//! Layout crate for the Azul GUI framework.

//!

//! Provides the layout solver (`solver3`), text shaping (`text3`), font

//! management (`font`), hit testing, page fragmentation, and widget support.

//! Integrates with `azul-core` for DOM types and `azul-css` for style

//! properties.

#![doc(

    html_logo_url = "https://raw.githubusercontent.com/maps4print/azul/master/assets/images/azul_logo_full_min.svg.png",

    html_favicon_url = "https://raw.githubusercontent.com/maps4print/azul/master/assets/images/favicon.ico"

)]

// Lint policy: deny correctness/safety issues, warn on style (`clippy::all`).

//

// Crate-wide allows are intentionally limited to lints that are either

//   (a) pervasive AND feature-sensitive — an import/binding/field that is unused

//       under one feature set is live under another, so a per-site fix would

//       break a different feature build — or

//   (b) churny / newer-toolchain lints with little value in scoping.

// Lints that fire in only a few, well-localized places are scoped with

// `#[allow(...)]` on the specific `pub mod` declarations further down, so the

// rest of the (hand-written) crate is actually checked.

#![deny(unused_must_use)]

#![warn(clippy::all)]

// Extreme-lint lockdown: all clippy groups plus opt-in rustc lints, enforced as

// -D warnings on library code by the CI clippy job. Test builds are exempt via

// cfg(not(test)) below since the set is high-noise and low-value on unit and

// generated tests; clippy::all correctness still applies to test code.

#![cfg_attr(not(test), warn(

    clippy::pedantic,

    clippy::nursery,

    clippy::cargo,

    // missing_docs,  // TODO(docs): re-enable as a dedicated final docs pass; disabled

    //                // for now so the cleanup focuses on code-quality lints, not doc debt.

    missing_debug_implementations,

    missing_copy_implementations,

    unreachable_pub,

    unused_qualifications,

    unused_lifetimes,

    unused_import_braces,

    unused_macro_rules,

    unused_crate_dependencies,

    meta_variable_misuse,

    trivial_casts,

    trivial_numeric_casts,

    elided_lifetimes_in_paths,

    single_use_lifetimes,

    variant_size_differences,

    non_ascii_idents,

    unsafe_op_in_unsafe_fn,

    let_underscore_drop,

))]

#![allow(

    // `unknown_lints` lets the two forward-compat lints below be listed even on

    // the CI toolchain (1.88), where they are not yet known, without emitting an

    // "unknown lint" warning of their own. They still apply on newer rustc.

    unknown_lints,

    mismatched_lifetime_syntaxes,          // newer rustc; fires in macro-generated code

    function_casts_as_integer,             // newer rustc; widget callback pointer identity

    // pervasive + feature-sensitive (unused under one feature, live under another):

    unused_imports,

    unused_variables,

    unused_mut,

    dead_code,

    // design lint, pervasive across the layout solver / renderer:

    clippy::too_many_arguments,

    // churny / 3rd-party, low value to scope:

    clippy::legacy_numeric_constants,

    unexpected_cfgs,                        // web-lift diagnostic cfgs

    deprecated,                             // image crate tiff encoder (only under `tiff`)

    // transitive dependency-version dups not resolvable in azul's source —

    // syn 1↔2 (proc-macro migration), heck/jni-sys/rustc-hash/rustls-webpki;

    // re-audit when the dep tree aligns.

    clippy::multiple_crate_versions,

    // ── Numeric conversion. A layout + raster engine crosses

    // px ↔ device-int ↔ float on essentially every path: a glyph's subpixel

    // origin becomes an integer scanline, a u32 pixel index becomes an i32

    // span bound, a node count becomes an f32 extent. ~150 sites, none of

    // them a defect; scoping each one buries the signal it is supposed to

    // carry. Overflow-checked builds (the dev-profile CI job) are what

    // actually catch a bad conversion here, and they do — that is how the

    // pass-2b tile-blit wrap was found.

    clippy::cast_possible_truncation,

    clippy::cast_possible_wrap,

    clippy::cast_precision_loss,

    clippy::cast_sign_loss,

    // Exact float comparison is the POINT in the cache/diff paths: "is this

    // the same value last frame computed" is a bit-identity question, and an

    // epsilon there would make the incremental path silently disagree with a

    // fresh render — the one property the equivalence laws pin.

    clippy::float_cmp,

    // `mul_add` is FUSED, so it changes f32 results. Layout output must stay

    // bit-reproducible across builds and platforms (the e2e corpus pins exact

    // frames), so the plain `a + b * c` form is deliberate.

    clippy::suboptimal_flops,

    // Geometry code is x0/x1/y0/y1, w/h, sx/sy, tx/ty — the similarity IS the

    // convention, and renaming to satisfy the lint would make it less readable.

    clippy::similar_names,

    // The solver, the rasterizer and the shaping walkers are long and branchy

    // by design: one pass, one place to read it. Splitting them threads state

    // through new signatures without making anything clearer.

    clippy::too_many_lines,

    clippy::cognitive_complexity,

    // `Default::default()` inside a struct literal whose field types are

    // obvious from the literal itself. Naming the type adds an import and a

    // line of noise per site.

    clippy::default_trait_access,

    // Four break-token builders filter a child list into a Vec and then

    // `extend` from it. Inlining the twelve-line borrow-capturing iterator

    // into each `extend` call saves one small allocation on a COLD page-break

    // path, in the code whose correctness the pagination suite exists to

    // protect. Not a trade worth making; revisit if a profile disagrees.

    clippy::needless_collect,

    // Nursery lint that wants `map_or_else` for every if-let/match. On the

    // multi-arm dispatch chains in this crate the rewrite nests closures

    // inside each other's else-branch; see the same call in azul-core.

    clippy::option_if_let_else,

    // A helper item declared next to the statements that use it, rather than

    // hoisted to the top of the function, is a deliberate locality choice.

    clippy::items_after_statements,

    // Arms that happen to share a body are frequently distinct CASES that

    // must stay separately readable (and separately editable) — merging them

    // by body is a refactor hazard, not a cleanup.

    clippy::match_same_arms,

    // By-value parameters are the C-ABI shape: generated bindings hand

    // ownership across the boundary.

    clippy::needless_pass_by_value,

    // Would force a `S: BuildHasher` parameter onto public API for no gain.

    clippy::implicit_hasher,

    // Types carrying f32 geometry cannot implement `Eq`.

    clippy::derive_partial_eq_without_eq,

    // ── Documentation prose. Deferred to the same dedicated docs pass as

    // `missing_docs` above (see the TODO there): these are shape-of-the-prose

    // lints over existing, accurate doc comments, not missing or wrong docs.

    clippy::too_long_first_doc_paragraph,

    clippy::doc_lazy_continuation,

    clippy::missing_panics_doc,

    clippy::missing_errors_doc,

)]

#[macro_use]

extern crate alloc;

extern crate core;

// Let this crate refer to itself as `azul_layout::…`. The e2e/debug-server port

// (`src/e2e/full.rs`) was written verbatim against the published crate name; the

// self-alias makes those ~80 `azul_layout::…` paths resolve without editing them.

extern crate self as azul_layout;

// Dependencies kept for downstream/feature-plumbing use but not referenced

// directly in this crate's source — marked intentionally linked so

// unused_crate_dependencies stays quiet (the lint's own suggested fix).

// `brotli-decompressor`: decompresses the codegen material_icons.ttf.br in azul-dll.

#[cfg(feature = "icons")]

use brotli_decompressor as _;

// `lru`: reserved for the slippy-map tile cache (azul-dll widgets).

use lru as _;

// `unicode-normalization` / `xmlwriter`: pulled by text_layout / xml for the

// shaping + SVG-writer paths consumed downstream.

#[cfg(feature = "text_layout")]

use unicode_normalization as _;

#[cfg(feature = "xml")]

use xmlwriter as _;

// `rustls` / `webpki-roots`: selected through ureq's `rustls-no-provider` +

// `rustls-webpki-roots` features and reached only via `ureq::tls::*`, so this

// crate never names them — but it must depend on them to pin the versions

// ureq resolves against (see the `http` feature).

#[cfg(all(feature = "http", not(target_arch = "wasm32")))]

use rustls as _;

#[cfg(all(feature = "http", not(target_arch = "wasm32")))]

use webpki_roots as _;

/// Web-lift diagnostic marker: a volatile store of `val` to the absolute wasm

/// linear-memory address `addr` (the 0x40000–0xF0000 free band the e2e harness

/// peeks via `AzStartup_peekU32`).

///

/// Compiles to NOTHING without the `web_lift`

/// feature — absolute-address stores would segfault native builds (macOS

/// `__PAGEZERO` covers the low 4 GiB). All in-tree diagnostic markers MUST go

/// through this helper rather than calling `core::ptr::write_volatile` on a

/// literal address directly.

///

/// # Safety

///

/// With the `web_lift` feature enabled, `addr` must be a valid, writable wasm

/// linear-memory address (within the 0x40000–0xF0000 diagnostic band). Without

/// the feature this is a no-op and always safe.

#[cfg(feature = "web_lift")]

#[inline]

pub unsafe fn az_mark(_addr: u32, _val: u32) {

    // Volatile isn't const-callable, so this variant is a plain (non-const) fn.

    core::ptr::write_volatile(_addr as usize as *mut u32, _val);

}

/// No-op `const` variant used when the `web_lift` feature is off.

///

/// # Safety

///

/// Always safe — this variant does nothing; the `unsafe` marker only exists to

/// keep the signature identical to the `web_lift` variant so call sites compile

/// unchanged under both features.

#[cfg(not(feature = "web_lift"))]

#[inline]

/// Read counterpart of [`az_mark`] (marker counters like `0x60758`).

/// Returns 0 without the `web_lift` feature.

///

/// # Safety

///

/// With the `web_lift` feature enabled, `addr` must be a valid, readable wasm

/// linear-memory address (within the 0x40000–0xF0000 diagnostic band). Without

/// the feature this is a no-op that returns 0 and is always safe.

#[cfg(feature = "web_lift")]

#[inline]

#[must_use] pub unsafe fn az_mark_read(_addr: u32) -> u32 {

    // Volatile isn't const-callable, so this variant is a plain (non-const) fn.

    core::ptr::read_volatile(_addr as usize as *const u32)

}

/// No-op `const` variant (returns 0) used when the `web_lift` feature is off.

///

/// # Safety

///

/// Always safe — returns 0 and touches nothing; the `unsafe` marker only exists

/// to keep the signature identical to the `web_lift` variant.

#[cfg(not(feature = "web_lift"))]

#[inline]

/// Font traits available regardless of text layout feature.

pub mod font_traits;

pub mod resource_handles;

/// Optional probe instrumentation. With the `probe` feature off this

/// is a tiny module of no-op stubs and pays zero cost.

pub mod probe;

/// Opt-in telemetry client: consent tiers, OTLP/HTTP JSON encoding, a

/// disk-backed ping queue and an uploader. Requires the `telemetry`

/// feature (std-only); collection stays *off* at runtime until a consent

/// tier is configured, so linking it in does not by itself send anything.

#[cfg(feature = "telemetry")]

// Scoped allows, per the crate lint policy above:

//   * the submodule names (`config`, `metrics`) are the public API grouping,

//     while the types are re-exported at `telemetry::*` where the `Telemetry`

//     prefix is what disambiguates them from every other `Config` in the tree;

//   * the registry and the config cell are global-by-design, so their guards

//     are held across the whole read/modify they protect — tightening the

//     drop would split an atomic update in half;

//   * `missing_const_for_fn` fires on accessors that read a `static` today and

//     will read more tomorrow; making them `const` is not a promise this API

//     wants to keep.

#[allow(

    clippy::module_name_repetitions,

    clippy::significant_drop_tightening,

    clippy::missing_const_for_fn

)]

pub mod telemetry;

/// Version checking + update policy (Phase 4): manifest source, install-kind

/// backstops (package-managed binaries never self-update), anti-downgrade,

/// cooldown/suspend state. Requires the `updater` feature.

#[cfg(feature = "updater")]

pub mod updater;

/// Process-wide `AppConfig` snapshot (app name/version, update manifest,

/// changelog + support-mailbox URLs) published by `App::run`, read by the

/// updater and the system dialogs.

#[cfg(feature = "std")]

pub mod appenv;

/// Built-in system dialogs (`SysDialogType`): report-a-problem, update

/// checker with Markdown changelog, crash reporter. ALWAYS CPU-rendered.

#[cfg(all(feature = "std", feature = "widgets", feature = "text_layout"))]

pub mod dialogs;

/// The ACTION JOURNAL: a bounded breadcrumb trail of dispatched callbacks,

/// for problem reports and crash dumps. Off until enabled.

#[cfg(feature = "std")]

pub mod journal;

/// Image decoding and encoding (wraps the `image` crate).

#[cfg(feature = "image_decoding")]

pub mod image;

/// Scroll, hover, clipboard, cursor, and focus managers.

#[cfg(feature = "text_layout")]

// Scoped (was crate-wide): internal manager types exposed for tests.

#[allow(private_interfaces)]

pub mod managers;

/// CSS layout solver: block, inline, flex, grid, and table formatting.

#[cfg(feature = "text_layout")]

// Scoped (was crate-wide): solver internals — intentional `drop(&_)` scope

// markers, internal types exposed for tests, incremental-relayout assignments,

// generated/parenthesized property code, and exhaustive generated matches.

#[allow(

    dropping_references,

    private_interfaces,

    unreachable_patterns,

    unused_parens,

    unused_doc_comments,

    unused_assignments

)]

pub mod solver3;

/// C-compatible string formatting via `strfmt`.

#[cfg(feature = "strfmt")]

pub mod fmt;

#[cfg(feature = "strfmt")]

pub use fmt::{FmtArg, FmtArgVec, FmtArgVecDestructor, FmtValue, fmt_string};

/// Built-in widgets: button, text input, tabs, tree view, node graph, etc.

#[cfg(feature = "widgets")]

// Scoped (was crate-wide): incremental widget-state assignments and the

// node_graph extern "C" fn that returns `()`.

#[allow(unused_assignments, improper_ctypes_definitions)]

pub mod widgets;

/// Desktop platform helpers (file dialogs, notifications).

#[cfg(feature = "extra")]

pub mod desktop;

/// ICU internationalization: date/time formatting, plurals, list formatting.

#[cfg(any(

    feature = "icu",

    all(target_os = "macos", feature = "icu_macos"),

    all(target_os = "windows", feature = "icu_windows"),

))]

pub mod icu;

#[cfg(any(

    feature = "icu",

    all(target_os = "macos", feature = "icu_macos"),

    all(target_os = "windows", feature = "icu_windows"),

))]

pub use icu::{

    DateTimeFieldSet, FormatLength, IcuDate, IcuDateTime, IcuError,

    IcuLocalizer, IcuLocalizerHandle, IcuResult, IcuStringVec, IcuTime,

    LayoutCallbackInfoIcuExt, ListType, PluralCategory,

};

/// Project Fluent localization: message bundles, argument formatting, ZIP I/O.

#[cfg(feature = "fluent")]

pub mod fluent;

#[cfg(feature = "fluent")]

pub use fluent::{

    check_fluent_syntax, check_fluent_syntax_bytes, create_fluent_zip,

    create_fluent_zip_from_strings, export_to_zip, FluentError,

    FluentLanguageInfo, FluentLanguageInfoVec, FluentLoadError, FluentLoadErrorVec,

    FluentLocalizerHandle, FluentSyntaxCheckResult,

    FluentZipLoadResult,

};

/// URL parsing (RFC 3986 compliant). Pure-Rust, always present (no TLS deps).

/// URL types live in `azul_core::url`; re-exported so `azul_layout::url::*`

/// keeps resolving. `Url::parse`/`join` are enabled via the `http` feature

/// (which turns on `azul-core/url`).

pub use azul_core::url;

pub use azul_core::url::{Url, UrlParseError, ResultUrlUrlParseError};

/// File system operations (C-compatible wrappers for `std::fs`).

// Scoped (was crate-wide): `///` doc comments before `impl_vec!`/`impl_option!`

// macro invocations, and an infallible inherent `FilePath::from_str` (returns

// `Self`, so it cannot implement the fallible `FromStr` trait).

#[allow(unused_doc_comments, clippy::should_implement_trait)]

pub mod file;

pub use file::{

    dir_create, dir_create_all, dir_list, dir_delete, dir_delete_all,

    file_append, file_copy, path_exists, file_metadata, file_read, file_read_string,

    file_delete, file_rename, file_write, file_write_string,

    path_canonicalize, path_extension, path_file_name, path_is_dir, path_is_file,

    path_join, path_parent, temp_dir,

    DirEntry, DirEntryVec, DirEntryVecDestructor, DirEntryVecDestructorType,

    FileError, FileErrorKind, FileMetadata, FilePath, OptionFilePath,

};

/// HTTP client: GET/POST requests with pure-Rust TLS.

///

/// API surface always present (stub when off); ureq/rustls only pulled in with `http`.

pub mod http;

pub use http::{

    download_bytes, download_bytes_with_config, http_get,

    http_get_with_config, http_post, http_post_with_config, http_put_with_config,

    http_request_with_config, is_url_reachable, HttpError, HttpHeader,

    HttpMethod, HttpRequestConfig, HttpResponse, HttpResponseTooLargeError,

    HttpResult, HttpStatusError,

};

/// JSON parsing and serialization for the C API.

#[cfg(feature = "json")]

pub mod json;

#[cfg(feature = "json")]

pub use json::{

    json_parse, json_stringify,

    Json, JsonInternal, JsonKeyValue, JsonKeyValueVec, JsonKeyValueVecDestructor, JsonKeyValueVecDestructorType,

    JsonParseError, JsonType, JsonVec,

    ResultJsonJsonParseError, OptionJson, OptionJsonVec, OptionJsonKeyValueVec,

};

/// ZIP file creation, extraction, and listing.

#[cfg(feature = "zip")]

pub mod zip;

#[cfg(feature = "zip")]

pub use zip::{

    zip_create, zip_create_from_files, zip_extract_all, zip_list_contents,

    ZipFile, ZipFileEntry, ZipFileEntryVec, ZipPathEntry, ZipPathEntryVec,

    ZipReadConfig, ZipWriteConfig, ZipReadError, ZipWriteError,

};

/// Icon provider: resolves icons from Material Icons font, images, or ZIP packs.

pub mod icon;

pub use icon::{

    // Resolver

    default_icon_resolver,

    // Data types for RefAny

    ImageIconData, FontIconData,

    // Helpers

    register_image_icon,

    register_font_icon,

    register_icons_from_zip,

    create_default_icon_provider,

    register_material_icons,

    register_embedded_material_icons,

};

// Re-export core icon types

pub use azul_core::icon::{

    IconProviderHandle, IconResolverCallbackType,

    resolve_icons_in_styled_dom, OptionIconProviderHandle,

};

/// Callback handling for layout events (invocation, result processing).

#[cfg(feature = "text_layout")]

pub mod callbacks;

/// CPU-based software rendering (no GPU required).

#[cfg(feature = "cpurender")]

// Scoped (was crate-wide): complex rasterizer signatures.

#[allow(clippy::type_complexity)]

pub mod cpurender;

/// Glyph path and cell cache for CPU text rendering.

#[cfg(feature = "cpurender")]

pub mod glyph_cache;

/// Default keyboard actions (copy, paste, select-all, undo, etc.).

#[cfg(feature = "text_layout")]

pub mod default_actions;

/// Post-layout developer warnings for raw text nodes used without a

/// containing block (azul does not auto-wrap them the way browsers do).

///

/// Reads computed display through `solver3::getters`, so it exists only

/// where the layout solver does — same gate as `window` and

/// `default_actions`, its only caller being inside `window`.

#[cfg(feature = "text_layout")]

pub mod dom_lint;

/// Apply structural `DocumentOperation`s to a plain XML tree.

///

/// The Path-2 helper for apps without their own document model (the PDF

/// editor).

#[cfg(all(feature = "text_layout", feature = "xml"))]

pub mod document_edit;

/// Event determination: maps raw input to DOM node callbacks.

#[cfg(feature = "text_layout")]

pub mod event_determination;

/// Font parsing, metrics extraction, and subsetting.

#[cfg(feature = "text_layout")]

// Scoped (was crate-wide): complex font-table signatures.

#[allow(clippy::type_complexity)]

pub mod font;

/// Headless backend for CPU-only rendering without a display server.

///

/// Used with `AZUL_HEADLESS=1` for E2E testing, CI, and screenshot capture.

#[cfg(feature = "text_layout")]

pub mod headless;

// Re-export allsorts types needed by printpdf

#[cfg(feature = "text_layout")]

pub use allsorts::subset::CmapTarget;

#[cfg(feature = "text_layout")]

pub use font::parsed::{

    FontParseWarning, FontParseWarningSeverity, FontType, OwnedGlyph, ParsedFont, PdfFontMetrics,

    SubsetFont,

};

// Re-export hyphenation for external crates (like printpdf)

#[cfg(feature = "text_layout_hyphenation")]

pub use hyphenation;

/// Hit-testing: maps screen coordinates to DOM nodes.

#[cfg(feature = "text_layout")]

pub mod hit_test;

/// Paged media: the `FragmentationContext` (continuous vs. paged) and page margins.

/// The primitive types live in `azul_core::paged`; re-exported here so existing

/// `azul_layout::paged::*` / `crate::paged::*` paths keep resolving.

pub use azul_core::paged;

/// Text shaping, line breaking (Knuth-Plass), and inline formatting.

#[cfg(feature = "text_layout")]

// Scoped (was crate-wide): internal types exposed for tests, a labelled

// shaping loop, and complex shaping/cache signatures.

#[allow(private_interfaces, unused_labels, clippy::type_complexity)]

pub mod text3;

/// Thread callback wrappers for the C API.

#[cfg(feature = "text_layout")]

pub mod thread;

/// Timer callback wrappers for the C API.

#[cfg(feature = "text_layout")]

// Scoped (was crate-wide): hand-written `Ord`/`PartialOrd` on a timer type.

#[allow(clippy::non_canonical_partial_ord_impl)]

pub mod timer;

/// Scroll physics timer for momentum-based smooth scrolling.

#[cfg(feature = "text_layout")]

pub mod scroll_timer;

/// Content overlay + journal for quickly-mutable content.

///

/// The single write chokepoint and overlay→DOM read order (images now,

/// text/structural next).

#[cfg(feature = "text_layout")]

pub mod overlay;

/// Window layout management: relayout, event processing, state sync.

#[cfg(feature = "text_layout")]

// Scoped (was crate-wide): parenthesized layout expressions.

#[allow(unused_parens)]

pub mod window;

/// Window state types (keyboard, mouse, DPI, focus).

#[cfg(feature = "text_layout")]

pub mod window_state;

/// XML and XHTML parsing for declarative UI definitions.

#[cfg(feature = "xml")]

// Scoped (was crate-wide): incremental parser-state assignments.

#[allow(unused_assignments)]

pub mod xml;

/// Debug / E2E server op-dispatch, ported verbatim from the DLL. Gated behind

/// the `e2e-server` feature (NOT in `default`), so the lean crate is unaffected.

#[cfg(feature = "e2e-server")]

pub mod e2e;

// Export the main layout function and window management

/// Canonical paged-media page margins (defined in [`paged`]).

pub use paged::PageMargins;

#[cfg(feature = "text_layout")]

pub use hit_test::{CursorTypeHitTest, FullHitTest};

#[cfg(feature = "text_layout")]

pub use solver3::cache::LayoutCache as Solver3LayoutCache;

#[cfg(feature = "text_layout")]

pub use solver3::display_list::DisplayList as DisplayList3;

#[cfg(feature = "text_layout")]

pub use solver3::layout_document;

#[cfg(feature = "text_layout")]

pub use solver3::paged_layout::layout_document_paged;

/// The analysis-returning paged entries + the precalculation-only path

/// (document editors: page count / page-of-node WITHOUT materializing pages).

#[cfg(feature = "text_layout")]

pub use solver3::paged_layout::{

    compute_document_pagination, layout_document_paged_v2, pagination_to_dom_breaks,

    spine_path_at_y, BreaksDelta, PagedLayoutResult, PaginationSession, StructuralBreak,

};

/// Standalone page-break analysis (typed breaks, spans, policy, lazy pages).

#[cfg(feature = "text_layout")]

pub use solver3::{

    display_list::paginate_single_page,

    page_breaks::{

        compute_page_breaks, compute_page_breaks_from_display_list,

        compute_page_breaks_with_report, compute_page_breaks_with_sequence,

        page_of_y, page_spans, recompute_page_breaks_from, BreakKind,

        BreakPolicy, MonolithReason, MonolithWarning, PageBreakPosition,

        PageBreakInput, PageConstraints, PaginationInfo,

    },

    pagination::{PageSequence, PageSetup},

};

#[cfg(feature = "text_layout")]

pub use solver3::{LayoutContext, LayoutError, Result as LayoutResult3};

#[cfg(feature = "text_layout")]

pub use text3::cache::{FontContext, FontManager, TextShapingCache};

/// Backwards-compat alias for the old `TextLayoutCache` name.

/// Will be dropped at the next API revision; new code should use

/// [`TextShapingCache`] directly.

#[cfg(feature = "text_layout")]

pub use text3::cache::TextShapingCache as TextLayoutCache;

#[cfg(feature = "font_async_registry")]

pub use rust_fontconfig::registry::FcFontRegistry;

#[cfg(feature = "text_layout")]

pub use window::{CursorBlinkTimerAction, LayoutWindow, ScrollbarDragState, TooltipTimerAction};

#[cfg(feature = "text_layout")]

pub use managers::text_input::{PendingTextEdit, OptionPendingTextEdit};

#[cfg(feature = "text_layout")]

/// Parses raw font bytes into a [`FontRef`](azul_css::props::basic::FontRef)

/// suitable for use in the layout system.

// signature must match the `ParseFontFn = fn(LoadedFontSource) -> ...` callback type

// (core/src/resources.rs) and the api.json export, so the owned param cannot become &.

#[allow(clippy::needless_pass_by_value)]

    use crate::font::parsed::ParsedFont;

    )

#[cfg(feature = "text_layout")]

/// Wraps a [`ParsedFont`] in a [`FontRef`](azul_css::props::basic::FontRef),

/// transferring ownership to the returned handle.

    use core::ffi::c_void;

#[cfg(feature = "text_layout")]

/// Recovers a reference to the [`ParsedFont`] stored inside a [`FontRef`](azul_css::props::basic::FontRef).

///

/// # Safety contract

/// The `font_ref` must have been created by [`parsed_font_to_font_ref`],

/// so that `font_ref.parsed` points to a valid `ParsedFont`.

    // SAFETY: `font_ref.parsed` was created by `parsed_font_to_font_ref`

    // via `Box::into_raw`, so it points to a valid, aligned `ParsedFont`.

#[cfg(test)]

mod autotest_generated {

    //! Adversarial unit tests generated by the autotest fleet.

    //!

    //! Covers the four items defined directly in `lib.rs`:

    //!   * `az_mark` / `az_mark_read` — the web-lift diagnostic markers. Only the

    //!     `#[cfg(not(feature = "web_lift"))]` (no-op `const`) variants are

    //!     exercised: the `web_lift` variants store to *absolute* addresses and

    //!     would segfault a native test binary, so they are deliberately untested

    //!     here (the doc comment says as much).

    //!   * `parse_font_fn` — raw bytes → `Option<FontRef>`.

    //!   * `parsed_font_to_font_ref` / `font_ref_to_parsed_font` — the

    //!     `Box::into_raw` / reborrow round-trip, plus the refcounted

    //!     clone/drop contract of the `FontRef` handle those two produce.

    use super::*;

    // ---------------------------------------------------------------

    // az_mark / az_mark_read  (numeric — no-op variants)

    // ---------------------------------------------------------------

    /// Without `web_lift` the read is documented to return 0 for *every* address,

    /// including the ends of the u32 range and the 0x40000–0xF0000 diagnostic band.

    /// A non-zero answer here would mean the native build is really dereferencing

    /// an absolute address.

    #[cfg(not(feature = "web_lift"))]

    #[test]

    fn az_mark_read_is_zero_for_every_boundary_address() {

        let addresses = [

            0u32,

            1,

            0x3_FFFF,          // one below the diagnostic band

            0x4_0000,          // band start

            0x6_0758,          // a real marker counter from the docs

            0xF_0000,          // band end

            0xF_0001,          // one past the band

            i32::MIN as u32,   // "negative" input, reinterpreted

            (-1i32) as u32,    // == u32::MAX

            u32::MAX - 1,

            u32::MAX,

            u32::MAX.wrapping_add(1), // wraps to 0, must not panic

        ];

        for addr in addresses {

            assert_eq!(unsafe { az_mark_read(addr) }, 0, "az_mark_read(0x{addr:x})");

        }

    }

    /// Sweep the whole u32 address space at a coarse stride: no address may panic

    /// or return anything but 0.

    #[cfg(not(feature = "web_lift"))]

    #[test]

    fn az_mark_read_sweeps_the_whole_address_space_as_zero() {

        for addr in (0u32..=u32::MAX).step_by(1 << 24) {

            assert_eq!(unsafe { az_mark_read(addr) }, 0);

        }

    }

    /// A write must remain unobservable (the no-op variant stores nothing), for

    /// every combination of boundary address and boundary value.

    #[cfg(not(feature = "web_lift"))]

    #[test]

    fn az_mark_writes_are_unobservable_without_web_lift() {

        let addresses = [0u32, 0x4_0000, 0x6_0758, 0xF_0000, u32::MAX];

        let values = [0u32, 1, u32::MAX / 2, u32::MAX - 1, u32::MAX, i32::MIN as u32];

        for addr in addresses {

            for val in values {

                unsafe { az_mark(addr, val) };

                assert_eq!(

                    unsafe { az_mark_read(addr) },

                    0,

                    "az_mark(0x{addr:x}, {val}) must not be observable"

                );

            }

        }

        // Repeating a write is still a no-op (idempotent, no accumulating state).

        for _ in 0..1_000 {

            unsafe { az_mark(0x6_0758, u32::MAX) };

        }

        assert_eq!(unsafe { az_mark_read(0x6_0758) }, 0);

    }

    /// Both no-op variants are `const fn`; this fails to *compile* if that ever

    /// regresses (the `web_lift` variants are non-const on purpose, so this test

    /// is gated off there).

    #[cfg(not(feature = "web_lift"))]

    #[test]

    fn az_mark_no_op_variants_are_const_evaluable() {

        const _WRITE_MIN: () = unsafe { az_mark(0, 0) };

        const _WRITE_MAX: () = unsafe { az_mark(u32::MAX, u32::MAX) };

        const READ_ZERO: u32 = unsafe { az_mark_read(0) };

        const READ_MAX: u32 = unsafe { az_mark_read(u32::MAX) };

        assert_eq!(READ_ZERO, 0);

        assert_eq!(READ_MAX, 0);

    }

    // ---------------------------------------------------------------

    // Shared font fixtures (text_layout only)

    // ---------------------------------------------------------------

    /// Positive control: the built-in `Azul Mock Mono` font (96 glyphs, upem 1000).

    #[cfg(feature = "text_layout")]

    const MOCK_MONO: &[u8] = text3::mock_fonts::MOCK_MONO_TTF;

    #[cfg(feature = "text_layout")]

    fn loaded_source(bytes: Vec<u8>, index: u32) -> azul_core::resources::LoadedFontSource {

        azul_core::resources::LoadedFontSource {

            data: azul_css::U8Vec::from_vec(bytes),

            index,

            load_outlines: true,

        }

    }

    #[cfg(feature = "text_layout")]

    fn parse_mock() -> ParsedFont {

        ParsedFont::from_bytes(MOCK_MONO, 0, &mut Vec::new())

            .expect("Azul Mock Mono must parse (positive control)")

    }

    // ---------------------------------------------------------------

    // parse_font_fn  (parser)

    // ---------------------------------------------------------------

    /// Malformed / hostile byte soup must come back as `None`, never a panic and

    /// never a bogus `FontRef` (which would later be dereferenced as a `ParsedFont`).

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_rejects_malformed_input() {

        let cases: Vec<(&str, Vec<u8>)> = vec![

            ("empty", Vec::new()),

            ("single_nul", vec![0u8]),

            ("whitespace_only", b"   \t\n".to_vec()),

            ("garbage", (0u8..=255).cycle().take(4096).collect()),

            ("invalid_utf8", vec![0xFF, 0xFE, 0x00]),

            ("sfnt_magic_only", vec![0x00, 0x01, 0x00, 0x00]),

            ("header_only", MOCK_MONO[..12].to_vec()),

            ("truncated_font", MOCK_MONO[..64].to_vec()),

            ("half_a_font", MOCK_MONO[..MOCK_MONO.len() / 2].to_vec()),

            ("unicode_emoji", "\u{1F600}\u{1F600}".repeat(1_000).into_bytes()),

            ("combining_marks", "e\u{0301}".repeat(10_000).into_bytes()),

            ("nested_brackets", vec![b'['; 10_000]),

            ("boundary_numbers", b"0 -0 9223372036854775807 NaN inf -inf 1e309".to_vec()),

            ("leading_junk_then_font", {

                let mut v = b"garbage".to_vec();

                v.extend_from_slice(MOCK_MONO);

                v

            }),

        ];

        for (name, bytes) in cases {

            assert!(

                parse_font_fn(loaded_source(bytes, 0)).is_none(),

                "{name} must not parse into a FontRef"

            );

        }

    }

    /// Multi-megabyte junk: must terminate quickly and return `None`, not hang or

    /// allocate its way out of memory (the sfnt table directory is attacker-controlled).

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_survives_extremely_long_input() {

        assert!(parse_font_fn(loaded_source(vec![0u8; 1_000_000], 0)).is_none());

        assert!(parse_font_fn(loaded_source(vec![b'a'; 1_000_000], 0)).is_none());

        // "ttcf" collection magic followed by a megabyte of junk offsets.

        let mut ttcf = b"ttcf".to_vec();

        ttcf.extend_from_slice(&vec![0xABu8; 1_000_000]);

        assert!(parse_font_fn(loaded_source(ttcf, 0)).is_none());

    }

    /// Positive control: a real font parses, and the handle we get back really does

    /// point at the parsed face (this is the only sanctioned way to build the

    /// `FontRef` that `font_ref_to_parsed_font` is allowed to reborrow).

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_parses_the_positive_control() {

        let font_ref = parse_font_fn(loaded_source(MOCK_MONO.to_vec(), 0))

            .expect("the positive control must parse");

        let parsed = font_ref_to_parsed_font(&font_ref);

        assert_eq!(parsed.num_glyphs(), 96);

        assert_eq!(parsed.num_glyphs(), parsed.maxp_table.num_glyphs);

        assert_eq!(parsed.font_metrics.units_per_em, 1000);

        assert!(parsed.font_metrics.ascent > 0.0);

        assert!(parsed.font_metrics.descent <= 0.0);

        assert!(parsed.font_metrics.ascent.is_finite());

        assert!(parsed.font_metrics.descent.is_finite());

        assert!(parsed.font_metrics.line_gap.is_finite());

        assert_eq!(parsed.font_type, FontType::TrueType);

        assert_eq!(parsed.original_index, 0);

        assert!(parsed.cmap_subtable.is_some());

        assert_eq!(parsed.hash, parse_mock().hash);

    }

    /// `load_outlines` is not consulted by `parse_font_fn` (only `data` + `index`

    /// are). Both settings must therefore yield the same face — if this ever

    /// diverges, callers that flip the flag silently get a different font.

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_ignores_the_load_outlines_flag() {

        let with = azul_core::resources::LoadedFontSource {

            data: azul_css::U8Vec::from_vec(MOCK_MONO.to_vec()),

            index: 0,

            load_outlines: true,

        };

        let without = azul_core::resources::LoadedFontSource {

            data: azul_css::U8Vec::from_vec(MOCK_MONO.to_vec()),

            index: 0,

            load_outlines: false,

        };

        let a = parse_font_fn(with).expect("parses with outlines");

        let b = parse_font_fn(without).expect("parses without outlines");

        let (pa, pb) = (font_ref_to_parsed_font(&a), font_ref_to_parsed_font(&b));

        assert_eq!(pa.hash, pb.hash);

        assert_eq!(pa.num_glyphs(), pb.num_glyphs());

        assert_eq!(pa.pdf_font_metrics, pb.pdf_font_metrics);

    }

    /// `index` is cast `u32 as usize` and fed to the table provider. Out-of-range

    /// face indices on a single-face font must be deterministic — no panic, no

    /// `12 + index * 4` overflow, and no face with a different glyph count.

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_with_an_out_of_range_index_is_deterministic() {

        let baseline = parse_mock();

        for index in [1u32, 2, 0x7FFF_FFFF, u32::MAX - 1, u32::MAX] {

            if let Some(font_ref) = parse_font_fn(loaded_source(MOCK_MONO.to_vec(), index)) {

                let parsed = font_ref_to_parsed_font(&font_ref);

                assert_eq!(

                    parsed.num_glyphs(),

                    baseline.num_glyphs(),

                    "index {index} must not conjure a different face"

                );

                assert_eq!(parsed.original_index, index as usize);

            }

        }

    }

    /// Empty / garbage input on the failing path must not leak or corrupt state

    /// across repeated calls (the destructor is only installed on the `Some` path).

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_failure_path_is_repeatable() {

        for _ in 0..200 {

            assert!(parse_font_fn(loaded_source(Vec::new(), 0)).is_none());

            assert!(parse_font_fn(loaded_source(vec![0xFF; 3], u32::MAX)).is_none());

        }

        // …and a good parse still works afterwards.

        assert!(parse_font_fn(loaded_source(MOCK_MONO.to_vec(), 0)).is_some());

    }

    /// Every successful parse mints a *fresh* identity, even for byte-identical

    /// input: `FontRef` equality is the never-reused `id`, not the heap pointer

    /// (freeing a font and reusing its address must not forge identity).

    #[cfg(feature = "text_layout")]

    #[test]

    fn parse_font_fn_mints_a_fresh_identity_per_call() {

        let a = parse_font_fn(loaded_source(MOCK_MONO.to_vec(), 0)).expect("parses");

        let b = parse_font_fn(loaded_source(MOCK_MONO.to_vec(), 0)).expect("parses");

        assert_ne!(a, b, "two parses of the same bytes are two distinct handles");

        assert_ne!(a.id, b.id);

        assert!(b > a, "ids are monotonically assigned");

        // …but the *content* is identical.

        assert_eq!(

            font_ref_to_parsed_font(&a).hash,

            font_ref_to_parsed_font(&b).hash

        );

    }

    // ---------------------------------------------------------------

    // parsed_font_to_font_ref / font_ref_to_parsed_font  (round-trip)

    // ---------------------------------------------------------------

    /// encode == decode: wrapping a `ParsedFont` and reborrowing it must hand back

    /// the very same face, field for field.

    #[cfg(feature = "text_layout")]

    #[test]

    fn parsed_font_font_ref_round_trip_preserves_the_face() {

        let original = parse_mock();

        let expected_hash = original.hash;

        let expected_glyphs = original.num_glyphs();

        let expected_metrics = original.pdf_font_metrics;

        let expected_upem = original.font_metrics.units_per_em;

        let expected_ascent = original.font_metrics.ascent;

        let expected_type = original.font_type.clone();

        let expected_index = original.original_index;

        let font_ref = parsed_font_to_font_ref(original);

        let decoded = font_ref_to_parsed_font(&font_ref);

        assert_eq!(decoded.hash, expected_hash);

        assert_eq!(decoded.num_glyphs(), expected_glyphs);

        assert_eq!(decoded.pdf_font_metrics, expected_metrics);

        assert_eq!(decoded.font_metrics.units_per_em, expected_upem);

        assert!((decoded.font_metrics.ascent - expected_ascent).abs() < f32::EPSILON);

        assert_eq!(decoded.font_type, expected_type);

        assert_eq!(decoded.original_index, expected_index);

    }

    /// The freshly-minted handle's invariants: live pointer, refcount of exactly 1,

    /// destructor armed, non-zero id (id 0 flags a raw-reconstructed handle).

    #[cfg(feature = "text_layout")]

    #[test]

    fn parsed_font_to_font_ref_handle_invariants() {

        use core::sync::atomic::Ordering as AtomicOrdering;

        let font_ref = parsed_font_to_font_ref(parse_mock());

        assert!(!font_ref.parsed.is_null());

        assert!(!font_ref.copies.is_null());

        assert!(font_ref.run_destructor);

        assert_ne!(font_ref.id, 0, "id 0 is reserved for un-initialised handles");

        assert_eq!(unsafe { (*font_ref.copies).load(AtomicOrdering::SeqCst) }, 1);

        assert_eq!(font_ref.get_parsed(), font_ref.parsed);

    }

    /// `font_ref_to_parsed_font` is a pure reborrow: repeated calls must yield the

    /// same address, and that address must be the handle's `parsed` pointer.

    #[cfg(feature = "text_layout")]

    #[test]

    fn font_ref_to_parsed_font_is_a_stable_reborrow() {

        use core::ffi::c_void;

        let font_ref = parsed_font_to_font_ref(parse_mock());

        let first: *const ParsedFont = font_ref_to_parsed_font(&font_ref);

        let second: *const ParsedFont = font_ref_to_parsed_font(&font_ref);

        assert!(core::ptr::eq(first, second), "reborrow must be stable");

        assert!(core::ptr::eq(first.cast::<c_void>(), font_ref.get_parsed()));

    }

    /// A clone shares the face (same pointer, same id) and bumps the refcount;

    /// dropping the clone must NOT free the face out from under the original.

    /// Reading through the survivor after the drop is the use-after-free probe.

    #[cfg(feature = "text_layout")]

    #[test]

    fn cloning_a_font_ref_shares_the_face_and_the_drop_is_refcounted() {

        use core::sync::atomic::Ordering as AtomicOrdering;

        let original = parsed_font_to_font_ref(parse_mock());

        let expected_hash = font_ref_to_parsed_font(&original).hash;

        let clone = original.clone();

        assert_eq!(clone.id, original.id, "a clone is the same font");

        assert_eq!(clone, original);

        assert!(core::ptr::eq(clone.parsed, original.parsed));

        assert_eq!(unsafe { (*original.copies).load(AtomicOrdering::SeqCst) }, 2);

        drop(clone);

        assert_eq!(unsafe { (*original.copies).load(AtomicOrdering::SeqCst) }, 1);

        assert_eq!(

            font_ref_to_parsed_font(&original).hash,

            expected_hash,

            "the face must survive its clone being dropped"

        );

        assert_eq!(font_ref_to_parsed_font(&original).num_glyphs(), 96);

    }

    /// Hammer the refcount: 1_000 clone/drop cycles (plus a batch held live at once)

    /// must leave the face readable and the count back at 1 — a double-decrement

    /// would free the `ParsedFont` early and turn the next reborrow into a UAF.

    #[cfg(feature = "text_layout")]

    #[test]

    fn font_ref_clone_drop_cycles_do_not_double_free() {

        use core::sync::atomic::Ordering as AtomicOrdering;

        let original = parsed_font_to_font_ref(parse_mock());

        let expected_hash = font_ref_to_parsed_font(&original).hash;

        for _ in 0..1_000 {

            let c = original.clone();

            assert_eq!(font_ref_to_parsed_font(&c).hash, expected_hash);

        }

        let batch: Vec<_> = (0..1_000).map(|_| original.clone()).collect();

        assert_eq!(

            unsafe { (*original.copies).load(AtomicOrdering::SeqCst) },

            1_001

        );

        drop(batch);

        assert_eq!(unsafe { (*original.copies).load(AtomicOrdering::SeqCst) }, 1);

        assert_eq!(font_ref_to_parsed_font(&original).hash, expected_hash);

    }

    /// Identity semantics as a hash/ordering key: clones collapse, independently

    /// wrapped faces don't — even when they hold byte-identical font data.

    #[cfg(feature = "text_layout")]

    #[test]

    fn font_ref_identity_is_per_handle_not_per_content() {

        use std::collections::{BTreeSet, HashSet};

        let a = parsed_font_to_font_ref(parse_mock());

        let b = parsed_font_to_font_ref(parse_mock());

        assert_ne!(a, b);

        assert!(a < b, "ids are monotonically assigned, so a precedes b");

        assert_eq!(

            font_ref_to_parsed_font(&a).hash,

            font_ref_to_parsed_font(&b).hash,

            "…even though the content hash is the same"

        );

        let set: HashSet<_> = vec![a.clone(), a.clone(), a.clone(), b.clone()]

            .into_iter()

            .collect();

        assert_eq!(set.len(), 2, "clones dedup, distinct handles do not");

        let ordered: BTreeSet<_> = vec![b.clone(), a.clone(), b.clone()].into_iter().collect();

        assert_eq!(ordered.len(), 2);

        assert_eq!(ordered.iter().next(), Some(&a));

    }

    /// Wrapping many faces in a row must keep every handle pointing at its *own*

    /// face — a shared/stale `Box::into_raw` would make them alias.

    #[cfg(feature = "text_layout")]

    #[test]

    fn many_font_refs_do_not_alias_each_other() {

        let refs: Vec<_> = (0..16).map(|_| parsed_font_to_font_ref(parse_mock())).collect();

        for (i, a) in refs.iter().enumerate() {

            assert_eq!(font_ref_to_parsed_font(a).num_glyphs(), 96);

            for b in refs.iter().skip(i + 1) {

                assert!(

                    !core::ptr::eq(a.parsed, b.parsed),

                    "independently boxed faces must not share a pointer"

                );

                assert_ne!(a.id, b.id);

            }

        }

    }

}