A call whose arguments hold a file or folder key at any depth, such as an
effect's textureImage.path, is refused before the command runs; the walk
keeps its own stack. Each call also runs with automation file access
confined to no roots, so every checked read or write a command makes is
refused, whichever param carried the path.
Create Gradient Mesh, a Mesh tool click and Object > Expand of a gradient
to a mesh gave each border edge one cubic fitted between two mesh points
and picked the corners from the bounding box, so the border cut off
corners and curves: 49 pt off a five-point star, 54 pt off a notch.
- The border follows the outline of the largest subpath by length; border
points sit on it and an edge with no anchor inside is the exact piece
of its segment.
- Where no single cubic follows a run within 0.1 pt (a thousandth of the
size on a small outline), a mesh line goes through an anchor, the
sharpest corner first; at most 256 lines each way. Rectangles and
ellipses keep the rows and columns asked for.
- Smooth runs keep their end tangents; border handles are no longer made
collinear.
- To Center and To Edge highlight placement accounts for the extra lines
(for_path_shaded, also used for gradient fills).
- Non-finite points give no mesh; a degenerate outline keeps the old
bounding-box mesh.
Holes of a compound path are still left out, as before.
Docs: docs/target-app-parity.md.
- PDF 1.3 and 1.4 files, PDF/X-1a, PDF/X-3, PDF/X-4 and PDF/A-2b at
PDF 1.4 among them, write a page longer than 14,400 pt in points
again, now with a warning that apps that keep to the limit cut it to
200 in. Only a page that failed with
"PDF writer error: Limit(TooLargeFloat)" gets the new error: one
whose size or art needs a real number past 32,767, the most PDF 1.4
holds. Whole numbers are written as integers, so a page of whole
points past 32,767 is written as before.
- A page whose side is past 32,767 pt and not a whole number of points
is refused before the thumbnails are drawn and the transparency is
flattened.
- A PDF 1.5 file written as PDF 1.6 for a long page keeps PDF 1.5's
encryption (128-bit RC4), which the Save PDF dialog shows.
- A long page whose short side would be under 3 units at its UserUnit
(ISO 32000-1, Annex C.2), such as 50 m x 4 mm, gets a smaller
UserUnit that keeps the short side at 3 units, with a warning.
- The warnings give a page's size rounded up, as the error does.
A page of 14,400 pt or less is written as before. The new warning has
rows in every complete catalog. Docs: docs/mcp.md,
docs/target-app-parity.md and the document.exportPdf params.
`Session::history_budget` (default `default_history_budget()`) caps the
memory the undo steps of all open documents keep together. After each
command, tool edit, interaction commit, direct edit, framed script run
and closed undo group, `Session::trim_histories` drops the oldest steps
of any document first, undo steps before redo steps. Each document keeps
its last eight undo steps and next eight redo steps, and a held history
keeps all of its steps. While a script runs or an undo group is open,
no steps are dropped, so a canceled group leaves the other documents'
steps in place. Closing a document frees its share. The steps are not
counted again while neither the budget nor any history changed. Each
document's own `byte_budget` stays as its ceiling.
A compound member copied or cut on its own now keeps the compound's
gradient fitted where it was: an unplaced gradient is pinned to the
compound's bounds, measured once per compound.
Clear that deletes every anchor or segment of every member of a compound
path now removes the compound too, as Cut does, instead of leaving an
empty compound in the layer.
The edit.copy and edit.clear descriptions, docs/mcp.md and the progress
line now say that selecting the compound copies it whole, that isolation
mode takes each member as itself, and how a compound of one and Paste in
Front with the copied member still selected behave.
vc_call returning -11 (from the start function, or in a run that can't make
calls) now fails the run like every other code, so a plug-in that ignores
it can't report success for a call that never ran. Calls are allowed once
the module has loaded, so a start-function call gets -11 instead of
trapping.
A compound-path member selected on its own, whole with Direct Selection
or with Group Selection, is now copied as an ordinary path instead of
promoting the selection to its compound. Cut removes the same objects
Copy takes, so the other members stay a compound path, a compound of
one included. The compound is still taken whole when every member is
selected whole, or when the compound itself is selected.
A copied member or piece takes the compound's paint, opacity, blending
mode, opacity mask, pixel alignment and fill rule.
Tests that pinned the earlier rule from #786 now check the new one.
A command's result describes the document, so a plug-in without doc.read
gets -6 for every call, whether or not the id names a command. A run that
calls commands commits an edit still in progress first and prepares its
input again when that changed the document or the selection.
- A new test walks every code point from U+0000 to U+10FFFF, surrogates
left out, and compares the start and part checks with Unicode Standard
Annex #31's general-category definition of ID_Start and ID_Continue,
written out in the test. The test also checks the set sizes against the
totals in Unicode 16.0's DerivedCoreProperties (141,269 and 144,541).
- The Other_ID_Continue test covers every code point of the property,
U+136A to U+1370 and the zero width non-joiner and joiner included.
- The zero width non-joiner and joiner are part of the Other_ID_Continue
list in chars.rs instead of a separate case.
is_id_start now accepts the Other_ID_Start characters (U+1885, U+1886,
U+2118, U+212E, U+309B, U+309C), and is_id_part the Other_ID_Continue
characters (U+00B7, U+0387, U+1369 to U+1371, U+19DA, U+30FB, U+FF65),
as Unicode's ID_Start and ID_Continue properties and the ECMAScript
Names and Keywords clause define them. Letters, marks, digits and
connectors that are Pattern_Syntax are refused, which replaces the
U+2E2F special case. Escaped identifier characters go through the same
check. A supplementary letter right after a number is now the
"identifier starts immediately after numeric literal" error.
Letter categories still come from Unicode 16.0, so characters assigned
in later versions are not identifier characters yet.
Docs: docs/mcp.md, docs/target-app-parity.md.
docs/mcp.md and docs/target-app-parity.md said that a width or height
typed with Measure Type by Glyph Bounds on changes the font size by the
scale. The font size follows the vertical scale only: a width typed
alone, out of proportion, changes the horizontal scale and keeps the
font size, and a height typed alone changes the horizontal scale the
other way. A new test checks both.
A variable font's CoolTypeFont record in the text document now carries
/4 (its design vector, one 16.16 value per fvar axis) and /5 (its
version string), and the font set keys on name plus design vector, so a
named instance or a run's own axis setting no longer opens at the
font's default instance. Static fonts are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inflate's grid clipped every ring of the outline in each cell the
outline crosses and tested every edge for each cell's center, so its
work grew with the outline's points times the cells: a comb of 4,000
teeth (16,002 points) took 1.1 to 1.3 s and one of 16,000 teeth 8.8 to
9.1 s. Inflate now counts that work (the edge index's entries, the edges
its queries look at and the ring points its cells clip) and refuses the
shape with "The 3D surface is too complex; simplify the shape" once it
passes 268,435,456, VectorCraft's own value (about 0.65 s). The index
takes at most 16,777,216 entries (64 MiB). Each row's inside test reads
the sorted crossings of its line, and a cell clips only the rings whose
bounds meet it, so a 65,536-point circle inflates in 0.66 s instead of
1.0 to 1.2 s.
The effects test of a stroke past the limits uses 40,000 corners, so its
outline passes the 65,536 points a solid takes.
Docs: docs/three-d.md, docs/mcp.md.
A filter at plug-in API level 2 with the new `commands` permission names
the commands it may run in its manifest's `commandAllowlist` and runs
them with `env.vc_call`, reading each result with `env.vc_call_result`.
Each call runs through Session::execute on the run's document and sees
what earlier calls changed; the calls and the filter's output are one
undo step, and a run that fails, is cancelled or makes a failed call
leaves the documents, their history and the session state the commands
change as they were.
Commands that touch files, the clipboard, preferences, the view,
scripts, actions, plug-ins, open documents or the undo history are never
callable, and every other command must be listed as allowed in
cmd/plugin_call/reviewed.rs, so a new command is refused until placed.
Calls are capped at 1,000 a run, 8 MiB a call and 64 MiB a run, and each
costs instructions from the run's budget. plugin.install refuses a
manifest that lists a refused command and reports unknown ids;
plugin.inspect lists both, and the approval dialog lists the commands.
Refs #2186
Each Extrude & Bevel and Inflate solid now takes up to 65,536 outline
points (was 2,048) and 163,840 faces (was 32,768), VectorCraft's own
limits, as Revolve's. Before any point is sampled, the outline's lines
and curves are counted with each curve's tolerance pieces, and the faces
the walls, bevels and caps (Extrude) or the sides (Inflate) need. When
they do not fit, every curve takes fewer pieces, down to 4; a shape that
does not fit at 4 is refused with the existing surface error before any
face is built. The subpath count is capped at the point limit too. The
error texts are unchanged.
A closed path of 2,000 curves now extrudes with a bevel and inflates,
and paths of 5,000 and 10,000 curves build at the default settings.
Docs: docs/three-d.md, docs/mcp.md, docs/target-app-parity.md.
The put-back after a failed page check replaces each live envelope with
its drawn art in one go, which fails as a whole when one envelope lies in
another's art: only the outermost are put back now. A live envelope of
type removes its hidden type only once it has found the drawn art it
replaces. The file format docs lose a revision row left twice by a rebase.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The file-format revision row for #3179 says that the page check weighs
a live envelope of type as the art it draws, that layers used though
they don't draw as the page leave envelopes of type their drawn art,
and that a slot bound to a visibility variable keeps it too, and lists
the new tests. The parity assessment's evidence says the same, and
the change gets its row and status entry there.
Part of #3179.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An envelope whose contents hold type kept its drawn art, with the type
hidden, because the type is laid out from the text document only after
the layers are read. It now waits for that, as warped type does: once
its text slots hold their type, the envelope is made of that type and
drawn by VectorCraft's own rule, and where it draws as the drawn art the
file saves (the same check and budget as other envelopes) it takes the
drawn art's place, with the type visible and editable in Edit Contents.
The hidden copy of the type goes.
As other live envelopes are, it is held to the page: when the layers
with it don't draw as the page, its drawn art and hidden type are put
back. A .ai whose layers would open alone, without its PDF part, now
waits on the PDF part when an envelope of type is in them; where none
opens live, the layers open alone as before. Layers built without a page
leave envelopes of type their drawn art.
Elsewhere it keeps its drawn art and hidden type, with the note: type in
a font that isn't available, a slot without made type (threaded, bound
to a text variable, a wrap object, type a look draws), an envelope that
doesn't read, no check left, or one that draws differently. Envelopes in
a symbol's or a pattern's art keep their drawn art.
Part of #3179.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Done ran text.spelling.removeWord and text.spelling.addWord one word at a
time, each saving the file, so a save that failed after a delete was saved
left that word deleted even after Cancel. text.spelling.editDictionary
{remove, add} makes every change, saves once and takes all of them back when
the save fails; Done runs it once.
Move a stray table row and the PR #3273/#3272 revision notes into
Feature revisions, keep one "Feature evidence last updated" line, drop the
duplicate Flyout update status line and fold eight reconciliation rows
into one per date. No score or estimate changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
BFlat