@openpresentation/opf-render 0.11.9 → 0.12.2

package/dist/preview-fonts-cli.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// RR-28: `opf-preview-fonts <outDir> [--scripts all|Jpan,Arab]` fills a self-hosted font root for <opf-deck>.
+import { copyPreviewFonts } from "./preview-fonts-node.js";
+
+const args = process.argv.slice(2);
+const flag = (name) => { const at = args.indexOf(name); return at === -1 ? undefined : args[at + 1]; };
+const outDir = args.find((arg, index) => !arg.startsWith("--") && args[index - 1] !== "--scripts");
+if (!outDir || args.includes("--help")) {
+  console.error("Usage: opf-preview-fonts <outDir> [--scripts all|Jpan,Arab,...]\nCopies the pinned, license-verified preview fonts to <outDir> (serve it as <opf-deck fonts=\"/<outDir>/\">).");
+  process.exit(outDir ? 0 : 2);
+}
+const scripts = flag("--scripts");
+const result = copyPreviewFonts({ outDir, scripts: scripts === undefined ? false : scripts === "all" ? "all" : scripts.split(",").map((code) => code.trim()).filter(Boolean) });
+console.log(`Preview fonts: ${result.packages} packages, ${result.copied} copied, ${result.verified} already verified, ${(result.bytes / 1048576).toFixed(1)} MiB, all SHA-256 verified.`);
+if (result.missing.length) console.warn(`Not installed (script faces skipped): ${result.missing.join(", ")}`);

package/dist/preview-fonts-node.d.ts

@@ -0,0 +1,14 @@
+export interface CopyPreviewFontsOptions {
+  /** The directory to fill (served as the `fonts` root of `<opf-deck>`). */
+  outDir: string;
+  /** Noto script faces to include (they are large): `false` (default), `"all"`, or ISO 15924 codes such as `["Jpan", "Arab"]`. */
+  scripts?: false | "all" | readonly string[];
+  /** Where optional script packages are looked up when they are not installed beside this package. */
+  cwd?: string;
+  manifest?: unknown;
+}
+
+export interface CopyPreviewFontsResult { copied: number; verified: number; bytes: number; files: string[]; packages: number; missing: string[] }
+
+/** Copy the pinned preview fonts into `outDir`, verifying every file's SHA-256 and writing every license notice to `LICENSES.txt`. */
+export declare function copyPreviewFonts(options: CopyPreviewFontsOptions): CopyPreviewFontsResult;

package/dist/preview-fonts-node.js

@@ -0,0 +1,86 @@
+// RR-28: fill a self-hosted font root (the layout of `preview-fonts.js`) from the installed packages, for hosts that serve
+// `<opf-deck fonts="/opf-fonts/">`. Node only. Every file is copied unmodified and checked against its pinned SHA-256 and
+// every license notice travels with it (LICENSES.txt). Nothing is downloaded: the faces come from this package's `fonts`
+// directory and the installed `@expo-google-fonts/*` packages.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { BUNDLED_FONT_MANIFEST } from "./font-manifest.js";
+import { previewFontLayout } from "./preview-fonts.js";
+import { scriptFontPackages } from "./script-font-pack.js";
+
+const ALLOWED_LICENSES = ["OFL-1.1", "Apache-2.0", "MIT", "UFL-1.0"];
+const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
+const safeFile = /^[A-Za-z0-9_./-]+$/;
+const rendererRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function within(directory, file) {
+  const resolved = path.resolve(directory, file);
+  if (file.includes("..") || !safeFile.test(file) || !resolved.startsWith(path.resolve(directory) + path.sep)) throw new Error(`${file} escapes its package directory.`);
+  return resolved;
+}
+
+function resolvePackageDirectory(name, from) {
+  const searched = [createRequire(path.join(rendererRoot, "package.json")), createRequire(path.join(from ?? process.cwd(), "package.json"))];
+  for (const requireFrom of searched) {
+    try { return path.dirname(requireFrom.resolve(`${name}/package.json`)); } catch { /* try the next location */ }
+  }
+  return undefined;
+}
+
+/**
+ * Copy the preview fonts into `outDir`.
+ *
+ * - `scripts`: which Noto script faces to include (they are large): `false` (default), `"all"`, or ISO 15924 codes such as
+ *   `["Jpan", "Arab"]`. A deck that draws a script nobody copied still renders; its text falls back to a system font.
+ * - `cwd`: where the optional script packages are looked up when they are not installed beside this package.
+ *
+ * Returns `{ copied, verified, bytes, files, packages, missing }`; `missing` names script packages that are not installed.
+ */
+export function copyPreviewFonts({ outDir, scripts = false, cwd, manifest = BUNDLED_FONT_MANIFEST } = {}) {
+  if (typeof outDir !== "string" || !outDir) throw new TypeError("copyPreviewFonts needs outDir.");
+  const wantedScripts = scripts === false ? new Set() : new Set(scriptFontPackages(scripts === true ? "all" : scripts).map((pkg) => pkg.name));
+  let copied = 0, verified = 0, bytes = 0;
+  const notices = [], missing = [], files = [];
+  const layout = previewFontLayout(manifest).filter((entry) => entry.kind !== "scripts" || wantedScripts.has(entry.pkg.name));
+  for (const { pkg, target } of layout) {
+    if (!ALLOWED_LICENSES.includes(pkg.license)) throw new Error(`${pkg.name} license ${pkg.license} is not allowed.`);
+    const sourceDirectory = pkg.vendored ? within(rendererRoot, pkg.vendored) : resolvePackageDirectory(pkg.name, cwd);
+    if (!sourceDirectory || !fs.existsSync(sourceDirectory)) {
+      if (pkg.pack === "scripts") { missing.push(pkg.name); continue; }
+      throw new Error(`${pkg.name} is not installed: reinstall @openpresentation/opf-render.`);
+    }
+    if (!pkg.vendored) {
+      const installed = JSON.parse(fs.readFileSync(path.join(sourceDirectory, "package.json"), "utf8"));
+      if (installed.version !== pkg.version) throw new Error(`Expected ${pkg.name}@${pkg.version}, found ${installed.version}: install the pinned version.`);
+    }
+    const destinationDirectory = path.join(outDir, target);
+    let licenseText = "";
+    for (const item of [{ file: pkg.licenseFile, sha256: pkg.licenseSha256 }, ...(pkg.noticeFile ? [{ file: pkg.noticeFile, sha256: pkg.noticeSha256 }] : [])]) {
+      const data = fs.readFileSync(within(sourceDirectory, item.file));
+      if (sha256(data) !== item.sha256) throw new Error(`${pkg.name} ${item.file} differs from the manifest hash.`);
+      fs.mkdirSync(destinationDirectory, { recursive: true });
+      fs.writeFileSync(within(destinationDirectory, item.file), data);
+      licenseText += `${licenseText ? "\n\n" : ""}${data.toString("utf8").replace(/\r\n/g, "\n").trim()}`;
+    }
+    notices.push(`${pkg.name}@${pkg.version} (${pkg.license}), ${pkg.source}\n\n${licenseText}`);
+    for (const face of pkg.faces) {
+      const destination = within(destinationDirectory, face.file);
+      files.push(path.posix.join(target, face.file));
+      if (fs.existsSync(destination)) {
+        const existing = fs.readFileSync(destination);
+        if (sha256(existing) === face.sha256) { verified++; bytes += existing.length; continue; }
+      }
+      const data = fs.readFileSync(within(sourceDirectory, face.file));
+      if (sha256(data) !== face.sha256) throw new Error(`${pkg.name}/${face.file} differs from the manifest hash: reinstall the pinned package.`);
+      fs.mkdirSync(path.dirname(destination), { recursive: true });
+      fs.writeFileSync(destination, data);
+      copied++; bytes += data.length;
+    }
+  }
+  fs.mkdirSync(outDir, { recursive: true });
+  fs.writeFileSync(path.join(outDir, "LICENSES.txt"), `Preview fonts served with <opf-deck>.\nEvery face is a pinned, unmodified copy, verified against its SHA-256.\n\n${notices.join("\n\n---\n\n")}\n`);
+  return { copied, verified, bytes, files, packages: layout.length - missing.length, missing };
+}

package/dist/preview-fonts.d.ts

@@ -0,0 +1,23 @@
+import type { BrowserFontRegistry } from "./fonts-browser.js";
+
+/** One face of the self-hosted font root: where it sits under the root, and its pinned hash. */
+export interface PreviewBaseFace { family: string; weight: number; italic: boolean; file: string; sha256: string; license: string }
+
+/** Where a manifest package sits under a font root: `kind` is `base`, `lazy` or `scripts`, `target` its root-relative directory. */
+export interface PreviewFontPlacement {
+  pkg: { name: string; version: string; pack: string; vendored?: string; license: string; faces: { file: string; family: string; weight: number; italic: boolean; sha256: string }[] };
+  kind: "base" | "lazy" | "scripts";
+  directory: string;
+  target: string;
+}
+
+export declare function previewFontDirectory(pkg: { name: string; vendored?: string }): string;
+export declare function previewFontLayout(manifest?: unknown, lazyFiles?: readonly string[]): PreviewFontPlacement[];
+export declare function previewBaseFaces(manifest?: unknown): PreviewBaseFace[];
+
+/**
+ * A browser font registry over a self-hosted font root: `<root>/base/<package>/<file>`, `<root>/lazy/fonts/<family>/<file>` and
+ * `<root>/scripts/<package>/<file>`. It starts with Roboto Regular and loads other faces on demand, hash-verified, only when a
+ * deck draws them. Registries are shared per root on a page.
+ */
+export declare function loadPreviewFonts(root: string, options?: { document?: Document; fetch?: typeof fetch; signal?: AbortSignal; registryOptions?: Record<string, unknown> }): Promise<BrowserFontRegistry>;

package/dist/preview-fonts.js

@@ -0,0 +1,78 @@
+// RR-28: the self-hosted font root <opf-deck> and the player load from. One directory a host serves from its own origin,
+// laid out as the editor playground and the OpenPresentation sites serve it (nothing is ever requested from a font CDN):
+//
+//   <root>/base/<package>/<file>       the eager Office and base faces (Roboto Regular loads at startup, the rest on demand)
+//   <root>/lazy/fonts/<family>/<file>  the vendored faces (Intos for the default Aptos scheme, the open families)
+//   <root>/scripts/<package>/<file>    the Noto script faces (Japanese, Arabic, ...)
+//
+// `copyPreviewFonts` (the `/fonts-node` side of this layout, `preview-fonts-node.js`) fills it from the installed packages.
+// Every file is verified against its pinned SHA-256 by the registry before use, and only the faces a deck draws are fetched.
+import { BUNDLED_FONT_MANIFEST } from "./font-manifest.js";
+import { lazyFontList, loadBrowserFontRegistry, splitStartupFaces } from "./fonts-browser.js";
+
+/** The directory a package's files sit in under its kind: a vendored family's own name, or the npm package name without its scope. */
+export function previewFontDirectory(pkg) {
+  return pkg.vendored ? pkg.vendored.replace(/^fonts\//, "") : pkg.name.split("/").pop();
+}
+
+/**
+ * Where every package of the manifest sits under a font root, relative to it: `kind` is `base`, `lazy` or `scripts`, and
+ * `target` the package's directory (`lazy` keeps the renderer's package-relative `fonts/<family>` path, which is what
+ * `lazyFontsBaseUrl` joins).
+ */
+export function previewFontLayout(manifest = BUNDLED_FONT_MANIFEST, lazyFiles = lazyFontList().map((face) => face.file)) {
+  const lazy = new Set(lazyFiles);
+  return manifest.packages.map((pkg) => {
+    const directory = previewFontDirectory(pkg);
+    const isLazy = pkg.faces.length > 0 && pkg.faces.every((face) => lazy.has(`${pkg.vendored}/${face.file}`));
+    const kind = pkg.pack === "scripts" ? "scripts" : isLazy ? "lazy" : "base";
+    return { pkg, kind, directory, target: kind === "lazy" ? `lazy/${pkg.vendored}` : `${kind}/${directory}` };
+  });
+}
+
+/** The eager faces (everything the registry could hold at startup) with their root-relative file and pinned hash. */
+export function previewBaseFaces(manifest = BUNDLED_FONT_MANIFEST) {
+  return previewFontLayout(manifest).filter((entry) => entry.kind === "base").flatMap(({ pkg, target }) => pkg.faces.map((face) => ({
+    family: face.family, weight: face.weight, italic: face.italic, file: `${target}/${face.file}`, sha256: face.sha256, license: pkg.license,
+  })));
+}
+
+const absolute = (root, document) => {
+  const text = String(root);
+  const base = document?.baseURI ?? globalThis.document?.baseURI ?? globalThis.location?.href;
+  const url = base ? new URL(text, base).href : text;
+  return url.endsWith("/") ? url : `${url}/`;
+};
+
+const shared = new Map();
+
+/**
+ * A browser font registry over a font root. It starts with Roboto Regular (the renderer's fallback family) and loads the rest
+ * only when a deck draws it, face by face: vendored faces from `<root>/lazy/`, script faces from `<root>/scripts/`, the other
+ * eager faces as the registry's extra lazy faces. One registry is shared by every deck on the page that names the same root.
+ */
+export function loadPreviewFonts(root, options = {}) {
+  if (typeof root !== "string" || !root) return Promise.reject(new TypeError("loadPreviewFonts needs the URL of the font root."));
+  const base = absolute(root, options.document);
+  const shareable = !options.document && !options.fetch && !options.registryOptions;
+  if (shareable && shared.has(base)) return shared.get(base);
+  const faces = previewBaseFaces();
+  const { startup, rest } = splitStartupFaces(faces, { startup: (face) => face.family === "Roboto" && face.weight === 400 && !face.italic });
+  const entry = (face) => ({ url: base + face.file, family: face.family, weight: face.weight, italic: face.italic, license: face.license, sha256: face.sha256 });
+  const promise = loadBrowserFontRegistry(startup.map(entry), {
+    substitutionPolicy: "visual",
+    fallbackFamily: "Roboto",
+    scriptBaseUrl: `${base}scripts/`,
+    lazyFontsBaseUrl: `${base}lazy/`,
+    extraLazyFonts: rest.map(entry),
+    ...(options.document ? { document: options.document } : {}),
+    ...(options.fetch ? { fetch: options.fetch } : {}),
+    ...(options.signal ? { signal: options.signal } : {}),
+    ...options.registryOptions,
+  });
+  if (shareable) {
+    shared.set(base, promise);
+    promise.catch(() => { if (shared.get(base) === promise) shared.delete(base); });
+  }
+  return promise;
+}

package/dist/raster-images.js

@@ -1,10 +1,11 @@
 import {OPFRenderError} from './svg.js';
 
-// Resvg does not decode WebP or apply JPEG EXIF orientation. Replace only
-// affected embedded image hrefs in the private
+// Resvg does not decode WebP or apply JPEG EXIF orientation, and draws no text of an SVG used as an image (its nested
+// document has no fonts). Replace only affected embedded image hrefs in the private
 // rasterization copy; preserve SVG text, attributes, comments and source bytes.
-export async function prepareRasterImages(svg) {
-  if (!/webp|jpeg|&#/i.test(svg)) return svg;
+// `nestedSvg(text)` renders an SVG picture that draws text to PNG bytes with the caller's fonts.
+export async function prepareRasterImages(svg, {nestedSvg} = {}) {
+  if (!/webp|jpeg|svg\+xml|&#/i.test(svg)) return svg;
   const cache = new Map();
   let output = '', end = 0, imageIndex = 0;
   const tokens = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<(?:"[^"]*"|'[^']*'|[^'">])*>/g;
@@ -16,11 +17,11 @@ export async function prepareRasterImages(svg) {
       ?? /\sxlink:href\s*=\s*(["'])([\s\S]*?)\1/.exec(tag);
     if (!href) continue;
     const uri = xmlText(href[2]);
-    if (!/^data:image\/(?:webp|jpeg)(?:;|,)/i.test(uri)) continue;
+    if (!/^data:image\/(?:webp|jpeg|svg\+xml)(?:;|,)/i.test(uri)) continue;
     const trace = /\sdata-opf-path\s*=\s*(["'])([\s\S]*?)\1/.exec(tag);
     const path = trace ? xmlText(trace[2]) : `svg.images.${index}`;
     try {
-      if (!cache.has(uri)) cache.set(uri, prepareRasterImage(uri));
+      if (!cache.has(uri)) cache.set(uri, /^data:image\/svg\+xml/i.test(uri) ? prepareSvgImage(uri, nestedSvg) : prepareRasterImage(uri));
       const png = await cache.get(uri);
       if (png === null) continue;
       const replacement = href[0].slice(0, href[0].indexOf(href[1]) + 1) + png + href[1];
@@ -34,6 +35,18 @@ export async function prepareRasterImages(svg) {
   return output + svg.slice(end);
 }
 
+// An SVG picture that draws text is rendered to PNG here (transparent, up to 4x its size) so its text uses the render's fonts;
+// one without text stays vector for resvg.
+async function prepareSvgImage(uri, nestedSvg) {
+  if (!nestedSvg) return null;
+  const comma = uri.indexOf(',');
+  const header = uri.slice(0, comma), data = uri.slice(comma + 1);
+  const text = /;base64$/i.test(header) ? Buffer.from(decodeURIComponent(data).replace(/\s/g, ''), 'base64').toString('utf8') : decodeURIComponent(data);
+  if (!/<(?:[A-Za-z_][\w.-]*:)?text[\s>/]/.test(text)) return null;
+  // A document resvg cannot read stays as it is: resvg then draws nothing for it, as for any broken picture.
+  try { return 'data:image/png;base64,' + Buffer.from(await nestedSvg(text)).toString('base64'); } catch { return null; }
+}
+
 async function prepareRasterImage(uri) {
   const comma = uri.indexOf(',');
   const header = uri.slice(0, comma), data = uri.slice(comma + 1);