imprimatur 0.6.0-aarch64-linux-gnu → 0.6.1-aarch64-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 60b0c7b03b95799ce827fc16a4c288dc929647e0fc94c6672bac555d75b85140
-  data.tar.gz: 11b2699bbe2481da51deeeeada85731c85d7577d3cfd06551093866edff29ab1
+  metadata.gz: 0c846ab26c3cce1cfd29ad57abec947eac5c8df63a8632edc28449b7130aa6ff
+  data.tar.gz: 9df791e2413c83d76620a696fb8f0a8b24c13504637ae08663f027fb695c90da
 SHA512:
-  metadata.gz: e710314613e0b8fde5895a7b751d6458fd52749cd44167828f7a3cee6e9abdebf98befe86c78a832913e3b362e0cbc0b57072ed35742b5bab1dd11e64918623e
-  data.tar.gz: 1a5eeda8859cafa2ae3ac1b3bac3b50954d4bfbcb7b4562d6c0c04280f5195192eb20fa07aaf167f364e7022e9d5b338ceab269852be9bebd0d40bf9ceaf6d11
+  metadata.gz: d889377347b347029cef45c2bdeb0d721b10bd9f7a67320a3358e7a49a83a92f3280b7dd43700f70cc33e9a773cf742cb61b88cfb4bc032821386720c8dbbd0b
+  data.tar.gz: 82311d23c3f95907dd1c3bf97e7da8c2e15c5faf466006d1250b950c2c5a33c5018e157f5479b50979426eea7b8766c74e1c78ca17cda66440163b9b63101fca

data/CHANGELOG.md

@@ -2,11 +2,21 @@
 
 ## Unreleased
 
-- Add native PDF metadata, bounded page reads with explicit failure states,
-  and optional pure-Rust full-page PNG rendering.
-- Keep scanned and blank page structure available without a text layer.
-- Render PDFs through a bundled Rust worker with time, memory and output limits;
-  cancellation kills and reaps it. macOS uses an RSS watchdog, not a hard cap.
+- Isolate PDF metadata and text reads in the bundled resource-limited Rust
+  worker, as rendering already is; all three accept `memory_bytes:`.
+- On Linux/FreeBSD, re-exec the worker under its address-space limit before
+  reading the PDF, including tiny metadata-only reads.
+- Preserve completed pages on worker termination and recover healthy neighbors
+  after page-local stream limits without renewing the overall deadline.
+- Allow a bounded exit grace when macOS cannot inspect an exiting worker;
+  persistent monitor failures still terminate and reap a live worker.
+
+## [0.6.1](https://github.com/seuros/imprimatur/compare/v0.6.0...v0.6.1) (2026-10-25)
+
+
+### Bug Fixes
+
+* **pdf:** isolate bounded reads and preserve page recovery ([fbfbbc5](https://github.com/seuros/imprimatur/commit/fbfbbc5e7e44768efae293b37be255b8b797f831))
 
 ## [0.6.0](https://github.com/seuros/imprimatur/compare/v0.5.0...v0.6.0) (2026-10-25)
 

data/README.md

@@ -362,20 +362,31 @@ before allocation (`max_pixels:`, 4 million) and encoded output
 (`max_output_bytes:`, 8 MiB). Preflight rejects pages drawing more than 40 million
 source-image pixels. Renderer warnings fail instead of silently dropping content.
 The crate exposes `read::pdf::{info, pages, render_page}` (`render` feature) and
-`read::pdf::isolation::render_page_isolated` (`isolation` feature). The latter
-takes an absolute path to the trusted `imprimatur-render-worker` executable.
-The gem bundles that worker and always uses isolated rendering; it never falls
-back to an in-process render or searches PATH.
+`read::pdf::isolation::{info_isolated, pages_isolated, render_page_isolated}`
+(`isolation` feature). These take an absolute path to the trusted
+`imprimatur-render-worker` executable. The gem bundles that worker and always
+isolates all three PDF operations; it never falls back to in-process parsing
+or searches PATH.
 
-All three accept the normal read limits. Rendering also accepts `memory_bytes:`
+All three accept the normal read limits and `memory_bytes:`
 (1 GiB by default): Linux/FreeBSD enforce an address-space cap; macOS uses a
 sampled RSS watchdog, which can briefly overshoot. A worker is killed and reaped
-on timeout, cancellation or supervisor failure. Rendering has a mandatory
+on timeout, cancellation or supervisor failure. Each operation has a mandatory
 60-second process ceiling even with `timeout: nil`; a shorter `timeout:` still
 applies. CPU time, output files and core dumps are also limited.
 
+The page worker flushes completed records as it goes. An exhausted stream
+budget triggers individual-page recovery inside that worker: each attempt has
+its own `max_inflated` allowance, while the original overall deadline, process
+memory limit and aggregate text cap remain in force. An oversized page is
+`failed`, not blank, without discarding healthy neighbors. A worker terminated
+after metadata was read preserves completed pages and explicitly marks the
+unreached pages; an expired overall deadline marks them `skipped`. Cancellation
+still raises rather than returning a partial successful call.
+
 This is resource containment, **not a filesystem/network security sandbox**.
-The raw crate `render_page` remains in-process and cannot interrupt Hayro.
+The raw crate `info`, `pages` and `render_page` APIs remain in-process;
+`render_page` cannot interrupt Hayro.
 `max_inflated` bounds our preflight, not Hayro's internal decoders.
 
 ```ruby

data/lib/imprimatur/pdf_reader.rb

@@ -3,16 +3,18 @@
 module Imprimatur
   # Keyword handling only; parsing, limits and rendering live in the native core.
   module PdfReader
-    def self.info(document, max_bytes: nil, **limits)
-      JSON.parse(Native.pdf_info(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits)),
+    def self.info(document, memory_bytes: 1024 * 1024 * 1024, max_bytes: nil, **limits)
+      JSON.parse(Native.pdf_info(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits),
+                                 RENDER_WORKER, memory_bytes),
                  symbolize_names: true)
     end
 
     def self.pages(document, first_page: 1, last_page: 0xFFFFFFFF, max_pages: 500,
                    max_page_bytes: 256 * 1024, max_output_bytes: 8 * 1024 * 1024,
-                   max_bytes: nil, **limits)
+                   memory_bytes: 1024 * 1024 * 1024, max_bytes: nil, **limits)
       options = [first_page, last_page, max_pages, max_page_bytes, max_output_bytes]
-      JSON.parse(Native.pdf_pages(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits), options),
+      JSON.parse(Native.pdf_pages(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits),
+                                  options, RENDER_WORKER, memory_bytes),
                  symbolize_names: true)
     end
 

data/lib/imprimatur/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Imprimatur
-  VERSION = '0.6.0'
+  VERSION = '0.6.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: imprimatur
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: aarch64-linux-gnu
 authors:
 - Abdelkader Boudih