Expose pickOpenMany on the bridge, stage selected files as one JSON result, and implement DocumentProvider::import_many so compose attachments can import several files in one picker action.
Carry the staged path and display name together from the ArkTS picker through the NAPI bridge. Keep the cache name random and only use the decoded original name as attachment metadata.
Keep the wheel axis step from cancelling the system scroll setting, validate present buffer stride and bounds before copying, and harden the PDFium source workflow with dispatch-only triggers, pinned actions and a checksum-verified SDK download.
Ship the LLVM libc++ license, document why the OpenHarmony PDFium component bundles libc++_shared.so, and record the pinned source-build compatibility patch and CI workflow.
Add compatibility entries for the annotation, catalog, font-name, page-object and text-object APIs that the pinned source no longer exports. These are not used by the preview renderer, but all dynamic bindings must resolve before the library can load.
Define FPDF_IMPLEMENTATION before the PDFium headers so FPDF_EXPORT applies default visibility; without it the compatibility functions were compiled hidden and dlsym still failed.
The compatibility translation unit uses FPDF_STRUCTELEMENT_ATTR_VALUE, which pdfium-render expects but the pinned OHOS header no longer declares. Add the opaque typedef locally.
pdfium-render 0.9.4 dynamically binds several optional struct-tree, text, font-map and page-move APIs that the pinned OHOS source no longer exports. Add a compatibility translation unit for the missing symbols so the library can load; the preview path only uses the core render APIs.
The source port exposes FPDF_GetDocPermissions with user semantics but no separate FPDF_GetDocUserPermissions symbol required by pdfium-render 0.9.4. Apply a pinned source patch that adds the compatibility entry point, and rebuild the CI artifact.
Report the underlying pdfium-render load error instead of discarding it. Component PDFium builds require libc++_shared.so; stage the matching SDK runtime beside libpdfium.so because the OHOS app namespace does not search /system/lib64 for it.
The OHOS port's default GN configuration is a component build and emits libpdfium.cr.so plus sibling .cr.so dependencies. Stage all component libraries beside a stable libpdfium.so and upload/checksum the complete set.
Add build-pdfium-source.sh for the OHOS PDFium port at a pinned source revision, using the local SDK through the port's ohos_sdk/18 path and staging a stripped libpdfium.so plus its license. Keep the checksum-pinned prebuilt as an offline fallback and package the source license when present.
fontique 0.11.1 already supports fontconfig-dlopen, which leaves an empty system collection when Fontconfig is absent. OHOS registers /system/fonts explicitly, so the local fontique copy, patch queue and quality verification are no longer needed; use the crates.io package and keep the lockfile pinned.
Cache plain text from the page's pasteboard listener and let Slint read that cache, so a cross-device pasteboard read cannot stall the Slint thread. Writes keep the cache coherent, and permission grants trigger a fresh read.
Slint reports the initial caret rectangle with InputMethodRequest::Enable, not a separate Update. Forward it too, cache cursor updates while attach/showTextInput is pending, and replay the latest rectangle after the IME becomes editable.\n\nOnly mark a rectangle as applied after updateCursor succeeds, retry transient 12800016 errors, and ignore late completions for an older caret.
Strip the staged native libraries for release builds (PDFium 62 MB -> 22 MB), package THIRD_PARTY_NOTICES.md plus the repository license texts under resources/rawfile, and document the pinned OHOS PDFium archive and its remaining reproducible-build limitation.
Pass the selected PROFILE to hvigor instead of always building debug. Default APP=demo to com.flectar.demo so it can coexist with the signed mail app; BUNDLE still overrides both.
Hold the surface gate while attaching, so a destroy callback cannot invalidate the window between the epoch check and gpu::set_surface. This closes the remaining attach race beyond queued stale events.
Catch unwinding panics on the Slint thread, log the payload, and abort instead of leaving a frozen window backed by a dead event loop. Slint's thread-local platform cannot be safely reinitialized.
Latin text that asks for sans-serif must not be rendered by a CJK face. Prefer Roboto/Noto Sans/other non-Han families for generic sans and retain Han as the final fallback.
Tag surface events with a gate epoch, invalidate it in OnSurfaceDestroyed, and ignore queued Surface/Destroyed events that cross the 500ms teardown timeout. A stale acknowledgement can no longer detach a newer surface.
A crypto error can mean the row belongs to a previous signing identity, but deleting it before verifying loses a readable secret if the overwrite fails for another reason. Query the existing value first; only remove a confirmed stale entry.
The 50 MiB constant only keeps an accidental huge selection out of the app cache; the shared core still enforces the 25 MiB total compose/draft attachment limit.
- use async fileIo open/stat/mkdir/close in both picker paths so slow content providers do not block the ArkUI thread
- add the window origin to IME updateCursor coordinates, since CursorInfo is in absolute physical screen coordinates
- subscribe the page to UIAbility.onBackground through the ability eventHub so preview resources are released on every background path, while keeping onPageHide as a fallback
- cache the latest password/type request while an IME attach or detach is in flight and replay it when the transition finishes
- chunk Asset Store secrets above its 1024-byte limit with generation-suffixed entries; publish the marker last and cover the chunked path in the self-test and unit tests
- picker: copy asynchronously, cap imports at 50 MiB, stage under a random UUID (no picked filename in the cache), and let the native side report whether a late result was accepted so the page cleans up orphaned copies
- register the native mouse callback for right-click/ContextMenuArea and reset Shift/CapsLock/auto-repeat state when the window hides or is destroyed
- register non-Latin script fallbacks for the Slint UI and the email renderer from the platform font directory
- report the system light/dark scheme through AppStorage, the NAPI bridge and SlintContext; throttle repeated IME cursor/color updates and guard overlapping IME attach calls
- expose suspendPreview for the page lifecycle so preview resources are released
- pass the focused field's InputType::Password through the show hook, use VISIBLE_PASSWORD/DONE, and detach/attach when the keyboard type changes
- subscribe sendFunctionKey and send a full Return press/release for the keyboard action key; the reported enter-key value varies by keyboard and is not a fixed code
- forward InputMethodRequest::Update's caret rectangle to the OHOS controller's updateCursor
- remove the remaining privacy bridge closures and URL interception left after the privacy UI was dropped
- request a redraw on Surface/SurfaceShown instead of only invalidating the cache, and skip drawing while the window is hidden so the request survives until it is shown
- wait for and close the acquire fence returned by RequestBuffer, and abort a rejected flush instead of leaking a dequeued buffer
- key buffer geometry to the current surface size so a resize on the same native window reconfigures the queue
- expose only the active renderer to Slint and re-associate the software renderer when the GPU attach or render falls back
- scale mouse-wheel degrees by the user scroll step, leaving touchpad pixel deltas at 1:1
Remove the bundled policy, first-launch consent screen, bridge URL interception and Settings/onboarding rows; Flectar hosts the policy at https://flectar.com/mail/privacy/. Remove the notification publisher seam and the permission request so they can be reviewed separately.
main now keys CalDAV secrets by connection id and names the legacy fixed slot AccountCaldavPassword; use Slot::key() and drop the host notification publisher assignment (the seam moves to its own PR).
Tomás Romero
springmin