imprimatur 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4b065ca85ce09dca629c5a4ca92fbd0c361a8855b7226fce30e6a6e93f587cb
-  data.tar.gz: 63bbf24b4c97feb96676db2c59a2d137220799a993ea51d707977d37d3e90cf2
+  metadata.gz: b79ecca5f76986eb4049090056dcee55fe7b8d2aafa1115de48ea2f45b0e12ef
+  data.tar.gz: 925d5c93f99da882db19b562c749ba41c1ae17a5fd01d17b66bd9be93a9dc15a
 SHA512:
-  metadata.gz: 3f58a00ab92228d0cb3c1403c1111909ebda037e776e78b05a0d3830b92f46501a34a3d069303ad6092dfe0f30b5544b2638ce4b708631f60706ef04c21d09ae
-  data.tar.gz: 32f985236d5804b10812fe87d5f2e74488085d35dd1a66d648474c47f07537e1ff62a7c04f8b06c51847ac0d3d557d35804b308f7972e2b2df24a020e562630c
+  metadata.gz: e28f3c9640d20df215ed94a94195fcea8a28336f1ddc1d5a923355e09fdc68142517b92147c3b76dc089b68294c8aa4b4edde1a832fc613fb44612d92e4773ba
+  data.tar.gz: c7f0d6f08c5f9349574e03c3ec025c82f737afdeb5e4e8c6994bf7afe0c5a7fa7091e418495691346f43b987a7abd7451d6eeca207b87dd911a523508039ac3a

data/CHANGELOG.md

@@ -2,11 +2,21 @@
 
 ## Unreleased
 
-- Add native PDF metadata, bounded page reads with explicit failure states,
-  and optional pure-Rust full-page PNG rendering.
-- Keep scanned and blank page structure available without a text layer.
-- Render PDFs through a bundled Rust worker with time, memory and output limits;
-  cancellation kills and reaps it. macOS uses an RSS watchdog, not a hard cap.
+- Isolate PDF metadata and text reads in the bundled resource-limited Rust
+  worker, as rendering already is; all three accept `memory_bytes:`.
+- On Linux/FreeBSD, re-exec the worker under its address-space limit before
+  reading the PDF, including tiny metadata-only reads.
+- Preserve completed pages on worker termination and recover healthy neighbors
+  after page-local stream limits without renewing the overall deadline.
+- Allow a bounded exit grace when macOS cannot inspect an exiting worker;
+  persistent monitor failures still terminate and reap a live worker.
+
+## [0.6.1](https://github.com/seuros/imprimatur/compare/v0.6.0...v0.6.1) (2026-10-25)
+
+
+### Bug Fixes
+
+* **pdf:** isolate bounded reads and preserve page recovery ([fbfbbc5](https://github.com/seuros/imprimatur/commit/fbfbbc5e7e44768efae293b37be255b8b797f831))
 
 ## [0.6.0](https://github.com/seuros/imprimatur/compare/v0.5.0...v0.6.0) (2026-10-25)
 

data/Cargo.lock

@@ -513,7 +513,7 @@ dependencies = [
 
 [[package]]
 name = "imprimatur"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "aes",
  "crc32fast",
@@ -526,6 +526,7 @@ dependencies = [
  "nix",
  "qrcode",
  "read-fonts 0.45.1",
+ "serde",
  "serde_json",
  "sha2",
  "tempfile",
@@ -535,7 +536,7 @@ dependencies = [
 
 [[package]]
 name = "imprimatur-cli"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "imprimatur",
  "regex",
@@ -547,7 +548,7 @@ dependencies = [
 
 [[package]]
 name = "imprimatur_native"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "imprimatur",
  "magnus",

data/Cargo.toml

@@ -15,7 +15,7 @@ crc32fast = "1.5.2"
 datamatrix = "0.3.3"
 font-test-data = "0.10.0"
 hayro = { version = "0.8.0", default-features = false, features = ["embed-fonts", "embed-cmaps"] }
-imprimatur = { path = "ext/imprimatur_native/core", version = "0.6.0" }
+imprimatur = { path = "ext/imprimatur_native/core", version = "0.6.1" }
 libproc = "0.14.11"
 magnus = { version = "0.9.2", default-features = false }
 md-5 = "0.11.0"
@@ -27,6 +27,7 @@ read-fonts = "0.45.1"
 # rb-sys, features and all.
 rb-sys = { version = "0.9.130", default-features = false, features = ["stable-api"] }
 regex = "1.13.1"
+serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.154"
 sha2 = "0.11.1"
 tempfile = "3"

data/README.md

@@ -362,20 +362,31 @@ before allocation (`max_pixels:`, 4 million) and encoded output
 (`max_output_bytes:`, 8 MiB). Preflight rejects pages drawing more than 40 million
 source-image pixels. Renderer warnings fail instead of silently dropping content.
 The crate exposes `read::pdf::{info, pages, render_page}` (`render` feature) and
-`read::pdf::isolation::render_page_isolated` (`isolation` feature). The latter
-takes an absolute path to the trusted `imprimatur-render-worker` executable.
-The gem bundles that worker and always uses isolated rendering; it never falls
-back to an in-process render or searches PATH.
+`read::pdf::isolation::{info_isolated, pages_isolated, render_page_isolated}`
+(`isolation` feature). These take an absolute path to the trusted
+`imprimatur-render-worker` executable. The gem bundles that worker and always
+isolates all three PDF operations; it never falls back to in-process parsing
+or searches PATH.
 
-All three accept the normal read limits. Rendering also accepts `memory_bytes:`
+All three accept the normal read limits and `memory_bytes:`
 (1 GiB by default): Linux/FreeBSD enforce an address-space cap; macOS uses a
 sampled RSS watchdog, which can briefly overshoot. A worker is killed and reaped
-on timeout, cancellation or supervisor failure. Rendering has a mandatory
+on timeout, cancellation or supervisor failure. Each operation has a mandatory
 60-second process ceiling even with `timeout: nil`; a shorter `timeout:` still
 applies. CPU time, output files and core dumps are also limited.
 
+The page worker flushes completed records as it goes. An exhausted stream
+budget triggers individual-page recovery inside that worker: each attempt has
+its own `max_inflated` allowance, while the original overall deadline, process
+memory limit and aggregate text cap remain in force. An oversized page is
+`failed`, not blank, without discarding healthy neighbors. A worker terminated
+after metadata was read preserves completed pages and explicitly marks the
+unreached pages; an expired overall deadline marks them `skipped`. Cancellation
+still raises rather than returning a partial successful call.
+
 This is resource containment, **not a filesystem/network security sandbox**.
-The raw crate `render_page` remains in-process and cannot interrupt Hayro.
+The raw crate `info`, `pages` and `render_page` APIs remain in-process;
+`render_page` cannot interrupt Hayro.
 `max_inflated` bounds our preflight, not Hayro's internal decoders.
 
 ```ruby

data/ext/imprimatur_native/cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "imprimatur-cli"
-version = "0.6.0"
+version = "0.6.1"
 description = "Read PDF, XLSX, XLS, ODS and DOCX documents as Markdown or JSON, search them, extract their images."
 keywords = ["pdf", "xlsx", "docx", "markdown", "cli"]
 categories = ["command-line-utilities", "text-processing"]

data/ext/imprimatur_native/core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "imprimatur"
-version = "0.6.0"
+version = "0.6.1"
 description = "XLSX, PDF and DOCX authoring, and PDF, XLSX, XLS, ODS and DOCX reading, with its own XML, zip and PDF code."
 keywords = ["xlsx", "excel", "pdf", "docx", "spreadsheet"]
 categories = ["encoding", "text-processing"]
@@ -33,6 +33,7 @@ md-5.workspace = true
 miniz_oxide.workspace = true
 qrcode.workspace = true
 read-fonts = { workspace = true, optional = true }
+serde = { workspace = true, optional = true }
 serde_json = { workspace = true, optional = true }
 sha2.workspace = true
 thiserror.workspace = true
@@ -51,7 +52,7 @@ archive = ["dep:zip"]
 fonts = ["dep:read-fonts"]
 # Pure-Rust full-page PDF rasterization; readers and writers remain independent.
 render = ["dep:hayro"]
-isolation = ["render", "dep:tempfile", "dep:nix", "dep:libproc"]
+isolation = ["render", "json", "dep:serde", "dep:tempfile", "dep:nix", "dep:libproc"]
 
 [target.'cfg(unix)'.dependencies]
 nix = { workspace = true, optional = true }

data/ext/imprimatur_native/core/README.md

@@ -11,10 +11,15 @@ states and UTF-8-safe text limits. `read::pdf::render_page`, under the optional
 `render` feature, rasterizes a full page through Hayro (pure Rust).
 That raw API is not preemptible. For untrusted documents, enable `isolation`,
 build the `imprimatur-render-worker` binary and pass its absolute path to
-`read::pdf::isolation::render_page_isolated`. Rust supervises finite wall/CPU,
+`read::pdf::isolation::{info_isolated, pages_isolated, render_page_isolated}`.
+Rust supervises finite wall/CPU,
 memory and file-output limits, killing and reaping failed/cancelled workers.
 Linux/FreeBSD enforce address-space limits; macOS samples RSS and can briefly
 overshoot. This is resource containment, not a filesystem/network sandbox.
+Isolated page reads flush completed records, retain them on worker termination,
+and recover healthy neighbors after page-local decompression failures. Recovery
+attempts renew only the individual decompression allowance, never the overall
+deadline, process-memory limit or aggregate text cap.
 
 ```rust
 use imprimatur::xlsx::{Cell, Color, DateTime, Format, Workbook};

data/ext/imprimatur_native/core/src/read/pdf/bounded.rs

@@ -11,6 +11,7 @@ use crate::{Error, Result};
 
 /// Metadata read without interpreting page content.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "isolation", derive(serde::Serialize, serde::Deserialize))]
 pub struct Info {
     pub page_count: u32,
     /// Opened with the empty password: permissions, not a locked document.
@@ -40,7 +41,7 @@ impl Default for ReadOptions {
 }
 
 impl ReadOptions {
-    const fn validate(&self) -> Result<()> {
+    pub(super) const fn validate(&self) -> Result<()> {
         if self.first_page == 0 || self.last_page < self.first_page {
             return Err(Error::InvalidPdfOption("pages must be an ascending one-based range"));
         }
@@ -53,6 +54,7 @@ impl ReadOptions {
 
 /// What is known about a page; failure is never reported as empty.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "isolation", derive(serde::Serialize, serde::Deserialize))]
 pub enum Status {
     Text,
     Empty,
@@ -73,6 +75,7 @@ impl Status {
 }
 
 #[derive(Debug)]
+#[cfg_attr(feature = "isolation", derive(serde::Serialize, serde::Deserialize))]
 pub struct PageResult {
     pub number: u32,
     pub status: Status,
@@ -106,6 +109,24 @@ pub fn info(data: &[u8], limits: &Limits) -> Result<Info> {
 /// # Errors
 /// As [`info`], and invalid options.
 pub fn pages(data: &[u8], options: &ReadOptions, limits: &Limits) -> Result<Pages> {
+    let mut pages = Vec::new();
+    let info = visit_pages(data, options, limits, false, |page| {
+        pages.push(page);
+        Ok(())
+    })?;
+    Ok(Pages { info, pages })
+}
+
+/// The worker flushes each completed page. After an exhausted stream budget,
+/// single-page attempts get fresh decompression budgets, as individual reads
+/// would; the supervisor still enforces one wall-clock and process limit.
+pub(super) fn visit_pages(
+    data: &[u8],
+    options: &ReadOptions,
+    limits: &Limits,
+    recover: bool,
+    mut emit: impl FnMut(PageResult) -> Result<()>,
+) -> Result<Info> {
     options.validate()?;
     let budget = Budget::new(limits, data.len())?;
     let document = open(data, &budget)?;
@@ -114,52 +135,89 @@ pub fn pages(data: &[u8], options: &ReadOptions, limits: &Limits) -> Result<Page
     let mut fonts = Fonts::new();
     let mut text = PageText { strict: true, ..PageText::default() };
     let mut remaining = options.max_output_bytes;
-    let mut results = Vec::with_capacity(selected.pages.len());
+    let mut individual = false;
     for (number, page) in selected.pages {
         budget.check()?;
         if remaining == 0 {
-            results.push(unread(
-                number,
-                Status::Skipped,
-                "the text output limit was reached".into(),
-            ));
+            emit(unread(number, Status::Skipped, "the text output limit was reached".into()))?;
             continue;
         }
         text.max_bytes = Some(options.max_page_bytes.min(remaining));
-        let read = page.and_then(|page| page_text(&document, &page, &mut fonts, &mut text));
-        match read {
-            Ok(()) => {
-                let lines = layout::lines(&text);
-                let mut output = String::new();
-                for line in &lines.lines {
-                    if !output.is_empty() {
-                        output.push('\n');
-                    }
-                    output.push_str(lines.text(line));
+        let read = if individual {
+            single_page(data, number, options, remaining, limits)
+        } else {
+            page.and_then(|page| page_text(&document, &page, &mut fonts, &mut text))
+                .map(|()| text_result(number, &text, text.max_bytes.unwrap_or(remaining)))
+        };
+        let read = match read {
+            Err(error @ Error::LimitExceeded(_)) if recover => {
+                // Never renew an expired time budget or swallow cancellation.
+                budget.check()?;
+                if individual {
+                    Err(error)
+                } else {
+                    individual = true;
+                    single_page(data, number, options, remaining, limits)
                 }
-                let limit = options.max_page_bytes.min(remaining);
-                let truncated = text.truncated || output.len() > limit;
-                truncate(&mut output, limit);
-                remaining -= output.len();
-                results.push(PageResult {
-                    number,
-                    status: if output.trim().is_empty() { Status::Empty } else { Status::Text },
-                    text: output,
-                    images: Some(u32::try_from(text.images).unwrap_or(u32::MAX)),
-                    truncated,
-                    reason: truncated.then(|| "the page text limit was reached".into()),
-                });
+            }
+            other => other,
+        };
+        let result = match read {
+            Ok(page) => page,
+            Err(error @ Error::LimitExceeded(_)) if recover => {
+                budget.check()?;
+                unread(number, Status::Failed, error.to_string())
             }
             Err(error) if xref::is_limit(&error) || matches!(error, Error::PasswordRequired) => {
                 return Err(error);
             }
-            Err(error) => results.push(unread(number, Status::Failed, error.to_string())),
+            Err(error) => unread(number, Status::Failed, error.to_string()),
+        };
+        remaining -= result.text.len();
+        emit(result)?;
+    }
+    Ok(Info { page_count: selected.count, encrypted: document.encrypted() })
+}
+
+fn single_page(
+    data: &[u8],
+    number: u32,
+    options: &ReadOptions,
+    remaining: usize,
+    limits: &Limits,
+) -> Result<PageResult> {
+    let options = ReadOptions {
+        first_page: number,
+        last_page: number,
+        max_pages: 1,
+        max_output_bytes: remaining,
+        ..options.clone()
+    };
+    pages(data, &options, limits)?
+        .pages
+        .pop()
+        .ok_or_else(|| Error::malformed("PDF", "the selected page disappeared"))
+}
+
+fn text_result(number: u32, text: &PageText, limit: usize) -> PageResult {
+    let lines = layout::lines(text);
+    let mut output = String::new();
+    for line in &lines.lines {
+        if !output.is_empty() {
+            output.push('\n');
         }
+        output.push_str(lines.text(line));
+    }
+    let truncated = text.truncated || output.len() > limit;
+    truncate(&mut output, limit);
+    PageResult {
+        number,
+        status: if output.trim().is_empty() { Status::Empty } else { Status::Text },
+        text: output,
+        images: Some(u32::try_from(text.images).unwrap_or(u32::MAX)),
+        truncated,
+        reason: truncated.then(|| "the page text limit was reached".into()),
     }
-    Ok(Pages {
-        info: Info { page_count: selected.count, encrypted: document.encrypted() },
-        pages: results,
-    })
 }
 
 pub(super) fn open<'a>(data: &'a [u8], budget: &'a Budget<'a>) -> Result<Document<'a>> {
@@ -170,7 +228,8 @@ pub(super) fn open<'a>(data: &'a [u8], budget: &'a Budget<'a>) -> Result<Documen
     Document::open(data, budget).map(Document::strict)
 }
 
-const fn unread(number: u32, status: Status, reason: String) -> PageResult {
+pub(super) fn unread(number: u32, status: Status, mut reason: String) -> PageResult {
+    truncate(&mut reason, 4096);
     PageResult {
         number,
         status,

data/ext/imprimatur_native/core/src/read/pdf/isolation/protocol.rs

@@ -1,105 +1,190 @@
-//! A versioned, bounded reply and numeric-only worker arguments.
+//! Versioned replies and numeric-only arguments for the trusted PDF worker.
 
 use std::ffi::OsString;
 use std::io::Write;
+use std::time::Duration;
 
 use super::ProcessLimits;
 use crate::read::Limits;
-use crate::read::pdf::RenderOptions;
+use crate::read::pdf::{ReadOptions, RenderOptions};
 use crate::{Error, Result};
 
-pub(super) const HEADER: &[u8; 6] = b"IMPR\x01\0";
+pub(super) const HEADER: &[u8; 6] = b"IMPR\x02\0";
 pub(super) const MAX_ERROR_BYTES: usize = 4096;
 
+pub(super) enum Operation {
+    Info,
+    Pages(ReadOptions),
+    Render(u32, RenderOptions),
+}
+
+impl Operation {
+    pub fn maximum(&self) -> Result<usize> {
+        let invalid = || Error::InvalidPdfOption("worker output limit is too large");
+        let maximum = match self {
+            Self::Info => MAX_ERROR_BYTES,
+            // JSON can escape each text byte as six ASCII bytes. Reasons and
+            // record metadata are separately bounded for every selected page.
+            Self::Pages(options) => options
+                .max_output_bytes
+                .checked_mul(6)
+                .and_then(|text| {
+                    options.max_pages.checked_mul(MAX_ERROR_BYTES * 6 + 512)?.checked_add(text)
+                })
+                .and_then(|bytes| bytes.checked_add(MAX_ERROR_BYTES * 6 + 512))
+                .ok_or_else(invalid)?,
+            Self::Render(_, options) => options.max_output_bytes,
+        };
+        maximum.max(MAX_ERROR_BYTES).checked_add(HEADER.len()).ok_or_else(invalid)
+    }
+}
+
 pub(super) struct Request {
-    pub number: u32,
-    pub options: RenderOptions,
+    pub restricted: bool,
+    pub operation: Operation,
     pub limits: Limits,
     pub memory: u64,
     pub cpu_seconds: u64,
 }
 
 impl Request {
-    pub fn new(
-        number: u32,
-        options: &RenderOptions,
-        limits: &Limits,
-        process: &ProcessLimits,
-    ) -> Result<Self> {
-        options
-            .max_output_bytes
-            .checked_add(HEADER.len())
-            .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
+    pub fn new(operation: Operation, limits: &Limits, process: &ProcessLimits) -> Result<Self> {
+        operation.maximum()?;
+        match &operation {
+            Operation::Pages(options) => options.validate()?,
+            Operation::Render(0, _) => {
+                return Err(Error::InvalidPdfOption("page number must be positive"));
+            }
+            _ => {}
+        }
         if process.memory_bytes == 0 || process.memory_bytes >= i64::MAX as u64 {
             return Err(Error::InvalidPdfOption("memory limit must be positive and finite"));
         }
-        let cpu_seconds = process
-            .wall_time
+        let wall = limits.timeout.unwrap_or(process.wall_time).min(process.wall_time);
+        let cpu_seconds = wall
             .as_secs()
-            .checked_add(u64::from(process.wall_time.subsec_nanos() != 0))
+            .checked_add(u64::from(wall.subsec_nanos() != 0))
             .filter(|&seconds| seconds != 0 && seconds < i64::MAX as u64)
             .ok_or(Error::InvalidPdfOption("worker wall time must be positive and finite"))?;
+        u64::try_from(wall.as_nanos())
+            .map_err(|_| Error::InvalidPdfOption("worker wall time is too large"))?;
         Ok(Self {
-            number,
-            options: options.clone(),
-            limits: limits.clone(),
+            restricted: false,
+            operation,
+            limits: limits.clone().timeout(Some(wall)),
             memory: process.memory_bytes,
             cpu_seconds,
         })
     }
 
     pub fn arguments(&self) -> Vec<OsString> {
-        [
-            u64::from(self.number),
-            u64::from(self.options.max_side),
-            self.options.max_pixels,
-            self.options.max_output_bytes as u64,
-            u64::from(self.options.grayscale),
+        let timeout = self.limits.timeout.unwrap_or_default();
+        let mut values = vec![
+            u64::from(self.restricted),
             self.limits.max_input as u64,
             self.limits.max_inflated,
             self.limits.max_depth as u64,
             self.memory,
             self.cpu_seconds,
-        ]
-        .map(|number| OsString::from(number.to_string()))
-        .to_vec()
+            u64::try_from(timeout.as_nanos()).unwrap_or(u64::MAX),
+        ];
+        match &self.operation {
+            Operation::Info => values.push(0),
+            Operation::Pages(options) => values.extend([
+                1,
+                u64::from(options.first_page),
+                u64::from(options.last_page),
+                options.max_pages as u64,
+                options.max_page_bytes as u64,
+                options.max_output_bytes as u64,
+            ]),
+            Operation::Render(number, options) => values.extend([
+                2,
+                u64::from(*number),
+                u64::from(options.max_side),
+                options.max_pixels,
+                options.max_output_bytes as u64,
+                u64::from(options.grayscale),
+            ]),
+        }
+        values.into_iter().map(|number| OsString::from(number.to_string())).collect()
     }
 
     pub fn parse() -> Result<Self> {
-        let invalid = || Error::InvalidPdfOption("invalid render worker arguments");
+        let invalid = || Error::InvalidPdfOption("invalid PDF worker arguments");
         let values: Vec<u64> = std::env::args()
             .skip(1)
             .map(|value| value.parse().map_err(|_| invalid()))
             .collect::<Result<_>>()?;
-        let [number, side, pixels, output, gray, input, inflated, depth, memory, cpu] =
+        let [restricted, input, inflated, depth, memory, cpu, timeout, rest @ ..] =
             values.as_slice()
         else {
             return Err(invalid());
         };
-        if *gray > 1
-            || *memory == 0
-            || *memory >= i64::MAX as u64
-            || *cpu == 0
-            || *cpu >= i64::MAX as u64
-        {
+        if *restricted > 1 {
             return Err(invalid());
         }
-        Ok(Self {
-            number: u32::try_from(*number).map_err(|_| invalid())?,
-            options: RenderOptions {
-                max_side: u16::try_from(*side).map_err(|_| invalid())?,
-                max_pixels: *pixels,
-                max_output_bytes: usize::try_from(*output).map_err(|_| invalid())?,
-                grayscale: *gray == 1,
-            },
-            limits: Limits::default()
-                .max_input(usize::try_from(*input).map_err(|_| invalid())?)
-                .max_inflated(*inflated)
-                .max_depth(usize::try_from(*depth).map_err(|_| invalid())?)
-                .timeout(None),
-            memory: *memory,
-            cpu_seconds: *cpu,
-        })
+        let length = |value| usize::try_from(value).map_err(|_| invalid());
+        let operation = match rest {
+            [0] => Operation::Info,
+            [1, first, last, count, page, output] => Operation::Pages(ReadOptions {
+                first_page: u32::try_from(*first).map_err(|_| invalid())?,
+                last_page: u32::try_from(*last).map_err(|_| invalid())?,
+                max_pages: length(*count)?,
+                max_page_bytes: length(*page)?,
+                max_output_bytes: length(*output)?,
+            }),
+            [2, number, side, pixels, output, gray] if *gray <= 1 => Operation::Render(
+                u32::try_from(*number).map_err(|_| invalid())?,
+                RenderOptions {
+                    max_side: u16::try_from(*side).map_err(|_| invalid())?,
+                    max_pixels: *pixels,
+                    max_output_bytes: length(*output)?,
+                    grayscale: *gray == 1,
+                },
+            ),
+            _ => return Err(invalid()),
+        };
+        let limits = Limits::default()
+            .max_input(length(*input)?)
+            .max_inflated(*inflated)
+            .max_depth(length(*depth)?)
+            .timeout(Some(Duration::from_nanos(*timeout)));
+        let process =
+            ProcessLimits { memory_bytes: *memory, wall_time: Duration::from_nanos(*timeout) };
+        let mut request = Self::new(operation, &limits, &process)?;
+        request.restricted = *restricted == 1;
+        if request.cpu_seconds != *cpu {
+            return Err(invalid());
+        }
+        Ok(request)
+    }
+}
+
+pub(super) fn failure(error: &Error) -> (u8, String) {
+    let kind = match error {
+        Error::PasswordRequired => 1,
+        Error::UnsupportedDocument(_) => 2,
+        Error::LimitExceeded(_) | Error::Cancelled => 3,
+        Error::InvalidPdfOption(_) => 4,
+        _ => 5,
+    };
+    let mut message = error.to_string();
+    let mut end = message.len().min(MAX_ERROR_BYTES);
+    while !message.is_char_boundary(end) {
+        end -= 1;
+    }
+    message.truncate(end);
+    (kind, message)
+}
+
+pub(super) fn error(kind: u8, message: String) -> Error {
+    match kind {
+        1 => Error::PasswordRequired,
+        2 => Error::UnsupportedDocument(message),
+        3 => Error::LimitExceeded("PDF worker limit"),
+        4 => Error::InvalidPdfOption("the PDF worker rejected the options"),
+        _ => Error::malformed("PDF worker", message),
     }
 }
 
@@ -111,20 +196,10 @@ pub(super) fn write_reply(mut out: impl Write, result: Result<Vec<u8>>) -> Resul
             out.write_all(&data)?;
         }
         Err(error) => {
-            header[5] = match &error {
-                Error::PasswordRequired => 1,
-                Error::UnsupportedDocument(_) => 2,
-                Error::LimitExceeded(_) | Error::Cancelled => 3,
-                Error::InvalidPdfOption(_) => 4,
-                _ => 5,
-            };
-            let message = error.to_string();
-            let mut end = message.len().min(MAX_ERROR_BYTES);
-            while !message.is_char_boundary(end) {
-                end -= 1;
-            }
+            let (kind, message) = failure(&error);
+            header[5] = kind;
             out.write_all(&header)?;
-            out.write_all(&message.as_bytes()[..end])?;
+            out.write_all(message.as_bytes())?;
         }
     }
     out.flush()?;
@@ -133,23 +208,17 @@ pub(super) fn write_reply(mut out: impl Write, result: Result<Vec<u8>>) -> Resul
 
 pub(super) fn decode(mut data: Vec<u8>, maximum: usize) -> Result<Vec<u8>> {
     if data.len() < HEADER.len() || data[..5] != HEADER[..5] {
-        return Err(Error::malformed("render worker", "missing or incompatible response"));
+        return Err(Error::malformed("PDF worker", "missing or incompatible response"));
     }
     let status = data[5];
     data.drain(..HEADER.len());
     if status == 0 {
         return if data.len() > maximum {
-            Err(Error::LimitExceeded("rendered bytes"))
+            Err(Error::LimitExceeded("PDF worker output"))
         } else {
             Ok(data)
         };
     }
     let message = String::from_utf8_lossy(&data[..data.len().min(MAX_ERROR_BYTES)]).into_owned();
-    Err(match status {
-        1 => Error::PasswordRequired,
-        2 => Error::UnsupportedDocument(message),
-        3 => Error::LimitExceeded("render worker limit"),
-        4 => Error::InvalidPdfOption("the render worker rejected the rendering options"),
-        _ => Error::malformed("render worker", message),
-    })
+    Err(error(status, message))
 }

data/ext/imprimatur_native/core/src/read/pdf/isolation/stream.rs

@@ -0,0 +1,113 @@
+//! Flushed page records survive a worker timeout or resource termination.
+
+use std::io::Write;
+
+use serde::{Deserialize, Serialize};
+
+use super::{Output, protocol};
+use crate::read::pdf::{Info, PageResult, Pages, ReadOptions, Status, bounded};
+use crate::{Error, Result};
+
+#[derive(Serialize, Deserialize)]
+pub(super) enum Frame {
+    Info(Info),
+    Page(PageResult),
+    End,
+    Error { kind: u8, message: String },
+}
+
+pub(super) fn write(out: &mut impl Write, frame: &Frame) -> Result<()> {
+    serde_json::to_writer(&mut *out, frame)
+        .map_err(|error| Error::malformed("PDF worker", error.to_string()))?;
+    out.write_all(b"\n")?;
+    out.flush()?;
+    Ok(())
+}
+
+pub(super) fn decode(output: Output, options: &ReadOptions) -> Result<Pages> {
+    let mut failure = output.failure;
+    if output.data.len() < protocol::HEADER.len() {
+        return Err(failure.unwrap_or_else(|| malformed("missing response")));
+    }
+    let bytes =
+        protocol::decode(output.data, protocol::Operation::Pages(options.clone()).maximum()?)?;
+    let mut info = None;
+    let mut pages = Vec::new();
+    let mut text_bytes = 0_usize;
+    let mut ended = false;
+    for line in bytes.split_inclusive(|&byte| byte == b'\n') {
+        if ended {
+            return Err(malformed("records after the end of the response"));
+        }
+        if !line.ends_with(b"\n") && failure.is_some() {
+            break; // A killed worker may leave one incomplete final record.
+        }
+        let frame: Frame =
+            serde_json::from_slice(line).map_err(|error| malformed(&error.to_string()))?;
+        match frame {
+            Frame::Info(value) if info.is_none() && pages.is_empty() => info = Some(value),
+            Frame::Page(page) => {
+                let metadata = info.ok_or_else(|| malformed("page before metadata"))?;
+                validate(&page, pages.len(), metadata, options)?;
+                text_bytes = text_bytes
+                    .checked_add(page.text.len())
+                    .filter(|&bytes| bytes <= options.max_output_bytes)
+                    .ok_or_else(|| malformed("text exceeds the requested limit"))?;
+                pages.push(page);
+            }
+            Frame::End => ended = true,
+            Frame::Error { kind, message } => {
+                failure = Some(protocol::error(kind, message));
+                ended = true;
+            }
+            Frame::Info(_) => return Err(malformed("duplicate metadata")),
+        }
+    }
+    let info =
+        info.ok_or_else(|| failure.take().unwrap_or_else(|| malformed("missing metadata")))?;
+    let count = selected(info, options);
+    if pages.len() == count && ended {
+        return Ok(Pages { info, pages });
+    }
+    let error = failure.ok_or_else(|| malformed("incomplete response"))?;
+    let reason = error.to_string();
+    let timed_out = matches!(
+        error,
+        Error::LimitExceeded("time" | "render worker wall time" | "PDF worker limit")
+    );
+    let first_missing = pages.len();
+    for index in first_missing..count {
+        let number =
+            options.first_page + u32::try_from(index).map_err(|_| malformed("page index"))?;
+        let status =
+            if timed_out || index > first_missing { Status::Skipped } else { Status::Failed };
+        pages.push(bounded::unread(number, status, reason.clone()));
+    }
+    Ok(Pages { info, pages })
+}
+
+fn selected(info: Info, options: &ReadOptions) -> usize {
+    let count = options
+        .last_page
+        .min(info.page_count)
+        .checked_sub(options.first_page)
+        .map_or(0, |difference| u64::from(difference) + 1);
+    usize::try_from(count).unwrap_or(usize::MAX).min(options.max_pages)
+}
+
+fn validate(page: &PageResult, index: usize, info: Info, options: &ReadOptions) -> Result<()> {
+    let expected = u64::from(options.first_page) + index as u64;
+    if index >= selected(info, options)
+        || u64::from(page.number) != expected
+        || page.text.len() > options.max_page_bytes
+        || page.reason.as_ref().is_some_and(|reason| reason.len() > protocol::MAX_ERROR_BYTES)
+        || (matches!(page.status, Status::Failed | Status::Skipped) && !page.text.is_empty())
+    {
+        return Err(malformed("invalid page record"));
+    }
+    Ok(())
+}
+
+fn malformed(reason: &str) -> Error {
+    Error::malformed("PDF worker", reason)
+}

data/ext/imprimatur_native/core/src/read/pdf/isolation/system.rs

@@ -28,6 +28,33 @@ pub(super) fn apply_limits(memory: u64, cpu: u64, output: u64) -> Result<()> {
     Ok(())
 }
 
+/// Replace the bootstrap after setting address-space limits, so the loader
+/// and parser cannot reuse memory mapped before the cap was installed.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+pub(super) fn reexec(arguments: &[std::ffi::OsString]) -> Result<()> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+
+    let string = |value: &[u8]| {
+        CString::new(value)
+            .map_err(|error| std::io::Error::new(std::io::ErrorKind::InvalidInput, error))
+    };
+    let executable = string(std::env::current_exe()?.as_os_str().as_bytes())?;
+    let mut args = vec![executable.clone(), string(b"1")?];
+    for argument in arguments.iter().skip(1) {
+        args.push(string(argument.as_os_str().as_bytes())?);
+    }
+    match nix::unistd::execv(&executable, &args) {
+        Ok(never) => match never {},
+        // A tiny address-space cap can prevent exec from allocating its
+        // argument/environment pages and surface as E2BIG rather than ENOMEM.
+        Err(Errno::ENOMEM | Errno::E2BIG) => {
+            Err(Error::LimitExceeded("PDF worker startup resources"))
+        }
+        Err(error) => Err(std::io::Error::from(error).into()),
+    }
+}
+
 fn lower(resource: Resource, value: u64) -> Result<()> {
     let (soft, hard) = getrlimit(resource).map_err(std::io::Error::from)?;
     let value = bounded_limit(value, soft, hard)?;

data/ext/imprimatur_native/core/src/read/pdf/isolation/worker.rs

@@ -1,43 +1,74 @@
-//! The companion worker sets limits before touching the document.
+//! Apply resource limits before parsing any document bytes.
 
-use std::io::Read;
+use std::io::{Read, Write};
 use std::process::ExitCode;
 
-use super::{protocol, system};
-use crate::read::pdf::render_page;
+use super::protocol::{Operation, Request};
+use super::{protocol, stream, system};
+use crate::read::pdf::{self, bounded};
 use crate::{Error, Result};
 
-/// Internal entry point for the bundled worker executable.
+/// Internal entry point for the bundled PDF worker executable.
 #[doc(hidden)]
 #[must_use]
 pub fn worker_main() -> ExitCode {
-    match protocol::write_reply(std::io::stdout().lock(), run()) {
+    let mut out = std::io::stdout().lock();
+    let result = Request::parse().and_then(|request| run(&request, &mut out));
+    match result.or_else(|error| protocol::write_reply(&mut out, Err(error))) {
         Ok(()) => ExitCode::SUCCESS,
         Err(error) => {
-            eprintln!("imprimatur render worker: {error}");
+            eprintln!("imprimatur PDF worker: {error}");
             ExitCode::FAILURE
         }
     }
 }
 
-fn run() -> Result<Vec<u8>> {
-    let request = protocol::Request::parse()?;
-    let output = request
-        .options
-        .max_output_bytes
-        .max(protocol::MAX_ERROR_BYTES)
-        .checked_add(protocol::HEADER.len())
-        .and_then(|value| u64::try_from(value).ok())
-        .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
+fn run(request: &Request, out: &mut impl Write) -> Result<()> {
+    let output = u64::try_from(request.operation.maximum()?)
+        .map_err(|_| Error::InvalidPdfOption("worker output limit is too large"))?;
     system::apply_limits(request.memory, request.cpu_seconds, output)?;
-    let mut bytes = Vec::new();
+    #[cfg(any(target_os = "linux", target_os = "freebsd"))]
+    if !request.restricted {
+        system::reexec(&request.arguments())?;
+    }
     let maximum = u64::try_from(request.limits.max_input)
         .ok()
         .and_then(|value| value.checked_add(1))
         .ok_or(Error::InvalidPdfOption("input limit is too large"))?;
+    let mut bytes = Vec::new();
     std::io::stdin().lock().take(maximum).read_to_end(&mut bytes)?;
     if bytes.len() > request.limits.max_input {
         return Err(Error::LimitExceeded("input size"));
     }
-    render_page(&bytes, request.number, &request.options, &request.limits).map(|image| image.data)
+    match &request.operation {
+        Operation::Info => protocol::write_reply(
+            out,
+            pdf::info(&bytes, &request.limits).and_then(|info| {
+                serde_json::to_vec(&info)
+                    .map_err(|error| Error::malformed("PDF worker", error.to_string()))
+            }),
+        ),
+        Operation::Render(number, options) => protocol::write_reply(
+            out,
+            pdf::render_page(&bytes, *number, options, &request.limits).map(|image| image.data),
+        ),
+        Operation::Pages(options) => {
+            out.write_all(protocol::HEADER)?;
+            let result = pdf::info(&bytes, &request.limits).and_then(|info| {
+                stream::write(out, &stream::Frame::Info(info))?;
+                bounded::visit_pages(&bytes, options, &request.limits, true, |page| {
+                    stream::write(out, &stream::Frame::Page(page))
+                })?;
+                Ok(())
+            });
+            let frame = match result {
+                Ok(()) => stream::Frame::End,
+                Err(error) => {
+                    let (kind, message) = protocol::failure(&error);
+                    stream::Frame::Error { kind, message }
+                }
+            };
+            stream::write(out, &frame)
+        }
+    }
 }

data/ext/imprimatur_native/core/src/read/pdf/isolation.rs

@@ -1,7 +1,8 @@
-//! Render in a separate, resource-limited process. No untrusted PDF parsing
+//! Read and render in a resource-limited process. No untrusted PDF parsing
 //! occurs in the supervisor.
 
 mod protocol;
+mod stream;
 mod system;
 #[cfg(test)]
 mod tests;
@@ -14,11 +15,47 @@ use std::path::Path;
 use std::process::{Child, Command, ExitStatus, Stdio};
 use std::time::{Duration, Instant};
 
-use super::RenderOptions;
+use super::{Info, Pages, ReadOptions, RenderOptions};
 use crate::read::{Budget, Image, Limits};
 use crate::{Error, Result};
 pub use worker::worker_main;
 
+/// Inspects a PDF in the trusted, resource-limited worker.
+///
+/// # Errors
+/// Invalid options, worker errors, or exceeded input, memory or time limits.
+pub fn info_isolated(
+    worker: &Path,
+    data: &[u8],
+    limits: &Limits,
+    process: &ProcessLimits,
+) -> Result<Info> {
+    let output = invoke(worker, data, protocol::Operation::Info, limits, process)?;
+    let bytes = output.complete(protocol::MAX_ERROR_BYTES)?;
+    serde_json::from_slice(&bytes)
+        .map_err(|error| Error::malformed("PDF worker", error.to_string()))
+}
+
+/// Reads PDF pages in the worker, retaining completed records on resource failure.
+///
+/// Page-local stream limits trigger bounded individual recovery.
+/// All attempts share one external wall-clock and process-memory limit.
+///
+/// # Errors
+/// As [`info_isolated`], and cancellation or an invalid worker reply.
+/// A failure before page metadata is available remains a document error.
+pub fn pages_isolated(
+    worker: &Path,
+    data: &[u8],
+    options: &ReadOptions,
+    limits: &Limits,
+    process: &ProcessLimits,
+) -> Result<Pages> {
+    let output =
+        invoke(worker, data, protocol::Operation::Pages(options.clone()), limits, process)?;
+    stream::decode(output, options)
+}
+
 /// Mandatory process limits, in addition to the reader/render limits.
 #[derive(Debug, Clone)]
 pub struct ProcessLimits {
@@ -51,6 +88,44 @@ pub fn render_page_isolated(
     limits: &Limits,
     process: &ProcessLimits,
 ) -> Result<Image> {
+    let output = invoke(
+        worker,
+        data,
+        protocol::Operation::Render(number, options.clone()),
+        limits,
+        process,
+    )?;
+    let data = output.complete(options.max_output_bytes)?;
+    // The trusted worker writes only PNG; reject malformed/empty replies too.
+    if !data.starts_with(b"\x89PNG\r\n\x1a\n") || data.len() < 26 {
+        return Err(Error::malformed("PDF worker", "invalid PNG response"));
+    }
+    let dimension = |at| u32::from_be_bytes(data[at..at + 4].try_into().unwrap_or([0; 4]));
+    let (width, height) = (dimension(16), dimension(20));
+    options.image(data, number, (width, height))
+}
+
+struct Output {
+    data: Vec<u8>,
+    failure: Option<Error>,
+}
+
+impl Output {
+    fn complete(self, maximum: usize) -> Result<Vec<u8>> {
+        if let Some(error) = self.failure {
+            return Err(error);
+        }
+        protocol::decode(self.data, maximum)
+    }
+}
+
+fn invoke(
+    worker: &Path,
+    data: &[u8],
+    operation: protocol::Operation,
+    limits: &Limits,
+    process: &ProcessLimits,
+) -> Result<Output> {
     let budget = Budget::new(limits, data.len())?;
     budget.check()?;
     let deadline = Instant::now()
@@ -59,10 +134,12 @@ pub fn render_page_isolated(
     if !worker.is_absolute() || !worker.is_file() {
         return Err(Error::InvalidPdfOption("an absolute path to the render worker is required"));
     }
-    if process.memory_bytes == 0 || process.wall_time.is_zero() || number == 0 {
-        return Err(Error::InvalidPdfOption("process limits and page number must be positive"));
+    if process.memory_bytes == 0 || process.wall_time.is_zero() {
+        return Err(Error::InvalidPdfOption("process limits must be positive"));
     }
-    let request = protocol::Request::new(number, options, limits, process)?;
+    let request = protocol::Request::new(operation, limits, process)?;
+    let maximum = u64::try_from(request.operation.maximum()?)
+        .map_err(|_| Error::InvalidPdfOption("worker output limit is too large"))?;
     let directory = tempfile::tempdir()?;
     let input_path = directory.path().join("input.pdf");
     File::create(&input_path)?.write_all(data)?;
@@ -77,30 +154,20 @@ pub fn render_page_isolated(
         .process_group(0)
         .spawn()?;
     let mut child = Running { child, finished: false };
-    let status = supervise(&mut child, &budget, deadline, process.memory_bytes)?;
-    if !status.success() {
-        return Err(Error::LimitExceeded("render worker resources"));
-    }
-    let maximum = options
-        .max_output_bytes
-        .max(protocol::MAX_ERROR_BYTES)
-        .checked_add(protocol::HEADER.len())
-        .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
-    let maximum = u64::try_from(maximum).unwrap_or(u64::MAX);
+    let failure = match supervise(&mut child, &budget, deadline, process.memory_bytes) {
+        Ok(status) if status.success() => check_finished(&budget, deadline).err(),
+        Ok(_) => Some(Error::LimitExceeded("PDF worker resources")),
+        Err(Error::Cancelled) => return Err(Error::Cancelled),
+        Err(error) => Some(error),
+    };
+    // Stop and reap an unfinished worker before inspecting its flushed output.
+    drop(child);
     if fs::metadata(&output_path)?.len() > maximum {
-        return Err(Error::LimitExceeded("render worker output"));
+        return Err(Error::LimitExceeded("PDF worker output"));
     }
     let mut output = Vec::new();
     File::open(output_path)?.take(maximum).read_to_end(&mut output)?;
-    check_finished(&budget, deadline)?;
-    let data = protocol::decode(output, options.max_output_bytes)?;
-    // The trusted worker writes only PNG; also reject malformed/empty replies.
-    if !data.starts_with(b"\x89PNG\r\n\x1a\n") || data.len() < 26 {
-        return Err(Error::malformed("render worker", "invalid PNG response"));
-    }
-    let dimension = |at| u32::from_be_bytes(data[at..at + 4].try_into().unwrap_or([0; 4]));
-    let (width, height) = (dimension(16), dimension(20));
-    options.image(data, number, (width, height))
+    Ok(Output { data: output, failure })
 }
 
 fn check(budget: &Budget<'_>, deadline: Instant) -> Result<()> {
@@ -155,12 +222,34 @@ fn supervise(
         check(budget, deadline)?;
         #[cfg(target_os = "macos")]
         if let Err(error) = system::check_memory(child.child.id(), memory) {
-            // It may have exited between try_wait and the memory query.
-            if let Some(status) = child.poll()? {
-                return Ok(status);
+            if matches!(error, Error::Io(_)) {
+                return finish_monitor_error(child, budget, deadline, error);
             }
             return Err(error);
         }
         std::thread::sleep(Duration::from_millis(5));
     }
 }
+
+#[cfg(target_os = "macos")]
+fn finish_monitor_error(
+    child: &mut Running,
+    budget: &Budget<'_>,
+    deadline: Instant,
+    error: Error,
+) -> Result<ExitStatus> {
+    // proc_pidinfo can stop seeing an exiting task before waitpid can reap it.
+    // Never bypass monitoring for a live worker: allow only a bounded exit
+    // grace, still respecting cancellation and the original overall deadline.
+    let grace = Instant::now() + Duration::from_millis(50);
+    loop {
+        if let Some(status) = child.poll()? {
+            return Ok(status);
+        }
+        check(budget, deadline)?;
+        if Instant::now() >= grace {
+            return Err(error);
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}

data/ext/imprimatur_native/ffi/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "imprimatur_native"
-version = "0.6.0"
+version = "0.6.1"
 description = "Ruby bindings for the imprimatur crate"
 publish = false
 edition.workspace = true

data/ext/imprimatur_native/ffi/src/lib.rs

@@ -326,8 +326,8 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     native.define_singleton_method("markdown", function!(read::markdown_native, 4))?;
     native.define_singleton_method("content", function!(read::content_native, 5))?;
     native.define_singleton_method("images", function!(read::images_native, 4))?;
-    native.define_singleton_method("pdf_info", function!(pdf::info, 2))?;
-    native.define_singleton_method("pdf_pages", function!(pdf::pages, 3))?;
+    native.define_singleton_method("pdf_info", function!(pdf::info, 4))?;
+    native.define_singleton_method("pdf_pages", function!(pdf::pages, 5))?;
     native.define_singleton_method("render_pdf_page", function!(pdf::render, 5))?;
     native.define_singleton_method("sheets", function!(sheets::sheets_native, 5))?;
     let zip_writer = native.define_class("ZipWriter", ruby.class_object())?;

data/ext/imprimatur_native/ffi/src/pdf.rs

@@ -9,9 +9,17 @@ use crate::read::without_gvl;
 
 type Keywords = (Option<usize>, Option<u64>, Option<f64>);
 
-pub fn info(ruby: &Ruby, document: RString, keywords: Keywords) -> Result<RString, Error> {
+pub fn info(
+    ruby: &Ruby,
+    document: RString,
+    keywords: Keywords,
+    worker: String,
+    memory_bytes: u64,
+) -> Result<RString, Error> {
+    let worker = PathBuf::from(worker);
+    let process = process_limits(memory_bytes);
     let value = without_gvl(ruby, document, keywords, |data, limits| {
-        let info = pdf::info(data, limits)?;
+        let info = pdf::isolation::info_isolated(&worker, data, limits, &process)?;
         Ok(json!({ "page_count": info.page_count, "encrypted": info.encrypted }).to_string())
     })?;
     Ok(ruby.str_new(&value))
@@ -22,12 +30,16 @@ pub fn pages(
     document: RString,
     keywords: Keywords,
     options: (u32, u32, usize, usize, usize),
+    worker: String,
+    memory_bytes: u64,
 ) -> Result<RString, Error> {
     let (first_page, last_page, max_pages, max_page_bytes, max_output_bytes) = options;
     let options =
         pdf::ReadOptions { first_page, last_page, max_pages, max_page_bytes, max_output_bytes };
+    let worker = PathBuf::from(worker);
+    let process = process_limits(memory_bytes);
     let value = without_gvl(ruby, document, keywords, |data, limits| {
-        let result = pdf::pages(data, &options, limits)?;
+        let result = pdf::isolation::pages_isolated(&worker, data, &options, limits, &process)?;
         let pages: Vec<_> = result
             .pages
             .into_iter()
@@ -63,11 +75,14 @@ pub fn render(
     let (page, max_side, max_pixels, max_output_bytes, grayscale) = options;
     let worker = PathBuf::from(worker);
     let options = pdf::RenderOptions { max_side, max_pixels, max_output_bytes, grayscale };
-    let process =
-        pdf::isolation::ProcessLimits { memory_bytes, ..pdf::isolation::ProcessLimits::default() };
+    let process = process_limits(memory_bytes);
     let data = without_gvl(ruby, document, keywords, |data: &[u8], limits: &Limits| {
         pdf::isolation::render_page_isolated(&worker, data, page, &options, limits, &process)
             .map(|image| image.data)
     })?;
     Ok(ruby.str_from_slice(&data))
 }
+
+fn process_limits(memory_bytes: u64) -> pdf::isolation::ProcessLimits {
+    pdf::isolation::ProcessLimits { memory_bytes, ..pdf::isolation::ProcessLimits::default() }
+}

data/lib/imprimatur/pdf_reader.rb

@@ -3,16 +3,18 @@
 module Imprimatur
   # Keyword handling only; parsing, limits and rendering live in the native core.
   module PdfReader
-    def self.info(document, max_bytes: nil, **limits)
-      JSON.parse(Native.pdf_info(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits)),
+    def self.info(document, memory_bytes: 1024 * 1024 * 1024, max_bytes: nil, **limits)
+      JSON.parse(Native.pdf_info(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits),
+                                 RENDER_WORKER, memory_bytes),
                  symbolize_names: true)
     end
 
     def self.pages(document, first_page: 1, last_page: 0xFFFFFFFF, max_pages: 500,
                    max_page_bytes: 256 * 1024, max_output_bytes: 8 * 1024 * 1024,
-                   max_bytes: nil, **limits)
+                   memory_bytes: 1024 * 1024 * 1024, max_bytes: nil, **limits)
       options = [first_page, last_page, max_pages, max_page_bytes, max_output_bytes]
-      JSON.parse(Native.pdf_pages(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits), options),
+      JSON.parse(Native.pdf_pages(Reader.read(document, max_bytes), Reader.limits(max_bytes:, **limits),
+                                  options, RENDER_WORKER, memory_bytes),
                  symbolize_names: true)
     end
 

data/lib/imprimatur/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Imprimatur
-  VERSION = '0.6.0'
+  VERSION = '0.6.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: imprimatur
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Abdelkader Boudih
@@ -114,6 +114,7 @@ files:
 - ext/imprimatur_native/core/src/read/pdf/images.rs
 - ext/imprimatur_native/core/src/read/pdf/isolation.rs
 - ext/imprimatur_native/core/src/read/pdf/isolation/protocol.rs
+- ext/imprimatur_native/core/src/read/pdf/isolation/stream.rs
 - ext/imprimatur_native/core/src/read/pdf/isolation/system.rs
 - ext/imprimatur_native/core/src/read/pdf/isolation/worker.rs
 - ext/imprimatur_native/core/src/read/pdf/layout.rs