Merge upstream pdfcraft and adopt the Mermaid palette

.coderabbit.yaml

@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"

.config/nextest.toml

@@ -0,0 +1,3 @@
+# Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
+# installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
+nextest-version = "0.9.150"

.github/codeql/codeql-config.yml

@@ -0,0 +1,12 @@
+# Tests hold known passwords and crypto vectors on purpose. Vendored crates are patched copies of
+# third-party code, whose PDF encryption code flags the formats' own constants. Excluding them keeps
+# real findings in the app's code visible, but CodeQL no longer looks for bugs in these folders.
+paths-ignore:
+  - "vendor/**"
+  - "xtask/**"
+  - "**/tests/**"
+  - "**/tests.rs"
+  - "**/*_tests.rs"
+  - "**/benches/**"
+  - "**/examples/**"
+  - "**/fuzz/**"

.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  # Maintain Rust / Cargo dependencies
+  - package-ecosystem: "cargo"
+    directories:
+      - "/"
+      - "/crates/filters/fuzz"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    # Consolidate updates into a single PR rather than one PR per crate
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Maintain GitHub Actions workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci(deps)"

.github/pull_request_template.md

@@ -0,0 +1,76 @@
+<!--
+Thanks for contributing to PdfCraft.
+
+Base this on `main` — it is the only integration branch. `main` moves fast (it took
+396 commits in the three days to 2026-10-12), so a PR that sits for a day usually needs
+a rebase. Rebasing the same day you are asked keeps the work from dying of conflicts.
+Delete any section below that does not apply.
+-->
+
+## What this changes
+
+<!-- What behaviour is different afterwards, and why it is worth doing. If it fixes an
+     issue, say `Fixes #123`. -->
+
+## How you verified it
+
+<!-- The commands you ran and what they said. Per-crate is fine and preferred:
+     `cargo test -p <crate>`. CI runs the full workspace on every PR, so you do not
+     need to locally. -->
+
+- [ ] `cargo fmt --check`
+- [ ] clippy with `-D warnings` on the crates I changed
+- [ ] tests pass on the crates I changed
+- [ ] `cargo xtask layers` and `cargo xtask assets` (if you touched crate boundaries or any asset)
+
+**Tests.** New behaviour needs a test at the right scale — a property test, a unit test, a
+crate integration test or an end-to-end one. For a bug fix, **please check that the test
+fails before your fix** by reverting the fix and watching it go red. A test nobody has seen
+fail is not evidence that it pins anything.
+
+## Never-crash
+
+Every PDF, script, MCP call, settings file and keystroke is untrusted input (`AGENTS.md` §4).
+
+- [ ] No new `unwrap`/`expect`/`panic!`/`unreachable!`/`todo!` outside tests, unless it is
+      provably infallible with a comment saying why
+- [ ] No indexing or slicing with input-derived positions (`get`, and strings only at char
+      boundaries); checked or saturating arithmetic; allocations sized by input are capped;
+      recursion is bounded
+- [ ] No `unsafe`
+- [ ] Any crash this fixes has a small synthetic regression test
+
+## Provenance
+
+This is the part that cannot be undone after a merge, and the part a new contributor is
+least likely to know about. Please read `AGENTS.md` §1 before adding any asset.
+
+- [ ] No asset from an Adobe product, and no Adobe icon recreated, traced or imitated
+- [ ] No font files committed here (they live in
+      [storytold/craft-fonts](https://github.com/storytold/craft-fonts))
+- [ ] No GPL/AGPL code copied in — MuPDF, Ghostscript, Poppler, veraPDF and DSS may only be
+      run as external oracle processes
+- [ ] Behaviour comes from the specification or black-box observation, **not** from reading
+      another implementation's source
+- [ ] Every new asset has an `ATTRIBUTION.toml` entry and `cargo xtask assets` passes
+
+## Security
+
+- [ ] `--root` confinement still holds on every path, including ones reached by nested
+      tool dispatch
+- [ ] MCP and the UI control channel stay opt-in, loopback-only and token-authenticated
+- [ ] No new outbound network access (that decision is the owner's)
+
+## Parity and reach
+
+- [ ] `parity/acrobat-features.toml` updated in this PR, with `notes` saying what is *still*
+      missing — `shipped` means "exists and tested", not "as good as Acrobat"
+- [ ] Reachable headlessly through an `automation` tool where that applies (`AGENTS.md` §3),
+      so agents can drive it and not just the UI
+- [ ] Docs updated if this changes a documented behaviour (`docs/`, crate README)
+
+## Anything a reviewer should look at first
+
+<!-- The judgement call you are least sure about, a deliberate restraint you want pinned,
+     or a behaviour change existing users will notice. Say so here rather than leaving it
+     to be found. -->

.github/workflows/ci.yml

@@ -1,133 +1,92 @@
 name: CI
 
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions. Nightly fuzzing is in fuzz.yml.
 on:
   push:
     branches: [main]
   pull_request:
+    # `labeled` so that adding `full-ci` to an open PR starts a run with Windows in it.
+    types: [opened, synchronize, reopened, labeled]
   workflow_dispatch:
-  schedule:
-    - cron: "17 3 * * *" # nightly fuzzing
 
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
+# The token is only used to check out the code: no job writes to the repository.
+permissions:
+  contents: read
 
+# A newer push to a PR branch cancels its older run; every push to main runs to the end. Adding
+# any label but `full-ci` gets a group of its own, so it neither runs the gate nor cancels a run.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-${{ github.event_name == 'pull_request' && (github.event.action != 'labeled' || github.event.label.name == 'full-ci') && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  test:
-    name: test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        # No macOS on PRs, main or nightly: the org's 5 macOS slots are kept for release builds,
-        # and release.yml builds macOS (a failing release is fixed and rebuilt).
-        os: [ubuntu-latest, windows-latest]
-    steps:
-      - uses: actions/checkout@v4
-
-      # The optional craft-fonts build input (Japanese fonts), so the Japanese font tests run on
-      # Linux; Windows tests the build without it. See craftrules standards/fonts.md.
-      - name: Check out craft-fonts (Linux)
-        if: runner.os == 'Linux'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-
-      - name: Install Linux system dependencies (egui/winit/rfd)
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
-            libgl1-mesa-dev libgtk-3-dev
-
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
-
-      - name: Require Windows executable resources
-        if: runner.os == 'Windows'
-        run: Add-Content -Path $env:GITHUB_ENV -Value 'PDFCRAFT_REQUIRE_WINRES=1'
-        shell: pwsh
-
-      - uses: Swatinem/rust-cache@v2
-
-      - name: Format
-        if: runner.os == 'Linux'
-        run: cargo fmt --all -- --check
-
-      - name: Clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings
-
-      - name: Test
-        if: runner.os != 'Linux'
-        run: cargo test --workspace
-
-      - name: Test (with craft-fonts)
-        if: runner.os == 'Linux'
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: cargo test --workspace
-
-      - name: Layering
-        run: cargo xtask layers
-
-      - name: Assets (licences and attribution)
-        if: runner.os == 'Linux'
-        run: cargo xtask assets
-
-      - name: CLI without the MCP server still builds
-        if: runner.os == 'Linux'
-        run: cargo check -p pdfcraft-cli --no-default-features
-
-  wasm:
-    name: wasm32 check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: wasm32
-      - name: Check library crates for wasm32
-        run: cargo xtask wasm
-
-  deny:
-    name: dependency licences and advisories
+  # The shared gate doesn't check where git dependencies come from; release.yml runs the same job.
+  git-sources:
+    if: github.event.action != 'labeled' || github.event.label.name == 'full-ci'
+    name: Git dependencies come from storytold
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: EmbarkStudios/cargo-deny-action@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          command: check
-
-  fuzz:
-    name: fuzz (mutation, 15 min)
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: fuzz
-      - name: Fetch the pdf.js corpus (seeds)
-        run: cargo xtask corpus
-      - name: Fuzz
-        run: cargo xtask fuzz --time 900 --seed ${{ github.run_number }}
-      - name: Upload findings
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: fuzz-findings
-          path: fuzz-out/findings
-          if-no-files-found: ignore
+          persist-credentials: false
+      - name: Windows font notice regressions
+        shell: pwsh
+        run: ./packaging/windows/test-font-notices.ps1
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
+
+  gate:
+    if: github.event.action != 'labeled' || github.event.label.name == 'full-ci'
+    # Pinned: a mutable reference to another repository can change what CI runs. Move it deliberately.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@2b3fb9dc05036f73c77d18f753a3aa9da55fa386 # main, 31 October 2026
+    with:
+      # Windows on main, manual runs and pull requests labelled `full-ci`. No macOS on PRs or main:
+      # the org's 5 macOS slots are kept for release builds, and release.yml builds macOS.
+      os: ${{ (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'full-ci')) && '["ubuntu-24.04","windows-latest"]' || '["ubuntu-24.04"]' }}
+      # Same craft-fonts commit as release.yml and freebsd.yml.
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+      # egui/winit/rfd, and the independent oracles (crates/oracle).
+      packages: >-
+        libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev
+        libgtk-3-dev qpdf poppler-utils
+      # cargo-deny for the deny step of `cargo xtask ci`, which requires it under CI.
+      tools: cargo-nextest@0.9.150,cargo-deny@0.20.2
+      # A missing oracle fails the job instead of printing a skip notice that reads as a pass.
+      linux-env: PDFCRAFT_ORACLES_REQUIRED=1
+      windows-env: PDFCRAFT_REQUIRE_WINRES=1
+      # Windows checks what differs by platform: the build (with resources) and the tests.
+      windows-command: |
+        cargo clippy --workspace --all-targets --locked -- -D warnings
+        cargo test --workspace --locked

.github/workflows/codeql.yml

@@ -39,6 +39,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4

.github/workflows/freebsd.yml

@@ -23,30 +23,7 @@ permissions:
 
 jobs:
   freebsd:
-    name: FreeBSD 14 (build + test)
-    runs-on: ubuntu-latest
-    timeout-minutes: 300
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build and test in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Nothing to bring back; copying the target dir out of the VM fails on large builds.
-          copyback: false
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
-            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-          run: |
-            . "$HOME/.cargo/env"
-            # The checkout is synced in under another owner; let tests that call git read it.
-            git config --global --add safe.directory "*"
-            rustc --version
-            CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
-            # The release packaging, end to end (a quicker release profile than the real release).
-            CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 packaging/freebsd/package.sh
-            tar -tzf dist/release/pdfcraft-*-freebsd-*.tar.gz | grep -E '/bin/pdfcraft$|/bin/pdfcraft-cli$|applications/|/share/pdfcraft/models/.+\.onnx$'
+    # Pinned: a mutable reference to another repository can change what CI runs. Move it deliberately.
+    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@2b3fb9dc05036f73c77d18f753a3aa9da55fa386 # main, 31 October 2026
+    with:
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83