spine-rigc 2.0.1 → 2.0.3

package/src/validate.ts

@@ -3466,10 +3466,70 @@ const NOT_A_VALUE_IN_THE_FILE: Record<string, string> = {
   index: 'the array position this walk already iterates by name',
   timelineIds: 'derived from the timelines',
   timelineSlots: 'derived from the skin',
-  properties: 'derived from the constraint',
   propertyIds: 'carries an attachment id, which is a counter (see above)',
 };
 
+/**
+ * The keys above that ARE a value the file carries on these owners, by the
+ * owner's class name (issue #1084).
+ *
+ * The skip list is keyed by field name alone, and four of its names are also
+ * the name of a field the parser reads off the file on a different class. Each
+ * owner below was found by walking the parsed form of the twelve editor exports
+ * and the seven gallery builds for every class carrying a key the list names,
+ * and each field was planted and posed before it was let back in:
+ *
+ * - `a`, `b` — a `Color`'s alpha and blue channels, which share their names with
+ *   two entries of a bone's world matrix. Every slot colour, dark colour, bone
+ *   colour and attachment colour lost half its channels to that: a slot's alpha
+ *   `ff` → `80` moved no value at all, and posed, it changes every slot row.
+ * - `local` — a slider's `local` flag, which shares its name with a bone pose's
+ *   derived `local`. Flipped on `gallery/look`'s `yaw`, it moves the posed bones.
+ * - `offsets` — a transform constraint's six offsets (`rotation`, `x`, `y`,
+ *   `scaleX`, `scaleY`, `shearY` in the file), which share their name with a
+ *   sequence's region offsets. A `y` offset moved on `6-arcs-pro`'s `tail`
+ *   moved no value and moves the posed bones.
+ *
+ * A fifth entry, `properties` (*derived from the constraint*), is gone rather
+ * than excepted: the one class measured carrying it is the transform constraint,
+ * where it is the file's from/to map, so the reason was not true of anything.
+ *
+ * ⚠️ An exception rather than a rewrite of the list: the list's design — a
+ * field the parser starts reading is compared the day it starts — is right,
+ * and what was wrong was that a name stood for every class carrying it.
+ */
+const VALUE_ON_THESE_OWNERS: Record<string, readonly string[]> = {
+  a: ['Color'],
+  b: ['Color'],
+  local: ['SliderData'],
+  offsets: ['TransformConstraintData'],
+};
+
+/** Whether the walk leaves `key` out on an object of class `owner`. */
+function notAValue(owner: string, key: string): boolean {
+  return key in NOT_A_VALUE_IN_THE_FILE && !(VALUE_ON_THESE_OWNERS[key] ?? []).includes(owner);
+}
+
+/**
+ * The class an object was parsed into when that class is one of several sharing
+ * a shape — it extends another class — or `null`.
+ *
+ * Reflection reads fields, and two classes with the same fields are the same
+ * object to it: a slider reading `rotate` holds a `FromRotate` and one reading
+ * `x` a `FromX`, both `{ offset, to }`, so moving a slider to another property
+ * moved no value (issue #1084). Measured over the parsed corpus, the only
+ * unnamed objects the walk expands whose class extends another are the
+ * transform and slider property classes (`From*`, `To*`); a pose, a colour and a
+ * sequence are classes of their own, so this adds nothing under them.
+ */
+function sharedShapeKind(obj: object): string | null {
+  const proto = Object.getPrototypeOf(obj) as object | null;
+  if (proto === null || proto === Object.prototype) return null;
+  const parent = Object.getPrototypeOf(proto) as object | null;
+  if (parent === null || parent === Object.prototype) return null;
+  return (obj.constructor as { name?: string } | undefined)?.name ?? null;
+}
+
 /** How deep a chain of unnamed objects may go before the walk says so and stops. */
 const VALUE_WALK_DEPTH = 10;
 
@@ -3501,7 +3561,24 @@ function pushValue(value: unknown, path: string, out: SkeletonValue[], depth: nu
   if (typeof value === 'function') return;
   if (ArrayBuffer.isView(value) || Array.isArray(value)) {
     const list = value as ArrayLike<unknown>;
-    for (let i = 0; i < list.length; i++) pushValue(list[i], `${path}/${i}`, out, depth + 1);
+    // A list whose every entry is an unnamed object of its own shared-shape
+    // class — a transform's `properties` and each one's `to` — is keyed by those
+    // classes rather than by position: the file writes them as an object keyed
+    // by property name, any writer may key it in its own order, and the
+    // parser's list follows that order. By position, the same map written
+    // backwards would read as every property moved (issue #1084).
+    const kinds: string[] = [];
+    for (let i = 0; i < list.length; i++) {
+      const entry = list[i];
+      const kind =
+        typeof entry === 'object' && entry !== null && typeof (entry as Record<string, unknown>).name !== 'string'
+          ? sharedShapeKind(entry)
+          : null;
+      if (kind === null || kinds.includes(kind)) break;
+      kinds.push(kind);
+    }
+    const byKind = list.length > 0 && kinds.length === list.length;
+    for (let i = 0; i < list.length; i++) pushValue(list[i], `${path}/${byKind ? kinds[i] : i}`, out, depth + 1);
     return;
   }
   if (typeof value !== 'object') return;
@@ -3514,8 +3591,12 @@ function pushValue(value: unknown, path: string, out: SkeletonValue[], depth: nu
     out.push({ path, value: '(deeper than the walk goes)' });
     return;
   }
+  const owner = (obj.constructor as { name?: string } | undefined)?.name ?? '';
+  // The class, where it is the one thing the fields cannot say — see `sharedShapeKind`.
+  const kind = depth > 0 ? sharedShapeKind(obj) : null;
+  if (kind !== null) out.push({ path: `${path}/kind`, value: kind });
   for (const key of Object.keys(obj).sort()) {
-    if (key in NOT_A_VALUE_IN_THE_FILE) continue;
+    if (notAValue(owner, key)) continue;
     pushValue(obj[key], `${path}/${key}`, out, depth + 1);
   }
 }
@@ -3570,7 +3651,9 @@ function timelineKey(timeline: Timeline, data: ReturnType<SkeletonJson['readSkel
  * and setup attachment, every attachment in every skin (a region's offsets,
  * rotation, scale and size; a mesh's vertices, weights, `regionUVs`,
  * triangles, hull and edges; a bounding box's, path's and clipping shape's
- * vertices), every constraint's pose and flags, every event's payload, and for
+ * vertices), every constraint's pose, flags and modes — a transform's offsets
+ * and its property map, each entry by its class, and a slider's property by its
+ * class (issue #1084) — every event's payload, and for
  * every timeline every frame — time and values, from the runtime's own
  * `getFrameEntries()` — its curve type and Bezier samples, and its deform
  * vertices, attachment names, draw orders and event payloads.
@@ -3605,7 +3688,7 @@ export function skeletonValues(skeletonText: string, atlasText: string): Skeleto
     const at = `bones/${bone.name}`;
     const rec = bone as unknown as Record<string, unknown>;
     for (const key of Object.keys(rec).sort()) {
-      if (key in NOT_A_VALUE_IN_THE_FILE || key === 'name') continue;
+      if (notAValue('BoneData', key) || key === 'name') continue;
       pushValue(rec[key], `${at}/${key === 'setupPose' ? 'setup' : key}`, out, 1);
     }
   }
@@ -3613,7 +3696,7 @@ export function skeletonValues(skeletonText: string, atlasText: string): Skeleto
     const at = `slots/${slot.name}`;
     const rec = slot as unknown as Record<string, unknown>;
     for (const key of Object.keys(rec).sort()) {
-      if (key in NOT_A_VALUE_IN_THE_FILE || key === 'name') continue;
+      if (notAValue('SlotData', key) || key === 'name') continue;
       pushValue(rec[key], `${at}/${key === 'setupPose' ? 'setup' : key}`, out, 1);
     }
   }
@@ -3681,7 +3764,7 @@ export function skeletonValues(skeletonText: string, atlasText: string): Skeleto
         }
         const rec = timeline as unknown as Record<string, unknown>;
         for (const field of Object.keys(rec).sort()) {
-          if (field in NOT_A_VALUE_IN_THE_FILE || field === 'frames') continue;
+          if (notAValue(timeline.constructor?.name ?? '', field) || field === 'frames') continue;
           // The owner is in the path already; comparing the index as well would
           // report one reordering twice, in a measure that is not about order.
           if (field === 'boneIndex' || field === 'slotIndex' || field === 'constraintIndex') continue;

package/tools/editor_roundtrip.ts

@@ -153,6 +153,41 @@ function bundleName(plist: string): string | null {
   }
 }
 
+/**
+ * The editor naming its own version, as MEASURED on a licensed 4.3 editor on
+ * macOS 2026-10-02 (issue #1077). `--version` printed nine lines on stdout and
+ * none on stderr, in this shape:
+ *
+ *     the launcher's banner        `Spine Launcher <x.y.z> (<platform>)`
+ *     the copyright line
+ *     the operating system and its version
+ *     `Starting: Spine <x.y.z> Professional`
+ *     `Spine <x.y.z> Professional`             <- this line
+ *     `Licensed to:`
+ *     the licensee's name
+ *     the licensee's e-mail address
+ *     `Complete.`
+ *
+ * 🚨 The tool used to print the last three of those, which are the licensee's
+ * name, e-mail and `Complete.` — personal data in a log that gets pasted into
+ * PR bodies and cards, and no version at all (issue #1040 found it). So the
+ * report keeps ONE line, the one the editor starts with its own name and a
+ * version, and nothing else from that output.
+ *
+ * ⚠️ Anchored at the start of the line and to a version straight after the
+ * word, which is what separates it from its neighbours: the launcher's banner
+ * has `Launcher` there (and is a different version), and the `Starting:` line
+ * does not start with `Spine`. A line that merely contains a version somewhere —
+ * the operating system's — is not the editor's.
+ */
+const EDITOR_VERSION_LINE = /^Spine[ \t]+\d+\.\d+\.\d+\b[^\n]*$/m;
+
+/** What step 0 prints for the editor's version: its own line, or a sentence saying it was not there. */
+function editorVersionLine(output: string): string {
+  const line = EDITOR_VERSION_LINE.exec(output);
+  return line === null ? 'editor version: not found in --version output' : line[0].trim();
+}
+
 /** The trial naming itself in its own `--version` output, or null. */
 function trialSignalFromVersion(output: string): string | null {
   const banner = TRIAL_BANNER.exec(output);
@@ -273,6 +308,61 @@ interface Ran {
   timedOut: boolean;
 }
 
+/**
+ * The indices of the lines in one stream of editor output that carry the
+ * licence holder, and nothing else (issue #1082).
+ *
+ * Measured on a licensed 4.3 editor on macOS 2026-10-02, through this tool, on
+ * four failing calls. Every one exited 1, wrote everything to stdout and nothing
+ * to stderr, and printed one of two shapes:
+ *
+ *   an input path that does not exist (import, and export) — refused by the
+ *   LAUNCHER before the editor starts, and no licence line at all:
+ *
+ *     the launcher's banner, the copyright line, the operating system
+ *     (blank)  `Parameter: --input <path>`  (blank)
+ *     `ERROR: Input path does not exist:`
+ *     the path
+ *
+ *   a file the editor cannot read (a skeleton JSON naming a parent bone it does
+ *   not declare; a `.spine` that is not a project) — the editor starts, names
+ *   itself and its licence holder, and then the failure:
+ *
+ *     the launcher's banner, the copyright line, the operating system
+ *     `Starting: Spine <x.y.z> Professional`
+ *     `Spine <x.y.z> Professional`
+ *     `Licensed to: <name> <<e-mail>>`         <- ONE line, withheld
+ *     import: `Project import: …`, `ERROR: Unable to import skeleton.`, then
+ *     export: `ERROR: Unable to export.`, then
+ *     `[error] …` lines, a stack, and `Cause: …` lines
+ *
+ * 🚨 So on a failure the block is one line, not the three `--version` prints
+ * (`Licensed to:` alone, then the name, then the e-mail — issue #1077), and
+ * the lines straight after it are the editor's own error: a rule that took
+ * "the header and the two lines after it" would have quoted the licence holder
+ * not at all and the reason for the failure not at all either.
+ *
+ * ⚠️ Both shapes are held, each by what bounds it. A header with a value on the
+ * same line is that one line. A bare header takes the two lines after it only
+ * when the second of them is an e-mail (`@`), which is the `--version` shape;
+ * anything else after a bare header is the editor talking and is quoted.
+ */
+function licenceLines(lines: readonly string[]): Set<number> {
+  const withheld = new Set<number>();
+  for (let i = 0; i < lines.length; i++) {
+    const header = /^[ \t]*Licensed to:(.*)$/.exec(lines[i]);
+    if (header === null) continue;
+    withheld.add(i);
+    if (header[1].trim() !== '') continue;
+    if (i + 2 < lines.length && lines[i + 2].includes('@')) {
+      withheld.add(i + 1);
+      withheld.add(i + 2);
+      i += 2;
+    }
+  }
+  return withheld;
+}
+
 /**
  * Everything the editor printed on a step that did not do what it was for.
  *
@@ -301,6 +391,11 @@ interface Ran {
  * softening the verdict. What it prints is the editor's own words, quoted and
  * attributed to the stream they came off, and never rewritten — a harness that
  * summarised them would be the same defect with a smaller radius.
+ *
+ * 🚨 With one exception, which is not the editor's words but the licence
+ * holder's (issue #1082): the licence line, which `licenceLines` names and
+ * which is replaced by one line saying it was withheld. Every other line is
+ * quoted as printed, in order.
  */
 function editorSaid(ran: Ran): string[] {
   const lines: string[] = [];
@@ -311,7 +406,21 @@ function editorSaid(ran: Ran): string[] {
     const body = text.replace(/\s+$/, '');
     if (body === '') continue;
     lines.push(`  the editor's ${stream}:`);
-    for (const line of body.split('\n')) lines.push(`    | ${line}`);
+    const printed = body.split('\n');
+    const withheld = licenceLines(printed);
+    for (let i = 0; i < printed.length; i++) {
+      if (!withheld.has(i)) {
+        lines.push(`    | ${printed[i]}`);
+        continue;
+      }
+      // One note per run of withheld lines, in the place they were printed, so
+      // the quotation still reads in the editor's order and the omission is
+      // stated rather than left to look like an editor that said less.
+      let span = 1;
+      while (withheld.has(i + span)) span++;
+      lines.push(`    ~ ${span} line(s) withheld here: the editor's licence block names the licence holder (issue #1082)`);
+      i += span - 1;
+    }
   }
   // Silence is a finding too, and it has to be stated rather than left to look
   // like a harness that forgot to print. The card above is what an unstated one
@@ -981,7 +1090,8 @@ function main(): void {
 
     const ver = run(opts.editor, ['--version'], 60);
     emit(`  editor   ${opts.editor}`);
-    for (const line of ver.stdout.trim().split('\n').slice(-3)) emit(`           ${line}`);
+    // One line, never the output's tail: the tail is the licensee's (issue #1077).
+    emit(`           ${editorVersionLine(`${ver.stdout}\n${ver.stderr}`)}`);
     // The second signal, and the only one that works on a platform whose trial
     // path this repository has never seen: the binary's own banner. It costs no
     // extra call — `--version` above is one the tool already made.

package/tools/plate.ts

@@ -15,7 +15,7 @@
 import { deflateSync, inflateSync } from 'node:zlib';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { drawText, textWidth } from './font5x7.ts';
-import { assertPng } from '../src/png.ts';
+import { assertPng, NotAPngError } from '../src/png.ts';
 
 export type RGBA = [number, number, number, number];
 
@@ -266,33 +266,27 @@ function toByte(sample: number, bitDepth: number): number {
   return Math.round((sample * 255) / ((1 << bitDepth) - 1));
 }
 
+/** What `decodePng` has once the stream is inflated and before a scanline is unfiltered. */
+interface InflatedPng {
+  width: number;
+  height: number;
+  bitDepth: number;
+  colourType: number;
+  channels: number;
+  pal: Uint8Array;
+  alphaTable: Uint8Array | null;
+  raw: Uint8Array;
+}
+
 /**
- * Read a PNG back into a `Plate`, expanding whatever it is to straight RGBA.
- *
- * `src/png.ts` parses 26 bytes because that is all the COMPILER needs, and it
- * stays that way: the compiler never re-measures art. This
- * decoder is for the measuring tools, which is where art measurement belongs -
- * the same division that puts `mesh.center` in the manifest as a measured number
- * rather than as something the compiler derives at build time.
- *
- * ⭐ **Every colour type the gate accepts is decodable here** (issue #226). It
- * used to read colour types 2 and 6 only, which was the compiler's own old blind
- * spot rebuilt one step later: `A19` learned in #215 that indexed and greyscale
- * art carrying a `tRNS` chunk is ordinary transparent art — ImageMagick, PNG-8
- * export, GIMP indexed, aseprite and pngquant all write it — so such a part
- * builds and validates green, and would then have been refused by the one command
- * whose whole job is to show the author what they built. A wall removed at the
- * gate and rebuilt at the picture is not a wall removed.
- *
- * So the expansion happens here, at decode: a palette index becomes its `PLTE`
- * entry with its `tRNS` alpha, a greyscale sample becomes three equal channels,
- * and a `tRNS` colour on a type 0 or 2 file becomes alpha 0 on the pixels that
- * match it. Every caller above this line keeps seeing exactly one thing, RGBA.
- *
- * Interlaced files are still refused: Adam7 is a second sample layout rather than
- * a second sample format, and no tool in the corpus writes one.
+ * The half of `decodePng` that can fail: the chunk walk, the header's own
+ * checks, the inflate of every `IDAT` concatenated, and whether what came out
+ * is as long as the header says the image is (issue #1074). Everything after
+ * it — unfiltering, expanding to RGBA — reads bytes that are there and cannot
+ * refuse, so `imageDataProblem` runs exactly this and nothing else, and is the
+ * decoder's own answer rather than a second opinion beside it.
  */
-export function decodePng(buf: Uint8Array): Plate {
+function inflatePng(buf: Uint8Array): InflatedPng {
   const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
   let at = 8;
   let width = 0;
@@ -329,6 +323,47 @@ export function decodePng(buf: Uint8Array): Plate {
   const alphaTable = trns;
 
   const raw = new Uint8Array(inflateSync(Buffer.concat(idat.map((c) => Buffer.from(c)))));
+  // A stream that inflates clean and short is as undecodable as one that does
+  // not inflate: the rows past its end would be read as zeros, a picture the
+  // file never held. Longer is accepted — the spec's decoders ignore the excess.
+  const needed = height * (Math.ceil((width * channels * bitDepth) / 8) + 1);
+  if (raw.length < needed) {
+    throw new Error(
+      `its image data inflates to ${raw.length} byte(s), where a ${width}x${height} image of colour type ` +
+        `${colourType} at bit depth ${bitDepth} needs ${needed}`,
+    );
+  }
+  return { width, height, bitDepth, colourType, channels, pal, alphaTable, raw };
+}
+
+/**
+ * Read a PNG back into a `Plate`, expanding whatever it is to straight RGBA.
+ *
+ * `src/png.ts` parses 26 bytes because that is all the COMPILER needs, and it
+ * stays that way: the compiler never re-measures art. This
+ * decoder is for the measuring tools, which is where art measurement belongs -
+ * the same division that puts `mesh.center` in the manifest as a measured number
+ * rather than as something the compiler derives at build time.
+ *
+ * ⭐ **Every colour type the gate accepts is decodable here** (issue #226). It
+ * used to read colour types 2 and 6 only, which was the compiler's own old blind
+ * spot rebuilt one step later: `A19` learned in #215 that indexed and greyscale
+ * art carrying a `tRNS` chunk is ordinary transparent art — ImageMagick, PNG-8
+ * export, GIMP indexed, aseprite and pngquant all write it — so such a part
+ * builds and validates green, and would then have been refused by the one command
+ * whose whole job is to show the author what they built. A wall removed at the
+ * gate and rebuilt at the picture is not a wall removed.
+ *
+ * So the expansion happens here, at decode: a palette index becomes its `PLTE`
+ * entry with its `tRNS` alpha, a greyscale sample becomes three equal channels,
+ * and a `tRNS` colour on a type 0 or 2 file becomes alpha 0 on the pixels that
+ * match it. Every caller above this line keeps seeing exactly one thing, RGBA.
+ *
+ * Interlaced files are still refused: Adam7 is a second sample layout rather than
+ * a second sample format, and no tool in the corpus writes one.
+ */
+export function decodePng(buf: Uint8Array): Plate {
+  const { width, height, bitDepth, colourType, channels, pal, alphaTable, raw } = inflatePng(buf);
   // The filter operates on BYTES, and its "left neighbour" is one whole pixel
   // back — rounded up to a byte, so sub-byte depths compare against the byte
   // immediately to the left.
@@ -430,6 +465,44 @@ export function readPlate(path: string): Plate {
   try {
     return decodePng(buf);
   } catch (err) {
-    throw new Error(`cannot decode PNG ${path}: ${(err as Error).message}`);
+    // The decoder's refusal as the same sentence the gate prints (issue
+    // #1074), and as the class every command already refuses by name: it was
+    // a bare Error, which `render` and `build` (through a mesh part's trace)
+    // let through as a stack.
+    throw new NotAPngError(path, undecodableSentence(path, (err as Error).message));
+  }
+}
+
+/** What a PNG whose header reads and whose image data does not decode is, as one sentence. */
+function undecodableSentence(path: string, decoder: string): string {
+  return (
+    `${path} is a PNG whose header and chunks read and whose image data cannot be decoded: the decoder stops ` +
+    `with "${decoder}", so no texel of it can be read. Re-export the file, or re-copy it whole`
+  );
+}
+
+/**
+ * Why the image data of a PNG that `pngProblem` accepts cannot be decoded, as
+ * one sentence — or `null` when it can (issue #1074).
+ *
+ * 🔒 **It is the decoder, not a check beside it**: it runs `inflatePng`, the
+ * half of `decodePng` that can refuse, and reports that refusal in the
+ * decoder's own words. `pngProblem` reads chunk headers and never inflates, so
+ * a page with an intact chunk walk over a broken compressed stream passed it,
+ * passed `A06`, and was found only by whichever reader decoded first — `A19`
+ * as `threw: cannot decode PNG …`, `render` and a mesh part's trace as a stack,
+ * and on a page `A19` does not scan (the base plate, or any page under the
+ * default profile) by nobody: such a build was written green.
+ *
+ * ⚠️ Inflate only, deliberately: measured over the 19 recipes' pages it is
+ * 68.9 ms against `validate()`'s 286.2 ms under `spine`, where a whole decode
+ * (`decodePng`, which unfilters and expands every texel) is 459.6 ms.
+ */
+export function imageDataProblem(buf: Uint8Array, path: string): string | null {
+  try {
+    inflatePng(buf);
+    return null;
+  } catch (err) {
+    return undecodableSentence(path, (err as Error).message);
   }
 }