@jasy/pdf 1.0.0-alpha.6 → 1.0.0-alpha.8

package/dist/utils/dest-registry.js

@@ -1,5 +1,3 @@
-// A PDF literal string escape (backslash first, then the string delimiters).
-const esc = (s) => s.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
 const num = (n) => (Number.isFinite(n) ? Number(n.toFixed(2)) : 0);
 /**
  * Collects named destinations - the jump targets an internal `Link({ to })` points at, declared with
@@ -19,13 +17,15 @@ export class DestRegistry {
         return this.dests.size === 0;
     }
     /** The `/Dests << /Names [ ... ] >>` fragment for the catalog `/Names` dictionary (merged with any
-     *  `/EmbeddedFiles`). Returns "" when empty. Names are sorted lexically - a name tree requires it. */
-    finalize() {
+     *  `/EmbeddedFiles`). Returns "" when empty. Names are sorted lexically - a name tree requires it.
+     *  Takes the object manager only so the names go through its string choke-point and get encrypted
+     *  with everything else. */
+    finalize(om) {
         if (this.dests.size === 0)
             return "";
         const entries = [...this.dests.keys()].sort().map((name) => {
             const d = this.dests.get(name);
-            return `(${esc(name)}) [${d.pageObjNum} 0 R /XYZ null ${num(d.top)} null]`;
+            return `${om.pdfString(name)} [${d.pageObjNum} 0 R /XYZ null ${num(d.top)} null]`;
         });
         return `/Dests << /Names [ ${entries.join(" ")} ] >>`;
     }

package/dist/utils/font-metrics.d.ts

@@ -1,4 +1,6 @@
 import type { FontStyle } from "./pdf-object-manager.js";
+import type { FontVerticals } from "../text/line-metrics.js";
+import type { FontDecoration } from "../text/text-decoration.js";
 /**
  * Read-only font measurement - the slice of the object manager that the layout pass
  * needs. Keeping layout (and, later, fragmentation) behind this interface means those
@@ -9,4 +11,16 @@ import type { FontStyle } from "./pdf-object-manager.js";
 export interface FontMetrics {
     getStringWidth(text: string, fontFamily: string, fontSize: number, fontStyle: FontStyle): number;
     getCharWidth(char: string, fontSize: number, fullFontName?: string, fontName?: string, fontStyle?: FontStyle): number;
+    /** Ascent / descent / lineGap of a face, in em fractions - the vertical counterpart of the widths
+     *  above. Drives the line box and the baseline (see `text/line-metrics.ts`). */
+    getFontVerticals(fontFamily: string, fontStyle: FontStyle): FontVerticals;
+    /** Underline / strikethrough geometry of a face, in em fractions. GLYPH metrics, deliberately kept
+     *  apart from the LINE metrics above (see `text/text-decoration.ts`). */
+    getFontDecoration(fontFamily: string, fontStyle: FontStyle): FontDecoration;
+    /** Whether kerning is on for this document. `runAdvance` reads it so a measured advance matches the
+     *  drawn one (the backend emits a `TJ` under the same flag). */
+    readonly kerningEnabled: boolean;
+    /** Per-adjacent-pair kerning of `text`, in em/1000 (negative tightens); length `codePoints - 1`,
+     *  zero next to a space. Only meaningful when `kerningEnabled`. */
+    getKernPairs(text: string, fontFamily: string, fontStyle: FontStyle): number[];
 }

package/dist/utils/outline.js

@@ -1,5 +1,4 @@
 // A PDF literal string escape (same rule as elsewhere): backslash first, then the string delimiters.
-const esc = (s) => s.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
 const num = (n) => Number(n.toFixed(2));
 /**
  * Builds the PDF document outline (`/Outlines`) - the viewer's bookmark panel. Entries are collected
@@ -52,7 +51,7 @@ export class OutlineBuilder {
         // Emit each item dict, wired to its parent, siblings (prev/next) and first/last child.
         const emit = (nodes, parentNum) => {
             nodes.forEach((n, i) => {
-                const parts = [`/Title (${esc(n.title)})`, `/Parent ${parentNum} 0 R`];
+                const parts = [`/Title ${om.pdfString(n.title)}`, `/Parent ${parentNum} 0 R`];
                 if (i > 0)
                     parts.push(`/Prev ${objOf.get(nodes[i - 1])} 0 R`);
                 if (i < nodes.length - 1)

package/dist/utils/pdf-object-manager.d.ts

@@ -2,9 +2,12 @@ import type { OverflowPolicy } from "../layout/fragmentation.js";
 import { TTFParser } from "./ttf-parser.js";
 import type { SecurityHandler } from "../crypto/security-handler.js";
 import type { Gradient } from "../ir/display-list.js";
+import type { FontVerticals } from "../text/line-metrics.js";
+import type { FontDecoration } from "../text/text-decoration.js";
 import { StructTree } from "./struct-tree.js";
 import { OutlineBuilder } from "./outline.js";
 import { DestRegistry } from "./dest-registry.js";
+import { AcroFormCollector } from "../forms/acroform.js";
 import type { PDFConfig } from "../renderer/pdf-document-class.js";
 import type { FontMetrics } from "./font-metrics.js";
 interface FontIndexes {
@@ -33,6 +36,8 @@ export declare class PDFObjectManager implements FontMetrics {
     pageFormat: [number, number];
     private afmParsers;
     private customFonts;
+    private verticalsCache;
+    private decorationCache;
     private customFontEmit;
     private attachments;
     private xmpMetadata?;
@@ -43,6 +48,7 @@ export declare class PDFObjectManager implements FontMetrics {
     private overflowPolicy;
     private security?;
     private encJobs;
+    private strJobs;
     private encryptObjNum?;
     private _struct;
     get struct(): StructTree;
@@ -50,6 +56,8 @@ export declare class PDFObjectManager implements FontMetrics {
     get outline(): OutlineBuilder;
     private _dests;
     get dests(): DestRegistry;
+    private _acroform;
+    get acroform(): AcroFormCollector;
     constructor();
     addObject(content: string): number;
     replaceObject(objectNumber: number, content: string): void;
@@ -57,9 +65,23 @@ export declare class PDFObjectManager implements FontMetrics {
     setOverflowPolicy(policy: OverflowPolicy): void;
     getOverflowPolicy(): OverflowPolicy;
     private encToken;
+    private strToken;
+    /**
+     * The single choke-point every literal string in an OBJECT goes through - a field's `/T` and `/V`, a
+     * bookmark `/Title`, a link `/URI`, an `/Alt` text, a destination name.
+     *
+     * Without a security handler this is the escaped literal we have always written, so output stays
+     * byte-identical. With one, the raw bytes are registered for the finalize pass and a placeholder takes
+     * their place: ISO 32000-1 7.6.2 requires ALL strings and streams to be encrypted, and the ones missed
+     * here were exactly the values a password is supposed to protect (ISSUE-7).
+     *
+     * A string INSIDE a content stream needs none of this - the stream is enciphered as a whole.
+     */
+    pdfString(text: string): string;
     private streamPayload;
     private stream;
     addContentStream(content: string): number;
+    addFormXObject(bbox: string, content: string, resources?: string): number;
     changePDFConfig(config: PDFConfig): void;
     getPDFConfig(): PDFConfig;
     private fillConfigWithStandardValues;
@@ -119,10 +141,32 @@ export declare class PDFObjectManager implements FontMetrics {
     private buildCIDFont;
     private buildToUnicode;
     private buildType0;
+    getFontVerticals(fontFamily: string, fontStyle: FontStyle): FontVerticals;
+    getFontDecoration(fontFamily: string, fontStyle: FontStyle): FontDecoration;
+    kerningEnabled: boolean;
+    setKerning(enabled: boolean): void;
+    /**
+     * The kerning adjustment for each adjacent code-point pair of `text`, in em/1000 (the sign the
+     * font declares: negative tightens). Length is `codePointCount - 1`. Zero at any pair next to a
+     * space - letters are never kerned against a space, which also keeps a per-word measure equal to a
+     * whole-line one (the space pairs contribute nothing either way).
+     *
+     * Standard-14 answers from the AFM `KPX` pairs. An embedded font has no kerning yet (its `kern` /
+     * `GPOS` tables are unparsed), so it returns zeros - never a wrong value, just no adjustment.
+     */
+    getKernPairs(text: string, fontFamily: string, fontStyle: FontStyle): number[];
+    /**
+     * Where the glyphs of `text` put ink inside a horizontal band, as x-intervals in POINTS measured
+     * from the start of the run. This is what an underline steps around ("skip-ink").
+     *
+     * `bandTop` / `bandBottom` are in points relative to the baseline, y UP (so both negative under
+     * it). Only an EMBEDDED font can answer: the standard-14 outlines live in the viewer, not here.
+     * Callers must check `isCustomFont` first rather than treat an empty result as "no descenders".
+     */
+    getInkSpansInBand(text: string, fontSize: number, fontFamily: string, fontStyle: FontStyle, bandTop: number, bandBottom: number, letterSpacing?: number): Array<[number, number]>;
     getStringWidth(text: string, fontFamily: string, fontSize: number, fontStyle: FontStyle): number;
     private getAVMParserByFont;
     getCharWidth(char: string, fontSize: number, fullFontName?: string, fontName?: string, fontStyle?: FontStyle): number;
-    private getKerning;
     getAllFontsRaw(): Map<string, FontIndexes>;
     getAllImagesRaw(): Map<string, number>;
     getRenderedObjects(): string;

package/dist/utils/pdf-object-manager.js

@@ -4,13 +4,14 @@ import { md5, md5Hex } from "./md5.js";
 import { zlibSync } from "fflate";
 import { bytesFromLatin1, latin1FromBytes } from "./bytes.js";
 import { AFMParser } from "./afm-parser.js";
-import { TTFParser } from "./ttf-parser.js";
+import { mergeSpans, TTFParser } from "./ttf-parser.js";
 import { subsetTTF } from "./ttf-subsetter.js";
 import { getArrayBuffer } from "./utf8-to-windows1252-encoder.js";
 import { isEmojiCodePoint } from "../text/emoji-codepoints.js";
 import { StructTree } from "./struct-tree.js";
 import { OutlineBuilder } from "./outline.js";
 import { DestRegistry } from "./dest-registry.js";
+import { AcroFormCollector } from "../forms/acroform.js";
 // Enums come from the leaf config module (never in a cycle); the config type is
 // erased at runtime so it can come from the cyclic module safely.
 import { ColorMode, Orientation } from "../renderer/pdf-config.js";
@@ -134,6 +135,9 @@ export class PDFObjectManager {
     get dests() {
         return this._dests;
     }
+    get acroform() {
+        return this._acroform;
+    }
     constructor(pageSize) {
         this.objects = [];
         this.objectPositions = [];
@@ -150,6 +154,10 @@ export class PDFObjectManager {
         // every lookup, and the lookups happen once per character - the string allocation alone was a third
         // of a custom-font render. `customFontEmit` below keeps the flat key: it is touched once per face.
         this.customFonts = new Map();
+        // Memoised getFontVerticals answers, family -> style -> metrics. Cleared when a font registers.
+        this.verticalsCache = new Map();
+        // Same, for getFontDecoration.
+        this.decorationCache = new Map();
         // Per-registered face: the reserved font-object numbers + the glyph ids actually used. The font
         // program is subsetted and the objects filled in by finalizeCustomFonts(), after the render pass.
         this.customFontEmit = new Map();
@@ -163,6 +171,7 @@ export class PDFObjectManager {
         this.compress = false;
         this.overflowPolicy = "error";
         this.encJobs = [];
+        this.strJobs = [];
         // Accessible (PDF/UA) tagging, off by default (byte-identical output); the API turns it on.
         this._struct = new StructTree();
         // Document outline (bookmarks). Empty unless a `Bookmark` was placed; then finalize() emits /Outlines.
@@ -170,6 +179,14 @@ export class PDFObjectManager {
         // Named destinations (internal-link jump targets). Empty unless an `Anchor` was placed; then it emits
         // a /Names /Dests tree.
         this._dests = new DestRegistry();
+        // Interactive form fields (AcroForm). Empty unless a form field was placed; then finalize() emits the
+        // catalog /AcroForm dict and each field's widget lands in its page /Annots.
+        this._acroform = new AcroFormCollector();
+        // Whether to kern. Document-level: measuring (via `runAdvance`, which reads this off the metrics)
+        // and drawing (the backend emits a `TJ`) both consult it, so they can never disagree. OFF while the
+        // embedded-font path (kern/GPOS) is unbuilt - a standard-14-only kerning would set the 14 system
+        // fonts finer than a user's own font, which is worse than none. Flip to on when GPOS lands.
+        this.kerningEnabled = false;
         if (pageSize)
             this.pageFormat = pageFormats[pageSize];
         this.fillConfigWithStandardValues();
@@ -204,6 +221,32 @@ export class PDFObjectManager {
     encToken(id) {
         return `
JENC:${id}
`;
     }
+    // The same trick for a literal STRING. A separate marker because the two are swapped differently: a
+    // stream keeps its delimiters and only the payload changes, a string is replaced whole by a hex one.
+    strToken(id) {
+        return `\x00\x02JSTR:${id}\x02\x00`;
+    }
+    /**
+     * The single choke-point every literal string in an OBJECT goes through - a field's `/T` and `/V`, a
+     * bookmark `/Title`, a link `/URI`, an `/Alt` text, a destination name.
+     *
+     * Without a security handler this is the escaped literal we have always written, so output stays
+     * byte-identical. With one, the raw bytes are registered for the finalize pass and a placeholder takes
+     * their place: ISO 32000-1 7.6.2 requires ALL strings and streams to be encrypted, and the ones missed
+     * here were exactly the values a password is supposed to protect (ISSUE-7).
+     *
+     * A string INSIDE a content stream needs none of this - the stream is enciphered as a whole.
+     */
+    pdfString(text) {
+        if (!this.security) {
+            return `(${text.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)")})`;
+        }
+        // Encrypt the bytes the unencrypted path would have written, so a viewer decrypts to the same value.
+        // No escaping is applied: the result is emitted as a HEX string, which has no escapes to get wrong.
+        const bytes = new Uint8Array(getArrayBuffer(text));
+        const id = this.strJobs.push(bytes) - 1;
+        return this.strToken(id);
+    }
     // The single encryption choke-point every stream emitter routes through (stream(), registerImage). Without
     // a security handler: the bytes as a latin1 string + their length. With one: register the raw bytes for the
     // finalize pass and return a placeholder + the pre-computable encrypted length (16-byte IV + PKCS#7 padding).
@@ -237,6 +280,14 @@ export class PDFObjectManager {
     addContentStream(content) {
         return this.addObject(this.stream("", new Uint8Array(getArrayBuffer(content))));
     }
+    // A Form XObject: a self-contained content stream with its own /BBox (+ optional /Resources). Used for
+    // form-field appearance streams (/AP). Routes through the same choke-point as page content, so
+    // compression and encryption apply. Returns the object number.
+    addFormXObject(bbox, content, resources) {
+        const dict = `/Type /XObject /Subtype /Form /BBox ${bbox}` +
+            (resources ? ` /Resources << ${resources} >>` : "");
+        return this.addObject(this.stream(dict, new Uint8Array(getArrayBuffer(content))));
+    }
     changePDFConfig(config) {
         this.pdfConfig = { ...this.pdfConfig, ...config };
     }
@@ -318,9 +369,8 @@ endstream`;
     attachFile(name, data, opts = {}) {
         const subtype = (opts.mimeType ?? "application/octet-stream").replace(/\//g, "#2F");
         const embedded = this.addObject(this.stream(`/Type /EmbeddedFile /Subtype /${subtype} /Params << /Size ${data.length} >>`, data));
-        const escaped = (s) => s.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
-        const desc = opts.description ? ` /Desc (${escaped(opts.description)})` : "";
-        const filespec = this.addObject(`<< /Type /Filespec /F (${escaped(name)}) /UF (${escaped(name)}) ` +
+        const desc = opts.description ? ` /Desc ${this.pdfString(opts.description)}` : "";
+        const filespec = this.addObject(`<< /Type /Filespec /F ${this.pdfString(name)} /UF ${this.pdfString(name)} ` +
             `/AFRelationship /${opts.relationship ?? "Unspecified"}${desc} ` +
             `/EF << /F ${embedded} 0 R /UF ${embedded} 0 R >> >>`);
         this.attachments.push({ name, filespec });
@@ -341,8 +391,8 @@ endstream`;
     setOutputIntent(icc, opts = {}) {
         const profile = this.addObject(this.stream("/N 3", icc));
         this.outputIntent = this.addObject(`<< /Type /OutputIntent /S /GTS_PDFA1 ` +
-            `/OutputConditionIdentifier (${opts.identifier ?? "sRGB"}) ` +
-            `/Info (${opts.info ?? "sRGB IEC61966-2.1"}) /DestOutputProfile ${profile} 0 R >>`);
+            `/OutputConditionIdentifier ${this.pdfString(opts.identifier ?? "sRGB")} ` +
+            `/Info ${this.pdfString(opts.info ?? "sRGB IEC61966-2.1")} /DestOutputProfile ${profile} 0 R >>`);
     }
     getOutputIntent() {
         return this.outputIntent;
@@ -390,6 +440,18 @@ endstream`;
             if (idx >= 0)
                 this.objects[idx] = this.objects[idx].replace(token, () => ciphertext);
         }
+        // Strings: the same idea, but a string is replaced WHOLE - `(text)` becomes `<ciphertext>`. Hex,
+        // because the ciphertext is binary and a hex string has no escape rules to get wrong.
+        for (let id = 0; id < this.strJobs.length; id++) {
+            const cipher = await this.security.encrypt(this.strJobs[id]);
+            const hex = Array.from(cipher, (b) => b.toString(16).padStart(2, "0").toUpperCase()).join("");
+            const token = this.strToken(id);
+            const idx = this.objects.findIndex((o) => o.includes(token));
+            if (idx >= 0)
+                this.objects[idx] = this.objects[idx].replace(token, () => `<${hex}>`);
+        }
+        // Added LAST on purpose: the /Encrypt dictionary's own strings must stay in the clear (7.6.2), and
+        // they would otherwise be swept up by the pass above.
         this.encryptObjNum = this.addObject(`<< ${this.security.encryptDict()} >>`);
     }
     // Registers (or reuses) a transparency graphics state and returns its resource name
@@ -462,6 +524,8 @@ endstream`;
         if (this.fonts.hasFont(fontName, fontStyle)) {
             return this.fonts.getFont(fontName, fontStyle); // Already exists? Return it!
         }
+        this.verticalsCache.delete(fontName);
+        this.decorationCache.delete(fontName);
         const data = STANDARD_AFM[fullName];
         if (data !== undefined) {
             this.afmParsers.push({
@@ -495,6 +559,8 @@ endstream`;
         if (byStyle.has(style))
             return;
         byStyle.set(style, new TTFParser(data));
+        this.verticalsCache.delete(name); // this family now answers from the .ttf, not from an AFM
+        this.decorationCache.delete(name);
         // Emission (the PDF font objects + page resource) is DEFERRED to first use via ensureEmitted(),
         // so a registered-but-never-rendered face - e.g. a bundled family the document doesn't touch -
         // costs nothing in the output. The metrics above are still available for layout immediately.
@@ -660,7 +726,7 @@ endstream`;
             .map((g) => `${g} [${all[g] ?? 1000}]`)
             .join(" ");
         return (`<< /Type /Font /Subtype /CIDFontType2 /BaseFont /${pdfName(name)} ` +
-            `/CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> ` +
+            `/CIDSystemInfo << /Registry ${this.pdfString("Adobe")} /Ordering ${this.pdfString("Identity")} /Supplement 0 >> ` +
             `/FontDescriptor ${descriptor} 0 R /CIDToGIDMap /Identity ` +
             `/DW 1000 /W [${w}] >>`);
     }
@@ -690,24 +756,132 @@ endstream`;
         return (`<< /Type /Font /Subtype /Type0 /BaseFont /${pdfName(name)} /Encoding /Identity-H ` +
             `/DescendantFonts [${cidFont} 0 R] /ToUnicode ${toUnicode} 0 R >>`);
     }
+    // The vertical metrics of a face, in em fractions - what seats the baseline and sizes the line
+    // box (see text/line-metrics.ts). An embedded font answers from its own `hhea`; a standard-14
+    // font from its AFM header. Nothing here is guessed: both numbers come out of the font data.
+    //
+    // Asked once per LINE (not per character), but a long document has a lot of lines and the
+    // standard-14 lookup below is a linear scan, so the answer is memoised per face. Registering a
+    // font clears the cache - a name can go from standard-14 to embedded.
+    getFontVerticals(fontFamily, fontStyle) {
+        let byStyle = this.verticalsCache.get(fontFamily);
+        const hit = byStyle?.get(fontStyle);
+        if (hit)
+            return hit;
+        const ttf = this.getCustomFont(fontFamily, fontStyle);
+        const verticals = ttf
+            ? {
+                ascent: ttf.ascent / 1000,
+                descent: -ttf.descent / 1000, // hhea writes the descent negative
+                lineGap: ttf.lineGap / 1000,
+            }
+            : this.getAVMParserByFont(undefined, fontFamily, fontStyle).parser.verticals();
+        if (!byStyle) {
+            byStyle = new Map();
+            this.verticalsCache.set(fontFamily, byStyle);
+        }
+        byStyle.set(fontStyle, verticals);
+        return verticals;
+    }
+    // Underline / strikethrough geometry of a face, in em fractions. Same shape as getFontVerticals:
+    // an embedded font answers from its `post`/`OS/2` tables, a standard-14 one from its AFM header,
+    // and the answer is memoised per face because it is asked once per decorated run.
+    getFontDecoration(fontFamily, fontStyle) {
+        let byStyle = this.decorationCache.get(fontFamily);
+        const hit = byStyle?.get(fontStyle);
+        if (hit)
+            return hit;
+        const ttf = this.getCustomFont(fontFamily, fontStyle);
+        const decoration = ttf
+            ? ttf.decoration()
+            : this.getAVMParserByFont(undefined, fontFamily, fontStyle).parser.decoration();
+        if (!byStyle) {
+            byStyle = new Map();
+            this.decorationCache.set(fontFamily, byStyle);
+        }
+        byStyle.set(fontStyle, decoration);
+        return decoration;
+    }
+    setKerning(enabled) {
+        this.kerningEnabled = enabled;
+    }
+    /**
+     * The kerning adjustment for each adjacent code-point pair of `text`, in em/1000 (the sign the
+     * font declares: negative tightens). Length is `codePointCount - 1`. Zero at any pair next to a
+     * space - letters are never kerned against a space, which also keeps a per-word measure equal to a
+     * whole-line one (the space pairs contribute nothing either way).
+     *
+     * Standard-14 answers from the AFM `KPX` pairs. An embedded font has no kerning yet (its `kern` /
+     * `GPOS` tables are unparsed), so it returns zeros - never a wrong value, just no adjustment.
+     */
+    getKernPairs(text, fontFamily, fontStyle) {
+        const chars = [...text];
+        if (chars.length < 2)
+            return [];
+        const out = [];
+        // An embedded font kerns by GLYPH id (kern table / GPOS); a standard-14 one by character (AFM).
+        const ttf = this.getCustomFont(fontFamily, fontStyle);
+        const parser = ttf
+            ? undefined
+            : this.getAVMParserByFont(undefined, fontFamily, fontStyle).parser;
+        for (let i = 0; i < chars.length - 1; i++) {
+            const a = chars[i];
+            const b = chars[i + 1];
+            if (a === " " || b === " ") {
+                out.push(0);
+            }
+            else if (ttf) {
+                out.push(ttf.getKerning(ttf.getGlyphIndex(a.codePointAt(0)), ttf.getGlyphIndex(b.codePointAt(0))));
+            }
+            else {
+                out.push(parser.getKerning(a, b));
+            }
+        }
+        return out;
+    }
+    /**
+     * Where the glyphs of `text` put ink inside a horizontal band, as x-intervals in POINTS measured
+     * from the start of the run. This is what an underline steps around ("skip-ink").
+     *
+     * `bandTop` / `bandBottom` are in points relative to the baseline, y UP (so both negative under
+     * it). Only an EMBEDDED font can answer: the standard-14 outlines live in the viewer, not here.
+     * Callers must check `isCustomFont` first rather than treat an empty result as "no descenders".
+     */
+    getInkSpansInBand(text, fontSize, fontFamily, fontStyle, bandTop, bandBottom, letterSpacing = 0) {
+        const ttf = this.getCustomFont(fontFamily, fontStyle);
+        if (!ttf)
+            return [];
+        const scale = fontSize / ttf.unitsPerEm;
+        const spans = [];
+        let pen = 0;
+        for (const ch of text) {
+            const codePoint = ch.codePointAt(0);
+            if (codePoint !== undefined) {
+                for (const [x0, x1] of ttf.inkSpansInBand(codePoint, bandTop / scale, bandBottom / scale)) {
+                    spans.push([pen + x0 * scale, pen + x1 * scale]);
+                }
+            }
+            // The pen advances by the glyph AND its letter-spacing, so the ink of the next glyph lands
+            // where `Tc` actually draws it - otherwise the skipped gaps drift under the wrong letters.
+            pen += this.getCharWidth(ch, fontSize, undefined, fontFamily, fontStyle) + letterSpacing;
+        }
+        return mergeSpans(spans);
+    }
     // Returns the current width of a text, included kernings
     getStringWidth(text, fontFamily, fontSize, fontStyle) {
         let width = 0;
         // Iterate code points, not UTF-16 units: an astral char (emoji, CJK-ext) is a surrogate pair,
         // and indexing by unit would measure each half as its own (zero-width) "char". The spread splits
         // on code points; for BMP text this is one unit each, so the result is unchanged.
-        const chars = [...text];
-        for (let i = 0; i < chars.length; i++) {
-            const char = chars[i];
-            const nextChar = chars[i + 1] || null;
-            // Get signs width
-            const charWidth = this.getCharWidth(char, fontSize, undefined, fontFamily, fontStyle);
-            width += charWidth;
-            // If a next sign available calculate the kerning
-            if (nextChar) {
-                const kerning = this.getKerning(char, nextChar, undefined, fontFamily, fontStyle);
-                width += kerning * fontSize; // Kerning must be scaled with the font size
-            }
+        //
+        // NO KERNING. We write a run as a single `Tj`, and a viewer advances that by the font's plain
+        // widths - PDF never kerns on its own; a producer has to say so with a `TJ` array. Folding the
+        // AFM's kerning into the MEASUREMENT while the OUTPUT ignores it made every kerned string draw
+        // wider than its box: "AVATAR Wave" at 40pt by 19pt, "Total" at 11pt by 5.7%. Measured must equal
+        // drawn. The AFM kerning pairs stay parsed (`getKerning`) for the day we emit `TJ` - see the
+        // "real kerning" item in todo.md, which must cover embedded fonts too (`kern`/`GPOS`).
+        for (const char of text) {
+            width += this.getCharWidth(char, fontSize, undefined, fontFamily, fontStyle);
         }
         return width;
     }
@@ -767,13 +941,6 @@ endstream`;
         return (advanceWidth / 1000) * fontSize;
     }
     // Method to get the kerning, if available, between two signs
-    getKerning(char, nextChar, fullFontName, fontName, fontStyle) {
-        // TrueType kerning (the kern/GPOS tables) is not wired up yet - no kerning for custom fonts.
-        if (this.getCustomFont(fullFontName ?? fontName, fontStyle))
-            return 0;
-        const currentParser = this.getAVMParserByFont(fullFontName, fontName, fontStyle);
-        return currentParser.parser.getKerning(char, nextChar) / 1000;
-    }
     // Returns all fonts
     getAllFontsRaw() {
         return this.fonts.getAllFonts();

package/dist/utils/struct-tree.js

@@ -1,5 +1,4 @@
 // Escapes a PDF literal string ( ... ) - the language tag is safe ASCII, but /Alt can carry arbitrary text.
-const esc = (s) => s.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
 // A structure role reaches the PDF as a raw name (/H1, /S /Table). Roles come from a controlled set,
 // but restrict them to a safe PDF-name token anyway (defence-in-depth) so a stray "/", whitespace, or
 // operator can never corrupt the content stream / object dictionary. Empty after stripping -> /Span.
@@ -90,7 +89,7 @@ export class StructTree {
                 ...childrenOf(e.key).map((c) => `${objNum.get(c.key)} 0 R`),
                 ...e.mc.map((m) => `<< /Type /MCR /Pg ${pg(m.structParents)} 0 R /MCID ${m.mcid} >>`),
             ].join(" ");
-            const alt = e.alt ? ` /Alt (${esc(e.alt)})` : "";
+            const alt = e.alt ? ` /Alt ${om.pdfString(e.alt)}` : "";
             // PDF/UA 7.5: a header cell needs a Scope so a reader can associate data cells with it. Our headers
             // are a header ROW (the Table `header` option), so each TH is the head of its Column.
             const attr = e.role === "TH" ? " /A << /O /Table /Scope /Column >>" : "";
@@ -125,6 +124,6 @@ export class StructTree {
         om.replaceObject(parentTreeNum, `<< /Nums [ ${nums.join(" ")} ] >>`);
         om.replaceObject(rootNum, `<< /Type /StructTreeRoot /K ${docNum} 0 R /ParentTree ${parentTreeNum} 0 R ` +
             `/ParentTreeNextKey ${this.structParentsCounter} >>`);
-        return `/MarkInfo << /Marked true >> /StructTreeRoot ${rootNum} 0 R /Lang (${esc(this.lang)})`;
+        return `/MarkInfo << /Marked true >> /StructTreeRoot ${rootNum} 0 R /Lang ${om.pdfString(this.lang)}`;
     }
 }

package/dist/utils/ttf-parser.d.ts

@@ -1,3 +1,4 @@
+import type { FontDecoration } from "../text/text-decoration.js";
 export type GlyphPathCommand = {
     type: "M";
     x: number;
@@ -47,11 +48,19 @@ export interface ColorGlyphLayer {
     paint: Paint;
     transform?: Affine;
 }
+/** Sorts x-intervals and unions the overlapping ones. */
+export declare function mergeSpans(spans: Array<[number, number]>): Array<[number, number]>;
 export declare class TTFParser {
     private data;
     unitsPerEm: number;
     ascent: number;
     descent: number;
+    lineGap: number;
+    private underlinePositionRaw;
+    private underlineThicknessRaw;
+    private xHeightRaw;
+    private capHeightRaw;
+    private cachedDecoration?;
     bbox: [number, number, number, number];
     private numGlyphs;
     private numHMetrics;
@@ -65,6 +74,9 @@ export declare class TTFParser {
     private palette;
     private colrBaseV1;
     private colrLayerListOffset;
+    private kernPairs;
+    private hasKerning;
+    private gposPairPos;
     constructor(data: Uint8Array);
     getData(): Uint8Array;
     glyphCount(): number;
@@ -75,6 +87,47 @@ export declare class TTFParser {
     getAdvanceWidth(glyphIndex: number): number;
     getCharWidth(char: string, fontSize: number): number;
     getStringWidth(text: string, fontSize: number): number;
+    private readDecorationMetrics;
+    /**
+     * Underline / strikethrough geometry, as fractions of the em.
+     *
+     * A font without `post` (rare) gets the classic 10% below the baseline at 5% thickness - the same
+     * numbers all 14 standard AFMs happen to declare, so it is a measured convention rather than an
+     * invention. A font whose `OS/2` predates version 2 has no x- or cap-height, so we MEASURE them off
+     * the outlines of `x` and `H` instead of guessing.
+     */
+    decoration(): FontDecoration;
+    /** The highest ON-CURVE point of a code point's outline, in font units; 0 for a missing glyph.
+     *  A quadratic's control point may sit above the curve, so it is not a bound - and `x`/`H` have
+     *  flat tops in any face where this fallback matters. */
+    private outlineTop;
+    /**
+     * Where a glyph's INK crosses a horizontal band, as x-intervals in font units (pen origin at 0).
+     * This is what lets an underline step around a descender ("skip-ink"), the way a browser does.
+     *
+     * Scanline fill: sample a few horizontal lines across the band, find every place the outline
+     * crosses them, and pair the crossings up into filled spans. A handful of scanlines is plenty -
+     * the band is a few percent of the em tall, and a descender stem does not wander inside it.
+     *
+     * `yTop` / `yBottom` are in font units, y UP from the baseline (so both are negative under it).
+     * Returns [] for a glyph with no outline (a space, an unmapped code point, a composite we cannot
+     * decompose) - the caller then leaves the line unbroken there, which is the safe direction.
+     */
+    inkSpansInBand(codePoint: number, yTop: number, yBottom: number): Array<[number, number]>;
+    /** True if the font declares any horizontal kerning (kern table or GPOS). */
+    kerns(): boolean;
+    private kernCache;
+    /** Kerning between two glyphs, in em/1000 (the standard-14 unit); 0 if the pair is not kerned.
+     *  Negative tightens, matching the AFM sign. GPOS wins over the legacy `kern` table when both
+     *  exist (it is what a modern shaper uses, and can carry more pairs). */
+    getKerning(leftGid: number, rightGid: number): number;
+    private readKern;
+    private readGpos;
+    private gposKern;
+    private static valueRecordSize;
+    private xAdvance;
+    private coverageIndex;
+    private classOf;
     private table;
     private readTableDirectory;
     private readHmtx;