + boxed(&e.attrs) + boxed(&e.slice) + boxed(&e.perspective);
+        b += boxed(&e.dimension) + boxed(&e.live_paint_gaps);
         b += e.trace.as_ref().map_or(0, |t| ALLOC + size_of::<Value>() + json_bytes(t));
         b += e.intertwine.as_deref().map_or(0, |a| ALLOC + size_of::<PathData>() + path_bytes(a));
     }

crates/doc/src/node.rs

@@ -570,6 +570,8 @@ pub struct NodeExtras {
     /// Object › Intertwine: as a member of an Intertwine group, the area (document coordinates,
     /// filled non-zero) where this object is drawn over the group's other members.
     pub intertwine: Option<Box<PathData>>,
+    /// Live Paint group: its Gap Options (Object › Live Paint › Gap Options; `None`: the defaults).
+    pub live_paint_gaps: Option<Box<crate::live_paint::GapOptions>>,
 }
 
 /// No extras: what [`Node::extras`] gives for a node without any.
@@ -587,6 +589,7 @@ static NO_EXTRAS: NodeExtras = NodeExtras {
     perspective: None,
     dimension: None,
     intertwine: None,
+    live_paint_gaps: None,
 };
 
 /// A node's [`NodeExtras`], if it has any ([`Node::extras`]). Extras that are all unset equal
@@ -720,6 +723,7 @@ impl Serialize for Node {
             e.perspective.is_none(),
             e.dimension.is_none(),
             e.intertwine.is_none(),
+            e.live_paint_gaps.is_none(),
         ];
         let mut st = s.serialize_struct("Node", skips.iter().filter(|s| !**s).count())?;
         let mut skip = skips.into_iter();
@@ -757,6 +761,7 @@ impl Serialize for Node {
         field!("perspective", &e.perspective);
         field!("dimension", &e.dimension);
         field!("intertwine", &e.intertwine);
+        field!("live_paint_gaps", &e.live_paint_gaps);
         st.end()
     }
 }
@@ -814,6 +819,8 @@ struct NodeWire {
     dimension: Option<Box<crate::dimension::Dimension>>,
     #[serde(default)]
     intertwine: Option<Box<PathData>>,
+    #[serde(default)]
+    live_paint_gaps: Option<Box<crate::live_paint::GapOptions>>,
 }
 
 impl From<NodeWire> for Node {
@@ -832,6 +839,7 @@ impl From<NodeWire> for Node {
             perspective: w.perspective,
             dimension: w.dimension,
             intertwine: w.intertwine,
+            live_paint_gaps: w.live_paint_gaps,
         };
         Node {
             id: w.id,
@@ -1706,8 +1714,41 @@ pub struct ObjectAttributes {
     /// `("pivot", "100,180")`), kept from import to export (`object.setProps {data}`).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub data: Vec<(String, String)>,
+    /// Window › SVG Interactivity: the JavaScript each event runs, in the panel's order
+    /// (`("onclick", "alert(1)")`, one entry per event of [`SVG_EVENTS`]). SVG export writes them as
+    /// the element's event attributes; nothing in VectorCraft runs them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub events: Vec<(String, String)>,
 }
 
+/// The events the SVG Interactivity panel attaches JavaScript to, by the names of the SVG event
+/// attributes that run it.
+pub const SVG_EVENTS: [&str; 19] = [
+    "onfocusin",
+    "onfocusout",
+    "onactivate",
+    "onmousedown",
+    "onmouseup",
+    "onclick",
+    "onmouseover",
+    "onmousemove",
+    "onmouseout",
+    "onkeydown",
+    "onkeypress",
+    "onkeyup",
+    "onload",
+    "onerror",
+    "onabort",
+    "onunload",
+    "onzoom",
+    "onresize",
+    "onscroll",
+];
+
+/// The most JavaScript files a document links (`Document::svg_scripts`): SVG import keeps the
+/// first ones and warns about the rest, and `svgInteractivity.addFile` refuses another.
+pub const MAX_SVG_SCRIPTS: usize = 64;
+
 /// The Attributes panel's Image Map shapes.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
@@ -2022,6 +2063,7 @@ mod tests {
             e.attrs = Some(Box::default());
             e.slice = Some(Box::default());
             e.perspective = Some(Box::new(crate::PerspectiveAttachment::new("left", 1.0)));
+            e.live_paint_gaps = Some(Box::default());
         }
         /// The top-level keys of a JSON object, in the order written.
         struct Keys(Vec<String>);
@@ -2063,6 +2105,7 @@ mod tests {
             "slice",
             "bbox_angle",
             "perspective",
+            "live_paint_gaps",
         ];
         assert_eq!(keys, order);
         assert_eq!(serde_json::from_value::<Node>(v).unwrap(), n);

crates/doc/src/pattern.rs

@@ -248,9 +248,20 @@ impl PatternDef {
         let ab = self.art_bounds().unwrap_or(self.tile).union(self.tile) - self.tile.origin().to_vec2();
         let (sx, sy) = self.tile_type.steps(w, h);
         // Shifts of brick/hex rows or columns are < one tile.
-        let (i0, i1) = (((region.x0 - ab.x1 - w) / sx).floor() as i64 - 1, ((region.x1 - ab.x0 + w) / sx).ceil() as i64 + 1);
-        let (j0, j1) = (((region.y0 - ab.y1 - h) / sy).floor() as i64 - 1, ((region.y1 - ab.y0 + h) / sy).ceil() as i64 + 1);
-        if (i1 - i0).saturating_mul(j1 - j0) > 250_000 {
+        // A region whose tile indices do not fit in integers (or are not finite) gives none, as does
+        // one with more than 250,000 positions or none.
+        let index = |v: f64| (v.abs() < 9.0e18).then_some(v as i64);
+        let (Some(i0), Some(i1), Some(j0), Some(j1)) = (
+            index(((region.x0 - ab.x1 - w) / sx).floor()),
+            index(((region.x1 - ab.x0 + w) / sx).ceil()),
+            index(((region.y0 - ab.y1 - h) / sy).floor()),
+            index(((region.y1 - ab.y0 + h) / sy).ceil()),
+        ) else {
+            return vec![];
+        };
+        let (i0, i1, j0, j1) = (i0 - 1, i1 + 1, j0 - 1, j1 + 1);
+        let (ni, nj) = (i1.saturating_sub(i0), j1.saturating_sub(j0));
+        if ni < 1 || nj < 1 || ni.saturating_mul(nj) > 250_000 {
             return vec![];
         }
         let mut out = vec![];
@@ -282,8 +293,15 @@ impl PatternDef {
         out
     }
     /// Instances covering `region` (document space) as plain nodes for a pattern painted with
-    /// `paint_xf` (pattern space → document), fresh-id-less (id 0). Used by exporters and Expand.
+    /// `paint_xf` (pattern space → document), fresh-id-less (id 0). Used by exporters and Distort
+    /// Pattern Fills; Expand uses [`Self::instances_in_with`].
     pub fn instances_in(&self, paint_xf: Affine, region: Rect) -> Vec<Node> {
+        self.instances_in_with(paint_xf, region, false)
+    }
+    /// [`Self::instances_in`], each instance placed with `scaling` (what scales with `paint_xf`
+    /// besides geometry).
+    pub fn instances_in_with(&self, paint_xf: Affine, region: Rect, scaling: impl Into<crate::node::Scaling>) -> Vec<Node> {
+        let scaling = scaling.into();
         let inv = paint_xf.inverse();
         let pr = inv.transform_rect_bbox(region);
         let mut out = vec![];
@@ -291,7 +309,7 @@ impl PatternDef {
             let m = paint_xf * self.instance_xf(o);
             for a in &self.art {
                 let mut n = (**a).clone();
-                n.transform(m, false);
+                place_art(&mut n, m, scaling);
                 zero_ids(&mut n);
                 out.push(n);
             }
@@ -300,6 +318,31 @@ impl PatternDef {
     }
 }
 
+/// Transform pattern art `n` by `m` with `scaling`, as a pattern places its art: the opacity masks
+/// in it move with it, unlinked ones included (the canvas draws a tile's art and masks together).
+pub fn place_art(n: &mut Node, m: Affine, scaling: impl Into<crate::node::Scaling>) {
+    let scaling = scaling.into();
+    n.transform(m, scaling);
+    place_unlinked_masks(n, m, scaling);
+}
+
+/// Transform the art of the unlinked opacity masks of `n` and its descendants by `m`, the masks
+/// inside mask art included.
+fn place_unlinked_masks(n: &mut Node, m: Affine, scaling: crate::node::Scaling) {
+    if let Some(mask) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        let linked = mask.linked;
+        let art = Arc::make_mut(&mut mask.art);
+        // A linked mask's art moved with `n`; an unlinked one's moves here.
+        if !linked {
+            art.transform(m, scaling);
+        }
+        place_unlinked_masks(art, m, scaling);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        place_unlinked_masks(Arc::make_mut(c), m, scaling);
+    }
+}
+
 fn zero_ids(n: &mut Node) {
     n.id = NodeId(0);
     if let Some(ch) = n.children_mut() {
@@ -670,6 +713,18 @@ mod tests {
         assert!(close(*d2.offsets_covering(Rect::new(0.0, 0.0, 30.0, 20.0)).last().unwrap(), Vec2::new(20.0, 10.0)));
     }
 
+    #[test]
+    fn a_region_too_large_to_count_has_no_offsets() {
+        // A pattern scaled by 1e-20 covers a 100 pt square with a region of 1e22 pt.
+        let def = PatternDef::new("p", vec![sq(0.0, 0.0, 10.0)]);
+        assert!(def.offsets_covering(Rect::new(-1e22, -1e22, 1e22, 1e22)).is_empty());
+        assert!(def.offsets_covering(Rect::new(f64::NEG_INFINITY, 0.0, f64::INFINITY, 10.0)).is_empty());
+        // Far out, a region one tile wide and 1e12 pt tall still counts its rows.
+        assert!(def.offsets_covering(Rect::new(1e18, 0.0, 1e18, 1e12)).is_empty());
+        let tiny = Affine::scale(1e-20);
+        assert!(def.instances_in(tiny, Rect::new(0.0, 0.0, 100.0, 100.0)).is_empty());
+    }
+
     #[test]
     fn instances_follow_paint_xf() {
         let def = PatternDef::new("p", vec![sq(100.0, 100.0, 10.0)]);
@@ -679,6 +734,33 @@ mod tests {
         assert!(n.iter().all(|n| n.id == NodeId(0)));
     }
 
+    #[test]
+    fn instances_carry_unlinked_masks_with_them() {
+        let mut art = (*sq(100.0, 100.0, 10.0)).clone();
+        let mut mask = crate::node::OpacityMask::new((*sq(100.0, 100.0, 5.0)).clone(), true);
+        mask.linked = false;
+        art.extras_mut().mask = Some(Box::new(mask));
+        let def = PatternDef::new("p", vec![Arc::new(art)]);
+        for n in def.instances_in(Affine::translate((3.0, 0.0)), Rect::new(0.0, 0.0, 20.0, 10.0)) {
+            let (b, m) = (n.geometric_bounds().unwrap(), n.extras().mask.as_ref().unwrap());
+            assert_eq!(m.art.geometric_bounds().unwrap().origin(), b.origin(), "the mask moves with its art");
+            assert!(!m.linked, "the mask stays unlinked");
+        }
+        // An unlinked mask inside a linked mask's art moves too.
+        let mut inner = (*sq(100.0, 100.0, 5.0)).clone();
+        let mut nested = crate::node::OpacityMask::new((*sq(100.0, 100.0, 2.0)).clone(), true);
+        nested.linked = false;
+        inner.extras_mut().mask = Some(Box::new(nested));
+        let mut art = (*sq(100.0, 100.0, 10.0)).clone();
+        art.extras_mut().mask = Some(Box::new(crate::node::OpacityMask::new(inner, true)));
+        let def = PatternDef::new("p", vec![Arc::new(art)]);
+        for n in def.instances_in(Affine::translate((3.0, 0.0)), Rect::new(0.0, 0.0, 20.0, 10.0)) {
+            let outer = n.extras().mask.as_ref().unwrap();
+            let nested = outer.art.extras().mask.as_ref().unwrap();
+            assert_eq!(nested.art.geometric_bounds().unwrap().origin(), n.geometric_bounds().unwrap().origin());
+        }
+    }
+
     #[test]
     fn preview_offsets_count() {
         let mut def = PatternDef::new("p", vec![sq(0.0, 0.0, 10.0)]);

crates/doc/src/pixels.rs

@@ -11,15 +11,20 @@ use crate::ImageBlob;
 /// address and aborts when an allocation fails, so it keeps the decoder's own 512 MB.
 pub const MAX_RASTER_ALLOC: u64 = if cfg!(target_arch = "wasm32") { 512 << 20 } else { 2 << 30 };
 
-/// The pixels of encoded image `bytes` as RGBA; `None` when they can't be decoded or would take
-/// more than `max` bytes as RGBA. The size is read from the header first: the decoder's own limit
-/// is on the file's samples, and a grey image is a quarter of what it becomes here (#1717).
+/// The pixels of encoded image `bytes` as RGBA; `None` when they can't be decoded, would take
+/// more than `max` bytes as RGBA, or need more than `max` bytes to decode. The size is read from
+/// the header first: the decoder's limit is on the file's samples, and a gray image is a quarter
+/// of what it becomes here (#1717).
 fn rgba_within(bytes: &[u8], max: u64) -> Option<image::RgbaImage> {
     let (w, h) = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?.into_dimensions().ok()?;
     if u64::from(w) * u64::from(h) > max / 4 {
         return None;
     }
-    Some(image::load_from_memory(bytes).ok()?.to_rgba8())
+    let mut reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?;
+    let mut limits = image::Limits::default();
+    limits.max_alloc = Some(max);
+    reader.limits(limits);
+    Some(reader.decode().ok()?.into_rgba8())
 }
 
 impl ImageBlob {
@@ -74,6 +79,59 @@ impl ImageBlob {
         sample_pixels(&img, x * k(img.width(), object.0), y * k(img.height(), object.1), size)
     }
 
+    /// The colours of a `rows` × `cols` mesh laid over the image: `(rows + 1) * (cols + 1)` straight
+    /// RGBA samples, row-major, one per grid line crossing (row 0 is the top). Each is the
+    /// alpha-weighted average of the area around the crossing, one grid cell wide and high (a
+    /// quarter of each of the neighbouring cells), not a single pixel. A crossing over transparent
+    /// pixels gets their average colour at alpha 0. `None` when `rows` or `cols` is 0 or the
+    /// image can't be decoded.
+    pub fn grid_samples(&self, rows: u32, cols: u32) -> Option<Vec<[u8; 4]>> {
+        if rows == 0 || cols == 0 {
+            return None;
+        }
+        let img = self.decoded()?;
+        let (w, h) = (img.width() as usize, img.height() as usize);
+        if w == 0 || h == 0 {
+            return None;
+        }
+        // The pixel columns [from, to) around grid line `i` of `n`, at least one pixel wide.
+        let span = |i: u32, n: u32, len: usize| {
+            let at = |k: f64| (k / n as f64 * len as f64).round().clamp(0.0, len as f64) as usize;
+            let (from, to) = (at(i as f64 - 0.5), at(i as f64 + 0.5));
+            let from = from.min(len - 1);
+            (from, to.max(from + 1))
+        };
+        let mut out = Vec::with_capacity((rows as usize + 1) * (cols as usize + 1));
+        for r in 0..=rows {
+            let (y0, y1) = span(r, rows, h);
+            for c in 0..=cols {
+                let (x0, x1) = span(c, cols, w);
+                let (mut sum, mut plain, mut alpha, mut n) = ([0u64; 3], [0u64; 3], 0u64, 0u64);
+                for y in y0..y1 {
+                    for x in x0..x1 {
+                        let [pr, pg, pb, pa] = img.get_pixel(x as u32, y as u32).0;
+                        let a = pa as u64;
+                        for (k, v) in [pr, pg, pb].into_iter().enumerate() {
+                            sum[k] += v as u64 * a;
+                            plain[k] += v as u64;
+                        }
+                        alpha += a;
+                        n += 1;
+                    }
+                }
+                let n = n.max(1);
+                out.push(if alpha == 0 {
+                    let m = |k: usize| ((plain[k] + n / 2) / n) as u8;
+                    [m(0), m(1), m(2), 0]
+                } else {
+                    let m = |k: usize| ((sum[k] + alpha / 2) / alpha) as u8;
+                    [m(0), m(1), m(2), ((alpha + n / 2) / n) as u8]
+                });
+            }
+        }
+        Some(out)
+    }
+
     /// The decoded pixels (the last image decoded is kept for the next sample).
     fn decoded(&self) -> Option<Arc<image::RgbaImage>> {
         thread_local! {
@@ -131,6 +189,35 @@ mod tests {
         image::load_from_memory(&b.bytes).unwrap().to_rgba8().pixels().map(|p| p.0).collect()
     }
 
+    /// A GIF whose `w` × `h` screen holds one opaque red pixel at the top left. The file holds no
+    /// other pixels, and the decoder makes them transparent.
+    fn gif_with_one_red_pixel(w: u16, h: u16) -> Vec<u8> {
+        let mut gif = b"GIF89a".to_vec();
+        gif.extend_from_slice(&w.to_le_bytes());
+        gif.extend_from_slice(&h.to_le_bytes());
+        // Flags for a global color table of two colors, the background and aspect bytes, then the
+        // table: red and black.
+        gif.extend_from_slice(&[0x80, 0, 0, 255, 0, 0, 0, 0, 0]);
+        // A 1 × 1 image at (0, 0), its LZW data (clear, color 0, end), and the end of the file.
+        gif.extend_from_slice(&[0x2C, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2, 2, 0x44, 0x01, 0, 0x3B]);
+        gif
+    }
+
+    /// The pixels are decoded within the allowance, not within the decoder's own 512 MB: an RGBA
+    /// image of 11,586 × 11,586 pixels (536,941,584 bytes) is recolored and sampled.
+    #[test]
+    fn pixels_past_the_decoders_own_limit_are_decoded_within_the_allowance() {
+        let (w, h) = (11_586, 11_586);
+        let rgba = u64::from(w) * u64::from(h) * 4;
+        assert!(rgba > 512 << 20);
+        let gif = gif_with_one_red_pixel(w, h);
+        assert!(rgba_within(&gif, rgba - 1).is_none(), "past the allowance");
+        let b = ImageBlob::new("image/gif", gif);
+        assert!(b.map_rgb(|[r, g, bl]| [bl, g, r]).is_some(), "red becomes blue");
+        assert_eq!(b.sample(0.5, 0.5, 1), Some([255, 0, 0, 255]));
+        assert_eq!(b.sample(f64::from(w) - 0.5, f64::from(h) - 0.5, 1), None, "transparent");
+    }
+
     /// #1717: the RGBA size is checked from the header, before anything is decoded: a grey image
     /// the decoder's own limit lets through is four times that as RGBA.
     #[test]

crates/doc/src/placed_document.rs

@@ -430,7 +430,7 @@ fn art_id() -> crate::NodeId {
 }
 
 /// Visit `n` and every descendant (opacity-mask art included) mutably.
-fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
+pub(crate) fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
     f(n);
     if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
         each_mut(Arc::make_mut(&mut m.art), f);

crates/doc/src/setup.rs

@@ -192,6 +192,16 @@ impl Background {
 
 /// Largest bleed on any side, in points (1 inch).
 pub const MAX_BLEED: f64 = 72.0;
+/// Largest superscript or subscript size, and the farthest its baseline moves either way, in
+/// percent of the font size.
+pub const MAX_SCRIPT: f64 = 500.0;
+/// Largest synthesized small capitals size, in percent of the font size.
+pub const MAX_SMALL_CAPS: f64 = 200.0;
+
+/// Returns `bleed` with each side kept to 0–[`MAX_BLEED`] points; a side that isn't finite becomes 0.
+pub fn bleed_in_range(bleed: [f64; 4]) -> [f64; 4] {
+    bleed.map(|b| if b.is_finite() { b.clamp(0.0, MAX_BLEED) } else { 0.0 })
+}
 
 /// File → Document Setup.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -274,6 +284,18 @@ impl DocSetup {
     pub fn flattener(&self) -> &str {
         self.flattener_preset.as_deref().unwrap_or(DEFAULT_FLATTENER)
     }
+    /// Moves the bleed and the type proportions into the ranges Document Setup takes, each to the
+    /// nearer end: the bleed by [`bleed_in_range`], superscript and subscript sizes to
+    /// 1–[`MAX_SCRIPT`] and positions to ±[`MAX_SCRIPT`], the small caps size to
+    /// 1–[`MAX_SMALL_CAPS`].
+    pub fn keep_in_range(&mut self) {
+        self.bleed = bleed_in_range(self.bleed);
+        for m in [&mut self.superscript, &mut self.subscript] {
+            m.size = m.size.clamp(1.0, MAX_SCRIPT);
+            m.position = m.position.clamp(-MAX_SCRIPT, MAX_SCRIPT);
+        }
+        self.small_caps_size = self.small_caps_size.clamp(1.0, MAX_SMALL_CAPS);
+    }
 }
 
 #[cfg(test)]

crates/doc/src/symbol_nine_slice.rs

@@ -0,0 +1,57 @@
+//! Symbol Options › Enable Guides for 9-Slice Scaling: four guides that cut a symbol into a 3 × 3
+//! grid so that, in Animate / Flash handoff, the corners keep their size while the edges and the
+//! centre stretch
+//! ([helpx Symbol Options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-and-place-symbols.html)).
+//!
+//! The guides are stored as fractions (0..1) of the symbol's natural size, measured from the left
+//! and top edges and from the right and bottom edges, so they survive resizing the art. Like
+//! [`crate::SymbolExportType`] this is handoff metadata: instances place the same on the canvas.
+//! Stored under [`SYMBOL_NINE_SLICE`] keyed by symbol name; symbols without 9-slice have no entry.
+
+use serde_json::{Value, json};
+
+/// Document unknown key: `{ symbolName: [left, top, right, bottom] }`.
+pub const SYMBOL_NINE_SLICE: &str = "symbolNineSlice";
+
+/// The four 9-slice guides as fractions of the symbol's natural size.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct SymbolNineSlice {
+    /// Left guide, from the left edge.
+    pub left: f64,
+    /// Top guide, from the top edge.
+    pub top: f64,
+    /// Right guide, from the right edge.
+    pub right: f64,
+    /// Bottom guide, from the bottom edge.
+    pub bottom: f64,
+}
+
+impl Default for SymbolNineSlice {
+    /// The centre third of each axis is the stretchy cell.
+    fn default() -> Self {
+        let t = 1.0 / 3.0;
+        Self { left: t, top: t, right: t, bottom: t }
+    }
+}
+
+impl SymbolNineSlice {
+    /// Guides from `[left, top, right, bottom]`; `None` unless each is finite, within 0..1, and the
+    /// two on each axis leave a gap between them.
+    pub fn new(left: f64, top: f64, right: f64, bottom: f64) -> Option<Self> {
+        let ok = |v: f64| v.is_finite() && (0.0..=1.0).contains(&v);
+        (ok(left) && ok(top) && ok(right) && ok(bottom) && left + right < 1.0 && top + bottom < 1.0).then_some(Self { left, top, right, bottom })
+    }
+
+    pub fn to_value(self) -> Value {
+        json!([self.left, self.top, self.right, self.bottom])
+    }
+
+    pub fn from_value(v: &Value) -> Option<Self> {
+        let a = v.as_array()?;
+        let n = |i: usize| a.get(i).and_then(Value::as_f64);
+        if a.len() != 4 {
+            return None;
+        }
+        Self::new(n(0)?, n(1)?, n(2)?, n(3)?)
+    }
+}

crates/doc/src/tests_units.rs

@@ -98,6 +98,13 @@ fn units_are_named_by_label_key_or_suffix() {
     assert_eq!(Unit::named(""), None);
 }
 
+#[test]
+fn a_shared_suffix_names_the_plain_unit() {
+    assert_eq!(Unit::named(Unit::Feet.suffix()), Some(Unit::Feet));
+    assert_eq!(Unit::named("FT"), Some(Unit::Feet));
+    assert_eq!(Unit::named(Unit::FeetInches.label()), Some(Unit::FeetInches));
+}
+
 #[test]
 fn readouts_show_two_decimals() {
     assert_eq!(Unit::Points.readout(15.0), "15.00 pt");

crates/doc/src/text.rs

@@ -32,6 +32,11 @@ pub struct CharStyle {
     /// wouldn't pick (an imported file's type matched to it); None = the one they pick.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub font_version: Option<String>,
+    /// Variation axis settings of a variable font (Character panel › Variable Font), by axis tag
+    /// (`wght`, `wdth`), in the axis's own units. They replace the named instance's setting of
+    /// each axis they name; the other axes keep the style's settings. Empty: the style as it is.
+    #[serde(default, rename = "fontAxes", skip_serializing_if = "std::collections::BTreeMap::is_empty")]
+    pub font_axes: std::collections::BTreeMap<String, f64>,
     /// Size in points.
     pub size: f64,
     /// Leading in points; None = Auto (120% of size).
@@ -174,6 +179,18 @@ pub struct ScriptMetrics {
 
 impl ScriptMetrics {
     pub const DEFAULT: Self = Self { size: 58.3, position: 33.3 };
+    /// Returns these proportions with the size kept to 1 to 500% and the position kept to -500 to
+    /// 500%, the ranges `document.setup` takes for `superscript` and `subscript`. A value outside
+    /// its range becomes the nearer end.
+    pub fn in_range(self) -> Self {
+        Self { size: self.size.clamp(1.0, 500.0), position: self.position.clamp(-500.0, 500.0) }
+    }
+}
+
+/// Returns a small caps size kept to 1 to 200%, the range `document.setup` takes for
+/// `smallCapsSize`. A size outside it becomes the nearer end.
+fn small_caps_in_range(size: f64) -> f64 {
+    size.clamp(1.0, 200.0)
 }
 
 impl Default for ScriptMetrics {
@@ -210,6 +227,14 @@ impl CharPosition {
             CharPosition::Subscript(_) => "subscript",
         }
     }
+    /// Returns this position with its proportions kept by [`ScriptMetrics::in_range`].
+    pub fn in_range(self) -> Self {
+        match self {
+            CharPosition::Normal => CharPosition::Normal,
+            CharPosition::Superscript(m) => CharPosition::Superscript(m.in_range()),
+            CharPosition::Subscript(m) => CharPosition::Subscript(m.in_range()),
+        }
+    }
 }
 
 fn ten() -> f64 {
@@ -231,6 +256,7 @@ impl Default for CharStyle {
             font_family: "Source Sans 3".into(),
             font_style: "Regular".into(),
             font_version: None,
+            font_axes: std::collections::BTreeMap::new(),
             size: 12.0,
             leading: None,
             tracking: 0.0,
@@ -267,6 +293,20 @@ impl CharStyle {
     pub fn effective_leading(&self) -> f64 {
         self.leading.unwrap_or(self.size * 1.2)
     }
+    /// Keeps the size, leading, baseline shift and horizontal and vertical scales in range: a size
+    /// or scale of 0 or less becomes the default new type takes (12 pt, 100%), a negative leading
+    /// becomes Auto, and a value past [`crate::MAX_COORD`] (a baseline shift past it either way)
+    /// becomes the nearer end. A leading of 0, which legacy `.ai` import stores, stays, and a
+    /// baseline shift that is not a number becomes 0.
+    pub fn keep_dimensions_in_range(&mut self) {
+        let default = Self::default();
+        let within = |v: f64, or: f64| if v > 0.0 { v.min(crate::MAX_COORD) } else { or };
+        self.size = within(self.size, default.size);
+        self.h_scale = within(self.h_scale, default.h_scale);
+        self.v_scale = within(self.v_scale, default.v_scale);
+        self.leading = self.leading.filter(|l| *l >= 0.0).map(|l| l.min(crate::MAX_COORD));
+        self.baseline_shift = if self.baseline_shift.is_nan() { 0.0 } else { self.baseline_shift.clamp(-crate::MAX_COORD, crate::MAX_COORD) };
+    }
     /// Do the characters draw a stroke (a paint and a positive weight)?
     pub fn has_stroke(&self) -> bool {
         !self.stroke.is_none() && self.stroke_width > 0.0
@@ -327,6 +367,60 @@ impl CharStyle {
     pub fn basic_appearance(&self) -> Appearance {
         Appearance { items: vec![AppearanceItem::Fill(self.fill_layer()), AppearanceItem::Stroke(self.stroke_layer())], ..Default::default() }
     }
+    /// Keeps the superscript or subscript proportions in range with [`CharPosition::in_range`] and
+    /// keeps the small caps size to 1 to 200%, the range `document.setup` takes for `smallCapsSize`.
+    pub fn keep_scripts_in_range(&mut self) {
+        self.position = self.position.in_range();
+        self.small_caps = self.small_caps.map(small_caps_in_range);
+    }
+}
+
+impl crate::Document {
+    /// Keeps the superscript, subscript and small caps proportions to the ranges `document.setup`
+    /// takes ([`CharStyle::keep_scripts_in_range`]) in the type of the layers, symbols, graph
+    /// designs, pattern swatches and the pattern definition that pattern editing's Cancel puts
+    /// back (opacity-mask art included), in graphs' label styles and in the character styles. It
+    /// recurses through the art: call it on a document no deeper than [`crate::depth::MAX_DEPTH`].
+    pub fn keep_scripts_in_range(&mut self) {
+        let mut fix = |n: &mut crate::Node| {
+            if let crate::NodeKind::Text(t) = &mut n.kind {
+                for r in &mut t.runs {
+                    r.style.keep_scripts_in_range();
+                }
+            }
+            if let Some(g) = n.extras_if_any().and_then(|e| e.graph.as_deref_mut()) {
+                let l = &mut g.label_styles;
+                for st in [&mut l.values, &mut l.categories, &mut l.legend].into_iter().flatten() {
+                    st.keep_scripts_in_range();
+                }
+            }
+        };
+        let roots = self
+            .layers
+            .iter_mut()
+            .chain(self.symbols.iter_mut().map(|s| &mut s.art))
+            .chain(self.graph_designs.iter_mut().map(|g| &mut g.art))
+            .chain(self.patterns.iter_mut().flat_map(|p| p.art.iter_mut()))
+            .chain(self.pattern_edit.iter_mut().filter_map(|pe| pe.original.as_mut()).flat_map(|p| p.art.iter_mut()));
+        for root in roots {
+            crate::placed_document::each_mut(std::sync::Arc::make_mut(root), &mut fix);
+        }
+        // Character styles store the attributes they set by their serialized names.
+        for def in self.char_styles.iter_mut() {
+            if let Some(v) = def.attrs.get_mut("position")
+                && let Ok(p) = serde_json::from_value::<CharPosition>(v.clone())
+                && p.in_range() != p
+            {
+                *v = serde_json::to_value(p.in_range()).unwrap_or(serde_json::Value::Null);
+            }
+            if let Some(v) = def.attrs.get_mut("small_caps")
+                && let Some(size) = v.as_f64()
+                && small_caps_in_range(size) != size
+            {
+                *v = small_caps_in_range(size).into();
+            }
+        }
+    }
 }
 
 /// Tab stop alignment (Tabs panel).
@@ -412,6 +506,98 @@ impl Default for HyphenationOptions {
     }
 }
 
+/// How a justified line holding a single word is set ([`JustificationOptions::single_word`]).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum SingleWordJustify {
+    /// Spread across the line, between its letters.
+    #[default]
+    FullJustify,
+    AlignLeft,
+    AlignCenter,
+    AlignRight,
+}
+
+/// A paragraph's justification options (Paragraph panel menu › Justification…), in percent.
+///
+/// Each spacing has a Minimum, a Desired and a Maximum value (`[min, desired, max]`). Desired
+/// applies to every line of the paragraph, justified or not: word spaces are that share of the
+/// font's word space, each letter is followed by that share of a word space, and glyphs are that
+/// wide. Justified lines may vary them between Minimum and Maximum to fill the measure. Saved only
+/// when they differ from the defaults: word spacing 80/100/133, letter spacing 0/0/0, glyph
+/// scaling 100/100/100, Auto Leading 120 and Full Justify.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct JustificationOptions {
+    /// Word Spacing, percent of the font's word space (0..1000).
+    pub word_spacing: [f64; 3],
+    /// Letter Spacing, percent of the font's word space added after each letter (-100..500).
+    pub letter_spacing: [f64; 3],
+    /// Glyph Scaling, percent of the glyphs' width (50..200).
+    pub glyph_scaling: [f64; 3],
+    /// Auto Leading: the leading of characters whose leading is Auto, in percent of their size
+    /// (0..500).
+    pub auto_leading: f64,
+    /// Single Word Justification: how a justified line holding one word is set.
+    pub single_word: SingleWordJustify,
+}
+
+impl JustificationOptions {
+    /// Word Spacing's range (percent).
+    pub const WORD_SPACING: (f64, f64) = (0.0, 1000.0);
+    /// Letter Spacing's range (percent).
+    pub const LETTER_SPACING: (f64, f64) = (-100.0, 500.0);
+    /// Glyph Scaling's range (percent).
+    pub const GLYPH_SCALING: (f64, f64) = (50.0, 200.0);
+    /// Auto Leading's range (percent).
+    pub const AUTO_LEADING: (f64, f64) = (0.0, 500.0);
+
+    /// Are Desired word spacing, letter spacing and glyph scaling the defaults (nothing to change
+    /// in a line's natural widths)?
+    pub fn desired_is_default(&self) -> bool {
+        let d = Self::default();
+        self.word_spacing[1] == d.word_spacing[1] && self.letter_spacing[1] == d.letter_spacing[1] && self.glyph_scaling[1] == d.glyph_scaling[1]
+    }
+
+    /// Keeps options read from a file to what `text.setFormat` can set: a value that is not a
+    /// finite number becomes its default, every value is clamped to its range, and a Minimum,
+    /// Desired and Maximum out of order go back to their defaults together.
+    pub fn keep_in_range(&mut self) {
+        let d = Self::default();
+        for (v, dv, (lo, hi)) in [
+            (&mut self.word_spacing, d.word_spacing, Self::WORD_SPACING),
+            (&mut self.letter_spacing, d.letter_spacing, Self::LETTER_SPACING),
+            (&mut self.glyph_scaling, d.glyph_scaling, Self::GLYPH_SCALING),
+        ] {
+            for (x, dx) in v.iter_mut().zip(dv) {
+                *x = if x.is_finite() { x.clamp(lo, hi) } else { dx };
+            }
+            if !(v[0] <= v[1] && v[1] <= v[2]) {
+                *v = dv;
+            }
+        }
+        let (lo, hi) = Self::AUTO_LEADING;
+        self.auto_leading = if self.auto_leading.is_finite() { self.auto_leading.clamp(lo, hi) } else { d.auto_leading };
+    }
+
+    /// A paragraph's leading for characters of `size` whose leading is Auto.
+    pub fn auto_leading_for(&self, size: f64) -> f64 {
+        size * self.auto_leading / 100.0
+    }
+}
+
+impl Default for JustificationOptions {
+    fn default() -> Self {
+        Self {
+            word_spacing: [80.0, 100.0, 133.0],
+            letter_spacing: [0.0, 0.0, 0.0],
+            glyph_scaling: [100.0, 100.0, 100.0],
+            auto_leading: 120.0,
+            single_word: SingleWordJustify::FullJustify,
+        }
+    }
+}
+
 /// Paragraph attributes (the Paragraph panel).
 ///
 /// Saved through [`ParaStyleFile`], which keeps files with text openable by builds from before
@@ -428,6 +614,9 @@ pub struct ParaStyle {
     pub hyphenate: bool,
     /// The limits automatic hyphenation keeps to (Paragraph panel menu › Hyphenation…).
     pub hyphenation: HyphenationOptions,
+    /// Word and letter spacing, glyph scaling, Auto Leading and Single Word Justification
+    /// (Paragraph panel menu › Justification…).
+    pub justification: JustificationOptions,
     /// Line breaking: Single-line or Every-line Composer.
     pub composer: Composer,
     /// Tab stops (Tabs panel), sorted by position.
@@ -452,6 +641,26 @@ pub struct ParaStyle {
     /// Kinsoku (Paragraph panel › Kinsoku Set): which Japanese characters may not start or end a
     /// line.
     pub kinsoku: Kinsoku,
+    /// Roman Hanging Punctuation (Paragraph panel menu): quotation marks, hyphens, full stops and
+    /// commas starting or ending a line hang outside the margin, and asterisks, tildes, ellipses,
+    /// dashes, colons and semicolons hang by half. East Asian punctuation hangs by burasagari.
+    pub roman_hanging: bool,
+}
+
+impl ParaStyle {
+    /// Keeps the indents and the space before and after to -[`crate::MAX_COORD`] to
+    /// [`crate::MAX_COORD`], and the tab stop positions to 0 to 100,000 pt, the range
+    /// `text.tabs.set` takes. A value outside its range becomes the nearer end, and one that is
+    /// not a number becomes 0.
+    pub fn keep_spacing_in_range(&mut self) {
+        let within = |v: f64, lo: f64, hi: f64| if v.is_nan() { 0.0 } else { v.clamp(lo, hi) };
+        for v in [&mut self.left_indent, &mut self.right_indent, &mut self.first_line_indent, &mut self.space_before, &mut self.space_after] {
+            *v = within(*v, -crate::MAX_COORD, crate::MAX_COORD);
+        }
+        for t in &mut self.tabs {
+            t.position = within(t.position, 0.0, 100_000.0);
+        }
+    }
 }
 
 /// [`ParaStyle`] as saved. [`Justify::Auto`] is written as the alignment it has in the paragraph
@@ -477,6 +686,8 @@ struct ParaStyleFile {
     hyphenate: bool,
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     hyphenation: HyphenationOptions,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    justification: JustificationOptions,
     #[serde(default, skip_serializing_if = "Composer::is_default")]
     composer: Composer,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -493,6 +704,8 @@ struct ParaStyleFile {
     burasagari: Burasagari,
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     kinsoku: Kinsoku,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    roman_hanging: bool,
 }
 
 impl From<ParaStyle> for ParaStyleFile {
@@ -511,6 +724,7 @@ impl From<ParaStyle> for ParaStyleFile {
             space_after,
             hyphenate,
             hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -519,6 +733,7 @@ impl From<ParaStyle> for ParaStyleFile {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
             ..
         } = p;
         Self {
@@ -531,6 +746,7 @@ impl From<ParaStyle> for ParaStyleFile {
             space_after,
             hyphenate,
             hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -539,6 +755,7 @@ impl From<ParaStyle> for ParaStyleFile {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
         }
     }
 }
@@ -546,6 +763,8 @@ impl From<ParaStyle> for ParaStyleFile {
 impl From<ParaStyleFile> for ParaStyle {
     fn from(f: ParaStyleFile) -> Self {
         let justify = if f.justify_auto { Justify::Auto } else { f.justify };
+        let mut justification = f.justification;
+        justification.keep_in_range();
         let ParaStyleFile {
             left_indent,
             right_indent,
@@ -562,6 +781,7 @@ impl From<ParaStyleFile> for ParaStyle {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
             ..
         } = f;
         Self {
@@ -573,6 +793,7 @@ impl From<ParaStyleFile> for ParaStyle {
             space_after,
             hyphenate,
             hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -581,6 +802,7 @@ impl From<ParaStyleFile> for ParaStyle {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
         }
     }
 }
@@ -1067,6 +1289,12 @@ pub struct TextObject {
     /// Wrap objects above this area type, resolved by the engine after each edit (text space).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub wrap: Vec<WrapShape>,
+    /// Type › Optical Margin Alignment: in every paragraph, Latin punctuation and the slanted
+    /// sides of letters such as A and W at a line's start or end hang outside the margin there
+    /// (point and area type of left-to-right paragraphs; see the layout's `optical_hangs`). Off
+    /// for new type and for documents from before it, and saved only when on.
+    #[serde(default, rename = "opticalMarginAlignment", skip_serializing_if = "crate::skip::is_default")]
+    pub optical_margin: bool,
     /// Cached layout bounds in text space, filled in by the layout engine (not serialized).
     #[serde(skip)]
     pub cached_bounds: Option<Rect>,
@@ -1132,6 +1360,7 @@ impl TextObject {
             path_align: PathAlign::default(),
             path_spacing: 0.0,
             wrap: Vec::new(),
+            optical_margin: false,
             cached_bounds: None,
             cached_baselines: Vec::new(),
         }
@@ -1348,6 +1577,87 @@ impl TextObject {
         });
         self.cached_baselines.iter().copied().chain(first)
     }
+    /// Keeps every run's size, leading, baseline shift and scales in range
+    /// ([`CharStyle::keep_dimensions_in_range`]) and every paragraph's indents, spacing and tab
+    /// stops ([`ParaStyle::keep_spacing_in_range`]).
+    pub fn keep_type_values_in_range(&mut self) {
+        for r in &mut self.runs {
+            r.style.keep_dimensions_in_range();
+        }
+        for p in self.para_styles_mut() {
+            p.keep_spacing_in_range();
+        }
+    }
+}
+
+impl crate::Document {
+    /// Keeps the character dimensions, indents, paragraph spacing and tab stops in range
+    /// ([`TextObject::keep_type_values_in_range`]) in the type of the layers, symbols, graph
+    /// designs, pattern swatches and the pattern definition that pattern editing's Cancel puts
+    /// back (opacity-mask art included), and the same attributes of the character and paragraph
+    /// styles. It recurses through the art: call it on a document no deeper than
+    /// [`crate::depth::MAX_DEPTH`].
+    pub fn keep_type_values_in_range(&mut self) {
+        let mut fix = |n: &mut crate::Node| {
+            if let crate::NodeKind::Text(t) = &mut n.kind {
+                t.keep_type_values_in_range();
+            }
+        };
+        let roots = self
+            .layers
+            .iter_mut()
+            .chain(self.symbols.iter_mut().map(|s| &mut s.art))
+            .chain(self.graph_designs.iter_mut().map(|g| &mut g.art))
+            .chain(self.patterns.iter_mut().flat_map(|p| p.art.iter_mut()))
+            .chain(self.pattern_edit.iter_mut().filter_map(|pe| pe.original.as_mut()).flat_map(|p| p.art.iter_mut()));
+        for root in roots {
+            crate::placed_document::each_mut(std::sync::Arc::make_mut(root), &mut fix);
+        }
+        // Styles store the attributes they set by their serialized names (a number, or null for
+        // Auto leading); a number is rewritten only when it changes.
+        for def in self.char_styles.iter_mut() {
+            let num = |k: &str| def.attrs.get(k).and_then(serde_json::Value::as_f64);
+            let mut st = CharStyle { leading: num("leading"), ..CharStyle::default() };
+            st.size = num("size").unwrap_or(st.size);
+            st.h_scale = num("h_scale").unwrap_or(st.h_scale);
+            st.v_scale = num("v_scale").unwrap_or(st.v_scale);
+            st.baseline_shift = num("baseline_shift").unwrap_or(st.baseline_shift);
+            st.keep_dimensions_in_range();
+            let kept = [
+                ("size", Some(st.size)),
+                ("h_scale", Some(st.h_scale)),
+                ("v_scale", Some(st.v_scale)),
+                ("baseline_shift", Some(st.baseline_shift)),
+                ("leading", st.leading),
+            ];
+            for (k, v) in kept {
+                if let Some(old) = def.attrs.get_mut(k)
+                    && old.is_number()
+                    && old.as_f64() != v
+                {
+                    *old = v.into();
+                }
+            }
+        }
+        for def in self.para_styles.iter_mut() {
+            for k in ["left_indent", "right_indent", "first_line_indent", "space_before", "space_after"] {
+                if let Some(v) = def.attrs.get_mut(k)
+                    && let Some(x) = v.as_f64()
+                    && x.abs() > crate::MAX_COORD
+                {
+                    *v = x.clamp(-crate::MAX_COORD, crate::MAX_COORD).into();
+                }
+            }
+            for t in def.attrs.get_mut("tabs").and_then(serde_json::Value::as_array_mut).into_iter().flatten() {
+                if let Some(v) = t.get_mut("position")
+                    && let Some(x) = v.as_f64()
+                    && !(0.0..=100_000.0).contains(&x)
+                {
+                    *v = x.clamp(0.0, 100_000.0).into();
+                }
+            }
+        }
+    }
 }
 
 #[cfg(test)]
@@ -1377,6 +1687,37 @@ mod tests {
         assert_eq!(serde_json::from_value::<CharStyle>(serde_json::to_value(&farsi).unwrap()).unwrap(), farsi);
     }
 
+    /// A file can't feed layout justification values `text.setFormat` would refuse: each is
+    /// clamped to its range, one that isn't finite takes its default, and a Minimum, Desired and
+    /// Maximum out of order go back to their defaults.
+    #[test]
+    fn justification_options_read_from_a_file_stay_in_range() {
+        let d = JustificationOptions::default();
+        let read: ParaStyle = serde_json::from_value(serde_json::json!({
+            "justification": {
+                "word_spacing": [-5.0, 1e300, 1e308], "letter_spacing": [10.0, 5.0, 20.0],
+                "glyph_scaling": [1.0, 100.0, 9e9], "auto_leading": -1e12
+            }
+        }))
+        .unwrap();
+        let j = read.justification;
+        assert_eq!(j.word_spacing, [0.0, 1000.0, 1000.0]);
+        assert_eq!(j.letter_spacing, d.letter_spacing, "out of order");
+        assert_eq!(j.glyph_scaling, [50.0, 100.0, 200.0]);
+        assert_eq!(j.auto_leading, 0.0);
+        let mut j = JustificationOptions {
+            word_spacing: [f64::NAN, 100.0, f64::INFINITY],
+            letter_spacing: [-1.0, 0.0, f64::NEG_INFINITY],
+            auto_leading: f64::NAN,
+            ..d.clone()
+        };
+        j.keep_in_range();
+        assert_eq!((j.word_spacing, j.letter_spacing, j.auto_leading), (d.word_spacing, [-1.0, 0.0, 0.0], d.auto_leading));
+        let mut same = d.clone();
+        same.keep_in_range();
+        assert_eq!(same, d);
+    }
+
     #[test]
     fn character_controls_reject_collapsed_and_nonfinite_transforms() {
         let mut t = TextObject::point(Point::ZERO, "Text", CharStyle::default());

crates/doc/src/variables.rs

@@ -116,6 +116,10 @@ pub struct Variables {
     pub bindings: BTreeMap<NodeId, BTreeSet<String>>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub active_dataset: Option<String>,
+    /// Lock Variables: while set, variables can't be defined, deleted or renamed. Objects can
+    /// still be bound to them and unbound, and datasets still change and apply.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub locked: bool,
 }
 
 impl Variables {
@@ -184,20 +188,26 @@ impl Document {
         self.variables.bindings = bindings;
     }
 
-    /// Whether a variable may read and rewrite the object `id`: it is in the document, neither
-    /// it nor anything above it is locked, and nothing above it is hidden. Its own visibility
-    /// doesn't count, as that is what a visibility variable drives: a row that hid it must be
-    /// able to show it again, and a capture must record it hidden.
+    /// Whether a variable may be bound to the object `id`: it is in the document, neither it nor
+    /// anything above it is locked, and nothing above it is hidden. Its own visibility doesn't
+    /// count, as that is what a visibility variable drives.
     pub fn variable_target(&self, id: NodeId) -> bool {
         self.ancestry(id).is_some_and(|a| a.iter().all(|i| self.node(*i).is_some_and(|n| !n.locked && (n.visible || *i == id))))
     }
 
+    /// Whether a data set reads and rewrites the bound object `id`: it is in the document and
+    /// neither it nor anything above it is locked. Hidden objects count, and so do objects in a
+    /// hidden layer or group.
+    pub fn dataset_target(&self, id: NodeId) -> bool {
+        self.ancestry(id).is_some_and(|a| a.iter().all(|i| self.node(*i).is_some_and(|n| !n.locked)))
+    }
+
     /// What the object `id` holds for the variable of `kind`: its characters, whether it shows,
     /// or a linked image's path. `None` when the object is gone, is not of that kind, has no
-    /// link path yet (an embedded image), or is locked or on a hidden or locked layer (the
+    /// link path yet (an embedded image), or is locked or in a locked layer or group (the
     /// document's value is whatever it was left at).
     pub fn variable_value(&self, id: NodeId, kind: VariableKind) -> Option<DataValue> {
-        if !self.variable_target(id) {
+        if !self.dataset_target(id) {
             return None;
         }
         let node = self.node(id)?;

crates/effects/src/adjust.rs

@@ -48,15 +48,29 @@ enum Channel {
 
 impl Channel {
     fn of(p: &Value) -> Self {
-        match text(p, "channel", "rgb").to_ascii_lowercase().as_str() {
-            "red" | "r" => Channel::One(0),
-            "green" | "g" => Channel::One(1),
-            "blue" | "b" => Channel::One(2),
-            _ => Channel::All,
+        Self::parse(text(p, "channel", "rgb")).unwrap_or(Channel::All)
+    }
+
+    fn parse(s: &str) -> Option<Self> {
+        match s.to_ascii_lowercase().as_str() {
+            "rgb" => Some(Channel::All),
+            "red" | "r" => Some(Channel::One(0)),
+            "green" | "g" => Some(Channel::One(1)),
+            "blue" | "b" => Some(Channel::One(2)),
+            _ => None,
         }
     }
 }
 
+/// The channels Curves and Levels apply to (`channel`), as their parameters list them.
+pub const CHANNELS: [&str; 4] = ["rgb", "red", "green", "blue"];
+
+/// Do Curves and Levels read `s` as their `channel`: one of [`CHANNELS`], or r, g or b, in any
+/// case? They draw any other value on all three channels, as RGB.
+pub fn is_channel(s: &str) -> bool {
+    Channel::parse(s).is_some()
+}
+
 /// Entries of a sampled tone curve.
 const LUT: usize = 256;
 
@@ -490,4 +504,20 @@ mod tests {
         assert_eq!(out.appearance.items[0].paint(), p.appearance.items[0].paint());
         assert!(out.appearance.items[1].effects().is_empty());
     }
+
+    #[test]
+    fn adjust_recolours_the_points_of_a_freeform_gradient() {
+        use vectorcraft_doc::color::{Freeform, FreeformPoint, Gradient, GradientKind, GradientPaint};
+        let mut gp = GradientPaint::new(Gradient { kind: GradientKind::Freeform, ..Gradient::default() });
+        let pt = |x, c| FreeformPoint::new(kurbo::Point::new(x, 5.0), c);
+        gp.set_freeform(Freeform { points: vec![pt(2.0, Color::rgb(1.0, 0.0, 0.0)), pt(8.0, Color::rgb(0.0, 0.0, 1.0))], ..Default::default() });
+        let fill = Appearance::basic(Paint::Gradient(Box::new(gp)), Paint::None, 0.0);
+        let mut p = Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), fill);
+        p.appearance.effects.push(Effect { id: "adjust.hueSaturation".into(), params: json!({"hue": 120}), visible: true });
+        let out = adjust(&p, None, &mut |_, _| None).unwrap();
+        let Paint::Gradient(g) = out.appearance.fill_paint() else { panic!("a gradient fill") };
+        // The points are what a freeform gradient draws from, not its stops.
+        let hexes: Vec<String> = g.freeform.as_ref().unwrap().points.iter().map(|p| p.color.to_hex()).collect();
+        assert_eq!(hexes, ["#00ff00", "#ff0000"]);
+    }
 }

crates/effects/src/bake.rs

@@ -89,7 +89,8 @@ fn path_kind(d: &mut Document, path: PathData, rule: FillRule) -> NodeKind {
 
 /// `n` with its geometry effects evaluated (`None` = unchanged).
 fn bake_node(d: &mut Document, n: &Node) -> Option<Node> {
-    if !needs_bake(n) {
+    // A cancelled export leaves the rest of the document as it is: the caller drops the result.
+    if !needs_bake(n) || vectorcraft_doc::cancel::is_cancelled() {
         return None;
     }
     // Colour adjustments: the object recoloured (inside it too), then baked as it is.
@@ -120,6 +121,13 @@ fn bake_node(d: &mut Document, n: &Node) -> Option<Node> {
         let m = reshape(n, symbol.as_deref())?;
         return Some(bake_node(d, &m).unwrap_or(m));
     }
+    // A path whose Transform effect copies it with a gradient: each copy an object of its own, so
+    // its gradient fits it rather than spanning every copy.
+    if crate::has_gradient_copies(n)
+        && let Some(m) = reshape(n, None)
+    {
+        return Some(bake_pieces(d, m));
+    }
     // Groups and layers: Pathfinder, geometry effects and their own fills and strokes (type that
     // Transform effects only move stays type). The new pieces (results, outlines, copies, the
     // fills' and strokes' art) get ids of their own.
@@ -505,7 +513,8 @@ pub fn expand_art(d: &mut Document, n: &mut Node, stroke_art: StrokeArt) {
 /// Envelope Options → Distort Appearance: path or compound path `n` as plain filled art that an
 /// envelope bends as a whole: its geometry effects applied, every visible fill a copy of the path
 /// painted by that fill and every visible stroke without a brush its filled outline in the
-/// stroke's paint, opacity and blend mode (a brushed stroke stays a stroke), in paint order, as
+/// stroke's paint, opacity, blend mode and raster effects (a gradient along or across the stroke:
+/// its gradient meshes clipped to the outline; a brushed stroke stays a stroke), in paint order, as
 /// the members of a group keeping `n`'s id, transparency, opacity mask and raster effects. `None`
 /// when it has neither a stroke to outline nor a geometry effect, so bending first changes nothing.
 pub fn bake_appearance(n: &Node) -> Option<Node> {
@@ -535,8 +544,28 @@ pub fn bake_appearance(n: &Node) -> Option<Node> {
         clear_item_effects(&mut it);
         pieces.push(match &it {
             AppearanceItem::Stroke(st) if st.brush.is_none() => {
-                let fill = FillLayer { opacity: st.opacity, blend: st.blend, ..FillLayer::new(st.paint.clone()) };
-                piece(crate::stroke::outline_region(&ig, rule, st), FillRule::NonZero, AppearanceItem::Fill(fill))
+                let outline = crate::stroke::outline_region(&ig, rule, st);
+                match st.path_gradient() {
+                    // A gradient along or across the stroke: its gradient meshes clipped to the outline.
+                    Some(g) => {
+                        let mut clip = Node::path(n.id, outline, Appearance::default());
+                        if let NodeKind::Path { clipping, .. } = &mut clip.kind {
+                            *clipping = true;
+                        }
+                        let meshes = crate::stroke::gradient_meshes(&ig.to_bezpath(), rule, st, &g.gradient);
+                        let meshes = meshes.into_iter().map(|m| Node::new(n.id, NodeKind::Mesh(m)));
+                        let children = std::iter::once(clip).chain(meshes).map(Arc::new).collect();
+                        let mut group = Node::new(n.id, NodeKind::Group { children, clip: true });
+                        (group.opacity, group.blend) = (st.opacity, st.blend);
+                        group.appearance.effects = st.effects.clone();
+                        Arc::new(group)
+                    }
+                    None => {
+                        let effects = st.effects.clone();
+                        let fill = FillLayer { opacity: st.opacity, blend: st.blend, effects, ..FillLayer::new(st.paint.clone()) };
+                        piece(outline, FillRule::NonZero, AppearanceItem::Fill(fill))
+                    }
+                }
             }
             _ => piece(ig, rule, it),
         });
@@ -572,6 +601,15 @@ mod tests {
     use vectorcraft_doc::{CharStyle, Effect, NodeId, TextObject};
     use vectorcraft_geom::{Point, Rect, shapes};
 
+    /// Type tests need glyph outlines, which only the optional craft-fonts build input provides.
+    fn skip_without_craft_fonts() -> bool {
+        let skip = vectorcraft_text::CRAFT_FONTS.is_empty();
+        if skip {
+            eprintln!("skipped: built without craft-fonts (set CRAFT_FONTS_DIR to a craft-fonts checkout to run it)");
+        }
+        skip
+    }
+
     fn fx(id: &str, params: serde_json::Value) -> Effect {
         Effect { id: id.into(), params, visible: true }
     }
@@ -619,6 +657,36 @@ mod tests {
         assert!(ch[0].id != ch[1].id && ch[0].id != NodeId(50));
     }
 
+    #[test]
+    fn a_baked_stroke_keeps_its_raster_effects() {
+        let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default_art());
+        if let AppearanceItem::Stroke(s) = &mut n.appearance.items[1] {
+            s.effects.push(fx("path.offsetPath", json!({"offset": 5.0})));
+            s.effects.push(fx("stylize.dropShadow", json!({})));
+        }
+        let m = bake_appearance(&n).unwrap();
+        let ch = m.children().unwrap();
+        let Some(AppearanceItem::Fill(f)) = ch[1].appearance.items.first() else { panic!("the outline is filled") };
+        assert_eq!(f.effects.iter().map(|e| e.id.as_str()).collect::<Vec<_>>(), ["stylize.dropShadow"]);
+    }
+
+    #[test]
+    fn a_baked_stroke_with_a_gradient_along_it_becomes_meshes_clipped_to_its_outline() {
+        let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default_art());
+        if let AppearanceItem::Stroke(s) = &mut n.appearance.items[1] {
+            s.width = 10.0;
+            s.paint = Paint::Gradient(Box::new(vectorcraft_color::GradientPaint::new(Default::default())));
+            s.gradient_mode = vectorcraft_doc::StrokeGradientMode::Along;
+            s.opacity = 0.5;
+        }
+        let m = bake_appearance(&n).unwrap();
+        let ch = m.children().unwrap();
+        let NodeKind::Group { children, clip: true } = &ch[1].kind else { panic!("a clip group: {:?}", ch[1].kind) };
+        assert!(matches!(children[0].kind, NodeKind::Path { clipping: true, .. }));
+        assert!(children.len() > 1 && children[1..].iter().all(|c| matches!(c.kind, NodeKind::Mesh(_))), "gradient meshes");
+        assert_eq!(ch[1].opacity, 0.5);
+    }
+
     /// Black 24 pt "Type" with its baseline at (20, 60).
     fn type_node(id: u64) -> Node {
         let style = CharStyle { size: 24.0, fill: Paint::solid(Color::BLACK), ..Default::default() };
@@ -647,6 +715,9 @@ mod tests {
 
     #[test]
     fn type_moved_or_copied_by_a_groups_transform_effect_stays_type() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         for (params, origins, square) in [
             (json!({"moveH": 30}), vec![(50.0, 60.0)], Rect::new(30.0, 0.0, 40.0, 10.0)),
             (json!({"moveH": 200, "copies": 1}), vec![(20.0, 60.0), (220.0, 60.0)], Rect::new(0.0, 0.0, 210.0, 10.0)),
@@ -678,6 +749,9 @@ mod tests {
 
     #[test]
     fn hidden_type_in_a_group_that_keeps_its_type_stays_hidden() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut g = type_group(vec![fx("distort.transform", json!({"moveH": 200, "copies": 1}))]);
         let mut hidden = type_node(55);
         hidden.visible = false;
@@ -689,6 +763,9 @@ mod tests {
 
     #[test]
     fn type_outlined_next_to_type_that_stays_type_keeps_its_look() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut g = type_group(vec![fx("distort.transform", json!({"moveH": 200, "copies": 1}))]);
         let mut shadowed = type_node(55);
         shadowed.opacity = 0.5;
@@ -711,6 +788,9 @@ mod tests {
 
     #[test]
     fn type_in_a_clipping_group_with_a_fill_of_its_own_is_outlined_plain() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut g = type_group(vec![fx("distort.transform", json!({"moveH": 200, "copies": 1}))]);
         // The clipping path is a group with a fill of its own, holding type with an effect of its own.
         let mut moved = type_node(60);
@@ -729,6 +809,9 @@ mod tests {
 
     #[test]
     fn type_with_its_own_transform_effect_copies_stays_type() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut n = type_node(50);
         n.opacity = 0.5;
         n.appearance.effects = vec![fx("distort.transform", json!({"moveV": 50, "copies": 2})), fx("stylize.dropShadow", json!({}))];
@@ -775,6 +858,9 @@ mod tests {
 
     #[test]
     fn type_whose_copies_paint_over_each_other_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let moves = vec![fx("distort.transform", json!({"moveV": 40, "copies": 1}))];
         assert_eq!(type_origins(&bake_document(&doc_with(type_group(moves.clone()))).unwrap()).len(), 2);
         // A 20 pt stroke on the characters reaches the copy below.
@@ -790,6 +876,9 @@ mod tests {
 
     #[test]
     fn type_with_a_look_of_its_own_in_a_moved_group_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let moves = vec![fx("distort.transform", json!({"moveV": 40, "copies": 1}))];
         let mut translucent = type_node(50);
         translucent.opacity = 0.5;
@@ -862,6 +951,9 @@ mod tests {
 
     #[test]
     fn type_whose_copies_hold_too_much_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let spaced = |spaces: usize| {
             let mut n = type_node(50);
             if let NodeKind::Text(t) = &mut n.kind {
@@ -899,6 +991,9 @@ mod tests {
 
     #[test]
     fn type_in_a_pathfinder_group_inside_a_moved_group_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut inner = type_group(vec![fx("pathfinder.add", json!({}))]);
         inner.id = NodeId(53);
         let mut outer = Node::group(NodeId(54), vec![Arc::new(inner)]);
@@ -932,4 +1027,36 @@ mod tests {
         // An effect that also scales.
         assert!(transform_offsets(&[json!({"moveH": 10, "scaleH": 50})], &square).is_none());
     }
+    /// A 10 pt square painted with a red to blue gradient and a Transform effect with 2 copies.
+    fn gradient_copies(id: u64) -> Node {
+        use vectorcraft_color::{Gradient, GradientKind, GradientPaint, GradientStop};
+        let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+        let paint = Paint::Gradient(Box::new(GradientPaint::new(Gradient { kind: GradientKind::Linear, stops })));
+        let mut n = Node::path(NodeId(id), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::basic(paint, Paint::None, 0.0));
+        n.appearance.effects.push(fx("distort.transform", json!({"moveH": 30, "copies": 2})));
+        n
+    }
+
+    /// The paths under `n` that paint a gradient fitted to their own 10 pt box, left to right.
+    fn gradient_pieces(n: &Node) -> Vec<f64> {
+        let mut out = vec![];
+        let mut walk = vec![n];
+        while let Some(n) = walk.pop() {
+            match n.children() {
+                Some(ch) if !matches!(n.kind, NodeKind::Compound { .. }) => walk.extend(ch.iter().map(|c| &**c)),
+                _ => {
+                    assert!(matches!(n.appearance.fill_paint(), Paint::Gradient(_)), "{n:?}");
+                    out.extend(n.geometric_bounds().map(|b| b.width()));
+                }
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn exporting_a_path_with_a_transform_gives_each_copy_its_own_gradient() {
+        let d = bake_document(&doc_with(gradient_copies(50))).unwrap();
+        // Three squares of their own, not one path spanning all three.
+        assert_eq!(gradient_pieces(d.node(NodeId(50)).unwrap()), vec![10.0; 3]);
+    }
 }

crates/effects/src/distort.rs

@@ -267,8 +267,20 @@ pub fn twist(path: &PathData, b: Rect, angle: f64) -> PathData {
 
 const ZIGZAG_ARCLEN_ACCURACY: f64 = 1e-4;
 
+/// A Zig Zag ridge: where it sits, the path's unit direction there, and the length along the
+/// path to the ridges before and after it (zero at an open path's ends).
+struct Ridge {
+    p: Point,
+    dir: Vec2,
+    gap_in: f64,
+    gap_out: f64,
+}
+
 /// Zig Zag: `ridges` extra points per segment, evenly spaced along its length and alternately
-/// displaced along the normal.
+/// displaced along the normal. Corner points join them with straight lines. Smooth points make a
+/// wave: every peak and valley is a smooth point whose handles run along the path, a third of the
+/// way to the next ridge, so each span between them follows a half cosine (an S through the path)
+/// whatever the size of the ridges (#2343).
 pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
     let size = num(p, "size", 10.0).clamp(-1e4, 1e4);
     let amp = if flag(p, "relative", false) { size / 100.0 * mean_size(b) } else { size };
@@ -277,29 +289,33 @@ pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
     let mut subs = vec![];
     for sp in &path.subpaths {
         let segs = sp.segment_count();
-        let mut pts = vec![];
+        let gap = |i: usize| sp.segment(i).arclen(ZIGZAG_ARCLEN_ACCURACY) / (ridges + 1) as f64;
+        let mut pts: Vec<Ridge> = vec![];
         let mut k = 0usize;
         for i in 0..segs {
             let c = sp.segment(i);
             // Ridges are spaced by length, not by `t`: a line's retracted handles bunch `t` up
             // near the anchors, and so does any uneven curve.
             let len = c.arclen(ZIGZAG_ARCLEN_ACCURACY);
+            let step = len / (ridges + 1) as f64;
             for j in 0..=ridges {
                 let s = j as f64 / (ridges + 1) as f64;
                 let t = if j > 0 && len > 1e-9 { c.inv_arclen(s * len, ZIGZAG_ARCLEN_ACCURACY).clamp(0.0, 1.0) } else { s };
+                let mut gap_in = step;
                 let nrm = if j == 0 {
                     // Average the normals of the segments meeting at the anchor.
                     let prev = if i > 0 {
-                        Some(sp.segment(i - 1))
+                        Some(i - 1)
                     } else if sp.closed {
-                        Some(sp.segment(segs - 1))
+                        Some(segs - 1)
                     } else {
                         None
                     };
+                    gap_in = prev.map_or(0.0, gap);
                     let n1 = normal_at(&c, 0.0);
                     match prev {
-                        Some(pc) => {
-                            let s = n1 + normal_at(&pc, 1.0);
+                        Some(pi) => {
+                            let s = n1 + normal_at(&sp.segment(pi), 1.0);
                             if s.hypot() > 1e-9 { s / s.hypot() } else { n1 }
                         }
                         None => n1,
@@ -308,7 +324,7 @@ pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
                     normal_at(&c, t)
                 };
                 let sign = if k.is_multiple_of(2) { 1.0 } else { -1.0 };
-                pts.push(c.eval(t) + nrm * (amp * sign));
+                pts.push(Ridge { p: c.eval(t) + nrm * (amp * sign), dir: Vec2::new(-nrm.y, nrm.x), gap_in, gap_out: step });
                 k += 1;
             }
         }
@@ -316,12 +332,18 @@ pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
             if segs > 0 {
                 let c = sp.segment(segs - 1);
                 let sign = if k.is_multiple_of(2) { 1.0 } else { -1.0 };
-                pts.push(c.p3 + normal_at(&c, 1.0) * (amp * sign));
+                let nrm = normal_at(&c, 1.0);
+                pts.push(Ridge { p: c.p3 + nrm * (amp * sign), dir: Vec2::new(-nrm.y, nrm.x), gap_in: gap(segs - 1), gap_out: 0.0 });
             } else {
-                pts.extend(sp.anchors.iter().map(|a| a.p));
+                pts.extend(sp.anchors.iter().map(|a| Ridge { p: a.p, dir: Vec2::ZERO, gap_in: 0.0, gap_out: 0.0 }));
             }
         }
-        subs.push(if smooth { catmull_rom(&pts, sp.closed, 1.0) } else { SubPath::polyline(&pts, sp.closed) });
+        subs.push(if smooth {
+            let anchors = pts.iter().map(|r| Anchor::with_handles(r.p, r.p - r.dir * (r.gap_in / 3.0), r.p + r.dir * (r.gap_out / 3.0))).collect();
+            SubPath::new(anchors, sp.closed)
+        } else {
+            SubPath::polyline(&pts.iter().map(|r| r.p).collect::<Vec<_>>(), sp.closed)
+        });
     }
     PathData::new(subs)
 }

crates/effects/src/group.rs

@@ -293,6 +293,15 @@ mod tests {
     use vectorcraft_doc::{CharStyle, Effect, NodeId, TextObject};
     use vectorcraft_geom::{Point, Rect, shapes};
 
+    /// Type tests need glyph outlines, which only the optional craft-fonts build input provides.
+    fn skip_without_craft_fonts() -> bool {
+        let skip = vectorcraft_text::CRAFT_FONTS.is_empty();
+        if skip {
+            eprintln!("skipped: built without craft-fonts (set CRAFT_FONTS_DIR to a craft-fonts checkout to run it)");
+        }
+        skip
+    }
+
     fn sq(id: u64, x: f64, color: Color) -> Arc<Node> {
         Arc::new(Node::path(
             NodeId(id),
@@ -350,6 +359,9 @@ mod tests {
 
     #[test]
     fn type_changes_the_result_of_every_pathfinder_effect() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let glyphs = crate::outline_text(&type_h()).unwrap();
         let b = glyphs.geometric_bounds().unwrap();
         assert!(b.x0 < 100.0 && b.x1 > 100.0 && b.y0 > 0.0 && b.y1 < 100.0, "{b:?}");
@@ -377,6 +389,9 @@ mod tests {
 
     #[test]
     fn pieces_of_type_keep_its_paint_opacity_and_blend_mode() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut t = type_h();
         (t.opacity, t.blend) = (0.5, BlendMode::Multiply);
         let look = |p: &Arc<Node>| (p.appearance.fill_paint(), p.opacity, p.blend);
@@ -418,6 +433,9 @@ mod tests {
 
     #[test]
     fn type_in_a_group_keeps_its_look_when_the_groups_geometry_effects_outline_it() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         use vectorcraft_color::BlendMode;
         let art = type_in_group(|t| (t.opacity, t.blend) = (0.5, BlendMode::Multiply));
         assert!(art.id == NodeId(3) && !matches!(art.kind, NodeKind::Text(_)), "{art:?}");
@@ -447,6 +465,9 @@ mod tests {
 
     #[test]
     fn a_transform_on_a_group_moves_the_gradients_of_its_type_and_not_those_placed_on_its_paths() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
         let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
         let ramp = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
@@ -470,4 +491,32 @@ mod tests {
         assert!((after - before - 30.0).abs() < 1e-6, "the type's gradient starts at {before}, then {after}");
         assert_eq!(start(&members[0]), 0.0, "the square's gradient stays where it was placed");
     }
+
+    #[test]
+    fn a_transform_on_a_group_paints_each_copy_with_its_own_gradient() {
+        use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+        let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+        let ramp = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
+        let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+        let paints = [Paint::Gradient(Box::new(ramp.clone())), Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }))];
+        for (k, paint) in paints.into_iter().enumerate() {
+            let square =
+                Arc::new(Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::basic(paint, Paint::None, 0.0)));
+            let mut g = Node::group(NodeId(10), vec![square]);
+            let params = serde_json::json!({"moveH": 30, "copies": 2});
+            g.appearance.effects.push(Effect { id: "distort.transform".into(), params, visible: true });
+            let art = evaluate_container(&g).unwrap();
+            let copies = art.children().unwrap()[0].children().expect("the object and its copies are objects of their own");
+            assert_eq!(copies.len(), 3);
+            for (i, c) in copies.iter().enumerate() {
+                // Each copy's own box: an unplaced gradient fits it, a placed one moved with it.
+                assert!((c.geometric_bounds().unwrap().x0 - 30.0 * i as f64).abs() < 1e-6);
+                match c.appearance.fill_paint() {
+                    Paint::Gradient(g) if k == 0 => assert!(g.geom.is_none(), "copy {i} fits its own box"),
+                    Paint::Gradient(g) => assert!((g.geom.unwrap().start.x - 30.0 * i as f64).abs() < 1e-6, "copy {i}"),
+                    p => panic!("a gradient: {p:?}"),
+                }
+            }
+        }
+    }
 }

crates/effects/src/lib.rs

@@ -5,7 +5,7 @@
 //!
 //! - **Geometry effects** (Distort & Transform, Path, Convert to Shape, Round Corners, Scribble,
 //!   Warp) rewrite a path: [`apply_geometry`] evaluates them in stack order.
-//! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur, and the
+//! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur, Rasterize, and the
 //!   Photoshop-style filters of [`pixel`]: Radial Blur, Smart Blur, Color Halftone, Crystallize, Mezzotint, Pointillize, Halftone Pattern,
 //!   Unsharp Mask and Glowing Edges) are described by
 //!   [`raster_effects`] and painted by the renderer; [`outset`] says how far they reach beyond
@@ -37,6 +37,7 @@ mod bake;
 mod clip;
 mod distort;
 mod group;
+mod lighting;
 mod live;
 mod marks;
 pub mod pixel;
@@ -58,7 +59,10 @@ use serde_json::{Map, Value, json};
 use vectorcraft_doc::{AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
 use vectorcraft_geom::{BezPath, FillRule, PathData, Rect};
 
-pub use adjust::{ADJUSTMENTS, ColorMap, ImageHook, adjust, adjust_in_document, color_map, curve_at, curve_points, has_adjustment, is_adjustment};
+pub use adjust::{
+    ADJUSTMENTS, CHANNELS, ColorMap, ImageHook, adjust, adjust_in_document, color_map, curve_at, curve_points, has_adjustment, is_adjustment,
+    is_channel,
+};
 pub use bake::{StrokeArt, bake_appearance, bake_document, expand_art, expand_leaf, fresh_ids, needs_bake};
 pub use clip::clip_outline;
 pub use group::{
@@ -68,8 +72,8 @@ pub use group::{
 pub use live::{expand_live, expand_live_deep, expanded_live_group, text_outliner};
 pub use marks::{CROP_MARKS, crop_marks_art, has_crop_marks};
 pub use pixel::{PIXEL_EFFECTS, PixelFx, PixelSpace};
-pub use raster::{RasterFx, outset, raster_effects};
-pub use reshape::{expand_outlined, has_item_geometry, needs_outline, outline_art, outline_text, reshape};
+pub use raster::{RASTERIZE, RasterFx, Rasterize, outset, raster_effects};
+pub use reshape::{expand_outlined, has_gradient_copies, has_item_geometry, needs_outline, outline_art, outline_text, reshape};
 pub use revolve::{REVOLVE, has_revolve, revolve_art, revolve_options, validate_revolve};
 pub use solids::{
     EXTRUDE, INFLATE, ROTATE, ROTATION_PRESETS, SOLIDS, extrude_options, has_solid, inflate_options, is_three_d, solid_art, validate_solid,
@@ -150,6 +154,7 @@ fn lengths_of(id: &str) -> Lengths {
         "texture.patchwork" => always(&["squareSize"]),
         "texture.stainedGlass" => always(&["cellSize"]),
         "sketch.halftonePattern" => always(&["size"]),
+        RASTERIZE => always(&["addAround"]),
         _ => Lengths::default(),
     }
 }
@@ -202,29 +207,29 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             REVOLVE,
             "Revolve…",
             &["Effect", "3D and Materials"],
-            "{angle: degrees (0..360, 360), offset: pt (0..100000, 0), edge: left|right, rotationX: degrees (0), rotationY: degrees (0), rotationZ: degrees (0), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), segments: integer (8..128, 64), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth), cap: bool (true, close circular ends of open profiles; partial-sweep cut sides stay open), expandVisibleOnly: bool (true, trim covered opaque solid surfaces only on Expand Appearance)}. Shaded surfaces use smooth vector gradients automatically; intersecting profiles use approximate painter visibility.",
-            json!({"angle":360.0,"offset":0.0,"edge":"left","rotationX":0.0,"rotationY":0.0,"rotationZ":0.0,"perspectiveAngle":0.0,"segments":64,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0,"cap":true,"expandVisibleOnly":true}),
+            "{angle: degrees (0..360, 360), offset: pt (0..100000, 0), edge: left|right, rotationX: degrees (0), rotationY: degrees (0), rotationZ: degrees (0), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), segments: integer (8..128, 64), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth), cap: bool (true, close circular ends of open profiles; partial-sweep cut sides stay open), expandVisibleOnly: bool (true, trim covered opaque solid surfaces only on Expand Appearance)}. Shaded surfaces use smooth vector gradients automatically; intersecting profiles use approximate painter visibility.",
+            json!({"angle":360.0,"offset":0.0,"edge":"left","rotationX":0.0,"rotationY":0.0,"rotationZ":0.0,"perspectiveAngle":0.0,"segments":64,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0,"cap":true,"expandVisibleOnly":true}),
         ),
         g(
             EXTRUDE,
             "Extrude & Bevel…",
             &["Effect", "3D and Materials"],
-            "{depth: pt (0..2000, 50), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: hollow), bevel: none|classic|rounded|cove|step|ogee (none), bevelWidth: pt (0..1000, 4), bevelHeight: pt (0..1000, 4), bevelRepeat: integer (1..32, 1), bevelSpace: % (0..90, 0; flat between repeats), bevelInside: bool (false: added around the shape; true: carved into it), bevelBothSides: bool (false), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. The front face is the art, extruded backwards about the centre of its bounds; painted with the top fill (else the top stroke).",
-            json!({"depth":50.0,"twist":0.0,"taper":100.0,"cap":true,"bevel":"none","bevelWidth":4.0,"bevelHeight":4.0,"bevelRepeat":1,"bevelSpace":0.0,"bevelInside":false,"bevelBothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
+            "{depth: pt (0..2000, 50), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: hollow), bevel: none|classic|rounded|cove|step|ogee (none), bevelWidth: pt (0..1000, 4), bevelHeight: pt (0..1000, 4), bevelRepeat: integer (1..32, 1), bevelSpace: % (0..90, 0; flat between repeats), bevelInside: bool (false: added around the shape; true: carved into it), bevelBothSides: bool (false), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. The front face is the art, extruded backwards about the centre of its bounds; painted with the top fill (else the top stroke).",
+            json!({"depth":50.0,"twist":0.0,"taper":100.0,"cap":true,"bevel":"none","bevelWidth":4.0,"bevelHeight":4.0,"bevelRepeat":1,"bevelSpace":0.0,"bevelInside":false,"bevelBothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             INFLATE,
             "Inflate…",
             &["Effect", "3D and Materials"],
-            "{depth: pt (0..2000, 0; flat depth between front and back), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: no back, a shell open behind), volume: % (0..100, 50; 50 rounds the edge like a half sphere), bothSides: bool (false: flat back), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Painted with the top fill (else the top stroke).",
-            json!({"depth":0.0,"twist":0.0,"taper":100.0,"cap":true,"volume":50.0,"bothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
+            "{depth: pt (0..2000, 0; flat depth between front and back), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: no back, a shell open behind), volume: % (0..100, 50; 50 rounds the edge like a half sphere), bothSides: bool (false: flat back), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Painted with the top fill (else the top stroke).",
+            json!({"depth":0.0,"twist":0.0,"taper":100.0,"cap":true,"volume":50.0,"bothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             ROTATE,
             "Rotate…",
             &["Effect", "3D and Materials"],
-            "{rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Turns the flat art in 3D about the centre of its bounds; every fill and stroke keeps its paint, shaded as one plane.",
-            json!({"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
+            "{rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Turns the flat art in 3D about the centre of its bounds; every fill and stroke keeps its paint, shaded as one plane.",
+            json!({"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             "convertToShape.rectangle",
@@ -336,6 +341,13 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
         ),
         r("stylize.feather", "Feather…", STYLIZE, "{radius: pt (5)}", json!({"radius": 5.0})),
         r("blur.gaussian", "Gaussian Blur…", BLUR, "{radius: pt (5)}", json!({"radius": 5.0})),
+        r(
+            "artistic.cutout",
+            "Cutout…",
+            ARTISTIC,
+            "{levels: 2..8 (4; steps per colour channel: more levels, more flat colours), edgeSimplicity: 0..10 (4; simpler, smoother edges), edgeFidelity: 1..3 (2; keeps more of the edges' detail)} redraws the object as flat pieces of coloured paper, each piece painted in the average colour that falls into it, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"levels": 4.0, "edgeSimplicity": 4.0, "edgeFidelity": 2.0}),
+        ),
         r(
             "artistic.filmGrain",
             "Film Grain…",
@@ -343,6 +355,20 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "{grain: 0..20 (4; monochrome noise in shadows and midtones), highlightArea: 0..20 (0; widens the bright highlight area), intensity: 0..10 (10; highlight strength and quieter highlight grain)}. Smooth document-space grain follows translations; minification uses approximate footprint filtering. Coverage and pure white are preserved; black takes light speckles, and saturated colour channels may clip. Grain 0 with either highlightArea 0 or intensity 0 leaves the art unchanged. Original visual approximation; chosen VectorCraft defaults.",
             json!({"grain": 4.0, "highlightArea": 0.0, "intensity": 10.0}),
         ),
+        r(
+            "artistic.neonGlow",
+            "Neon Glow…",
+            ARTISTIC,
+            "{glowSize: -24..24 (5; above 0 the light areas glow, below 0 the dark ones; farther from 0 spreads the glow wider), glowBrightness: 0..50 (15; a stronger glow over dimmer greys), color: \"#rrggbb\" (\"#4da6ff\"; the glow's colour)} redraws the object in greys lit by a coloured glow, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"glowSize": 5.0, "glowBrightness": 15.0, "color": "#4da6ff"}),
+        ),
+        r(
+            "artistic.posterEdges",
+            "Poster Edges…",
+            ARTISTIC,
+            "{edgeThickness: 0..10 (2; wider lines), edgeIntensity: 0..10 (1; darker lines, on fainter edges too), posterization: 0..6 (2; posterization + 2 levels per colour channel)} reduces the object's colours and draws black lines on its edges, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"edgeThickness": 2.0, "edgeIntensity": 1.0, "posterization": 2.0}),
+        ),
         r(
             "blur.radial",
             "Radial Blur…",
@@ -354,7 +380,7 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "blur.smart",
             "Smart Blur…",
             BLUR,
-            "{radius: pt 0.1..100 (3), threshold: levels 0.1..100 (25; only colours closer than this blur together, so edges stay sharp), quality: \"low\"|\"medium\"|\"high\" (\"medium\"; 5, 7 or 9 samples across), blurMode: \"normal\"|\"edgeOnly\"|\"overlayEdge\" (\"normal\"; edgeOnly: the edges in white on black, overlayEdge: the edges in white over the blur)}. A pixel is on an edge when one of its four nearest pixels differs from it by more than the threshold in a channel and its channels (alpha included) add up to at least that pixel's; the white and the black keep each pixel's coverage, and the radius changes only the blur",
+            "{radius: pt 0.1..100 (3), threshold: levels 0.1..100 (25; only colours closer than this blur together, so edges stay sharp), quality: \"low\"|\"medium\"|\"high\" (\"medium\"; 5, 7 or 9 samples across), blurMode: \"normal\"|\"edgeOnly\"|\"overlayEdge\" (\"normal\"; edgeOnly: the edges in white on black, overlayEdge: the edges in white over the blur)}. A pixel is on an edge when one of the pixels the search reads within the radius (all of them for a small radius, a grid of samples for a wide one) or one of its four nearest pixels differs from it by more than the threshold in a channel and its channels (alpha included) add up to at least that pixel's, so a step gives a line about as wide as the radius, and at least one pixel wide, on the side with the larger sum; the white and the black keep each pixel's coverage",
             json!({"radius": 3.0, "threshold": 25.0, "quality": "medium", "blurMode": "normal"}),
         ),
         r(
@@ -614,6 +640,13 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
         "{style?: \"roman\"|\"japanese\" (default: the japaneseCropMarks preference when applied)} trim marks in [Registration] around the object's bounds, following it",
         json!({}),
     ));
+    v.push(r(
+        RASTERIZE,
+        "Rasterize…",
+        &["Effect"],
+        "{colorModel: \"document\" (the document's mode, RGB or CMYK)|\"grayscale\"|\"bitmap\" (\"document\"), useDocumentResolution: bool (true: Document Raster Effects Settings › Resolution), resolution: ppi 1..2400 (72; with useDocumentResolution false), background: \"white\"|\"transparent\" (\"transparent\"), antiAlias: \"none\"|\"art\"|\"type\" (\"art\"; none: hard edges), clippingMask: bool (false; the image clipped to the art's outline), addAround: pt 0..1000 (0; room around the art)} draws the object as an image of square pixels over its bounds and the room around them, leaving its paths, type and other art as they are; when it is the object's only raster effect, Expand Appearance makes the image Object › Rasterize makes",
+        json!({"colorModel": "document", "useDocumentResolution": true, "resolution": 72.0, "background": "transparent", "antiAlias": "art", "clippingMask": false, "addAround": 0.0}),
+    ));
     v
 }
 
@@ -763,7 +796,7 @@ pub fn scale_effect(e: &mut Effect, s: f64) {
 
 /// Is `id` a raster (painted) effect?
 pub fn is_raster(id: &str) -> bool {
-    matches!(id, "stylize.dropShadow" | "stylize.innerGlow" | "stylize.outerGlow" | "stylize.feather" | "blur.gaussian")
+    matches!(id, "stylize.dropShadow" | "stylize.innerGlow" | "stylize.outerGlow" | "stylize.feather" | "blur.gaussian" | RASTERIZE)
         || PIXEL_EFFECTS.contains(&id)
 }
 

crates/effects/src/lighting.rs

@@ -0,0 +1,373 @@
+//! Shared conversion and vector paint shading for the 3D effects' directional lights.
+use serde_json::Value;
+use vectorcraft_doc::color::{Color, Paint};
+use vectorcraft_doc::{AppearanceItem, FillLayer};
+
+fn parse(v: &Value) -> Option<Color> {
+    let s = v.as_str()?;
+    // Match the command's opaque RGB contract, before any parsing or allocation.
+    (s.len() == 7 && s.starts_with('#') && s.as_bytes().iter().skip(1).all(u8::is_ascii_hexdigit)).then(|| Color::from_hex(s)).flatten()
+}
+
+pub(crate) fn light_color(p: &Value) -> [f64; 3] {
+    p.get("lightColor").and_then(parse).unwrap_or(Color::WHITE).to_rgb_uncalibrated().map(f64::from)
+}
+
+pub(crate) fn validate(p: &Value) -> Result<(), String> {
+    if p.get("lightColor").is_some_and(|v| parse(v).is_none()) {
+        return Err("lightColor must be an opaque RGB color in #rrggbb form".into());
+    }
+    if let Some(list) = p.get("lights").filter(|v| !v.is_null()) {
+        parse_lights(list)?;
+    }
+    Ok(())
+}
+
+pub(crate) fn lights(p: &Value) -> Option<vectorcraft_three_d::Lights> {
+    p.get("lights").filter(|v| !v.is_null()).and_then(|v| parse_lights(v).ok())
+}
+
+fn parse_lights(v: &Value) -> Result<vectorcraft_three_d::Lights, String> {
+    use vectorcraft_three_d::{Light, Lights, MAX_LIGHTS};
+    let list = v.as_array().filter(|v| !v.is_empty() && v.len() <= MAX_LIGHTS).ok_or("lights must contain one to ten lights")?;
+    let mut out = Vec::with_capacity(list.len());
+    for item in list {
+        let item = item.as_object().ok_or("each light must be an object")?;
+        if item.keys().any(|key| !["color", "intensity", "rotation", "height", "softness", "behind"].contains(&key.as_str())) {
+            return Err("unknown light setting: use color, intensity, rotation, height, softness or behind".into());
+        }
+        let defaults = Light::default();
+        let number = |key: &str, default: f64, min: f64, max: f64| -> Result<f64, String> {
+            match item.get(key) {
+                None => Ok(default),
+                Some(v) => v
+                    .as_f64()
+                    .filter(|n| n.is_finite() && *n >= min && *n <= max)
+                    .ok_or_else(|| format!("light {key} must be a number from {min} to {max}")),
+            }
+        };
+        let color = match item.get("color") {
+            None => [1.0; 3],
+            Some(v) => parse(v).ok_or("light color must use opaque #rrggbb")?.to_rgb_uncalibrated().map(f64::from),
+        };
+        let behind = item.get("behind").map_or(Ok(false), |v| v.as_bool().ok_or("light behind must be true or false"))?;
+        out.push(Light {
+            color,
+            behind,
+            intensity: number("intensity", defaults.intensity * 100.0, 0.0, 100.0)? / 100.0,
+            rotation: number("rotation", defaults.rotation, -180.0, 180.0)?,
+            height: number("height", defaults.height, 0.0, 90.0)?,
+            softness: number("softness", defaults.softness * 100.0, 0.0, 100.0)? / 100.0,
+        });
+    }
+    Lights::new(&out)
+}
+
+pub(crate) fn shade(c: Color, rgb: [f64; 3]) -> Color {
+    let [r, g, b] = c.to_rgb();
+    Color::rgb(r * rgb[0] as f32, g * rgb[1] as f32, b * rgb[2] as f32)
+}
+
+pub(crate) fn smooth_paint(g: vectorcraft_three_d::LightGradient, color: Color) -> Paint {
+    use vectorcraft_doc::color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = g.stops().into_iter().map(|(at, rgb)| GradientStop::new(at, shade(color, rgb))).collect();
+    let mut p = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
+    p.geom = Some(GradientGeom { start: g.diffuse.start, end: g.diffuse.end, aspect: 1.0, focal: None });
+    Paint::Gradient(Box::new(p))
+}
+
+/// Multiply two independently placed vector gradients before applying the face's coverage
+/// once. Separately antialiasing the source and light along each triangle edge leaves seams.
+pub(crate) fn gradient_art(
+    id: vectorcraft_doc::NodeId,
+    path: &vectorcraft_geom::PathData,
+    paint: &Paint,
+    light: vectorcraft_three_d::LightGradient,
+) -> vectorcraft_doc::Node {
+    composed_art(id, path, paint, Ramp::Single(light), 0.75)
+}
+
+pub(crate) fn rgb_gradient_art(
+    id: vectorcraft_doc::NodeId,
+    path: &vectorcraft_geom::PathData,
+    paint: &Paint,
+    light: vectorcraft_three_d::RgbGradient,
+) -> vectorcraft_doc::Node {
+    composed_art(id, path, paint, Ramp::Rgb(light), 0.75)
+}
+
+/// Smooth Inflate triangles keep the seam within their narrow projected footprint.
+pub(crate) fn facet_art(
+    id: vectorcraft_doc::NodeId,
+    path: &vectorcraft_geom::PathData,
+    paint: &Paint,
+    light: vectorcraft_three_d::RgbGradient,
+    seam: f64,
+) -> vectorcraft_doc::Node {
+    let [r, g, b] = light.channels;
+    if r == g && g == b {
+        let light = vectorcraft_three_d::LightGradient { diffuse: r, ambient: 0.0, color: [1.0; 3] };
+        if let Some(color) = paint.color() {
+            let paint = smooth_paint(light, color);
+            let mut edge = vectorcraft_doc::StrokeLayer::new(paint.clone(), seam);
+            edge.join = vectorcraft_doc::LineJoin::Round;
+            return vectorcraft_doc::Node::path(
+                id,
+                path.clone(),
+                vectorcraft_doc::Appearance {
+                    items: vec![AppearanceItem::Fill(FillLayer::new(paint)), AppearanceItem::Stroke(edge)],
+                    ..Default::default()
+                },
+            );
+        }
+        return composed_art(id, path, paint, Ramp::Single(light), seam);
+    }
+    composed_art(id, path, paint, Ramp::Rgb(light), seam)
+}
+
+/// Composite smooth solid-fill facets with one clip and three channel groups per surface.
+/// Black channel backdrops keep shared edges opaque before the final coverage is applied.
+pub(crate) fn solid_surface(id: vectorcraft_doc::NodeId, facets: &[vectorcraft_three_d::Facet], paint: &Paint) -> vectorcraft_doc::Node {
+    use kurbo::Shape;
+    use std::sync::Arc;
+    use vectorcraft_doc::color::BlendMode;
+    use vectorcraft_doc::{Appearance, Node, NodeKind, StrokeLayer};
+    use vectorcraft_geom::{BezPath, PathData, Rect, shapes};
+
+    let mut boundary = BezPath::new();
+    let mut bounds = None;
+    for face in facets {
+        let path = face.path();
+        if let Some(b) = path.bounds() {
+            bounds = Some(bounds.map_or(b, |r: Rect| r.union(b)));
+        }
+        let mut contour = path.to_bezpath();
+        if contour.area() < 0.0 {
+            contour = contour.reverse_subpaths();
+        }
+        boundary.extend(contour.iter());
+    }
+    let clip = Node::path(id, PathData::from_bezpath(&boundary), Appearance::default());
+    let bounds = bounds.unwrap_or(Rect::ZERO).inflate(1.0, 1.0);
+    let cover = |paint| Node::path(id, shapes::rectangle(bounds), Appearance::basic(paint, Paint::None, 0.0));
+    let channels = (0..3)
+        .map(|channel| {
+            let mut color = [0.0; 3];
+            if let Some(value) = color.get_mut(channel) {
+                *value = 1.0;
+            }
+            let mut children = vec![Arc::new(cover(Paint::solid(Color::BLACK)))];
+            children.extend(facets.iter().map(|face| {
+                let paint = if let Some(ramp) = face.rgb_gradient {
+                    smooth_paint(vectorcraft_three_d::LightGradient { diffuse: ramp.channels[channel], ambient: 0.0, color }, Color::WHITE)
+                } else {
+                    Paint::solid(shade(Color::WHITE, color.map(|c| c * face.illumination[channel])))
+                };
+                let mut edge = StrokeLayer::new(paint.clone(), (face.thickness() / 2.0).clamp(0.05, 0.75));
+                edge.join = vectorcraft_doc::LineJoin::Round;
+                Arc::new(Node::path(
+                    id,
+                    face.path(),
+                    Appearance { items: vec![AppearanceItem::Fill(FillLayer::new(paint)), AppearanceItem::Stroke(edge)], ..Default::default() },
+                ))
+            }));
+            let mut group = Node::group(id, children);
+            group.isolate = true;
+            group.blend = BlendMode::Screen;
+            Arc::new(group)
+        })
+        .collect();
+    let mut light = Node::group(id, channels);
+    light.isolate = true;
+    light.blend = BlendMode::Multiply;
+    let mut colors = Node::group(id, vec![Arc::new(cover(paint.clone())), Arc::new(light)]);
+    colors.isolate = true;
+    Node::new(id, NodeKind::Group { children: vec![Arc::new(clip), Arc::new(colors)], clip: true })
+}
+
+enum Ramp {
+    Single(vectorcraft_three_d::LightGradient),
+    Rgb(vectorcraft_three_d::RgbGradient),
+}
+
+/// Separate a gradient's color and coverage so a tessellated surface can apply its opacity
+/// once, instead of building opacity at the overlapping seam strokes of adjacent faces.
+pub(crate) fn opaque_paint(paint: &Paint) -> (Paint, Option<Paint>) {
+    let mut base = paint.clone();
+    let mut mask = paint.clone();
+    let mut transparent = false;
+    if let (Paint::Gradient(b), Paint::Gradient(m)) = (&mut base, &mut mask) {
+        b.swatch = None;
+        m.swatch = None;
+        for (b, m) in b.gradient.stops.iter_mut().zip(&mut m.gradient.stops) {
+            transparent |= b.opacity != 1.0;
+            b.opacity = 1.0;
+            m.color = Color::WHITE;
+            m.swatch = None;
+            m.tint = 1.0;
+        }
+        if let (Some(b), Some(m)) = (&mut b.freeform, &mut m.freeform) {
+            for (b, m) in b.points.iter_mut().zip(&mut m.points) {
+                transparent |= b.opacity != 1.0;
+                b.opacity = 1.0;
+                m.color = Color::WHITE;
+            }
+        }
+    }
+    (base, transparent.then_some(mask))
+}
+
+fn composed_art(id: vectorcraft_doc::NodeId, path: &vectorcraft_geom::PathData, paint: &Paint, light: Ramp, seam: f64) -> vectorcraft_doc::Node {
+    use kurbo::Shape;
+    use std::sync::Arc;
+    use vectorcraft_doc::color::BlendMode;
+    use vectorcraft_doc::{Appearance, Node, NodeKind, OpacityMask};
+    use vectorcraft_geom::{Rect, shapes};
+    let (base, mask) = opaque_paint(paint);
+    // Clip once to the union of this single-contour face and its round seam stroke.
+    // Align their winding so the nonzero fill adds coverage instead of cancelling it.
+    let mut boundary = path.to_bezpath();
+    let mut footprint = kurbo::stroke(boundary.iter(), &kurbo::Stroke::new(seam).with_join(kurbo::Join::Round), &kurbo::StrokeOpts::default(), 0.05);
+    if boundary.area() * footprint.area() < 0.0 {
+        boundary = boundary.reverse_subpaths();
+    }
+    footprint.extend(boundary.iter());
+    let clip = Node::path(id, vectorcraft_geom::PathData::from_bezpath(&footprint), Appearance::default());
+    // Opaque rectangles cover the complete seam stroke, without separately antialiasing
+    // either ramp. Opaque sources need only vector clipping, not full-frame opacity masks.
+    let bounds = path.bounds().unwrap_or(Rect::ZERO).inflate(1.0, 1.0);
+    let cover = |paint| Node::path(id, shapes::rectangle(bounds), Appearance::basic(paint, Paint::None, 0.0));
+    let mut illumination = match light {
+        Ramp::Single(light) => cover(smooth_paint(light, Color::WHITE)),
+        Ramp::Rgb(light) => {
+            let channels = light
+                .channels
+                .iter()
+                .enumerate()
+                .map(|(channel, gradient)| {
+                    let mut color = [0.0; 3];
+                    if let Some(value) = color.get_mut(channel) {
+                        *value = 1.0;
+                    }
+                    let mut layer = cover(smooth_paint(vectorcraft_three_d::LightGradient { diffuse: *gradient, ambient: 0.0, color }, Color::WHITE));
+                    // Screen adds disjoint R, G and B channels exactly; no light is clamped
+                    // separately. Each ramp already holds the sum of all directional lights.
+                    layer.blend = BlendMode::Screen;
+                    Arc::new(layer)
+                })
+                .collect();
+            let mut group = Node::group(id, channels);
+            group.isolate = true;
+            group
+        }
+    };
+    illumination.blend = BlendMode::Multiply;
+    let mut colors = Node::group(id, vec![Arc::new(cover(base)), Arc::new(illumination)]);
+    colors.isolate = true;
+    // Keep isolation inside the clip: the clip then applies to the finished colors,
+    // rather than separately antialiasing each of the two gradient drawings.
+    let mut face = Node::new(id, NodeKind::Group { children: vec![Arc::new(clip), Arc::new(colors)], clip: true });
+    if let Some(mask) = mask {
+        face.extras_mut().mask = Some(Box::new(OpacityMask::new(cover(mask), true)));
+    }
+    face
+}
+
+pub(crate) fn fills(paint: &Paint, rgb: [f64; 3], brightness: f64, colored: bool) -> Vec<AppearanceItem> {
+    let shade = |c: Color| shade(c, rgb);
+    if let Some(c) = paint.color() {
+        return vec![AppearanceItem::Fill(FillLayer::new(Paint::solid(shade(c))))];
+    }
+    // Keep the white-light gradient treatment identical to existing documents. Colored light
+    // shades the ramp itself, keeping placement, stops, midpoint and opacity as vector data.
+    if matches!(paint, Paint::Gradient(_)) && colored {
+        let mut shaded = paint.clone();
+        vectorcraft_doc::recolor::map_paint(&mut shaded, &shade);
+        if let Paint::Gradient(g) = &mut shaded {
+            g.swatch = None;
+        }
+        return vec![AppearanceItem::Fill(FillLayer::new(shaded))];
+    }
+    // Pattern tiles remain referenced artwork. Retain their existing neutral shadow
+    // approximation; tinting arbitrary pattern contents needs document-level evaluation.
+    let mut shadow = FillLayer::new(Paint::solid(Color::BLACK));
+    shadow.opacity = (1.0 - brightness) as f32;
+    vec![AppearanceItem::Fill(FillLayer::new(paint.clone())), AppearanceItem::Fill(shadow)]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use vectorcraft_doc::color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    use vectorcraft_geom::Point;
+
+    #[test]
+    fn command_contract_is_strict_and_loaded_invalid_colors_fall_back_to_white() {
+        assert_eq!(light_color(&json!({})), [1.0; 3]);
+        assert_eq!(light_color(&json!({"lightColor":"#FF0000"})), [1.0, 0.0, 0.0]);
+        for v in [json!("#ff0"), json!("#ffffff80"), json!("blue"), json!("#gg0000"), json!(null), json!([1, 0, 0])] {
+            let p = json!({"lightColor":v});
+            assert!(validate(&p).is_err(), "{p}");
+            assert_eq!(light_color(&p), [1.0; 3]);
+        }
+    }
+
+    #[test]
+    fn malformed_loaded_lists_keep_the_legacy_light_and_valid_lists_override_it() {
+        for value in [json!([]), json!(vec![json!({}); 11]), json!([false]), json!([{"height": 91}]), json!([{"color":"#ff0"}])] {
+            let p = json!({"lights": value, "lightColor":"#ff0000"});
+            assert!(lights(&p).is_none());
+            assert_eq!(light_color(&p), [1.0, 0.0, 0.0]);
+            assert!(validate(&p).is_err());
+        }
+        let p = json!({"lights":[{}, {"color":"#0000ff","intensity":40}], "lightColor":"#ff0000"});
+        let list = lights(&p).unwrap();
+        assert_eq!(list.iter().count(), 2);
+        assert_eq!(*list.iter().next().unwrap(), vectorcraft_three_d::Light::default());
+        assert_eq!(list.iter().nth(1).unwrap().color, [0.0, 0.0, 1.0]);
+    }
+
+    #[test]
+    fn colored_gradient_keeps_placement_alpha_and_midpoints() {
+        let mut stop = GradientStop::new(0.0, Color::WHITE);
+        stop.opacity = 0.4;
+        stop.midpoint = 0.3;
+        let g = GradientPaint {
+            gradient: Gradient { kind: GradientKind::Linear, stops: vec![stop, GradientStop::new(1.0, Color::BLACK)] },
+            geom: Some(GradientGeom { start: Point::new(20.0, 30.0), end: Point::new(100.0, 30.0), aspect: 1.0, focal: None }),
+            angle: 0.0,
+            swatch: None,
+            freeform: None,
+        };
+        let paint = Paint::Gradient(Box::new(g.clone()));
+        let items = fills(&paint, [1.0, 0.25, 0.25], 1.0, true);
+        let Paint::Gradient(shaded) = items[0].paint() else { panic!("vector gradient") };
+        assert_eq!(shaded.geom, g.geom);
+        assert_eq!(shaded.gradient.stops[0].color.to_rgb(), [1.0, 0.25, 0.25]);
+        assert_eq!(shaded.gradient.stops[0].opacity, 0.4);
+        assert_eq!(shaded.gradient.stops[0].midpoint, 0.3);
+        assert_eq!(shaded.gradient.stops[1].color, Color::BLACK);
+        assert_eq!(paint, Paint::Gradient(Box::new(g)));
+        let white = fills(&paint, [0.4; 3], 0.4, false);
+        assert_eq!(white[0].paint(), &paint, "white retains the previous gradient treatment");
+        assert_eq!(white.len(), 2);
+        let unlit = fills(&paint, [0.25; 3], 0.25, true);
+        assert_eq!(unlit.len(), 1, "neutral ambient under colored light still tints once");
+        let mut freeform = if let Paint::Gradient(g) = paint { g } else { panic!("gradient") };
+        freeform.gradient.kind = GradientKind::Freeform;
+        freeform.gradient.stops = vec![GradientStop::new(0.0, Color::BLACK)];
+        freeform.swatch = Some("Original ramp".into());
+        freeform.freeform = Some(vectorcraft_doc::color::Freeform {
+            points: vec![vectorcraft_doc::color::FreeformPoint::new(Point::new(12.0, 18.0), Color::WHITE)],
+            ..Default::default()
+        });
+        let original = Paint::Gradient(freeform);
+        let items = fills(&original, [1.0, 0.25, 0.25], 1.0, true);
+        let Paint::Gradient(shaded) = items[0].paint() else { panic!("freeform gradient") };
+        let point = shaded.freeform.as_ref().unwrap().points[0];
+        assert_eq!(point.at, Point::new(12.0, 18.0));
+        assert_eq!(point.color.to_rgb(), [1.0, 0.25, 0.25]);
+        assert_eq!(shaded.swatch, None, "a changed freeform point detaches the gradient swatch");
+    }
+}

crates/effects/src/pixel/artistic.rs

@@ -1,11 +1,13 @@
-//! Effect › Artistic. Original filters built from public behaviour documentation:
+//! Effect › Artistic (Cutout, Film Grain, Neon Glow, Poster Edges). Original filters built from
+//! public behaviour documentation:
 //! <https://helpx.adobe.com/illustrator/using/summary-effects.html> and
 //! <https://helpx.adobe.com/photoshop-elements/using/artistic-filters.html>.
 //! These are visual approximations, not reproductions of a proprietary algorithm.
 
-use super::PixelSpace;
+use super::edges::sobel;
 use super::pixelate::{Place, cell, rand};
 use super::texture::{luma, premultiply, straight};
+use super::{PixelSpace, blur_plane};
 use vectorcraft_geom::Point;
 
 const SALT_FILM: u64 = 256;
@@ -134,3 +136,135 @@ pub(super) fn film_grain(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSp
         *p = premultiply(c, f32::from(p[3]) / 255.0);
     });
 }
+
+/// The coverage-weighted Gaussian softening of the planes `planes` (premultiplied by `alpha`) by
+/// `sigma` pixels: each divided by the softened coverage, so transparency doesn't darken edges.
+fn soften(planes: &mut [Vec<f32>], alpha: &[f32], w: usize, h: usize, sigma: f64) {
+    let mut a = alpha.to_vec();
+    blur_plane(&mut a, w, h, sigma);
+    for plane in planes {
+        for (v, c) in plane.iter_mut().zip(alpha) {
+            *v *= c;
+        }
+        blur_plane(plane, w, h, sigma);
+        for (v, c) in plane.iter_mut().zip(&a) {
+            *v = if *c > 1e-4 { (*v / c).clamp(0.0, 1.0) } else { 0.0 };
+        }
+    }
+}
+
+/// The pixels' straight colour channels and their coverage (0..1), as planes.
+fn planes(px: &[[u8; 4]]) -> ([Vec<f32>; 3], Vec<f32>) {
+    let colours = px.iter().map(|p| straight(*p)).collect::<Vec<_>>();
+    (std::array::from_fn(|k| colours.iter().map(|c| c[k]).collect()), px.iter().map(|p| f32::from(p[3]) / 255.0).collect())
+}
+
+/// Cutout: the object as flat pieces of coloured paper. Its colours, softened as `simplicity`
+/// (0..10) asks and less as `fidelity` (1..3) keeps detail, fall into `levels` (2..8) steps per
+/// colour channel; each step's piece is painted in the average colour of what falls into it, so
+/// colours keep their hue. Slivers (the blends along softened edges) take the nearest large
+/// piece's colour, so the pieces meet with crisp edges. Coverage is kept.
+pub(super) fn cutout(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, levels: f64, simplicity: f64, fidelity: f64) {
+    if !([levels, simplicity, fidelity].iter().all(|v| v.is_finite()) && space.px.is_finite() && space.px > 0.0) {
+        return;
+    }
+    let levels = levels.round().clamp(2.0, 8.0) as usize;
+    // Simpler edges come from softer colours; more fidelity softens them less.
+    let sigma = 0.6 * simplicity.clamp(0.0, 10.0) * (4.0 - fidelity.clamp(1.0, 3.0)) / 3.0 / space.px;
+    let (mut colour, alpha) = planes(px);
+    soften(&mut colour, &alpha, w, h, sigma);
+    let at = |k: usize| [0, 1, 2].map(|i| colour[i].get(k).copied().unwrap_or(0.0));
+    let piece = |c: [f32; 3]| c.iter().fold(0, |n, v| n * levels + ((v * levels as f32) as usize).min(levels - 1));
+    // Each piece's colour: the coverage-weighted mean of the softened colours in it.
+    let mut sums = vec![[0.0f64; 4]; levels * levels * levels];
+    for (k, a) in alpha.iter().enumerate() {
+        let c = at(k);
+        let Some(sum) = sums.get_mut(piece(c)) else { continue };
+        for (s, v) in sum.iter_mut().zip(c) {
+            *s += f64::from(v * a);
+        }
+        sum[3] += f64::from(*a);
+    }
+    let mean = |sum: &[f64; 4]| [0, 1, 2].map(|i| (sum[i] / sum[3]) as f32);
+    let total: f64 = sums.iter().map(|s| s[3]).sum();
+    let heaviest = sums.iter().map(|s| s[3]).fold(0.0, f64::max);
+    // Pieces of at least 1% of the object (and always the largest one) are kept.
+    let large: Vec<[f32; 3]> = sums.iter().filter(|s| s[3] > 0.0 && (s[3] >= 0.01 * total || s[3] >= heaviest)).map(mean).collect();
+    let paint: Vec<Option<[f32; 3]>> = sums
+        .iter()
+        .map(|s| {
+            let c = (s[3] > 0.0).then(|| mean(s))?;
+            let far = |o: &[f32; 3]| o.iter().zip(c).map(|(a, b)| (a - b) * (a - b)).sum::<f32>();
+            large.iter().min_by(|a, b| far(a).total_cmp(&far(b))).copied()
+        })
+        .collect();
+    for (k, p) in px.iter_mut().enumerate() {
+        if p[3] == 0 {
+            continue;
+        }
+        if let Some(Some(c)) = paint.get(piece(at(k))) {
+            *p = premultiply(*c, f32::from(p[3]) / 255.0);
+        }
+    }
+}
+
+/// Poster Edges: the object's colours posterized to `posterization` + 2 (2..8) levels per
+/// channel, with black lines drawn on the edges of any of its colour channels and of its outline. `thickness` (0..10) widens the lines and
+/// `intensity` (0..10) darkens them and lets fainter edges take a line. Coverage is kept.
+pub(super) fn poster_edges(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, thickness: f64, intensity: f64, posterization: f64) {
+    if !([thickness, intensity, posterization].iter().all(|v| v.is_finite()) && space.px.is_finite() && space.px > 0.0) {
+        return;
+    }
+    let steps = (posterization.round().clamp(0.0, 6.0) + 1.0) as f32;
+    // The edges of each premultiplied channel (so the object's outline too), a step of 1 reading 1.
+    let mut edges = vec![0.0f32; px.len()];
+    for k in 0..4 {
+        let plane: Vec<f32> = px.iter().map(|p| f32::from(p[k]) / 255.0).collect();
+        for (e, s) in edges.iter_mut().zip(sobel(&plane, w, h)) {
+            *e = e.max(s / 4.0);
+        }
+    }
+    // Wider lines spread the edges; scale them back up so a spread line stays as dark.
+    let sigma = (0.3 + 0.25 * thickness.clamp(0.0, 10.0)) / space.px;
+    blur_plane(&mut edges, w, h, sigma);
+    let gain = ((0.3 + 0.25 * intensity.clamp(0.0, 10.0)) * (1.0 + 1.5 * sigma.max(0.0))) as f32;
+    for (p, e) in px.iter_mut().zip(edges) {
+        if p[3] == 0 {
+            continue;
+        }
+        let t = ((e * gain - 0.25) / 0.5).clamp(0.0, 1.0);
+        let ink = t * t * (3.0 - 2.0 * t);
+        let c = straight(*p).map(|v| (v * steps).round() / steps * (1.0 - ink));
+        *p = premultiply(c, f32::from(p[3]) / 255.0);
+    }
+}
+
+/// How far (document units) Neon Glow's glow spreads at `size` (-24..24).
+pub(super) fn glow_spread(size: f64) -> f64 {
+    0.25 * size.abs().min(24.0)
+}
+
+/// Neon Glow: the object in dimmed greys, lit by `colour` glowing from its light areas (`size`
+/// above 0) or from its dark areas (below 0), spread as far as |`size`| (0..24) says and as
+/// strong as `brightness` (0..50). Coverage is kept.
+pub(super) fn neon_glow(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, size: f64, brightness: f64, colour: [f32; 3]) {
+    if !([size, brightness].iter().all(|v| v.is_finite()) && space.px.is_finite() && space.px > 0.0) {
+        return;
+    }
+    let strength = (brightness / 50.0).clamp(0.0, 1.0) as f32;
+    let tones: Vec<f32> = px.iter().map(|p| luma(straight(*p))).collect();
+    let alpha: Vec<f32> = px.iter().map(|p| f32::from(p[3]) / 255.0).collect();
+    let mut glow = [tones.iter().map(|l| if size < 0.0 { 1.0 - l } else { *l }).collect::<Vec<_>>()];
+    soften(&mut glow, &alpha, w, h, glow_spread(size) / space.px);
+    let [glow] = glow;
+    for ((p, tone), g) in px.iter_mut().zip(tones).zip(glow) {
+        if p[3] == 0 {
+            continue;
+        }
+        // The greys dim as the glow brightens, and the glow is screened over them.
+        let base = tone * (1.0 - 0.6 * strength);
+        let lit = (3.0 * g * strength).clamp(0.0, 1.0);
+        let c = colour.map(|v| 1.0 - (1.0 - base) * (1.0 - v.clamp(0.0, 1.0) * lit));
+        *p = premultiply(c, f32::from(p[3]) / 255.0);
+    }
+}

crates/effects/src/pixel/blur.rs

@@ -102,6 +102,40 @@ fn close(a: &Px16, b: &Px16, t: i32) -> bool {
     a.iter().zip(b).all(|(a, b)| (*a as i32 - *b as i32).abs() <= t)
 }
 
+/// The offsets Smart Blur looks at around a pixel out to about `r` pixels (up to round(`r`)),
+/// with the radius of the box blur of the copy they are read from (0: the pixels themselves):
+/// every pixel of the square of side 2 · round(`r`) + 1, or `samples` × `samples` points spread
+/// over the square once it is wider than `samples` pixels, read from a copy box-blurred over the
+/// gaps between them. The callers keep the offsets inside their disc.
+fn smart_grid(r: f64, samples: u32) -> (Vec<Vec2>, usize) {
+    let n = samples.clamp(3, 15) as f64;
+    let k = r.round();
+    if 2.0 * k < n {
+        let k = k as i32;
+        ((-k..=k).flat_map(|dy| (-k..=k).map(move |dx| Vec2::new(dx as f64, dy as f64))).collect(), 0)
+    } else {
+        let gap = 2.0 * r / (n - 1.0);
+        let grid = (0..n as i32).map(|i| -r + gap * i as f64);
+        (grid.clone().flat_map(|dy| grid.clone().map(move |dx| Vec2::new(dx.round(), dy.round()))).collect(), (gap / 2.0).floor() as usize)
+    }
+}
+
+/// How far from a pixel Smart Blur's edge modes ([`smart_edges`]) read, in the units of `radius`:
+/// `radius`, and the box blur of the copy that a wide radius's offsets are read from.
+pub(super) fn edge_reach(radius: f64, samples: u32) -> f64 {
+    radius + radius / (samples.clamp(3, 15) as f64 - 1.0)
+}
+
+/// `src` (rows of `w` pixels) box-blurred with radius `prefilter`, the copy that the offsets of
+/// [`smart_grid`] are read from; `None` when they are read from `src` itself.
+fn smart_near(src: &[Px16], w: usize, prefilter: usize) -> Option<Vec<Px16>> {
+    (prefilter > 0).then(|| {
+        let mut b = src.to_vec();
+        box_blur(&mut b, w, prefilter);
+        b
+    })
+}
+
 /// Smart Blur (Normal mode): each pixel averaged with itself and the neighbours within `radius`
 /// pixels whose premultiplied channels all lie within `threshold` levels of its own. Wide radii
 /// look at `samples` × `samples` neighbours spread over the disc, read from a copy box-blurred
@@ -113,28 +147,12 @@ pub(super) fn smart(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, thresho
         return;
     }
     let r = radius.min(MAX_SMART);
-    let n = samples.clamp(3, 15) as f64;
-    let k = r.round();
-    let (offsets, prefilter): (Vec<Vec2>, usize) = if 2.0 * k < n {
-        let k = k as i32;
-        ((-k..=k).flat_map(|dy| (-k..=k).map(move |dx| Vec2::new(dx as f64, dy as f64))).collect(), 0)
-    } else {
-        let gap = 2.0 * r / (n - 1.0);
-        let grid = (0..n as i32).map(|i| -r + gap * i as f64);
-        (grid.clone().flat_map(|dy| grid.clone().map(move |dx| Vec2::new(dx.round(), dy.round()))).collect(), (gap / 2.0).floor() as usize)
-    };
+    let (offsets, prefilter) = smart_grid(r, samples);
     let offsets: Vec<(isize, isize)> =
         offsets.into_iter().filter(|o| o.hypot() <= r + 0.5 && *o != Vec2::ZERO).map(|o| (o.x as isize, o.y as isize)).collect();
     let src = to16(px);
-    let blurred;
-    let near: &[Px16] = if prefilter > 0 {
-        let mut b = src.clone();
-        box_blur(&mut b, w, prefilter);
-        blurred = b;
-        &blurred
-    } else {
-        &src
-    };
+    let blurred = smart_near(&src, w, prefilter);
+    let near = blurred.as_deref().unwrap_or(&src);
     let t = levels(threshold);
     for (y, (row, out)) in src.chunks_exact(w).zip(px.chunks_exact_mut(w)).enumerate().take(h) {
         for (x, (c, o)) in row.iter().zip(out.iter_mut()).enumerate() {
@@ -162,33 +180,41 @@ pub(super) fn smart(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, thresho
 
 /// Smart Blur's Edge Only (`overlay` false) and Overlay Edge (`overlay` true) modes: the pixels on
 /// an edge drawn white, over black or over the Normal mode's result ([`smart`]). A pixel is on an
-/// edge when one of its four nearest neighbors (transparent beyond the raster) has a premultiplied
-/// channel more than `threshold` levels from its own and its channels add up to at least the
-/// neighbor's, so a step between two colors gives a line one pixel wide on the side whose channels
-/// add up to more, and two pixels wide when the sums are equal. The white and the black keep the
-/// pixel's coverage.
+/// edge when one of the pixels the search reads within `radius` pixels of it (transparent beyond
+/// the raster) has a premultiplied channel more than `threshold` levels from its own and its
+/// channels add up to at least that pixel's. The search reads the Normal mode's offsets ([`smart_grid`]) for the whole
+/// pixels of `radius`, kept within `radius`, from the pixels and, for a wide radius, from the
+/// box-blurred copy, and always the four nearest pixels. A straight step between two colors gives
+/// a line on the side whose channels add up to more, about `radius` wide (the whole pixels of
+/// `radius` while every pixel within it is read, and at least one pixel), and lines on both sides
+/// when the sums are equal. The white and the black keep the pixel's coverage.
 pub(super) fn smart_edges(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, threshold: f64, samples: u32, overlay: bool) {
     let src = to16(px);
     let t = levels(threshold);
     let sum = |p: &Px16| p.iter().map(|v| u32::from(*v)).sum::<u32>();
-    let at = |x: usize, y: usize, dx: isize, dy: isize| -> Px16 {
-        let (Some(x), Some(y)) = (x.checked_add_signed(dx), y.checked_add_signed(dy)) else { return [0; 4] };
-        if x >= w || y >= h {
-            return [0; 4];
+    let r = if radius.is_nan() { 0.0 } else { radius.min(MAX_SMART) };
+    // Spread over whole pixels, so that the outermost offsets lie within `r` and are kept.
+    let (offsets, prefilter) = smart_grid(r.floor(), samples);
+    let wide: Vec<(isize, isize)> = offsets.into_iter().filter(|o| o.hypot() > 1.0 && o.hypot() <= r).map(|o| (o.x as isize, o.y as isize)).collect();
+    let nearest = [(1, 0), (-1, 0), (0, 1), (0, -1)];
+    let blurred = smart_near(&src, w, prefilter);
+    let mut edge = vec![false; src.len()];
+    for (y, (row, out)) in src.chunks_exact(w).zip(edge.chunks_exact_mut(w)).enumerate().take(h) {
+        for (x, (c, e)) in row.iter().zip(out.iter_mut()).enumerate() {
+            let own = sum(c);
+            let differs = |n: &Px16| !close(n, c, t) && own >= sum(n);
+            // The pixel at the offset and, with `copy`, its blurred copy; transparent beyond the raster.
+            let found = |(dx, dy): &(isize, isize), copy: bool| {
+                let (sx, sy) = (x as isize + dx, y as isize + dy);
+                if sx < 0 || sy < 0 || sx as usize >= w || sy as usize >= h {
+                    return differs(&[0; 4]);
+                }
+                let i = sy as usize * w + sx as usize;
+                src.get(i).is_some_and(differs) || (copy && blurred.as_deref().and_then(|b| b.get(i)).is_some_and(differs))
+            };
+            *e = nearest.iter().any(|o| found(o, false)) || wide.iter().any(|o| found(o, true));
         }
-        src.get(y * w + x).copied().unwrap_or([0; 4])
-    };
-    let edge: Vec<bool> = src
-        .iter()
-        .enumerate()
-        .map(|(i, c)| {
-            let (x, y) = (i % w.max(1), i / w.max(1));
-            [(1, 0), (-1, 0), (0, 1), (0, -1)].iter().any(|(dx, dy)| {
-                let n = at(x, y, *dx, *dy);
-                !close(&n, c, t) && sum(c) >= sum(&n)
-            })
-        })
-        .collect();
+    }
     if overlay {
         smart(px, w, h, radius, threshold, samples);
     }

crates/effects/src/pixel/mod.rs

@@ -1,4 +1,4 @@
-//! Photoshop-style raster effects (Effect › Artistic › Film Grain, Blur › Radial Blur and Smart Blur, Brush Strokes ›
+//! Photoshop-style raster effects (Effect › Artistic › Cutout, Film Grain, Neon Glow and Poster Edges, Blur › Radial Blur and Smart Blur, Brush Strokes ›
 //! Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes
 //! and Sumi-e, Distort › Diffuse Glow, Glass and Ocean Ripple, Pixelate › Color Halftone,
 //! Crystallize, Mezzotint and Pointillize, Sharpen › Unsharp Mask, Sketch › Halftone Pattern, Stylize ›
@@ -39,8 +39,11 @@ pub use sketch::{HALFTONE_TYPES, HalftonePattern};
 pub use texture::{GRAIN_TYPES, Grain, LIGHT_DIRECTIONS, Light, TEXTURES, Texture};
 
 /// The Photoshop-style effect ids (all raster effects, see [`crate::is_raster`]).
-pub const PIXEL_EFFECTS: [&str; 29] = [
+pub const PIXEL_EFFECTS: [&str; 32] = [
+    "artistic.cutout",
     "artistic.filmGrain",
+    "artistic.neonGlow",
+    "artistic.posterEdges",
     "blur.radial",
     "blur.smart",
     "brushStrokes.accentedEdges",
@@ -75,18 +78,27 @@ pub const PIXEL_EFFECTS: [&str; 29] = [
 /// are in document units.
 #[derive(Clone, Debug, PartialEq)]
 pub enum PixelFx {
+    /// Artistic › Cutout: flat pieces of colour in `levels` (2..8) steps per channel, their
+    /// edges as simple as `simplicity` (0..10) and as faithful as `fidelity` (1..3) say.
+    Cutout { levels: f64, simplicity: f64, fidelity: f64 },
     /// Artistic › Film Grain: monochrome grain in shadows and midtones, a wider bright
     /// highlight area (0..20), and tonal intensity (0..10), preserving coverage.
     FilmGrain { grain: f64, highlight: f64, intensity: f64 },
+    /// Artistic › Neon Glow: dimmed greys lit by `colour` (straight RGB, 0..1) glowing from the
+    /// light areas (`size` above 0) or the dark ones (below 0), spread by |`size`| (-24..24), as
+    /// strong as `brightness` (0..50).
+    NeonGlow { size: f64, brightness: f64, colour: [f32; 3] },
+    /// Artistic › Poster Edges: colours posterized to `posterization` + 2 levels (0..6) with black
+    /// lines on the edges, as thick as `thickness` (0..10) and as dark as `intensity` (0..10).
+    PosterEdges { thickness: f64, intensity: f64, posterization: f64 },
     /// Blur › Radial Blur around the object's centre: along arcs (spin, an arc of `amount`°) or
     /// along rays (zoom, the content scaled by up to about ±`amount`/2 %), averaging 2^`passes` samples.
     RadialBlur { amount: f64, zoom: bool, passes: u32 },
     /// Blur › Smart Blur (Normal mode): each pixel averaged with the neighbours within `radius`
     /// whose colour differs from its own by no more than `threshold` levels, over a grid of
     /// `samples` × `samples` neighbours at most.
-    /// The Edge Only `mode` draws the edges where neighboring pixels differ by more than
-    /// `threshold` levels in white on black, and Overlay Edge draws them in white over the Normal
-    /// result.
+    /// The Edge Only `mode` draws the edges that `threshold` and `radius` find (`blur::smart_edges`)
+    /// in white on black, and Overlay Edge draws them in white over the Normal result.
     SmartBlur { radius: f64, threshold: f64, samples: u32, mode: SmartBlurMode },
     /// Brush Strokes › Accented Edges: the edges, about `width` (1..14) wide, accented towards
     /// white chalk or black ink as `brightness` (0..50) says; `smoothness` (1..15) softens them.
@@ -210,6 +222,21 @@ pub(crate) fn parse(id: &str, p: &Value) -> Option<PixelFx> {
         levels.iter().find(|(name, _)| name.eq_ignore_ascii_case(q)).map_or(default, |(_, v)| *v)
     };
     Some(match id {
+        "artistic.cutout" => PixelFx::Cutout {
+            levels: num(p, "levels", 4.0).round().clamp(2.0, 8.0),
+            simplicity: num(p, "edgeSimplicity", 4.0).clamp(0.0, 10.0),
+            fidelity: num(p, "edgeFidelity", 2.0).round().clamp(1.0, 3.0),
+        },
+        "artistic.neonGlow" => PixelFx::NeonGlow {
+            size: num(p, "glowSize", 5.0).clamp(-24.0, 24.0),
+            brightness: num(p, "glowBrightness", 15.0).clamp(0.0, 50.0),
+            colour: crate::raster::color_param(p, vectorcraft_doc::color::Color::rgb(0.3, 0.65, 1.0)).to_rgb(),
+        },
+        "artistic.posterEdges" => PixelFx::PosterEdges {
+            thickness: num(p, "edgeThickness", 2.0).clamp(0.0, 10.0),
+            intensity: num(p, "edgeIntensity", 1.0).clamp(0.0, 10.0),
+            posterization: num(p, "posterization", 2.0).round().clamp(0.0, 6.0),
+        },
         "artistic.filmGrain" => PixelFx::FilmGrain {
             grain: num(p, "grain", 4.0).clamp(0.0, 20.0),
             highlight: num(p, "highlightArea", 0.0).clamp(0.0, 20.0),
@@ -368,6 +395,9 @@ impl PixelFx {
             PixelFx::UnsharpMask { .. } | PixelFx::HalftonePattern { .. } => 0.0,
             PixelFx::GlowingEdges { width, smoothness, .. } => width.max(smoothness * 3.0),
             PixelFx::FilmGrain { .. }
+            | PixelFx::Cutout { .. }
+            | PixelFx::NeonGlow { .. }
+            | PixelFx::PosterEdges { .. }
             | PixelFx::ColorHalftone { .. }
             | PixelFx::Mezzotint { .. }
             | PixelFx::Craquelure { .. }
@@ -388,7 +418,8 @@ impl PixelFx {
     pub fn reach(&self) -> Option<f64> {
         match *self {
             PixelFx::RadialBlur { .. } => None,
-            PixelFx::SmartBlur { radius, .. } => Some(radius),
+            PixelFx::SmartBlur { radius, mode: SmartBlurMode::Normal, .. } => Some(radius),
+            PixelFx::SmartBlur { radius, samples, .. } => Some(blur::edge_reach(radius, samples)),
             PixelFx::AccentedEdges { width, smoothness, .. } => Some(brushstrokes::accent_reach(width, smoothness)),
             // The strokes, and the softened tones that choose them.
             PixelFx::AngledStrokes { length, .. } => Some(brushstrokes::stroke_reach(length).max(brushstrokes::TONE_REACH)),
@@ -409,6 +440,12 @@ impl PixelFx {
             PixelFx::ColorHalftone { max_radius, .. } => Some(3.0 * std::f64::consts::SQRT_2 * max_radius),
             PixelFx::Crystallize { cell } => Some(1.5 * cell),
             PixelFx::FilmGrain { .. } | PixelFx::Mezzotint { .. } | PixelFx::HalftonePattern { .. } => Some(0.0),
+            // Cutout's palette comes from the whole object.
+            PixelFx::Cutout { .. } => None,
+            // The softened tones around the pixel.
+            PixelFx::NeonGlow { size, .. } => Some(3.0 * artistic::glow_spread(size)),
+            // The edges' lines, spread round them.
+            PixelFx::PosterEdges { thickness, .. } => Some(3.0 * (0.3 + 0.25 * thickness) + 1.0),
             // The dots' points, and the softened colour around them.
             PixelFx::Pointillize { cell } => Some(2.5 * cell),
             // The softened tones around the pixel.
@@ -429,7 +466,12 @@ impl PixelFx {
         let Some(px) = pixels(data, w, h) else { return };
         let to_px = |len: f64| len / space.px.max(1e-9);
         match *self {
+            PixelFx::Cutout { levels, simplicity, fidelity } => artistic::cutout(px, w, h, space, levels, simplicity, fidelity),
             PixelFx::FilmGrain { grain, highlight, intensity } => artistic::film_grain(px, w, h, space, grain, highlight, intensity),
+            PixelFx::NeonGlow { size, brightness, colour } => artistic::neon_glow(px, w, h, space, size, brightness, colour),
+            PixelFx::PosterEdges { thickness, intensity, posterization } => {
+                artistic::poster_edges(px, w, h, space, thickness, intensity, posterization)
+            }
             PixelFx::RadialBlur { amount, zoom, passes } => blur::radial(px, w, h, space, amount, zoom, passes),
             PixelFx::SmartBlur { radius, threshold, samples, mode: SmartBlurMode::Normal } => {
                 blur::smart(px, w, h, to_px(radius), threshold, samples)
@@ -552,6 +594,45 @@ pub fn blur_plane(a: &mut Vec<f32>, w: usize, h: usize, sigma: f64) {
     }
 }
 
+/// Grow a `w` × `h` plane by `radius` pixels each way, the box of SVG's feMorphology: each value
+/// becomes the largest within the radius. A fractional radius blends the two whole radii around
+/// it, so a silhouette grows smoothly as the raster scales. Does nothing for a radius of zero or
+/// less, or when the sizes don't match.
+pub fn dilate_plane(a: &mut Vec<f32>, w: usize, h: usize, radius: f64) {
+    if radius.is_nan() || radius <= 0.0 || w == 0 || h == 0 || w.checked_mul(h) != Some(a.len()) {
+        return;
+    }
+    let radius = radius.min(MAX_BOX as f64);
+    let whole = radius.floor() as usize;
+    let frac = (radius - whole as f64) as f32;
+    let mut tmp = vec![0.0; a.len()];
+    for (len, other) in [(w, h), (h, w)] {
+        max_plane(a, &mut tmp, len, whole, frac);
+        std::mem::swap(a, &mut tmp);
+        transpose(a, &mut tmp, len, other);
+        std::mem::swap(a, &mut tmp);
+    }
+}
+
+/// One horizontal pass of [`dilate_plane`] over the rows of `w` values of a plane: the largest
+/// value within `whole`, blended by `frac` towards the largest within `whole + 1`.
+fn max_plane(src: &[f32], dst: &mut [f32], w: usize, whole: usize, frac: f32) {
+    for (row, out) in src.chunks_exact(w).zip(dst.chunks_exact_mut(w)) {
+        for (x, o) in out.iter_mut().enumerate() {
+            let lo = x.saturating_sub(whole + 1);
+            let hi = (x + whole + 1).min(w - 1);
+            let (mut inner, mut ring) = (row[x], row[x]);
+            for (j, v) in row[lo..=hi].iter().enumerate() {
+                if (lo + j).abs_diff(x) <= whole {
+                    inner = inner.max(*v);
+                }
+                ring = ring.max(*v);
+            }
+            *o = inner + (ring - inner) * frac;
+        }
+    }
+}
+
 /// Premultiplied RGBA at 16 bits (×257): blurs and averages that keep their tones.
 pub(super) type Px16 = [u16; 4];
 

crates/effects/src/pixel/tests.rs

@@ -41,6 +41,26 @@ fn fx(id: &str, p: serde_json::Value) -> PixelFx {
     }
 }
 
+#[test]
+fn dilate_plane_grows_by_its_radius_and_blends_a_fraction() {
+    // GUARDS: an Outer Glow grows its silhouette by a quarter raster pixel before the blur; a step in
+    // that growth as the raster scales would show as the glow's width jumping with the zoom.
+    let mut dot = vec![0.0f32; 7 * 7];
+    dot[3 * 7 + 3] = 255.0;
+    let mut grown = dot.clone();
+    dilate_plane(&mut grown, 7, 7, 1.0);
+    assert_eq!(grown[2 * 7 + 2], 255.0);
+    assert_eq!(grown[7 + 3], 0.0);
+    let mut half = dot.clone();
+    dilate_plane(&mut half, 7, 7, 1.5);
+    assert_eq!(half[3 * 7 + 4], 255.0);
+    assert_eq!(half[3 * 7 + 5], 127.5);
+    assert_eq!(half[3 * 7 + 6], 0.0);
+    let mut same = dot.clone();
+    dilate_plane(&mut same, 7, 7, 0.0);
+    assert_eq!(same, dot);
+}
+
 fn grey(v: u8) -> [u8; 4] {
     [v, v, v, 255]
 }
@@ -500,6 +520,9 @@ fn outsets_follow_the_object() {
     assert!((spin.outset(b) - (far - 25.0)).abs() < 1e-9);
     assert!(fx("blur.radial", json!({"method": "zoom", "amount": 100})).outset(b) > 0.4 * far);
     assert_eq!(fx("blur.smart", json!({"radius": 4})).outset(b), 4.0);
+    assert_eq!(fx("blur.smart", json!({"radius": 4})).reach(), Some(4.0));
+    // The edge modes also read the copy blurred over a wide radius's samples.
+    assert_eq!(fx("blur.smart", json!({"radius": 4, "quality": "low", "blurMode": "edgeOnly"})).reach(), Some(5.0));
     assert_eq!(fx("sharpen.unsharpMask", json!({})).outset(b), 0.0);
     assert_eq!(spin.reach(), None);
     assert_eq!(fx("sharpen.unsharpMask", json!({"radius": 2})).reach(), Some(6.0));
@@ -656,8 +679,8 @@ fn smart_blur_normal_mode_keeps_its_pixels() {
 
 /// Smart Blur's test image: grays 56 and 64 in a checkerboard for x < 3 and 66 and 74 for x in 3..6
 /// (steps of 2 or 18 levels at x = 3, under the threshold), gray 200 from x = 6 on (steps of 126 or
-/// 134 levels). Its edges at threshold 25 are the pixels on the raster's border (transparency is
-/// beyond it) and column 6, the step's lighter side.
+/// 134 levels). Its edges at threshold 25 and radius 1 are the pixels on the raster's border
+/// (transparency is beyond it) and column 6, the step's lighter side.
 fn smart_blur_steps() -> (usize, usize, Vec<u8>, impl Fn(usize, usize) -> bool) {
     let (w, h) = (12, 8);
     let src = image(w, h, |x, y| match x {
@@ -672,16 +695,16 @@ fn smart_blur_steps() -> (usize, usize, Vec<u8>, impl Fn(usize, usize) -> bool)
 fn smart_blur_edge_only_draws_the_edges_white_on_black() {
     let (w, h, src, edge) = smart_blur_steps();
     let mut d = src.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly"})).apply(&mut d, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 1})).apply(&mut d, w, h, &space(w, h));
     let want = image(w, h, |x, y| if edge(x, y) { [255; 4] } else { [0, 0, 0, 255] });
     assert_eq!(d, want);
-    // The radius changes only the blur.
-    let mut wide = src.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 40})).apply(&mut wide, w, h, &space(w, h));
-    assert_eq!(wide, want);
+    // Under one pixel the search still takes the four nearest pixels.
+    let mut narrow = src.clone();
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 0.1})).apply(&mut narrow, w, h, &space(w, h));
+    assert_eq!(narrow, want);
     // A threshold under the checkerboard's 8 levels makes its lighter squares edges too.
     let mut low = src.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly", "threshold": 5})).apply(&mut low, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 1, "threshold": 5})).apply(&mut low, w, h, &space(w, h));
     for y in 1..h - 1 {
         for x in 1..6 {
             let lighter = matches!(at(&src, w, x, y)[0], 64 | 74);
@@ -692,7 +715,7 @@ fn smart_blur_edge_only_draws_the_edges_white_on_black() {
     let (w, h) = (8, 8);
     let shape = image(w, h, |x, y| if (2..6).contains(&x) && (2..6).contains(&y) { [64, 0, 0, 128] } else { [0; 4] });
     let mut s = shape.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly"})).apply(&mut s, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 1})).apply(&mut s, w, h, &space(w, h));
     let ring = |x: usize, y: usize| (2..6).contains(&x) && (2..6).contains(&y) && !((3..5).contains(&x) && (3..5).contains(&y));
     let inside = |x: usize, y: usize| (3..5).contains(&x) && (3..5).contains(&y);
     let want = image(w, h, |x, y| match (ring(x, y), inside(x, y)) {
@@ -707,10 +730,10 @@ fn smart_blur_edge_only_draws_the_edges_white_on_black() {
 fn smart_blur_overlay_edge_draws_the_edges_white_over_the_blur() {
     let (w, h, src, edge) = smart_blur_steps();
     let mut normal = src.clone();
-    fx("blur.smart", json!({})).apply(&mut normal, w, h, &space(w, h));
+    fx("blur.smart", json!({"radius": 1})).apply(&mut normal, w, h, &space(w, h));
     assert_ne!(normal, src, "the checkerboard is blurred");
     let mut d = src.clone();
-    fx("blur.smart", json!({"blurMode": "overlayEdge"})).apply(&mut d, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "overlayEdge", "radius": 1})).apply(&mut d, w, h, &space(w, h));
     for y in 0..h {
         for x in 0..w {
             let want = if edge(x, y) { [255; 4] } else { at(&normal, w, x, y) };
@@ -726,6 +749,87 @@ fn smart_blur_overlay_edge_draws_the_edges_white_over_the_blur() {
     }
 }
 
+/// The edges #2154 drew at any radius: a pixel is on an edge when one of its four nearest pixels
+/// (transparent beyond the raster) differs from it by more than `t` levels in a channel and its
+/// channels add up to at least that pixel's.
+fn four_neighbor_edges(src: &[u8], w: usize, h: usize, t: u8) -> Vec<bool> {
+    let px = |x: isize, y: isize| if x < 0 || y < 0 || x as usize >= w || y as usize >= h { [0; 4] } else { at(src, w, x as usize, y as usize) };
+    let sum = |p: [u8; 4]| p.iter().map(|v| u32::from(*v)).sum::<u32>();
+    let mut edges = Vec::new();
+    for y in 0..h as isize {
+        for x in 0..w as isize {
+            let c = px(x, y);
+            edges.push([(1, 0), (-1, 0), (0, 1), (0, -1)].iter().any(|(dx, dy)| {
+                let n = px(x + dx, y + dy);
+                c.iter().zip(&n).any(|(a, b)| a.abs_diff(*b) > t) && sum(c) >= sum(n)
+            }));
+        }
+    }
+    edges
+}
+
+#[test]
+fn smart_blur_edges_at_radius_one_are_the_four_neighbor_edges() {
+    let (w, h) = (48, 40);
+    let src = image(w, h, |x, y| {
+        let a = if x > 4 && y < 36 { 255 } else { 128 };
+        [((x * 5 + y) as u8).min(a), ((y * 6) as u8).min(a), (((x * y) % 97) as u8).min(a), a]
+    });
+    for t in [5, 10, 25, 60] {
+        let edges = four_neighbor_edges(&src, w, h, t);
+        assert!(edges.contains(&true) && edges.contains(&false), "threshold {t}");
+        let want: Vec<u8> = src.as_chunks::<4>().0.iter().zip(&edges).flat_map(|(p, e)| if *e { [p[3]; 4] } else { [0, 0, 0, p[3]] }).collect();
+        for radius in [0.1, 0.5, 1.0] {
+            let mut d = src.clone();
+            fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": radius, "threshold": t})).apply(&mut d, w, h, &space(w, h));
+            assert_eq!(d, want, "threshold {t}, radius {radius}");
+        }
+    }
+}
+
+#[test]
+fn smart_blur_radius_widens_the_edge_search() {
+    // Gray 60 left of x = 15 and gray 200 from it on: a step of 140 levels.
+    let (w, h) = (30, 16);
+    let src = image(w, h, |x, _| grey(if x < 15 { 60 } else { 200 }));
+    for radius in [1.0, 1.5, 2.0, 2.5, 3.0, 3.5, 4.0, 4.5] {
+        let mut d = src.clone();
+        fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": radius})).apply(&mut d, w, h, &space(w, h));
+        // The pixels within `radius` of a darker one: the step's first `r` columns on its lighter
+        // side, and a band `r` wide along the raster's border (transparency is beyond it). Up to
+        // radius 4.5 the search reads no blurred copy: at 4 and 4.5 the medium quality's 7 samples
+        // across are 4/3 pixels apart, under the 2 pixels a box blur of radius 1 needs.
+        let r = radius as usize;
+        let want =
+            image(w, h, |x, y| if x < r || y < r || x >= w - r || y >= h - r || (15..15 + r).contains(&x) { [255; 4] } else { [0, 0, 0, 255] });
+        assert_eq!(d, want, "radius {radius}");
+    }
+    // Overlay Edge draws the same edges over the blur.
+    let mut normal = src.clone();
+    fx("blur.smart", json!({"radius": 3})).apply(&mut normal, w, h, &space(w, h));
+    let mut over = src.clone();
+    fx("blur.smart", json!({"blurMode": "overlayEdge", "radius": 3})).apply(&mut over, w, h, &space(w, h));
+    assert_eq!(at(&over, w, 17, 8), [255; 4]);
+    assert_eq!(at(&over, w, 18, 8), at(&normal, w, 18, 8));
+    // A wide radius reads a grid of samples, also through a blurred copy, and finds the step from
+    // the radius away, on its lighter side only.
+    let (w, h) = (260, 100);
+    let src = image(w, h, |x, _| grey(if x < 100 { 60 } else { 200 }));
+    let mut d = src.clone();
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 40})).apply(&mut d, w, h, &space(w, h));
+    for (x, edge) in [(100, true), (130, true), (139, true), (170, false), (99, false), (70, false)] {
+        assert_eq!(at(&d, w, x, 50)[0] == 255, edge, "({x}, 50)");
+    }
+    // A dark band narrower than the gaps between the samples is found through the blurred copy:
+    // at x = 120 the samples fall on x = 107, 93 and 80, all light.
+    let src = image(w, h, |x, _| grey(if (100..104).contains(&x) { 60 } else { 200 }));
+    let mut d = src.clone();
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 40})).apply(&mut d, w, h, &space(w, h));
+    for (x, edge) in [(104, true), (120, true), (102, false)] {
+        assert_eq!(at(&d, w, x, 50)[0] == 255, edge, "band ({x}, 50)");
+    }
+}
+
 #[test]
 fn unsharp_mask_overshoots_at_edges() {
     let (w, h) = (40, 10);
@@ -2009,3 +2113,199 @@ fn halftone_draws_in_black_and_white_only() {
         }
     }
 }
+
+/// The distinct colours of the covered pixels.
+fn colours(d: &[u8]) -> std::collections::BTreeSet<[u8; 4]> {
+    d.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).copied().collect()
+}
+
+/// A left-to-right rainbow ramp, half covered at its bottom rows.
+fn ramp(w: usize, h: usize) -> Vec<u8> {
+    image(w, h, |x, y| {
+        let t = x * 255 / (w - 1);
+        let a = if y + 4 >= h { 128 } else { 255 };
+        let c = [t, 255 - t, (t * 3) % 256].map(|v| (v * a / 255) as u8);
+        [c[0], c[1], c[2], a as u8]
+    })
+}
+
+#[test]
+fn artistic_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("artistic.cutout", json!({})), PixelFx::Cutout { levels: 4.0, simplicity: 4.0, fidelity: 2.0 });
+    assert_eq!(
+        fx("artistic.cutout", json!({"levels": 1e308, "edgeSimplicity": -5, "edgeFidelity": "NaN"})),
+        PixelFx::Cutout { levels: 8.0, simplicity: 0.0, fidelity: 2.0 }
+    );
+    assert_eq!(fx("artistic.posterEdges", json!({})), PixelFx::PosterEdges { thickness: 2.0, intensity: 1.0, posterization: 2.0 });
+    assert_eq!(
+        fx("artistic.posterEdges", json!({"edgeThickness": 99, "edgeIntensity": -1, "posterization": 6.4})),
+        PixelFx::PosterEdges { thickness: 10.0, intensity: 0.0, posterization: 6.0 }
+    );
+    let PixelFx::NeonGlow { size, brightness, colour } = fx("artistic.neonGlow", json!({})) else { panic!() };
+    assert_eq!((size, brightness), (5.0, 15.0));
+    assert!((colour[0] - 0.3).abs() < 0.01 && (colour[1] - 0.65).abs() < 0.01 && colour[2] == 1.0, "{colour:?}");
+    assert_eq!(
+        fx("artistic.neonGlow", json!({"glowSize": -1e308, "glowBrightness": 80, "color": "#ff0000"})),
+        PixelFx::NeonGlow { size: -24.0, brightness: 50.0, colour: [1.0, 0.0, 0.0] }
+    );
+    for id in ["artistic.cutout", "artistic.neonGlow", "artistic.posterEdges"] {
+        assert_eq!(fx(id, json!({})).outset(Rect::new(0.0, 0.0, 40.0, 30.0)), 0.0, "{id} keeps the object's shape");
+    }
+}
+
+#[test]
+fn artistic_filters_leave_invalid_coordinate_spaces_alone() {
+    let (w, h) = (16, 12);
+    let src = ramp(w, h);
+    let run = |f: &PixelFx, s: &PixelSpace| {
+        let mut out = src.clone();
+        f.apply(&mut out, w, h, s);
+        out
+    };
+    let colour = [0.3, 0.65, 1.0];
+    let filters = [
+        PixelFx::Cutout { levels: 4.0, simplicity: 4.0, fidelity: 2.0 },
+        PixelFx::NeonGlow { size: 5.0, brightness: 15.0, colour },
+        PixelFx::PosterEdges { thickness: 2.0, intensity: 1.0, posterization: 2.0 },
+    ];
+    for f in &filters {
+        assert_ne!(run(f, &space(w, h)), src, "{f:?} changes the art in a valid space");
+    }
+    let mut changed = Vec::new();
+    for f in &filters {
+        for px in [0.0, -1.0, f64::NAN, f64::INFINITY] {
+            if run(f, &PixelSpace { px, ..space(w, h) }) != src {
+                changed.push(format!("{f:?} at px {px}"));
+            }
+        }
+    }
+    for f in [
+        PixelFx::Cutout { levels: f64::NAN, simplicity: 4.0, fidelity: 2.0 },
+        PixelFx::Cutout { levels: 4.0, simplicity: f64::INFINITY, fidelity: 2.0 },
+        PixelFx::Cutout { levels: 4.0, simplicity: 4.0, fidelity: f64::NEG_INFINITY },
+        PixelFx::NeonGlow { size: f64::NAN, brightness: 15.0, colour },
+        PixelFx::NeonGlow { size: 5.0, brightness: f64::INFINITY, colour },
+        PixelFx::PosterEdges { thickness: f64::NAN, intensity: 1.0, posterization: 2.0 },
+        PixelFx::PosterEdges { thickness: 2.0, intensity: f64::INFINITY, posterization: 2.0 },
+        PixelFx::PosterEdges { thickness: 2.0, intensity: 1.0, posterization: f64::NEG_INFINITY },
+    ] {
+        if run(&f, &space(w, h)) != src {
+            changed.push(format!("{f:?}"));
+        }
+    }
+    assert!(changed.is_empty(), "directly constructed non-finite parameters and invalid spaces are harmless: {changed:?}");
+}
+
+#[test]
+fn cutout_paints_a_few_flat_colours_and_keeps_coverage() {
+    let (w, h) = (64, 24);
+    let src = ramp(w, h);
+    for levels in [2, 3, 5, 8] {
+        let mut out = src.clone();
+        fx("artistic.cutout", json!({"levels": levels})).apply(&mut out, w, h, &space(w, h));
+        let opaque: std::collections::BTreeSet<_> = colours(&out).into_iter().filter(|p| p[3] == 255).collect();
+        assert!(opaque.len() <= levels * levels * levels && opaque.len() >= 2, "{levels} levels: {} colours", opaque.len());
+        assert!(opaque.len() < 64, "flat pieces, not a ramp: {levels} levels, {} colours", opaque.len());
+        assert!(out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0).all(|(o, s)| o[3] == s[3]));
+    }
+}
+
+#[test]
+fn cutout_simplicity_smooths_the_pieces_edges() {
+    // A noisy grey: simpler edges join the speckles into fewer changes between neighbours.
+    let (w, h) = (48, 48);
+    let src = image(w, h, |x, y| grey(if (x * 7 + y * 13) % 5 < 2 { 60 } else { 190 }));
+    let changes = |simplicity: f64| {
+        let mut out = src.clone();
+        fx("artistic.cutout", json!({"levels": 2, "edgeSimplicity": simplicity, "edgeFidelity": 1})).apply(&mut out, w, h, &space(w, h));
+        out.as_chunks::<4>().0.windows(2).filter(|p| p[0] != p[1]).count()
+    };
+    assert!(changes(10.0) * 4 < changes(0.0), "{} vs {}", changes(10.0), changes(0.0));
+}
+
+#[test]
+fn poster_edges_draw_black_lines_on_edges_and_posterize_the_rest() {
+    let (w, h) = (40, 20);
+    // Two flat halves: a line where they meet, posterized colour away from it.
+    let src = image(w, h, |x, _| if x < w / 2 { [200, 90, 30, 255] } else { [30, 120, 210, 255] });
+    let mut out = src.clone();
+    fx("artistic.posterEdges", json!({"edgeThickness": 2, "edgeIntensity": 10, "posterization": 0})).apply(&mut out, w, h, &space(w, h));
+    let line = at(&out, w, w / 2, h / 2);
+    assert!(line[0] < 40 && line[1] < 40 && line[2] < 40, "a dark line on the edge: {line:?}");
+    // 2 levels per channel: every far pixel is 0 or 255 in each channel.
+    for x in [3, w - 4] {
+        let p = at(&out, w, x, h / 2);
+        assert!(p[..3].iter().all(|v| *v == 0 || *v == 255), "{x}: {p:?}");
+    }
+    // Inside a flat colour, away from the object's outline, there are no lines: it only posterizes.
+    let mut flat = image(w, h, |_, _| [200, 90, 30, 255]);
+    fx("artistic.posterEdges", json!({"edgeIntensity": 10, "posterization": 6})).apply(&mut flat, w, h, &space(w, h));
+    let inside: std::collections::BTreeSet<_> = (6..h - 6).flat_map(|y| (6..w - 6).map(move |x| (x, y))).map(|(x, y)| at(&flat, w, x, y)).collect();
+    assert_eq!(inside.len(), 1, "{inside:?}");
+    assert!(at(&flat, w, 0, h / 2)[0] < 60, "the outline takes a line");
+}
+
+#[test]
+fn poster_edges_thickness_widens_the_lines() {
+    let (w, h) = (60, 10);
+    let src = image(w, h, |x, _| grey(if x < w / 2 { 30 } else { 230 }));
+    let dark = |thickness: f64| {
+        let mut out = src.clone();
+        fx("artistic.posterEdges", json!({"edgeThickness": thickness, "edgeIntensity": 10, "posterization": 6})).apply(&mut out, w, h, &space(w, h));
+        (0..w).filter(|x| at(&out, w, *x, h / 2)[0] < 20 && (*x >= w / 2 || at(&src, w, *x, h / 2)[0] > 20)).count()
+    };
+    assert!(dark(10.0) > dark(0.0), "{} vs {}", dark(10.0), dark(0.0));
+}
+
+#[test]
+fn neon_glow_lights_the_bright_or_the_dark_areas_in_its_colour() {
+    let (w, h) = (40, 20);
+    let src = image(w, h, |x, _| grey(if x < w / 2 { 20 } else { 235 }));
+    let run = |size: f64| {
+        let mut out = src.clone();
+        fx("artistic.neonGlow", json!({"glowSize": size, "glowBrightness": 40, "color": "#ff0000"})).apply(&mut out, w, h, &space(w, h));
+        (at(&out, w, 3, h / 2), at(&out, w, w - 4, h / 2))
+    };
+    // Red glow: the red channel rises above green and blue where it glows.
+    let red = |p: [u8; 4]| i32::from(p[0]) - i32::from(p[1]);
+    let (dark, light) = run(8.0);
+    assert!(red(light) > 60 && red(light) > red(dark) + 40, "light areas glow: {dark:?} {light:?}");
+    let (dark, light) = run(-8.0);
+    assert!(red(dark) > 60 && red(dark) > red(light) + 40, "dark areas glow: {dark:?} {light:?}");
+    // No brightness: dimmed greys only.
+    let mut out = src.clone();
+    fx("artistic.neonGlow", json!({"glowBrightness": 0})).apply(&mut out, w, h, &space(w, h));
+    assert!(out.as_chunks::<4>().0.iter().all(|p| p[0] == p[1] && p[1] == p[2] && p[3] == 255));
+}
+
+#[test]
+fn artistic_filters_look_the_same_at_any_resolution() {
+    // The same art at 1 and at 2 pixels per point: the filter at the coarse resolution matches
+    // the fine result sampled at the same points.
+    let (w, h) = (48, 32);
+    let art = |x: f64, y: f64| grey(if (x - 24.0).hypot(y - 16.0) < 10.0 { 230 } else { 40 });
+    let coarse = image(w, h, |x, y| art(x as f64 + 0.5, y as f64 + 0.5));
+    let fine = image(2 * w, 2 * h, |x, y| art((x as f64 + 0.5) / 2.0, (y as f64 + 0.5) / 2.0));
+    let mut half = space(2 * w, 2 * h);
+    half.to_doc = Affine::scale(0.5);
+    half.px = 0.5;
+    half.center = Point::new(w as f64 / 2.0, h as f64 / 2.0);
+    for (id, p) in [
+        ("artistic.cutout", json!({"edgeSimplicity": 6})),
+        ("artistic.neonGlow", json!({"glowSize": 12, "glowBrightness": 30})),
+        ("artistic.posterEdges", json!({"edgeThickness": 6, "edgeIntensity": 6})),
+    ] {
+        let (mut a, mut b) = (coarse.clone(), fine.clone());
+        fx(id, p.clone()).apply(&mut a, w, h, &space(w, h));
+        fx(id, p).apply(&mut b, 2 * w, 2 * h, &half);
+        let diff: f64 = (0..h)
+            .flat_map(|y| (0..w).map(move |x| (x, y)))
+            .map(|(x, y)| {
+                let (p, q) = (at(&a, w, x, y), at(&b, 2 * w, 2 * x, 2 * y));
+                (0..3).map(|k| f64::from(p[k].abs_diff(q[k]))).sum::<f64>() / 3.0
+            })
+            .sum::<f64>()
+            / (w * h) as f64;
+        assert!(diff < 12.0, "{id}: mean difference {diff}");
+    }
+}

crates/effects/src/raster.rs

@@ -1,15 +1,19 @@
 //! Raster (painted) effects: descriptions for the renderer.
 
 use serde_json::Value;
-use vectorcraft_doc::Effect;
 use vectorcraft_doc::color::{BlendMode, Color};
+use vectorcraft_doc::rastersettings::MAX_ADD_AROUND;
+use vectorcraft_doc::{Effect, RasterColorModel, RasterEffectsSettings};
 
-use vectorcraft_geom::Rect;
+use vectorcraft_geom::{Point, Rect};
 
 use crate::merged_params;
-use crate::pixel::{self, PixelFx};
+use crate::pixel::{self, PixelFx, PixelSpace};
 use crate::util::*;
 
+/// Effect › Rasterize's id.
+pub const RASTERIZE: &str = "rasterize";
+
 /// A painted effect, in document units. `blur` is Illustrator's blur distance; the renderer uses
 /// a Gaussian with σ = blur / 2 (so the visible spread is about 1.5 × blur).
 #[derive(Clone, Debug, PartialEq)]
@@ -25,6 +29,8 @@ pub enum RasterFx {
         /// instead of `color`; `None` when it is `color`.
         darkness: Option<f32>,
     },
+    /// Blurs the art's solid silhouette grown by a quarter of a pixel of the document's raster grid,
+    /// as the glows AI files export measure.
     OuterGlow {
         mode: BlendMode,
         opacity: f32,
@@ -48,6 +54,8 @@ pub enum RasterFx {
     },
     /// A Photoshop-style filter over the object's pixels (Radial Blur, Unsharp Mask…).
     Pixel(PixelFx),
+    /// Effect › Rasterize: the object drawn as an image of square pixels.
+    Rasterize(Rasterize),
 }
 
 impl RasterFx {
@@ -71,6 +79,282 @@ impl RasterFx {
             RasterFx::InnerGlow { .. } | RasterFx::Feather { .. } => 0.0,
             RasterFx::GaussianBlur { radius } => 1.5 * radius,
             RasterFx::Pixel(p) => p.outset(bounds),
+            RasterFx::Rasterize(r) => r.outset(),
+        }
+    }
+    /// This effect with a Rasterize that takes the document's resolution at `ppi` ([`Rasterize::at_document_ppi`]).
+    pub fn at_document_ppi(&self, ppi: f64) -> RasterFx {
+        match self {
+            RasterFx::Rasterize(r) => RasterFx::Rasterize(r.at_document_ppi(ppi)),
+            fx => fx.clone(),
+        }
+    }
+    /// What this effect paints over when what it paints around covers `bounds`: Rasterize's image
+    /// ([`Rasterize::image`], `line` the document's raster grid), `bounds` grown by
+    /// [`Self::outset`] for the others.
+    pub fn spread(&self, bounds: Rect, line: f64) -> Rect {
+        match self {
+            RasterFx::Rasterize(r) => r.image(bounds, line),
+            RasterFx::OuterGlow { .. } => {
+                let o = self.outset(bounds) + 0.25 * line;
+                bounds.inflate(o, o)
+            }
+            fx => {
+                let o = fx.outset(bounds);
+                bounds.inflate(o, o)
+            }
+        }
+    }
+}
+
+/// Effect › Rasterize's options, read from its parameters. The image covers the object's bounds
+/// (as far as the effects before it spread the object) and `add_around` points around them, in
+/// pixels `72 / ppi` points wide whose first one starts at that area's top-left corner, as Object
+/// › Rasterize makes its image.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Rasterize {
+    /// Pixels per inch (1 to 2400); `None` takes Document Raster Effects Settings › Resolution.
+    pub ppi: Option<f64>,
+    /// The image's color model.
+    pub color_model: RasterColorModel,
+    /// A white background: the image is opaque. Otherwise it keeps its transparency.
+    pub white: bool,
+    /// Smooth edges (Art Optimized or Type Optimized). Off, each pixel takes the art at its center.
+    pub anti_alias: bool,
+    /// Type Optimized: smooth edges with type fitted to the pixels.
+    pub hinted: bool,
+    /// The image is clipped to the art's outline.
+    pub clipping_mask: bool,
+    /// Room around the art, in points (0 to [`MAX_ADD_AROUND`]).
+    pub add_around: f64,
+}
+
+impl Rasterize {
+    /// The options in the effect's parameters `p` (defaults merged in).
+    fn parse(p: &Value) -> Self {
+        let ppi = (!flag(p, "useDocumentResolution", true)).then(|| num(p, "resolution", 72.0).clamp(1.0, 2400.0));
+        let color_model = match text(p, "colorModel", "document").to_ascii_lowercase().as_str() {
+            "grayscale" | "gray" => RasterColorModel::Grayscale,
+            "bitmap" => RasterColorModel::Bitmap,
+            _ => RasterColorModel::Document,
+        };
+        Self {
+            ppi,
+            color_model,
+            white: text(p, "background", "transparent").eq_ignore_ascii_case("white"),
+            anti_alias: !text(p, "antiAlias", "art").eq_ignore_ascii_case("none"),
+            hinted: text(p, "antiAlias", "art").eq_ignore_ascii_case("type"),
+            clipping_mask: flag(p, "clippingMask", false),
+            add_around: num(p, "addAround", 0.0).clamp(0.0, MAX_ADD_AROUND),
+        }
+    }
+
+    /// The width of a pixel of the image in document units: 72 / `ppi`, or `line` (72 / the
+    /// document's raster effects resolution) when it takes the document's.
+    pub fn cell(&self, line: f64) -> f64 {
+        self.ppi.map_or(line, |ppi| 72.0 / ppi)
+    }
+
+    /// These options at `ppi` when they take the document's resolution.
+    pub fn at_document_ppi(self, ppi: f64) -> Self {
+        Self { ppi: self.ppi.or(Some(ppi)), ..self }
+    }
+
+    /// How far beyond the object's bounds the image reaches: the room around it and, at a known
+    /// resolution, one pixel more for the last column and row, which are whole pixels.
+    pub fn outset(&self) -> f64 {
+        self.add_around + self.ppi.map_or(0.0, |ppi| 72.0 / ppi)
+    }
+
+    /// How far (document units) from a pixel the content that decides it lies: across its pixel
+    /// of the image (72 points when the resolution is the document's, not known here).
+    pub fn reach(&self) -> f64 {
+        self.cell(72.0) * std::f64::consts::SQRT_2
+    }
+
+    /// The image of art over `bounds`: `bounds` and the room around them, in whole pixels
+    /// ([`Self::cell`] of `line`) from that area's top-left corner.
+    pub fn image(&self, bounds: Rect, line: f64) -> Rect {
+        let cell = self.cell(line);
+        let area = bounds.inflate(self.add_around, self.add_around);
+        let (cols, rows) = ((area.width() / cell).ceil().max(1.0), (area.height() / cell).ceil().max(1.0));
+        Rect::new(area.x0, area.y0, area.x0 + cols * cell, area.y0 + rows * cell)
+    }
+
+    /// Give `pixels` (premultiplied RGBA8), the art drawn on the image's own grid, the background
+    /// and then the color model, as Object › Rasterize does.
+    pub fn finish(&self, pixels: &mut [u8]) {
+        for p in pixels.as_chunks_mut::<4>().0 {
+            if self.white {
+                let under = 255 - p[3];
+                *p = p.map(|c| c.saturating_add(under));
+            }
+        }
+        RasterEffectsSettings { color_model: self.color_model, ..Default::default() }.finish_pixels(pixels);
+    }
+
+    /// Draw `image` into `data`, `w` × `h` premultiplied RGBA8 pixels lying in the document as
+    /// `space` says: `image` is `cols` × `rows` premultiplied RGBA8 pixels covering `rect` in the
+    /// document. In a view that isn't turned, each pixel of `data` takes the mean of the image over
+    /// its area (transparent outside the image); otherwise the mean of the image at up to 8 × 8
+    /// points across it. Does nothing when the sizes don't match.
+    #[allow(clippy::too_many_arguments)]
+    pub fn compose(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace, image: &[u8], cols: usize, rows: usize, rect: Rect) {
+        let (px, rest) = data.as_chunks_mut::<4>();
+        let (src, src_rest) = image.as_chunks::<4>();
+        let fits = |n: usize, w: usize, h: usize, rest: usize| w > 0 && h > 0 && rest == 0 && w.checked_mul(h) == Some(n);
+        if !(fits(px.len(), w, h, rest.len()) && fits(src.len(), cols, rows, src_rest.len()) && rect.width() > 0.0 && rect.height() > 0.0) {
+            return;
+        }
+        let (sx, sy) = (cols as f64 / rect.width(), rows as f64 / rect.height());
+        // Document → image pixels.
+        let to_image = |p: Point| ((p.x - rect.x0) * sx, (p.y - rect.y0) * sy);
+        let at = |i: f64, j: f64| {
+            (i >= 0.0 && j >= 0.0 && i < cols as f64 && j < rows as f64).then(|| src.get(j as usize * cols + i as usize).copied()).flatten()
+        };
+        let straight = matches!(space.to_doc.as_coeffs(), [_, b, c, _, _, _] if b == 0.0 && c == 0.0);
+        // Points across a raster pixel in a turned view: about one an image pixel.
+        let n = (space.px * sx.max(sy)).ceil().clamp(1.0, 8.0) as usize;
+        for (k, p) in px.iter_mut().enumerate() {
+            let (x, y) = ((k % w) as f64, (k / w) as f64);
+            let mut acc = [0.0f64; 4];
+            let weight = if straight {
+                let (a, b) = (to_image(space.to_doc * Point::new(x, y)), to_image(space.to_doc * Point::new(x + 1.0, y + 1.0)));
+                let (u0, u1, v0, v1) = (a.0.min(b.0), a.0.max(b.0), a.1.min(b.1), a.1.max(b.1));
+                let (i0, i1) = (u0.floor().max(0.0), u1.ceil().min(cols as f64));
+                let (j0, j1) = (v0.floor().max(0.0), v1.ceil().min(rows as f64));
+                let mut j = j0;
+                while j < j1 {
+                    let mut i = i0;
+                    while i < i1 {
+                        let share = (u1.min(i + 1.0) - u0.max(i)).max(0.0) * (v1.min(j + 1.0) - v0.max(j)).max(0.0);
+                        if let Some(q) = at(i, j) {
+                            for (s, v) in acc.iter_mut().zip(q) {
+                                *s += share * f64::from(v);
+                            }
+                        }
+                        i += 1.0;
+                    }
+                    j += 1.0;
+                }
+                (u1 - u0) * (v1 - v0)
+            } else {
+                for t in 0..n * n {
+                    let (fx, fy) = (((t % n) as f64 + 0.5) / n as f64, ((t / n) as f64 + 0.5) / n as f64);
+                    let (i, j) = to_image(space.to_doc * Point::new(x + fx, y + fy));
+                    if let Some(q) = at(i.floor(), j.floor()) {
+                        for (s, v) in acc.iter_mut().zip(q) {
+                            *s += f64::from(v);
+                        }
+                    }
+                }
+                (n * n) as f64
+            };
+            *p = if weight > 0.0 { acc.map(|s| (s / weight).round().clamp(0.0, 255.0) as u8) } else { [0; 4] };
+        }
+    }
+
+    /// Turn `data`, `w` × `h` premultiplied RGBA8 pixels of the object lying in the document as
+    /// `space` says, into its image over `bounds` (what the object covers after the effects before
+    /// this one), when the image is too large to draw on its own grid. Each pixel of the image more
+    /// than a raster pixel wide takes the mean of the raster pixels whose centers lie in it
+    /// (anti-aliased) or the raster pixel at its center (not anti-aliased). Smaller pixels are left
+    /// as drawn. Then the background and the color model apply as Object › Rasterize applies them.
+    /// What lies outside the image becomes transparent, and in a view that isn't turned the raster
+    /// pixels along its edges keep the share of them it covers. Does nothing when the sizes don't
+    /// match. The renderer draws the content with hard edges when it goes into Rasterize with
+    /// anti-aliasing off and image pixels at least a raster pixel wide.
+    pub fn apply(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace, bounds: Rect) {
+        let cell = self.cell(space.line);
+        let (px, rest) = data.as_chunks_mut::<4>();
+        if w == 0 || h == 0 || !rest.is_empty() || w.checked_mul(h) != Some(px.len()) || !(cell.is_finite() && cell > 0.0 && space.px > 0.0) {
+            return;
+        }
+        let area = self.image(bounds, space.line);
+        let (cols, rows) = ((area.width() / cell).round().max(1.0), (area.height() / cell).round().max(1.0));
+        // The pixel of the image (column, row) that a raster pixel's center lies in.
+        let pixel_at = |x: usize, y: usize| {
+            let p = space.to_doc * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+            let (c, r) = (((p.x - area.x0) / cell).floor(), ((p.y - area.y0) / cell).floor());
+            (c >= 0.0 && r >= 0.0 && c < cols && r < rows).then_some((c, r))
+        };
+        let wide = cell / space.px;
+        // The image's pixels the raster covers: columns c0..c1, rows r0..r1.
+        let seen = space.to_doc.transform_rect_bbox(Rect::new(0.0, 0.0, w as f64, h as f64));
+        let (c0, c1) = (((seen.x0 - area.x0) / cell).floor().clamp(0.0, cols), ((seen.x1 - area.x0) / cell).ceil().clamp(0.0, cols));
+        let (r0, r1) = (((seen.y0 - area.y0) / cell).floor().clamp(0.0, rows), ((seen.y1 - area.y0) / cell).ceil().clamp(0.0, rows));
+        let span = (c1 - c0) as usize;
+        let slot = |(c, r): (f64, f64)| ((r - r0) as usize).saturating_mul(span).saturating_add((c - c0) as usize);
+        // Anti-aliased: the sums of each pixel's raster pixels (premultiplied) and their count,
+        // which saturate past 16 million raster pixels to an image pixel. They are kept for the
+        // whole grid when it has no more pixels than the raster, else for the pixels the raster
+        // reaches (a turned view of a narrow raster).
+        let grid = span.saturating_mul((r1 - r0) as usize);
+        let whole = grid <= px.len();
+        let mut dense: Vec<[u32; 5]> = vec![];
+        let mut sparse: std::collections::HashMap<usize, [u32; 5]> = std::collections::HashMap::new();
+        if self.anti_alias && wide > 1.0 {
+            if whole {
+                dense = vec![[0; 5]; grid];
+            }
+            for (i, p) in px.iter().enumerate() {
+                let Some(k) = pixel_at(i % w, i / w).map(slot) else { continue };
+                let s = if whole { dense.get_mut(k) } else { Some(sparse.entry(k).or_default()) };
+                if let Some(s) = s {
+                    for (acc, v) in s.iter_mut().zip(p) {
+                        *acc = acc.saturating_add(u32::from(*v));
+                    }
+                    s[4] = s[4].saturating_add(1);
+                }
+            }
+        }
+        let sum = |k: usize| if whole { dense.get(k) } else { sparse.get(&k) };
+        // Not anti-aliased: the raster as drawn, to read each pixel's center from.
+        let drawn = (!self.anti_alias && wide > 1.0).then(|| px.to_vec());
+        let to_raster = space.to_doc.inverse();
+        let model = RasterEffectsSettings { color_model: self.color_model, ..Default::default() };
+        // In a view that isn't turned, the raster pixels along the image's edges take the share of
+        // them it covers; otherwise those whose center lies in it are in it.
+        let straight = matches!(space.to_doc.as_coeffs(), [_, b, c, _, _, _] if b == 0.0 && c == 0.0);
+        let image = to_raster.transform_rect_bbox(area);
+        let cover =
+            |x: f64, y: f64| (image.x1.min(x + 1.0) - image.x0.max(x)).clamp(0.0, 1.0) * (image.y1.min(y + 1.0) - image.y0.max(y)).clamp(0.0, 1.0);
+        for (i, p) in px.iter_mut().enumerate() {
+            let (x, y) = (i % w, i / w);
+            let (at, share) = if straight {
+                // The image pixel nearest the raster pixel's center.
+                let q = space.to_doc * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+                let at = (((q.x - area.x0) / cell).floor().clamp(0.0, cols - 1.0), ((q.y - area.y0) / cell).floor().clamp(0.0, rows - 1.0));
+                (Some(at), cover(x as f64, y as f64))
+            } else {
+                (pixel_at(x, y), 1.0)
+            };
+            let Some(at) = at.filter(|_| share > 0.0) else {
+                *p = [0; 4];
+                continue;
+            };
+            // An image pixel's color, over the share of the raster pixel the image covers. (A raster
+            // pixel left as drawn holds art the image covers whole.)
+            let made = if let Some(s) = sum(slot(at)).filter(|s| s[4] > 0) {
+                Some([0, 1, 2, 3].map(|k| ((u64::from(s[k]) + u64::from(s[4] / 2)) / u64::from(s[4])).min(255) as u8))
+            } else {
+                drawn.as_ref().map(|drawn| {
+                    let center = to_raster * Point::new(area.x0 + (at.0 + 0.5) * cell, area.y0 + (at.1 + 0.5) * cell);
+                    let (x, y) = (center.x.floor(), center.y.floor());
+                    let inside = x >= 0.0 && y >= 0.0 && x < w as f64 && y < h as f64;
+                    if inside { drawn.get(y as usize * w + x as usize).copied().unwrap_or_default() } else { [0; 4] }
+                })
+            };
+            if let Some(v) = made {
+                *p = if share < 1.0 { v.map(|c| (f64::from(c) * share).round() as u8) } else { v };
+            }
+            // White goes under the art first, over the image's share of the pixel, then the color
+            // model applies, as in Object › Rasterize.
+            if self.white {
+                let under = ((255.0 * share).round() as u8).saturating_sub(p[3]);
+                *p = p.map(|c| c.saturating_add(under));
+            }
+            model.finish_pixels(p);
         }
     }
 }
@@ -133,6 +417,7 @@ pub fn raster_effects(effects: &[Effect]) -> Vec<RasterFx> {
                 },
                 "stylize.feather" => RasterFx::Feather { radius: num(&p, "radius", 5.0).clamp(0.0, 1000.0) },
                 "blur.gaussian" => RasterFx::GaussianBlur { radius: num(&p, "radius", 5.0).clamp(0.0, 1000.0) },
+                RASTERIZE => RasterFx::Rasterize(Rasterize::parse(&p)),
                 id => RasterFx::Pixel(pixel::parse(id, &p)?),
             })
         })

crates/effects/src/reshape.rs

@@ -32,6 +32,17 @@ pub fn needs_outline(n: &Node) -> bool {
     )
 }
 
+/// Is `n` a path or compound path with a visible Transform effect that makes copies and a gradient
+/// in a fill or stroke? Such an object is drawn through its art ([`outline_art`]) so that each copy
+/// paints its gradient by itself ([`copy_with_gradients`]), as a group's copies do.
+pub fn has_gradient_copies(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::Path { guide: false, clipping: false, .. } | NodeKind::Compound { .. })
+        && (n.appearance.has_unplaced_gradient() || n.appearance.has_placed_gradient())
+        && geometry_effects(n)
+            .iter()
+            .any(|e| e.id == "distort.transform" && crate::distort::transform_map(Rect::ZERO, &merged_params(&e.id, &e.params), 0).1 > 0)
+}
+
 /// Is `n` type without inline graphics that has a fill or stroke of its own that paints and has a
 /// visible geometry effect? Such an effect reshapes the whole outline that its fill or stroke
 /// paints ([`outline_text`], which leaves inline graphics out).
@@ -127,6 +138,16 @@ pub fn outline_art(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
             a.transform(*xf, false);
             Node::group(n.id, vec![Arc::new(a)])
         }
+        // The object as the one piece the copies of its Transform effect are made from.
+        _ if has_gradient_copies(n) => {
+            let mut one = n.clone();
+            one.opacity = 1.0;
+            one.blend = Default::default();
+            one.isolate = false;
+            one.extras_mut().mask = None;
+            one.appearance.effects.clear();
+            Node::group(n.id, vec![Arc::new(one)])
+        }
         _ if vectorcraft_doc::live::is_live(n) => vectorcraft_doc::live::expand_deep(n, Some(hook)),
         _ => return None,
     };
@@ -171,16 +192,21 @@ pub(crate) fn outline_nested_text(n: &mut Node, clipping: bool) {
 /// a geometry effect on a fill or stroke of its own ([`has_item_geometry`]), or has no art (a
 /// symbol instance without `symbol_art`).
 pub fn reshape(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
-    if (geometry_effects(n).is_empty() && n.projection().is_none() && !has_item_geometry(n)) || !needs_outline(n) {
+    if (geometry_effects(n).is_empty() && n.projection().is_none() && !has_item_geometry(n)) || !(needs_outline(n) || has_gradient_copies(n)) {
         return None;
     }
     as_art(n, symbol_art)
 }
 
-/// `n` (see [`needs_outline`]) as plain art for Expand Appearance: [`reshape`]d when it has
+/// `n` (see [`needs_outline`], or a path with [`has_gradient_copies`]) as plain art for Expand
+/// Appearance: [`reshape`]d when it has
 /// geometry effects, else type with fills or strokes of its own outlined, in the same form. `None`
 /// when it has neither.
 pub fn expand_outlined(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
+    // A path whose Transform effect copies it with a gradient: each copy an object of its own.
+    if has_gradient_copies(n) {
+        return as_art(n, symbol_art);
+    }
     let own_paint = matches!(n.kind, NodeKind::Text(_)) && !n.appearance.items.is_empty();
     if !needs_outline(n) || (geometry_effects(n).is_empty() && !own_paint) {
         return None;
@@ -268,13 +294,21 @@ pub(crate) fn reshape_leaves(art: &mut Node, fx: &[&Effect]) {
     for e in fx {
         let Some(bounds) = art.geometric_bounds() else { break };
         let params = merged_params(&e.id, &e.params);
+        let transform = (e.id == "distort.transform").then(|| crate::distort::transform_map(bounds, &params, seed));
         for_each_leaf(art, &mut |leaf| {
             let Some((path, rule)) = leaf_geometry(leaf) else { return };
+            // A gradient paints each copy by itself, not the one piece the copies make together.
+            if let Some((m, copies)) = transform
+                && copies > 0
+                && (leaf.appearance.has_unplaced_gradient() || leaf.appearance.has_placed_gradient())
+            {
+                copy_with_gradients(leaf, &path, m, copies);
+                return;
+            }
             let out = apply_one(&e.id, &params, &path, bounds, &GeomContext { seed, ..GeomContext::of(leaf) });
             set_geometry(leaf, out, rule);
         });
-        if e.id == "distort.transform" {
-            let (m, copies) = crate::distort::transform_map(bounds, &params, seed);
+        if let Some((m, copies)) = transform {
             transform_placed(art, m, copies);
         }
     }
@@ -283,6 +317,34 @@ pub(crate) fn reshape_leaves(art: &mut Node, fx: &[&Effect]) {
     }
 }
 
+/// Replace `leaf` (a path or compound path with geometry `path`) by a group of it and `copies`
+/// more, each mapped once more by `m` than the last, as a Transform effect copies an object. Each
+/// copy is an object of its own, so its gradients fit it (a placed gradient moves with it) rather
+/// than spanning every copy. The copies stop where [`crate::distort::transform_within`]'s would.
+fn copy_with_gradients(leaf: &mut Node, path: &PathData, m: Affine, copies: usize) {
+    let each = path.anchor_count();
+    let mut anchors = each;
+    let mut placements: Vec<Arc<Node>> = vec![Arc::new(leaf.clone())];
+    let mut xf = Affine::IDENTITY;
+    for _ in 0..copies {
+        anchors = anchors.saturating_add(each);
+        if anchors > crate::distort::MAX_COPY_ANCHORS {
+            break;
+        }
+        xf *= m;
+        let mut copy = leaf.clone();
+        copy.transform(xf, vectorcraft_doc::Scaling::default());
+        if !copy.geometric_bounds().is_some_and(crate::distort::within_reach) {
+            break;
+        }
+        placements.push(Arc::new(copy));
+    }
+    // The copies become nodes of their own under a group with the object's id and name.
+    let mut g = Node::group(leaf.id, placements);
+    g.name = leaf.name.clone();
+    *leaf = g;
+}
+
 /// The bounds of each group of type's outlines under `n` ([`outline_text`]), `n` included, in
 /// order. A group inside one of them is part of it.
 fn type_outline_bounds(n: &Node, out: &mut Vec<Option<Rect>>) {

crates/effects/src/revolve.rs

@@ -34,6 +34,8 @@ pub fn revolve_options(p: &Value) -> Revolve {
         light_rotation: num(p, "lightRotation", vectorcraft_three_d::DEFAULT_LIGHT.0),
         light_height: num(p, "lightHeight", vectorcraft_three_d::DEFAULT_LIGHT.1),
         light_behind: flag(p, "lightBehind", false),
+        light_color: crate::lighting::light_color(p),
+        lights: crate::lighting::lights(p),
         light_intensity: num(p, "lightIntensity", 80.0) / 100.0,
         light_softness: num(p, "lightSoftness", 0.0) / 100.0,
         ambient: num(p, "ambient", 25.0) / 100.0,
@@ -46,6 +48,7 @@ pub fn revolve_options(p: &Value) -> Revolve {
 /// Validate before a command mutates the document. Loading external files is still bounded
 /// by the evaluator; unsupported source kinds remain unchanged when rendered.
 pub fn validate_revolve(n: &Node, p: &Value) -> Result<(), String> {
+    crate::lighting::validate(p)?;
     let path = profile(n).ok_or("Revolve currently requires a path or compound path. Select a profile drawn with the Pen tool.")?;
     let b = path.bounds().ok_or("Revolve requires a profile with at least two anchors")?;
     if !path.subpaths.iter().any(|sp| sp.anchors.len() >= 2) {
@@ -87,7 +90,9 @@ fn surface(
     let b = path.bounds()?;
     // A loaded file or a profile edited past the limits keeps drawing its source path instead
     // of crashing the frame. Commands validate the same evaluator and report its errors.
-    let faces = vectorcraft_three_d::revolve(path, b, revolve_options(&merged_params(REVOLVE, &fx.params))).ok()?;
+    let options = revolve_options(&merged_params(REVOLVE, &fx.params));
+    let colored = options.light_color != [1.0; 3] || options.lights.is_some();
+    let faces = vectorcraft_three_d::revolve(path, b, options).ok()?;
     // Visibility is an expansion option, never a change to live geometry or export baking.
     // Keep all faces for paints whose coverage we cannot prove opaque. A bounded visibility
     // failure also retains the complete surface rather than losing any of the user's art.
@@ -102,19 +107,42 @@ fn surface(
     let faces = visible.unwrap_or_else(|| {
         faces
             .into_iter()
-            .map(|f| vectorcraft_three_d::VisibleFace { path: f.path(), brightness: f.brightness, depth: f.depth, gradient: f.gradient })
+            .map(|f| vectorcraft_three_d::VisibleFace {
+                path: f.path(),
+                brightness: f.brightness,
+                depth: f.depth,
+                gradient: f.gradient,
+                illumination: f.illumination,
+                light_gradient: f.light_gradient,
+                rgb_gradient: f.rgb_gradient,
+            })
             .collect()
     });
     let children = faces
         .into_iter()
         .map(|face| {
+            if let Some(g) = face.rgb_gradient
+                && (paint.color().is_some() || matches!(paint, Paint::Gradient(_)))
+            {
+                return Arc::new(crate::lighting::rgb_gradient_art(n.id, &face.path, &paint, g));
+            }
+            if let (true, Paint::Gradient(_), Some(g)) = (colored, &paint, face.light_gradient) {
+                return Arc::new(crate::lighting::gradient_art(n.id, &face.path, &paint, g));
+            }
             let mut fill = FillLayer::new(paint.clone());
             let mut items = vec![];
             if let Some(c) = paint.color() {
                 let [r, g, b] = c.to_rgb();
                 let color = |s: f64| Color::rgb(r * s as f32, g * s as f32, b * s as f32);
-                fill.paint = face.gradient.map_or_else(|| Paint::solid(color(face.brightness)), |g| shading_paint(g, color, |_| 1.0));
+                fill.paint = if colored {
+                    face.light_gradient
+                        .map_or_else(|| Paint::solid(crate::lighting::shade(c, face.illumination)), |g| crate::lighting::smooth_paint(g, c))
+                } else {
+                    face.gradient.map_or_else(|| Paint::solid(color(face.brightness)), |g| shading_paint(g, color, |_| 1.0))
+                };
                 items.push(AppearanceItem::Fill(fill));
+            } else if colored && matches!(paint, Paint::Gradient(_)) {
+                items = crate::lighting::fills(&paint, face.illumination, face.brightness, true);
             } else {
                 items.push(AppearanceItem::Fill(fill));
                 let mut shadow = FillLayer::new(Paint::solid(Color::BLACK));

crates/effects/src/solids.rs

@@ -3,11 +3,14 @@
 use std::sync::Arc;
 
 use serde_json::Value;
-use vectorcraft_doc::color::{BlendMode, Color, Paint};
-use vectorcraft_doc::{Appearance, AppearanceItem, Effect, FillLayer, Node, NodeKind, StrokeLayer};
+use vectorcraft_doc::color::{BlendMode, Paint};
+use vectorcraft_doc::{Appearance, AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
 use vectorcraft_geom::{FillRule, PathData, Rect};
 use vectorcraft_three_d::{Bevel, BevelShape, Extrude, Facet, Inflate, View};
 
+#[cfg(test)]
+use vectorcraft_doc::color::Color;
+
 use crate::util::{flag, num, text};
 use crate::{GeomContext, apply_geometry_with, is_geometry};
 
@@ -65,6 +68,8 @@ pub fn view_options(p: &Value) -> View {
         light_rotation: num(p, "lightRotation", vectorcraft_three_d::DEFAULT_LIGHT.0),
         light_height: num(p, "lightHeight", vectorcraft_three_d::DEFAULT_LIGHT.1),
         light_behind: flag(p, "lightBehind", false),
+        light_color: crate::lighting::light_color(p),
+        lights: crate::lighting::lights(p),
         light_intensity: num(p, "lightIntensity", 80.0) / 100.0,
         light_softness: num(p, "lightSoftness", 0.0) / 100.0,
         ambient: num(p, "ambient", 25.0) / 100.0,
@@ -124,6 +129,7 @@ fn facets(id: &str, path: &PathData, rule: FillRule, bounds: Rect, p: &Value) ->
 
 /// Validate before a command changes the document; the evaluator bounds loaded files too.
 pub fn validate_solid(n: &Node, id: &str, p: &Value) -> Result<(), String> {
+    crate::lighting::validate(p)?;
     let label = crate::effect_info(id).map_or("This effect", |e| e.label.trim_end_matches('…'));
     let (path, rule) =
         profile(n).ok_or_else(|| format!("{label} currently requires a path or compound path. Convert type, images and groups to paths first."))?;
@@ -139,32 +145,38 @@ pub fn validate_solid(n: &Node, id: &str, p: &Value) -> Result<(), String> {
 
 /// One surface: each facet a path shaded from `paint`, as a group with the paint's opacity and
 /// blend mode (so overlapping facets don't add up their transparency).
-fn surface(n: &Node, facets: Vec<Facet>, paint: &Paint, opacity: f32, blend: BlendMode) -> Node {
+fn surface(n: &Node, facets: Vec<Facet>, paint: &Paint, opacity: f32, blend: BlendMode, colored: bool) -> Node {
+    if colored && paint.color().is_some() && facets.iter().any(|face| face.rgb_gradient.is_some()) {
+        let mut group = crate::lighting::solid_surface(n.id, &facets, paint);
+        group.opacity = opacity;
+        group.blend = blend;
+        return group;
+    }
+    // Preserve existing white-light paints, alpha composition and seam joins exactly.
+    let (opaque, mask) = if colored { crate::lighting::opaque_paint(paint) } else { (paint.clone(), None) };
+    let paint = &opaque;
     let children = facets
         .into_iter()
         .map(|face| {
-            let mut items = vec![];
-            if let Some(c) = paint.color() {
-                let [r, g, b] = c.to_rgb();
-                let s = face.brightness as f32;
-                items.push(AppearanceItem::Fill(FillLayer::new(Paint::solid(Color::rgb(r * s, g * s, b * s)))));
-            } else {
-                // Gradients and patterns keep their paint, darkened by a black layer.
-                items.push(AppearanceItem::Fill(FillLayer::new(paint.clone())));
-                let mut shadow = FillLayer::new(Paint::solid(Color::BLACK));
-                shadow.opacity = (1.0 - face.brightness) as f32;
-                items.push(AppearanceItem::Fill(shadow));
-            }
             // Adjacent facets, antialiased on their own, would leave hairline seams: a narrow
             // stroke of the same paint closes them. No wider than the facet is thick, though: seen
             // at a grazing angle a facet can be thinner than the stroke, and its stroke would then
             // paint over its neighbours.
             let seam = (face.thickness() / 2.0).clamp(0.05, 0.75);
+            if let Some(g) = face.rgb_gradient
+                && (paint.color().is_some() || matches!(paint, Paint::Gradient(_)))
+            {
+                return Arc::new(crate::lighting::facet_art(n.id, &face.path(), paint, g, seam));
+            }
+            let items = crate::lighting::fills(paint, face.illumination, face.brightness, colored);
             let items = items
                 .into_iter()
                 .flat_map(|item| {
                     let AppearanceItem::Fill(fill) = &item else { return vec![item] };
                     let mut edge = StrokeLayer::new(fill.paint.clone(), seam);
+                    if colored {
+                        edge.join = vectorcraft_doc::LineJoin::Round;
+                    }
                     edge.opacity = fill.opacity;
                     vec![item, AppearanceItem::Stroke(edge)]
                 })
@@ -175,6 +187,11 @@ fn surface(n: &Node, facets: Vec<Facet>, paint: &Paint, opacity: f32, blend: Ble
     let mut group = Node::group(n.id, children);
     group.opacity = opacity;
     group.blend = blend;
+    if let Some(mask) = mask {
+        let bounds = group.visual_bounds().unwrap_or(Rect::ZERO).inflate(1.0, 1.0);
+        let coverage = Node::path(n.id, vectorcraft_geom::shapes::rectangle(bounds), Appearance::basic(mask, Paint::None, 0.0));
+        group.extras_mut().mask = Some(Box::new(vectorcraft_doc::OpacityMask::new(coverage, true)));
+    }
     group
 }
 
@@ -200,6 +217,7 @@ fn region(path: &PathData, rule: FillRule, item: &AppearanceItem) -> (PathData,
 fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&AppearanceItem]) -> Option<Vec<Arc<Node>>> {
     let b = path.bounds()?;
     let p = crate::merged_params(&fx.id, &fx.params);
+    let colored = view_options(&p).has_colored_lights();
     if fx.id == ROTATE {
         // Every part turns about the centre of the object's own bounds, so they stay together.
         let mut out = vec![];
@@ -207,7 +225,7 @@ fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&App
             let (paint, opacity, blend) = paint_of(item);
             let (area, rule) = region(path, rule, item);
             let f = facets(ROTATE, &area, rule, b, &p).ok()?;
-            out.push(Arc::new(surface(n, f, &paint, opacity, blend)));
+            out.push(Arc::new(surface(n, f, &paint, opacity, blend, colored)));
         }
         return Some(out);
     }
@@ -216,7 +234,7 @@ fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&App
     // A loaded file or a shape edited past the limits keeps drawing its source path instead of
     // failing the frame; commands validate the same evaluator and report its errors.
     let f = facets(&fx.id, path, rule, b, &p).ok()?;
-    Some(vec![Arc::new(surface(n, f, &paint, opacity, blend))])
+    Some(vec![Arc::new(surface(n, f, &paint, opacity, blend, colored))])
 }
 
 fn geometry(path: &PathData, fx: &[Effect], ctx: &GeomContext) -> PathData {

crates/effects/src/tests.rs

@@ -510,6 +510,31 @@ fn zigzag_spaces_ridges_evenly_along_a_straight_line() {
     }
 }
 
+/// #2343: Smooth points make a continuous wave, not a zigzag with rounded tips. Every peak and
+/// valley is a smooth point whose handles run parallel to the line, and the curve between them
+/// follows a cosine, even where the ridges are much taller than they are apart.
+#[test]
+fn zigzag_smooth_is_a_wave() {
+    use vectorcraft_geom::kurbo::ParamCurve;
+    let line = PathData::single(SubPath::polyline(&[Point::new(0.0, 0.0), Point::new(100.0, 0.0)], false));
+    for size in [3.0, 30.0] {
+        let out = run("distort.zigZag", json!({"ridges": 9, "points": "smooth", "size": size}), &line);
+        let sp = &out.subpaths[0];
+        assert_eq!(sp.anchors.len(), 11);
+        for a in &sp.anchors {
+            assert!(close(a.h_in.y, a.p.y, 1e-9) && close(a.h_out.y, a.p.y, 1e-9), "size {size}: handles not level at {a:?}");
+        }
+        for i in 0..sp.segment_count() {
+            let c = sp.segment(i);
+            for k in 0..=20 {
+                let q = c.eval(k as f64 / 20.0);
+                let want = -size * (std::f64::consts::PI * q.x / 10.0).cos();
+                assert!((q.y - want).abs() < 0.03 * size, "size {size}: {q:?} off the wave ({want})");
+            }
+        }
+    }
+}
+
 /// #1554 on curves: a circle's ridges sit at equal angles, at the radius plus and minus the size in
 /// turn all the way round.
 #[test]
@@ -809,6 +834,50 @@ fn drop_shadow_darkness_replaces_its_color_when_chosen() {
     assert_eq!(darkness(json!({})), None);
 }
 
+#[test]
+fn rasterize_compose_leaves_the_raster_alone_when_the_sizes_do_not_fit() {
+    let r = match raster_effects(&[fx(RASTERIZE, json!({}))]).as_slice() {
+        [RasterFx::Rasterize(r)] => *r,
+        other => panic!("{other:?}"),
+    };
+    let space = PixelSpace {
+        to_doc: Affine::IDENTITY,
+        px: 1.0,
+        center: Point::new(1.0, 1.0),
+        channels: pixel::Channels::Rgb,
+        line: 1.0,
+        extent: std::f64::consts::SQRT_2,
+    };
+    let compose = |len: usize, w: usize, h: usize, image: &[u8], cols: usize, rows: usize, rect: Rect| {
+        let mut data = vec![7; len];
+        r.compose(&mut data, w, h, &space, image, cols, rows, rect);
+        data
+    };
+    // A 2 × 2 red image over a 2 × 2 raster of one-point pixels: each pixel takes the image's color.
+    let red = [255, 0, 0, 255].repeat(4);
+    let mut long = red.clone();
+    long.extend([255, 0]);
+    let (img, long, area) = (red.as_slice(), long.as_slice(), Rect::new(0.0, 0.0, 2.0, 2.0));
+    assert_eq!(compose(16, 2, 2, img, 2, 2, area), red);
+    let cases = [
+        ("w × h is not the raster's pixel count", 16, 1, 2, img, 2, 2, area),
+        ("the raster's length is not a multiple of 4", 18, 2, 2, img, 2, 2, area),
+        ("cols × rows is not the image's pixel count", 16, 2, 2, img, 1, 2, area),
+        ("the image's length is not a multiple of 4", 16, 2, 2, long, 2, 2, area),
+        ("the image has no width", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, 0.0, 2.0)),
+        ("the image has no height", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, 2.0, 0.0)),
+        ("the image has a negative width", 16, 2, 2, img, 2, 2, Rect::new(2.0, 0.0, 0.0, 2.0)),
+        ("the image has a NaN width", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, f64::NAN, 2.0)),
+        ("the image has a NaN height", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, 2.0, f64::NAN)),
+    ];
+    let failures: Vec<_> = cases
+        .iter()
+        .filter(|&&(_, len, w, h, image, cols, rows, rect)| compose(len, w, h, image, cols, rows, rect) != vec![7; len])
+        .map(|c| c.0)
+        .collect();
+    assert!(failures.is_empty(), "{failures:?}");
+}
+
 #[test]
 fn blend_mode_names() {
     use vectorcraft_doc::color::BlendMode;

crates/effects/src/tests_scale.rs

@@ -23,6 +23,10 @@ fn scale_effect_scales_distances_only() {
     scale_effect(&mut e, 2.0);
     assert_eq!((&e.params["x"], &e.params["y"], &e.params["blur"]), (&json!(6.0), &json!(8.0), &json!(10.0)));
     assert_eq!(e.params["opacity"], json!(75.0));
+    // Rasterize's Add Around Object is a distance; its resolution isn't.
+    let mut r = new_effect(RASTERIZE, &json!({"addAround": 10, "resolution": 150})).unwrap();
+    scale_effect(&mut r, 2.0);
+    assert_eq!((&r.params["addAround"], &r.params["resolution"]), (&json!(20.0), &json!(150)));
     // Outline Stroke without a weight follows its stroke's: nothing to scale.
     let mut o = Effect { id: "path.outlineStroke".into(), params: json!(null), visible: true };
     scale_effect(&mut o, 2.0);

crates/effects/src/tests_solids.rs

@@ -27,7 +27,10 @@ fn faces(art: &Node) -> Vec<&Node> {
 
 fn fill_rgb(n: &Node) -> [f32; 3] {
     match &n.appearance.items[0] {
-        AppearanceItem::Fill(f) => f.paint.color().unwrap().to_rgb(),
+        AppearanceItem::Fill(f) => match &f.paint {
+            Paint::Gradient(g) => g.gradient.sample(0.5).0.to_rgb(),
+            p => p.color().unwrap().to_rgb(),
+        },
         _ => panic!("a fill first"),
     }
 }
@@ -183,10 +186,12 @@ fn an_earlier_perspective_strength_draws_as_its_angle() {
 #[test]
 fn an_earlier_light_direction_shades_as_its_rotation_and_height() {
     fn colours(n: &Node, out: &mut Vec<[f32; 3]>) {
-        if let Some(AppearanceItem::Fill(f)) = n.appearance.items.first()
-            && let Some(c) = f.paint.color()
-        {
-            out.push(c.to_rgb());
+        if let Some(AppearanceItem::Fill(f)) = n.appearance.items.first() {
+            if let Paint::Gradient(g) = &f.paint {
+                out.extend(g.gradient.stops.iter().map(|s| s.color.to_rgb()));
+            } else if let Some(c) = f.paint.color() {
+                out.push(c.to_rgb());
+            }
         }
         for c in n.children().into_iter().flatten() {
             colours(c, out);
@@ -265,3 +270,52 @@ fn inflate_reads_twist_taper_and_cap() {
     assert_eq!((d.twist, d.taper, d.cap), (0.0, 1.0, true));
     assert_eq!(crate::default_params(INFLATE).unwrap()["cap"], json!(true));
 }
+
+#[test]
+fn legacy_white_inflate_keeps_polygon_faces_and_its_seam_range() {
+    let mut n = square_node();
+    n.appearance.effects.push(fx(INFLATE, json!({})));
+    let art = solid_art(&n).unwrap();
+    let original = faces(&art);
+    assert!(original.len() > 1000);
+    assert!(original.iter().any(|f| f.path_data().unwrap().subpaths.iter().any(|p| p.anchors.len() > 3)), "legacy cells remain polygons");
+    for face in original {
+        assert!(matches!(face.kind, NodeKind::Path { .. }));
+        let AppearanceItem::Stroke(stroke) = &face.appearance.items[1] else { panic!("seam") };
+        assert!((0.05..=0.75).contains(&stroke.width));
+        assert_eq!(stroke.join, vectorcraft_doc::LineJoin::Miter);
+    }
+    // A tiny shape exercises the lower bound, which otherwise disappears at grazing angles.
+    n.transform(Affine::scale(0.001), false);
+    let art = solid_art(&n).unwrap();
+    assert!(faces(&art).iter().any(|face| matches!(&face.appearance.items[1], AppearanceItem::Stroke(s) if s.width == 0.05)));
+    // An explicit white light overrides a stale legacy color without switching shading paths.
+    n.appearance.effects[0].params = json!({"lightColor":"#ff0000","lights":[{}]});
+    let art = solid_art(&n).unwrap();
+    assert!(faces(&art).iter().all(|face| matches!(face.kind, NodeKind::Path { .. })));
+}
+
+#[test]
+fn colored_solid_inflate_batches_channels_and_clips_once_per_surface() {
+    let mut n = square_node();
+    n.appearance.effects.push(fx(INFLATE, json!({"lights":[{"color":"#ff0000"},{"color":"#0000ff"}]})));
+    let art = solid_art(&n).unwrap();
+    fn count(n: &Node) -> (usize, usize, usize) {
+        let (mut groups, mut clips, mut paths) = match &n.kind {
+            NodeKind::Group { clip, .. } => (1, usize::from(*clip), 0),
+            NodeKind::Path { .. } => (0, 0, 1),
+            _ => (0, 0, 0),
+        };
+        for child in n.children().into_iter().flatten() {
+            let (g, c, p) = count(child);
+            groups += g;
+            clips += c;
+            paths += p;
+        }
+        (groups, clips, paths)
+    }
+    let (groups, clips, paths) = count(&art);
+    assert!(paths > 1000, "exercise a tessellated surface");
+    assert_eq!(clips, 1);
+    assert_eq!(groups, 7, "group count must not grow with triangle count");
+}

crates/engine/Cargo.toml

@@ -15,6 +15,8 @@ default = ["bundled-fonts"]
 bundled-fonts = ["vectorcraft-text/bundled-fonts"]
 
 [dependencies]
+# Which paths stored in documents may be opened.
+craft-docpath = { workspace = true }
 vectorcraft-geom = { workspace = true }
 vectorcraft-color = { workspace = true }
 vectorcraft-doc = { workspace = true }
@@ -35,6 +37,8 @@ vectorcraft-affinity = { workspace = true }
 vectorcraft-scriptcheck = { workspace = true }
 image = { workspace = true }
 flate2 = { workspace = true }
+# The XML parts of Word documents placed as type (place/docx.rs).
+roxmltree = "0.21"
 kurbo = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -46,6 +50,8 @@ vectorcraft-affinity = { workspace = true, features = ["synth"] }
 crc32fast = { workspace = true }
 vectorcraft-testkit = { workspace = true }
 proptest = { workspace = true }
+# A variable font built in code (no font file is committed).
+vectorcraft-text = { workspace = true, features = ["test-fonts"] }
 wat = { workspace = true }
 # Zstandard streams for the Illustrator editing data fuzz tests.
 ruzstd = { workspace = true }

crates/engine/src/cmd/brushsym.rs

@@ -11,11 +11,12 @@ use std::sync::Arc;
 use serde_json::{Value, json};
 use vectorcraft_brush::{self as brush, Brush};
 use vectorcraft_color::{Color, Paint};
-use vectorcraft_doc::{AppearanceItem, Document, FillLayer, Node, NodeId, NodeKind, Symbol, SymbolExportType, SymbolRegistration};
+use vectorcraft_doc::{AppearanceItem, Document, FillLayer, Node, NodeId, NodeKind, Symbol, SymbolExportType, SymbolNineSlice, SymbolRegistration};
 use vectorcraft_geom::{Affine, Point, Vec2};
 
 use super::edit::{outermost, selected_roots};
 use super::pathops::{remove_each, separate};
+use super::swatch::names_param;
 use super::*;
 use crate::EngineError;
 
@@ -61,18 +62,34 @@ pub fn specs() -> Vec<CommandSpec> {
             "New Brush…",
             [],
             None,
-            "{type: calligraphic|scatter|art|pattern|bristle, name?, params?: {…definition fields}, ids?|id?} new brush; art/scatter/pattern brushes take the selected art (pattern: side tile) unless params give it → {name}",
+            "{type: calligraphic|scatter|art|pattern|bristle, name? (trimmed; blank: New <Type> Brush), params?: {…definition fields}, ids?|id?} new brush; art/scatter/pattern brushes take the selected art (pattern: side tile) unless params give it → {name}",
             has_doc,
             brush_new
         ),
-        cmd!("brush.delete", "Delete Brush", [], None, "{name} delete a brush; strokes using it become plain strokes", has_doc, brush_delete),
-        cmd!("brush.duplicate", "Duplicate Brush", [], None, "{name, newName?} → {name}", has_doc, brush_duplicate),
+        cmd!(
+            "brush.delete",
+            "Delete Brush",
+            [],
+            None,
+            "{name} | {names: [name…]} delete brushes; strokes using them become plain strokes",
+            has_doc,
+            brush_delete
+        ),
+        cmd!(
+            "brush.duplicate",
+            "Duplicate Brush",
+            [],
+            None,
+            "{name, newName? (trimmed; blank: <name> copy)} | {names: [name…]} → {name} | {names}",
+            has_doc,
+            brush_duplicate
+        ),
         cmd!(
             "brush.options",
             "Brush Options…",
             [],
             None,
-            "{name, params?: {…fields to change (brush.get shows them; values outside their ranges are clamped). calligraphic: angle −180..180°, roundness 0..100%, size 0..1296 pt, variation: [angle°, roundness%, size pt], modes: [fixed|random|pressure for angle, roundness, size] (pressure goes from value − variation at the lightest pen pressure to value + variation at the heaviest). scatter: size [a, b] 1..10000%, spacing [a, b] 1..10000%, scatter [a, b] −1000..1000%, rotation [a, b] −180..180°, modes: [fixed|random|pressure for size, spacing, scatter, rotation] (fixed: a; random: between a and b; pressure: a at the lightest pen pressure to b at the heaviest), rotation_relative_to_path. art: width 1..1000%, scale: {mode: proportional|stretch|betweenGuides, start, end: 0..1 of the art length}, direction: leftToRight|rightToLeft|topToBottom|bottomToTop, flip_along, flip_across. pattern: scale 1..10000%, spacing 0..10000%, fit: stretch|addSpace|approximate, flip_along, flip_across. scatter, art and pattern: colorization: {method: none|tints|tintsAndShades|hueShift, key: colour (hueShift: the art colour that becomes the stroke colour)}}, newName?} edit a brush definition (strokes using it update) → {name}",
+            "{name, params?: {…fields to change (brush.get shows them; values outside their ranges are clamped). calligraphic: angle −180..180°, roundness 0..100%, size 0..1296 pt, variation: [angle°, roundness%, size pt], modes: [fixed|random|pressure for angle, roundness, size] (pressure goes from value − variation at the lightest pen pressure to value + variation at the heaviest). scatter: size [a, b] 1..10000%, spacing [a, b] 1..10000%, scatter [a, b] −1000..1000%, rotation [a, b] −180..180°, modes: [fixed|random|pressure for size, spacing, scatter, rotation] (fixed: a; random: between a and b; pressure: a at the lightest pen pressure to b at the heaviest), rotation_relative_to_path. art: width 1..1000%, scale: {mode: proportional|stretch|betweenGuides, start, end: 0..1 of the art length}, direction: leftToRight|rightToLeft|topToBottom|bottomToTop, flip_along, flip_across. pattern: scale 1..10000%, spacing 0..10000%, fit: stretch|addSpace|approximate, flip_along, flip_across. scatter, art and pattern: colorization: {method: none|tints|tintsAndShades|hueShift, key: colour (hueShift: the art colour that becomes the stroke colour)}}, newName? (trimmed; blank: the name is kept)} edit a brush definition (strokes using it update) → {name}",
             has_doc,
             brush_options
         ),
@@ -101,7 +118,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "New Symbol…",
             [],
             None,
-            "{name?, ids?|id?, registration?: 0..8 (9-point grid, 4 = centre; Symbol Options › Registration), exportType?: movieClip (default)|graphic} make a symbol from the selection and replace it with an instance → {name, id, registration, exportType}",
+            "{name?, ids?|id?, registration?: 0..8 (9-point grid, 4 = centre; Symbol Options › Registration), exportType?: movieClip (default)|graphic, nineSlice?: bool, nineSliceGuides?: array} make a symbol from the selection and replace it with an instance; nineSlice is Symbol Options › Enable Guides for 9-Slice Scaling, nineSliceGuides [left, top, right, bottom] as fractions 0..1 of the natural size (default a third each) → {name, id, registration, exportType, nineSlice}",
             has_selection,
             symbol_new
         ),
@@ -110,7 +127,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Symbol Options…",
             [],
             None,
-            "{name?, newName?, registration?: 0..8, exportType?: movieClip|graphic} rename a symbol and/or set Symbol Options › Registration and Export Type (default name: current) → {name, registration, exportType}",
+            "{name?, newName?, registration?: 0..8, exportType?: movieClip|graphic, nineSlice?: bool, nineSliceGuides?: array} rename a symbol and/or set Symbol Options › Registration and Export Type and 9-slice guides (nineSliceGuides [left, top, right, bottom] fractions 0..1; default name: current) → {name, registration, exportType, nineSlice}",
             has_doc,
             symbol_options
         ),
@@ -193,7 +210,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Symbolism Tool",
             [],
             None,
-            "{tool: shift|scrunch|size|spin|stain|screen|style, points: [[x,y]…], radius?: 40, intensity?: 1..10 (5), alt?: bool, color?, style?: name} adjust instances near the points (selection, else all) → {count}",
+            "{tool: shift|scrunch|size|spin|stain|screen|style, points: [[x,y]…], radius?: 40, intensity?: 1..10 (5), alt?: bool, color?, keepModel?: bool (as paint.setFill), style?: name} adjust instances near the points (selection, else all) → {count}",
             has_doc,
             symbol_adjust
         ),
@@ -339,10 +356,10 @@ fn merge(base: &mut Value, patch: &Value) {
     }
 }
 
-fn save_library(s: &mut Session, label: &str, lib: Vec<Brush>, rename: Option<(String, Option<String>)>) -> Result<()> {
+fn save_library(s: &mut Session, label: &str, lib: Vec<Brush>, renames: &[(String, Option<String>)]) -> Result<()> {
     s.edit(label, |d, _| {
         brush::store(d, &lib);
-        if let Some((from, to)) = rename {
+        for (from, to) in renames {
             let ids: Vec<NodeId> = {
                 let mut v = vec![];
                 d.walk(|n| {
@@ -384,7 +401,8 @@ fn brush_new(s: &mut Session, p: &Value) -> Result<Value> {
         o => return Err(bad(C, format!("unknown brush type `{o}`"))),
     };
     let mut lib = brush::library(&s.doc()?.doc);
-    let base_name = str_param(p, "name").map(str::to_string).unwrap_or_else(|| format!("New {} Brush", ty[..1].to_uppercase() + &ty[1..]));
+    let given = str_param(p, "name").map(str::trim).filter(|n| !n.is_empty());
+    let base_name = given.map_or_else(|| format!("New {} Brush", ty[..1].to_uppercase() + &ty[1..]), str::to_string);
     let name = brush::unique_name(&lib, &base_name);
     let mut v = json!({"name": name, "type": ty});
     if let Some(params) = p.get("params") {
@@ -402,7 +420,7 @@ fn brush_new(s: &mut Session, p: &Value) -> Result<Value> {
         v[k] = serde_json::to_value(&art).unwrap_or_default();
     }
     lib.push(parse_brush(C, v)?);
-    save_library(s, "New Brush", lib, None)?;
+    save_library(s, "New Brush", lib, &[])?;
     Ok(json!({ "name": name }))
 }
 
@@ -414,26 +432,36 @@ fn parse_brush(cmd: &str, v: Value) -> Result<Brush> {
 }
 
 fn brush_delete(s: &mut Session, p: &Value) -> Result<Value> {
-    let name = name_param(p, "brush.delete")?.to_string();
+    const C: &str = "brush.delete";
+    let names = names_param(p, C)?;
     let mut lib = brush::library(&s.doc()?.doc);
-    let n = lib.len();
-    lib.retain(|b| b.name != name);
-    if lib.len() == n {
-        return Err(bad("brush.delete", format!("no brush named `{name}`")));
+    if let Some(name) = names.iter().find(|n| !lib.iter().any(|b| &b.name == *n)) {
+        return Err(bad(C, format!("no brush named `{name}`")));
     }
-    save_library(s, "Delete Brush", lib, Some((name, None)))?;
+    lib.retain(|b| !names.contains(&b.name));
+    let renames: Vec<(String, Option<String>)> = names.into_iter().map(|n| (n, None)).collect();
+    save_library(s, "Delete Brush", lib, &renames)?;
     ok()
 }
 
+/// Adds a copy of each brush in `name` or `names` at the end of the library. `newName`, given
+/// without `names`, names the copy.
 fn brush_duplicate(s: &mut Session, p: &Value) -> Result<Value> {
-    let name = name_param(p, "brush.duplicate")?;
-    let mut lib = brush::library(&s.doc()?.doc);
-    let mut b = lib.iter().find(|b| b.name == name).cloned().ok_or_else(|| bad("brush.duplicate", format!("no brush named `{name}`")))?;
-    b.name = brush::unique_name(&lib, str_param(p, "newName").unwrap_or(&format!("{name} copy")));
-    let out = b.name.clone();
-    lib.push(b);
-    save_library(s, "Duplicate Brush", lib, None)?;
-    Ok(json!({ "name": out }))
+    const C: &str = "brush.duplicate";
+    let names = names_param(p, C)?;
+    let before = brush::library(&s.doc()?.doc);
+    let mut lib = before.clone();
+    let mut out = vec![];
+    for name in &names {
+        let mut b = before.iter().find(|b| &b.name == name).cloned().ok_or_else(|| bad(C, format!("no brush named `{name}`")))?;
+        let given = str_param(p, "newName").map(str::trim).filter(|n| !n.is_empty() && p.get("names").is_none());
+        let new_name = given.map_or_else(|| format!("{} copy", name.trim()), str::to_string);
+        b.name = brush::unique_name(&lib, &new_name);
+        out.push(b.name.clone());
+        lib.push(b);
+    }
+    save_library(s, "Duplicate Brush", lib, &[])?;
+    Ok(if p.get("names").is_some() { json!({ "names": out }) } else { json!({ "name": out.first() }) })
 }
 
 fn brush_options(s: &mut Session, p: &Value) -> Result<Value> {
@@ -445,7 +473,7 @@ fn brush_options(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(params) = p.get("params") {
         merge(&mut v, params);
     }
-    let new_name = str_param(p, "newName").filter(|n| !n.trim().is_empty() && *n != name).map(str::to_string);
+    let new_name = str_param(p, "newName").map(str::trim).filter(|n| !n.is_empty() && *n != name).map(str::to_string);
     if let Some(nn) = &new_name {
         if lib.iter().any(|b| &b.name == nn) {
             return Err(bad(C, format!("a brush named `{nn}` exists")));
@@ -458,7 +486,7 @@ fn brush_options(s: &mut Session, p: &Value) -> Result<Value> {
     lib[i] = parse_brush(C, v)?;
     let out = lib[i].name.clone();
     let rename = new_name.map(|nn| (name, Some(nn)));
-    save_library(s, "Brush Options", lib, rename)?;
+    save_library(s, "Brush Options", lib, rename.as_slice())?;
     Ok(json!({ "name": out }))
 }
 
@@ -540,6 +568,33 @@ fn export_type_param(p: &Value, cmd: &str) -> Result<Option<SymbolExportType>> {
     }
 }
 
+/// `nineSlice` (bool) and `nineSliceGuides` ([left, top, right, bottom] fractions of the natural
+/// size): `None` leaves the symbol alone, `Some(None)` turns 9-slice off, `Some(Some(g))` turns it
+/// on with guides `g` (the symbol's current ones, else the centre third, when none are given).
+fn nine_slice_param(p: &Value, cmd: &str, current: Option<SymbolNineSlice>) -> Result<Option<Option<SymbolNineSlice>>> {
+    let on = match p.get("nineSlice") {
+        None | Some(Value::Null) => None,
+        Some(v) => Some(v.as_bool().ok_or_else(|| bad(cmd, "nineSlice must be true or false"))?),
+    };
+    let guides =
+        match p.get("nineSliceGuides") {
+            None | Some(Value::Null) => None,
+            Some(v) => Some(SymbolNineSlice::from_value(v).ok_or_else(|| {
+                bad(cmd, "nineSliceGuides must be [left, top, right, bottom], each 0..1, with left + right < 1 and top + bottom < 1")
+            })?),
+        };
+    Ok(match (on, guides) {
+        (Some(false), _) => Some(None),
+        (None, None) => None,
+        (_, Some(g)) => Some(Some(g)),
+        (Some(true), None) => Some(Some(current.unwrap_or_default())),
+    })
+}
+
+fn nine_slice_json(d: &Document, name: &str) -> Value {
+    d.symbol_nine_slice(name).map_or(Value::Null, SymbolNineSlice::to_value)
+}
+
 fn rename_natural_size(d: &mut Document, from: &str, to: &str) {
     if from == to {
         return;
@@ -596,6 +651,7 @@ fn symbol_list(s: &mut Session, _: &Value) -> Result<Value> {
                 "size": [w, h],
                 "registration": d.symbol_registration(&sym.name).0,
                 "exportType": d.symbol_export_type(&sym.name).id(),
+                "nineSlice": nine_slice_json(d, &sym.name),
             })
         })
         .collect();
@@ -623,9 +679,10 @@ fn symbol_new(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = roots(s, p)?;
     let art = selection_art(s, p)?.ok_or_else(|| EngineError::Other("nothing selected".into()))?;
     let (art, size, c) = normalize(art)?;
-    let name = s.doc()?.doc.unique_symbol_name(str_param(p, "name").filter(|n| !n.trim().is_empty()).unwrap_or("New Symbol"));
+    let name = s.doc()?.doc.unique_symbol_name(str_param(p, "name").map(str::trim).filter(|n| !n.is_empty()).unwrap_or("New Symbol"));
     let reg = registration_param(p, C)?.unwrap_or(SymbolRegistration::CENTER);
     let export = export_type_param(p, C)?.unwrap_or_default();
+    let nine = nine_slice_param(p, C, None)?.flatten();
     // Keep the art where it was: the geometric centre stays at `c`, whatever the registration is.
     let place = place_xf(c + reg.offset_from_center(size.0, size.1), size, reg);
     let id = s.edit("New Symbol", |d, sel| {
@@ -634,12 +691,15 @@ fn symbol_new(s: &mut Session, p: &Value) -> Result<Value> {
         set_natural_size(d, &name, Some(size));
         d.set_symbol_registration(&name, reg);
         d.set_symbol_export_type(&name, export);
+        d.set_symbol_nine_slice(&name, nine);
         d.unknown.insert(CURRENT_SYMBOL.into(), json!(name));
         let id = replace_with_instance(d, &ids, &name, place)?;
         sel.set([id]);
         Ok(id)
     })?;
-    Ok(json!({ "name": name, "id": id.0, "registration": reg.0, "exportType": export.id() }))
+    Ok(
+        json!({ "name": name, "id": id.0, "registration": reg.0, "exportType": export.id(), "nineSlice": nine.map_or(Value::Null, SymbolNineSlice::to_value) }),
+    )
 }
 
 fn symbol_options(s: &mut Session, p: &Value) -> Result<Value> {
@@ -647,9 +707,10 @@ fn symbol_options(s: &mut Session, p: &Value) -> Result<Value> {
     let name = resolve_symbol(&s.doc()?.doc, p, C)?;
     let export = export_type_param(p, C)?;
     let reg = registration_param(p, C)?;
+    let nine = nine_slice_param(p, C, s.doc()?.doc.symbol_nine_slice(&name))?;
     let new_name = str_param(p, "newName").map(str::trim).filter(|n| !n.is_empty()).map(str::to_string);
-    if new_name.is_none() && export.is_none() && reg.is_none() {
-        return Err(bad(C, "pass newName, registration and/or exportType"));
+    if new_name.is_none() && export.is_none() && reg.is_none() && nine.is_none() {
+        return Err(bad(C, "pass newName, registration, exportType and/or nineSlice"));
     }
     if let Some(ref n) = new_name
         && n != &name
@@ -673,6 +734,7 @@ fn symbol_options(s: &mut Session, p: &Value) -> Result<Value> {
             rename_natural_size(d, &name, n);
             d.rename_symbol_registration(&name, n);
             d.rename_symbol_export_type(&name, n);
+            d.rename_symbol_nine_slice(&name, n);
             if d.unknown.get(CURRENT_SYMBOL).and_then(Value::as_str) == Some(name.as_str()) {
                 d.unknown.insert(CURRENT_SYMBOL.into(), json!(n));
             }
@@ -683,6 +745,9 @@ fn symbol_options(s: &mut Session, p: &Value) -> Result<Value> {
         if let Some(kind) = export {
             d.set_symbol_export_type(&final_name, kind);
         }
+        if let Some(g) = nine {
+            d.set_symbol_nine_slice(&final_name, g);
+        }
         Ok(())
     })?;
     let d = &s.doc()?.doc;
@@ -690,6 +755,7 @@ fn symbol_options(s: &mut Session, p: &Value) -> Result<Value> {
         "name": final_name,
         "registration": d.symbol_registration(&final_name).0,
         "exportType": d.symbol_export_type(&final_name).id(),
+        "nineSlice": nine_slice_json(d, &final_name),
     }))
 }
 
@@ -848,6 +914,7 @@ fn symbol_delete(s: &mut Session, p: &Value) -> Result<Value> {
         set_natural_size(d, &name, None);
         d.set_symbol_registration(&name, SymbolRegistration::CENTER);
         d.clear_symbol_export_type(&name);
+        d.set_symbol_nine_slice(&name, None);
         if d.unknown.get(CURRENT_SYMBOL).and_then(Value::as_str) == Some(name.as_str()) {
             d.unknown.remove(CURRENT_SYMBOL);
         }
@@ -861,19 +928,22 @@ fn symbol_duplicate(s: &mut Session, p: &Value) -> Result<Value> {
     let name = name_param(p, C)?.to_string();
     let d = &s.doc()?.doc;
     let sym = d.symbols.iter().find(|x| x.name == name).cloned().ok_or_else(|| bad(C, format!("no symbol named `{name}`")))?;
-    let new = d.unique_symbol_name(str_param(p, "newName").unwrap_or(&format!("{name} copy")));
+    let given = str_param(p, "newName").map(str::trim).filter(|n| !n.is_empty());
+    let new = d.unique_symbol_name(&given.map_or_else(|| format!("{} copy", name.trim()), str::to_string));
     let size = natural_size(d, &name);
     let reg = d.symbol_registration(&name);
     let export = d.symbol_export_type(&name);
+    let nine = d.symbol_nine_slice(&name);
     s.edit("Duplicate Symbol", |d, _| {
         let art = d.reid(&sym.art);
         d.symbols.push(Symbol { name: new.clone(), art: Arc::new(art) });
         set_natural_size(d, &new, Some(size));
         d.set_symbol_registration(&new, reg);
         d.set_symbol_export_type(&new, export);
+        d.set_symbol_nine_slice(&new, nine);
         Ok(())
     })?;
-    Ok(json!({ "name": new, "registration": reg.0, "exportType": export.id() }))
+    Ok(json!({ "name": new, "registration": reg.0, "exportType": export.id(), "nineSlice": nine.map_or(Value::Null, SymbolNineSlice::to_value) }))
 }
 
 fn symbol_replace(s: &mut Session, p: &Value) -> Result<Value> {
@@ -1040,7 +1110,7 @@ fn symbol_adjust(s: &mut Session, p: &Value) -> Result<Value> {
     let alt = bool_or(p, "alt", false);
     let st = s.doc()?;
     let color = match p.get("color").and_then(color_value) {
-        Some(c) => c,
+        Some(c) => super::paint::new_color(s, p, c),
         None => s.paint.fill.color().unwrap_or(Color::BLACK),
     };
     let style_paint = match str_param(p, "style") {

crates/engine/src/cmd/buildcmds.rs

@@ -15,7 +15,7 @@ use std::sync::Arc;
 use serde_json::{Value, json};
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_doc::appearance::{AppearanceItem, FillLayer, LineCap, LineJoin, StrokeLayer};
-use vectorcraft_doc::{Appearance, Document, LiveShape, Node, NodeId, NodeKind, Selection, TraceView};
+use vectorcraft_doc::{Appearance, Document, GapOptions, GapSize, LiveShape, Node, NodeId, NodeKind, Selection, TraceView};
 use vectorcraft_geom::{FillRule, PathData, Point, Rect, SubPath};
 use vectorcraft_pathops as po;
 use vectorcraft_tools::builder::{
@@ -88,6 +88,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection_or_ids,
             lp_expand
         ),
+        cmd!(
+            "livePaint.gapOptions",
+            "Gap Options",
+            [],
+            None,
+            "{id?, ids?: [id…] (instead of id; default: the selected Live Paint groups), detect?: bool (Gap Detection: paint stops at gaps up to size wide), size?: \"small\" (3 pt) | \"medium\" (6 pt) | \"large\" (12 pt) | pt (custom, over 0 up to 72) (Paint Stops At), color?: #rrggbb or a layer color's name such as \"Red\" (Gap Preview Color), closeGaps?: bool (add an unpainted path across each gap up to size wide to the group's paths)} set the Gap Options of Live Paint groups (what is not given stays as it was; a group starts with detect false, small and Red) and make their faces again, keeping their paint → {ids, faces, gaps: [[x0,y0,x1,y1]…] (the gaps up to size wide that no path closes, from a loose end of a path to where it closes to; detect closes them for paint), closed (paths added)}",
+            has_selection_or_ids,
+            lp_gap_options
+        ),
         cmd!(
             "livePaint.fill",
             "Live Paint Bucket",
@@ -111,7 +120,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Live Paint Info",
             [],
             None,
-            "{group, id?: object id (default: the selection)} → {faces: [{id, fill, bounds}], edges: [{id, stroke, width}], sources}",
+            "{group, id?: object id (default: the selection)} → {faces: [{id, fill, bounds}], edges: [{id, stroke, width}], sources, gapOptions: {detect, size: \"small\"|\"medium\"|\"large\"|pt, points, color: #rrggbb} (as livePaint.gapOptions sets them), gaps: [[x0,y0,x1,y1]…] (as livePaint.gapOptions returns them)}",
             has_doc,
             lp_info
         ),
@@ -120,7 +129,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Make",
             ["Object", "Image Trace"],
             None,
-            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), enhanced?: false (the preset's enhanced version: with Auto Grouping, and with Shapes in all but High Fidelity Photo; Flat Logo has none and is traced as it is), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite (leave out white areas), ignoreColor?: \"#rrggbb\" (with ignoreWhite: the colour left out instead of white), snapCurvesToLines, shapes: false (filled outlines that are a circle, an ellipse, a rectangle or a regular polygon come out as that live shape), autoGrouping: false (each path that has others inside it is grouped with them), gradients: false (grayscale and color: an area whose colour changes evenly along one direction is one path with a linear gradient fill), fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult), ids?: [id…] (instead of id)} → {id, paths, anchors, colors}",
+            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), enhanced?: false (the preset's enhanced version: with Auto Grouping, and with Shapes in all but High Fidelity Photo; Flat Logo has none and is traced as it is), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite (leave out white areas), ignoreColor?: \"#rrggbb\" (with ignoreWhite: the colour left out instead of white), snapCurvesToLines, shapes: false (filled outlines that are a circle, an ellipse, a rectangle or a regular polygon come out as that live shape), autoGrouping: false (each path that has others inside it is grouped with them), gradients: false (grayscale and color: an area whose colour changes evenly along one direction is one path with a linear gradient fill), fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult), ids?: [id…] (instead of id)} → {id, paths, anchors, colors, warnings: [text…] (the image is over 1500 px on a side, so it traces more slowly; or it was traced scaled down)}",
             has_selection_or_ids,
             |s, p| trace_make(s, p, false)
         ),
@@ -223,7 +232,7 @@ fn fill_param(s: &Session, p: &Value, cmd: &str) -> Result<Option<Paint>> {
         Some(v @ Value::Object(o)) if o.contains_key("color") || o.contains_key("swatch") || o.contains_key("gradient") || o.contains_key("none") => {
             paint_from(s, v)
         }
-        Some(v) => color_value(v).map(|c| Some(Paint::solid(c))).ok_or_else(|| bad(cmd, format!("bad fill {v}"))),
+        Some(v) => color_value(v).map(|c| Some(Paint::solid(super::paint::new_color(s, p, c)))).ok_or_else(|| bad(cmd, format!("bad fill {v}"))),
     }
 }
 
@@ -383,10 +392,11 @@ fn source_nodes(n: &Node) -> Vec<Arc<Node>> {
     if is_live_paint(n) { b::sources(n).and_then(|g| g.children().cloned()).unwrap_or_default() } else { vec![Arc::new(n.clone())] }
 }
 
-/// Planar map children (sources group, faces, edges) for `sources`.
-fn build_children(d: &mut Document, sources: Vec<Arc<Node>>) -> Result<(Vec<Arc<Node>>, usize, usize)> {
+/// The planar map's inputs from `sources` (paths and compound paths, back → front), with the
+/// fill, stroke and stroke width of each.
+fn source_shapes(sources: &[Arc<Node>]) -> (Vec<po::Shape>, Vec<(Paint, Paint, f64)>) {
     let mut lv = vec![];
-    for n in &sources {
+    for n in sources {
         b::leaf_shapes(n, &mut lv);
     }
     let mut shapes = vec![];
@@ -400,6 +410,13 @@ fn build_children(d: &mut Document, sources: Vec<Arc<Node>>) -> Result<(Vec<Arc<
             styles.push((a.fill_paint(), a.stroke_paint(), a.stroke().map(|s| s.width).unwrap_or(1.0)));
         }
     }
+    (shapes, styles)
+}
+
+/// Planar map children (sources group, faces, edges) for `sources`; with `max_gap` (Gap
+/// Detection), paint stops at the gaps up to that wide.
+fn build_children(d: &mut Document, sources: Vec<Arc<Node>>, max_gap: Option<f64>) -> Result<(Vec<Arc<Node>>, usize, usize)> {
+    let (shapes, styles) = source_shapes(&sources);
     if shapes.is_empty() {
         return Err(EngineError::Other("Live Paint: select paths or compound paths".into()));
     }
@@ -410,7 +427,13 @@ fn build_children(d: &mut Document, sources: Vec<Arc<Node>>) -> Result<(Vec<Arc<
     src_group.visible = false;
     children.push(Arc::new(src_group));
     // Every path is an edge, open ones included; faces are the areas they enclose.
-    let (regs, edges) = po::live_paint(&shapes);
+    let (regs, edges) = match max_gap {
+        Some(gap) => {
+            let (regs, edges, _) = po::live_paint_with_gaps(&shapes, gap);
+            (regs, edges)
+        }
+        None => po::live_paint(&shapes),
+    };
     if regs.is_empty() && edges.is_empty() {
         return Err(EngineError::Other("Live Paint: these paths are too degenerate to paint".into()));
     }
@@ -433,6 +456,51 @@ fn build_children(d: &mut Document, sources: Vec<Arc<Node>>) -> Result<(Vec<Arc<
     Ok((children, nfaces, nedges))
 }
 
+/// Give the faces and edges of `g`, a Live Paint group made again from the sources of `old`, the
+/// look of `old`'s face or edge where they lie: each face takes everything but the outline (its
+/// appearance, none included, its transparency and the rest) of the old face its inside point is
+/// in, and each edge that of the old edge its middle lies on. Faces and edges where `old` had none
+/// keep the paint of their sources.
+fn repaint_from(g: &mut Node, old: &Node) {
+    /// How far an edge's middle may be from the old edge it lies on.
+    const ON_EDGE: f64 = 1e-3;
+    let Some(ch) = g.children_mut() else { return };
+    for c in ch.iter_mut() {
+        let Some(pd) = c.path_data() else { continue };
+        let was = match c.name.as_deref() {
+            Some(FACE_NAME) => po::interior_point(pd).and_then(|pt| face_at(old, pt)),
+            Some(EDGE_NAME) => pd
+                .subpaths
+                .first()
+                .filter(|sp| sp.segment_count() > 0)
+                .and_then(|sp| edge_near(old, kurbo::ParamCurve::eval(&sp.segment(0), 0.5), ON_EDGE)),
+            _ => None,
+        };
+        if let Some(was) = was {
+            let mut n = (**was).clone();
+            // Gradients fitted to the old outline keep that fit on the new one.
+            n.pin_gradients();
+            n.id = c.id;
+            n.kind = c.kind.clone();
+            n.bbox_angle = c.bbox_angle;
+            *c = Arc::new(n);
+        }
+    }
+}
+
+/// `options` as stored on a Live Paint group: none for the defaults.
+fn stored_gap_options(options: GapOptions) -> Option<Box<GapOptions>> {
+    (options != GapOptions::default()).then(|| Box::new(options))
+}
+
+/// The Gap Options of Live Paint groups merged into one, given bottom-most first: the bottom-most
+/// group's when its Gap Detection is on; else Gap Detection on with Small Gaps when another
+/// group's is on; else the bottom-most group's.
+fn merged_gap_options(groups: &[GapOptions]) -> GapOptions {
+    let Some(&bottom) = groups.first() else { return GapOptions::default() };
+    if !bottom.detect && groups.iter().any(|g| g.detect) { GapOptions { detect: true, size: GapSize::Small, ..bottom } } else { bottom }
+}
+
 /// Make a Live Paint group from `roots`; returns (group, faces, edges).
 fn make_live(d: &mut Document, sel: &mut Selection, roots: &[NodeId]) -> Result<(NodeId, usize, usize)> {
     let mut sources = vec![];
@@ -440,7 +508,7 @@ fn make_live(d: &mut Document, sel: &mut Selection, roots: &[NodeId]) -> Result<
         let n = d.node(*r).ok_or(EngineError::NoNode(*r))?;
         sources.extend(source_nodes(n));
     }
-    let (children, nf, ne) = build_children(d, sources)?;
+    let (children, nf, ne) = build_children(d, sources, None)?;
     let gid = d.alloc_id();
     let mut g = Node::group(gid, children);
     g.name = Some(LIVE_PAINT_NAME.into());
@@ -484,11 +552,15 @@ fn lp_merge(s: &mut Session, p: &Value) -> Result<Value> {
                 sources.extend(source_nodes(d.node(*r).ok_or(EngineError::NoNode(*r))?));
             }
         }
-        let (children, nf, ne) = build_children(d, sources)?;
+        // Merge applies the Gap Options' merge rules to the groups' options, bottom-most first.
+        let groups: Vec<GapOptions> = roots.iter().filter_map(|r| d.node(*r)).filter(|n| is_live_paint(n)).map(Node::gap_options).collect();
+        let options = merged_gap_options(&groups);
+        let (children, nf, ne) = build_children(d, sources, options.max_gap())?;
         let mut g = Node::group(target, children);
         g.name = old.name.clone();
         g.opacity = old.opacity;
         g.blend = old.blend;
+        g.extras_mut().live_paint_gaps = stored_gap_options(options);
         for (pt, paint) in keep_faces {
             if let Some(fid) = face_at(&g, pt).map(|f| f.id)
                 && let Some(ch) = g.children_mut()
@@ -553,7 +625,11 @@ fn lp_expand(s: &mut Session, p: &Value) -> Result<Value> {
         for g in &targets {
             let n = d.node_mut(*g).ok_or(EngineError::NoNode(*g))?;
             n.name = None;
-            n.extras_mut().trace = None;
+            {
+                let mut e = n.extras_mut();
+                e.trace = None;
+                e.live_paint_gaps = None;
+            }
             if let Some(ch) = n.children_mut() {
                 ch.retain(|c| match c.name.as_deref() {
                     Some(SOURCES_NAME) => false,
@@ -569,6 +645,81 @@ fn lp_expand(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "ids": ids_json(&targets) }))
 }
 
+/// Gaps as `[x0, y0, x1, y1]` (the loose end, then where it closes to).
+fn gaps_json(gaps: &[[Point; 2]]) -> Value {
+    json!(gaps.iter().map(|[a, b]| [a.x, a.y, b.x, b.y]).collect::<Vec<_>>())
+}
+
+/// A group's Gap Options as `livePaint.info` gives them.
+fn gap_options_json(o: GapOptions) -> Value {
+    let [r, g, b] = o.color;
+    let size = o.size.id().map_or_else(|| json!(o.size.points()), |id| json!(id));
+    json!({ "detect": o.detect, "size": size, "points": o.size.points(), "color": format!("#{r:02x}{g:02x}{b:02x}") })
+}
+
+/// The gaps up to `options`' size wide among a Live Paint group's sources.
+fn open_gaps(group: &Node, options: GapOptions) -> Vec<[Point; 2]> {
+    po::find_gaps(&source_shapes(&source_nodes(group)).0, options.size.points())
+}
+
+fn lp_gap_options(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "livePaint.gapOptions";
+    let detect = match p.get("detect").filter(|v| !v.is_null()) {
+        Some(v) => Some(v.as_bool().ok_or_else(|| bad(C, "detect must be true or false"))?),
+        None => None,
+    };
+    let size =
+        match p.get("size").filter(|v| !v.is_null()) {
+            Some(v) => Some(GapSize::parse(v).ok_or_else(|| {
+                bad(C, format!("size must be \"small\", \"medium\", \"large\" or a number of points over 0 up to {}", GapSize::MAX))
+            })?),
+            None => None,
+        };
+    let color = match p.get("color").filter(|v| !v.is_null()) {
+        Some(v) => Some(super::layer::layer_color_param(v).map_err(|e| bad(C, e))?.rgb()),
+        None => None,
+    };
+    let close = bool_or(p, "closeGaps", false);
+    let targets = live_targets(s, p)?;
+    let (faces, gaps, closed) = s.edit("Gap Options", |d, sel| {
+        let (mut faces, mut gaps, mut closed) = (0, vec![], 0);
+        let mut changed = Beside::replacing(d, &targets);
+        for g in &targets {
+            let old = d.node(*g).cloned().ok_or(EngineError::NoNode(*g))?;
+            let mut options = old.gap_options();
+            options.detect = detect.unwrap_or(options.detect);
+            options.size = size.unwrap_or(options.size);
+            options.color = color.unwrap_or(options.color);
+            let mut sources = source_nodes(&old);
+            if close {
+                // Close Gaps With Paths adds an unpainted line across each gap to the group's paths.
+                for gap in po::find_gaps(&source_shapes(&sources).0, options.size.points()) {
+                    let line = PathData::single(SubPath::polyline(&gap, false));
+                    sources.push(Arc::new(Node::path(d.alloc_id(), line, Appearance::default())));
+                    closed += 1;
+                }
+            }
+            let mut n = old.clone();
+            // The faces change only with what paint stops at, or with new paths.
+            if close || options.max_gap() != old.gap_options().max_gap() {
+                let (children, _, _) = build_children(d, sources, options.max_gap())?;
+                if let Some(ch) = n.children_mut() {
+                    *ch = children;
+                }
+                repaint_from(&mut n, &old);
+            }
+            n.extras_mut().live_paint_gaps = stored_gap_options(options);
+            faces += b::faces(&n).len();
+            gaps.extend(open_gaps(&n, options));
+            changed.put(d, *g, vec![n])?;
+        }
+        changed.finish(d)?;
+        sel.set(targets.iter().copied());
+        Ok((faces, gaps, closed))
+    })?;
+    Ok(json!({ "ids": ids_json(&targets), "faces": faces, "gaps": gaps_json(&gaps), "closed": closed }))
+}
+
 fn lp_fill(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "livePaint.fill";
     let pt = point_param(p, "point").filter(|q| finite(*q)).ok_or_else(|| bad(C, "missing point [x,y]"))?;
@@ -637,7 +788,14 @@ fn lp_info(s: &mut Session, p: &Value) -> Result<Value> {
         .map(|e| json!({ "id": e.id.0, "stroke": e.appearance.stroke_paint().label(), "width": e.appearance.stroke_width() }))
         .collect();
     let sources = b::sources(n).and_then(|g| g.children()).map(|c| c.len()).unwrap_or(0);
-    Ok(json!({ "faces": faces, "edges": edges, "sources": sources }))
+    let options = n.gap_options();
+    Ok(json!({
+        "faces": faces,
+        "edges": edges,
+        "sources": sources,
+        "gapOptions": gap_options_json(options),
+        "gaps": gaps_json(&open_gaps(n, options)),
+    }))
 }
 
 // ---------- Image Trace ----------
@@ -701,9 +859,16 @@ fn trace_library(s: &Session, params: &mut tr::TraceParams) -> Result<Vec<([u8;
     Ok(library)
 }
 
-/// The most anchor points an Image Trace may make: a photo traced at high fidelity can make
-/// millions, more than the canvas draws smoothly or a laptop has memory for, so the trace is
-/// refused with advice instead (#525).
+/// The most anchor points an Image Trace may make, a guard for memory: a trace past it is refused
+/// with advice instead (#525). A trace keeps about 90 bytes an anchor in the document (measured on
+/// code-drawn photos of 2000 × 2000 to 6000 × 4000 pixels), so 8,000,000 anchors are about
+/// 0.7 GB, with a peak of about 1 GB while tracing: a 4000 × 3000 photo at High Fidelity Photo
+/// makes about 1.9 million, and even at Paths 100, Noise 1 and every tone about 7.9 million. On the
+/// web, where a page has at most 4 GB of memory, the limit stays at 2,000,000.
+#[cfg(not(target_arch = "wasm32"))]
+pub const MAX_TRACE_ANCHORS: usize = 8_000_000;
+/// The most anchor points an Image Trace may make on the web (see the native limit).
+#[cfg(target_arch = "wasm32")]
 pub const MAX_TRACE_ANCHORS: usize = 2_000_000;
 
 /// The live shape for a shape the tracer found (in the image's pixels), placed in the document by `xf`.
@@ -817,6 +982,7 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     let raster = tr::Raster::decode_to_fit(&blob.bytes).map_err(|e| EngineError::Other(e.to_string()))?;
     let library = trace_library(s, &mut params)?;
     let res = tr::trace_within(&raster, &params, MAX_TRACE_ANCHORS).map_err(|e| EngineError::Other(e.to_string()))?;
+    let warnings = trace_warnings((img.width, img.height), (raster.width, raster.height));
     // Pixel space of the decoded raster → the image object's pixel space → document.
     let sx = img.width.max(1) as f64 / raster.width.max(1) as f64;
     let sy = img.height.max(1) as f64 / raster.height.max(1) as f64;
@@ -886,7 +1052,34 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
         sel.set([gid]);
         Ok(gid)
     })?;
-    Ok(json!({ "id": id.0, "paths": npaths, "anchors": anchors, "colors": colors }))
+    Ok(json!({ "id": id.0, "paths": npaths, "anchors": anchors, "colors": colors, "warnings": warnings }))
+}
+
+/// Images larger than this on a side are traced, but more slowly: the trace says so.
+pub const LARGE_TRACE_SIDE: u32 = 1500;
+
+/// What a trace of an image of `size` pixels, traced at `traced` pixels, tells the user: that a
+/// large image takes longer (the public documentation's warning for images over 1500 px), and that
+/// one over the tracer's [`tr::MAX_PIXELS`] was traced scaled down.
+pub(crate) fn trace_warnings(size: (u32, u32), traced: (u32, u32)) -> Vec<String> {
+    let mut out = vec![];
+    if size.0.max(size.1) > LARGE_TRACE_SIDE {
+        out.push(format!(
+            "The image is {} × {} pixels, more than {LARGE_TRACE_SIDE} on a side: it is traced, but more slowly. A lower-fidelity preset or a smaller copy of the image traces faster.",
+            size.0, size.1
+        ));
+    }
+    if u64::from(traced.0) * u64::from(traced.1) < u64::from(size.0) * u64::from(size.1) {
+        out.push(format!(
+            "The image was traced at {} × {} pixels, scaled down from {} × {} ({} megapixels at most).",
+            traced.0,
+            traced.1,
+            size.0,
+            size.1,
+            tr::MAX_PIXELS >> 20
+        ));
+    }
+    out
 }
 
 fn trace_targets(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
@@ -955,3 +1148,21 @@ fn trace_expand(s: &mut Session, p: &Value) -> Result<Value> {
     })?;
     Ok(json!({ "ids": ids_json(&targets) }))
 }
+
+#[cfg(test)]
+mod trace_limit_tests {
+    use super::{MAX_TRACE_ANCHORS, trace_warnings};
+
+    #[test]
+    fn trace_warnings_name_a_large_or_scaled_down_image() {
+        assert!(trace_warnings((1500, 1500), (1500, 1500)).is_empty());
+        assert_eq!(trace_warnings((1501, 10), (1501, 10)).len(), 1);
+        let w = trace_warnings((16000, 12000), (9459, 7094));
+        assert_eq!(w.len(), 2, "{w:?}");
+        assert!(w[0].contains("16000 × 12000") && w[1].contains("9459 × 7094") && w[1].contains("64 megapixels"), "{w:?}");
+    }
+
+    // A 4000 × 3000 photo at High Fidelity Photo makes about 1.9 million anchors, which must fit;
+    // the limit still guards memory (about 90 bytes an anchor). Checked when the tests build.
+    const _: () = assert!(MAX_TRACE_ANCHORS >= 2_000_000 && MAX_TRACE_ANCHORS <= 16_000_000);
+}

crates/engine/src/cmd/clipboard.rs

@@ -80,22 +80,22 @@ pub struct Clipboard {
     pub para_styles: Vec<TextStyleDef>,
     /// Brushes the objects' strokes use.
     pub brushes: Vec<Brush>,
-    /// The artboard the objects were copied from (none when they lie on no artboard): Paste on All
-    /// Artboards keeps their offset to it.
+    /// The artboard the objects were copied from (none when they lie on no artboard; the first of
+    /// [`Self::artboards`] when there are any): Paste on All Artboards keeps their offset to it.
     pub source_artboard: Option<Rect>,
     /// Per object: the name of the layer it was copied from (Paste Remembers Layers).
     pub source_layers: Vec<Option<String>>,
     /// The open document the objects came from ([`DocState::uid`]): pasting back into it uses its
     /// own resources as they are now.
     pub source_doc: Option<u64>,
-    /// An artboard copied with the Artboard tool (`artboard.copy`); `nodes` are then its art. Pasting
-    /// adds a copy of it with the art.
-    pub artboard: Option<vectorcraft_doc::Artboard>,
+    /// The artboards copied with the Artboard tool (`artboard.copy`); `nodes` are then their art.
+    /// Pasting adds a copy of each with the art.
+    pub artboards: Vec<vectorcraft_doc::Artboard>,
 }
 
 impl Clipboard {
     pub fn is_empty(&self) -> bool {
-        self.nodes.is_empty() && self.artboard.is_none()
+        self.nodes.is_empty() && self.artboards.is_empty()
     }
 
     /// Objects `roots` of `st`'s document with their resources, source artboard and layers.
@@ -109,7 +109,9 @@ impl Clipboard {
             // The nearest enclosing layer (or sublayer).
             source_layers.push(anc.iter().rev().skip(1).find_map(|a| d.node(*a).filter(|l| l.is_layer())).and_then(|l| l.name.clone()));
         }
-        let bounds = nodes.iter().filter_map(Node::visual_bounds).reduce(|a, b| a.union(b));
+        // Symbol instances are measured by their art.
+        let symbols = d.symbol_boxes();
+        let bounds = nodes.iter().filter_map(|n| n.visual_bounds_with(&symbols)).reduce(|a, b| a.union(b));
         // Art on no artboard has no source artboard: in-place pastes put it back where it was (#1924).
         let board = bounds.and_then(|b| d.artboard_at(b.center()));
         Self {
@@ -127,9 +129,13 @@ impl Clipboard {
         Self::gather(src, nodes)
     }
 
-    /// Union of the objects' visual bounds.
+    /// Union of the objects' visual bounds, with symbol instances measured by the art of the
+    /// symbols the clipboard holds.
     pub fn bounds(&self) -> Option<Rect> {
-        self.nodes.iter().filter_map(Node::visual_bounds).reduce(|a, b| a.union(b))
+        let mut d = Document::new(100.0, 100.0);
+        d.symbols = self.symbols.clone();
+        let symbols = d.symbol_boxes();
+        self.nodes.iter().filter_map(|n| n.visual_bounds_with(&symbols)).reduce(|a, b| a.union(b))
     }
 
     /// The swatch name conflicts pasting into `st` raises, as (pasted, document) swatches: none

crates/engine/src/cmd/clipboard/flavours.rs

@@ -81,6 +81,7 @@ pub fn file_flavour(name: &str, head: &[u8], mimes: &[&str]) -> Option<&'static
         // reads SVGZ data.
         "svgz" if unpacks_to_svg(head) => (SVG, SVG),
         "pdf" => (PDF, PDF),
+        "ps" => (EPS, EPS),
         "eps" => (EPS, EPS),
         "ai" | "ait" if head.starts_with(b"%PDF") => (PDF, PDF),
         "ai" | "ait" if vectorcraft_pdf::is_postscript(head) => (EPS, EPS),
@@ -129,7 +130,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Clipboard as PNG",
             [],
             None,
-            "{scale?: 1 (pixels per point, up to 64)} → {dataBase64, width, height (px)} the copied objects cropped to their visual bounds, transparent around them (dataBase64 null when the clipboard is empty)",
+            "{scale?: 1 (pixels per point, up to 64)} → {dataBase64, width, height (px), warnings} the copied objects cropped to their visual bounds, transparent around them (dataBase64 null when the clipboard is empty); warnings as for document.export (an image that couldn't be decoded, type in the fallback font or that doesn't fit its frame)",
             always,
             export_png
         ),
@@ -138,7 +139,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Clipboard as PDF",
             [],
             None,
-            "{} → {dataBase64} a one-page PDF of the copied objects, the page their visual bounds (null when the clipboard is empty)",
+            "{} → {dataBase64, warnings} a one-page PDF of the copied objects, the page their visual bounds (dataBase64 null when the clipboard is empty); warnings as for document.export",
             always,
             export_pdf
         ),
@@ -217,6 +218,9 @@ fn type_only(n: &Node) -> bool {
     }
 }
 
+/// A PNG of the copied objects: (bytes, width, height in pixels, the encoder's warnings).
+pub type Png = (Vec<u8>, u32, u32, Vec<String>);
+
 impl Clipboard {
     /// The copied type objects' text, one object per line (`None` unless it holds type only).
     pub fn text(&self) -> Option<String> {
@@ -242,21 +246,21 @@ impl Clipboard {
         Some((fileio::with_single_artboard(self.to_document(), b, "Clipboard"), b))
     }
 
-    /// A PNG of the objects at `scale` pixels per point → (bytes, width, height); `None` when
-    /// there are none.
-    pub fn png(&self, scale: f64) -> Result<Option<(Vec<u8>, u32, u32)>> {
+    /// A PNG of the objects at `scale` pixels per point → (bytes, width, height, the warnings
+    /// [`fileio::encode_with_warnings`] gives); `None` when there are none.
+    pub fn png(&self, scale: f64) -> Result<Option<Png>> {
         const C: &str = "clipboard.exportPng";
         let Some((doc, b)) = self.cropped() else { return Ok(None) };
         let (w, h) = vectorcraft_render::raster_size(b, scale).map_err(|e| bad(C, e))?;
-        let png = fileio::encode(&doc, "png", &json!({ "scale": scale, "background": "transparent" }))?;
-        Ok(Some((png, w, h)))
+        let (png, warnings) = fileio::encode_with_warnings(&doc, "png", &json!({ "scale": scale, "background": "transparent" }))?;
+        Ok(Some((png, w, h, warnings)))
     }
 
-    /// A one-page PDF of the objects (without the native document inside); `None` when there are
-    /// none.
-    pub fn pdf(&self) -> Result<Option<Vec<u8>>> {
+    /// A one-page PDF of the objects (without the native document inside) → (bytes, the encoder's
+    /// warnings); `None` when there are none.
+    pub fn pdf(&self) -> Result<Option<(Vec<u8>, Vec<String>)>> {
         let Some((doc, _)) = self.cropped() else { return Ok(None) };
-        fileio::encode(&doc, "pdf", &json!({ "preserveEditing": false })).map(Some)
+        fileio::encode_with_warnings(&doc, "pdf", &json!({ "preserveEditing": false })).map(Some)
     }
 
     /// The MIME types of [`Self::flavours`], without making them.
@@ -274,23 +278,38 @@ impl Clipboard {
     /// (`pdf`) as given (see `clipboard.flavours`). A [`Flavour`] that can't be made (art too large
     /// to render) is left out; the PNG is scaled down to at most [`COPY_PNG_SIDE`] pixels a side.
     pub fn flavours(&self, svg: bool, pdf: bool) -> Vec<Flavour> {
+        self.flavours_with_warnings(svg, pdf).0
+    }
+
+    /// [`Self::flavours`], with the warnings of the PDF and PNG encoders, each once (an image that
+    /// couldn't be decoded, type in the fallback font).
+    pub fn flavours_with_warnings(&self, svg: bool, pdf: bool) -> (Vec<Flavour>, Vec<String>) {
         let types = self.flavour_types(svg, pdf);
         let svg = types.contains(&SVG).then(|| self.svg()).flatten();
         let mut out = vec![];
+        let mut warnings: Vec<String> = vec![];
+        let mut keep = |(bytes, notes): (Vec<u8>, Vec<String>)| {
+            for w in notes {
+                if !warnings.contains(&w) {
+                    warnings.push(w);
+                }
+            }
+            bytes
+        };
         for mime in types {
             let data = match mime {
                 TEXT => self.text().or_else(|| svg.clone()).map(String::into_bytes),
                 SVG => svg.clone().map(String::into_bytes),
-                PDF => self.pdf().inspect_err(|e| log::warn!("clipboard PDF: {e}")).ok().flatten(),
+                PDF => self.pdf().inspect_err(|e| log::warn!("clipboard PDF: {e}")).ok().flatten().map(&mut keep),
                 _ => {
                     let side = self.bounds().map_or(1.0, |b| b.width().max(b.height()));
                     let scale = (COPY_PNG_SIDE / side).clamp(0.01, 1.0);
-                    self.png(scale).inspect_err(|e| log::warn!("clipboard PNG: {e}")).ok().flatten().map(|(png, ..)| png)
+                    self.png(scale).inspect_err(|e| log::warn!("clipboard PNG: {e}")).ok().flatten().map(|(png, _, _, notes)| keep((png, notes)))
                 }
             };
             out.extend(data.map(|data| Flavour { mime, data }));
         }
-        out
+        (out, warnings)
     }
 }
 
@@ -301,15 +320,15 @@ impl Session {
         self.clipboard.text()
     }
 
-    /// A PNG of the copied objects at `scale` pixels per point → (bytes, width, height); `None`
-    /// when the clipboard is empty.
-    pub fn clipboard_png(&self, scale: f64) -> Result<Option<(Vec<u8>, u32, u32)>> {
+    /// A PNG of the copied objects at `scale` pixels per point → (bytes, width, height, the
+    /// encoder's warnings); `None` when the clipboard is empty.
+    pub fn clipboard_png(&self, scale: f64) -> Result<Option<Png>> {
         self.clipboard.png(scale)
     }
 
-    /// A one-page PDF of the copied objects (without the native document inside); `None` when the
-    /// clipboard is empty.
-    pub fn clipboard_pdf(&self) -> Result<Option<Vec<u8>>> {
+    /// A one-page PDF of the copied objects (without the native document inside) → (bytes, the
+    /// encoder's warnings); `None` when the clipboard is empty.
+    pub fn clipboard_pdf(&self) -> Result<Option<(Vec<u8>, Vec<String>)>> {
         self.clipboard.pdf()
     }
 
@@ -355,13 +374,18 @@ fn export_png(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad("clipboard.exportPng", "scale must be a number above 0, at most 64"));
     }
     Ok(match s.clipboard_png(scale)? {
-        Some((png, w, h)) => json!({ "dataBase64": vectorcraft_format::base64_encode(&png), "width": w, "height": h }),
+        Some((png, w, h, warnings)) => {
+            json!({ "dataBase64": vectorcraft_format::base64_encode(&png), "width": w, "height": h, "warnings": warnings })
+        }
         None => json!({ "dataBase64": null }),
     })
 }
 
 fn export_pdf(s: &mut Session, _: &Value) -> Result<Value> {
-    Ok(json!({ "dataBase64": s.clipboard_pdf()?.map(|b| vectorcraft_format::base64_encode(&b)) }))
+    Ok(match s.clipboard_pdf()? {
+        Some((pdf, warnings)) => json!({ "dataBase64": vectorcraft_format::base64_encode(&pdf), "warnings": warnings }),
+        None => json!({ "dataBase64": null }),
+    })
 }
 
 fn export_text(s: &mut Session, _: &Value) -> Result<Value> {
@@ -418,7 +442,8 @@ fn import_emf(s: &mut Session, p: &Value) -> Result<Value> {
 fn import_eps(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "clipboard.importEps";
     let bytes = data_param(p, C)?;
-    if !vectorcraft_pdf::is_postscript(&bytes) {
+    // Programs whose header is only `%!` are read too, as they are when a `.ps` or `.eps` file opens.
+    if !bytes.starts_with(b"%!") && !vectorcraft_pdf::is_postscript(&bytes) {
         return Err(bad(C, "the data isn't an EPS or PostScript picture"));
     }
     import_picture(s, p, C, "Clipboard.eps", &bytes)

crates/engine/src/cmd/colormgmt.rs

@@ -39,10 +39,19 @@ pub fn specs() -> Vec<CommandSpec> {
             "Load Color Profile…",
             [],
             None,
-            "{path: .icc/.icm file} register an ICC profile until the app quits or the `run` ends (native only; it isn't remembered, so load it again in each run that names it) → {name, kind}",
+            "{path: .icc/.icm file of at most 32 MB} register an ICC profile (native only). The desktop app and vectorcraft-cli keep a copy of the file in the `Color Profiles` folder next to the preferences and register it again at every start (not with VECTORCRAFT_NO_PREFS, or in a confined `mcp --automation-*-root` server: there it lasts until the process ends) → {name, kind, remembered: whether a copy was kept}",
             always,
             load_profile
         ),
+        cmd!(
+            "color.removeProfile",
+            "Remove Color Profile…",
+            [],
+            None,
+            "{name} forget a profile color.loadProfile loaded, and the copy kept of it (built-in profiles and the working spaces stay) → {removed: name}",
+            always,
+            remove_profile
+        ),
         cmd!(
             "edit.assignProfile",
             "Assign Profile…",
@@ -178,12 +187,35 @@ fn color_settings(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 #[cfg(not(target_arch = "wasm32"))]
-fn load_profile(_: &mut Session, p: &Value) -> Result<Value> {
+fn load_profile(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "color.loadProfile";
     let path = str_param(p, "path").ok_or_else(|| bad(C, "missing `path`"))?;
     crate::file_access::check_read(path).map_err(EngineError::Other)?;
-    let info = cms::load_icc_file(std::path::Path::new(path)).map_err(|e| bad(C, e.to_string()))?;
-    Ok(json!({"name": info.name, "kind": info.kind}))
+    let bytes = crate::store::read_capped(std::path::Path::new(path), crate::store::MAX_PROFILE_FILE).map_err(|e| bad(C, format!("{path}: {e}")))?;
+    let info = cms::register_icc(&bytes, None).map_err(|e| bad(C, e.to_string()))?;
+    // The bytes are kept, not the path: the file may move or go away.
+    let remembered = s.store_profile(&info.name, &bytes);
+    Ok(json!({"name": info.name, "kind": info.kind, "remembered": remembered}))
+}
+
+/// Forget a profile `color.loadProfile` loaded, and the copy that is kept of it.
+fn remove_profile(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "color.removeProfile";
+    let name = str_param(p, "name").ok_or_else(|| bad(C, "missing `name`"))?;
+    let info = cms::profiles().into_iter().find(|i| i.name == name).ok_or_else(|| bad(C, format!("no profile named `{name}`")))?;
+    if info.builtin {
+        return Err(bad(C, format!("`{name}` is a built-in profile and stays")));
+    }
+    let working = cms::active_settings();
+    if working.rgb == name || working.cmyk == name {
+        return Err(bad(C, format!("`{name}` is a working space: choose another with edit.colorSettings first")));
+    }
+    if !cms::unregister_icc(&info.name) {
+        return Err(bad(C, format!("no profile named `{name}`")));
+    }
+    s.unstore_profile(&info.name);
+    touch_all(s);
+    Ok(json!({"removed": info.name}))
 }
 
 #[cfg(target_arch = "wasm32")]

crates/engine/src/cmd/colortheme.rs

@@ -142,7 +142,8 @@ fn add_to_swatches(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "colorTheme.addToSwatches";
     let name = str_param(p, "name").ok_or_else(|| bad(C, "missing `name`"))?;
     let t = &s.prefs.color_themes[find(s, name, C)?];
-    let params = json!({ "name": t.name, "colors": t.colors.iter().map(color_json).collect::<Vec<_>>() });
+    // The theme's colors keep their model, in a CMYK document too.
+    let params = json!({ "name": t.name, "colors": t.colors.iter().map(color_json).collect::<Vec<_>>(), "keepModel": true });
     let r = s.execute("swatch.newGroup", &params)?;
     Ok(json!({ "name": r["name"], "swatches": r["swatches"] }))
 }

crates/engine/src/cmd/create.rs

@@ -74,7 +74,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Create Text",
             [],
             None,
-            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height, fit?: none|autoHeight|shrinkText, fitMinPercent?}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), justify?: \"auto\" (default: the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\" (point type: aligned on x, so \"center\" centres each line on the point and \"right\" ends it there; text.setStyle changes it later), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id, overflow?: [id] (area type whose text doesn't fit its frame: the lines past it aren't drawn; left out when it fits)}; new area type gets Auto Size (fit autoHeight) when the autoSizeAreaType preference is on",
+            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, keepModel?: bool (as paint.setFill), area?: {width, height, fit?: none|autoHeight|shrinkText, fitMinPercent?}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), justify?: \"auto\" (default: the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\" (point type: aligned on x, so \"center\" centres each line on the point and \"right\" ends it there; text.setStyle changes it later), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id, bounds: {x, y, width, height} (the new type's box as document.inspect reports it, after justify), overflow?: [id] (area type whose text doesn't fit its frame: the lines past it aren't drawn; left out when it fits)}; new area type gets Auto Size (fit autoHeight) when the autoSizeAreaType preference is on",
             has_doc,
             text_create
         ),
@@ -512,6 +512,7 @@ fn text_create(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let made = add_node(s, "Type", NodeKind::Text(Box::new(t)), Appearance::default(), None)?;
     let id = made.get("id").and_then(Value::as_u64).map(NodeId);
+    let made = super::typecmd::with_bounds(s, id, made);
     Ok(super::typecmd::with_overflow(s, id.as_slice(), made))
 }
 
@@ -572,8 +573,9 @@ pub(crate) fn new_area_fit(s: &Session, p: &Value, c: &str) -> Result<vectorcraf
     Ok(super::typecmd::fit_param(p, default, c)?.unwrap_or(default))
 }
 
-/// The character style new type gets: `size`, `font`, `style` and `color` from `p`, else the
-/// defaults, filled with the current fill unless that is None or white (black then).
+/// The character style new type gets: `size`, `font`, `style` and `color` from `p` (an RGB
+/// `color` in a CMYK document as [`super::paint::new_color`] stores it), else the defaults,
+/// filled with the current fill unless that is None or white (black then).
 pub(crate) fn new_type_style(s: &Session, p: &Value) -> CharStyle {
     let mut style = CharStyle::default();
     if let Some(sz) = p.get("size").and_then(Value::as_f64) {
@@ -586,7 +588,7 @@ pub(crate) fn new_type_style(s: &Session, p: &Value) -> CharStyle {
         style.font_style = f.to_string();
     }
     style.fill = match p.get("color").and_then(color_value) {
-        Some(c) => vectorcraft_color::Paint::solid(c),
+        Some(c) => vectorcraft_color::Paint::solid(super::paint::new_color(s, p, c)),
         None if !s.paint.fill.is_none() && s.paint.fill != vectorcraft_color::Paint::solid(vectorcraft_color::Color::WHITE) => s.paint.fill.clone(),
         None => vectorcraft_color::Paint::solid(vectorcraft_color::Color::BLACK),
     };

crates/engine/src/cmd/css.rs

@@ -7,7 +7,7 @@ use serde_json::{Value, json};
 use vectorcraft_doc::NodeId;
 use vectorcraft_svg::{CssOptions, CssSheet, css_rules};
 
-use super::fileio::{default_name, encode, isolated, write_file};
+use super::fileio::{default_name, encode_with_warnings, isolated, write_file};
 use super::*;
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -27,7 +27,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export CSS",
             [],
             None,
-            "{path?, scope?: selection|all (default selection; ids? picks the objects), …options as css.selection, id?: object id (default: the selection)} write the CSS (css.selection, or css.generate for all) to path and, with rasterize, each picture its rules refer to next to it (PNG of the object's visual bounds, 1 px per point) → {path, bytes, rules: n, images: [path…], warnings}; no path → {data: the CSS, name: <document>.css, rules, images: [{name, dataBase64}], warnings}",
+            "{path?, scope?: selection|all (default selection; ids? picks the objects), …options as css.selection, id?: object id (default: the selection)} write the CSS (css.selection, or css.generate for all) to path and, with rasterize, each picture its rules refer to next to it (PNG of the object's visual bounds, 1 px per point) → {path, bytes, rules: n, images: [path…], warnings}; no path → {data: the CSS, name: <document>.css, rules, images: [{name, dataBase64}], warnings}; warnings are css.selection's and the pictures' as document.export gives them (an image that couldn't be decoded, type in the fallback font or that doesn't fit its frame), each once",
             has_doc,
             export
         ),
@@ -100,12 +100,19 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let css = format!("{}\n", sheet.text());
     let doc = &s.doc()?.doc;
-    // The pictures of rasterized art.
+    // Encode the pictures of rasterized art, and add each of their warnings once.
     let mut images = Vec::new();
+    let mut warnings = sheet.warnings.clone();
     for r in &sheet.rules {
         let Some(name) = &r.image else { continue };
         let (d, _) = isolated(doc, &[r.id], name).ok_or_else(|| bad(C, format!("{} paints nothing to rasterize", r.selector)))?;
-        images.push((name, encode(&d, "png", &json!({}))?));
+        let (png, notes) = encode_with_warnings(&d, "png", &json!({}))?;
+        images.push((name, png));
+        for w in notes {
+            if !warnings.contains(&w) {
+                warnings.push(w);
+            }
+        }
     }
     let n = sheet.rules.len();
     match str_param(p, "path") {
@@ -118,12 +125,12 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
                 write_file(&at, bytes)?;
                 written.push(at);
             }
-            Ok(json!({ "path": path, "bytes": css.len(), "rules": n, "images": written, "warnings": sheet.warnings }))
+            Ok(json!({ "path": path, "bytes": css.len(), "rules": n, "images": written, "warnings": warnings }))
         }
         None => {
             let images: Vec<Value> =
                 images.iter().map(|(name, bytes)| json!({ "name": name, "dataBase64": vectorcraft_format::base64_encode(bytes) })).collect();
-            Ok(json!({ "data": css, "name": default_name(doc, "css"), "rules": n, "images": images, "warnings": sheet.warnings }))
+            Ok(json!({ "data": css, "name": default_name(doc, "css"), "rules": n, "images": images, "warnings": warnings }))
         }
     }
 }

crates/engine/src/cmd/distortcmds.rs

@@ -746,13 +746,9 @@ fn puppet_warp(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 /// Forget the Puppet Warp pins: not an undo step, and a saved document stays saved (pins are
-/// never saved).
+/// never saved, [`crate::DocState::change_unsaved`]).
 pub(crate) fn drop_puppet_pins(st: &mut crate::DocState) {
-    let clean = !st.is_dirty();
-    Arc::make_mut(&mut st.doc).puppet = None;
-    if clean {
-        st.mark_saved();
-    }
+    st.change_unsaved(|d| Arc::make_mut(d).puppet = None);
 }
 
 fn puppet_pins(s: &mut Session, p: &Value) -> Result<Value> {
@@ -1335,7 +1331,8 @@ fn edit_text(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 /// Edit Text ends (isolation mode on `id` exits): the type is projected again, in the document and
-/// in every undo state (the flat view is never an undo step of its own).
+/// in every undo state (the flat view is never an undo step of its own, and never saved: a saved
+/// state stays saved, [`crate::DocState::change_unsaved`]).
 pub(crate) fn finish_edit_text(st: &mut crate::DocState, id: NodeId) {
     let clear = |doc: &mut Arc<Document>| {
         // Undo steps keep no lookup cache: look without building one, and drop the one an edit
@@ -1346,14 +1343,14 @@ pub(crate) fn finish_edit_text(st: &mut crate::DocState, id: NodeId) {
             p.editing = false;
         }
     };
-    let saved = Arc::ptr_eq(&st.doc, &st.saved_doc);
-    clear(&mut st.doc);
-    if saved {
-        st.saved_doc = st.doc.clone();
-    }
+    st.change_unsaved(clear);
     for e in st.history.undo.iter_mut().chain(st.history.redo.iter_mut()) {
+        let saved = Arc::ptr_eq(&e.doc, &st.saved_doc);
         clear(&mut e.doc);
         e.doc.drop_lookup_cache();
+        if saved {
+            st.saved_doc = e.doc.clone();
+        }
     }
     if let Some(it) = &mut st.interaction {
         clear(&mut it.doc);

crates/engine/src/cmd/docmenu.rs

@@ -153,7 +153,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Lock Guides",
             ["View", "Guides"],
             Some("Cmd+Alt+;"),
-            "{locked?: bool} toggle (or set) the session's guide lock → {locked}",
+            "{locked?: bool} toggle (or set) the session's guide lock; locking deselects the ruler guides and guide paths in every open document → {locked}",
             has_doc,
             lock_guides
         ),
@@ -601,12 +601,20 @@ fn release_guides(s: &mut Session, p: &Value) -> Result<Value> {
 fn lock_guides(s: &mut Session, p: &Value) -> Result<Value> {
     let v = p.get("locked").and_then(Value::as_bool).unwrap_or(!s.menu.guides_locked);
     s.menu.guides_locked = v;
-    // Locked guides can't stay selected, ruler guides or guide paths ([`Session::select`] lets
-    // those go).
+    // Locked guides can't stay selected, ruler guides or guide paths, in any open document
+    // ([`Session::select`] lets those go in the active one).
     let st = s.doc()?;
     if v && (!st.selection.guides.is_empty() || st.selection.objects.iter().any(|id| crate::is_guide_path(&st.doc, *id))) {
         s.select(|_, sel| sel.guides.clear())?;
     }
+    if v {
+        let active = s.active;
+        for (i, st) in s.docs.iter_mut().enumerate() {
+            if Some(i) != active && crate::deselect_guides(&st.doc, &mut st.selection) {
+                st.revision += 1;
+            }
+        }
+    }
     Ok(json!({ "locked": v }))
 }
 

crates/engine/src/cmd/docsetup.rs

@@ -121,7 +121,7 @@ fn apply(s: &mut DocSetup, units: &mut vectorcraft_doc::Unit, k: &str, v: &Value
         "typographersQuotes" => s.typographers_quotes = flag(k, v)?,
         "superscript" => s.superscript = script_param(k, v, s.superscript)?,
         "subscript" => s.subscript = script_param(k, v, s.subscript)?,
-        "smallCapsSize" => s.small_caps_size = percent(k, v, 1.0, 200.0)?,
+        "smallCapsSize" => s.small_caps_size = percent(k, v, 1.0, vectorcraft_doc::setup::MAX_SMALL_CAPS)?,
         "exportText" => s.export_text = v.as_str().and_then(ExportText::parse).ok_or_else(|| bad(C, "exportText must be editable or appearance"))?,
         "backgroundContents" => s.background = background_param(v, C)?,
         // Read-only values `document.setup` reports.
@@ -223,8 +223,8 @@ fn script_param(k: &str, v: &Value, mut m: ScriptMetrics) -> Result<ScriptMetric
     let o = v.as_object().ok_or_else(|| bad(C, format!("{k} must be {{size?, position?}}")))?;
     for (key, x) in o {
         match key.as_str() {
-            "size" => m.size = percent(&format!("{k}.size"), x, 1.0, 500.0)?,
-            "position" => m.position = percent(&format!("{k}.position"), x, -500.0, 500.0)?,
+            "size" => m.size = percent(&format!("{k}.size"), x, 1.0, vectorcraft_doc::setup::MAX_SCRIPT)?,
+            "position" => m.position = percent(&format!("{k}.position"), x, -vectorcraft_doc::setup::MAX_SCRIPT, vectorcraft_doc::setup::MAX_SCRIPT)?,
             _ => return Err(bad(C, format!("unknown {k} key `{key}` (size, position)"))),
         }
     }
@@ -251,7 +251,7 @@ pub(crate) fn script_params(p: &Value, setup: &DocSetup, cmd: &str) -> Result<(O
 }
 
 /// A superscript or subscript in `setup`'s proportions.
-fn position_in(setup: &DocSetup, p: CharPosition) -> CharPosition {
+pub(crate) fn position_in(setup: &DocSetup, p: CharPosition) -> CharPosition {
     match p {
         CharPosition::Normal => CharPosition::Normal,
         CharPosition::Superscript(_) => CharPosition::Superscript(setup.superscript),

crates/engine/src/cmd/draw2.rs

@@ -26,7 +26,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Pencil",
             [],
             None,
-            "{points: [[x,y]…] or [[x,y,pressure]…] (pen pressure 0..1: the stroke keeps it, for Calligraphic brushes with Pressure variation; a point without one presses fully), fidelity?: pt (1.5), closed?, style?: \"pencil\"|\"brush\", fill?: bool, keepSelected?: bool (true: the drawn or continued path is selected; false: it is not, and the rest of the selection stays), extend?: {id, end: \"start\"|\"end\"}} fit a freehand stroke → {id}",
+            "{points: [[x,y]…] or [[x,y,pressure]…] (pen pressure 0..1: the stroke keeps it, for Calligraphic brushes with Pressure variation; a point without one presses fully), fidelity?: pt (1.5), closed?, style?: \"pencil\"|\"brush\", fill?: bool, keepSelected?: bool (true: the drawn or continued path is selected; false: it is not, and the rest of the selection stays), extend?: {id, end: \"start\"|\"end\"}, redraw?: {id, within?: pt (12)}} fit a freehand stroke → {id}. extend continues the path from that end; redraw (Edit Selected Paths) replaces the section of the path between where the stroke starts and ends, each within `within` of one subpath (the shorter way round a closed one), and draws a new path when the stroke doesn't end on it",
             has_doc,
             freehand
         ),
@@ -53,7 +53,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Delete Anchor Point",
             [],
             None,
-            "{id, subpath, anchor} remove one anchor, re-fitting the curve",
+            "{id, subpath?, anchor} remove one anchor, re-fitting the curve",
             has_doc,
             remove_anchor
         ),
@@ -71,7 +71,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Convert Anchor Point",
             [],
             None,
-            "{id, subpath, anchor, to: \"corner\"|\"smooth\", x?, y?} (smooth with x/y: out handle there, in handle mirrored; without: as the Curvature tool curves a point, along the circle through it and its neighbours, or at an open end one handle into the curve)",
+            "{id, subpath?, anchor, to: \"corner\"|\"smooth\", x?, y?} (smooth with x/y: out handle there, in handle mirrored; without: as the Curvature tool curves a point, along the circle through it and its neighbours, or at an open end one handle into the curve)",
             has_doc,
             convert_anchor
         ),
@@ -80,7 +80,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reshape Segment",
             [],
             None,
-            "{id, subpath, segment, t, dx, dy} bend a segment so the point at t moves by (dx, dy)",
+            "{id, subpath?, segment, t, dx, dy, perpendicular?: bool} bend a segment so the point at t moves by (dx, dy); with perpendicular (Shift), both handles stand at right angles to the line between its anchors at one length, and the point at t lies as far from that line as the moved point does",
             has_doc,
             reshape_segment
         ),
@@ -89,7 +89,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Split Path",
             [],
             None,
-            "{id, subpath, segment, t} or {id, subpath, anchor}: closed paths open there, open paths become two → {ids}",
+            "{id, subpath?, segment, t} or {id, subpath?, anchor}: closed paths open there, open paths become two → {ids}",
             has_doc,
             split
         ),
@@ -201,10 +201,29 @@ fn subpath_len(sp: &SubPath) -> f64 {
     PathData::single(sp.clone()).to_bezpath().segments().map(|s| s.arclen(0.01)).sum()
 }
 
+/// The bound, in points, on the length of a `path.reshapeSegment` delta and on the x and y of a
+/// point given to `path.convertAnchor` or `path.freehand`. The blend spine commands set the same
+/// bound (`object.blend.spine.reshapeSegment`, `object.blend.spine.moveAnchor`).
+const MAX_INPUT: f64 = 1e9;
+
+/// Whether `q` is finite and its x and y are each smaller than [`MAX_INPUT`] in size.
+fn within_input_bound(q: Point) -> bool {
+    q.x.is_finite() && q.y.is_finite() && q.x.abs() < MAX_INPUT && q.y.abs() < MAX_INPUT
+}
+
 fn usize_req(p: &Value, key: &str, cmd: &str) -> Result<usize> {
     p.get(key).and_then(Value::as_u64).map(|v| v as usize).ok_or_else(|| bad(cmd, format!("missing integer `{key}`")))
 }
 
+/// The whole number of 0 or more that `key` holds, or `None` when `key` is absent or null. Any other
+/// value is [`usize_req`]'s error.
+pub(super) fn usize_opt(p: &Value, key: &str, cmd: &str) -> Result<Option<usize>> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(_) => usize_req(p, key, cmd).map(Some),
+    }
+}
+
 fn path_mut(d: &mut Document, id: NodeId) -> Result<&mut PathData> {
     let n = d.node_mut(id).ok_or(EngineError::NoNode(id))?;
     match &mut n.kind {
@@ -538,9 +557,93 @@ fn fit_freehand(pts: &[Point], tol: f64, closed: bool) -> SubPath {
     fitted.subpaths.into_iter().next().filter(|s| s.anchors.len() >= 2).unwrap_or(sp)
 }
 
+/// Pencil's Edit Selected Paths in the middle of a path: a stroke from one point of a subpath of
+/// `pd` to another, each within `within` of it, replaces the section between them (the shorter
+/// way round a closed subpath) with the stroke fitted at `tol`. The subpath's index and its new
+/// shape; None when the stroke doesn't start and end on the same subpath, or meets it once.
+fn redraw_section(pd: &PathData, pts: &[Point], tol: f64, within: f64) -> Option<(usize, SubPath)> {
+    use kurbo::ParamCurveArclen;
+    let (first, last) = (*pts.first()?, *pts.last()?);
+    let (si, _, _, _, d_a) = pd.nearest(first)?;
+    let (sj, _, _, _, d_b) = pd.nearest(last)?;
+    if si != sj || d_a > within || d_b > within || pts.len() < 2 {
+        return None;
+    }
+    let mut sp = pd.subpaths.get(si)?.clone();
+    if sp.anchors.len() < 2 {
+        return None;
+    }
+    // The anchor nearest to `q`: the one there, else a new one, and whether it was added. Each
+    // point is looked up on the subpath as it is by then: splitting a straight segment makes two
+    // new ones, which a `t` along the old one doesn't measure.
+    let place = |sp: &mut SubPath, q: Point| {
+        let (_, seg, t, _, _) = PathData::single(sp.clone()).nearest(q)?;
+        let n = sp.anchors.len();
+        Some(if t <= 1e-6 {
+            (seg % n, false)
+        } else if t >= 1.0 - 1e-6 {
+            ((seg + 1) % n, false)
+        } else {
+            (sp.insert_anchor(seg, t), true)
+        })
+    };
+    let (mut from, _) = place(&mut sp, first)?;
+    let (to, added) = place(&mut sp, last)?;
+    if added && to <= from {
+        from += 1;
+    }
+    if from == to {
+        return None;
+    }
+    let n = sp.anchors.len();
+    // The length of the run of segments from anchor i forward to anchor j.
+    let run = |i: usize, j: usize| (0..(j + n - i) % n).map(|k| sp.segment((i + k) % n).arclen(0.01)).sum::<f64>();
+    // The stroke goes from `start` to `end` and replaces the run between them; `kept` runs from
+    // `end` round to `start`, then the stroke's inner anchors follow.
+    let (start, end, reversed) = if sp.closed {
+        if run(from, to) <= run(to, from) { (from, to, false) } else { (to, from, true) }
+    } else if from < to {
+        (from, to, false)
+    } else {
+        (to, from, true)
+    };
+    let mut stroke = pts.to_vec();
+    if reversed {
+        stroke.reverse();
+    }
+    let (Some(s0), Some(s1)) = (stroke.first_mut(), sp.anchors.get(start)) else { return None };
+    *s0 = s1.p;
+    let (Some(e0), Some(e1)) = (stroke.last_mut(), sp.anchors.get(end)) else { return None };
+    *e0 = e1.p;
+    let fit = fit_freehand(&stroke, tol, false).anchors;
+    let (Some(f0), Some(f1)) = (fit.first().copied(), fit.last().copied()) else { return None };
+    let inner = fit.get(1..fit.len().saturating_sub(1)).unwrap_or_default();
+    let (before, after): (Vec<Anchor>, Vec<Anchor>) = if sp.closed {
+        ((0..=(start + n - end) % n).filter_map(|k| sp.anchors.get((end + k) % n).copied()).collect(), vec![])
+    } else {
+        (sp.anchors.get(..=start)?.to_vec(), sp.anchors.get(end..)?.to_vec())
+    };
+    let mut anchors = before;
+    if let Some(a) = anchors.last_mut() {
+        *a = Anchor::with_handles(a.p, a.h_in, f0.h_out);
+    }
+    anchors.extend_from_slice(inner);
+    let at_end = anchors.len();
+    anchors.extend(after);
+    // The anchor the stroke ends on: the first after it, or round to the first of a closed one.
+    let end_at = if sp.closed { 0 } else { at_end };
+    if let Some(a) = anchors.get_mut(end_at) {
+        *a = Anchor::with_handles(a.p, f1.h_in, a.h_out);
+    }
+    Some((si, SubPath::new(anchors, sp.closed)))
+}
+
 fn freehand(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.freehand";
     let samples = samples_param(p, "points", C)?;
+    if samples.iter().any(|(q, _)| !within_input_bound(*q)) {
+        return Err(bad(C, "x and y must be finite"));
+    }
     let pressure = stroke_pressure(&samples);
     let mut pts: Vec<Point> = samples.into_iter().map(|(pt, _)| pt).collect();
     let tol = f64_or(p, "fidelity", 1.5).clamp(0.05, 100.0);
@@ -617,6 +720,28 @@ fn freehand(s: &mut Session, p: &Value) -> Result<Value> {
         })?;
         return Ok(json!({ "id": id.0 }));
     }
+    if let Some(rd) = p.get("redraw").filter(|v| !v.is_null()) {
+        let id = id_param(rd, "id").ok_or_else(|| bad(C, "redraw needs id"))?;
+        let within = f64_or(rd, "within", 12.0);
+        if !within.is_finite() || within < 0.0 {
+            return Err(bad(C, "redraw within must be a finite distance of 0 or more"));
+        }
+        let (pd, _) = path_of(&s.doc()?.doc, id)?;
+        // shortcut: a stroke pressure profile is left as it was, measured along the old path; fit
+        // it to the new length if Calligraphic pressure strokes get redrawn.
+        if let Some((si, sp)) = redraw_section(&pd, &pts, tol, within) {
+            s.edit(if brush { "Paintbrush" } else { "Pencil" }, |d, sel| {
+                *path_mut(d, id)?.subpaths.get_mut(si).ok_or_else(|| bad(C, "no such subpath"))? = sp;
+                if keep_selected {
+                    sel.set([id]);
+                } else {
+                    sel.remove(id);
+                }
+                Ok(())
+            })?;
+            return Ok(json!({ "id": id.0 }));
+        }
+    }
     if pts.len() < 2 {
         return Err(bad(C, "need at least two points"));
     }
@@ -679,7 +804,7 @@ fn curvature_edit(s: &mut Session, p: &Value) -> Result<Value> {
     use vectorcraft_tools::draw2::{EndCurve, curvature_close, curvature_extend, curvature_insert, curvature_move};
     const C: &str = "path.curvatureEdit";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let at = match (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) {
         (Some(x), Some(y)) if x.is_finite() && y.is_finite() => Some(Point::new(x, y)),
         (None, None) => None,
@@ -743,7 +868,7 @@ fn curvature_edit(s: &mut Session, p: &Value) -> Result<Value> {
 fn remove_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.removeAnchor";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let ai = usize_req(p, "anchor", C)?;
     let removed = s.edit("Delete Anchor Point", |d, sel| {
         let sp = path_mut(d, id)?.subpaths.get(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
@@ -850,13 +975,16 @@ fn remove_anchors_of(
 fn convert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.convertAnchor";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let ai = usize_req(p, "anchor", C)?;
     let smooth = str_param(p, "to") == Some("smooth");
     let target = match (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) {
         (Some(x), Some(y)) => Some(Point::new(x, y)),
         _ => None,
     };
+    if target.is_some_and(|q| !within_input_bound(q)) {
+        return Err(bad(C, "x and y must be finite"));
+    }
     s.edit("Convert Anchor Point", |d, _| {
         let path = path_mut(d, id)?;
         let sp = path.subpaths.get_mut(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
@@ -882,17 +1010,19 @@ fn convert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
 fn reshape_segment(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.reshapeSegment";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let seg = usize_req(p, "segment", C)?;
     let t = f64_or(p, "t", 0.5).clamp(0.05, 0.95);
     let dv = Vec2::new(f64_or(p, "dx", 0.0), f64_or(p, "dy", 0.0));
-    if !(dv.x.is_finite() && dv.y.is_finite()) {
+    if !(dv.x.is_finite() && dv.y.is_finite() && dv.hypot() < MAX_INPUT) {
         return Err(bad(C, "invalid delta"));
     }
+    let perpendicular = bool_or(p, "perpendicular", false);
     s.edit("Reshape", |d, _| {
         let path = path_mut(d, id)?;
         let sp = path.subpaths.get_mut(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
-        if !sp.bend_segment(seg, t, dv) {
+        let bent = if perpendicular { sp.bend_segment_perpendicular(seg, t, dv) } else { sp.bend_segment(seg, t, dv) };
+        if !bent {
             return Err(EngineError::Other("no such segment".into()));
         }
         Ok(())
@@ -905,9 +1035,9 @@ fn reshape_segment(s: &mut Session, p: &Value) -> Result<Value> {
 fn split(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.split";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
-    let anchor = p.get("anchor").and_then(Value::as_u64).map(|v| v as usize);
-    let seg = p.get("segment").and_then(Value::as_u64).map(|v| v as usize);
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
+    let anchor = usize_opt(p, "anchor", C)?;
+    let seg = usize_opt(p, "segment", C)?;
     if anchor.is_none() && seg.is_none() {
         return Err(bad(C, "need `anchor` or `segment` + `t`"));
     }

crates/engine/src/cmd/edit.rs

@@ -4,7 +4,7 @@ use std::collections::{BTreeMap, BTreeSet};
 use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Document, Node, NodeId, Unit};
+use vectorcraft_doc::{Document, Node, NodeId, RulerMode, Unit};
 use vectorcraft_geom::{Affine, Point, Vec2};
 
 use super::clipboard::SwatchChoices;
@@ -24,7 +24,7 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         cmd!("file.close", "Close", ["File"], Some("Cmd+W"), "{index?}", has_doc, file_close),
         cmd!("document.activate", "Activate Document", [], None, "{index}", always, doc_activate),
-        cmd!(query "document.inspect", "Inspect Document", [], None, "{depth?, childLimit?} → layer tree (each node: id, name, kind, visible, locked, bounds, opacity when below 1, blend when not Normal, fill, stroke and strokeWidth of objects and compound paths; a compound path's members have compoundMember: true instead of paint, which is the compound's), artboards, selection, history (a sliced tree reports childCount)", has_doc, |s, p| Ok(inspect::document_opts(s, slice_opts(p, "document.inspect")?))),
+        cmd!(query "document.inspect", "Inspect Document", [], None, "{depth?, childLimit?, ids?: [id…] (list just these nodes, of any level, in this order, under `nodes` in place of `layers`; an unknown id is an error; at most 10000), kind?: panel label such as Layer; Group; Path; Type or Image (exact, ignoring case; list every such node under `nodes`, each with `path`, its ancestor ids with the layer first, searching the subtrees of `ids` when given), limit?: at most this many entries of the list, offset?: entries skipped first (default 0; with `ids`, `kind`, `limit` or `offset` the reply adds `total`, the entries before paging)} → layer tree (each node: id, name, kind, visible, locked, bounds, opacity when below 1, blend when not Normal, fill, stroke and strokeWidth of objects and compound paths; a compound path's members have compoundMember: true instead of paint, which is the compound's), artboards, selection, history (a sliced tree reports childCount); without the scope options the reply is the whole layer tree", has_doc, doc_inspect),
         cmd!(query "document.node", "Inspect Object", [], None, "{id, summary?: compact summary, depth?: child levels in the summary (default all), childLimit?: children shown per node (default all; a level that shows fewer reports childCount)} → one object", has_doc, doc_node),
         cmd!(query "document.find", "Find Objects", [], None, "{name?: substring of the Layers panel name, kind?: panel label such as Group; Path; Type or Image (exact), text?: substring of type content, limit?: max matches (default 100, 0 counts only)} → {matches: [{id, name, kind, path}], total}", has_doc, doc_find),
         cmd!(query "document.json", "Document JSON", [], None, "{} → complete document model", has_doc, |s, _| Ok(serde_json::to_value(&*s.doc()?.doc).unwrap_or(Value::Null))),
@@ -37,13 +37,21 @@ pub fn specs() -> Vec<CommandSpec> {
             has_doc,
             set_units
         ),
-        cmd!(query "document.rulerOrigin", "Ruler Origin", [], None, "{} → {x, y} the rulers' zero point, in absolute document points", has_doc, |s, _| Ok(json!(s.doc()?.doc.ruler_origin))),
+        cmd!(
+            query "document.rulerOrigin",
+            "Ruler Origin",
+            [],
+            None,
+            "{artboard?: index=0 (the active artboard, which artboard rulers measure from)} → {x, y} the rulers' zero point, in absolute document points",
+            has_doc,
+            ruler_origin
+        ),
         cmd!(
             "document.setRulerOrigin",
             "Ruler Origin",
             [],
             None,
-            "{x, y} set the rulers' zero point in absolute document points; art, guides and command coordinates stay in place",
+            "{x, y, artboard?: index=0} set the rulers' zero point in absolute document points: the document's with global rulers, that artboard's with artboard rulers (it moves with the artboard); art, guides and command coordinates stay in place",
             has_doc,
             set_ruler_origin
         ),
@@ -52,12 +60,30 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reset Ruler Origin",
             [],
             None,
-            "{artboard?: index=0} reset the rulers' zero point to that artboard's top-left corner",
+            "{artboard?: index=0} reset the rulers' zero point to that artboard's top-left corner (with artboard rulers, that artboard's own zero point)",
             has_doc,
             reset_ruler_origin
         ),
+        cmd!(
+            "view.globalRulers",
+            "Change to Global Rulers",
+            ["View", "Rulers"],
+            Some("Cmd+Alt+R"),
+            "{global?: bool (default: toggle)} global rulers measure the whole document from one zero point; artboard rulers (a new document's) from the active artboard's top-left corner, or the zero point set for it. Saved with the document → {global}",
+            has_doc,
+            global_rulers
+        ),
         cmd!("edit.undo", "Undo", ["Edit"], Some("Cmd+Z"), "{}", can_undo, undo),
         cmd!("edit.redo", "Redo", ["Edit"], Some("Cmd+Shift+Z"), "{}", can_redo, redo),
+        cmd!(
+            "edit.clearHistory",
+            "Clear History",
+            [],
+            None,
+            "{} remove every undo and redo step of the active document (the History panel menu's Clear History): the document stays as it is, and clearing is not an undo step → {cleared: the number of steps removed}",
+            can_clear_history,
+            clear_history
+        ),
         cmd!(
             "edit.undoGroup.begin",
             "Begin Undo Group",
@@ -83,7 +109,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Paste",
             ["Edit"],
             Some("Cmd+V"),
-            "{center?: [x, y], dx?, dy?, swatchConflict?} paste centred on `center` (the app passes the view centre), else offset by dx/dy (default: the Paste Offset preference). Pasting brings the image blobs, symbols, patterns, global and spot swatches (with the tint swatches of the tints used), gradient swatches, graphic styles, character and paragraph styles and brushes the objects use; one of the same name that differs comes in renamed. swatchConflict, for a swatch whose name the document gives another colour (clipboard.conflicts): \"merge\" (default: the objects take the document's swatch) | \"add\" (the pasted swatch comes in renamed) | {name: \"merge\"|\"add\"}. With Paste Remembers Layers on (layer.pasteRemembersLayers), objects go back into the layers they came from (by name; made when missing). An artboard copied with artboard.copy comes with its art, right of the last artboard (the other paste commands but Paste on All Artboards: where it was), its art back in the layers it came from → {ids, artboard: the new artboard's index or null, added: resources added, merged: conflicts merged, renamed: [{kind, from, to}]}",
+            "{center?: [x, y], dx?, dy?, swatchConflict?} paste centred on `center` (the app passes the view centre), else offset by dx/dy (default: the Paste Offset preference). Pasting brings the image blobs, symbols, patterns, global and spot swatches (with the tint swatches of the tints used), gradient swatches, graphic styles, character and paragraph styles and brushes the objects use; one of the same name that differs comes in renamed. swatchConflict, for a swatch whose name the document gives another colour (clipboard.conflicts): \"merge\" (default: the objects take the document's swatch) | \"add\" (the pasted swatch comes in renamed) | {name: \"merge\"|\"add\"}. With Paste Remembers Layers on (layer.pasteRemembersLayers), objects go back into the layers they came from (by name; made when missing). Artboards copied with artboard.copy come with their art, together right of the last artboard as they lay (the other paste commands but Paste on All Artboards: where they were), their art back in the layers it came from, and the Artboard tool, when chosen, selects them → {ids, artboard: the first new artboard's index or null, artboards: the new artboards' indices, added: resources added, merged: conflicts merged, renamed: [{kind, from, to}]}",
             has_clipboard,
             |s, p| paste(s, p, PasteMode::Offset)
         ),
@@ -172,6 +198,26 @@ fn doc_node(s: &mut Session, p: &Value) -> Result<Value> {
     if summary { Ok(inspect::node_summary_opts(n, opts, &doc.symbol_boxes())) } else { Ok(serde_json::to_value(n).unwrap_or(Value::Null)) }
 }
 
+/// Most node ids `document.inspect {ids}` takes.
+const MAX_INSPECT_IDS: usize = 10_000;
+
+fn doc_inspect(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "document.inspect";
+    let opts = slice_opts(p, C)?;
+    let ids = match p.get("ids") {
+        None | Some(Value::Null) => None,
+        Some(Value::Array(a)) if a.len() > MAX_INSPECT_IDS => return Err(bad(C, format!("`ids` takes at most {MAX_INSPECT_IDS} ids"))),
+        Some(_) => Some(checked_ids_param(s, p, "ids", C)?),
+    };
+    let kind = match p.get("kind") {
+        None | Some(Value::Null) => None,
+        Some(Value::String(k)) => Some(k.clone()),
+        Some(_) => return Err(bad(C, "`kind` must be a string")),
+    };
+    let scope = inspect::Scope { ids, kind, limit: opt_u64(p, C, "limit")?, offset: opt_u64(p, C, "offset")?.unwrap_or(0) };
+    Ok(inspect::document_scoped(s, opts, &scope))
+}
+
 /// `depth` / `childLimit` for a summary read: absent (or null) means no limit.
 fn slice_opts(p: &Value, cmd: &str) -> Result<inspect::SummaryOpts> {
     Ok(inspect::SummaryOpts { depth: opt_u64(p, cmd, "depth")?, child_limit: opt_u64(p, cmd, "childLimit")?, compound_member: false })
@@ -209,33 +255,91 @@ fn set_units(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
+/// The `artboard` param of the ruler origin commands: an artboard index, 0 when not given.
+fn artboard_param(s: &Session, p: &Value, c: &str) -> Result<usize> {
+    let index = match p.get("artboard") {
+        None => 0,
+        Some(v) => v.as_u64().and_then(|n| usize::try_from(n).ok()).ok_or_else(|| bad(c, "index out of range"))?,
+    };
+    if index >= s.doc()?.doc.artboards.len() {
+        return Err(bad(c, "index out of range"));
+    }
+    Ok(index)
+}
+
+fn ruler_origin(s: &mut Session, p: &Value) -> Result<Value> {
+    let d = &s.doc()?.doc;
+    // A document without artboards measures from its global zero point.
+    let index = if d.artboards.is_empty() && p.get("artboard").is_none() { 0 } else { artboard_param(s, p, "document.rulerOrigin")? };
+    Ok(json!(s.doc()?.doc.ruler_origin_for(index)))
+}
+
 fn set_ruler_origin(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "document.setRulerOrigin";
     let origin = Point::new(f64_req(p, "x", C)?, f64_req(p, "y", C)?);
-    change_ruler_origin(s, origin, "Ruler Origin")
+    let index = if s.doc()?.doc.rulers == RulerMode::Global && p.get("artboard").is_none() { 0 } else { artboard_param(s, p, C)? };
+    change_ruler_origin(s, index, Some(origin), "Ruler Origin")
 }
 
 fn reset_ruler_origin(s: &mut Session, p: &Value) -> Result<Value> {
-    const C: &str = "document.resetRulerOrigin";
-    let index = match p.get("artboard") {
-        None => 0,
-        Some(v) => v.as_u64().and_then(|n| usize::try_from(n).ok()).ok_or_else(|| bad(C, "index out of range"))?,
-    };
-    let ab = s.doc()?.doc.artboards.get(index).ok_or_else(|| bad(C, "index out of range"))?;
-    change_ruler_origin(s, Point::new(ab.rect.x0, ab.rect.y0), "Reset Ruler Origin")
+    let index = artboard_param(s, p, "document.resetRulerOrigin")?;
+    change_ruler_origin(s, index, None, "Reset Ruler Origin")
 }
 
-fn change_ruler_origin(s: &mut Session, origin: Point, label: &str) -> Result<Value> {
-    if !origin.is_finite() || origin.x.abs() > crate::MAX_COORD || origin.y.abs() > crate::MAX_COORD {
+/// Move the rulers' zero point to `origin`, or back to artboard `index`'s top-left corner: the
+/// document's (global rulers) or that artboard's (artboard rulers, kept as an offset from its
+/// corner so it follows the artboard).
+fn change_ruler_origin(s: &mut Session, index: usize, origin: Option<Point>, label: &str) -> Result<Value> {
+    let d = &s.doc()?.doc;
+    let global = d.rulers == RulerMode::Global;
+    let corner = d.artboards.get(index).map(|ab| Point::new(ab.rect.x0, ab.rect.y0));
+    let target = origin.or(corner).unwrap_or(Point::ZERO);
+    if !target.is_finite() || target.x.abs() > crate::MAX_COORD || target.y.abs() > crate::MAX_COORD {
         return Err(EngineError::Other("result would exceed the canvas (coordinates out of range)".into()));
     }
-    if s.doc()?.doc.ruler_origin != origin {
+    if global {
+        if d.ruler_origin != target {
+            s.edit(label, |d, _| {
+                d.ruler_origin = target;
+                Ok(())
+            })?;
+        }
+        return Ok(json!(target));
+    }
+    let Some((id, corner)) = d.artboards.get(index).map(|ab| ab.id).zip(corner) else {
+        return Err(bad("document.setRulerOrigin", "index out of range"));
+    };
+    let offset = Some(target - corner).filter(|o| *o != Vec2::ZERO);
+    if d.artboard_ruler_origins.get(&id).copied() != offset {
         s.edit(label, |d, _| {
-            d.ruler_origin = origin;
+            // Origins of artboards that no longer exist go too.
+            let ids: BTreeSet<u32> = d.artboards.iter().map(|ab| ab.id).collect();
+            d.artboard_ruler_origins.retain(|id, _| ids.contains(id));
+            match offset {
+                Some(o) => d.artboard_ruler_origins.insert(id, o),
+                None => d.artboard_ruler_origins.remove(&id),
+            };
             Ok(())
         })?;
     }
-    Ok(json!(origin))
+    Ok(json!(target))
+}
+
+/// View › Rulers › Change to Global / Artboard Rulers.
+fn global_rulers(s: &mut Session, p: &Value) -> Result<Value> {
+    let current = s.doc()?.doc.rulers == RulerMode::Global;
+    let global = match p.get("global") {
+        None => !current,
+        Some(v) => v.as_bool().ok_or_else(|| bad("view.globalRulers", "global must be true or false"))?,
+    };
+    if global != current {
+        let label = if global { "Change to Global Rulers" } else { "Change to Artboard Rulers" };
+        s.edit(label, |d, _| {
+            d.rulers = if global { RulerMode::Global } else { RulerMode::Artboard };
+            Ok(())
+        })?;
+    }
+    Ok(json!({ "global": global }))
 }
 
 /// A typing session in progress (the Type tool previews the whole session as one interaction).
@@ -276,6 +380,7 @@ pub(crate) fn settle_interaction(s: &mut Session) -> Result<()> {
 
 fn undo(s: &mut Session, _: &Value) -> Result<Value> {
     settle_interaction(s)?;
+    let guides_locked = s.menu.guides_locked;
     let st = s.doc_mut()?;
     let e = st.history.undo.pop().ok_or_else(|| EngineError::Other("nothing to undo".into()))?;
     let label = e.label.clone();
@@ -284,16 +389,23 @@ fn undo(s: &mut Session, _: &Value) -> Result<Value> {
     let doc = std::mem::replace(&mut st.doc, e.doc);
     let selection = std::mem::replace(&mut st.selection, Arc::unwrap_or_clone(e.selection));
     let selection = shared_selection(selection, st.history.redo.last());
-    st.history.redo.push(crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs));
+    let mut turned = crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs);
+    turned.named = e.named;
+    st.history.redo.push(turned);
     st.history.trim();
     st.revision += 1;
     st.selection.prune(&st.doc);
+    // Guides locked since the step was made stay deselected.
+    if guides_locked {
+        crate::deselect_guides(&st.doc, &mut st.selection);
+    }
     super::maskedit::follow_history(st, editing);
     Ok(json!({ "undone": label }))
 }
 
 fn redo(s: &mut Session, _: &Value) -> Result<Value> {
     settle_interaction(s)?;
+    let guides_locked = s.menu.guides_locked;
     let st = s.doc_mut()?;
     let e = st.history.redo.pop().ok_or_else(|| EngineError::Other("nothing to redo".into()))?;
     let label = e.label.clone();
@@ -302,14 +414,32 @@ fn redo(s: &mut Session, _: &Value) -> Result<Value> {
     let doc = std::mem::replace(&mut st.doc, e.doc);
     let selection = std::mem::replace(&mut st.selection, Arc::unwrap_or_clone(e.selection));
     let selection = shared_selection(selection, st.history.undo.last());
-    st.history.undo.push(crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs));
+    let mut turned = crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs);
+    turned.named = e.named;
+    st.history.undo.push(turned);
     st.history.trim();
     st.revision += 1;
     st.selection.prune(&st.doc);
+    if guides_locked {
+        crate::deselect_guides(&st.doc, &mut st.selection);
+    }
     super::maskedit::follow_history(st, editing);
     Ok(json!({ "redone": label }))
 }
 
+/// History panel › Clear History: removes the steps after the current state and the steps before
+/// it, and leaves the document as it is. Typing or a drag still in progress is first kept as a
+/// step, as Undo keeps it, so it is removed with the others and its change stays in the document.
+fn clear_history(s: &mut Session, _: &Value) -> Result<Value> {
+    settle_interaction(s)?;
+    let st = s.doc_mut()?;
+    let cleared = st.history.undo.len() + st.history.redo.len();
+    st.history.undo.clear();
+    st.history.redo.clear();
+    st.revision += 1;
+    Ok(json!({ "cleared": cleared }))
+}
+
 /// `selection` for an undo (redo) step, sharing that of `like`, the step beside it, when the same.
 fn shared_selection(selection: vectorcraft_doc::Selection, like: Option<&crate::HistoryEntry>) -> Arc<vectorcraft_doc::Selection> {
     match like {
@@ -324,22 +454,23 @@ pub(crate) fn selected_roots(s: &Session) -> Result<Vec<NodeId>> {
     Ok(roots_of(&st.doc, st.selection.in_paint_order(&st.doc)))
 }
 
-/// [`selected_roots`] for the commands that move or reshape the art (Move, Transform, Rotate…): in
-/// an isolated compound path its paths are objects of their own, so the hole of a ring moves
-/// without the ring. Paint and the rest still go to the compound path, which holds the paint.
+/// [`selected_roots`] for the commands that move or reshape the art (Move, Transform, Rotate…): a
+/// path of a compound path selected on its own (Group Selection, or in the isolated compound path)
+/// is an object of its own, so the hole of a ring moves without the ring (#2441). Paint and the
+/// rest still go to the compound path, which holds the paint.
 pub(crate) fn selected_roots_to_transform(s: &Session) -> Result<Vec<NodeId>> {
     let st = s.doc()?;
-    Ok(roots_within(&st.doc, st.selection.in_paint_order(&st.doc), st.isolation))
+    Ok(roots_within(&st.doc, st.selection.in_paint_order(&st.doc), true))
 }
 
 /// The top-level objects among `ids` (in paint order): compound-path members stand for their
 /// compound, and ids whose ancestor is also listed, and layers, are dropped.
 pub(crate) fn roots_of(doc: &Document, ids: Vec<NodeId>) -> Vec<NodeId> {
-    roots_within(doc, ids, None)
+    roots_within(doc, ids, false)
 }
 
-/// [`roots_of`], less the swap for the members of `isolation` when it is a compound path.
-fn roots_within(doc: &Document, ids: Vec<NodeId>, isolation: Option<NodeId>) -> Vec<NodeId> {
+/// [`roots_of`]; with `members`, a compound path's member listed stays itself.
+fn roots_within(doc: &Document, ids: Vec<NodeId>, members: bool) -> Vec<NodeId> {
     // Every id's place in the tree, found in one walk (a lookup per id is a walk per id).
     let paths = doc.index_paths(ids.iter().copied());
     // A compound-path member acts as its compound (compounds are one object).
@@ -349,7 +480,7 @@ fn roots_within(doc: &Document, ids: Vec<NodeId>, isolation: Option<NodeId>) ->
             let path = paths.get(&id);
             let parent = path.and_then(|p| p.split_last()).map(|(_, up)| up).filter(|up| !up.is_empty());
             match parent.and_then(|up| doc.node_at(up).map(|n| (up, n))) {
-                Some((up, n)) if matches!(n.kind, vectorcraft_doc::NodeKind::Compound { .. }) && Some(n.id) != isolation => (n.id, Some(up.to_vec())),
+                Some((up, n)) if matches!(n.kind, vectorcraft_doc::NodeKind::Compound { .. }) && !members => (n.id, Some(up.to_vec())),
                 _ => (id, path.cloned()),
             }
         })
@@ -495,16 +626,19 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
     let st = s.doc()?;
     let same_doc = clip.source_doc == Some(st.uid);
     let parent = st.target_parent()?;
-    // A copied artboard comes back with its art: right of the last artboard, or where it was
-    // (Paste in Place, in Front, in Back). Paste on All Artboards pastes only the art.
-    let board = clip
-        .artboard
-        .as_ref()
+    // Copied artboards come back with their art: together right of the last artboard, as they lay,
+    // or where they were (Paste in Place, in Front, in Back). Paste on All Artboards pastes only the
+    // art.
+    let boards = clip
+        .artboards
+        .iter()
+        .map(|a| a.rect)
+        .reduce(|a, b| a.union(b))
         .filter(|_| mode != PasteMode::AllArtboards)
-        .map(|a| (a, if mode == PasteMode::Offset { super::panelcmds::beside_artboards(&st.doc, a.rect) } else { Vec2::ZERO }));
+        .map(|all| (&clip.artboards, if mode == PasteMode::Offset { super::panelcmds::beside_artboards(&st.doc, all) } else { Vec2::ZERO }));
     // Paste Remembers Layers (not while isolating a group: pastes stay in it); an artboard's art
     // always goes back into its layers.
-    let remember = (st.doc.paste_remembers_layers || board.is_some()) && parent.is_some_and(|p| st.doc.node(p).is_some_and(Node::is_layer));
+    let remember = (st.doc.paste_remembers_layers || boards.is_some()) && parent.is_some_and(|p| st.doc.node(p).is_some_and(Node::is_layer));
     // Front/back: relative to the selection (top-most / bottom-most selected object); with
     // nothing selected, the top / bottom of the current layer.
     let anchor = match mode {
@@ -515,7 +649,7 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
         }
         _ => None,
     };
-    let placements: Vec<Affine> = match (mode, board) {
+    let placements: Vec<Affine> = match (mode, boards) {
         (_, Some((_, dv))) => vec![Affine::translate(dv)],
         (PasteMode::Offset | PasteMode::Library, None) => vec![match point_param(p, "center") {
             Some(c) => clip.bounds().map_or(Affine::IDENTITY, |b| Affine::translate(c - b.center())),
@@ -528,9 +662,13 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
         // In place, in front, in back: onto the active artboard when the UI names it.
         _ => vec![onto_artboard(&st.doc, p, clip)],
     };
-    let (ids, imported, artboard) = s.edit(mode.label(), |d, sel| {
+    let (ids, imported, artboards) = s.edit(mode.label(), |d, sel| {
         let imported = clip.import_into(d, choices, same_doc);
-        let artboard = board.map(|(a, dv)| super::panelcmds::push_artboard_copy(d, a, a.rect + dv));
+        let artboards: Vec<usize> = boards
+            .into_iter()
+            .flat_map(|(all, dv)| all.iter().map(move |a| (a, dv)))
+            .map(|(a, dv)| super::panelcmds::push_artboard_copy(d, a, a.rect + dv))
+            .collect();
         let mut layers: BTreeMap<&str, NodeId> = BTreeMap::new();
         // Objects pasted into each parent so far (keeps their order in front and back pastes).
         let mut placed: BTreeMap<Option<NodeId>, usize> = BTreeMap::new();
@@ -565,15 +703,16 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
         // Pasted type arrives without the layout bounds cache: fill it so boxes and alignment are
         // right away (opening the file later would, but paste must not depend on a reopen).
         super::typecmd::refresh_bounds_of(d, &new_ids);
-        Ok((new_ids, imported, artboard))
+        Ok((new_ids, imported, artboards))
     })?;
-    // The Artboard tool takes the pasted artboard.
-    if let Some(i) = artboard.filter(|_| s.tool_id() == "artboard") {
-        s.set_tool_option("active", &json!(i));
+    // The Artboard tool selects the pasted artboards, the first one active.
+    if !artboards.is_empty() && s.tool_id() == "artboard" {
+        s.set_tool_option("selected", &json!(artboards));
     }
     Ok(json!({
         "ids": ids.iter().map(|i| i.0).collect::<Vec<_>>(),
-        "artboard": artboard,
+        "artboard": artboards.first(),
+        "artboards": artboards,
         "added": imported.added,
         "merged": imported.merged,
         "renamed": imported.renamed,

crates/engine/src/cmd/effectcmd.rs

@@ -59,7 +59,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand Appearance",
             ["Object"],
             None,
-            "{ids?|id?: [..], target?} turn each object's appearance into objects: every fill and stroke becomes an object of its own (strokes outlined, brushed strokes their brush art) grouped in paint order under the object's id and transparency, geometry effects are baked, raster effects become an embedded image (shadows and outer glows below the art; blur, feather and inner glow replace it), type with effects or fills of its own is outlined; Crop Marks become a group of the object and its marks; a group's or layer's own fills and strokes become objects among its members, which are expanded too. Hidden fills, strokes and effects are dropped. Enabled when a selected or targeted object's appearance isn't basic (`ids` then pick which objects) → {ids}",
+            "{ids?|id?: [..], target?} turn each object's appearance into objects: every fill and stroke becomes an object of its own (strokes outlined, brushed strokes their brush art) grouped in paint order under the object's id and transparency, geometry effects are baked, raster effects become an embedded image (shadows and outer glows below the art; blur, feather and inner glow replace it; an object whose only raster effect is its own Rasterize becomes the image object.rasterize makes with the effect's options), type with effects or fills of its own is outlined; Crop Marks become a group of the object and its marks; a group's or layer's own fills and strokes become objects among its members, which are expanded too. Hidden fills, strokes and effects are dropped. Enabled when a selected or targeted object's appearance isn't basic (`ids` then pick which objects) → {ids, warning? (an image in the art couldn't be decoded, as object.rasterize says)}",
             can_expand,
             expand_appearance
         ),
@@ -138,6 +138,8 @@ pub(crate) fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     if !params.is_null() && !params.is_object() {
         return Err(bad(C, "`params` must be an object"));
     }
+    super::params::check_effect_color(C, id, &params)?;
+    super::params::check_effect_channel(C, id, &params)?;
     // Crop Marks take their style from the preferences when applied.
     if id == effects::CROP_MARKS && params.get("style").is_none() {
         params["style"] = json!(s.crop_mark_style().id());
@@ -313,7 +315,12 @@ fn set_params(s: &mut Session, p: &Value) -> Result<Value> {
         .transpose()?;
     let visible = p.get("visible").and_then(Value::as_bool);
     let item = item_target(s, p, C)?;
-    if set_params_effects(s, p).iter().any(|e| e == GLASS) {
+    let edited = set_params_effects(s, p);
+    for effect in &edited {
+        super::params::check_effect_color(C, effect, &params)?;
+        super::params::check_effect_channel(C, effect, &params)?;
+    }
+    if edited.iter().any(|e| e == GLASS) {
         load_texture(&mut params, C)?;
     }
     for id in appearance_targets(s, p)? {
@@ -421,9 +428,10 @@ fn is_container(n: &Node) -> bool {
 }
 
 /// The raster effects of `n` (its own, its fills' and strokes') as an embedded image rendered at
-/// the document's raster effects resolution, with whether they all paint below it (shadows and
-/// outer glows: the image then holds just them). A group's or layer's image leaves out its
-/// members' raster effects, which are expanded with them. `None` when it has none.
+/// the document's raster effects resolution or a Rasterize effect's finer one, with whether they
+/// all paint below it (shadows and outer glows: the image then holds just them). A group's or
+/// layer's image leaves out its members' raster effects, which are expanded with them. `None`
+/// when it has none.
 fn raster_image(d: &mut Document, n: &Node) -> Option<(Node, bool)> {
     let fx = rasterfx::raster_fx(n);
     if fx.is_empty() {
@@ -504,10 +512,11 @@ pub(crate) fn expand_node(d: &mut Document, id: NodeId, brushes: &[vectorcraft_b
                     expand_pieces(d, &mut m, false, &mut stroke_art);
                     m
                 })
-            } else if matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. }) {
+            } else if matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. }) && !effects::has_gradient_copies(&v) {
                 effects::expand_leaf(d, &v, &mut stroke_art)
             } else {
-                // Type, images, symbol instances, live objects: through their outlines.
+                // Type, images, symbol instances, live objects (and paths whose Transform effect copies
+                // them with a gradient): through their outlines.
                 let symbol = match &n.kind {
                     NodeKind::SymbolInstance { symbol, .. } => d.symbols.iter().find(|s| s.name == *symbol).map(|s| s.art.clone()),
                     _ => None,
@@ -545,6 +554,7 @@ pub(crate) fn expand_node(d: &mut Document, id: NodeId, brushes: &[vectorcraft_b
 
 fn expand_appearance(s: &mut Session, p: &Value) -> Result<Value> {
     let roots = appearance_targets(s, p)?;
+    let failed = vectorcraft_render::decode_failures();
     let ids = s.edit("Expand Appearance", |d, _| {
         let brushes = vectorcraft_brush::library(d);
         let mut out = vec![];
@@ -556,7 +566,12 @@ fn expand_appearance(s: &mut Session, p: &Value) -> Result<Value> {
         }
         Ok(out)
     })?;
-    Ok(json!({ "ids": ids_json(&ids) }))
+    let mut out = json!({ "ids": ids_json(&ids) });
+    // Raster effects become images rendered from the art.
+    if let Some(w) = rasterfx::undecoded_warning(failed) {
+        out["warning"] = json!(w);
+    }
+    Ok(out)
 }
 
 #[cfg(test)]
@@ -995,4 +1010,27 @@ mod tests {
         assert_eq!(ch.len(), 1);
         assert!((ch[0].geometric_bounds().unwrap().width() - 50.0).abs() < 1e-6);
     }
+    #[test]
+    fn expand_appearance_gives_each_copy_of_a_transform_its_own_gradient() {
+        use vectorcraft_color::{Color, Gradient, GradientKind, GradientPaint, GradientStop, Paint};
+        let (mut s, id) = session_with_rect();
+        let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+        let ramp = Paint::Gradient(Box::new(GradientPaint::new(Gradient { kind: GradientKind::Linear, stops })));
+        s.edit("gradient", |d, _| {
+            let n = d.node_mut(id).unwrap();
+            n.appearance.set_fill(ramp);
+            Ok(())
+        })
+        .unwrap();
+        s.execute("effect.apply", &json!({"effect":"distort.transform","ids":[id.0],"item":null})).unwrap();
+        s.execute("effect.setParams", &json!({"index":0,"params":{"moveH":150,"copies":2},"ids":[id.0],"item":null})).unwrap();
+        s.execute("effect.expandAppearance", &json!({"ids":[id.0]})).unwrap();
+        let mut boxes = vec![];
+        node(&s, id).walk(&mut |n| {
+            if matches!(n.kind, NodeKind::Path { .. }) && matches!(n.appearance.fill_paint(), Paint::Gradient(_)) {
+                boxes.push(n.geometric_bounds().unwrap().width());
+            }
+        });
+        assert_eq!(boxes, vec![100.0; 3], "three squares, each with its own gradient");
+    }
 }

crates/engine/src/cmd/expand.rs

@@ -1,8 +1,9 @@
-//! Object → Expand: live shapes, type and effects (Object), strokes (Stroke) and gradient fills
-//! (Fill) into plain art in one undo step; blends, repeats and Intertwine groups become groups of their steps, of their instances and of what they draw. Placed documents (Object) become editable copies of the
+//! Object → Expand: live shapes, type and effects (Object), strokes (Stroke) and gradient and pattern
+//! fills (Fill) into plain art in one undo step; blends, repeats and Intertwine groups become groups of their steps, of their instances and of what they draw. Placed documents (Object) become editable copies of the
 //! art they show, their resources joining the document. A linear or radial gradient fill becomes a
 //! gradient mesh, or solid strips / concentric ellipses, inside a clip group shaped like the object; a freeform
-//! gradient becomes a mesh shaped like the object. Create Gradient Mesh shares the sampling.
+//! gradient becomes a mesh shaped like the object. A pattern fill becomes the tiles it paints inside a clip
+//! group shaped like the object. Create Gradient Mesh shares the sampling.
 
 use std::sync::Arc;
 
@@ -12,13 +13,14 @@ use vectorcraft_color::freeform::spread_scale;
 use vectorcraft_color::{Color, Gradient, GradientKind, GradientPaint, Paint};
 use vectorcraft_doc::appearance::{AppearanceItem, FillLayer};
 use vectorcraft_doc::live::{GradientMesh, lerp_color};
-use vectorcraft_doc::{Appearance, Document, Node, NodeId, NodeKind};
+use vectorcraft_doc::pattern::{PatternDef, place_art};
+use vectorcraft_doc::{Appearance, Document, Node, NodeId, NodeKind, Scaling};
 use vectorcraft_geom::{Affine, PathData, Point, Rect, SubPath, Vec2, shapes};
 
 use super::edit::selected_roots;
 use super::menucmds::{run_raw, squash};
 use super::object::as_clipping_path;
-use super::pathops::{assemble, node_path, replace_leaves, styled_copy, with_transparency};
+use super::pathops::{assemble, node_path, outline_strokes, replace_leaves, styled_copy, with_transparency};
 use super::*;
 
 const C: &str = "object.expand";
@@ -37,7 +39,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand…",
             ["Object"],
             None,
-            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, repeats → groups of their instances, Intertwine groups → groups of their objects and of the parts drawn over the others (clip groups), envelopes → their distorted content, placed documents → editable copies of their art, as placing the file without link gives, its symbols, patterns, swatches and images joining the document), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh); both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
+            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, repeats → groups of their instances, Intertwine groups → groups of their objects and of the parts drawn over the others (clip groups), envelopes → their distorted content, placed documents → editable copies of their art, as placing the file without link gives, its symbols, patterns, swatches and images joining the document), fill?: true (gradient fills → `gradient` art, pattern fills → their tiles in a clip group shaped like the object), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh); both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
             has_selection,
             expand
         ),
@@ -46,11 +48,11 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand Options",
             [],
             None,
-            "{} what each Expand option would change in the selection → {object, fill, stroke} (true: something to expand)",
+            "{} what each Expand option would change in the selection → {object, fill, stroke, gradient} (true: something to expand; gradient: a gradient fill that Fill expands, which Expand Gradient To applies to)",
             has_selection,
             |s, _| {
                 let e = Expandable::of(&s.doc()?.doc, &selected_roots(s)?);
-                Ok(json!({"object": e.object(), "fill": e.fill, "stroke": e.stroke}))
+                Ok(json!({"object": e.object(), "fill": e.fill, "stroke": e.stroke, "gradient": e.gradient}))
             }
         ),
     ]
@@ -99,6 +101,8 @@ struct Expandable {
     live: bool,
     effects: bool,
     fill: bool,
+    /// Gradient fills (the ones Expand Gradient To applies to), a part of `fill`.
+    gradient: bool,
     stroke: bool,
     /// An envelope (Object expands it into its distorted content).
     envelope: bool,
@@ -127,10 +131,17 @@ impl Expandable {
                 e.repeats |= matches!(c.kind, NodeKind::Repeat(_));
                 e.intertwines |= matches!(c.kind, NodeKind::Intertwine { .. });
                 e.stroke |= shape && !c.appearance.stroke_paint().is_none();
-                e.fill |= match &c.kind {
+                e.gradient |= match &c.kind {
                     NodeKind::Text(t) => t.runs.iter().any(|r| matches!(r.style.fill, Paint::Gradient(_))),
                     _ => shape && c.appearance.items.iter().any(|i| gradient_fill(i).is_some()),
                 };
+                e.fill |= e.gradient;
+                e.fill |= match &c.kind {
+                    NodeKind::Text(t) => {
+                        t.runs.iter().any(|r| matches!(&r.style.fill, Paint::Pattern { pattern, .. } if d.pattern(pattern).is_some()))
+                    }
+                    _ => shape && c.appearance.items.iter().any(|i| pattern_fill(d, i).is_some()),
+                };
             });
         }
         e
@@ -152,6 +163,17 @@ fn gradient_fill(i: &AppearanceItem) -> Option<(&FillLayer, &GradientPaint)> {
     }
 }
 
+/// The definition and placement of a visible pattern fill whose pattern `d` defines.
+fn pattern_fill<'a, 'd>(d: &'d Document, i: &'a AppearanceItem) -> Option<(&'a FillLayer, &'d PatternDef, Affine)> {
+    match i {
+        AppearanceItem::Fill(f) if f.visible => match &f.paint {
+            Paint::Pattern { pattern, xf } => Some((f, d.pattern(pattern)?, *xf)),
+            _ => None,
+        },
+        _ => None,
+    }
+}
+
 fn expand(s: &mut Session, p: &Value) -> Result<Value> {
     let object = bool_or(p, "object", true);
     let fill = bool_or(p, "fill", true);
@@ -212,6 +234,7 @@ fn expand(s: &mut Session, p: &Value) -> Result<Value> {
     }
     if fill {
         let _ = expand_gradient_fills(s, to);
+        let _ = expand_pattern_fills(s);
     }
     if s.doc()?.revision == rev0 {
         return Err(EngineError::Other("Expand: nothing to expand".into()));
@@ -250,18 +273,27 @@ fn expand_gradient_fills(s: &mut Session, to: GradientTo) -> Result<()> {
 }
 
 /// Path `l` with each gradient fill turned into art, in appearance order: the other items stay
-/// on plain copies of the path. `None` when it has no gradient fill.
+/// on plain copies of the path. The path's geometry effects ([`reshaped`]) and each fill's own
+/// ([`fill_shape`]) shape the outline the art fills first, as on the canvas. `None` when no
+/// gradient fill can be expanded.
 fn expand_fills(d: &mut Document, l: &Node, to: GradientTo) -> Option<Node> {
     if !matches!(l.kind, NodeKind::Path { .. } | NodeKind::Compound { .. }) || !l.appearance.items.iter().any(|i| gradient_fill(i).is_some()) {
         return None;
     }
+    let reshaped = reshaped(l);
+    let l = reshaped.as_ref().unwrap_or(l);
     let (path, _) = node_path(l)?;
     let bounds = path.bounds()?;
     let mut parts = vec![];
     let mut rest = vec![];
+    let mut expanded = false;
     for item in &l.appearance.items {
         // Items that paint nothing go; a gradient that can't be expanded stays.
-        let Some(art) = gradient_fill(item).and_then(|(f, g)| gradient_art(d, l, &path, bounds, f, g, to)) else {
+        let art = gradient_fill(item).and_then(|(f, g)| {
+            let (fl, path, bounds) = fill_shape(l, f, &path, bounds)?;
+            gradient_art(d, &fl, &path, bounds, f, g, to)
+        });
+        let Some(art) = art else {
             if item.visible() && !item.paint().is_none() {
                 rest.push(item.clone());
             }
@@ -271,6 +303,10 @@ fn expand_fills(d: &mut Document, l: &Node, to: GradientTo) -> Option<Node> {
             parts.push(styled_copy(d, l, std::mem::take(&mut rest)));
         }
         parts.push(art);
+        expanded = true;
+    }
+    if !expanded {
+        return None;
     }
     if !rest.is_empty() {
         parts.push(styled_copy(d, l, rest));
@@ -279,10 +315,10 @@ fn expand_fills(d: &mut Document, l: &Node, to: GradientTo) -> Option<Node> {
 }
 
 /// Gradient fill `f` (gradient `g`) of path `l` (outline `path`, box `bounds`) as art, with the
-/// fill's opacity, blend mode and effects.
+/// fill's opacity, blend mode and effects other than geometry effects ([`fill_effects`]).
 fn gradient_art(d: &mut Document, l: &Node, path: &PathData, bounds: Rect, f: &FillLayer, g: &GradientPaint, to: GradientTo) -> Option<Node> {
     let content = if g.gradient.kind == GradientKind::Freeform {
-        let m = GradientMesh::for_path_with(path, FREEFORM_MESH, FREEFORM_MESH, &*gradient_sampler(g, bounds))?;
+        let m = GradientMesh::for_path_with(path, FREEFORM_MESH, FREEFORM_MESH, &*gradient_sampler(g, bounds, d.color_mode.model()))?;
         vec![Node::new(d.alloc_id(), NodeKind::Mesh(m))]
     } else {
         let frame = Frame::new(g, bounds);
@@ -308,35 +344,400 @@ fn gradient_art(d: &mut Document, l: &Node, path: &PathData, bounds: Rect, f: &F
         Node::new(d.alloc_id(), NodeKind::Group { children, clip: true })
     };
     let mut art = with_transparency(d, art, f.opacity, f.blend);
-    art.appearance.effects = f.effects.clone();
+    art.appearance.effects = fill_effects(f);
+    Some(art)
+}
+
+/// Path `l` as the canvas paints its fills and strokes: its visible geometry effects applied to its
+/// path (a plain path then), and every geometry effect of its own removed. `None` when it has no
+/// visible geometry effect.
+fn reshaped(l: &Node) -> Option<Node> {
+    use vectorcraft_render::effects::{GeomContext, apply_geometry_with, has_geometry, is_geometry};
+    if !has_geometry(&l.appearance.effects) {
+        return None;
+    }
+    let (path, _) = node_path(l)?;
+    let g = apply_geometry_with(&l.appearance.effects, &path, path.bounds()?, &GeomContext::of(l));
+    let mut m = with_path(l, g);
+    m.appearance.effects.retain(|e| !is_geometry(&e.id));
+    Some(m)
+}
+
+/// Path `l` (outline `path`, box `bounds`) as fill `f` paints it on the canvas, with its outline
+/// and box: when the fill has visible geometry effects, `l` with the outline they make of `path`
+/// as a plain path, and that outline's box.
+fn fill_shape(l: &Node, f: &FillLayer, path: &PathData, bounds: Rect) -> Option<(Node, PathData, Rect)> {
+    use vectorcraft_render::effects::{GeomContext, apply_geometry_with, has_geometry};
+    if !has_geometry(&f.effects) {
+        return Some((l.clone(), path.clone(), bounds));
+    }
+    let outline = apply_geometry_with(&f.effects, path, bounds, &GeomContext::of(l));
+    let b = outline.bounds()?;
+    Some((with_path(l, outline.clone()), outline, b))
+}
+
+/// Path or compound path `l` with `path` as its path, a plain path.
+fn with_path(l: &Node, path: PathData) -> Node {
+    let mut m = l.clone();
+    m.kind = match &l.kind {
+        NodeKind::Path { rule, clipping, guide, .. } => NodeKind::Path { path, rule: *rule, live: None, clipping: *clipping, guide: *guide },
+        NodeKind::Compound { rule, .. } => NodeKind::Path { path, rule: *rule, live: None, clipping: false, guide: false },
+        k => k.clone(),
+    };
+    m
+}
+
+/// The effects of fill `f` that stay on its expanded art: all but its geometry effects, which
+/// shape the outline it paints ([`fill_shape`]).
+fn fill_effects(f: &FillLayer) -> Vec<vectorcraft_doc::Effect> {
+    f.effects.iter().filter(|e| !vectorcraft_render::effects::is_geometry(&e.id)).cloned().collect()
+}
+
+/// Replace every pattern fill of the selected paths by the tiles it paints (see [`expand_patterns`]).
+fn expand_pattern_fills(s: &mut Session) -> Result<()> {
+    let roots = selected_roots(s)?;
+    s.edit("Expand", |d, sel| {
+        let (mut ids, mut changed) = (vec![], 0);
+        for r in &roots {
+            let (id, n) = replace_leaves(d, *r, expand_patterns)?;
+            ids.push(id);
+            changed += n;
+        }
+        if changed == 0 {
+            return Err(EngineError::Other("Expand: nothing to expand".into()));
+        }
+        sel.set(ids);
+        Ok(())
+    })
+}
+
+/// Path `l` with each pattern fill turned into the tiles it paints over the box of the outline it
+/// fills, in a clip group shaped like that outline with the fill's opacity, blend mode and effects
+/// other than geometry effects, in appearance order: the other items stay on plain copies of the
+/// path. The path's geometry effects ([`reshaped`]) and each fill's own ([`fill_shape`]) shape
+/// that outline first, as on the canvas. The tiles are drawn as the canvas draws them
+/// ([`pattern_tiles`]). A pattern fill that lays no tile there stays. `None` when no pattern fill
+/// lays a tile.
+fn expand_patterns(d: &mut Document, l: &Node) -> Option<Node> {
+    if !matches!(l.kind, NodeKind::Path { .. } | NodeKind::Compound { .. }) || !l.appearance.items.iter().any(|i| pattern_fill(d, i).is_some()) {
+        return None;
+    }
+    let reshaped = reshaped(l);
+    let l = reshaped.as_ref().unwrap_or(l);
+    let (path, _) = node_path(l)?;
+    let bounds = path.bounds()?;
+    let mut parts = vec![];
+    let mut rest = vec![];
+    let mut expanded = false;
+    for item in &l.appearance.items {
+        let fill = pattern_fill(d, item).map(|(f, def, xf)| (f, def.clone(), xf));
+        let tiles = fill.and_then(|(f, def, xf)| {
+            let (fl, _, bounds) = fill_shape(l, f, &path, bounds)?;
+            let t = pattern_tiles(d, &def, xf, bounds);
+            (!t.is_empty()).then_some((f, fl, t))
+        });
+        let Some(art) = tiles.and_then(|(f, fl, t)| tile_art(d, &fl, f, &t)) else {
+            if item.visible() && !item.paint().is_none() {
+                rest.push(item.clone());
+            }
+            continue;
+        };
+        if !rest.is_empty() {
+            parts.push(styled_copy(d, l, std::mem::take(&mut rest)));
+        }
+        parts.push(art);
+        expanded = true;
+    }
+    if !expanded {
+        return None;
+    }
+    if !rest.is_empty() {
+        parts.push(styled_copy(d, l, rest));
+    }
+    assemble(d, l, parts)
+}
+
+/// The tiles pattern `def` placed by `xf` lays over `bounds` in document `d`, as the canvas draws
+/// them: their stroke weights and effects scale with the pattern, and when it also turns, flips,
+/// stretches or shears them, the strokes (brushed ones included) and geometry effects of their
+/// paths and opacity masks become filled art and their live shapes become plain paths first. The
+/// same happens when it scales art with geometry effects (Roughen's detail, for one, is per inch
+/// and does not scale). No tiles when it turns, flips, stretches or shears art with raster or 3D
+/// effects or with a geometry effect on a group or type, or scales art with a geometry effect on a
+/// group or type, which the canvas draws turned or scaled with the tile and live effects would
+/// not, and when it does more than move art that holds a symbol instance, whose strokes the canvas
+/// draws scaled with the tile and an instance does not scale. Random Transform effects and brushes
+/// that vary at random in the art are baked first ([`seeds_baked`], [`random_brushes_baked`]).
+fn pattern_tiles(d: &mut Document, def: &PatternDef, xf: Affine, bounds: Rect) -> Vec<Node> {
+    if !moves_only(xf) && def.art.iter().any(|a| has_instances(a)) {
+        return vec![];
+    }
+    let Some(def) = seeds_baked(def) else {
+        return vec![];
+    };
+    let brushes = vectorcraft_brush::library(d);
+    let def = random_brushes_baked(d, &brushes, def);
+    let def = &*def;
+    let scaling = Scaling { strokes: true, effects: Some(vectorcraft_render::effects::scale_effect), patterns: true, ..Scaling::default() };
+    if scales_evenly(xf) && (moves_only(xf) || !def.art.iter().any(|a| has_geometry_effects(a))) {
+        return def.instances_in_with(xf, bounds, scaling);
+    }
+    if def.art.iter().any(|a| has_unbakeable_effects(a)) {
+        return vec![];
+    }
+    let placed = Scaling { patterns: true, ..Scaling::default() };
+    let mut tiles = def.instances_in_with(Affine::IDENTITY, xf.inverse().transform_rect_bbox(bounds), placed);
+    for t in &mut tiles {
+        *t = prepared(d, &brushes, t);
+        place_art(t, xf, scaling);
+    }
+    tiles
+}
+
+/// Pattern `def` with each path in its art (opacity masks included) that has a random Transform
+/// effect baked into filled art ([`bake_appearance`](vectorcraft_render::effects::bake_appearance))
+/// while it keeps its own id: the effect takes its seed from the id, and the canvas draws the art
+/// with those ids for every tile, while the tiles get ids of their own. `None` when something
+/// other than a path has such an effect.
+fn seeds_baked(def: &PatternDef) -> Option<std::borrow::Cow<'_, PatternDef>> {
+    if !def.art.iter().any(|a| has_seeded(a)) {
+        return Some(std::borrow::Cow::Borrowed(def));
+    }
+    let mut def = def.clone();
+    def.art = def.art.iter().map(|a| bake_seeded(a).map(Arc::new)).collect::<Option<_>>()?;
+    Some(std::borrow::Cow::Owned(def))
+}
+
+/// Pattern `def` with each path in its art (opacity masks included) whose stroke has a brush that
+/// varies at random ([`draws_random_art`]) [`prepared`] where the pattern defines it: the brush
+/// takes its seed from the path's points, and the canvas draws the art there for every tile.
+fn random_brushes_baked<'a>(
+    d: &mut Document,
+    brushes: &[vectorcraft_brush::Brush],
+    def: std::borrow::Cow<'a, PatternDef>,
+) -> std::borrow::Cow<'a, PatternDef> {
+    if !def.art.iter().any(|a| has_random_brush(brushes, a)) {
+        return def;
+    }
+    let mut def = def.into_owned();
+    def.art = def.art.iter().map(|a| Arc::new(bake_random_brushes(d, brushes, a))).collect();
+    std::borrow::Cow::Owned(def)
+}
+
+/// Does brush `name` of `brushes` draw different art for different points: a calligraphic or
+/// scatter brush with Random variation, or a bristle brush?
+fn draws_random_art(brushes: &[vectorcraft_brush::Brush], name: &str) -> bool {
+    use vectorcraft_brush::{BrushKind, Variation};
+    brushes.iter().find(|b| b.name == name).is_some_and(|b| match &b.kind {
+        BrushKind::Calligraphic(c) => c.modes().contains(&Variation::Random),
+        BrushKind::Scatter(s) => s.modes().contains(&Variation::Random),
+        BrushKind::Bristle(_) => true,
+        BrushKind::Art(_) | BrushKind::Pattern(_) => false,
+    })
+}
+
+/// Is `n` a path with a visible stroke whose brush varies at random ([`draws_random_art`])?
+fn random_brushed(brushes: &[vectorcraft_brush::Brush], n: &Node) -> bool {
+    let random = |st: &vectorcraft_doc::appearance::StrokeLayer| st.visible && st.brush.as_deref().is_some_and(|b| draws_random_art(brushes, b));
+    matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. })
+        && n.appearance.items.iter().any(|i| matches!(i, AppearanceItem::Stroke(st) if random(st)))
+}
+
+/// Does `n`, something in it or one of their opacity masks have a stroke whose brush varies at
+/// random ([`random_brushed`])?
+fn has_random_brush(brushes: &[vectorcraft_brush::Brush], n: &Node) -> bool {
+    random_brushed(brushes, n)
+        || n.extras().mask.as_ref().is_some_and(|m| has_random_brush(brushes, &m.art))
+        || (!matches!(n.kind, NodeKind::Compound { .. }) && n.children().is_some_and(|c| c.iter().any(|c| has_random_brush(brushes, c))))
+}
+
+/// `n` with the paths in it whose brush varies at random [`prepared`] ([`random_brushes_baked`]).
+fn bake_random_brushes(d: &mut Document, brushes: &[vectorcraft_brush::Brush], n: &Node) -> Node {
+    if !has_random_brush(brushes, n) {
+        return n.clone();
+    }
+    if random_brushed(brushes, n) {
+        return prepared(d, brushes, n);
+    }
+    let mut n = n.clone();
+    if !matches!(n.kind, NodeKind::Compound { .. }) {
+        for c in n.children_mut().into_iter().flatten() {
+            *c = Arc::new(bake_random_brushes(d, brushes, c));
+        }
+    }
+    if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        m.art = Arc::new(bake_random_brushes(d, brushes, &m.art));
+    }
+    n
+}
+
+/// Does `n`, something in it or one of their opacity masks have a visible geometry effect?
+fn has_geometry_effects(n: &Node) -> bool {
+    let geometry = |e: &vectorcraft_doc::Effect| e.visible && vectorcraft_render::effects::is_geometry(&e.id);
+    n.appearance.effects.iter().any(geometry)
+        || n.appearance.items.iter().any(|i| i.effects().iter().any(geometry))
+        || n.extras().mask.as_ref().is_some_and(|m| has_geometry_effects(&m.art))
+        || n.children().is_some_and(|c| c.iter().any(|c| has_geometry_effects(c)))
+}
+
+/// Does `n`, something in it or one of their opacity masks hold a symbol instance?
+fn has_instances(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::SymbolInstance { .. })
+        || n.extras().mask.as_ref().is_some_and(|m| has_instances(&m.art))
+        || n.children().is_some_and(|c| c.iter().any(|c| has_instances(c)))
+}
+
+/// Does `a` only move (no scale, turn, flip, stretch or shear)?
+fn moves_only(a: Affine) -> bool {
+    let [m0, m1, m2, m3, _, _] = a.as_coeffs();
+    let eps = 1e-9;
+    (m0 - 1.0).abs() <= eps && m1.abs() <= eps && m2.abs() <= eps && (m3 - 1.0).abs() <= eps
+}
+
+/// Does `n` have a visible Transform effect with Random on, its own or a fill's or stroke's?
+fn seeded_here(n: &Node) -> bool {
+    let seeded =
+        |e: &vectorcraft_doc::Effect| e.visible && e.id == "distort.transform" && e.params.get("random").and_then(Value::as_bool) == Some(true);
+    n.appearance.effects.iter().any(seeded) || n.appearance.items.iter().any(|i| i.effects().iter().any(seeded))
+}
+
+/// Does `n`, something in it or one of their opacity masks have a random Transform effect
+/// ([`seeded_here`])?
+fn has_seeded(n: &Node) -> bool {
+    seeded_here(n)
+        || n.extras().mask.as_ref().is_some_and(|m| has_seeded(&m.art))
+        || (!matches!(n.kind, NodeKind::Compound { .. }) && n.children().is_some_and(|c| c.iter().any(|c| has_seeded(c))))
+}
+
+/// `n` with the paths in it that have a random Transform effect baked ([`seeds_baked`]). `None`
+/// when something else has one.
+fn bake_seeded(n: &Node) -> Option<Node> {
+    if !has_seeded(n) {
+        return Some(n.clone());
+    }
+    let mut n = if seeded_here(n) {
+        if !matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. }) {
+            return None;
+        }
+        vectorcraft_render::effects::bake_appearance(n)?
+    } else {
+        n.clone()
+    };
+    if !matches!(n.kind, NodeKind::Compound { .. }) {
+        for c in n.children_mut().into_iter().flatten() {
+            *c = Arc::new(bake_seeded(c)?);
+        }
+    }
+    if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        m.art = Arc::new(bake_seeded(&m.art)?);
+    }
+    Some(n)
+}
+
+/// Does `n`, something in it or one of their opacity masks have a visible effect that [`prepared`]
+/// cannot bake: a raster or 3D effect, or a geometry effect on something other than a path?
+fn has_unbakeable_effects(n: &Node) -> bool {
+    use vectorcraft_render::effects::{is_geometry, is_raster, is_three_d};
+    let path = matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. });
+    let unbakeable = |e: &vectorcraft_doc::Effect| e.visible && (is_raster(&e.id) || is_three_d(&e.id) || (!path && is_geometry(&e.id)));
+    n.appearance.effects.iter().any(unbakeable)
+        || n.appearance.items.iter().any(|i| i.effects().iter().any(unbakeable))
+        || n.extras().mask.as_ref().is_some_and(|m| has_unbakeable_effects(&m.art))
+        || n.children().is_some_and(|c| c.iter().any(|c| has_unbakeable_effects(c)))
+}
+
+/// Tile art `n` ready for a turn, flip, stretch or shear: the strokes and geometry effects of its
+/// paths baked ([`baked`], [`outline_brushed`]) and its live shapes turned into plain paths (a
+/// stretch would rebuild their corners round), in its opacity masks too.
+fn prepared(d: &mut Document, brushes: &[vectorcraft_brush::Brush], n: &Node) -> Node {
+    let mut t = baked(n);
+    outline_brushed(d, brushes, &mut t);
+    drop_live(&mut t);
+    prepare_masks(d, brushes, &mut t);
+    t
+}
+
+/// The opacity masks of `n` and of everything in it [`prepared`].
+fn prepare_masks(d: &mut Document, brushes: &[vectorcraft_brush::Brush], n: &mut Node) {
+    if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        m.art = Arc::new(prepared(d, brushes, &m.art));
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        prepare_masks(d, brushes, Arc::make_mut(c));
+    }
+}
+
+/// `n` with each path in it that has a brushed stroke turned into filled art and brush art
+/// ([`outline_strokes`]).
+fn outline_brushed(d: &mut Document, brushes: &[vectorcraft_brush::Brush], n: &mut Node) {
+    if matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. }) {
+        let brushed = n.appearance.items.iter().any(|i| matches!(i, AppearanceItem::Stroke(st) if st.brush.is_some()));
+        if brushed && let Some(o) = outline_strokes(d, brushes, n) {
+            *n = o;
+        }
+        return;
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        outline_brushed(d, brushes, Arc::make_mut(c));
+    }
+}
+
+/// Is `a` a move and a positive uniform scale (which brush nibs, strokes and effects follow by
+/// scaling alone)?
+fn scales_evenly(a: Affine) -> bool {
+    let [m0, m1, m2, m3, _, _] = a.as_coeffs();
+    let eps = 1e-9 * m0.abs().max(m3.abs());
+    m0 > 0.0 && m1.abs() <= eps && m2.abs() <= eps && (m0 - m3).abs() <= eps
+}
+
+/// `n` with the strokes and geometry effects of each path in it baked into filled art
+/// ([`bake_appearance`](vectorcraft_render::effects::bake_appearance)).
+fn baked(n: &Node) -> Node {
+    if let Some(b) = vectorcraft_render::effects::bake_appearance(n) {
+        return b;
+    }
+    let mut n = n.clone();
+    for c in n.children_mut().into_iter().flatten() {
+        *c = Arc::new(baked(c));
+    }
+    n
+}
+
+/// Pattern tiles `tiles` of fill `f` of path `l` as a clip group shaped like `l` that isolates
+/// their blending (as the canvas draws a tile on its own), with the fill's opacity, blend mode and
+/// effects other than geometry effects ([`fill_effects`]).
+fn tile_art(d: &mut Document, l: &Node, f: &FillLayer, tiles: &[Node]) -> Option<Node> {
+    let mut clip = styled_copy(d, l, vec![]);
+    as_clipping_path(&mut clip).ok()?;
+    let tiles: Vec<Node> = tiles.iter().map(|t| d.reid(t)).collect();
+    let children = std::iter::once(clip).chain(tiles).map(Arc::new).collect();
+    let mut art = Node::new(d.alloc_id(), NodeKind::Group { children, clip: true });
+    art.isolate = true;
+    let mut art = with_transparency(d, art, f.opacity, f.blend);
+    art.appearance.effects = fill_effects(f);
     Some(art)
 }
 
 /// The colour and opacity gradient fill `g` paints at a document point of an object whose box is
 /// `bounds`, as the canvas draws it (the end colours continue past the ends). Colours stay in the
-/// colour model their stops (or freeform points) share; display RGB where models differ.
-pub(crate) fn gradient_sampler(g: &GradientPaint, bounds: Rect) -> Box<dyn Fn(Point) -> (Color, f32) + '_> {
+/// color model their stops share; display RGB where models differ. Freeform points mix in the
+/// model they share ([`vectorcraft_color::Freeform::model_field`]); where their models differ, the
+/// RGB color they mix to is stored in `doc_model` (the document's model) the way `paint.setFill`
+/// stores an RGB color ([`super::paint::stored_color`]).
+pub(crate) fn gradient_sampler(g: &GradientPaint, bounds: Rect, doc_model: Model) -> Box<dyn Fn(Point) -> (Color, f32) + '_> {
     if g.gradient.kind == GradientKind::Freeform {
         let b = bounds.abs();
-        let f = g.freeform_on(b);
-        let model = shared_model(f.points.iter().map(|p| p.color));
-        let field = f.field(spread_scale(b));
+        let field = g.freeform_on(b).model_field(spread_scale(b));
+        let store_in = (field.model().is_none() && doc_model != Model::Rgb).then_some(doc_model);
         return Box::new(move |p| {
-            let ([r, g, b], a) = field.sample(p);
-            let c = Color::rgb(r, g, b);
-            (model.map_or(c, |m| c.in_model(m)), a)
+            let (c, a) = field.sample(p);
+            (super::paint::stored_color(store_in, c), a)
         });
     }
     let geom = g.resolve(bounds);
     Box::new(move |p| g.gradient.sample_with(geom.param_at(g.gradient.kind, p) as f32, lerp_color))
 }
 
-/// The colour model all of `colors` share.
-fn shared_model(mut colors: impl Iterator<Item = Color>) -> Option<Model> {
-    let m = colors.next()?.model();
-    colors.all(|c| c.model() == m).then_some(m)
-}
-
 /// Where the colour changes along a gradient between parameters `t0` and `t1`: both ends, every
 /// stop between them (in its own colour, so coincident stops keep a sharp edge) and every midpoint
 /// off the centre, as (parameter, colour, opacity) in order, with more between them where they

crates/engine/src/cmd/fileio/action_batch.rs

@@ -127,6 +127,9 @@ fn batch_folder(s: &mut Session, cmd: &str, p: &Value, override_open: bool, run:
 
 #[cfg(not(target_arch = "wasm32"))]
 fn batch_datasets(s: &mut Session, cmd: &str, run: &Run<'_>) -> Result<Value> {
+    use super::distinct_names;
+    use super::screens::file_part;
+
     let st = s.doc()?;
     let names: Vec<String> = st.doc.variables.datasets.iter().map(|d| d.name.clone()).collect();
     if names.is_empty() {
@@ -136,12 +139,17 @@ fn batch_datasets(s: &mut Session, cmd: &str, run: &Run<'_>) -> Result<Value> {
         return Err(bad(cmd, format!("more than {MAX_BATCH_FILES} data sets")));
     }
     let doc_stem = st.path.as_deref().and_then(|p| std::path::Path::new(p).file_stem().and_then(|s| s.to_str())).unwrap_or("Untitled").to_string();
+    // Data set files are named File + Data Set Name (helpx, for Override Save/Export; the folder
+    // destination uses the same name). `file_part` writes the characters Windows does not allow in a
+    // file name (`/`, `\`, `:`, `<`, `>`, `"`, `|`, `?`, `*` and control characters) in the data set's
+    // name as `-`, and `distinct_names` adds `-2`, `-3`… to a name an earlier data set used.
+    let stems = distinct_names(names.iter().map(|name| format!("{doc_stem}_{}", file_part(name))));
     let steps = filter_steps(run.steps, true, false);
     let run = Run { steps: &steps, ..*run };
     let mut processed = Vec::new();
     let mut failed = 0usize;
-    for name in &names {
-        match process_one_dataset(s, &run, name, &doc_stem) {
+    for (name, stem) in names.iter().zip(&stems) {
+        match process_one_dataset(s, &run, name, stem) {
             Ok(row) => processed.push(row),
             Err(e) => {
                 failed += 1;
@@ -184,14 +192,12 @@ fn process_one_file(s: &mut Session, run: &Run<'_>, path: &str, stem: &str, ext:
 }
 
 #[cfg(not(target_arch = "wasm32"))]
-fn process_one_dataset(s: &mut Session, run: &Run<'_>, name: &str, doc_stem: &str) -> Result<Value> {
+fn process_one_dataset(s: &mut Session, run: &Run<'_>, name: &str, stem: &str) -> Result<Value> {
     s.execute("dataset.select", &json!({"name": name}))?;
-    // File + Data Set Name naming when overriding Save/Export (helpx).
-    let stem = format!("{doc_stem}_{name}");
-    let rewritten = rewrite_paths(run.steps, run.override_save, run.override_export, run.dest_folder, &stem, "vectorcraft");
+    let rewritten = rewrite_paths(run.steps, run.override_save, run.override_export, run.dest_folder, stem, "vectorcraft");
     let batch = s.execute("command.batch", &json!({"label": run.label, "commands": rewritten}))?;
     // Data sets share one open document: write each row out but leave it open for the next.
-    finish_destination(s, run, &stem, "vectorcraft", "", false)?;
+    finish_destination(s, run, stem, "vectorcraft", "", false)?;
     Ok(json!({"dataset": name, "result": batch}))
 }
 
@@ -241,7 +247,8 @@ fn write_result(s: &mut Session, path: &str, ext: &str, as_copy: bool) -> Result
     Ok(())
 }
 
-/// Point Save / Export steps at `dest_folder/{stem}.{ext}` when overrides are on.
+/// Point Save / Export steps at `dest_folder/{stem}.{ext}` when overrides are on: `ext` is the
+/// extension of the step's `format` ([`format_extension`]), else `default_ext`.
 #[cfg(not(target_arch = "wasm32"))]
 fn rewrite_paths(
     steps: &[Value],
@@ -266,8 +273,10 @@ fn rewrite_paths(
             }
             let params = c.get("params").cloned().unwrap_or(json!({}));
             let mut params = params.as_object().cloned().unwrap_or_default();
-            let ext = params.get("format").and_then(Value::as_str).unwrap_or(default_ext);
-            let ext = if ext.is_empty() { default_ext } else { ext };
+            let ext = match params.get("format").and_then(Value::as_str).filter(|f| !f.is_empty()) {
+                Some(f) => format_extension(f),
+                None => default_ext.to_string(),
+            };
             let file = std::path::Path::new(folder).join(format!("{stem}.{ext}"));
             params.insert("path".into(), json!(file.to_string_lossy()));
             if let Some(o) = c.as_object_mut() {
@@ -278,6 +287,21 @@ fn rewrite_paths(
         .collect()
 }
 
+/// The extension of the file a step writes in `format` (an id or extension, as [`super::format`]
+/// reads it: any case, a leading dot allowed): the extension as written, in lower case and without
+/// the dot, when it is one of the format's (`SVG` → `svg`, `.JPEG` → `jpeg`), else the format's
+/// first (`png8` → `png`, `template` → `vctemplate`). An unknown format (`xyz`) keeps its spelling,
+/// and the step fails with its command's error.
+#[cfg(not(target_arch = "wasm32"))]
+fn format_extension(format: &str) -> String {
+    let written = format.trim_start_matches('.').to_ascii_lowercase();
+    match super::format(format) {
+        Some(f) if f.extensions.contains(&written.as_str()) => written,
+        Some(f) => f.extensions.first().map_or(written, |e| (*e).to_string()),
+        None => format.to_string(),
+    }
+}
+
 /// Readable files under `folder` (and optionally its subfolders), capped.
 #[cfg(not(target_arch = "wasm32"))]
 fn collect_files(folder: &str, include_subdirs: bool, depth: usize) -> Result<Vec<String>> {
@@ -405,6 +429,70 @@ mod tests {
         assert!(dest.join("only.svg").is_file());
     }
 
+    /// Override Export names each file with the extension of the format the step names, however
+    /// the step spells it; a format given by one of its extensions keeps that extension.
+    #[test]
+    fn batch_override_export_names_files_with_the_format_s_extension() {
+        let src = tmp("ext-src");
+        write_svg(&src, "a.svg", "#f00");
+        let cases = [(".svg", "a.svg"), ("SVG", "a.svg"), ("svg", "a.svg"), ("png8", "a.png"), ("template", "a.vctemplate"), (".JPEG", "a.jpeg")];
+        for (i, (format, want)) in cases.into_iter().enumerate() {
+            let dest = tmp(&format!("ext-out-{i}"));
+            let mut s = Session::new();
+            let r = s
+                .execute(
+                    "action.batch",
+                    &json!({
+                        "folder": src.to_string_lossy(),
+                        "destinationFolder": dest.to_string_lossy(),
+                        "commands": [{"command": "document.export", "params": {"format": format}}]
+                    }),
+                )
+                .unwrap();
+            assert_eq!(r["failed"], 0, "{format}: {r}");
+            assert_eq!(file_names(&dest), [want], "{format}: {r}");
+        }
+        // An unknown format keeps its spelling, and the step fails with the export's error.
+        let dest = tmp("ext-out-unknown");
+        let mut s = Session::new();
+        let r = s
+            .execute(
+                "action.batch",
+                &json!({
+                    "folder": src.to_string_lossy(),
+                    "destinationFolder": dest.to_string_lossy(),
+                    "commands": [{"command": "document.export", "params": {"format": "xyz"}}]
+                }),
+            )
+            .unwrap();
+        assert_eq!(r["failed"], 1, "{r}");
+        assert!(r["processed"][0]["error"].as_str().is_some_and(|e| e.contains("unknown format `xyz`")), "{r}");
+        assert!(file_names(&dest).is_empty(), "{r}");
+    }
+
+    /// Override Save names each file with the extension of the format the step names, also over
+    /// data sets.
+    #[test]
+    fn batch_override_save_names_files_with_the_format_s_extension() {
+        for (i, format) in [".svg", "SVG", ".PDF"].into_iter().enumerate() {
+            let dest = tmp(&format!("ext-save-{i}"));
+            let mut s = with_data_sets(&["a"]);
+            let r = s
+                .execute(
+                    "action.batch",
+                    &json!({
+                        "source": "datasets",
+                        "destinationFolder": dest.to_string_lossy(),
+                        "commands": [{"command": "file.saveAs", "params": {"format": format}}]
+                    }),
+                )
+                .unwrap();
+            assert_eq!(r["failed"], 0, "{format}: {r}");
+            let want = format!("Untitled_a.{}", format.trim_start_matches('.').to_ascii_lowercase());
+            assert_eq!(file_names(&dest), [want], "{format}: {r}");
+        }
+    }
+
     #[test]
     fn batch_datasets_applies_each_row() {
         let dest = tmp("sets");
@@ -434,6 +522,128 @@ mod tests {
         assert_eq!(written.len(), 2, "{written:?}");
     }
 
+    /// The names of the files in `dir`, sorted.
+    fn file_names(dir: &std::path::Path) -> Vec<String> {
+        let mut names: Vec<String> =
+            std::fs::read_dir(dir).unwrap().filter_map(|e| e.ok()).map(|e| e.file_name().to_string_lossy().into_owned()).collect();
+        names.sort();
+        names
+    }
+
+    /// A new document with an empty data set for each of `names`.
+    fn with_data_sets(names: &[&str]) -> Session {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 100, "height": 80})).unwrap();
+        for name in names {
+            s.execute("dataset.new", &json!({"name": name})).unwrap();
+        }
+        s
+    }
+
+    #[test]
+    fn batch_keeps_data_set_files_inside_the_destination_folder() {
+        let root = tmp("set-names-root");
+        let dest = root.join("out");
+        // The folder that `a/../../x` would pass through on its way out of `out`.
+        std::fs::create_dir_all(dest.join("Untitled_a")).unwrap();
+        let mut s = with_data_sets(&["a/../../x", "../y"]);
+        let r = s
+            .execute(
+                "action.batch",
+                &json!({
+                    "source": "datasets",
+                    "destination": "folder",
+                    "destinationFolder": dest.to_string_lossy(),
+                    "stopOnError": false,
+                    "commands": [{"command": "object.unlockAll", "params": {}}]
+                }),
+            )
+            .unwrap();
+        assert_eq!(r["failed"], 0, "{r}");
+        assert_eq!(file_names(&dest), ["Untitled_..-y.vectorcraft", "Untitled_a", "Untitled_a-..-..-x.vectorcraft"], "{r}");
+        assert_eq!(file_names(&root), ["out"], "nothing is written outside the destination folder");
+    }
+
+    #[test]
+    fn batch_saves_data_sets_named_with_separators() {
+        let dest = tmp("set-names-sep");
+        let exports = tmp("set-names-sep-export");
+        let mut s = with_data_sets(&["a/b", "c\\d", "e:f"]);
+        let r = s
+            .execute(
+                "action.batch",
+                &json!({
+                    "source": "datasets",
+                    "destination": "folder",
+                    "destinationFolder": dest.to_string_lossy(),
+                    "stopOnError": false,
+                    "commands": [{"command": "object.unlockAll", "params": {}}]
+                }),
+            )
+            .unwrap();
+        assert_eq!(r["failed"], 0, "{r}");
+        assert_eq!(file_names(&dest), ["Untitled_a-b.vectorcraft", "Untitled_c-d.vectorcraft", "Untitled_e-f.vectorcraft"], "{r}");
+        // Override Export points each data set's export at the destination folder under the same name.
+        let r = s
+            .execute(
+                "action.batch",
+                &json!({
+                    "source": "datasets",
+                    "destinationFolder": exports.to_string_lossy(),
+                    "stopOnError": false,
+                    "commands": [{"command": "document.export", "params": {"format": "svg"}}]
+                }),
+            )
+            .unwrap();
+        assert_eq!(r["failed"], 0, "{r}");
+        assert_eq!(file_names(&exports), ["Untitled_a-b.svg", "Untitled_c-d.svg", "Untitled_e-f.svg"], "{r}");
+    }
+
+    /// Windows does not allow `<`, `>`, `"`, `|`, `?`, `*` or control characters in a file name:
+    /// Batch writes them as `-` in a data set's name, on every platform.
+    #[test]
+    fn batch_saves_data_sets_named_with_characters_windows_does_not_allow() {
+        let dest = tmp("set-names-win");
+        let mut s = with_data_sets(&["a?b", "c*d<e>", "f\"g|h", "i\u{7}j"]);
+        let r = s
+            .execute(
+                "action.batch",
+                &json!({
+                    "source": "datasets",
+                    "destination": "folder",
+                    "destinationFolder": dest.to_string_lossy(),
+                    "stopOnError": false,
+                    "commands": [{"command": "object.unlockAll", "params": {}}]
+                }),
+            )
+            .unwrap();
+        assert_eq!(r["failed"], 0, "{r}");
+        assert_eq!(
+            file_names(&dest),
+            ["Untitled_a-b.vectorcraft", "Untitled_c-d-e-.vectorcraft", "Untitled_f-g-h.vectorcraft", "Untitled_i-j.vectorcraft"],
+            "{r}"
+        );
+    }
+
+    #[test]
+    fn batch_gives_each_data_set_a_file_of_its_own() {
+        let dest = tmp("set-names-same");
+        let mut s = with_data_sets(&["a:b", "a-b", "A-B"]);
+        let r = s
+            .execute(
+                "action.batch",
+                &json!({
+                    "source": "datasets",
+                    "destination": "folder",
+                    "destinationFolder": dest.to_string_lossy(),
+                    "commands": [{"command": "object.unlockAll", "params": {}}]
+                }),
+            )
+            .unwrap();
+        assert_eq!(r["failed"], 0, "{r}");
+        assert_eq!(file_names(&dest), ["Untitled_A-B-3.vectorcraft", "Untitled_a-b-2.vectorcraft", "Untitled_a-b.vectorcraft"], "{r}");
+    }
+
     #[test]
     fn batch_refuses_nesting_and_empty_commands() {
         let mut s = Session::new();

crates/engine/src/cmd/fileio/batch.rs

@@ -99,7 +99,7 @@ fn run_steps(s: &mut Session, label: &str, artboard: Option<u64>, cmds: &mut [Va
 /// ones close, closed or replaced ones (`stash`) come back, and each has its art, selection,
 /// history, file, format and saved state again (#1697: undoing the batch's interaction alone left
 /// a Save As step's new file and an Undo step's history in place). Files the steps wrote stay
-/// written.
+/// written. Lock Guides stays as the steps left it, and while it is on the guides are deselected.
 fn roll_back(s: &mut Session, start: Vec<DocState>, stash: &[DocState]) {
     let open = std::mem::take(&mut s.docs);
     s.docs = start;
@@ -107,5 +107,8 @@ fn roll_back(s: &mut Session, start: Vec<DocState>, stash: &[DocState]) {
         // Past the newest revision the document reached, so the restored one redraws.
         let newest = open.iter().chain(stash).filter(|d| d.uid == st.uid).map(|d| d.revision).max().unwrap_or(st.revision);
         st.revision = newest.saturating_add(1);
+        if s.menu.guides_locked {
+            crate::deselect_guides(&st.doc, &mut st.selection);
+        }
     }
 }

crates/engine/src/cmd/fileio/encode.rs

@@ -385,7 +385,7 @@ pub fn encode(doc: &Document, format: &str, p: &Value) -> Result<Vec<u8>> {
 
 /// Like [`encode`], also returning the encoder's warnings (PDF and SVG: options not applied yet,
 /// features approximated or left out; every format that draws type: fonts written in the fallback
-/// font).
+/// font; PDF, EPS, SVG, EMF, WMF and the raster formats: type that doesn't fit its frame).
 pub fn encode_with_warnings(doc: &Document, format: &str, p: &Value) -> Result<(Vec<u8>, Vec<String>)> {
     let f = super::writable(C, Some(format), None)?;
     encode_all(doc, f.id, p)?.single(f)
@@ -413,10 +413,14 @@ fn encode_all_of(doc: &Document, format: &str, p: &Value) -> Result<Encoded> {
     let f = super::writable(C, Some(format), None)?;
     let failed = vectorcraft_render::decode_failures();
     let mut enc = encode_files(doc, f, p)?;
+    // Baking, flattening and drawing stop early when cancelled and leave a truncated result.
+    vectorcraft_doc::cancel::check()?;
     // An image the renderer couldn't decode draws nothing: say so rather than write a picture
     // that silently lacks it.
-    if f.raster && vectorcraft_render::decode_failures() > failed {
-        enc.warnings.push("an image couldn't be decoded and is missing from the picture".into());
+    if f.raster
+        && let Some(w) = crate::cmd::rasterfx::undecoded_warning(failed)
+    {
+        enc.warnings.push(w.into());
     }
     // Formats that draw type: missing fonts come out in the fallback font (PDF and SVG say so
     // themselves: SVG only when it outlines or embeds fonts).
@@ -502,7 +506,10 @@ fn encode_files(doc: &Document, f: &Format, p: &Value) -> Result<Encoded> {
             };
             let mut enc = Encoded::default();
             let mut renderer = vectorcraft_render::Renderer::new();
-            for b in chosen {
+            let total = chosen.len() as u64;
+            for (done, b) in chosen.into_iter().enumerate() {
+                vectorcraft_doc::cancel::check()?;
+                vectorcraft_doc::cancel::progress(done as u64, total, &format!("Rendering artboard {} of {total}", done + 1));
                 let region = doc.artboards.get(b).ok_or_else(|| bad(C, format!("no artboard {}", b + 1)))?.rect;
                 check_format_size(f, region.width() * scale, region.height() * scale)?;
                 vectorcraft_render::raster_size(region, scale).map_err(|e| bad(C, e))?;
@@ -522,6 +529,8 @@ fn encode_files(doc: &Document, f: &Format, p: &Value) -> Result<Encoded> {
             if enc.files.is_empty() {
                 return Err(bad(C, "the document has no artboard"));
             }
+            let regions: Vec<Rect> = enc.files.iter().filter_map(|(b, _)| b.and_then(|b| doc.artboards.get(b))).map(|a| a.rect).collect();
+            enc.warnings.extend(crate::cmd::fonts::export_overflow_warning(doc, &doc.layers, Some(&regions)));
             if format == RasterFormat::WebP && o.lossless == Some(false) {
                 enc.warnings.push("lossy WebP isn't available yet: the file is lossless (exact, but larger)".into());
             }

crates/engine/src/cmd/fileio/eps.rs

@@ -270,6 +270,7 @@ pub(super) fn encode(doc: &Document, p: &Value) -> Result<Encoded> {
     if pages.is_empty() {
         return Err(bad(C, "the document has no artboard"));
     }
+    let regions: Vec<Rect> = pages.iter().map(|(_, region, _)| *region).collect();
     let transparent = doc.layers.iter().any(|l| l.shows_transparency());
     let flat = flatten_document(doc, &set.flatten)?;
     let drawn = flat.as_ref().unwrap_or(doc);
@@ -302,6 +303,7 @@ pub(super) fn encode(doc: &Document, p: &Value) -> Result<Encoded> {
             }
         }
     }
+    enc.warnings.extend(crate::cmd::fonts::export_overflow_warning(doc, &doc.layers, Some(&regions)));
     Ok(enc)
 }
 

crates/engine/src/cmd/fileio/export.rs

@@ -12,8 +12,7 @@ use crate::DocState;
 use super::super::*;
 use super::encode::single_artboard;
 use super::{
-    ARTBOARD_PARAMS, Format, default_name, encode, encode_all, encode_with_warnings, merge, with_black_output, writable, write_encoded,
-    write_or_return,
+    ARTBOARD_PARAMS, Format, default_name, encode_all, encode_with_warnings, merge, with_black_output, writable, write_encoded, write_or_return,
 };
 
 pub(super) fn serialize(s: &mut Session, p: &Value) -> Result<Value> {
@@ -173,7 +172,7 @@ fn selection(s: &mut Session, cmd: &str) -> Result<(Document, vectorcraft_geom::
 
 /// The selected objects (their top-most selected ancestors) that are artwork: those on template
 /// layers are guides and are left out.
-pub(crate) fn selected_artwork(s: &mut Session) -> Result<Vec<NodeId>> {
+pub(crate) fn selected_artwork(s: &Session) -> Result<Vec<NodeId>> {
     let ids = edit::selected_roots(s)?;
     let st = s.doc()?;
     let is_template = |id| st.doc.node(id).is_some_and(|l| matches!(l.kind, NodeKind::Layer { template: true, .. }));
@@ -224,7 +223,7 @@ pub(super) fn export_selection(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 /// File → Save for Office Documents: one artboard as a PNG at `ppi`, on white unless
-/// `transparent`.
+/// `transparent`, with the encoder's warnings.
 pub(super) fn export_for_office(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "document.exportForOffice";
     if let Some(path) = str_param(p, "path") {
@@ -242,8 +241,8 @@ pub(super) fn export_for_office(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let background = if bool_or(p, "transparent", false) { "transparent" } else { "white" };
     let opts = with_black_output(s, &json!({ "ppi": ppi, "background": background, "artboard": artboard }));
-    let bytes = encode(doc, "png", &opts)?;
+    let (bytes, warnings) = encode_with_warnings(doc, "png", &opts)?;
     // The pixel size, from the PNG header.
     let side = |at: usize| bytes.get(at..at + 4).and_then(|b| b.try_into().ok()).map_or(0, u32::from_be_bytes);
-    write_or_return(path, &bytes, json!({ "width": side(16), "height": side(20) }))
+    write_or_return(path, &bytes, json!({ "width": side(16), "height": side(20), "warnings": warnings }))
 }

crates/engine/src/cmd/fileio/legacy_ai.rs

@@ -15,7 +15,9 @@
 //! blending mode written opaque is a box hiding the art under it (version 7 images have no alpha
 //! channel, §8.1). With `flatten` (the default) each becomes an opaque image of itself and the art
 //! under it, rendered from the document as it is, clipped to the area where it changes what shows;
-//! the art under it stays as it was. With `omit` they are left out.
+//! the art under it stays as it was. With `omit` they are left out. An image that can't be decoded
+//! is missing from the images that flattening and expanding raster effects draw, and the warnings
+//! then carry the raster exports' note once.
 //!
 //! The format can't hide objects, only layers (`hiddenObjects`): with `layer` (the default) each
 //! layer's hidden objects go to a hidden layer of their own just above it, with `omit` they are
@@ -33,15 +35,20 @@ use vectorcraft_geom::{Anchor, FillRule, PathData, Point, Rect, SubPath};
 use super::super::*;
 use super::{ArtboardPick, Encoded, Format};
 
-/// Does `p` ask for a legacy `.ai` file of version 7 (`aiVersion: "7"`)? An unknown version is an error.
-pub(super) fn wanted(cmd: &str, p: &Value) -> Result<bool> {
-    match p.get("aiVersion") {
-        None | Some(Value::Null) => Ok(false),
-        Some(Value::String(v)) if v.trim().is_empty() || v.eq_ignore_ascii_case("pdf") => Ok(false),
-        Some(Value::String(v)) if v.trim() == "7" => Ok(true),
-        Some(Value::Number(n)) if n.as_f64() == Some(7.0) => Ok(true),
-        Some(v) => Err(bad(cmd, format!("aiVersion {v}: \"pdf\" (PDF-compatible, the default) or \"7\" (legacy .ai, version 7)"))),
+/// Does `p` ask a save in `f` for a legacy `.ai` file of version 7 (`aiVersion: "7"`)? An unknown
+/// version is an error, and so is version 7 for a `.ait` template, which is PDF-compatible only.
+pub(super) fn wanted(cmd: &str, f: &Format, p: &Value) -> Result<bool> {
+    let legacy = match p.get("aiVersion") {
+        None | Some(Value::Null) => false,
+        Some(Value::String(v)) if v.trim().is_empty() || v.eq_ignore_ascii_case("pdf") => false,
+        Some(Value::String(v)) if v.trim() == "7" => true,
+        Some(Value::Number(n)) if n.as_f64() == Some(7.0) => true,
+        Some(v) => return Err(bad(cmd, format!("aiVersion {v}: \"pdf\" (PDF-compatible, the default) or \"7\" (legacy .ai, version 7)"))),
+    };
+    if legacy && f.id == "ait" {
+        return Err(bad(cmd, "aiVersion 7 writes legacy .ai files; a .ait template is always PDF-compatible"));
     }
+    Ok(legacy)
 }
 
 /// What a legacy `.ai` does with the images it can't hold (`transparentImages`).
@@ -104,6 +111,7 @@ pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result
         enc.warnings.push(SEPARATE.to_string());
     }
     let created = vectorcraft_doc::metadata::now_unix();
+    let failed = vectorcraft_render::decode_failures();
     for b in boards {
         let one = super::save::artboard_doc(doc, b);
         let (full, placed) = crate::cmd::place::document::full_documents(&one);
@@ -127,6 +135,11 @@ pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result
         }
         enc.files.push((Some(b), out.bytes));
     }
+    // Expanding raster effects and flattening images draw the art, and an image the renderer
+    // couldn't decode drew nothing there.
+    if let Some(w) = super::super::rasterfx::undecoded_warning(failed) {
+        note(&mut enc.warnings, w);
+    }
     Ok(enc)
 }
 

crates/engine/src/cmd/fileio/load.rs

@@ -76,9 +76,10 @@ pub fn detect(name: &str, bytes: &[u8]) -> Option<&'static Format> {
         return format("svgz");
     }
     if vectorcraft_pdf::is_postscript(bytes) {
-        // PostScript (.eps, and .ai saved without PDF compatibility) by any name; .ai and .ait
-        // keep their meaning (a template), read as PostScript all the same.
-        return by_name.filter(|f| matches!(f.id, "ai" | "ait")).or_else(|| format("eps"));
+        // PostScript (.eps, .ps, and .ai saved without PDF compatibility) by any name; .ai, .ait
+        // and .ps keep their meaning (a template, a PostScript file), read as PostScript all the
+        // same.
+        return by_name.filter(|f| matches!(f.id, "ai" | "ait" | "ps")).or_else(|| format("eps"));
     }
     if bytes.starts_with(b"%PDF") {
         // .ai and .ait files are PDF inside; the extension keeps the template meaning.
@@ -167,6 +168,12 @@ fn through_editing_data(bytes: &[u8], opts: &LoadOptions, doc: Document, warning
     if !read {
         return (doc, warnings);
     }
+    // The layers' text objects hold type and the stroked paths around it, which can include stroked
+    // glyphs the PDF part kept as outlines: without any such glyph in the document, the warnings on
+    // outlines are dropped.
+    if !vectorcraft_pdf::holds_outlines(&doc) {
+        warnings.retain(|w| !vectorcraft_pdf::is_outlines_note(w));
+    }
     // The layers hold the art that the PDF part leaves out or, in a PDF, that the import clipped
     // to the page.
     warnings.retain(|w| w != vectorcraft_pdf::OFF_ARTBOARD_NOTE && w != vectorcraft_pdf::PAST_PAGE_NOTE);
@@ -197,8 +204,8 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
     let mut converted = false;
     let mut preview_only = false;
     let (mut doc, mut warnings, restored) = match format.id {
-        // EPS and PostScript .ai: the document our EPS files carry, else the PostScript read.
-        _ if format.id == "eps" || vectorcraft_pdf::is_postscript(bytes) => {
+        // EPS, .ps and PostScript .ai: the document our EPS files carry, else the PostScript read.
+        _ if matches!(format.id, "eps" | "ps") || vectorcraft_pdf::is_postscript(bytes) => {
             let editing = vectorcraft_eps::has_native(bytes).then_some((true, || vectorcraft_eps::native(bytes)));
             restore_or_import(editing, || {
                 let r = vectorcraft_eps::import_with(bytes, opts.editing_data).map_err(|e| err(format!("can't open `{}`: {e}", file_name(name))))?;
@@ -263,9 +270,13 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
     {
         super::super::fileinfo::read_pdf(&mut doc.metadata, info);
     }
-    // Threaded type read from a file flows through its frames.
+    // Threaded type read from a file flows through its frames (the threaded type of a restored
+    // document keeps its text as saved), and every frame of a thread takes its first frame's
+    // Optical Margin Alignment setting.
     if !doc.text_threads.is_empty() && !restored {
         crate::cmd::threads::reflow(&Document::new(1.0, 1.0), &mut doc);
+    } else if !doc.text_threads.is_empty() {
+        crate::cmd::threads::share_optical_margin(&mut doc);
     }
     if let Some(mode) = opts.color_mode.filter(|m| *m != doc.color_mode) {
         super::super::colormgmt::set_color_mode(&mut doc, mode, true, None, opts.grays);
@@ -286,8 +297,11 @@ pub(crate) fn import_svg(text: &str, folder: Option<&str>) -> Result<(Document,
     // The importer reads on a thread of its own (for its stack): what may be read is what may be
     // read here.
     let scope = crate::file_access::ScopeHandle::capture();
+    // Paths are checked as stored in a document inside `folder` (only the folder is used).
+    let document = folder.map(|f| std::path::Path::new(f).join("-").to_string_lossy().into_owned());
     let read = |path: &str| {
         scope.clone().run(|| {
+            let path = &super::document_path(path, document.as_deref()).ok()?;
             // Only files (not folders or devices) are read.
             file_stamp(path)?;
             let bytes = read_file(path).ok()?;
@@ -441,47 +455,88 @@ pub(super) fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
 /// that default: wasm32 has 4 GB to address and aborts when an allocation fails.
 pub(crate) use vectorcraft_doc::MAX_RASTER_ALLOC;
 
-/// What to say of encoded image `bytes` that need more than [`MAX_RASTER_ALLOC`] to decode (its
-/// header says so; the pixels aren't read): the renderer, which has the same allowance, draws
-/// nothing for them, so Open, Place and the Links panel say it (#1479). `None` for images that
-/// decode, and for bytes that aren't an image.
+/// What to say of encoded image `bytes` that need more than [`MAX_RASTER_ALLOC`] to decode,
+/// counted as RGBA (4 bytes a pixel) or as the decoder gives them when that is more (its header
+/// says so; the pixels aren't read): Open, Place and the Links panel say it (#1479). `None` for
+/// images within the allowance, and for bytes that aren't an image.
 pub(crate) fn too_large_note(bytes: &[u8]) -> Option<String> {
     use image::ImageDecoder as _;
+    if let Some((w, h)) = vectorcraft_doc::cmyk::oversized_tiff(bytes) {
+        return Some(format!("an image of {w} × {h} pixels is too large to draw"));
+    }
     let d = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?.into_decoder().ok()?;
     let (w, h) = d.dimensions();
-    (d.total_bytes() > MAX_RASTER_ALLOC).then(|| format!("an image of {w} × {h} pixels is too large to draw"))
+    // The allowance also counts the pixels as RGBA: an image of fewer than 4 bytes a pixel (gray,
+    // gray with alpha, RGB) takes more than the decoder counts (#1717).
+    let rgba_over = u64::from(w) * u64::from(h) > MAX_RASTER_ALLOC / 4;
+    (rgba_over || d.total_bytes() > MAX_RASTER_ALLOC).then(|| format!("an image of {w} × {h} pixels is too large to draw"))
 }
 
 /// Decode an image's header (and, for formats stored as PNG, its pixels). CMYK TIFFs are kept as
-/// they are, with their ink amounts ([`ImageBlob::cmyk`]); CMYK TIFFs with an alpha channel, which
-/// the decoder can't read, become RGBA in the active colour settings' CMYK, as do CMYK Photoshop
-/// documents, whose merged image is read ([`psdread`]). Grayscale TIFFs with an alpha channel or
-/// other extra channels, which the decoder can't read either, become RGBA too.
+/// they are, with their ink amounts ([`ImageBlob::cmyk`]), except that ones storing one plane per
+/// ink are written again with their inks together ([`vectorcraft_doc::cmyk::stored_cmyk_tiff`]);
+/// CMYK TIFFs with an alpha channel, which the decoder can't read, become RGBA in the active color
+/// settings' CMYK, as do CMYK Photoshop documents, whose merged image is read ([`psdread`]).
+/// 1-bit TIFFs compressed with CCITT Group 3, which the decoder can't read either, become RGBA
+/// too ([`vectorcraft_doc::cmyk::group3_tiff_rgba`]).
+/// Grayscale TIFFs with an alpha channel or other extra channels, which the decoder can't read
+/// either, become RGBA too, whether they store their channels together or one plane per channel.
+/// A Targa file, which starts with no signature, is recognized by its header
+/// ([`super::tgaread::is_targa`]) and becomes RGBA with the transparency it stores
+/// ([`super::tgaread::fix_alpha`]). An image stored as PNG whose decoded samples, or whose pixels
+/// as RGBA, need more than [`MAX_RASTER_ALLOC`] is refused as too large to draw.
+/// A TIFF with more strips or tiles than the decoder can count
+/// ([`vectorcraft_doc::cmyk::oversized_tiff`]) is refused as too large to draw.
 pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     let ppi = super::ppi::resolution(bytes);
+    if let Some((w, h)) = vectorcraft_doc::cmyk::oversized_tiff(bytes) {
+        return Err(err(format!("an image of {w} × {h} pixels is too large to draw")));
+    }
     if psdread::is_psd(bytes) {
         let cms = vectorcraft_color::cms::active();
         return as_png(psdread::decode(bytes, MAX_RASTER_ALLOC, |c| cms.cmyk_to_srgb(c, false)).map_err(err)?, ppi);
     }
     let mut reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(err)?;
+    if reader.format().is_none() && super::tgaread::is_targa(bytes) {
+        reader.set_format(image::ImageFormat::Tga);
+    }
     let mut limits = image::Limits::default();
     limits.max_alloc = Some(MAX_RASTER_ALLOC);
     reader.limits(limits);
     let kind = reader.format().ok_or_else(|| err("not an image VectorCraft reads (see document.formats)"))?;
     let f = image_format(kind).ok_or_else(|| err(format!("{kind:?} images can't be opened (see document.formats)")))?;
-    let cmyk = || ImageBlob::new(f.mime, bytes.to_vec()).cmyk().is_some();
-    if matches!(f.id, "png" | "jpg" | "gif" | "webp") || (f.id == "tiff" && cmyk()) {
+    let kept = match f.id {
+        "png" | "jpg" | "gif" | "webp" => Some(bytes.to_vec()),
+        "tiff" => vectorcraft_doc::cmyk::stored_cmyk_tiff(bytes, ppi),
+        _ => None,
+    };
+    if let Some(kept) = kept {
         let (width, height) = reader.into_dimensions().map_err(err)?;
-        return stored(bytes.to_vec(), f.mime, (width, height), ppi);
+        return stored(kept, f.mime, (width, height), ppi);
     }
     let extra_samples = || {
         let cms = vectorcraft_color::cms::active();
         vectorcraft_doc::cmyk::extra_samples_tiff_rgba(bytes, |c| cms.cmyk_to_srgb(c, false))
     };
-    let img = match (f.id == "tiff").then(extra_samples).flatten() {
+    let mut img = match (f.id == "tiff").then(extra_samples).flatten() {
         Some(img) => img,
-        None => reader.decode().map_err(err)?.to_rgba8(),
+        None => match (f.id == "tiff").then(|| vectorcraft_doc::cmyk::group3_tiff_rgba(bytes)).flatten() {
+            Some(read) => read.map_err(err)?,
+            None => {
+                use image::ImageDecoder as _;
+                let decoder = reader.into_decoder().map_err(err)?;
+                // The allowance counts the decoded samples and the RGBA pixels they become (#1717).
+                let (w, h) = decoder.dimensions();
+                if decoder.total_bytes() > MAX_RASTER_ALLOC || u64::from(w) * u64::from(h) * 4 > MAX_RASTER_ALLOC {
+                    return Err(err(format!("an image of {w} × {h} pixels is too large to draw")));
+                }
+                image::DynamicImage::from_decoder(decoder).map_err(err)?.to_rgba8()
+            }
+        },
     };
+    if f.id == "tga" {
+        super::tgaread::fix_alpha(bytes, &mut img);
+    }
     as_png(img, ppi)
 }
 

crates/engine/src/cmd/fileio/metafile.rs

@@ -42,6 +42,8 @@ pub(super) fn encode(doc: &Document, p: &Value, use_artboards: Option<bool>, kin
     if enc.files.is_empty() {
         return Err(bad(C, "the document has no artboard"));
     }
+    let regions: Vec<vectorcraft_geom::Rect> = enc.files.iter().filter_map(|(b, _)| b.and_then(|b| doc.artboards.get(b))).map(|a| a.rect).collect();
+    enc.warnings.extend(crate::cmd::fonts::export_overflow_warning(doc, &doc.layers, Some(&regions)));
     Ok(enc)
 }
 

crates/engine/src/cmd/fileio/mod.rs

@@ -8,7 +8,7 @@
 //! - `svg`: the SVG Options (styling, fonts, images, object ids, artboards…).
 //! - `export`: `document.export` / `serialize` / `exportSelection` / `exportForOffice`.
 //! - `screens`: Export for Screens (`document.exportForScreens`, `document.exportSettings`); `zip`
-//!   packs its files as one download.
+//!   packs its files as one download, and reads the files of Word documents placed as type.
 //! - `save`: `document.save`, Save As / a Copy / as Template, New from Template, Revert and the
 //!   per-format options (`file.formatOptions`); [`save_with`] is the one save path of every frontend.
 //! - `pdf`: PDF settings and presets for every PDF export, `document.exportPdf`.
@@ -40,12 +40,14 @@ pub mod pdf;
 mod pdfimport;
 pub mod pngtext;
 pub mod ppi;
+pub mod progress;
 pub mod psdread;
 mod save;
 mod screens;
 mod svg;
 mod text;
-mod zip;
+mod tgaread;
+pub mod zip;
 
 use serde_json::{Value, json};
 
@@ -75,10 +77,11 @@ pub use save::{
 };
 pub use screens::{
     PRESET_KEYS as SCREEN_EXPORT_PRESET_KEYS, PRESETS as SCREEN_PRESETS, ScreenExportPreset, ScreenSize,
-    builtin_presets as screen_export_builtin_presets, preset_rows as screen_preset_rows,
+    builtin_presets as screen_export_builtin_presets, first_file as screen_first_file, preset_rows as screen_preset_rows,
 };
 pub(crate) use screens::{
-    SHARED_KEYS as SCREEN_SETTINGS_KEYS, check_settings as check_screen_settings, export as export_screens, store_settings as store_screen_settings,
+    SHARED_KEYS as SCREEN_SETTINGS_KEYS, check_settings as check_screen_settings, export as export_screens, safe_file_name,
+    store_settings as store_screen_settings,
 };
 pub use svg::options_map as svg_options;
 /// Atomic file writes (a temporary file renamed over the target: a failed write never damages the
@@ -114,7 +117,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Serialize Document",
             [],
             None,
-            "{format?: vectorcraft (default)|template|svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd, …the format's options (see document.formats; SVG ones also as svg: {…}), selectedOnly?: false (the selected objects alone, in their layers)} → {text, warnings} for svg (plus dataBase64, the file, when its encoding isn't UTF-8), else {dataBase64, warnings}; an SVG of several artboards also gives files: [{name, text}], linked images linked: [{name, dataBase64}]",
+            "{format?: vectorcraft (default)|template|svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd (ait, a .ait template, is written by file.saveAsTemplate), …the format's options (see document.formats; SVG ones also as svg: {…}), selectedOnly?: false (the selected objects alone, in their layers)} → {text, warnings} for svg (plus dataBase64, the file, when its encoding isn't UTF-8), else {dataBase64, warnings}; an SVG of several artboards also gives files: [{name, text}], linked images linked: [{name, dataBase64}]",
             has_doc,
             export::serialize
         ),
@@ -123,7 +126,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export Document",
             [],
             None,
-            "{path?, format?: svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd|vectorcraft|template (default: from the path's extension, else png; png8 writes an indexed .png), selectedOnly?: false (the selected objects alone, in their layers), artboard?: 0, artboards?: [i…], rect?: [x, y, width, height] (raster formats: that area of the page in points, y down, instead of an artboard; not with artboard, artboards, range or useArtboards), range?: \"1-3, 5\" | \"all\" (1-based; PDF and .ai write one page per artboard, default all; SVG writes one file per artboard, {stem}-{artboard}.svg; raster formats write one artboard), useArtboards?: true (raster: one file per chosen artboard, default all, {stem}-{artboard}.{ext}; pdf/ai: every page) | false (pdf/ai/raster: the bounds of the visible art; SVG has it as an SVG option), ppi?: 72 (raster formats: pixels per inch, stored in the file; wins over scale), scale?: 1 (pixels per point), background?: transparent|white|black|\"#rrggbb\" (jpg: white when transparent), antiAlias?: none|art (default)|type (text snapped to pixels), interlaced?: false (png, Adam7), embedIcc?: true (png: an sRGB chunk marks the colours as sRGB), quality?: 90 (jpg: 0–100), colorModel?: rgb|cmyk|gray (jpg), method?: baseline|optimized|progressive, scans?: 3 (3–5, progressive), embedIcc?: true, imageMap?: none|client|server (an HTML or NCSA map of the objects with a URL, written as <stem>.html / <stem>.map), colors?: 256 (gif/png8: 2–256), reduction?: perceptual|selective (default)|adaptive|web|blackWhite|gray, dither?: none|diffusion (default)|pattern|noise, ditherAmount?: 100, transparency?: true, matte?: white|\"#rrggbb\"|none, interlaced?, lossless?: true (webp: lossy WebP isn't available yet: written lossless, with a warning), encoding?: utf8|utf16 (txt: the stories in stacking order, back to front, a thread once; utf16 with a byte order mark), lineEndings?: lf|crlf, selectionOnly?: false, svg?: {styling, outlineText, images, objectIds, decimals, minify, responsive, useArtboards, preserveEditing, metadata, fewerTspans, hiddenLayers, encoding, profile, embedFonts} (see document.formats), …the SVG options given flat instead, …the PDF options of document.exportPdf, …the DXF options of document.exportDxf (useArtboards: one drawing per artboard), …the EPS options of document.exportEps (useArtboards: one file per artboard, {stem}_{artboard}.eps; else the visible art), …emf and wmf write one picture of the artboard (useArtboards: true one file per chosen artboard, false the bounds of the visible art; EMF keeps curves, clipping, transparent images and gradients as images clipped to their shape; WMF flattens curves into polygons behind a placeable header; what a format leaves out comes back in warnings), colorModel?: rgb|cmyk|gray (tiff: rgb keeps transparency as an alpha channel), lzw?: true, byteOrder?: little|big, embedIcc?: true, colorModel?: rgb|gray (bmp), depth?: 24 (bmp: 1 black and white, 4|8 a palette by reduction and dither, 16, 24, 32 with alpha), fileFormat?: windows|os2 (1, 4, 8 or 24 bits), rle?: false (4 and 8 bits, windows), flipRows?: false (top-down rows), depth?: 24 (tga: 16 one-bit alpha, 24, 32 with alpha), colorModel?: rgb|cmyk|gray (psd), layers?: true (each top-level layer a pixel layer with its opacity and blend mode; a background colour is a Background layer; false: one flat image, on white), maxEditability?: false (layers and sublayers become groups, each object a layer named as in the Layers panel, text by its text; clipping, masked or knockout layers stay one layer), hiddenLayers?: false (hidden layers and objects written hidden instead of left out), embedIcc?: true (at most 30000 pixels a side; formats without alpha are flattened on white)} → {path, format, bytes, warnings, files?: [path…] (several), linked?: [path…] (linked images, image maps)}; no path → {dataBase64, format, bytes, warnings, files?: [{name, dataBase64}], linked?: [{name, dataBase64}]}. Never changes the document's path",
+            "{path?, format?: svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd|vectorcraft|template (default: from the path's extension, else png; png8 writes an indexed .png; ait, a .ait template, is written by file.saveAsTemplate), selectedOnly?: false (the selected objects alone, in their layers), artboard?: 0, artboards?: [i…], rect?: [x, y, width, height] (raster formats: that area of the page in points, y down, instead of an artboard; not with artboard, artboards, range or useArtboards), range?: \"1-3, 5\" | \"all\" (1-based; PDF and .ai write one page per artboard, default all; SVG writes one file per artboard, {stem}-{artboard}.svg; raster formats write one artboard), useArtboards?: true (raster: one file per chosen artboard, default all, {stem}-{artboard}.{ext}; pdf/ai: every page) | false (pdf/ai/raster: the bounds of the visible art; SVG has it as an SVG option), ppi?: 72 (raster formats: pixels per inch, stored in the file; wins over scale), scale?: 1 (pixels per point), background?: transparent|white|black|\"#rrggbb\" (jpg: white when transparent), antiAlias?: none|art (default)|type (text snapped to pixels), interlaced?: false (png, Adam7), embedIcc?: true (png: an sRGB chunk marks the colours as sRGB), quality?: 90 (jpg: 0–100), colorModel?: rgb|cmyk|gray (jpg), method?: baseline|optimized|progressive, scans?: 3 (3–5, progressive), embedIcc?: true, imageMap?: none|client|server (an HTML or NCSA map of the objects with a URL, written as <stem>.html / <stem>.map), colors?: 256 (gif/png8: 2–256), reduction?: perceptual|selective (default)|adaptive|web|blackWhite|gray, dither?: none|diffusion (default)|pattern|noise, ditherAmount?: 100, transparency?: true, matte?: white|\"#rrggbb\"|none, interlaced?, lossless?: true (webp: lossy WebP isn't available yet: written lossless, with a warning), encoding?: utf8|utf16 (txt: the stories in stacking order, back to front, a thread once; utf16 with a byte order mark), lineEndings?: lf|crlf, selectionOnly?: false, svg?: {styling, outlineText, images, objectIds, decimals, minify, responsive, useArtboards, preserveEditing, metadata, fewerTspans, hiddenLayers, encoding, profile, embedFonts} (see document.formats), …the SVG options given flat instead, …the PDF options of document.exportPdf, …the DXF options of document.exportDxf (useArtboards: one drawing per artboard), …the EPS options of document.exportEps (useArtboards: one file per artboard, {stem}_{artboard}.eps; else the visible art), …emf and wmf write one picture of the artboard (useArtboards: true one file per chosen artboard, false the bounds of the visible art; EMF keeps curves, clipping, transparent images and gradients as images clipped to their shape; WMF flattens curves into polygons behind a placeable header; what a format leaves out comes back in warnings), colorModel?: rgb|cmyk|gray (tiff: rgb keeps transparency as an alpha channel), lzw?: true, byteOrder?: little|big, embedIcc?: true, colorModel?: rgb|gray (bmp), depth?: 24 (bmp: 1 black and white, 4|8 a palette by reduction and dither, 16, 24, 32 with alpha), fileFormat?: windows|os2 (1, 4, 8 or 24 bits), rle?: false (4 and 8 bits, windows), flipRows?: false (top-down rows), depth?: 24 (tga: 16 one-bit alpha, 24, 32 with alpha), colorModel?: rgb|cmyk|gray (psd), layers?: true (each top-level layer a pixel layer with its opacity and blend mode; a background colour is a Background layer; false: one flat image, on white), maxEditability?: false (layers and sublayers become groups, each object a layer named as in the Layers panel, text by its text; clipping, masked or knockout layers stay one layer), hiddenLayers?: false (hidden layers and objects written hidden instead of left out), embedIcc?: true (at most 30000 pixels a side; formats without alpha are flattened on white)} → {path, format, bytes, warnings, files?: [path…] (several), linked?: [path…] (linked images, image maps)}; no path → {dataBase64, format, bytes, warnings, files?: [{name, dataBase64}], linked?: [{name, dataBase64}]}. Never changes the document's path",
             has_doc,
             export::export
         ),
@@ -141,7 +144,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export for Screens",
             ["File", "Export"],
             None,
-            "{folder?, zip?: false (one store-only .zip of every file: no folder → {name, dataBase64, bytes, files: [name…]}; with a folder it is written there → {path, bytes, files}), artboards?: [index…] | range?: \"1-3\" (default all), assets?: [asset id…] (instead of artboards: each asset's art alone, cropped to its bounds and named after the asset; see assets.list), layers?: [layer id…] (instead of artboards: each layer's art alone, sublayers included, named after the layer), selection?: one|each (instead of artboards: the selected art as one file, or a file per selected object, named after it), fullDocument?: false (one file per format instead: a PDF of every artboard, other formats the bounds of all visible art, named after the document), includeBleed?: false (artboards grown by the document's bleed), exportPreset?: (a preset of document.exportPresets.list: its settings, under these params), subfolders?: false (each row's files in a sub-folder: its folder, else its size for raster (1x, 2x, 100w…) or its format (SVG, PDF)), folders?: none|rows (as subfolders)|format (a folder per extension: png, svg, pdf…)|item (a folder per artboard, asset, layer or object)|itemFormat (item/extension) (default: rows with subfolders or a preset, else none), name?: (a file name pattern instead of the item's name, with <filename> for the document, <name> for the artboard, asset, layer or object, <index> from 1, #### for the counter zero-padded to the run of #, <format>, <scale>, <suffix> (else the row's suffix ends the name), YYYYMMDD, YYYY-MM-DD, YYYY, <date>, <time>, <YYYY>, <MM>, <DD>, <hh>, <mm> and <ss>; a trailing .ext is dropped, as in `COMPANY-Logo-<filename>-####-YYYYMMDD`; different files it names alike get -2, -3…), counterStart?: 1, counterPer?: item (every file of an item has its number)|file, date?: YYYY-MM-DD (the date the pattern uses; default today, UTC), preset?: mobile (PNG 1x, 2x, 3x) | density (PNG 0.75x–4x in ldpi…xxxhdpi sub-folders) instead of formats (turns subfolders on), formats?: [{format: png|png8|jpg|webp|gif|tiff|bmp|tga|psd|svg|svgz|pdf|eps|ai|vectorcraft, scale?: 1 | \"2x\" | \"100w\" | \"100h\" | \"72ppi\", width?: px | height?: px | ppi? (raster only; width, then height, then ppi win over scale), suffix?: (raster default: @2x, @100w, @100h, none at 1x; vector formats drop size suffixes), folder?: (its sub-folder), quality?: (jpg 0–100), …the format's options (antiAlias, background, preset (pdf)…)}], settings?: {png|png8|jpg|webp|gif|tiff|bmp|tga|psd|svg|svgz|pdf|eps|ai|vectorcraft: {…options for every row of that format}} (rows' own options win), prefix?, antiAlias?: none|art|type (raster rows without their own), openLocation?: (remembered; the app shows the files after exporting)} one file per artboard and format (a PDF holds its artboard alone; artboards with the same name, in any case, get -2, -3…; an unnamed one is Artboard-N) → {files: [path…]}; no folder → {files: [{name, dataBase64}]} (names include sub-folders: 2x/[email protected]). eps, ai and vectorcraft rows write a document of the item alone (its one artboard). The params (but zip and assets) are remembered in the document (document.exportSettings; not an undo step)",
+            "{folder?, zip?: false (one store-only .zip of every file: no folder → {name, dataBase64, bytes, files: [name…]}; with a folder it is written there → {path, bytes, files}), artboards?: [index…] | range?: \"1-3\" (default all), assets?: [asset id…] (instead of artboards: each asset's art alone, cropped to its bounds and named after the asset; see assets.list), layers?: [layer id…] (instead of artboards: each layer's art alone, sublayers included, named after the layer), selection?: one|each (instead of artboards: the selected art as one file, or a file per selected object, named after it), fullDocument?: false (one file per format instead: a PDF of every artboard, other formats the bounds of all visible art, named after the document), includeBleed?: false (artboards grown by the document's bleed), exportPreset?: (a preset of document.exportPresets.list: its settings, under these params), subfolders?: false (each row's files in a sub-folder: its folder, else its size for raster (1x, 2x, 100w…) or its format (SVG, PDF)), folders?: none|rows (as subfolders)|format (a folder per extension: png, svg, pdf…)|item (a folder per artboard, asset, layer or object)|itemFormat (item/extension) (default: rows with subfolders or a preset, else none), name?: (a file name pattern instead of the item's name, with <filename> for the document, <name> for the artboard, asset, layer or object, <index> from 1, #### for the counter zero-padded to the run of #, <format>, <scale>, <suffix> (else the row's suffix ends the name), YYYYMMDD, YYYY-MM-DD, YYYY, <date>, <time>, <YYYY>, <MM>, <DD>, <hh>, <mm> and <ss>; a trailing .ext is dropped, as in `COMPANY-Logo-<filename>-####-YYYYMMDD`; different files it names alike get -2, -3…), counterStart?: 1, counterPer?: item (every file of an item has its number)|file, date?: YYYY-MM-DD (the date the pattern uses; default today, UTC), preset?: mobile (PNG 1x, 2x, 3x) | density (PNG 0.75x–4x in ldpi…xxxhdpi sub-folders) instead of formats (turns subfolders on), formats?: [{format: png|png8|jpg|webp|gif|tiff|bmp|tga|psd|svg|svgz|pdf|eps|ai|vectorcraft, scale?: 1 | \"2x\" | \"100w\" | \"100h\" | \"72ppi\", width?: px | height?: px | ppi? (raster only; width, then height, then ppi win over scale), suffix?: (raster default: @2x, @100w, @100h, none at 1x; vector formats drop size suffixes), folder?: (its sub-folder), quality?: (jpg 0–100), …the format's options (antiAlias, background, preset (pdf)…)}], settings?: {png|png8|jpg|webp|gif|tiff|bmp|tga|psd|svg|svgz|pdf|eps|ai|vectorcraft: {…options for every row of that format}} (rows' own options win), prefix?, antiAlias?: none|art|type (raster rows without their own), openLocation?: (remembered; the app shows the files after exporting)} one file per artboard and format (a PDF holds its artboard alone; artboards with the same name, in any case, get -2, -3…; an unnamed one is Artboard-N) → {files: [path…]}; no folder → {files: [{name, dataBase64}]} (names include sub-folders: 2x/[email protected]); every reply has warnings: [the encoders' warnings for the files, each once: an image that couldn't be decoded, type written in the fallback font…]. eps, ai and vectorcraft rows write a document of the item alone (its one artboard). The params (but zip and assets) are remembered in the document (document.exportSettings; not an undo step)",
             has_doc,
             screens::export_for_screens
         ),
@@ -186,7 +189,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Batch…",
             [],
             None,
-            "{commands: [{command, params}] (the action's steps), source?: folder (default) | datasets, folder? (required for folder: the source folder), includeSubdirs?: false, destination?: none (default: leave each file open) | saveAndClose (save over the source and close) | folder (save or export into destinationFolder and close), destinationFolder? (required when destination is folder; also the folder Override Save/Export write into), overrideOpen?: true (skip document.open / file.open steps: the batch opens each source file), overrideSave?: true (point document.save / file.save / file.saveAs at destinationFolder/{stem}.{ext}), overrideExport?: true (point document.export / document.exportForScreens / document.exportSelection the same way), stopOnError?: true, label?} play the commands on every readable file in folder (and its subfolders when includeSubdirs), or on every data set of the open document (source: datasets; File + Data Set Name for Override Save/Export). Caps: 500 files or data sets, 8 folder levels, 256 steps. Batches cannot nest. → {processed: [{path|dataset, result|error}…], count, failed, stopped}",
+            "{commands: [{command, params}] (the action's steps), source?: folder (default) | datasets, folder? (required for folder: the source folder), includeSubdirs?: false, destination?: none (default: leave each file open) | saveAndClose (save over the source and close) | folder (save or export into destinationFolder and close), destinationFolder? (required when destination is folder; also the folder Override Save/Export write into), overrideOpen?: true (skip document.open / file.open steps: the batch opens each source file), overrideSave?: true (point document.save / file.save / file.saveAs at destinationFolder/{stem}.{ext}), overrideExport?: true (point document.export / document.exportForScreens / document.exportSelection the same way), stopOnError?: true, label?} play the commands on every readable file in folder (and its subfolders when includeSubdirs), or on every data set of the open document (source: datasets; File + Data Set Name for the folder destination and Override Save/Export, with `/`, `\\`, `:`, `<`, `>`, `\"`, `|`, `?`, `*` and control characters in the data set's name as `-`, and `-2`, `-3`… added to a name already used). Caps: 500 files or data sets, 8 folder levels, 256 steps. Batches cannot nest. → {processed: [{path|dataset, result|error}…], count, failed, stopped}",
             always,
             action_batch::action_batch
         ),
@@ -204,7 +207,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "PDF Info",
             [],
             None,
-            "{path | name? | dataBase64 (a file's path, or its bytes), password?, thumbnail?: page (1-based), thumbnailSize?: 160 (px, longest side), cropTo?: crop (the thumbnail's box)} → {pages, needsPassword, wrongPassword?, pageInfo: [{width, height (pt, as shown), rotation, boxes: {media, crop, bleed, trim, art: [x0, y0, x1, y1] (PDF space, pt)}}], thumbnail?: PNG dataBase64}; a page whose UserUnit (PDF 1.6) is above 1 gives its size and boxes in pt, its numbers times the UserUnit (one above 75,000 counts as 75,000); an encrypted PDF without its password → {pages: 0, needsPassword: true}",
+            "{path | name? | dataBase64 (a file's path, or its bytes), password?, thumbnail?: page (1-based), thumbnailSize?: 160 (px, longest side), cropTo?: crop (the thumbnail's box)} → {pages, needsPassword, wrongPassword?, pageInfo: [{width, height (pt, as shown), rotation, boxes: {media, crop, bleed, trim, art: [x0, y0, x1, y1] (PDF space, pt)}}], thumbnail?: PNG dataBase64}; a page whose UserUnit (PDF 1.6) is above 1 gives its size and boxes in pt, its numbers times the UserUnit (one above 75,000 counts as 75,000); an encrypted PDF without its password → {pages: 0, needsPassword: true}; a PostScript file (an EPS, a .ps file, a .ai in PostScript form) → {pages: 1, needsPassword: false, pageInfo: [{width, height (its bounding box, a US Letter page without one), rotation: 0, boxes: {}}]} (password and cropTo don't apply; thumbnail: 1 shows what the page prints)",
             always,
             pdfimport::pdf_info
         ),
@@ -213,7 +216,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Save for Office Documents…",
             ["File"],
             None,
-            "{path?, ppi?: 150 (72, 150, 300… pixels per inch), transparent?: false (else on white), artboard?: 0, acknowledgeLoss?: bool (write over the file the document was read from although reading it left things out)} the artboard as a PNG for office documents and slides → {path, bytes, width, height} (pixels); no path → {dataBase64, bytes, width, height}",
+            "{path?, ppi?: 150 (72, 150, 300… pixels per inch), transparent?: false (else on white), artboard?: 0, acknowledgeLoss?: bool (write over the file the document was read from although reading it left things out)} the artboard as a PNG for office documents and slides → {path, bytes, width, height, warnings} (pixels); no path → {dataBase64, bytes, width, height, warnings}; warnings as for document.export (an image that couldn't be decoded, type in the fallback font or that doesn't fit its frame)",
             has_doc,
             export::export_for_office
         ),
@@ -635,7 +638,7 @@ pub const FORMATS: &[Format] = &[
     Format {
         id: "eps",
         label: "EPS",
-        extensions: &["eps"],
+        extensions: &["eps", "epsf"],
         mime: "application/postscript",
         read: true,
         write: true,
@@ -644,13 +647,24 @@ pub const FORMATS: &[Format] = &[
     },
     Format { id: "emf", label: "EMF", extensions: &["emf"], mime: "image/emf", read: true, write: true, raster: false, options: metafile::OPTIONS },
     Format { id: "wmf", label: "WMF", extensions: &["wmf"], mime: "image/wmf", read: true, write: true, raster: false, options: metafile::OPTIONS },
-    Format { id: "tga", label: "Targa", extensions: &["tga"], mime: "image/x-tga", read: false, write: true, raster: true, options: TGA_OPTIONS },
+    Format {
+        id: "tga",
+        label: "Targa",
+        extensions: &["tga", "vda", "icb", "vst"],
+        mime: "image/x-tga",
+        read: true,
+        write: true,
+        raster: true,
+        options: TGA_OPTIONS,
+    },
     Format { id: "psd", label: "PSD", extensions: &["psd"], mime: "image/x-psd", read: true, write: true, raster: true, options: PSD_OPTIONS },
     // Affinity Photo's `.afphoto` opens by its content but isn't listed: Finder shouldn't offer a
     // vector app for a raster editor's documents.
     reader("affinity", "Affinity", &["af", "afdesign", "afpub"], "application/vnd.affinity", false),
     // Photoshop's large document format: read like a PSD (its merged image), never written.
     reader("psb", "PSB", &["psb"], "image/x-psb", true),
+    // PostScript programs, read as EPS files are; Print to PostScript writes them, exports don't.
+    reader("ps", "PostScript", &["ps"], "application/postscript", false),
 ];
 
 /// Every extension `document.open` reads (the "All readable files" filter of open dialogs).
@@ -670,6 +684,10 @@ pub const OPEN_EXTS: &[&str] = &[
     "tif",
     "tiff",
     "bmp",
+    "tga",
+    "vda",
+    "icb",
+    "vst",
     "psd",
     "psb",
     "vctemplate",
@@ -677,6 +695,8 @@ pub const OPEN_EXTS: &[&str] = &[
     "emf",
     "wmf",
     "eps",
+    "epsf",
+    "ps",
     "af",
     "afdesign",
     "afpub",
@@ -684,8 +704,9 @@ pub const OPEN_EXTS: &[&str] = &[
 
 /// Extensions in [`OPEN_EXTS`] the desktop packaging doesn't associate with VectorCraft: Photoshop
 /// documents belong to raster editors, so Finder and file managers don't offer a vector app for
-/// them (File › Open and Place still read them).
-pub const UNASSOCIATED_EXTS: &[&str] = &["psd", "psb"];
+/// them, and the packaging declares no `.epsf`, `.ps` or Targa type (File › Open and Place still
+/// read them all).
+pub const UNASSOCIATED_EXTS: &[&str] = &["psd", "psb", "epsf", "ps", "tga", "vda", "icb", "vst"];
 
 /// The extension that picks each writable format when exporting (the format's first; PNG-8 shares
 /// `.png` with PNG, so `.png` comes once), in [`FORMATS`] order.
@@ -702,7 +723,14 @@ pub fn export_extensions() -> Vec<&'static str> {
 /// Text files: File → Place sets them as area type (Text Import Options).
 pub const TEXT_EXTS: &[&str] = &["txt"];
 
-/// Every extension File → Place reads: [`OPEN_EXTS`] and [`TEXT_EXTS`].
+/// RTF files: File → Place sets them as area type with their formatting.
+pub const RTF_EXTS: &[&str] = &["rtf"];
+
+/// Word documents: File → Place sets them as area type with their formatting.
+pub const DOCX_EXTS: &[&str] = &["docx"];
+
+/// Every extension File → Place reads: [`OPEN_EXTS`], [`TEXT_EXTS`], [`RTF_EXTS`] and
+/// [`DOCX_EXTS`].
 pub const PLACE_EXTS: &[&str] = &[
     "vectorcraft",
     "drawcraft",
@@ -719,6 +747,10 @@ pub const PLACE_EXTS: &[&str] = &[
     "tif",
     "tiff",
     "bmp",
+    "tga",
+    "vda",
+    "icb",
+    "vst",
     "psd",
     "psb",
     "vctemplate",
@@ -726,10 +758,14 @@ pub const PLACE_EXTS: &[&str] = &[
     "emf",
     "wmf",
     "eps",
+    "epsf",
+    "ps",
     "af",
     "afdesign",
     "afpub",
     "txt",
+    "rtf",
+    "docx",
 ];
 
 /// One dialog filter per readable format.
@@ -753,11 +789,14 @@ pub fn open_filters() -> impl Iterator<Item = (&'static str, &'static [&'static
         .chain(std::iter::once(("Plug-ins", super::plugin::EXTS)))
 }
 
-/// File → Place dialog filters: "All placeable files", then one per placeable format, then text.
+/// File → Place dialog filters: "All placeable files", then one per placeable format, then text,
+/// RTF and Word.
 pub fn place_filters() -> impl Iterator<Item = (&'static str, &'static [&'static str])> {
     std::iter::once(("All placeable files", PLACE_EXTS))
         .chain(format_filters().filter(|(_, exts)| exts.iter().all(|ext| PLACE_EXTS.contains(ext))))
         .chain(std::iter::once(("Text", TEXT_EXTS)))
+        .chain(std::iter::once(("RTF", RTF_EXTS)))
+        .chain(std::iter::once(("Word", DOCX_EXTS)))
 }
 
 /// A format by id or extension (any case, leading dot allowed; `jpeg` finds `jpg`).
@@ -793,7 +832,8 @@ pub fn format_for_name(name: &str) -> Option<&'static Format> {
     Some(extension(name)).filter(|e| !e.is_empty()).and_then(|e| format(&e))
 }
 
-/// The format to write: `format` (an id or extension), else the path's extension, else PNG.
+/// The format to write: `format` (an id or extension), else the path's extension, else PNG. For a
+/// `.ait` template it returns an error that names `file.saveAsTemplate`, which writes it.
 pub fn writable_format(format_param: Option<&str>, path: Option<&str>) -> std::result::Result<&'static Format, String> {
     // Formats that can't be written say what to use instead.
     let unknown = |what: String, key: &str| unsupported(key).map_or(what, |u| u.hint.to_string());
@@ -802,7 +842,13 @@ pub fn writable_format(format_param: Option<&str>, path: Option<&str>) -> std::r
         (None, Some(e)) => format(&e).ok_or_else(|| unknown(format!("unknown extension `.{e}`: pass `format` (see document.formats)"), &e))?,
         (None, None) => format("png").ok_or("no PNG encoder")?,
     };
-    if f.write { Ok(f) } else { Err(format!("{} files can be opened but not written (see document.formats)", f.label)) }
+    if f.write {
+        Ok(f)
+    } else if TEMPLATE_FORMATS.contains(&f.id) {
+        Err(format!("{} files are written by file.saveAsTemplate", f.label))
+    } else {
+        Err(format!("{} files can be opened but not written (see document.formats)", f.label))
+    }
 }
 
 /// [`writable_format`] for command `cmd`.
@@ -830,9 +876,36 @@ fn formats(_: &mut Session, _: &Value) -> Result<Value> {
 /// `path` checked for reading against the automation roots in force.
 #[cfg(not(target_arch = "wasm32"))]
 fn may_read(path: &str) -> Result<()> {
+    #[cfg(test)]
+    touch(path);
     crate::file_access::check_read(path).map_err(EngineError::Other)
 }
 
+/// Paths read while [`touched`] runs, on any thread (the SVG importer reads on one of its own).
+#[cfg(test)]
+static TOUCHED: std::sync::Mutex<Vec<String>> = std::sync::Mutex::new(Vec::new());
+#[cfg(test)]
+static RECORDING: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+#[cfg(test)]
+fn touch(path: &str) {
+    if RECORDING.load(std::sync::atomic::Ordering::SeqCst) > 0 {
+        TOUCHED.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(path.to_string());
+    }
+}
+
+/// Run `f` and list the paths read through this module meanwhile (by any test running then).
+#[cfg(test)]
+pub(crate) fn touched<T>(f: impl FnOnce() -> T) -> (T, Vec<String>) {
+    use std::sync::atomic::Ordering::SeqCst;
+    let start = TOUCHED.lock().unwrap_or_else(std::sync::PoisonError::into_inner).len();
+    RECORDING.fetch_add(1, SeqCst);
+    let out = f();
+    RECORDING.fetch_sub(1, SeqCst);
+    let seen = TOUCHED.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(start..).unwrap_or_default().to_vec();
+    (out, seen)
+}
+
 /// `path` checked for writing against the automation roots in force.
 #[cfg(not(target_arch = "wasm32"))]
 fn may_write(path: &str) -> Result<()> {
@@ -861,6 +934,8 @@ pub(crate) fn read_file_head(path: &str, max: usize) -> Result<Vec<u8>> {
 
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn write_file(path: &str, bytes: &[u8]) -> Result<()> {
+    // Work that stops early for a cancel can leave a truncated result: none of it is written.
+    vectorcraft_doc::cancel::check()?;
     may_write(path)?;
     // Never a half-written file: see [`write_atomic`].
     write_atomic(std::path::Path::new(path), bytes).map_err(|e| EngineError::Other(format!("{path}: {e}")))
@@ -869,6 +944,7 @@ pub(crate) fn write_file(path: &str, bytes: &[u8]) -> Result<()> {
 /// [`write_file`] with what `fill` writes into the file (a save streamed into it).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn write_file_with(path: &str, fill: &mut dyn FnMut(&mut dyn std::io::Write) -> std::io::Result<()>) -> Result<()> {
+    vectorcraft_doc::cancel::check()?;
     may_write(path)?;
     vectorcraft_format::write_atomic_with(std::path::Path::new(path), |f| fill(f)).map_err(|e| EngineError::Other(format!("{path}: {e}")))
 }
@@ -987,8 +1063,7 @@ fn list_dir(_: &str, _: usize) -> Result<(Vec<Value>, bool)> {
 /// keeps one); `None` when there is no file at `path` (or automation may not read it).
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn file_stamp(path: &str) -> Option<(u64, Option<u64>)> {
-    may_read(path).ok()?;
-    let m = std::fs::metadata(path).ok().filter(std::fs::Metadata::is_file)?;
+    let m = file_metadata(path).filter(std::fs::Metadata::is_file)?;
     let modified = m.modified().ok().and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok()).map(|d| d.as_millis() as u64);
     Some((m.len(), modified))
 }
@@ -997,11 +1072,17 @@ pub(crate) fn file_stamp(path: &str) -> Option<(u64, Option<u64>)> {
 /// (and automation may read it).
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn file_created(path: &str) -> Option<u64> {
-    may_read(path).ok()?;
-    let t = std::fs::metadata(path).ok()?.created().ok()?;
+    let t = file_metadata(path)?.created().ok()?;
     t.duration_since(std::time::UNIX_EPOCH).ok().map(|d| d.as_millis() as u64)
 }
 
+/// The file system's metadata of `path`, following links (when automation may read it).
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn file_metadata(path: &str) -> Option<std::fs::Metadata> {
+    may_read(path).ok()?;
+    std::fs::metadata(path).ok()
+}
+
 #[cfg(target_arch = "wasm32")]
 pub(crate) fn file_created(_: &str) -> Option<u64> {
     None
@@ -1017,6 +1098,81 @@ pub(crate) fn absolute_path(path: &str) -> String {
     std::path::absolute(path).map_or_else(|_| path.to_string(), |p| p.to_string_lossy().into_owned())
 }
 
+/// The file to open for `stored`, a path or `file:` URL stored in a document (a linked file, an
+/// SVG image's href), or why it is not followed. `document` is the path of the document it is
+/// stored in, when it has one: a relative path is taken from its folder. Only files on this
+/// computer, or on the network share the document is on, are followed (see `craft_docpath`); a
+/// path that is still relative (no document) is refused, as the working directory isn't the
+/// document's choice. On Windows, a document on a mapped drive is on the share behind the drive
+/// ([`share_path`]): a path refused as on another computer is checked again against the
+/// document's path on that share. Every stored path reaches the file system through this.
+pub(crate) fn document_path(stored: &str, document: Option<&str>) -> std::result::Result<String, craft_docpath::Refused> {
+    document_path_with(stored, document, share_path)
+}
+
+/// [`document_path`], with `share` giving a document's path on the network share behind its drive.
+pub(crate) fn document_path_with(
+    stored: &str,
+    document: Option<&str>,
+    share: impl FnOnce(&str) -> Option<String>,
+) -> std::result::Result<String, craft_docpath::Refused> {
+    use craft_docpath::Refused;
+    let document = document.map(absolute_path);
+    let resolve = |document: Option<&str>| craft_docpath::resolve(stored, document.map(std::path::Path::new));
+    let path = match resolve(document.as_deref()) {
+        Err(Refused::Network) => {
+            let share = document.as_deref().and_then(share).ok_or(Refused::Network)?;
+            resolve(Some(share.as_str()))?
+        }
+        path => path?,
+    };
+    if !path.is_absolute() {
+        return Err(Refused::Invalid);
+    }
+    path.into_os_string().into_string().map_err(|_| Refused::Invalid)
+}
+
+/// The path of `document` (on a drive, `Z:\jobs\doc.vectorcraft`) on the network share the drive is
+/// mapped to (`\\server\share\jobs\doc.vectorcraft`), when its folder is on one and automation may
+/// read the folder. The folder's final path ([`std::fs::canonicalize`]) names the share as
+/// `\\?\UNC\server\share\…`.
+#[cfg(windows)]
+pub(crate) fn share_path(document: &str) -> Option<String> {
+    share_of(document, |folder| {
+        may_read(folder).ok()?;
+        std::fs::canonicalize(folder).ok()
+    })
+}
+
+#[cfg(not(windows))]
+pub(crate) fn share_path(_: &str) -> Option<String> {
+    None
+}
+
+/// The path of `document` on the network share its drive is mapped to, given `final_path`, which
+/// returns the final path of a folder: `None` when `document` is not on a drive (`C:\` or `C:/`)
+/// or `final_path` gives no share (`\\?\UNC\server\share\…`), such as a folder on a local volume.
+#[cfg(any(windows, test))]
+pub(crate) fn share_of(document: &str, final_path: impl FnOnce(&str) -> Option<std::path::PathBuf>) -> Option<String> {
+    let mut chars = document.chars();
+    if !matches!((chars.next(), chars.next(), chars.next()), (Some(l), Some(':'), Some('\\' | '/')) if l.is_ascii_alphabetic()) {
+        return None;
+    }
+    // The drive's root folder keeps its separator (`Z:\`).
+    let split = document.rfind(['\\', '/'])?;
+    let (folder, name) = (document.get(..split.max(3))?, document.get(split + 1..)?);
+    if name.is_empty() {
+        return None;
+    }
+    let target = final_path(folder)?;
+    let target = target.to_str()?;
+    let unc = target.get(..8).filter(|p| p.eq_ignore_ascii_case(r"\\?\UNC\")).and(target.get(8..))?.trim_end_matches('\\');
+    if unc.split('\\').filter(|c| !c.is_empty()).count() < 2 {
+        return None;
+    }
+    Some(format!(r"\\{unc}\{name}"))
+}
+
 #[cfg(target_arch = "wasm32")]
 pub(crate) fn file_stamp(_: &str) -> Option<(u64, Option<u64>)> {
     None
@@ -1073,14 +1229,18 @@ pub fn artboard_file_names(doc: &vectorcraft_doc::Document, boards: &[usize]) ->
 /// characters as `-`, the fallback when it is empty, and `-2`, `-3`… after a name already used
 /// (compared without case).
 pub(crate) fn unique_file_names<'a>(names: impl IntoIterator<Item = (&'a str, String)>) -> Vec<String> {
+    distinct_names(names.into_iter().map(|(name, fallback)| {
+        let base: String = name.chars().map(|c| if c.is_alphanumeric() || c == '-' || c == '_' { c } else { '-' }).collect();
+        if base.is_empty() { fallback } else { base }
+    }))
+}
+
+/// `names` with `-2`, `-3`… after a name already used (compared without case).
+fn distinct_names(names: impl IntoIterator<Item = String>) -> Vec<String> {
     let mut taken = std::collections::HashSet::new();
     names
         .into_iter()
-        .map(|(name, fallback)| {
-            let mut base: String = name.chars().map(|c| if c.is_alphanumeric() || c == '-' || c == '_' { c } else { '-' }).collect();
-            if base.is_empty() {
-                base = fallback;
-            }
+        .map(|base| {
             let mut name = base.clone();
             for i in 2.. {
                 if taken.insert(name.to_lowercase()) {

crates/engine/src/cmd/fileio/naming.rs

@@ -12,7 +12,10 @@
 //!   (YYYYMMDD), `<time>` (hhmmss), `<YYYY>`, `<MM>`, `<DD>`, `<hh>`, `<mm>`, `<ss>`.
 //!
 //! A trailing `.ext` (or `.<ext>`, `.<format>`) is dropped: the extension comes from the format.
-//! Anything that could start a folder (`/`, `\`, `:`) becomes `-`.
+//! The characters Windows does not allow in a file name (`/`, `\`, `:`, `<`, `>`, `"`, `|`, `?`,
+//! `*` and control characters) become `-`, in the template's text and in what the tokens put in.
+
+use super::screens::file_part;
 
 /// What a template's tokens stand for, for one file.
 #[derive(Clone, Debug, Default, PartialEq)]
@@ -50,11 +53,6 @@ fn token(name: &str, p: &NameParts<'_>) -> Option<String> {
     })
 }
 
-/// Text with `/`, `\` and `:` turned into `-`, so it can't start a folder.
-fn clean(s: &str) -> String {
-    s.chars().map(|c| if matches!(c, '/' | '\\' | ':') { '-' } else { c }).collect()
-}
-
 /// Does `template` place the row's suffix itself (so it isn't added at the end)?
 pub fn has_suffix_token(template: &str) -> bool {
     template.contains("<suffix>")
@@ -72,12 +70,12 @@ pub fn render(template: &str, p: &NameParts<'_>) -> String {
     let mut out = String::with_capacity(t.len() + 16);
     let mut rest = t;
     while let Some(c) = rest.chars().next() {
-        // Bracketed tokens; an unknown one stays as written.
+        // Bracketed tokens; an unknown one stays as written, with `-` for its brackets.
         if c == '<'
             && let Some(end) = rest.find('>')
             && let Some(value) = rest.get(1..end).and_then(|name| token(name, p))
         {
-            out.push_str(&clean(&value));
+            out.push_str(&value);
             rest = rest.get(end + 1..).unwrap_or("");
             continue;
         }
@@ -94,10 +92,10 @@ pub fn render(template: &str, p: &NameParts<'_>) -> String {
             rest = rest.get(pat.len()..).unwrap_or("");
             continue;
         }
-        out.push(if matches!(c, '/' | '\\' | ':') { '-' } else { c });
+        out.push(c);
         rest = rest.get(c.len_utf8()..).unwrap_or("");
     }
-    out.trim().to_string()
+    file_part(out.trim())
 }
 
 /// `YYYY-MM-DD` (or `YYYYMMDD`) as `[year, month, day, 0, 0, 0]`; `None` when it isn't a date.
@@ -133,7 +131,7 @@ mod tests {
         assert_eq!(render("YYYY-MM-DD YYYY", &p), "2026-10-16 2026");
         // Words are left alone: only the date patterns and bracketed tokens are replaced.
         assert_eq!(render("SUMMER-DD-MM", &p), "SUMMER-DD-MM");
-        assert_eq!(render("<unknown>-x", &p), "<unknown>-x");
+        assert_eq!(render("<unknown>-x", &p), "-unknown--x");
         assert_eq!(render("logo.<format>", &p), "logo", "the extension comes from the format");
         assert!(has_suffix_token("a<suffix>") && !has_suffix_token("a"));
     }
@@ -143,6 +141,9 @@ mod tests {
         let p = NameParts { name: "../../etc", ..parts() };
         let n = render("a/b\\c:<name>", &p);
         assert!(!n.contains('/') && !n.contains('\\') && !n.contains(':'), "{n}");
+        // Nor any other character Windows does not allow in a file name, typed or put in.
+        let p = NameParts { name: "<a>\"b|c?d*\u{0}\u{1f}", ..parts() };
+        assert_eq!(render("<name>|?*\u{1}", &p), "-a--b-c-d-------");
         // A long counter is padded, a short run is not cut.
         assert_eq!(render("########", &NameParts { counter: 123, ..parts() }), "00000123");
         assert_eq!(render("#", &NameParts { counter: 12345, ..parts() }), "12345");

crates/engine/src/cmd/fileio/native.rs

@@ -103,7 +103,7 @@ pub const AI_OPTIONS: &[FormatOption] = &[
         name: "aiVersion",
         ty: "string",
         default: "\"pdf\"",
-        description: "pdf (a PDF-compatible .ai carrying the VectorCraft document) or 7 (the legacy, PostScript-form .ai of version 7, which keeps layers, groups, compound paths and clipping groups in apps that read it; one file per artboard, transparent objects opaque; the other .ai options don't apply)",
+        description: "pdf (a PDF-compatible .ai carrying the VectorCraft document) or 7 (the legacy, PostScript-form .ai of version 7, which keeps layers, groups, compound paths and clipping groups in apps that read it; one file per artboard, transparent objects opaque; the other .ai options don't apply; an error for a .ait template)",
     },
     FormatOption {
         name: "transparentImages",

crates/engine/src/cmd/fileio/pdf.rs

@@ -169,6 +169,7 @@ pub(crate) fn merge(base: &mut Value, over: &Value) {
 pub(crate) fn pdf_error(cmd: &str, e: PdfError) -> EngineError {
     match e {
         PdfError::BadSetting(_) | PdfError::Unsupported(_) => bad(cmd, e.to_string()),
+        PdfError::Cancelled => EngineError::Cancelled,
         e => EngineError::Other(e.to_string()),
     }
 }
@@ -234,11 +235,15 @@ pub fn expand_preset<'a>(s: &Session, cmd: &str, p: &'a Value) -> Result<Cow<'a,
     super::eps::with_flattener(s, cmd, expanded)
 }
 
-/// The full export options for `doc`: settings plus the artboards `p` picks (default all).
+/// The full export options for `doc`: settings plus the artboards `p` picks (default all), created
+/// at `doc`'s File Info creation date (the time of writing when it has none) and modified at the
+/// time of writing. On the web, which has no clock, the creation date is the modification date too,
+/// and a document without one gets neither.
 pub fn options(cmd: &str, doc: &Document, p: &Value) -> Result<PdfOptions> {
     let pick = if p.is_object() { ArtboardPick::deserialize(p).map_err(|e| bad(cmd, format!("PDF options: {e}")))? } else { ArtboardPick::default() };
     let artboards = pick.resolve(doc.artboards.len()).map_err(|e| bad(cmd, e))?;
-    Ok(PdfOptions { settings: settings(cmd, p)?, artboards, ..Default::default() })
+    let now = vectorcraft_doc::metadata::now_unix();
+    Ok(PdfOptions { settings: settings(cmd, p)?, artboards, created: doc.metadata.created.or(now), modified: now, ..Default::default() })
 }
 
 /// Why a PDF of some artboards carries no editing data.
@@ -253,9 +258,21 @@ pub fn encode(cmd: &str, doc: &Document, p: &Value) -> Result<(Vec<u8>, Vec<Stri
     let (full, mut warnings) = crate::cmd::place::document::full_documents(doc);
     let (bytes, drawn_warnings) = encode_carrying(cmd, &full, p, || Ok(vectorcraft_format::save(doc, false)))?;
     warnings.extend(drawn_warnings);
+    warnings.extend(overflow_warning(cmd, &full, p)?);
     Ok((bytes, warnings))
 }
 
+/// The warning about the type that the pages of a PDF of `doc` with the options in `p` draw and
+/// whose text doesn't fit (see [`crate::cmd::fonts::export_overflow_warning`]): on the pages
+/// chosen, leaving out the layers that don't print unless the PDF writes them.
+fn overflow_warning(cmd: &str, doc: &Document, p: &Value) -> Result<Option<String>> {
+    let opts = options(cmd, doc, p)?;
+    let areas = vectorcraft_pdf::page_areas(doc, &opts).map_err(|e| pdf_error(cmd, e))?;
+    let set = &opts.settings;
+    let printed = if set.include_non_printing || set.create_layers { None } else { without_non_printing(&doc.layers) };
+    Ok(crate::cmd::fonts::export_overflow_warning(doc, printed.as_deref().unwrap_or(&doc.layers), Some(&areas)))
+}
+
 /// [`encode`] the pages of `doc`, carrying `native()` as the editing data (a `.ai` file: the
 /// native document with its save options, whose pages may be left blank).
 pub(super) fn encode_carrying(cmd: &str, doc: &Document, p: &Value, native: impl FnOnce() -> Result<Vec<u8>>) -> Result<(Vec<u8>, Vec<String>)> {
@@ -273,7 +290,11 @@ pub(super) fn encode_carrying(cmd: &str, doc: &Document, p: &Value, native: impl
         }
     }
     let set = &opts.settings;
+    if set.pdf13() {
+        vectorcraft_doc::cancel::progress(0, 0, "Flattening transparency");
+    }
     let flat = flatten_for(cmd, doc, set, p)?;
+    vectorcraft_doc::cancel::check()?;
     if flat.is_some() {
         let kind = if set.standard.flattens() { set.standard.label() } else { set.compatibility.label() };
         warnings.push(format!("transparency is flattened into opaque art and images ({kind} files have none): see the flattener preset"));

crates/engine/src/cmd/fileio/pdfimport.rs

@@ -1,6 +1,6 @@
 //! Opening and placing PDF (and PDF-compatible `.ai`/`.ait`) files: the options `document.open`
 //! and `file.place` read ([`LoadOptions`]), the pages they import and `document.pdfInfo` (pages,
-//! boxes, a thumbnail) for the Import PDF dialog.
+//! boxes, a thumbnail; one page for a PostScript file) for the Import PDF dialog.
 
 use serde_json::{Value, json};
 use vectorcraft_doc::{ColorMode, Document};
@@ -162,6 +162,10 @@ const INFO: &str = "document.pdfInfo";
 pub(super) fn pdf_info(_: &mut Session, p: &Value) -> Result<Value> {
     let bytes = source(p, INFO)?.bytes;
     let o = LoadOptions::from_params(INFO, p)?;
+    // Programs whose header is only `%!` are PostScript too, as `clipboard.importEps` reads them.
+    if bytes.starts_with(b"%!") || vectorcraft_pdf::is_postscript(&bytes) {
+        return postscript_info(&bytes, p);
+    }
     let info = match vectorcraft_pdf::info(&bytes, o.password.as_deref()) {
         Ok(i) => i,
         Err(e @ (PdfError::NeedsPassword | PdfError::WrongPassword)) => {
@@ -183,10 +187,34 @@ pub(super) fn pdf_info(_: &mut Session, p: &Value) -> Result<Value> {
         let page = usize::try_from(n).ok().and_then(|n| n.checked_sub(1)).filter(|i| *i < info.pages.len());
         let page = page.ok_or_else(|| bad(INFO, format!("thumbnail: no page {n} (the PDF has {})", info.pages.len())))?;
         let (doc, _) = page_document(&bytes, page, &o)?;
-        let size = f64_or(p, "thumbnailSize", 160.0).clamp(16.0, 1024.0);
-        let r = doc.artboards.first().map(|a| a.rect).ok_or_else(|| err("the page has no area"))?;
-        let png = super::encode(&doc, "png", &json!({"scale": size / r.width().max(r.height()).max(1.0)}))?;
-        out["thumbnail"] = json!(vectorcraft_format::base64_encode(&png));
+        out["thumbnail"] = json!(thumbnail(&doc, p)?);
     }
     Ok(out)
 }
+
+/// `document.pdfInfo` of a PostScript file (an EPS, a `.ps` file, a `.ai` in PostScript form): one
+/// page, the page [`vectorcraft_eps::page`] reads, with no PDF boxes. Its thumbnail is the file as
+/// the EPS reader reads it without any editing data it carries: what the page prints, or the
+/// file's preview when its PostScript can't be read.
+fn postscript_info(bytes: &[u8], p: &Value) -> Result<Value> {
+    let page = vectorcraft_eps::page(bytes).map_err(err)?;
+    let info = json!({"width": page.width(), "height": page.height(), "rotation": 0, "boxes": {}});
+    let mut out = json!({"pages": 1, "needsPassword": false, "pageInfo": [info]});
+    if let Some(n) = p.get("thumbnail").and_then(Value::as_u64) {
+        if n != 1 {
+            return Err(bad(INFO, format!("thumbnail: no page {n} (the file has 1)")));
+        }
+        let doc = vectorcraft_eps::import_with(bytes, false).map_err(err)?.document;
+        out["thumbnail"] = json!(thumbnail(&doc, p)?);
+    }
+    Ok(out)
+}
+
+/// A PNG of `doc`'s first artboard, `thumbnailSize` px (default 160, from 16 to 1024) on its longer
+/// side, base64.
+fn thumbnail(doc: &Document, p: &Value) -> Result<String> {
+    let size = f64_or(p, "thumbnailSize", 160.0).clamp(16.0, 1024.0);
+    let r = doc.artboards.first().map(|a| a.rect).ok_or_else(|| err("the page has no area"))?;
+    let png = super::encode(doc, "png", &json!({"scale": size / r.width().max(r.height()).max(1.0)}))?;
+    Ok(vectorcraft_format::base64_encode(&png))
+}

crates/engine/src/cmd/fileio/progress.rs

@@ -0,0 +1,82 @@
+//! Progress and Cancel of an export running off the UI thread (Background Export), on the shared
+//! [`vectorcraft_doc::cancel`] mechanism.
+//!
+//! The frontend makes a [`Progress`], runs the export inside [`scope`] on its worker and reads the
+//! counts from the UI thread to draw them; its Cancel button calls [`Progress::cancel`]. Inside the
+//! scope the encoders that work in steps (raster formats: one artboard at a time) report each step
+//! through [`vectorcraft_doc::cancel::progress`] and stop at the next check once cancelled; the
+//! renderer stops drawing and keeps no half-drawn pattern tile or effect raster. Encoders that
+//! make one file in one go report nothing: the frontend shows them as busy and checks
+//! [`Progress::cancelled`] itself before writing, so a cancelled export never writes a file.
+
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use vectorcraft_doc::cancel::{self, CancelToken, ProgressSink};
+
+/// How far an export has got, shared between the worker and the UI thread.
+#[derive(Debug, Default)]
+pub struct Progress {
+    token: CancelToken,
+    done: AtomicU64,
+    total: AtomicU64,
+}
+
+impl Progress {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self::default())
+    }
+
+    /// `(steps done, steps in all)`; `total` is 0 while the export can't say (one file made in one go).
+    pub fn counts(&self) -> (u64, u64) {
+        let total = self.total.load(Ordering::Relaxed);
+        (self.done.load(Ordering::Relaxed).min(total), total)
+    }
+
+    /// The share of the export done, 0 to 1; `None` while the export can't say.
+    pub fn fraction(&self) -> Option<f64> {
+        let (done, total) = self.counts();
+        (total > 0).then(|| done as f64 / total as f64)
+    }
+
+    /// Ask the export to stop: it writes nothing more, and a render under way stops drawing.
+    pub fn cancel(&self) {
+        self.token.cancel();
+    }
+
+    pub fn cancelled(&self) -> bool {
+        self.token.is_cancelled()
+    }
+}
+
+/// Run `f` with `progress`'s token in effect on this thread and the steps reported to it.
+pub fn scope<R>(progress: &Arc<Progress>, f: impl FnOnce() -> R) -> R {
+    let to = Arc::clone(progress);
+    let sink: ProgressSink = Rc::new(move |done, total, _| {
+        to.total.store(total, Ordering::Relaxed);
+        to.done.store(done, Ordering::Relaxed);
+    });
+    cancel::scope(&progress.token, Some(sink), f)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_raster_export_counts_its_artboards_and_stops_once_cancelled() {
+        let mut doc = vectorcraft_doc::Document::new(100.0, 100.0);
+        let second = doc.artboards[0].clone();
+        doc.artboards.push(second);
+        let p = Progress::new();
+        assert_eq!(p.fraction(), None, "nothing reported yet");
+        let png = scope(&p, || super::super::encode_all(&doc, "png", &serde_json::json!({"useArtboards": true})));
+        assert!(png.is_ok(), "{:?}", png.err());
+        assert_eq!(p.counts(), (1, 2), "the step under way when the last artboard started");
+        p.cancel();
+        let r = scope(&p, || super::super::encode_all(&doc, "png", &serde_json::json!({"useArtboards": true})));
+        assert!(matches!(r, Err(crate::EngineError::Cancelled)), "{:?}", r.err());
+        assert!(!cancel::is_cancelled(), "the scope ended");
+    }
+}

crates/engine/src/cmd/fileio/save.rs

@@ -185,6 +185,9 @@ fn parent_folder(path: &str) -> Option<String> {
 fn save_format_of(f: &str) -> std::result::Result<&'static Format, String> {
     match format(f) {
         Some(f) if SAVE_FORMATS.contains(&f.id) => Ok(f),
+        Some(f) if TEMPLATE_FORMATS.contains(&f.id) => {
+            Err(format!("Save writes {}, not {}: use file.saveAsTemplate to write it", SAVE_FORMATS.join(", "), f.label))
+        }
         Some(f) => Err(format!("Save writes {}, not {}: use document.export for other formats", SAVE_FORMATS.join(", "), f.label)),
         None => Err(format!("unknown format `{f}` (Save writes {})", SAVE_FORMATS.join(", "))),
     }
@@ -196,6 +199,18 @@ pub fn save_format(format: Option<&str>, path: Option<&str>) -> std::result::Res
     save_format_of(format.or_else(|| path.and_then(format_for_name).map(|f| f.id)).unwrap_or("vectorcraft"))
 }
 
+/// `path` for a template in format `f`: kept when its extension names `f`, with the extension
+/// replaced when it names another format (`card.png` → `card.vctemplate`), else with `f`'s
+/// extension added (`card`, `card v1.2`).
+fn template_path(path: &str, f: &Format) -> String {
+    let ext = f.extensions[0];
+    match format_for_name(path) {
+        Some(g) if g.id == f.id => path.to_string(),
+        Some(_) => std::path::Path::new(path).with_extension(ext).to_string_lossy().into_owned(),
+        None => format!("{path}.{ext}"),
+    }
+}
+
 /// [`save_format_of`] for command `cmd`.
 fn checked(cmd: &str, f: &str) -> Result<&'static Format> {
     save_format_of(f).map_err(|e| bad(cmd, e))
@@ -217,6 +232,7 @@ pub fn save_plan(s: &Session, mode: SaveMode, p: &Value) -> Result<SavePlan> {
         (_, None, Some(f)) => checked(cmd, f.id)?,
         (_, None, None) => checked(cmd, st.format)?,
     };
+    let path = if mode == SaveMode::Template { path.map(|p| template_path(&p, format)) } else { path };
     let mut given: Map<String, Value> = match p.get("options") {
         Some(Value::Object(o)) => o.iter().filter(|(k, _)| reads_option(format, k)).map(|(k, v)| (k.clone(), v.clone())).collect(),
         None | Some(Value::Null) => Map::new(),
@@ -280,17 +296,18 @@ fn is_svg(f: &Format) -> bool {
 }
 
 /// The document as written: native files carry the view to reopen at and the Layers panel's open
-/// rows.
+/// rows and transparency grid visibility.
 fn doc_to_save(st: &DocState, f: &Format) -> Arc<Document> {
     if !is_native(f) {
         return st.doc.clone();
     }
     let open = st.layers_open.saved(&st.doc);
-    if st.doc.last_view == st.view && st.doc.layers_open == open {
+    if st.doc.last_view == st.view && st.doc.layers_open == open && st.doc.transparency_grid == st.transparency_grid {
         return st.doc.clone();
     }
     let mut d = (*st.doc).clone();
     d.last_view = st.view.clone();
+    d.transparency_grid = st.transparency_grid;
     d.layers_open = open;
     Arc::new(d)
 }
@@ -354,7 +371,7 @@ impl<W: std::io::Write> std::io::Write for Counted<W> {
 /// `separateArtboards`, those `range` names (default all).
 fn separate_boards(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result<Vec<usize>> {
     // A legacy .ai file is a file per artboard already.
-    if !is_native(f) || !bool_or(p, "separateArtboards", false) || super::legacy_ai::wanted(cmd, p)? {
+    if !is_native(f) || !bool_or(p, "separateArtboards", false) || super::legacy_ai::wanted(cmd, f, p)? {
         return Ok(vec![]);
     }
     let range = str_param(p, "range").filter(|r| !r.trim().is_empty()).map(str::to_string);
@@ -407,7 +424,7 @@ const NOT_PDF_COMPATIBLE: &str = "saved without PDF content: VectorCraft opens i
 /// The shared Save and Export encoder for PDF-compatible `.ai` files (and `.ait` templates, the
 /// same file).
 pub(super) fn encode_ai(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result<Encoded> {
-    if super::legacy_ai::wanted(cmd, p)? {
+    if super::legacy_ai::wanted(cmd, f, p)? {
         return super::legacy_ai::encode(cmd, f, doc, p);
     }
     let mut params = if p.is_object() { p.clone() } else { json!({}) };
@@ -491,7 +508,7 @@ fn job_for_stamped(s: &Session, st: &DocState, plan: SavePlan, stamped: Option<i
     }
     let boards = separate_boards(cmd, plan.format, &doc, &params)?;
     let mut params = super::pdf::expand_preset(s, cmd, &params)?.into_owned();
-    let legacy = super::legacy_ai::wanted(cmd, &params)?;
+    let legacy = super::legacy_ai::wanted(cmd, plan.format, &params)?;
     if let (Some(o), "ai" | "ait") = (params.as_object_mut(), plan.format.id) {
         // Save keeps every artboard; exports may choose a subset instead. A legacy .ai file per
         // artboard keeps a range given: the artboards to save.
@@ -541,7 +558,7 @@ impl SaveJob {
         let (cmd, f) = (self.plan.mode.command(), self.plan.format);
         let enc = if matches!(f.id, "ai" | "ait") { encode_ai(cmd, f, doc, &self.params)? } else { encode_all(doc, f.id, &self.params)? };
         // A legacy .ai file per artboard.
-        let per_artboard = f.id == "ai" && super::legacy_ai::wanted(cmd, &self.params)?;
+        let per_artboard = f.id == "ai" && super::legacy_ai::wanted(cmd, f, &self.params)?;
         if enc.files.len() != 1 && !per_artboard {
             return Err(bad(cmd, "Save writes one artboard: name one, or export several with document.export"));
         }
@@ -631,7 +648,8 @@ impl SaveJob {
 
     /// Once written: Save and Save As (except to a template) make the file `st`'s own: path,
     /// title, format, options, and the snapshot as the saved state (edits made since the job was
-    /// made keep the document modified).
+    /// made keep the document modified; changes that are not edits to save don't,
+    /// [`DocState::same_content`]).
     pub fn finish(self, st: &mut DocState) {
         let retargets = self.plan.retargets();
         if let (true, Some(path)) = (retargets, self.plan.path) {
@@ -643,6 +661,12 @@ impl SaveJob {
             if let Some(at) = self.stamped {
                 if Arc::ptr_eq(&st.doc, &self.source) {
                     st.doc = self.snapshot.clone();
+                } else if st.same_content(&self.source) {
+                    // Changed while the save ran only by changes that are not edits to save
+                    // (Puppet Warp pins dropped, Edit Text ended, type laid out again after a font
+                    // scan): with the dates, the document counts as saved.
+                    stamp_save_dates(st, at);
+                    return st.mark_saved();
                 } else {
                     // Edited while the save ran: the dates still go on, the edits stay unsaved. The
                     // undo history holds the document as it was before the dates, so that is the
@@ -755,7 +779,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             "Save As…",
             ["File"],
             Some("Cmd+Shift+S"),
-            "{…as document.save} {path?, format?: vectorcraft|template|pdf|svg|svgz|ai (default: the path's extension, else the document's own), options?, svg?, modified?} the document takes on the new path, name and format (except a template, which is always a copy) → {path, format, bytes, warnings}; no path → {dataBase64, format, name, folder?, warnings}",
+            "{…as document.save} {path?, format?: vectorcraft|template|pdf|svg|svgz|ai (default: the path's extension, else the document's own; ait, a .ait template, is written by file.saveAsTemplate), options?, svg?, modified?} the document takes on the new path, name and format (except a template, which is always a copy) → {path, format, bytes, warnings}; no path → {dataBase64, format, name, folder?, warnings}",
             has_doc,
             |s, p| save(s, SaveMode::SaveAs, p)
         ),
@@ -773,7 +797,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             "Save as Template…",
             ["File"],
             None,
-            "{…as document.save} {path?, format?: template (default) | ait (also when format is not given and the path ends in .ait), compress?, version?, preview?} a template that opens as a new untitled document: a native template (.vctemplate), or a PDF-compatible .ait written as a .ai file is (the .ai options and the PDF options, as document.save takes them for .ai); the document is unchanged → {path, format, bytes, warnings}; no path → {dataBase64, format, name: \"<name> template.<ext>\", folder: the Templates folder (preference templatesFolder), warnings}",
+            "{…as document.save} {path? (saved with the format's extension: one naming another format is replaced, and one is added to a name without it), format?: template (default) | ait (also when format is not given and the path ends in .ait), compress?, version?, preview?} a template that opens as a new untitled document: a native template (.vctemplate), or a PDF-compatible .ait written as a .ai file is (the .ai options and the PDF options, as document.save takes them for .ai; aiVersion 7 is an error); the document is unchanged → {path, format, bytes, warnings}; no path → {dataBase64, format, name: \"<name> template.<ext>\", folder: the Templates folder (preference templatesFolder), warnings}",
             has_doc,
             |s, p| save(s, SaveMode::Template, p)
         ),

crates/engine/src/cmd/fileio/screens.rs

@@ -18,10 +18,11 @@ use vectorcraft_geom::Rect;
 
 use super::super::*;
 use super::encode::single_artboard;
-use super::export::{isolated, selected_artwork, without_artboards};
+use super::export::{export_crop, isolated, selected_artwork, without_artboards};
 use super::naming::{self, NameParts};
 use super::{
-    ARTBOARD_PARAMS, ArtboardPick, Format, artboard_file_names, create_dir, encode, unique_file_names, with_black_output, writable, write_file,
+    ARTBOARD_PARAMS, ArtboardPick, Format, artboard_file_names, create_dir, distinct_names, encode_with_warnings, unique_file_names,
+    with_black_output, writable, write_file,
 };
 
 const C: &str = "document.exportForScreens";
@@ -148,10 +149,29 @@ fn safe_name(s: &str) -> Option<String> {
     (!n.trim_matches('.').is_empty()).then_some(n)
 }
 
-/// Text that goes into a file name (prefix, suffix): path separators and `:` become `-`, so it can't
-/// start a folder or climb out of the export folder.
-fn file_part(s: &str) -> String {
-    s.chars().map(|c| if matches!(c, '/' | '\\' | ':') { '-' } else { c }).collect()
+/// Text that goes into a file name (prefix, suffix, a data set's name in Batch, a name pattern's text
+/// and the names it puts in): the characters Windows does not allow in a file name (`/`, `\`, `:`,
+/// `<`, `>`, `"`, `|`, `?`, `*` and the control characters U+0000 to U+001F,
+/// <https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file>) become `-` on every
+/// platform, so the name cannot make a subfolder or point outside the folder the file is written to.
+pub(super) fn file_part(s: &str) -> String {
+    s.chars().map(|c| if matches!(c, '/' | '\\' | ':' | '<' | '>' | '"' | '|' | '?' | '*') || c < ' ' { '-' } else { c }).collect()
+}
+
+/// A whole file or folder name (`[email protected]`, a sub-folder) through [`file_part`], without
+/// trailing periods and spaces, and with `-` after a Windows device name that is the whole name or
+/// comes before its first period: `CON`, `PRN`, `AUX`, `NUL`, `COM1` to `COM9` and `LPT1` to `LPT9`,
+/// also with `¹`, `²` or `³` for the digit, in any case (`CON.png` becomes `CON-.png`). The same on
+/// every platform.
+pub(crate) fn safe_file_name(s: &str) -> String {
+    let name = file_part(s);
+    let name = name.trim_end_matches(['.', ' ']);
+    let (base, rest) = name.split_at(name.find('.').unwrap_or(name.len()));
+    let upper = base.to_ascii_uppercase();
+    let numbered = |n: &str| n.chars().count() == 1 && n.chars().all(|c| matches!(c, '1'..='9' | '¹' | '²' | '³'));
+    let device = matches!(upper.as_str(), "CON" | "PRN" | "AUX" | "NUL")
+        || upper.strip_prefix("COM").or_else(|| upper.strip_prefix("LPT")).is_some_and(numbered);
+    if device { format!("{base}-{rest}") } else { name.to_string() }
 }
 
 /// Keys of a format row that aren't encoder options.
@@ -322,6 +342,97 @@ impl ScreenParams {
     fn of(p: &Value) -> Result<Self> {
         if p.is_object() { Self::deserialize(p).map_err(|e| bad(C, e.to_string())) } else { Ok(Self::default()) }
     }
+
+    /// An error when more than one of `assets`, `layers`, `selection` and `fullDocument` is given.
+    fn one_source(&self) -> Result<()> {
+        let sources = [self.full_document, self.assets.is_some(), self.layers.is_some(), self.selection.is_some()].iter().filter(|b| **b).count();
+        if sources > 1 {
+            return Err(bad(C, "give one of assets, layers, selection or fullDocument"));
+        }
+        Ok(())
+    }
+
+    /// `selection`: `None` without it, `Some(false)` for `one` file, `Some(true)` for `each` object.
+    fn selection_mode(&self) -> Result<Option<bool>> {
+        match self.selection.as_deref() {
+            None => Ok(None),
+            Some("one") => Ok(Some(false)),
+            Some("each") => Ok(Some(true)),
+            Some(m) => Err(bad(C, format!("selection `{m}`: one or each"))),
+        }
+    }
+}
+
+/// How a batch export names its files and sorts them into folders.
+struct Naming<'a> {
+    /// The `name` pattern, when it holds more than spaces.
+    pattern: Option<&'a str>,
+    /// The `prefix`, through [`file_part`].
+    prefix: String,
+    /// The document's name, safe as a file name (`<filename>`, the Full Document's item).
+    filename: String,
+    /// The date and time the pattern's tokens use.
+    when: [i64; 6],
+    counter_start: u64,
+    /// The counter counts files rather than items.
+    per_file: bool,
+    folders: Folders,
+}
+
+impl<'a> Naming<'a> {
+    /// The naming of params `o` for a document titled `title`.
+    fn of(o: &'a ScreenParams, title: &str) -> Result<Self> {
+        let folders = Folders::of(o)?;
+        // A prefix names files, not folders.
+        let prefix = file_part(o.prefix.as_deref().unwrap_or(""));
+        let when = match o.date.as_deref() {
+            Some(d) => naming::parse_date(d).ok_or_else(|| bad(C, format!("date `{d}`: YYYY-MM-DD")))?,
+            None => vectorcraft_doc::metadata::now_unix().map_or([1970, 1, 1, 0, 0, 0], vectorcraft_doc::metadata::civil),
+        };
+        let per_file = match o.counter_per.as_deref() {
+            None | Some("item") => false,
+            Some("file") => true,
+            Some(c) => return Err(bad(C, format!("counterPer `{c}`: item or file"))),
+        };
+        let filename = safe_name(&super::file_stem(title)).unwrap_or_else(|| "Untitled".into());
+        let pattern = o.name.as_deref().filter(|n| !n.trim().is_empty());
+        Ok(Self { pattern, prefix, filename, when, counter_start: o.counter_start.unwrap_or(1), per_file, folders })
+    }
+
+    /// The sub-folder (`None` for the export folder itself) and the file name of the file row `r`
+    /// writes of `item`, the `index`th item (from 0), when `files` files came before it.
+    fn file(&self, item: &Item, index: usize, files: u64, r: &Row) -> (Option<String>, String) {
+        let counter = self.counter_start.saturating_add(if self.per_file { files } else { index as u64 });
+        let ext = r.format.extensions.first().copied().unwrap_or(r.format.id);
+        let prefix = &self.prefix;
+        let stem = match self.pattern {
+            Some(pattern) => {
+                let parts = NameParts {
+                    filename: &self.filename,
+                    name: &item.name,
+                    index: index + 1,
+                    counter,
+                    format: ext,
+                    scale: &if r.format.raster { r.size.label() } else { String::new() },
+                    suffix: &r.suffix,
+                    when: self.when,
+                };
+                let named = naming::render(pattern, &parts);
+                let named = if named.is_empty() { item.stem.clone() } else { named };
+                if naming::has_suffix_token(pattern) { format!("{prefix}{named}") } else { format!("{prefix}{named}{}", r.suffix) }
+            }
+            None => format!("{prefix}{}{}", item.stem, r.suffix),
+        };
+        let file = safe_file_name(&format!("{stem}.{ext}"));
+        let sub = match self.folders {
+            Folders::None => None,
+            Folders::Rows => Some(safe_file_name(&r.folder)),
+            Folders::Format => Some(ext.to_string()),
+            Folders::Item => Some(item.stem.clone()),
+            Folders::ItemFormat => Some(format!("{}/{ext}", item.stem)),
+        };
+        (sub, file)
+    }
 }
 
 /// The format rows `p` asks for (`formats`, else `preset`'s, else one PNG at 1x), each with the
@@ -541,40 +652,20 @@ pub(super) fn presets_delete(s: &mut Session, p: &Value) -> Result<Value> {
 /// Every chosen artboard (asset, layer, selected object) in every format row, one file each (a PDF
 /// holds its artboard alone), or with `fullDocument` one file per row (a PDF of every artboard,
 /// else the bounds of all art). Items that share a name get `-2`, `-3`… instead of overwriting, and
-/// so do different files the `name` pattern gives one name.
+/// so do different files the `name` pattern gives one name. The reply's `warnings` lists every
+/// warning the encoders give for the files, each once.
 pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     let o = ScreenParams::of(p)?;
     let rows = rows_of(s, p, o.preset.as_deref())?;
-    let sources = [o.full_document, o.assets.is_some(), o.layers.is_some(), o.selection.is_some()].iter().filter(|b| **b).count();
-    if sources > 1 {
-        return Err(bad(C, "give one of assets, layers, selection or fullDocument"));
-    }
-    let folders = Folders::of(&o)?;
-    // A prefix names files, not folders.
-    let prefix = file_part(o.prefix.as_deref().unwrap_or(""));
+    o.one_source()?;
+    let naming = Naming::of(&o, &s.doc()?.doc.title)?;
     let folder = o.folder.as_deref().filter(|f| !f.is_empty());
-    let when = match o.date.as_deref() {
-        Some(d) => naming::parse_date(d).ok_or_else(|| bad(C, format!("date `{d}`: YYYY-MM-DD")))?,
-        None => vectorcraft_doc::metadata::now_unix().map_or([1970, 1, 1, 0, 0, 0], vectorcraft_doc::metadata::civil),
-    };
-    let per_file = match o.counter_per.as_deref() {
-        None | Some("item") => false,
-        Some("file") => true,
-        Some(c) => return Err(bad(C, format!("counterPer `{c}`: item or file"))),
-    };
-    let counter_start = o.counter_start.unwrap_or(1);
-    let selection = match o.selection.as_deref() {
-        None => None,
-        Some("one") => Some(false),
-        Some("each") => Some(true),
-        Some(m) => return Err(bad(C, format!("selection `{m}`: one or each"))),
-    };
+    let selection = o.selection_mode()?;
     let selected = if selection.is_some() { selected_artwork(s)? } else { vec![] };
     if let Some(dir) = folder {
         create_dir(dir)?;
     }
     let doc = s.doc()?.doc.clone();
-    let filename = safe_name(&super::file_stem(&doc.title)).unwrap_or_else(|| "Untitled".into());
     // Include Bleed: each artboard grown by the document's bleed.
     let doc = if o.include_bleed && doc.setup.has_bleed() {
         let mut d = (*doc).clone();
@@ -586,43 +677,26 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
         doc
     };
     let crop = rows.iter().any(|r| r.format.id != "pdf");
-    let items = items(&doc, &o, selection, &selected, &filename, crop)?;
+    let items = items(&doc, &o, selection, &selected, &naming.filename, crop, true)?;
     let mut out = Output::default();
+    // The encoders' warnings for every file, each once.
+    let mut warnings: Vec<String> = Vec::new();
     // Appearance of Black › Printing / Exporting for RGB raster rows.
-    let write = |doc: &Document, format: &str, options: &Value| encode(doc, format, &with_black_output(s, options));
+    let mut write = |doc: &Document, format: &str, options: &Value| -> Result<Vec<u8>> {
+        let (bytes, notes) = encode_with_warnings(doc, format, &with_black_output(s, options))?;
+        for w in notes {
+            if !warnings.contains(&w) {
+                warnings.push(w);
+            }
+        }
+        Ok(bytes)
+    };
     // A whole-document copy of an artboard, for the formats that write documents to edit.
     let mut board_docs: std::collections::HashMap<usize, Arc<Document>> = std::collections::HashMap::new();
     let mut files = 0u64;
     for (index, item) in items.iter().enumerate() {
         for r in &rows {
-            let counter = counter_start.saturating_add(if per_file { files } else { index as u64 });
-            let ext = r.format.extensions.first().copied().unwrap_or(r.format.id);
-            let stem = match o.name.as_deref().filter(|n| !n.trim().is_empty()) {
-                Some(pattern) => {
-                    let parts = NameParts {
-                        filename: &filename,
-                        name: &item.name,
-                        index: index + 1,
-                        counter,
-                        format: ext,
-                        scale: &if r.format.raster { r.size.label() } else { String::new() },
-                        suffix: &r.suffix,
-                        when,
-                    };
-                    let named = naming::render(pattern, &parts);
-                    let named = if named.is_empty() { item.stem.clone() } else { named };
-                    if naming::has_suffix_token(pattern) { format!("{prefix}{named}") } else { format!("{prefix}{named}{}", r.suffix) }
-                }
-                None => format!("{prefix}{}{}", item.stem, r.suffix),
-            };
-            let file = format!("{stem}.{ext}");
-            let sub = match folders {
-                Folders::None => None,
-                Folders::Rows => Some(r.folder.clone()),
-                Folders::Format => Some(ext.to_string()),
-                Folders::Item => Some(item.stem.clone()),
-                Folders::ItemFormat => Some(format!("{}/{ext}", item.stem)),
-            };
+            let (sub, file) = naming.file(item, index, files, r);
             let name = sub.map_or_else(|| file.clone(), |d| format!("{d}/{file}"));
             let Some(name) = out.claim(&name, &format!("{}|{}", item.stem, r.key), o.name.is_some()) else { continue };
             let bytes = if let (Some(all), "pdf") = (&item.every_artboard, r.format.id) {
@@ -644,34 +718,80 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     let names: Vec<&str> = out.kept.iter().map(|(n, _)| n.as_str()).collect();
     if o.zip {
         let zip = super::zip::store(&out.kept).map_err(|e| bad(C, e))?;
-        let zip_name = format!("{prefix}{filename}.zip");
+        let zip_name = safe_file_name(&format!("{}{}.zip", naming.prefix, naming.filename));
         return match folder {
             Some(dir) => {
                 let path = format!("{dir}/{zip_name}");
                 write_file(&path, &zip)?;
-                Ok(json!({ "path": path, "bytes": zip.len(), "files": names }))
+                Ok(json!({ "path": path, "bytes": zip.len(), "files": names, "warnings": warnings }))
             }
-            None => Ok(json!({ "name": zip_name, "dataBase64": vectorcraft_format::base64_encode(&zip), "bytes": zip.len(), "files": names })),
+            None => Ok(
+                json!({ "name": zip_name, "dataBase64": vectorcraft_format::base64_encode(&zip), "bytes": zip.len(), "files": names, "warnings": warnings }),
+            ),
         };
     }
     Ok(match folder {
-        Some(_) => json!({ "files": out.written }),
+        Some(_) => json!({ "files": out.written, "warnings": warnings }),
         None => {
-            json!({ "files": out.kept.iter().map(|(name, bytes)| json!({ "name": name, "dataBase64": vectorcraft_format::base64_encode(bytes) })).collect::<Vec<_>>() })
+            let files: Vec<Value> =
+                out.kept.iter().map(|(name, bytes)| json!({ "name": name, "dataBase64": vectorcraft_format::base64_encode(bytes) })).collect();
+            json!({ "files": files, "warnings": warnings })
         }
     })
 }
 
+/// The path, relative to the export folder, of the first file `document.exportForScreens` with
+/// params `p` writes (sub-folders included: `2x/[email protected]`): the first format row's file of the
+/// first artboard, asset, layer or selected object, or of the whole document, named as [`export`]
+/// names it. It encodes and writes nothing and cuts no art out of the document: of the objects
+/// selected for a file each, it measures only the first ones, up to the first that draws something.
+/// It does not refuse what the export refuses for drawing nothing: a checked asset or layer, the
+/// selection as one file, or the Full Document with no visible art.
+/// The Export for Screens dialog shows it on its Example line.
+pub fn first_file(s: &Session, p: &Value) -> Result<String> {
+    let p = with_preset(s, p)?;
+    let o = ScreenParams::of(&p)?;
+    let rows = rows_of(s, &p, o.preset.as_deref())?;
+    o.one_source()?;
+    let selection = o.selection_mode()?;
+    let doc = &s.doc()?.doc;
+    let mut selected = if selection.is_some() { selected_artwork(s)? } else { vec![] };
+    // A file per object: objects that draw nothing write no file.
+    if selection == Some(true) {
+        selected = selected.into_iter().find(|id| export_crop(doc, &[*id]).is_some()).into_iter().collect();
+    }
+    let naming = Naming::of(&o, &doc.title)?;
+    let items = items(doc, &o, selection, &selected, &naming.filename, false, false)?;
+    let (Some(item), Some(r)) = (items.first(), rows.first()) else { return Err(bad(C, "nothing to export")) };
+    let (sub, file) = naming.file(item, 0, 0, r);
+    Ok(sub.map_or_else(|| file.clone(), |d| format!("{d}/{file}")))
+}
+
 /// What `o` exports a file of per row ([`Item`]): the whole document, the assets, the layers, the
 /// selection (one item, or one per object), else the chosen artboards.
-/// `crop`: some row needs the Full Document's art bounds (a format other than PDF).
-fn items(doc: &Arc<Document>, o: &ScreenParams, selection: Option<bool>, selected: &[NodeId], filename: &str, crop: bool) -> Result<Vec<Item>> {
+/// `crop`: some row needs the Full Document's art bounds (a format other than PDF). `art`: each
+/// asset, layer and selected object is cut out of the document; without it, only the items' names
+/// are made, every item holds the whole document, and none is left out for drawing nothing.
+fn items(
+    doc: &Arc<Document>,
+    o: &ScreenParams,
+    selection: Option<bool>,
+    selected: &[NodeId],
+    filename: &str,
+    crop: bool,
+    art: bool,
+) -> Result<Vec<Item>> {
     // The art of `ids` alone, as an item named `name`.
     let alone = |ids: &[NodeId], name: &str| -> Option<(Arc<Document>, Rect)> {
+        if !art {
+            return Some((doc.clone(), Rect::ZERO));
+        }
         isolated(doc, &doc.paint_order(ids.iter().copied()), name).map(|(d, r)| (Arc::new(d), r))
     };
+    // Each item's stem follows Windows' file-naming rules, and no two items share one.
+    let safe = |stems: Vec<String>| distinct_names(stems.iter().map(|s| safe_file_name(s)));
     let named = |pieces: Vec<(String, Arc<Document>, Option<usize>, Rect)>, fallback: &str| -> Vec<Item> {
-        let stems = unique_file_names(pieces.iter().map(|(n, ..)| (n.as_str(), fallback.to_string())));
+        let stems = safe(unique_file_names(pieces.iter().map(|(n, ..)| (n.as_str(), fallback.to_string()))));
         pieces
             .into_iter()
             .zip(stems)
@@ -688,7 +808,8 @@ fn items(doc: &Arc<Document>, o: &ScreenParams, selection: Option<bool>, selecte
             (doc.clone(), Rect::ZERO)
         };
         let name = filename.to_string();
-        return Ok(vec![Item { name: name.clone(), stem: name, doc: whole, artboard: Some(0), region, every_artboard: Some(doc.clone()) }]);
+        let stem = safe_file_name(&name);
+        return Ok(vec![Item { name, stem, doc: whole, artboard: Some(0), region, every_artboard: Some(doc.clone()) }]);
     }
     if let Some(ids) = &o.assets {
         let mut pieces = vec![];
@@ -742,7 +863,7 @@ fn items(doc: &Arc<Document>, o: &ScreenParams, selection: Option<bool>, selecte
     if boards.is_empty() {
         return Err(bad(C, "the document has no artboard"));
     }
-    let stems = artboard_file_names(doc, &boards);
+    let stems = safe(artboard_file_names(doc, &boards));
     Ok(boards
         .into_iter()
         .zip(stems)

crates/engine/src/cmd/fileio/svg.rs

@@ -157,6 +157,10 @@ pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Enco
     // that preparation out of the native attachment so missing links remain relinkable.
     let (full, warnings) = crate::cmd::place::document::full_documents(doc);
     let doc = &*full;
+    // A chosen artboard's file holds the art over it; otherwise the file holds all of it.
+    let regions: Option<Vec<vectorcraft_geom::Rect>> =
+        chosen.then(|| boards.iter().flatten().filter_map(|b| doc.artboards.get(*b)).map(|a| a.rect).collect());
+    let overflow = crate::cmd::fonts::export_overflow_warning(doc, &doc.layers, regions.as_deref());
     // SVG has no filters for the Photoshop-style effects: their objects go in as images.
     let flat = crate::cmd::rasterfx::flatten_pixel_effects(doc);
     let doc = flat.as_ref().unwrap_or(doc);
@@ -184,5 +188,6 @@ pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Enco
     {
         enc.warnings.push(w);
     }
+    enc.warnings.extend(overflow);
     Ok(enc)
 }

crates/engine/src/cmd/fileio/tests.rs

@@ -114,6 +114,223 @@ fn cmyk_tiffs_keep_their_inks_and_other_tiffs_become_png() {
     assert_eq!(rgb.blob.mime, "image/png");
 }
 
+/// A 3 × 2 TIFF at 150 ppi of `channels` (`extra`: their ExtraSamples values), 8 or 16 `bits` a
+/// sample, chunky or `planar`.
+fn hand_tiff(photometric: u16, bits: u16, extra: &[u16], planar: bool, channels: &[Vec<u16>]) -> Vec<u8> {
+    let t = vectorcraft_testkit::tiff::Tiff { width: 3, height: 2, photometric, bits, extra, planar, ppi: Some(150), channels };
+    vectorcraft_testkit::tiff::tiff(&t)
+}
+
+/// What Place keeps of TIFF `bytes`: the ink amounts, when it keeps them, and the pixels any image
+/// reader decodes from the stored image, as RGBA.
+fn kept(what: &str, bytes: &[u8]) -> (Option<Vec<u8>>, Vec<u8>) {
+    let r = raster_image(bytes).unwrap_or_else(|e| panic!("{what}: {e}"));
+    assert_eq!((r.width, r.height, r.ppi), (3, 2, Some((150.0, 150.0))), "{what}");
+    assert_eq!(super::ppi::resolution(&r.blob.bytes), Some((150.0, 150.0)), "{what}: the stored image keeps the resolution");
+    let rgba = image::load_from_memory(&r.blob.bytes).unwrap_or_else(|e| panic!("{what}: {e}")).to_rgba8().into_raw();
+    (r.blob.cmyk().map(|i| i.data), rgba)
+}
+
+/// TIFFs that store one plane per channel (PlanarConfiguration 2) read as their chunky versions do:
+/// grayscale and RGB with extra channels, and CMYK with and without them (#1466).
+#[test]
+fn planar_tiffs_read_as_their_chunky_versions() {
+    let ch = |v: [u16; 6]| v.to_vec();
+    let (gray, alpha, spot) = (ch([0, 51, 102, 153, 204, 255]), ch([255, 128, 0, 255, 64, 255]), ch([9, 8, 7, 6, 5, 4]));
+    let (r, g, b) = (ch([255, 0, 0, 10, 20, 30]), ch([0, 255, 0, 40, 50, 60]), ch([0, 0, 255, 70, 80, 90]));
+    let (c, m, y, k) = (ch([255, 0, 0, 0, 12, 200]), ch([0, 255, 0, 0, 34, 100]), ch([0, 0, 255, 0, 56, 50]), ch([0, 0, 0, 255, 78, 0]));
+    // Pixel by pixel, the samples of `px`.
+    let interleave = |px: &[&Vec<u16>]| -> Vec<u8> { (0..6).flat_map(|i| px.iter().map(move |v| v[i] as u8)).collect() };
+    let opaque = ch([255; 6]);
+    let inks = interleave(&[&c, &m, &y, &k]);
+    // (photometric, ExtraSamples, channels, the RGBA pixels when the color is gray or RGB, the inks when it is CMYK)
+    type Case = (u16, Vec<u16>, Vec<Vec<u16>>, Option<Vec<u8>>, Option<Vec<u8>>);
+    let cases: Vec<Case> = vec![
+        (1, vec![2], vec![gray.clone(), alpha.clone()], Some(interleave(&[&gray, &gray, &gray, &alpha])), None),
+        (1, vec![2, 0], vec![gray.clone(), alpha.clone(), spot.clone()], Some(interleave(&[&gray, &gray, &gray, &alpha])), None),
+        (2, vec![0], vec![r.clone(), g.clone(), b.clone(), spot.clone()], Some(interleave(&[&r, &g, &b, &opaque])), None),
+        (2, vec![2, 0], vec![r.clone(), g.clone(), b.clone(), alpha.clone(), spot.clone()], Some(interleave(&[&r, &g, &b, &alpha])), None),
+        (5, vec![], vec![c.clone(), m.clone(), y.clone(), k.clone()], None, Some(inks.clone())),
+        (5, vec![0], vec![c.clone(), m.clone(), y.clone(), k.clone(), spot.clone()], None, Some(inks.clone())),
+        (5, vec![2], vec![c.clone(), m.clone(), y.clone(), k.clone(), alpha.clone()], None, None),
+    ];
+    for (photometric, extra, channels, want_rgba, want_inks) in cases {
+        for bits in [8, 16] {
+            let wide: Vec<Vec<u16>> = channels.iter().map(|ch| ch.iter().map(|v| if bits == 16 { v * 257 } else { *v }).collect()).collect();
+            let what = format!("photometric {photometric}, extra samples {extra:?}, {bits} bits");
+            let chunky = kept(&format!("{what}, chunky"), &hand_tiff(photometric, bits, &extra, false, &wide));
+            let planar = kept(&format!("{what}, planar"), &hand_tiff(photometric, bits, &extra, true, &wide));
+            assert_eq!(planar.0, chunky.0, "{what}: planar keeps the inks chunky keeps");
+            assert_eq!(planar.0, want_inks, "{what}: the inks");
+            // A 16-bit chunky CMYK file is stored as it is, and a planar one is written again with
+            // its 8-bit inks: their RGB pixels may be a level apart.
+            let close = planar.1.len() == chunky.1.len() && planar.1.iter().zip(&chunky.1).all(|(a, b)| a.abs_diff(*b) <= 1);
+            assert!(close, "{what}: planar reads as chunky: {:?} against {:?}", planar.1, chunky.1);
+            if let Some(want) = &want_rgba {
+                assert_eq!(&planar.1, want, "{what}: the pixels");
+            }
+        }
+    }
+}
+
+/// A planar TIFF whose header claims more strips than the decoder can count (here 2^31 + 1 rows
+/// a strip each, times 5 planes) is refused as too large to draw, without a panic.
+#[test]
+fn planar_tiffs_with_more_strips_than_can_be_counted_are_too_large() {
+    let plane = |v: u16| vec![v; 6];
+    let mut file = hand_tiff(5, 8, &[0], true, &[plane(200), plane(40), plane(10), plane(0), plane(90)]);
+    // ImageLength (the directory's second entry, its value at offset 30) and RowsPerStrip (the
+    // eighth, at offset 102).
+    file[30..34].copy_from_slice(&(1u32 << 31 | 1).to_le_bytes());
+    file[102..106].copy_from_slice(&1u32.to_le_bytes());
+    let e = raster_image(&file).err().expect("refused");
+    assert!(e.to_string().contains("an image of 3 × 2147483649 pixels is too large to draw"), "{e}");
+    assert!(too_large_note(&file).is_some());
+    assert_eq!(vectorcraft_doc::cmyk::oversized_tiff(&file), Some((3, 1 << 31 | 1)));
+}
+
+/// A 16-bit RGB TIFF whose samples need more than the allowance (6 bytes a pixel), though its RGBA
+/// pixels would fit, is refused as too large to draw before it is decoded.
+#[test]
+fn tiffs_whose_samples_pass_the_allowance_are_too_large() {
+    let plane = |v: u16| vec![v; 6];
+    let mut file = hand_tiff(2, 16, &[], false, &[plane(9000), plane(30_000), plane(60_000)]);
+    // The loop sets ImageWidth, ImageLength and RowsPerStrip (the first, second and eighth entries) to `side`.
+    let side = 20_000u32;
+    assert!(u64::from(side * side) * 6 > MAX_RASTER_ALLOC && u64::from(side * side) * 4 <= MAX_RASTER_ALLOC);
+    for at in [18, 30, 102] {
+        file[at..at + 4].copy_from_slice(&side.to_le_bytes());
+    }
+    let e = raster_image(&file).err().expect("refused");
+    assert_eq!(e.to_string(), "an image of 20000 × 20000 pixels is too large to draw");
+}
+
+/// A planar CMYK TIFF opens and places with its ink amounts, stored as a TIFF the image decoder
+/// reads (#1466).
+#[test]
+fn planar_cmyk_tiffs_open_and_place_with_their_inks() {
+    let inks = [vec![255u16, 0, 12, 0, 40, 9], vec![0, 255, 34, 0, 50, 8], vec![0, 0, 56, 0, 60, 7], vec![0, 0, 78, 255, 70, 6]];
+    let file = hand_tiff(5, 8, &[], true, &inks);
+    let want: Vec<u8> = (0..6).flat_map(|i| inks.iter().map(move |v| v[i] as u8)).collect();
+    assert!(image::load_from_memory(&file).is_err(), "the image decoder reads planar CMYK now");
+    let mut s = Session::new();
+    open(&mut s, "planar.tif", &file);
+    let blob = &s.doc().unwrap().doc.images[&image_of(&s).key];
+    assert_eq!(blob.cmyk().map(|i| i.data), Some(want.clone()), "Open keeps the inks");
+    let mut s = session(100.0, 100.0, 1);
+    s.execute("file.place", &json!({"name": "planar.tif", "dataBase64": vectorcraft_format::base64_encode(&file)})).unwrap();
+    let blob = &s.doc().unwrap().doc.images[&image_of(&s).key];
+    assert_eq!(blob.cmyk().map(|i| i.data), Some(want), "Place keeps the inks");
+    assert!(image::load_from_memory(&blob.bytes).is_ok(), "the image decoder reads the stored image");
+}
+
+/// A 70 × 7 picture, `true` for black: a white row and a black row (runs past 63 take a make-up
+/// code), then runs of several lengths.
+fn fax_picture() -> Vec<Vec<bool>> {
+    (0..7).map(|y| (0..70).map(|x| if y < 2 { y == 1 } else { (x * (y + 2) / 5 + y) % 3 == 0 }).collect()).collect()
+}
+
+/// The first `rows` rows of [`fax_picture`] as a TIFF compressed with CCITT Group 3 in one strip:
+/// `compression` 2 or 3 with `t4_options`, white is zero, the highest bit of each byte first.
+fn group3_tiff(compression: u16, t4_options: u32, rows: usize) -> Vec<u8> {
+    let rows = &fax_picture()[..rows];
+    let g =
+        vectorcraft_testkit::tiff::Group3 { rows, compression, t4_options, photometric: 0, fill_order: 1, rows_per_strip: 7, tile: None, rtc: false };
+    vectorcraft_testkit::tiff::group3(&g)
+}
+
+/// 1-bit TIFFs compressed with CCITT Group 3 open and place with their pixels (#1466): Compression
+/// 2 (modified Huffman) and Compression 3 (ITU-T T.4) with one-dimensional rows or two-dimensional
+/// ones (T4Options bit 0), with and without fill bits (bit 2) and six EOLs at the end, in one strip,
+/// three strips or three 32 × 16 tiles, each byte's highest or lowest bit first (FillOrder 1 and 2),
+/// white or black as zero.
+#[test]
+fn ccitt_group3_tiffs_open_and_place_with_their_pixels() {
+    let rows = fax_picture();
+    let mut s = Session::new();
+    for (compression, t4_options, rtc) in [(2, 0, false), (3, 0, false), (3, 4, true), (3, 1, false), (3, 5, true)] {
+        for (rows_per_strip, tile) in [(7, None), (3, None), (7, Some((32, 16)))] {
+            for fill_order in [1, 2] {
+                for photometric in [0, 1] {
+                    let what = format!(
+                        "Compression {compression}, T4Options {t4_options}, {rows_per_strip} rows a strip, tiles {tile:?}, FillOrder {fill_order}, photometric {photometric}"
+                    );
+                    let g = vectorcraft_testkit::tiff::Group3 {
+                        rows: &rows,
+                        compression,
+                        t4_options,
+                        photometric,
+                        fill_order,
+                        rows_per_strip,
+                        tile,
+                        rtc,
+                    };
+                    let file = vectorcraft_testkit::tiff::group3(&g);
+                    assert!(image::load_from_memory(&file).is_err(), "{what}: the image decoder reads Group 3 now");
+                    // A black run's pixels are 1 bits, which show as black when white is zero.
+                    let want: Vec<u8> = rows.concat().iter().map(|&black| if black == (photometric == 0) { 0 } else { 255 }).collect();
+                    let pixels = |s: &Session| {
+                        let blob = &s.doc().unwrap().doc.images[&image_of(s).key];
+                        image::load_from_memory(&blob.bytes).unwrap_or_else(|e| panic!("{what}: {e}")).to_luma8().into_raw()
+                    };
+                    open(&mut s, "fax.tif", &file);
+                    assert_eq!(pixels(&s), want, "{what}: Open");
+                    let mut placed = session(100.0, 100.0, 1);
+                    placed.execute("file.place", &json!({"name": "fax.tif", "dataBase64": vectorcraft_format::base64_encode(&file)})).unwrap();
+                    assert_eq!(pixels(&placed), want, "{what}: Place");
+                }
+            }
+        }
+    }
+}
+
+/// A Group 3 TIFF whose pixels would take more than the decoding allowance as RGBA is refused as
+/// too large to draw, without a panic at 2^31 × 2^31 pixels too. One whose data ends inside a row,
+/// or after a whole row before the strip's last, is refused as damaged, and so is one whose tiles
+/// are wider than the allowance.
+#[test]
+fn ccitt_group3_tiffs_too_large_or_cut_short_are_refused() {
+    // ImageWidth (the directory's first entry, its value at offset 18), ImageLength (the second, at
+    // 30) and RowsPerStrip (the eighth, at 102).
+    for (width, height) in [(70u32, 1u32 << 30), (1 << 31, 1 << 31)] {
+        let mut big = group3_tiff(3, 1, 7);
+        big[18..22].copy_from_slice(&width.to_le_bytes());
+        big[30..34].copy_from_slice(&height.to_le_bytes());
+        big[102..106].copy_from_slice(&height.to_le_bytes());
+        let e = raster_image(&big).err().expect("refused");
+        assert!(e.to_string().contains(&format!("an image of {width} × {height} pixels is too large to draw")), "{e}");
+    }
+    let mut short = group3_tiff(3, 0, 7);
+    short.truncate(short.len() - 6);
+    let e = raster_image(&short).err().expect("refused");
+    assert!(e.to_string().contains("could not decode image: unexpected end of input"), "{e}");
+    // Compression 2 rows start at a byte, so the strip of the first six rows is where the strip of
+    // seven starts. StripByteCounts (the ninth entry, its value at offset 114) gives the six rows'.
+    let (mut seven, six) = (group3_tiff(2, 0, 7), group3_tiff(2, 0, 6));
+    seven[114..118].copy_from_slice(&six[114..118]);
+    assert_eq!(seven[30..34], 7u32.to_le_bytes(), "ImageLength");
+    assert_eq!(seven[78..82], six[78..82], "StripOffsets (the sixth entry, at offset 78)");
+    let e = raster_image(&seven).err().expect("refused");
+    assert!(e.to_string().contains("could not decode image: unexpected end of input"), "{e}");
+    // A tile wider than the allowance: TileWidth (the eighth entry, its value at offset 102).
+    let rows = fax_picture();
+    let g = vectorcraft_testkit::tiff::Group3 {
+        rows: &rows,
+        compression: 3,
+        t4_options: 1,
+        photometric: 0,
+        fill_order: 1,
+        rows_per_strip: 7,
+        tile: Some((80, 16)),
+        rtc: false,
+    };
+    let mut wide = vectorcraft_testkit::tiff::group3(&g);
+    assert_eq!(wide[102..106], 80u32.to_le_bytes(), "TileWidth");
+    wide[102..106].copy_from_slice(&u32::MAX.to_le_bytes());
+    let e = raster_image(&wide).err().expect("refused");
+    assert!(e.to_string().contains("could not decode image: arithmetic overflow"), "{e}");
+}
+
 #[test]
 fn content_beats_a_wrong_extension() {
     let png = image_bytes(2, 2, image::ImageFormat::Png);
@@ -129,7 +346,8 @@ fn templates_open_untitled() {
     let mut s = session(100.0, 100.0, 1);
     let dir = tmp_dir("tpl");
     let path = dir.join("t.vectorcraft").to_string_lossy().to_string();
-    s.execute("file.saveAsTemplate", &json!({"path": path})).unwrap();
+    // A template under a native file name still opens untitled.
+    std::fs::write(&path, b64(&s.execute("file.saveAsTemplate", &json!({})).unwrap())).unwrap();
     let r = s.execute("document.open", &json!({"path": path})).unwrap();
     assert!(r["title"].as_str().unwrap().starts_with("Untitled-"), "{r}");
     assert_eq!(s.doc().unwrap().path, None);

crates/engine/src/cmd/fileio/tests_aiimport.rs

@@ -135,16 +135,42 @@ fn a_pdfs_art_past_the_page_opens_whole_from_its_editing_data() {
     assert!(s.doc().unwrap().doc.art_bounds().is_some_and(|b| b.x1 < 200.5));
 }
 
-/// Editing data that can't be read leaves the file as its PDF part reads, with that part's notes:
-/// a `.ai`'s art outside its artboards is missing, and a PDF's art past the page is clipped.
+/// A `.ai` or a PDF whose editing data can't be decompressed opens from its PDF part with a note
+/// that its layers weren't read, and an export to its own path is refused unless it is given
+/// `acknowledgeLoss`.
+#[test]
+fn a_file_whose_editing_data_cant_be_decompressed_is_not_written_over_unasked() {
+    let d = std::env::temp_dir().join(format!("vc-aiundecoded-{}", std::process::id()));
+    std::fs::create_dir_all(&d).unwrap();
+    let damaged = b"%AI12_CompressedDataxx";
+    for (name, file) in [("art.ai", ai::ai(damaged, ai::page_pdf())), ("art.pdf", ai::pdf(damaged, ai::page_pdf()))] {
+        let path = d.join(name);
+        std::fs::write(&path, &file).unwrap();
+        let path = path.to_string_lossy().to_string();
+        let mut s = Session::new();
+        let r = s.execute("document.open", &json!({"path": path})).unwrap();
+        assert!(r["warnings"].to_string().contains("layers weren't read from its editing data (its zlib compression is damaged)"), "{name}: {r}");
+        let e = s.execute("document.export", &json!({"path": path})).unwrap_err().to_string();
+        assert!(e.contains("left things out") && e.contains("layers weren't read"), "{name}: {e}");
+        assert_eq!(std::fs::read(&path).unwrap(), file, "{name}");
+        s.execute("document.export", &json!({"path": path, "acknowledgeLoss": true})).unwrap();
+        assert_ne!(std::fs::read(&path).unwrap(), file, "{name}");
+    }
+    std::fs::remove_dir_all(d).ok();
+}
+
+/// Editing data that can't be read leaves the file as its PDF part reads, with that part's notes
+/// and then a note saying why its layers weren't read: a `.ai`'s art outside its artboards is
+/// missing, and a PDF's art past the page is clipped.
 #[test]
 fn editing_data_that_cant_be_read_keeps_the_pdf_parts_notes() {
     let damaged = b"%AI12_CompressedData not zlib";
+    let unread = "the file's layers weren't read from its editing data (its zlib compression is damaged): they come from its PDF part";
     let mut s = Session::new();
     let r = open(&mut s, "damaged.ai", &ai::ai(damaged, ai::page_pdf()), json!({})).unwrap();
-    assert_eq!(r["warnings"], json!([vectorcraft_pdf::OFF_ARTBOARD_NOTE]), "{r}");
+    assert_eq!(r["warnings"], json!([vectorcraft_pdf::OFF_ARTBOARD_NOTE, unread]), "{r}");
     let r = open(&mut s, "damaged.pdf", &ai::pdf(damaged, "0 g 150 20 100 60 re f"), json!({})).unwrap();
-    assert_eq!(r["warnings"], json!([vectorcraft_pdf::PAST_PAGE_NOTE]), "{r}");
+    assert_eq!(r["warnings"], json!([vectorcraft_pdf::PAST_PAGE_NOTE, unread]), "{r}");
 }
 
 #[test]
@@ -158,6 +184,34 @@ fn what_the_reader_doesnt_read_opens_as_before_with_a_warning() {
     assert!(r["warnings"].to_string().contains("symbols") && r["warnings"].to_string().contains("PDF part"), "{r}");
 }
 
+/// A `.ai` whose document data has a variable library opens with a note that its variables and
+/// data sets weren't read, whether its layers are read or it comes in as its PDF part.
+#[test]
+fn an_ai_file_with_a_variable_library_says_its_variables_werent_read() {
+    const NOTE: &str = "the file's variables and data sets weren't read (variables: 2, data sets: 3): the Variables panel doesn't list them";
+    let library = ai::variable_library(&["Name", "Number"], &["One", "Two", "Three"]);
+    let square = format!("0 1 1 0 1 0 0 Xa\n{}f\n", ai::rect(10.0, 50.0, 40.0, 90.0));
+    let notes =
+        |r: &Value| r["warnings"].as_array().unwrap().iter().filter(|w| w.as_str().unwrap().contains("variables")).cloned().collect::<Vec<_>>();
+    let mut s = Session::new();
+    let layered = ai::editing_data(200.0, 100.0, &format!("{library}{}", ai::layer("Art", &square)));
+    let file = ai::ai(&compressed(layered.as_bytes()), "1 0 0 rg 10 50 30 40 re f");
+    let r = open(&mut s, "variables.ai", &file, json!({})).unwrap();
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Art"], "{r}");
+    assert_eq!(notes(&r), [json!(NOTE)], "{r}");
+    let r = s.execute("variable.list", &json!({})).unwrap();
+    assert_eq!(r["variables"], json!([]), "{r}");
+    // Its layers can't be read (a symbol): it comes in as its PDF part, with the note.
+    let symbols = ai::editing_data(200.0, 100.0, &format!("{library}{}", ai::layer("Art", "/SymbolInstance :\n(Dot) /SymbolRef ,\n;\n")));
+    let r = open(&mut s, "symbols.ai", &ai::ai(&compressed(symbols.as_bytes()), ai::page_pdf()), json!({})).unwrap();
+    assert!(r["warnings"].to_string().contains("PDF part"), "{r}");
+    assert_eq!(notes(&r), [json!(NOTE)], "{r}");
+    // Without a library, no note.
+    let plain = ai::editing_data(200.0, 100.0, &ai::layer("Art", &square));
+    let r = open(&mut s, "plain.ai", &ai::ai(&compressed(plain.as_bytes()), "1 0 0 rg 10 50 30 40 re f"), json!({})).unwrap();
+    assert!(notes(&r).is_empty(), "{r}");
+}
+
 /// A page showing only a placeholder line, as a `.ai` saved without PDF compatibility has.
 const PLACEHOLDER: &str = "BT /F1 12 Tf 10 50 Td (Saved without its PDF part) Tj ET";
 
@@ -303,6 +357,144 @@ fn type_asked_for_as_outlines_opens_a_file_whose_type_shows_from_its_pdf_part()
     assert_ne!(names(&s.doc().unwrap().doc.layers), ["Art"], "{r}");
 }
 
+/// `data` as ASCII85, up to the `~>`.
+fn ascii85(data: &[u8]) -> String {
+    let mut out = String::new();
+    for chunk in data.chunks(4) {
+        let mut x = chunk.iter().enumerate().fold(0u32, |v, (i, b)| v | u32::from(*b) << (24 - 8 * i));
+        let mut d = [0u8; 5];
+        for c in d.iter_mut().rev() {
+            *c = (x % 85) as u8 + b'!';
+            x /= 85;
+        }
+        out.extend(d.iter().take(chunk.len() + 1).map(|c| char::from(*c)));
+    }
+    out.push_str("~>");
+    out
+}
+
+/// Page content drawing one glyph and then `rest` in 10 pt on the baseline at `y`, from x = 14, in
+/// rendering mode `mode` (0 fills the type, 1 strokes it). The glyph is code 0x41 of the font `F2`,
+/// standing for the "fi" of the story, and `F2` isn't installed and its `ToUnicode` map gives that
+/// glyph U+FFFD, so that the PDF part keeps it as outlines; `rest` is in Helvetica (`F1`).
+fn half_outlined_line(y: f64, rest: &str, mode: u8) -> String {
+    format!("{mode} Tr BT /F2 10 Tf 14 {y} Td (A) Tj ET BT /F1 10 Tf 19 {y} Td ({rest}) Tj ET ")
+}
+
+/// A `.ai` whose page draws a gray square and `type_content` (see [`half_outlined_line`]), and whose
+/// layer `Art` has the square and text objects: the first of story 0, which `story` gives in the
+/// text document (a line starting at (14, 65)), then `more` of a story the text document doesn't
+/// have. Without `story` the file has no text document.
+fn half_outlined_ai(story: Option<&str>, more: usize, type_content: &str) -> Vec<u8> {
+    let text = |story: u32| format!("/AI11Text :\n0 /FreeUndo ,\n0 /FrameIndex ,\n{story} /StoryIndex ,\n;\n");
+    let texts: String = std::iter::once(text(0)).chain((0..more).map(|_| text(99))).collect();
+    let mut body =
+        format!("%AI3_TemplateBox: 100 50 100 50\n{}", ai::layer("Art", &format!("0.5 g\n{}f\n{texts}", ai::rect(120.0, 20.0, 160.0, 60.0))));
+    if let Some(story) = story {
+        // The story's one line starts at the canvas center (8191.5, the template box's center) moved
+        // to (14, 65): its y runs down the page.
+        let n = story.chars().count();
+        let document = format!(
+            "/0 << /1 << /0 [ << /0 << /0 << /0 (Helvetica) >> >> >> ] >> /8 << /0 [ << /0 << /0 [ 0 0 ] /2 << /2 [ 1 0 0 1 0 0 ] >> >> >> ] >> >>\n\
+             /1 << /1 [ << /0 << /0 ({story}\r) /5 << /0 [ << /0 << /0 << /0 () /5 << /0 0 >> /6 0 >> >> /1 {} >> ] >> \
+             /6 << /0 [ << /0 << /0 << /0 () /5 0 /6 << /0 0 /1 10.0 /53 << /99 /CAITextPaint /0 << /0 2 /1 [ 1.0 0.0 0.0 0.0 1.0 ] >> >> >> >> >> /1 {} >> ] >> >> \
+             /1 << /0 [ << /0 0 >> ] /2 [ << /99 /PC /6 [ << /99 /F /0 << /0 [ 8105.5 8176.5 ] >> /6 [ << /99 /R /6 [ << /99 /R /6 [ << /99 /L /6 [ \
+             << /99 /S /0 << /0 [ 0.0 0.0 ] >> /15 << /0 {} >> >> ] >> ] >> ] >> ] >> ] >> ] >> >> ] /2 << /1 12.0 >> >>\n",
+            n + 1,
+            n + 1,
+            n + 1
+        );
+        let lines: Vec<String> = ascii85(document.as_bytes()).as_bytes().chunks(60).map(|c| format!("%{}", String::from_utf8_lossy(c))).collect();
+        body.push_str(&format!("%AI11_BeginTextDocument\n/AI11TextDocument : /ASCII85Decode ,\n{}\n%AI11_EndTextDocument\n", lines.join("\n")));
+    }
+    let data = ai::editing_data(200.0, 100.0, &body);
+    let content = format!("0.5 g 120 20 40 40 re f 0.2 g 0.2 G {type_content}");
+    let page = PdfPage {
+        resources: format!(
+            "/Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> \
+             /F2 << /Type /Font /Subtype /Type1 /BaseFont /VectorCraftTestUnnamed /ToUnicode {} 0 R >> >>",
+            first_extra(1) + 1
+        ),
+        entries: format!("/PieceInfo << /Illustrator << /Private << /AIPrivateData1 {} 0 R /NumBlock 1 >> >> >>", first_extra(1)),
+        ..PdfPage::new(200.0, 100.0, &content)
+    };
+    let cmap = "begincmap\n1 begincodespacerange\n<00> <FF>\nendcodespacerange\n1 beginbfchar\n<41> <FFFD>\nendbfchar\nendcmap\n";
+    pdf_with(
+        &[page],
+        &[&format!("<< /Length {} >>\nstream\n{data}\nendstream", data.len()), &format!("<< /Length {} >>\nstream\n{cmap}endstream", cmap.len())],
+        None,
+    )
+}
+
+fn outlines_notes(r: &Value) -> Vec<String> {
+    let notes = r["warnings"].as_array().unwrap().iter().filter_map(Value::as_str);
+    notes.filter(|w| vectorcraft_pdf::is_outlines_note(w)).map(String::from).collect()
+}
+
+/// The notes the PDF part of [`half_outlined_ai`] reads with: its glyph of U+FFFD, kept as outlines.
+fn pdf_part_outlines_notes() -> [String; 2] {
+    [format!("text in Vector Craft Test Unnamed {}", vectorcraft_pdf::UNNAMED_CHARACTERS_NOTE), vectorcraft_pdf::OUTLINED_TEXT_NOTE.into()]
+}
+
+/// The note on text objects that hold the page's type without some of its characters, for `n` of
+/// them.
+fn without_outlines_note(n: usize) -> Value {
+    json!(format!("{n} text objects hold their type as the page draws it, without the characters the page has only as outlines"))
+}
+
+/// The texts in the first layer.
+fn texts(s: &Session) -> Vec<String> {
+    let art = s.doc().unwrap().doc.layers[0].children().unwrap();
+    art.iter().filter_map(|n| if let NodeKind::Text(t) = &n.kind { Some(t.plain_text()) } else { None }).collect()
+}
+
+/// The note that glyphs were kept as outlines is dropped when the type comes from the editing data's
+/// text document, and stays with the PDF part alone.
+#[test]
+fn type_from_the_text_document_opens_without_the_pdf_parts_note_on_outlines() {
+    let file = half_outlined_ai(Some("first draft"), 0, &half_outlined_line(65.0, "rst draft", 0));
+    let mut s = Session::new();
+    let r = open(&mut s, "draft.ai", &file, json!({})).unwrap();
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Art"], "{r}");
+    assert_eq!(texts(&s), ["first draft"], "{r}");
+    assert_eq!(outlines_notes(&r), Vec::<String>::new(), "{r}");
+    assert!(!r["warnings"].as_array().unwrap().contains(&without_outlines_note(1)), "{r}");
+    let r = open(&mut s, "draft.ai", &file, json!({"editingData": false})).unwrap();
+    assert_eq!(outlines_notes(&r), pdf_part_outlines_notes(), "{r}");
+    // A second text object that takes the page's type, away from the glyph: no note on it.
+    let page = half_outlined_line(65.0, "rst draft", 0) + "BT /F1 10 Tf 14 30 Td (notes) Tj ET";
+    let r = open(&mut s, "notes.ai", &half_outlined_ai(Some("first draft"), 1, &page), json!({})).unwrap();
+    assert_eq!(texts(&s), ["first draft", "notes"], "{r}");
+    assert_eq!(outlines_notes(&r), Vec::<String>::new(), "{r}");
+    assert!(!r["warnings"].as_array().unwrap().contains(&without_outlines_note(1)), "{r}");
+}
+
+/// A text object that takes the page's type lacks the glyphs next to it that the page kept as
+/// outlines: a note counts such objects, in place of the PDF part's notes. Stroked glyphs that
+/// come in with the stroked type keep the PDF part's notes.
+#[test]
+fn type_from_the_page_opens_with_a_note_on_the_characters_it_has_only_as_outlines() {
+    let mut s = Session::new();
+    let r = open(&mut s, "draft.ai", &half_outlined_ai(None, 0, &half_outlined_line(65.0, "rst draft", 0)), json!({})).unwrap();
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Art"], "{r}");
+    assert_eq!(texts(&s), ["rst draft"], "{r}");
+    assert!(!vectorcraft_pdf::holds_outlines(&s.doc().unwrap().doc), "{r}");
+    assert_eq!(outlines_notes(&r), Vec::<String>::new(), "{r}");
+    assert!(r["warnings"].as_array().unwrap().contains(&without_outlines_note(1)), "{r}");
+    // Stroked: the glyph comes in with the type.
+    let r = open(&mut s, "draft.ai", &half_outlined_ai(None, 0, &half_outlined_line(65.0, "rst draft", 1)), json!({})).unwrap();
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Art"], "{r}");
+    assert!(vectorcraft_pdf::holds_outlines(&s.doc().unwrap().doc), "{r}");
+    assert_eq!(outlines_notes(&r), pdf_part_outlines_notes(), "{r}");
+    assert!(!r["warnings"].to_string().contains("without the characters"), "{r}");
+    // A stroked line whose glyph comes in, and a filled one whose glyph doesn't.
+    let page = half_outlined_line(65.0, "rst draft", 1) + &half_outlined_line(30.0, "nd more", 0);
+    let r = open(&mut s, "both.ai", &half_outlined_ai(None, 1, &page), json!({})).unwrap();
+    assert_eq!(texts(&s), ["rst draft", "nd more"], "{r}");
+    assert_eq!(outlines_notes(&r), pdf_part_outlines_notes(), "{r}");
+    assert!(r["warnings"].as_array().unwrap().contains(&without_outlines_note(1)), "{r}");
+}
+
 /// A `.ai` saved in units of 10 points: its PDF part's page is 200 × 100 with `/UserUnit 10`, and
 /// its editing data has the artboard and a red rectangle in the same units. It opens at 2000 × 1000
 /// pt, from its editing data and from its PDF part alone, with the rectangle ten times as large,

crates/engine/src/cmd/fileio/tests_batch.rs

@@ -105,6 +105,17 @@ fn the_counter_counts_items_or_files_from_any_start() {
     assert_eq!(parts, ["1_Artboard 2_2x@2x_png.png"]);
 }
 
+/// Export for Screens writes the characters Windows does not allow in a file name (`<`, `>`, `"`,
+/// `|`, `?`, `*`, control characters) as `-` in a pattern's text and in the names its tokens stand
+/// for, on every platform.
+#[test]
+fn a_pattern_writes_the_characters_windows_does_not_allow_as_dashes() {
+    let mut s = session(1);
+    s.execute("artboard.setProps", &json!({"index": 0, "name": "a|b?\"c\u{7}"})).unwrap();
+    let r = export(&mut s, json!({"name": "<name>*<x>", "formats": [{"format": "svg"}]}));
+    assert_eq!(names(&r), ["a-b--c---x-.svg"]);
+}
+
 #[test]
 fn layers_and_the_selection_are_exported_by_name() {
     let mut s = session(1);