svgpng 0.1.0

data/lib/svgpng/package_resolution.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "rubygems/package"
+require "rubygems/resolver"
+require "rubygems/source"
+require "tmpdir"
+require "zlib"
+require_relative "../svgpng"
+require_relative "native"
+require_relative "release_set"
+
+module Svgpng
+  # Exercises RubyGems resolution against the verified staged set and local index.
+  # rubocop:disable Metrics/ModuleLength -- cohesive private pipeline helpers keep the public surface to verify!.
+  module PackageResolution
+    class VerificationError < StandardError; end
+
+    # Resolve dependencies from the installed bundle, but always select SVGPNG
+    # from the verified eight-package index rather than the source checkout.
+    class InstalledDependencies < Gem::Resolver::CurrentSet
+      def find_all(request)
+        request.name == "svgpng" ? [] : super
+      end
+    end
+
+    def self.verify!(directory:, manifest_path:, destination:)
+      verify_destination!(destination)
+
+      paths = ReleaseSet.verify!(directory: directory, manifest_path: manifest_path)
+      Dir.mktmpdir("svgpng-resolution-") do |workspace|
+        resolve_staged(paths, workspace, destination)
+      end
+    rescue ReleaseSet::VerificationError => e
+      raise VerificationError, "staged release-set validation failed: #{e.message}"
+    end
+
+    def self.verify_destination!(destination)
+      return unless File.exist?(destination) && (!File.directory?(destination) || !Dir.empty?(destination))
+
+      raise VerificationError, "install destination must be absent or an empty directory"
+    end
+    private_class_method :verify_destination!
+
+    def self.resolve_staged(paths, workspace, destination)
+      repository = stage_repository(paths, workspace)
+      generate_index(repository)
+      install_local(repository, destination)
+    end
+    private_class_method :resolve_staged
+
+    def self.generate_index(repository)
+      specs = package_specs(repository)
+      quick = File.join(repository, "quick", "Marshal.4.8")
+      FileUtils.mkdir_p(quick)
+      write_quick_specs(specs, quick)
+      tuples = specs.map { |spec| [spec.name, spec.version, spec.platform] }
+      write_index_files(repository, tuples)
+    end
+    private_class_method :generate_index
+
+    def self.package_specs(repository)
+      Dir.glob(File.join(repository, "gems", "*.gem")).map { |path| Gem::Package.new(path).spec }
+    end
+    private_class_method :package_specs
+
+    def self.write_quick_specs(specs, quick)
+      specs.each do |spec|
+        path = File.join(quick, "#{spec.full_name}.gemspec.rz")
+        File.binwrite(path, Zlib::Deflate.deflate(Marshal.dump(spec)))
+      end
+    end
+    private_class_method :write_quick_specs
+
+    def self.write_index_files(repository, tuples)
+      %w[specs.4.8 latest_specs.4.8].each { |name| write_gzip_index(repository, name, tuples) }
+    end
+    private_class_method :write_index_files
+
+    def self.write_gzip_index(repository, name, tuples)
+      File.open(File.join(repository, "#{name}.gz"), "wb") do |file|
+        Zlib::GzipWriter.wrap(file) { |gzip| gzip.write(Marshal.dump(tuples)) }
+      end
+    end
+    private_class_method :write_gzip_index
+
+    def self.stage_repository(paths, workspace)
+      repository = File.join(workspace, "repository")
+      gem_directory = File.join(repository, "gems")
+      FileUtils.mkdir_p(gem_directory)
+      paths.each { |path| FileUtils.cp(path, File.join(gem_directory, File.basename(path))) }
+      repository
+    end
+    private_class_method :stage_repository
+
+    def self.install_local(repository, destination)
+      target = target_for(Gem::Platform.local)
+      source = Gem::Source.new("file://#{File.realpath(repository)}")
+      install_resolved(source, repository, destination, target)
+    rescue Gem::Exception, IOError, SystemCallError => e
+      raise VerificationError, "local gem resolution/install failed: #{e.message}"
+    end
+    private_class_method :install_local
+
+    def self.install_resolved(source, repository, destination, target)
+      request = resolve_full_set(source)
+      raise VerificationError, "local full-set index did not resolve svgpng 0.1.0" unless request
+
+      verify_selected_target!(request.spec.platform, target)
+      installed = install_selected_package(repository, request.spec, destination, target)
+      { name: installed.name, version: installed.version.to_s, platform: installed.platform.to_s }.freeze
+    end
+    private_class_method :install_resolved
+
+    def self.install_selected_package(repository, resolver_spec, destination, target)
+      package = package_path(repository, resolver_spec.spec)
+      installed = install_package(package, destination)
+      verify_installed_target!(installed.platform, target)
+      installed
+    end
+    private_class_method :install_selected_package
+
+    def self.verify_selected_target!(platform, target)
+      return if target.nil? && platform == Gem::Platform::RUBY
+      return if target && platform.to_s == target
+
+      expected = target || "Ruby shell for unsupported host"
+      raise VerificationError, "RubyGems selected #{platform}; expected #{expected}"
+    end
+    private_class_method :verify_selected_target!
+
+    def self.verify_installed_target!(platform, target)
+      return if target.nil? && platform == Gem::Platform::RUBY
+      return if target && platform.to_s == target
+
+      expected = target || "Ruby shell for unsupported host"
+      raise VerificationError, "installed platform #{platform} does not match expected #{expected}"
+    end
+    private_class_method :verify_installed_target!
+
+    def self.target_for(platform)
+      exact = ReleaseSet::TARGETS.find do |candidate|
+        next false if candidate == "ruby"
+
+        declared = Gem::Platform.new(candidate)
+        declared.cpu == platform.cpu && declared.os == platform.os && declared.version == platform.version
+      end
+      exact || Native.send(:compatible_target, platform)
+    end
+    private_class_method :target_for
+
+    def self.resolve_full_set(source)
+      activations = Gem::Resolver.new([Gem::Dependency.new("svgpng", "= 0.1.0")],
+                                      Gem::Resolver::ComposedSet.new(Gem::Resolver::IndexSet.new(source),
+                                                                     InstalledDependencies.new)).resolve
+      activations.find { |activation| activation.spec.name == "svgpng" }
+    end
+    private_class_method :resolve_full_set
+
+    def self.package_path(repository, spec)
+      package = File.join(repository, "gems", "#{spec.full_name}.gem")
+      raise VerificationError, "resolved package is missing from verified local set" unless File.file?(package)
+
+      package
+    end
+    private_class_method :package_path
+
+    def self.install_package(package, destination)
+      Gem::Installer.at(package, install_dir: destination, wrappers: false, document: []).install
+    end
+    private_class_method :install_package
+    # rubocop:enable Metrics/ModuleLength
+  end
+end

data/lib/svgpng/raw_input.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Svgpng
+  # Runs before any XML parser. This is not the native URI/CSS policy.
+  module RawInput
+    def self.validate!(bytes)
+      # Class-side checking and a plain snapshot prevent caller overrides/mutation.
+      # rubocop:disable-next Style/CaseEquality
+      raise InputError, "SVG input must be a String" unless String === bytes
+
+      bytes = String.new(bytes)
+      raise LimitError, "SVG exceeds #{Limits::SVG_BYTES} bytes" if bytes.bytesize > Limits::SVG_BYTES
+
+      text = bytes.dup.force_encoding(Encoding::UTF_8)
+      raise InputError, "SVG must contain UTF-8 XML bytes" unless text.valid_encoding? && !text.include?("\0")
+
+      # Scan byte offsets so repeated delimiters after multibyte text stay linear.
+      scan_declarations!(text.force_encoding(Encoding::BINARY))
+      text.force_encoding(Encoding::UTF_8).freeze
+    end
+
+    def self.scan_declarations!(text)
+      cursor = 0
+      while (opening = text.index("<", cursor))
+        cursor = token_end(text, opening)
+      end
+    end
+
+    def self.token_end(text, opening)
+      return closing(text, "-->", opening + 4) if text[opening, 4] == "<!--"
+      return closing(text, "]]>", opening + 9) if text[opening, 9] == "<![CDATA["
+      return closing(text, "?>", opening + 2) if text[opening, 2] == "<?"
+      if text[opening, 10].match?(/\A<!DOCTYPE(?:\s|\[|>)/)
+        raise ForbiddenReferenceError.new(
+          "XML DOCTYPE declarations are forbidden",
+          reference_class: "doctype", location: "document@doctype"
+        )
+      end
+
+      opening + 1
+    end
+
+    def self.closing(text, delimiter, start)
+      index = text.index(delimiter, start)
+      raise InputError, "Unterminated XML comment, CDATA or instruction" unless index
+
+      index + delimiter.length
+    end
+    private_class_method :scan_declarations!, :token_end, :closing
+  end
+end

data/lib/svgpng/release_set.rb

@@ -0,0 +1,273 @@
+# frozen_string_literal: true
+
+require "digest"
+require "rubygems/package"
+require "tmpdir"
+require "yaml"
+
+module Svgpng
+  # Validates the staged local 0.1.0 package set without mutating it.
+  module ReleaseSet
+    VERSION = "0.1.0"
+    TARGETS = %w[
+      arm64-darwin x86_64-darwin x86_64-linux aarch64-linux
+      x86_64-linux-musl aarch64-linux-musl x64-mingw-ucrt ruby
+    ].freeze
+    TARGET_PATTERN = TARGETS.reject { |target| target == "ruby" }.join("|").freeze
+    GEM_NAME = /\Asvgpng-0\.1\.0(?:-(?:#{TARGET_PATTERN}))?\.gem\z/
+    SHA256 = /\A[a-f0-9]{64}\z/
+    MANIFEST_KEYS = %w[schema_version version artifacts].freeze
+    ARTIFACT_KEYS = %w[target path sha256].freeze
+    CHUNK_SIZE = 1024 * 1024
+
+    class VerificationError < StandardError; end
+
+    def self.verify!(directory:, manifest_path:)
+      raise VerificationError, "release directory must not be a symlink" if File.symlink?(directory)
+
+      release_dir = File.expand_path(directory)
+      raise VerificationError, "release directory does not exist: #{release_dir}" unless File.directory?(release_dir)
+
+      artifacts = Manifest.new(manifest_path).artifacts
+      Directory.new(release_dir).verify!(artifacts)
+    end
+
+    # Reads the versioned manifest and validates its schema and artifact names.
+    class Manifest
+      attr_reader :artifacts
+
+      def initialize(path)
+        @path = File.expand_path(path)
+        @artifacts = read_artifacts
+      end
+
+      private
+
+      def read_artifacts
+        raise VerificationError, "release manifest is missing: #{@path}" unless File.file?(@path)
+        raise VerificationError, "release manifest must not be a symlink: #{@path}" if File.symlink?(@path)
+
+        data = load_yaml
+        validate_header(data)
+        build_artifacts(manifest_entries(data))
+      end
+
+      def manifest_entries(data)
+        entries = data.fetch("artifacts")
+        raise VerificationError, "manifest artifacts must be an array" unless entries.is_a?(Array)
+
+        entries.map { |entry| validate_entry(entry) }
+      end
+
+      def build_artifacts(parsed)
+        validate_targets(parsed.map(&:first))
+        paths = parsed.map { |row| row[1] }
+        raise VerificationError, "manifest artifact paths must be unique" unless paths.uniq.length == paths.length
+
+        parsed.to_h { |target, path, digest| [path, [target, digest]] }
+      end
+
+      def load_yaml
+        YAML.safe_load_file(@path, permitted_classes: [], permitted_symbols: [], aliases: false)
+      rescue Psych::Exception => e
+        raise VerificationError, "invalid YAML manifest #{@path}: #{e.message}"
+      end
+
+      def validate_header(data)
+        unless data.is_a?(Hash) && data.keys.sort == MANIFEST_KEYS.sort
+          raise VerificationError, "manifest must contain exactly: #{MANIFEST_KEYS.join(", ")}"
+        end
+        raise VerificationError, "manifest schema_version must be 1" unless data["schema_version"] == 1
+        raise VerificationError, "manifest version must be #{VERSION}" unless data["version"] == VERSION
+      end
+
+      def validate_targets(targets)
+        return if targets.sort == TARGETS.sort
+
+        raise VerificationError, "manifest must list exactly eight targets (#{target_problems(targets)})"
+      end
+
+      def target_problems(targets)
+        missing = TARGETS - targets
+        unexpected = targets - TARGETS
+        duplicates = targets.tally.select { |_target, count| count > 1 }.keys
+        issues = [target_issue("missing", missing), target_issue("unexpected", unexpected),
+                  target_issue("duplicate", duplicates)]
+        issues
+          .compact
+          .join("; ")
+      end
+
+      def target_issue(kind, values)
+        "#{kind} targets: #{values.join(", ")}" unless values.empty?
+      end
+
+      def validate_entry(entry)
+        unless entry.is_a?(Hash) && entry.keys.sort == ARTIFACT_KEYS.sort
+          raise VerificationError, "each artifact must contain exactly: #{ARTIFACT_KEYS.join(", ")}"
+        end
+
+        target = entry["target"]
+        path = entry["path"]
+        digest = entry["sha256"]
+        validate_path(target, path)
+        validate_digest(path, digest)
+        [target, path, digest]
+      end
+
+      def validate_digest(path, digest)
+        return if digest.is_a?(String) && SHA256.match?(digest)
+
+        raise VerificationError, "#{path}: sha256 must be 64 lowercase hexadecimal characters"
+      end
+
+      def validate_path(target, path)
+        raise VerificationError, "artifact target must be a string" unless target.is_a?(String)
+
+        validate_basename(path)
+        raise VerificationError, "invalid release gem filename: #{path}" unless GEM_NAME.match?(path)
+
+        expected = target == "ruby" ? "svgpng-#{VERSION}.gem" : "svgpng-#{VERSION}-#{target}.gem"
+        raise VerificationError, "#{target}: expected filename #{expected}" unless path == expected
+      end
+
+      def validate_basename(path)
+        return if path.is_a?(String) && File.basename(path) == path && path != "." && path != ".."
+
+        raise VerificationError, "artifact path must be a simple basename"
+      end
+    end
+
+    # Compares the manifest against regular files in the local candidate dir.
+    class Directory
+      def initialize(path)
+        @path = path
+      end
+
+      def verify!(artifacts)
+        paths = actual_paths
+        expected = artifacts.keys.sort
+        validate_set(paths, expected)
+        expected.each { |name| verify_artifact(name, artifacts.fetch(name)) }
+        expected.map { |name| File.join(@path, name) }.freeze
+      end
+
+      private
+
+      def actual_paths
+        Dir.children(@path).select { |name| name.end_with?(".gem") }.sort
+      end
+
+      def validate_set(actual, expected)
+        missing = expected - actual
+        extra = actual - expected
+        raise VerificationError, "release set mismatch; missing: #{missing.join(", ")}" unless missing.empty?
+        raise VerificationError, "release set mismatch; unexpected: #{extra.join(", ")}" unless extra.empty?
+      end
+
+      def verify_artifact(name, artifact)
+        target, expected_digest = artifact
+        path = File.join(@path, name)
+        raise VerificationError, "release artifact must not be a symlink: #{path}" if File.symlink?(path)
+        raise VerificationError, "release artifact is not a regular file: #{path}" unless File.file?(path)
+
+        actual_digest = digest(path)
+        unless actual_digest == expected_digest
+          raise VerificationError, "SHA-256 mismatch for #{path}: expected #{expected_digest}, got #{actual_digest}"
+        end
+
+        Package.new(path, target).verify!
+      end
+
+      def digest(path)
+        result = Digest::SHA256.new
+        File.open(path, "rb") do |file|
+          while (chunk = file.read(CHUNK_SIZE))
+            result.update(chunk)
+          end
+        end
+        result.hexdigest
+      end
+    end
+
+    # Inspects gem metadata and unpacked paths without installing the package.
+    class Package
+      def initialize(path, target)
+        @path = path
+        @target = target
+      end
+
+      def verify!
+        package = Gem::Package.new(@path)
+        validate_gemspec(package.spec)
+        contents = package.contents
+        validate_contents(contents)
+        verify_payload(package)
+      rescue Gem::Package::Error, Gem::Security::Exception, Zlib::Error => e
+        raise VerificationError, "invalid gem package #{@path}: #{e.message}"
+      end
+
+      private
+
+      def validate_gemspec(spec)
+        platform = @target == "ruby" ? "ruby" : @target
+        unless spec.name == "svgpng" && spec.version.to_s == VERSION && spec.platform.to_s == platform
+          raise VerificationError, "#{@path}: gem metadata must be svgpng #{VERSION} for #{platform}"
+        end
+        return if spec.extensions.empty? && spec.executables.empty?
+
+        raise VerificationError, "#{@path}: gem must not declare extensions or executables"
+      end
+
+      def validate_contents(contents)
+        contents.each { |entry| validate_entry(entry) }
+        libraries = contents.select { |entry| shared_library?(entry) }
+        validate_shared_libraries(libraries)
+      end
+
+      def validate_entry(entry)
+        if entry.start_with?("/") || entry.split("/").include?("..") || entry.include?(92.chr)
+          raise VerificationError, "#{@path}: unsafe package path #{entry.inspect}"
+        end
+        return unless entry.start_with?("bin/") || entry.match?(/\.(?:sh|bat|ps1)\z/i)
+
+        raise VerificationError, "#{@path}: packaged scripts are not allowed (#{entry})"
+      end
+
+      def validate_shared_libraries(libraries)
+        if @target == "ruby" && !libraries.empty?
+          raise VerificationError, "#{@path}: ruby shell gem must not contain shared libraries"
+        end
+        return if @target == "ruby" || libraries == [shared_library_path]
+
+        raise VerificationError,
+              "#{@path}: expected exactly #{shared_library_path}; found shared libraries: #{libraries.join(", ")}"
+      end
+
+      def verify_payload(package)
+        return if @target == "ruby"
+
+        Dir.mktmpdir("svgpng-gem-inspect-") do |destination|
+          package.extract_files(destination)
+          extracted = File.join(destination, shared_library_path)
+          unless File.file?(extracted) && !File.symlink?(extracted)
+            raise VerificationError, "#{@path}: expected packaged shared library #{shared_library_path}"
+          end
+        end
+      end
+
+      def shared_library?(entry)
+        entry.match?(/\.(?:so|dylib|dll)\z/)
+      end
+
+      def shared_library_path
+        extension = case @target
+                    when /darwin/ then "dylib"
+                    when /mingw/ then "dll"
+                    else "so"
+                    end
+        "lib/svgpng/native/#{@target}/svgpng.#{extension}"
+      end
+    end
+  end
+end

data/lib/svgpng/render_profile.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+module Svgpng
+  # Resolves parser-provided root attributes into a bounded raster canvas.
+  # Keep viewport resolution, output fitting, and their shared limits together.
+  class RenderProfile # rubocop:disable Metrics/ClassLength
+    MAX_DIMENSION = 32_768
+    MAX_PIXELS = 64_000_000
+    MAX_STRIDE = MAX_DIMENSION * 4
+    MAX_BUFFER_BYTES = 256 * 1024 * 1024
+    MAX_ROOT_NUMBER_BYTES = 1024
+    MAX_ROOT_EXPONENT = 4096
+    KEYS = %i[width height scale background].freeze
+    DECIMAL = /\A[+-]?(?:\d+(?:\.\d*)?|\.\d+)\z/
+    SVG_NUMBER = /[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?/
+    LENGTH = /\A(#{SVG_NUMBER})(px|in|cm|mm|q|pt|pc|%)?\z/
+    UNITS = { "px" => 1, "in" => 96, "cm" => Rational(4800, 127),
+              "mm" => Rational(480, 127), "q" => Rational(120, 127),
+              "pt" => Rational(4, 3), "pc" => 16 }.freeze
+
+    Layout = Struct.new(:width, :height, :intrinsic_width, :intrinsic_height,
+                        :scale, :translate_x, :translate_y, :background,
+                        keyword_init: true) do
+      def transform
+        [scale, 0, 0, scale, translate_x, translate_y].freeze
+      end
+
+      def stride
+        width * 4
+      end
+
+      def buffer_bytes
+        stride * height
+      end
+    end
+
+    # Validation must precede capturing the immutable profile values.
+    def initialize(profile = {}) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      unless profile.is_a?(Hash) && (profile.keys - KEYS).empty?
+        raise ProfileError, "profile must be a hash with symbol width, height, scale, background keys"
+      end
+      if profile.key?(:scale) && (profile.key?(:width) || profile.key?(:height))
+        raise ProfileError, "scale cannot be combined with width or height"
+      end
+
+      @width = pixel_dimension(profile, :width)
+      @height = pixel_dimension(profile, :height)
+      @scale = decimal_scale(profile[:scale]) if profile.key?(:scale)
+      @background = parse_background(profile.fetch(:background, "transparent"))
+      freeze
+    end
+
+    # Build one immutable layout only after all allocation bounds pass.
+    def resolve(root_attributes = {}) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      unless root_attributes.is_a?(Hash) && root_attributes.keys.all?(String)
+        raise ProfileError, "root attributes must be a hash with string keys"
+      end
+
+      source_width, source_height = intrinsic_size(root_attributes)
+      width, height = output_size(source_width, source_height)
+      check_bounds(width, height)
+      scale = [Rational(width, 1) / source_width, Rational(height, 1) / source_height].min
+      Layout.new(width: width, height: height, intrinsic_width: source_width,
+                 intrinsic_height: source_height, scale: scale,
+                 translate_x: (width - (source_width * scale)) / 2,
+                 translate_y: (height - (source_height * scale)) / 2,
+                 background: @background).freeze
+    end
+
+    private
+
+    def pixel_dimension(profile, key)
+      return unless profile.key?(key)
+
+      value = profile[key]
+      raise ProfileError, "#{key} must be a positive integer" unless value.is_a?(Integer) && value.positive?
+      raise LimitError, "#{key} exceeds #{MAX_DIMENSION}" if value > MAX_DIMENSION
+
+      value
+    end
+
+    def decimal_scale(value)
+      unless value.is_a?(String) && DECIMAL.match?(value)
+        raise ProfileError, "scale must be a positive finite base-10 decimal string"
+      end
+
+      number = Rational(value)
+      raise ProfileError, "scale must be positive" unless number.positive?
+
+      number
+    end
+
+    def parse_background(value)
+      return [0, 0, 0, 0].freeze if value == "transparent"
+      unless value.is_a?(String) && /\A#[0-9a-fA-F]{6}(?:[0-9a-fA-F]{2})?\z/.match?(value)
+        raise ProfileError, "background must be transparent, #RRGGBB, or #RRGGBBAA"
+      end
+
+      channels = value.delete_prefix("#").scan(/../).map { |channel| channel.to_i(16) }
+      alpha = channels.fetch(3, 255)
+      [*channels.first(3).map { |channel| ((channel * alpha) + 127) / 255 }, alpha].freeze
+    end
+
+    # These branches mirror the public root-dimension precedence contract.
+    def intrinsic_size(attributes) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      width = root_length(attributes["width"], 300)
+      height = root_length(attributes["height"], 150)
+      view_box = parse_view_box(attributes["viewBox"])
+      if width && height
+        [width, height]
+      elsif width
+        [width, view_box ? width * view_box[3] / view_box[2] : Rational(150)]
+      elsif height
+        [view_box ? height * view_box[2] / view_box[3] : Rational(300), height]
+      elsif view_box
+        view_box.last(2)
+      else
+        [Rational(300), Rational(150)]
+      end
+    end
+
+    def root_length(value, percentage_base)
+      return if value.nil?
+
+      match = LENGTH.match(value.to_s.strip)
+      raise ProfileError, "unsupported root length: #{value.inspect}" unless match
+
+      number = root_number(match[1])
+      raise ProfileError, "root dimensions must be positive" unless number.positive?
+
+      unit = match[2]
+      number * (unit == "%" ? Rational(percentage_base, 100) : UNITS.fetch(unit, 1))
+    end
+
+    def parse_view_box(value)
+      return if value.nil?
+
+      text = value.to_s.strip
+      # Enforce separators so malformed tokens cannot become a different viewport.
+      unless /\A#{SVG_NUMBER}(?:(?:\s*,\s*|\s+)#{SVG_NUMBER}){3}\z/.match?(text)
+        raise ProfileError, "viewBox must contain four finite numbers"
+      end
+
+      values = text.split(/[\s,]+/).map { |number| root_number(number) }
+      values if values[2].positive? && values[3].positive?
+    end
+
+    def root_number(value)
+      if value.bytesize > MAX_ROOT_NUMBER_BYTES || value.split(/[eE]/).fetch(1, "0").to_i.abs > MAX_ROOT_EXPONENT
+        raise LimitError, "root numeric representation exceeds limits"
+      end
+      raise ProfileError, "root numbers must be finite" unless Float(value).finite?
+
+      Rational(value)
+    end
+
+    def output_size(width, height)
+      if @width && @height
+        [@width, @height]
+      elsif @width
+        [@width, round_dimension(@width * height / width)]
+      elsif @height
+        [round_dimension(@height * width / height), @height]
+      else
+        factor = @scale || 1
+        [round_dimension(width * factor), round_dimension(height * factor)]
+      end
+    end
+
+    def round_dimension(value)
+      [(value + Rational(1, 2)).floor, 1].max
+    end
+
+    def check_bounds(width, height)
+      raise LimitError, "output dimension exceeds #{MAX_DIMENSION}" if [width, height].max > MAX_DIMENSION
+      raise LimitError, "output pixel count exceeds #{MAX_PIXELS}" if width * height > MAX_PIXELS
+      raise LimitError, "output row stride exceeds #{MAX_STRIDE}" if width * 4 > MAX_STRIDE
+      return if width * height * 4 <= MAX_BUFFER_BYTES
+
+      raise LimitError, "output buffer exceeds #{MAX_BUFFER_BYTES} bytes"
+    end
+  end
+end