imprimatur 0.5.0 → 0.6.1

data/Cargo.toml

@@ -10,20 +10,36 @@ license = "BSD-3-Clause"
 repository = "https://github.com/seuros/imprimatur"
 
 [workspace.dependencies]
-imprimatur = { path = "ext/imprimatur_native/core", version = "0.5.0" }
+aes = "0.9.3"
+crc32fast = "1.5.2"
+datamatrix = "0.3.3"
+font-test-data = "0.10.0"
+hayro = { version = "0.8.0", default-features = false, features = ["embed-fonts", "embed-cmaps"] }
+imprimatur = { path = "ext/imprimatur_native/core", version = "0.6.1" }
+libproc = "0.14.11"
 magnus = { version = "0.9.2", default-features = false }
+md-5 = "0.11.0"
+miniz_oxide = "0.9.1"
+nix = { version = "0.31.3", features = ["resource", "process", "signal"] }
+qrcode = { version = "0.14.1", default-features = false }
+read-fonts = "0.45.1"
 # For rb_thread_call_without_gvl2, which magnus does not wrap; magnus's own
 # rb-sys, features and all.
 rb-sys = { version = "0.9.130", default-features = false, features = ["stable-api"] }
 regex = "1.13.1"
+serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.154"
+sha2 = "0.11.1"
 tempfile = "3"
+thiserror = "2.0.21"
 usage-parser = { package = "usage-lib", version = "7.0.1" }
 usage-rs = "7.0.1"
+zip = { version = "9.0.3", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 
 [workspace.lints.rust]
 unsafe_code = "deny"
 unused_must_use = "warn"
+dead_code_pub_in_binary = "warn"
 
 [workspace.lints.clippy]
 all = { level = "warn", priority = -1 }

data/README.md

@@ -7,10 +7,9 @@ a 40,000-character cell is refused at the door, not discovered by Excel's
 
 - **A Ruby DSL over a native core.** The core is also published on its own,
   as `imprimatur` on crates.io; the gem wraps it.
-- **No third-party format stack.** The XML writer and the zip container are
-  written here, from ECMA-376 and the zip specification; only deflate
-  (`miniz_oxide`) and CRC-32 (`crc32fast`) come from crates, and QR Code and
-  Data Matrix encoding (`qrcode`, `datamatrix`) for barcodes.
+- **Own readers and writers.** XML, zip and PDF reading/writing live here.
+  Optional full-page PDF rendering uses Hayro, a pure-Rust CPU renderer;
+  no Poppler, PDFium, GPU or system fonts are required.
 - **Deterministic.** The same document always gives the same bytes.
 - **Native only.** CRuby 4.0+. No pure Ruby fallback, no JRuby, no TruffleRuby.
 
@@ -178,7 +177,7 @@ Not yet: merged cells, frozen panes, streaming for very large sheets.
 One document, two formats:
 
 ```ruby
-doc = Imprimatur::Document.new(page_size: :a4, page_numbers: true)
+doc = Imprimatur::Document.new(page_size: :a4, font_size: 10, page_numbers: true)
 doc.heading "Quarterly report"
 doc.heading "Sales", level: 2
 doc.paragraph do |p|
@@ -195,12 +194,14 @@ doc.paragraph "Appendix."
 doc.save_pdf("report.pdf")
 doc.save_docx("report.docx")
 
-Imprimatur.pdf("memo.pdf") { it.paragraph "Or in one go." }    # Imprimatur.docx alike
+Imprimatur.pdf("memo.pdf", font_size: 10) { it.paragraph "Or in one go." } # Imprimatur.docx alike
 Imprimatur.pdf(page_size: [200, 200], margin: 10) { it.image qr_png, width: 180 }
 ```
 
 - Headings 1 to 3 (real Word heading styles in DOCX), paragraphs of runs
   (bold, italic, underline, color), alignment, `\n` line breaks and tabs.
+- Body text at `font_size:` points (1 to 1638, in steps of 0.5; 11 unless
+  set), in both formats; headings keep their own sizes.
 - Tables: equal columns, borders, a shaded header row that repeats on every
   page; cells are converted with `to_s`.
 - Pictures: PNG or JPEG (a path, the bytes or an IO), at `width:` or
@@ -333,6 +334,61 @@ pages of headings and paragraphs with their position, a workbook's typed
 cells and comments, a Word document's blocks with their bold, italic and
 linked stretches.
 
+For a PDF without text, `content` still returns every page, its empty
+`blocks` and its `images` count. `markdown` and the text-oriented CLI commands
+still report `NoTextLayer`;
+OCR callers need the structure of scanned and blank pages too.
+
+### Bounded PDF pages and OCR rendering
+
+```ruby
+Imprimatur.pdf_info(upload.download) # => {page_count: 20, encrypted: false}
+result = Imprimatur.pdf_pages(upload.download, first_page: 2, last_page: 10, max_pages: 5)
+result[:pages].each { |page| puts [page[:page], page[:status], page[:text]] }
+png = Imprimatur.render_pdf_page(upload.download, page: 2, max_side: 1568)
+```
+
+`pdf_info` counts actual pages without interpreting their content. `pdf_pages`
+only interprets the selected streams, at most 500 pages by default. Each page
+has `status` (`text`, `empty`, `failed`, `skipped`), `text`, `images` (nil if
+unknown), `truncated` and `reason`. It keeps healthy pages when another is
+damaged. Unlike the tolerant Markdown reader, corrupt Flate streams fail
+explicitly. Limits are 256 KiB of text per page and 8 MiB total
+(`max_page_bytes:`, `max_output_bytes:`); truncation respects UTF-8.
+
+`render_pdf_page` returns an opaque grayscale PNG of the **whole page**, not
+just its scan image; `grayscale: false` keeps color. It bounds the output surface
+before allocation (`max_pixels:`, 4 million) and encoded output
+(`max_output_bytes:`, 8 MiB). Preflight rejects pages drawing more than 40 million
+source-image pixels. Renderer warnings fail instead of silently dropping content.
+The crate exposes `read::pdf::{info, pages, render_page}` (`render` feature) and
+`read::pdf::isolation::{info_isolated, pages_isolated, render_page_isolated}`
+(`isolation` feature). These take an absolute path to the trusted
+`imprimatur-render-worker` executable. The gem bundles that worker and always
+isolates all three PDF operations; it never falls back to in-process parsing
+or searches PATH.
+
+All three accept the normal read limits and `memory_bytes:`
+(1 GiB by default): Linux/FreeBSD enforce an address-space cap; macOS uses a
+sampled RSS watchdog, which can briefly overshoot. A worker is killed and reaped
+on timeout, cancellation or supervisor failure. Each operation has a mandatory
+60-second process ceiling even with `timeout: nil`; a shorter `timeout:` still
+applies. CPU time, output files and core dumps are also limited.
+
+The page worker flushes completed records as it goes. An exhausted stream
+budget triggers individual-page recovery inside that worker: each attempt has
+its own `max_inflated` allowance, while the original overall deadline, process
+memory limit and aggregate text cap remain in force. An oversized page is
+`failed`, not blank, without discarding healthy neighbors. A worker terminated
+after metadata was read preserves completed pages and explicitly marks the
+unreached pages; an expired overall deadline marks them `skipped`. Cancellation
+still raises rather than returning a partial successful call.
+
+This is resource containment, **not a filesystem/network security sandbox**.
+The raw crate `info`, `pages` and `render_page` APIs remain in-process;
+`render_page` cannot interrupt Hayro.
+`max_inflated` bounds our preflight, not Hayro's internal decoders.
+
 ```ruby
 sheet = Imprimatur.content("sales.xlsx")[:sheets].first
 sheet[:rows][1][:cells]
@@ -441,7 +497,7 @@ The core works without Ruby too; see
 
 ```sh
 bundle install
-rake test:all        # cargo test, then the Ruby suite on the compiled extension
+rake test:all        # core, CLI and Ruby suites on the compiled extension
 rake lint            # dictator, cargo fmt --check, clippy
 rake gems:native     # the precompiled gem for this machine, in pkg/
 ```

data/ext/imprimatur_native/cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "imprimatur-cli"
-version = "0.5.0"
+version = "0.6.1"
 description = "Read PDF, XLSX, XLS, ODS and DOCX documents as Markdown or JSON, search them, extract their images."
 keywords = ["pdf", "xlsx", "docx", "markdown", "cli"]
 categories = ["command-line-utilities", "text-processing"]

data/ext/imprimatur_native/cli/src/app.rs

@@ -89,7 +89,9 @@ pub fn read(file: &Path) -> imprimatur::Result<Vec<u8>> {
 
 /// A document's content: the file read, then the document.
 pub fn content(file: &Path, limits: &Limits) -> imprimatur::Result<Content> {
-    read(file).and_then(|document| imprimatur::read::content(&document, limits))
+    let content = read(file).and_then(|document| imprimatur::read::content(&document, limits))?;
+    content.ensure_text_layer()?;
+    Ok(content)
 }
 
 /// What a document's outputs are named after: its file's stem, `stdin`

data/ext/imprimatur_native/core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "imprimatur"
-version = "0.5.0"
+version = "0.6.1"
 description = "XLSX, PDF and DOCX authoring, and PDF, XLSX, XLS, ODS and DOCX reading, with its own XML, zip and PDF code."
 keywords = ["xlsx", "excel", "pdf", "docx", "spreadsheet"]
 categories = ["encoding", "text-processing"]
@@ -25,17 +25,20 @@ include = [
 workspace = true
 
 [dependencies]
-aes = "0.9.3"
-crc32fast = "1.5.2"
-datamatrix = "0.3.3"
-md-5 = "0.11.0"
-miniz_oxide = "0.9.1"
-qrcode = { version = "0.14.1", default-features = false }
-read-fonts = { version = "0.45.1", optional = true }
+aes.workspace = true
+crc32fast.workspace = true
+datamatrix.workspace = true
+hayro = { workspace = true, optional = true }
+md-5.workspace = true
+miniz_oxide.workspace = true
+qrcode.workspace = true
+read-fonts = { workspace = true, optional = true }
+serde = { workspace = true, optional = true }
 serde_json = { workspace = true, optional = true }
-sha2 = "0.11.1"
-thiserror = "2.0.21"
-zip = { version = "9.0.3", default-features = false, features = ["deflate-flate2-zlib-rs"], optional = true }
+sha2.workspace = true
+thiserror.workspace = true
+tempfile = { workspace = true, optional = true }
+zip = { workspace = true, optional = true }
 
 [features]
 # `read::json`: content and images as JSON, the schema the command line and
@@ -47,8 +50,22 @@ archive = ["dep:zip"]
 # `font`: static TrueType font data (glyphs, advances, line metrics),
 # through `read-fonts`.
 fonts = ["dep:read-fonts"]
+# Pure-Rust full-page PDF rasterization; readers and writers remain independent.
+render = ["dep:hayro"]
+isolation = ["render", "json", "dep:serde", "dep:tempfile", "dep:nix", "dep:libproc"]
+
+[target.'cfg(unix)'.dependencies]
+nix = { workspace = true, optional = true }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+libproc = { workspace = true, optional = true }
+
+[[bin]]
+name = "imprimatur-render-worker"
+path = "src/bin/imprimatur-render-worker.rs"
+required-features = ["isolation"]
 
 [dev-dependencies]
-font-test-data = "0.10.0"
+font-test-data.workspace = true
 tempfile.workspace = true
-zip = { version = "9.0.3", default-features = false, features = ["deflate-flate2-zlib-rs"] }
+zip.workspace = true

data/ext/imprimatur_native/core/README.md

@@ -1,10 +1,26 @@
 # imprimatur
 
-Document authoring with no third-party format stack: the XML and the zip
+Document authoring with its own format stack: the XML and the zip
 container are written here, on `miniz_oxide` (deflate) and `crc32fast`.
 XLSX workbooks, and PDF and DOCX from one document model.
 Output is deterministic: the same document always gives the same bytes.
 
+`read::pdf::info` inspects a PDF without interpreting its content.
+`read::pdf::pages` reads a bounded, one-based selection, with per-page failure
+states and UTF-8-safe text limits. `read::pdf::render_page`, under the optional
+`render` feature, rasterizes a full page through Hayro (pure Rust).
+That raw API is not preemptible. For untrusted documents, enable `isolation`,
+build the `imprimatur-render-worker` binary and pass its absolute path to
+`read::pdf::isolation::{info_isolated, pages_isolated, render_page_isolated}`.
+Rust supervises finite wall/CPU,
+memory and file-output limits, killing and reaping failed/cancelled workers.
+Linux/FreeBSD enforce address-space limits; macOS samples RSS and can briefly
+overshoot. This is resource containment, not a filesystem/network sandbox.
+Isolated page reads flush completed records, retain them on worker termination,
+and recover healthy neighbors after page-local decompression failures. Recovery
+attempts renew only the individual decompression allowance, never the overall
+deadline, process-memory limit or aggregate text cap.
+
 ```rust
 use imprimatur::xlsx::{Cell, Color, DateTime, Format, Workbook};
 
@@ -27,6 +43,7 @@ book.save("budget.xlsx")?;          // or to_bytes(), or write_to(impl Write)
 use imprimatur::doc::{Document, Paragraph, Run, Table};
 
 let mut doc = Document::new();
+doc.set_font_size(10.0)?; // body text in points; 11 unless set
 doc.set_page_numbers(true);
 doc.heading(1, "Quarterly report")?;
 doc.push_paragraph(Paragraph::new().text("Revenue was ").run(Run::new("up 12%").bold()))?;

data/ext/imprimatur_native/core/src/bin/imprimatur-render-worker.rs

@@ -0,0 +1,10 @@
+#[cfg(unix)]
+fn main() -> std::process::ExitCode {
+    imprimatur::read::pdf::isolation::worker_main()
+}
+
+#[cfg(not(unix))]
+fn main() -> std::process::ExitCode {
+    eprintln!("isolated PDF rendering requires a supported Unix platform");
+    std::process::ExitCode::FAILURE
+}

data/ext/imprimatur_native/core/src/bytes.rs

@@ -0,0 +1,16 @@
+//! Checked integer reads shared by binary format parsers.
+
+#[cfg(test)]
+mod tests;
+
+fn array<const N: usize>(data: &[u8], at: usize) -> Option<[u8; N]> {
+    data.get(at..at.checked_add(N)?)?.try_into().ok()
+}
+
+pub fn u16_le(data: &[u8], at: usize) -> Option<u16> {
+    array(data, at).map(u16::from_le_bytes)
+}
+
+pub fn u32_le(data: &[u8], at: usize) -> Option<u32> {
+    array(data, at).map(u32::from_le_bytes)
+}

data/ext/imprimatur_native/core/src/doc/picture.rs

@@ -2,13 +2,12 @@
 
 use std::sync::Arc;
 
+use super::size;
 use crate::style::Align;
 use crate::{Error, Result};
 
 /// Pixels per point at 96 pixels an inch: a picture's size when none is set.
 const POINTS_PER_PIXEL: f64 = 0.75;
-/// The largest side, in points, a picture may be set to: PDF's page limit.
-const MAX_POINTS: f64 = 14_400.0;
 /// The largest side, in pixels, a picture may have.
 const MAX_PIXELS: u32 = 1 << 16;
 
@@ -112,15 +111,12 @@ impl Picture {
             (None, Some(height)) => (height * pixels_wide / pixels_high, height),
             (None, None) => (pixels_wide * POINTS_PER_PIXEL, pixels_high * POINTS_PER_PIXEL),
         };
-        let scale = (room.0 / width).min(room.1 / height).min(1.0);
-        (width * scale, height * scale)
+        size::fit((width, height), room)
     }
 }
 
 fn points_in_range(points: f64) -> Result<f64> {
-    (1.0..=MAX_POINTS)
-        .contains(&points)
-        .then_some(points)
+    size::points_in_range(points)
         .ok_or(Error::InvalidImage("a picture of 1 to 14 400 points a side"))
 }
 

data/ext/imprimatur_native/core/src/doc/size.rs

@@ -0,0 +1,14 @@
+//! Physical sizing shared by pictures and barcode symbols.
+
+/// The largest side in points allowed by PDF.
+const MAX_POINTS: f64 = 14_400.0;
+
+pub(super) fn points_in_range(points: f64) -> Option<f64> {
+    (1.0..=MAX_POINTS).contains(&points).then_some(points)
+}
+
+/// Fits into the available room without enlarging or changing proportions.
+pub(super) fn fit((width, height): (f64, f64), room: (f64, f64)) -> (f64, f64) {
+    let scale = (room.0 / width).min(room.1 / height).min(1.0);
+    (width * scale, height * scale)
+}

data/ext/imprimatur_native/core/src/doc/symbol.rs

@@ -1,12 +1,11 @@
 //! Barcodes in the flow: shapes in a PDF, a picture in DOCX.
 
+use super::size;
 use crate::Result;
 use crate::barcode::{Barcode, Look, Shapes};
 use crate::doc::Picture;
 use crate::style::{Align, Color};
 
-/// The largest side, in points, a symbol may be set to: PDF's page limit.
-const MAX_POINTS: f64 = 14_400.0;
 /// Pixels an inch a DOCX picture of a symbol has at least.
 const DOCX_DPI: f64 = 300.0;
 
@@ -96,8 +95,7 @@ impl Symbol {
             };
             (columns * module, rows * module)
         };
-        let scale = (room.0 / width).min(room.1 / height).min(1.0);
-        (shapes, (width * scale, height * scale))
+        (shapes, size::fit((width, height), room))
     }
 
     /// A PNG of it at 300 pixels an inch or more, for formats that take
@@ -125,7 +123,7 @@ impl Symbol {
 
     fn points_in_range(&self, points: f64) -> Result<f64> {
         let invalid = || self.barcode.symbology().invalid("a size of 1 to 14 400 points");
-        (1.0..=MAX_POINTS).contains(&points).then_some(points).ok_or_else(invalid)
+        size::points_in_range(points).ok_or_else(invalid)
     }
 }
 

data/ext/imprimatur_native/core/src/doc.rs

@@ -23,6 +23,7 @@
 
 mod paragraph;
 pub(crate) mod picture;
+mod size;
 mod symbol;
 mod table;
 #[cfg(test)]
@@ -111,6 +112,8 @@ pub struct Document {
     page_numbers: bool,
     /// Hundredths of a point; one inch when unset.
     margin: Option<u32>,
+    /// Half points; 11 points when unset.
+    font_size: Option<u16>,
 }
 
 impl Document {
@@ -144,6 +147,27 @@ impl Document {
         self.margin.map_or(72.0, |margin| f64::from(margin) / 100.0)
     }
 
+    /// Body text size in points, 11 unless set.
+    ///
+    /// # Errors
+    /// [`Error::InvalidDocumentFontSize`] outside 1 to 1638, or between half points.
+    pub fn set_font_size(&mut self, points: f64) -> Result<&mut Self> {
+        let half_points = points * 2.0;
+        let valid = (1.0..=1638.0).contains(&points) && half_points.fract() == 0.0;
+        valid.ok_or(Error::InvalidDocumentFontSize(points))?;
+        #[expect(clippy::cast_possible_truncation, reason = "a whole number from 2 to 3276")]
+        #[expect(clippy::cast_sign_loss, reason = "a whole number from 2 to 3276")]
+        let half_points = half_points as u16;
+        self.font_size = Some(half_points);
+        Ok(self)
+    }
+
+    /// Body text size in points.
+    #[must_use]
+    pub fn font_size(&self) -> f64 {
+        f64::from(self.font_size.unwrap_or(22)) / 2.0
+    }
+
     /// The width and height between the margins, in points.
     ///
     /// # Errors

data/ext/imprimatur_native/core/src/docx.rs

@@ -50,7 +50,7 @@ pub fn write<W: Write>(document: &Document, out: W) -> Result<W> {
     zip.add("_rels/.rels", package.as_bytes())?;
     zip.add("word/document.xml", body(document, room, first_media, &pictures).as_bytes())?;
     zip.add("word/_rels/document.xml.rels", opc::relationships(&parts).as_bytes())?;
-    zip.add("word/styles.xml", styles().as_bytes())?;
+    zip.add("word/styles.xml", styles(document).as_bytes())?;
     if footer {
         zip.add("word/footer1.xml", page_number_footer().as_bytes())?;
     }
@@ -350,16 +350,17 @@ const HEADINGS: [(&str, &str, Option<&str>, &str); 3] = [
 ];
 
 /// `word/styles.xml`: Normal text, Heading 1-3 and a bordered table style,
-/// with a Calibri 11pt body.
-fn styles() -> String {
+/// with a Calibri body at the document's font size.
+fn styles(document: &Document) -> String {
     let mut xml = XmlWriter::new();
     xml.open("w:styles", &[("xmlns:w", W_NS)]);
     xml.open("w:docDefaults", &[]);
     xml.open("w:rPrDefault", &[]);
     xml.open("w:rPr", &[]);
     xml.empty("w:rFonts", &[("w:ascii", "Calibri"), ("w:hAnsi", "Calibri"), ("w:cs", "Arial")]);
-    xml.empty("w:sz", &[("w:val", "22")]);
-    xml.empty("w:szCs", &[("w:val", "22")]);
+    let size = (document.font_size() * 2.0).to_string();
+    xml.empty("w:sz", &[("w:val", &size)]);
+    xml.empty("w:szCs", &[("w:val", &size)]);
     xml.close("w:rPr");
     xml.close("w:rPrDefault");
     xml.open("w:pPrDefault", &[]);

data/ext/imprimatur_native/core/src/error.rs

@@ -78,6 +78,9 @@ pub enum Error {
     #[error("margin {0} points is out of range (0 to 144), or leaves no room on the page")]
     InvalidMargin(f64),
 
+    #[error("document font size {0} is out of range (1 to 1638 points, in steps of 0.5)")]
+    InvalidDocumentFontSize(f64),
+
     #[error(
         "{character:?} (U+{code:04X}) cannot be written with the PDF standard font {font}: \
          only Windows-1252 (Latin) text is supported until embedded fonts land",
@@ -118,6 +121,9 @@ pub enum Error {
     #[error("the document is encrypted with a password")]
     PasswordRequired,
 
+    #[error("invalid PDF option: {0}")]
+    InvalidPdfOption(&'static str),
+
     #[error(transparent)]
     Io(#[from] io::Error),
 }

data/ext/imprimatur_native/core/src/font.rs

@@ -7,6 +7,8 @@
 #[cfg(test)]
 mod tests;
 
+use std::fmt;
+
 use read_fonts::{
     FontRead, FontRef, MinByteRange, TableProvider,
     tables::{
@@ -45,6 +47,16 @@ pub struct TrueTypeFont<'a> {
     glyph_count: u16,
 }
 
+impl fmt::Debug for TrueTypeFont<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("TrueTypeFont")
+            .field("data_len", &self.data.len())
+            .field("metrics", &self.metrics)
+            .field("glyph_count", &self.glyph_count)
+            .finish_non_exhaustive()
+    }
+}
+
 impl<'a> TrueTypeFont<'a> {
     /// Load font data without copying it or accessing system fonts.
     ///

data/ext/imprimatur_native/core/src/lib.rs

@@ -19,9 +19,15 @@
 //! # Ok::<(), imprimatur::Error>(())
 //! ```
 
+#![cfg_attr(
+    all(test, feature = "isolation", unix),
+    expect(dead_code_pub_in_binary, reason = "worker entry point is integration-tested")
+)]
+
 #[cfg(feature = "archive")]
 pub mod archive;
 pub mod barcode;
+mod bytes;
 pub mod doc;
 mod docx;
 mod error;

data/ext/imprimatur_native/core/src/pdf/layout.rs

@@ -13,7 +13,6 @@ use crate::style::{Align, Color};
 use crate::{Error, Result};
 use wrap::{Line, Look, wrap};
 
-const BODY_SIZE: f64 = 11.0;
 const TABLE_SIZE: f64 = 10.0;
 /// Line height as a multiple of the font size.
 const LEADING: f64 = 1.25;
@@ -31,6 +30,7 @@ pub struct Layout {
     width: f64,
     height: f64,
     margin: f64,
+    body_size: f64,
     pages: Vec<Vec<u8>>,
     /// The top of the free space on the current page, from the bottom edge.
     y: f64,
@@ -46,7 +46,15 @@ impl Layout {
         document.room()?;
         let (width, height) = document.page_size().points();
         let margin = document.margin();
-        Ok(Self { width, height, margin, pages: vec![Vec::new()], y: height - margin, blank: true })
+        Ok(Self {
+            width,
+            height,
+            margin,
+            body_size: document.font_size(),
+            pages: vec![Vec::new()],
+            y: height - margin,
+            blank: true,
+        })
     }
 
     pub const fn page_size(&self) -> (f64, f64) {
@@ -63,7 +71,7 @@ impl Layout {
         let look = Look { face: Face::Bold, color, underline: false };
         let lines = wrap(&[(Face::Bold.encode(text)?, look)], size, self.content_width());
         // Keep the heading with at least two lines of what follows.
-        let body_lines = 2.0 * BODY_SIZE * LEADING;
+        let body_lines = 2.0 * self.body_size * LEADING;
         let needed = (line_count(&lines) * size).mul_add(LEADING, before) + body_lines;
         self.ensure_room(needed);
         if !self.blank {
@@ -83,8 +91,8 @@ impl Layout {
                 Look { face, color: run.color, underline: run.underline },
             ));
         }
-        let lines = wrap(&runs, BODY_SIZE, self.content_width());
-        self.lines(&lines, BODY_SIZE, paragraph.effective_align());
+        let lines = wrap(&runs, self.body_size, self.content_width());
+        self.lines(&lines, self.body_size, paragraph.effective_align());
         self.y -= PARAGRAPH_GAP;
         Ok(())
     }

data/ext/imprimatur_native/core/src/pdf/objects.rs

@@ -127,7 +127,7 @@ impl<W: Write> Write for Counted<'_, W> {
 
 /// A number for a content stream: two decimals at most, no trailing zeros,
 /// formatted without an intermediate `String`.
-#[derive(Clone, Copy)]
+#[derive(Debug, Clone, Copy)]
 pub struct Num(pub f64);
 
 impl fmt::Display for Num {

data/ext/imprimatur_native/core/src/pdf/truetype/descriptor.rs

@@ -15,6 +15,7 @@ use crate::font::{TrueTypeFont, invalid};
 use crate::pdf::objects::{Num, PdfWriter};
 use crate::{Error, Result};
 
+#[derive(Debug)]
 pub struct Descriptor {
     /// PostScript name, escaped as a PDF name (without its leading slash).
     pub name: String,

data/ext/imprimatur_native/core/src/read/budget.rs

@@ -23,11 +23,11 @@ const TICKS_PER_CHECK: u32 = 4096;
 /// ```
 #[derive(Debug, Clone)]
 pub struct Limits {
-    max_input: usize,
-    max_inflated: u64,
-    max_depth: usize,
-    timeout: Option<Duration>,
-    cancel: Option<Arc<AtomicBool>>,
+    pub(crate) max_input: usize,
+    pub(crate) max_inflated: u64,
+    pub(crate) max_depth: usize,
+    pub(crate) timeout: Option<Duration>,
+    pub(crate) cancel: Option<Arc<AtomicBool>>,
 }
 
 impl Default for Limits {
@@ -127,6 +127,11 @@ impl<'a> Budget<'a> {
         if self.limits.cancel.as_deref().is_some_and(|flag| flag.load(Ordering::Relaxed)) {
             return Err(Error::Cancelled);
         }
+        self.check_time()
+    }
+
+    /// Check elapsed time after a completed worker (SIGCHLD may wake its caller).
+    pub(crate) fn check_time(&self) -> Result<()> {
         if self.deadline.is_some_and(|deadline| Instant::now() >= deadline) {
             return Err(Error::LimitExceeded("time"));
         }

data/ext/imprimatur_native/core/src/read/content.rs

@@ -27,6 +27,22 @@ pub enum Content {
 }
 
 impl Content {
+    /// Requires readable PDF text for text-oriented callers, while structured
+    /// callers can still inspect scanned and blank pages.
+    ///
+    /// # Errors
+    /// [`crate::Error::NoTextLayer`] for a PDF without readable blocks.
+    pub fn ensure_text_layer(&self) -> crate::Result<()> {
+        if let Self::Pdf(pages) = self
+            && pages.iter().all(|page| {
+                page.blocks.iter().all(|block| block.block.plain_text().trim().is_empty())
+            })
+        {
+            return Err(crate::Error::NoTextLayer);
+        }
+        Ok(())
+    }
+
     /// The document's format.
     #[must_use]
     pub const fn format(&self) -> super::Format {