pdf-codec 5.8.1 → 5.8.3

package/README.md

@@ -334,6 +334,10 @@ A TrueType subset can lose its glyph names and its `cmap` both and keep nothing
 
 A `/ToUnicode` CMap that a producer writes for the Symbol or Wingdings font (Word does, for a bullet, a tick or an arrow it draws in them) gives each glyph the private-use code point its 8-bit code makes in the 0xF000 range, which identifies the glyph in that one font and nothing else: 0xFC is a check mark in Wingdings and a piece of a right brace in Symbol. `symbol-font-private-use.ts` reads such a code point as the character the named font draws at that code, applied to the text a `/ToUnicode` CMap gave for a Symbol, SymbolMT or Wingdings font, by name, and to no other font: Symbol through its published encoding (the assembly pieces of a tall bracket and the integral extension as their Unicode characters), Wingdings through `wingdings-characters.ts`, the table of Unicode's own Wingdings document. A code the font has no character at, and Wingdings 2 and 3, Webdings and ZapfDingbats, stay as the producer wrote them.
 
+Two ways a producer names a core face other than the PostScript name the face's own tables carry are read through the same carried glyph order. A TrueType program Windows-era producers embed under the face's Windows name (`TimesNewRoman`, `Arial,Bold`) is the face `TimesNewRomanPSMT` or `Arial-BoldMT`, still accepted glyph by glyph against the program's own advance widths. And Adobe Acrobat's optimiser rewrites a TrueType face as a CFF subset that names each glyph `G` followed by its glyph id in the face (`G36` is the capital A of Times New Roman) under a font name carrying a size suffix (`Times.New.Roman092`, `Arial.Bold0133`): `coreFaceTextsOfNumberedGlyphs` reads those names through the face's order, but only for a font whose dictionary widths agree with the face's advances over at least five numbered glyphs and nine in ten of them, so a subset of another face, or one too small to tell, is read as before. The Symbol face and the Type 3 fonts such producers also write are not covered: the first has no carried order, and a Type 3 glyph is a drawing procedure with no character.
+
+Some producers write the font dictionary's own tables wrong for a symbol subset: a typesetter's Type 1C math fonts give each glyph an arbitrary name, assign the names to codes with `/Differences`, and have a `/ToUnicode` CMap read each name as the character it spells, so an equals sign is read as `¼` and an omega as `!`, from tables that are valid and wrong. `verified-glyph-tables.ts` holds tables for the exact subsets whose glyphs were rendered from the embedded program and checked one by one (`docs/verified-glyph-tables/`), each keyed by the SHA-256 of the decoded font program; a glyph of such a subset is read as what it draws, before the font dictionary's tables, and every other subset, family and code is read as before.
+
 **Where nothing states an answer, the answer is the replacement character plus a `text/unmapped-encoding` diagnostic, never a guess.** Cases that reach it in practice: a symbolic font with no embedded program and no `/ToUnicode`; a subsetted font that both strips its glyph names and maps its glyphs only from private-use code points; a nameless, `cmap`-less subset of a face whose glyph order this package does not carry, or of a carried face at a glyph its recorded releases do not number; and a composite font whose `/Encoding` is a CMap other than Identity-H or Identity-V, whose codes reach CIDs this reader does not map. A private-use code point identifies a glyph inside one font and says nothing about the character it draws, so it is treated as no answer rather than a wrong one.
 
 ## Grouping text runs into lines and words

package/dist/builtin-encoding.cjs

@@ -92,7 +92,7 @@ function coreFaceSource(font, fontName) {
 	const unitsPerEm = require_font_tables.parseHead(font)?.unitsPerEm;
 	const advanceOf = advanceWidths(font);
 	if (name === void 0 || unitsPerEm === void 0 || advanceOf === void 0) return;
-	const order = require_core_font_glyph_orders.coreFaceGlyphOrder(require_font_style.withoutSubsetTag(name), unitsPerEm);
+	const order = require_core_font_glyph_orders.coreFaceGlyphOrder(require_core_font_glyph_orders.coreFaceNameOfFontName(name) ?? require_font_style.withoutSubsetTag(name), unitsPerEm);
 	if (order === void 0) return;
 	return (glyphId) => order(glyphId, advanceOf(glyphId));
 }

package/dist/builtin-encoding.js

@@ -2,7 +2,7 @@ import { standardGlyphName } from "./encoding-standard-tables.js";
 import { hasBytes, parseSfnt, sfntTableBytes, u16, u8 } from "./sfnt.js";
 import { cffStringForSid, parseCffDict, readCffIndex } from "./cff.js";
 import { readCmapSubtables } from "./cmap-table.js";
-import { coreFaceGlyphOrder } from "./core-font-glyph-orders.js";
+import { coreFaceGlyphOrder, coreFaceNameOfFontName } from "./core-font-glyph-orders.js";
 import { withoutSubsetTag } from "./font-style.js";
 import { parseHead, parseMaxp, parseName, parsePostGlyphNames } from "./font-tables.js";
 import { glyphNameToUnicode } from "./glyph-names.js";
@@ -91,7 +91,7 @@ function coreFaceSource(font, fontName) {
 	const unitsPerEm = parseHead(font)?.unitsPerEm;
 	const advanceOf = advanceWidths(font);
 	if (name === void 0 || unitsPerEm === void 0 || advanceOf === void 0) return;
-	const order = coreFaceGlyphOrder(withoutSubsetTag(name), unitsPerEm);
+	const order = coreFaceGlyphOrder(coreFaceNameOfFontName(name) ?? withoutSubsetTag(name), unitsPerEm);
 	if (order === void 0) return;
 	return (glyphId) => order(glyphId, advanceOf(glyphId));
 }

package/dist/core-font-glyph-orders.cjs

@@ -58,5 +58,102 @@ function coreFaceGlyphOrder(postScriptName, unitsPerEm) {
 	if (face?.unitsPerEm !== unitsPerEm) return;
 	return (glyphId, advanceWidth) => face.advances[glyphId] === advanceWidth ? face.texts[glyphId] : void 0;
 }
+/** The PostScript names of the core faces, by the family and style a font name spells with its punctuation, subset tag and Distiller size suffix taken off. */
+const CORE_FACE_BY_SPELLING = /* @__PURE__ */ new Map([
+	["arial", "ArialMT"],
+	["arialmt", "ArialMT"],
+	["arialbold", "Arial-BoldMT"],
+	["arialboldmt", "Arial-BoldMT"],
+	["arialitalic", "Arial-ItalicMT"],
+	["arialitalicmt", "Arial-ItalicMT"],
+	["arialbolditalic", "Arial-BoldItalicMT"],
+	["arialbolditalicmt", "Arial-BoldItalicMT"],
+	["timesnewroman", "TimesNewRomanPSMT"],
+	["timesnewromanpsmt", "TimesNewRomanPSMT"],
+	["timesnewromanbold", "TimesNewRomanPS-BoldMT"],
+	["timesnewromanpsboldmt", "TimesNewRomanPS-BoldMT"],
+	["timesnewromanitalic", "TimesNewRomanPS-ItalicMT"],
+	["timesnewromanpsitalicmt", "TimesNewRomanPS-ItalicMT"],
+	["timesnewromanbolditalic", "TimesNewRomanPS-BoldItalicMT"],
+	["timesnewromanpsbolditalicmt", "TimesNewRomanPS-BoldItalicMT"],
+	["couriernew", "CourierNewPSMT"],
+	["couriernewpsmt", "CourierNewPSMT"],
+	["couriernewbold", "CourierNewPS-BoldMT"],
+	["couriernewpsboldmt", "CourierNewPS-BoldMT"],
+	["couriernewitalic", "CourierNewPS-ItalicMT"],
+	["couriernewpsitalicmt", "CourierNewPS-ItalicMT"],
+	["couriernewbolditalic", "CourierNewPS-BoldItalicMT"],
+	["couriernewpsbolditalicmt", "CourierNewPS-BoldItalicMT"]
+]);
+const ZERO_CODE = 48;
+const NINE_CODE = 57;
+const FULL_STOP_CODE = 46;
+function isDigitAt(name, index) {
+	const code = name.charCodeAt(index);
+	return code >= ZERO_CODE && code <= NINE_CODE;
+}
+function digitRunStart(name, end) {
+	let start = end;
+	while (start > 0 && isDigitAt(name, start - 1)) start -= 1;
+	return start;
+}
+/**
+* `name` without a trailing size or version number a producer appends to a font name ("Arial.Bold0133", "Arial086.75"): digits, optionally a fraction. Found by one scan back from the end, so the work is the length of the number and not of the name: the end-anchored pattern this replaces (a digit run followed by an optional fraction, then the end) is retried from every offset of a long digit run that a letter follows, which takes time quadratic in its length.
+* @param name - A `/BaseFont` name.
+* @returns The name with its trailing number cut off, or the name itself when it does not end in one.
+*/
+function withoutTrailingNumber(name) {
+	const fractionStart = digitRunStart(name, name.length);
+	if (fractionStart === name.length) return name;
+	const point = fractionStart - 1;
+	if (point > 0 && name.charCodeAt(point) === FULL_STOP_CODE) {
+		const wholeStart = digitRunStart(name, point);
+		if (wholeStart < point) return name.slice(0, wholeStart);
+	}
+	return name.slice(0, fractionStart);
+}
+/**
+* The PostScript name of the core face a font name spells, or `undefined` when it spells none: `TimesNewRoman` and `Times.New.Roman.Bold092` are `TimesNewRomanPSMT` and `TimesNewRomanPS-BoldMT`. A spelling is only a candidate: the glyph order is accepted per glyph, against the font dictionary's own widths (`coreFaceTextOfNumberedGlyph`).
+* @param fontName - A `/BaseFont` name, with or without its subset tag.
+* @returns The face's PostScript name, or `undefined`.
+*/
+function coreFaceNameOfFontName(fontName) {
+	const spelled = withoutTrailingNumber(fontName.replace(/^[A-Z]{6}\+/u, "")).replace(/[^A-Za-z]/gu, "").toLowerCase();
+	return CORE_FACE_BY_SPELLING.get(spelled);
+}
+const NUMBERED_GLYPH_NAME = /^G(\d+)$/u;
+const WIDTH_AGREEMENT_TOLERANCE = 25;
+const THOUSANDTHS_PER_EM = 1e3;
+const MIN_AGREEING_SHARE = .9;
+const MIN_NUMBERED_GLYPHS = 5;
+/**
+* What a core face draws at the glyphs of a CFF subset that names each `G<id>`, accepted for the whole font only when the font dictionary's widths agree with the face's advances over at least `MIN_NUMBERED_GLYPHS` glyphs and `MIN_AGREEING_SHARE` of them, so a subset of any other face, or of another release of this one, is read as before.
+* @param fontName - The font's `/BaseFont`.
+* @param glyphs - Each glyph of the font a `/Differences` array names, with the width, in thousandths of an em, the dictionary gives its code.
+* @returns The character each numbered glyph name draws, or `undefined` when the font is not taken for a core face.
+*/
+function coreFaceTextsOfNumberedGlyphs(fontName, glyphs) {
+	const faceName = coreFaceNameOfFontName(fontName);
+	const face = faceName === void 0 ? void 0 : readFaces().get(faceName);
+	if (face === void 0) return;
+	const texts = /* @__PURE__ */ new Map();
+	let numbered = 0;
+	let agreeing = 0;
+	for (const { name, width } of glyphs) {
+		const id = NUMBERED_GLYPH_NAME.exec(name)?.[1];
+		const advance = id === void 0 ? void 0 : face.advances[Number.parseInt(id, 10)];
+		if (id === void 0 || advance === void 0) continue;
+		numbered++;
+		const text = face.texts[Number.parseInt(id, 10)];
+		if (Math.abs(advance * THOUSANDTHS_PER_EM / face.unitsPerEm - width) <= WIDTH_AGREEMENT_TOLERANCE) {
+			agreeing++;
+			if (text !== void 0) texts.set(name, text);
+		}
+	}
+	return numbered >= MIN_NUMBERED_GLYPHS && agreeing >= numbered * MIN_AGREEING_SHARE ? texts : void 0;
+}
 //#endregion
 exports.coreFaceGlyphOrder = coreFaceGlyphOrder;
+exports.coreFaceNameOfFontName = coreFaceNameOfFontName;
+exports.coreFaceTextsOfNumberedGlyphs = coreFaceTextsOfNumberedGlyphs;
+exports.withoutTrailingNumber = withoutTrailingNumber;

package/dist/core-font-glyph-orders.d.cts

@@ -6,5 +6,27 @@
  * @returns a lookup from a glyph id and the program's own advance width for that glyph to the character the face draws there, answering undefined wherever the width disagrees with the face's or the face draws no character; or undefined when the name is not a core face or the grid is not the face's
  */
 declare function coreFaceGlyphOrder(postScriptName: string, unitsPerEm: number): ((glyphId: number, advanceWidth: number) => string | undefined) | undefined;
+/**
+ * `name` without a trailing size or version number a producer appends to a font name ("Arial.Bold0133", "Arial086.75"): digits, optionally a fraction. Found by one scan back from the end, so the work is the length of the number and not of the name: the end-anchored pattern this replaces (a digit run followed by an optional fraction, then the end) is retried from every offset of a long digit run that a letter follows, which takes time quadratic in its length.
+ * @param name - A `/BaseFont` name.
+ * @returns The name with its trailing number cut off, or the name itself when it does not end in one.
+ */
+declare function withoutTrailingNumber(name: string): string;
+/**
+ * The PostScript name of the core face a font name spells, or `undefined` when it spells none: `TimesNewRoman` and `Times.New.Roman.Bold092` are `TimesNewRomanPSMT` and `TimesNewRomanPS-BoldMT`. A spelling is only a candidate: the glyph order is accepted per glyph, against the font dictionary's own widths (`coreFaceTextOfNumberedGlyph`).
+ * @param fontName - A `/BaseFont` name, with or without its subset tag.
+ * @returns The face's PostScript name, or `undefined`.
+ */
+declare function coreFaceNameOfFontName(fontName: string): string | undefined;
+/**
+ * What a core face draws at the glyphs of a CFF subset that names each `G<id>`, accepted for the whole font only when the font dictionary's widths agree with the face's advances over at least `MIN_NUMBERED_GLYPHS` glyphs and `MIN_AGREEING_SHARE` of them, so a subset of any other face, or of another release of this one, is read as before.
+ * @param fontName - The font's `/BaseFont`.
+ * @param glyphs - Each glyph of the font a `/Differences` array names, with the width, in thousandths of an em, the dictionary gives its code.
+ * @returns The character each numbered glyph name draws, or `undefined` when the font is not taken for a core face.
+ */
+declare function coreFaceTextsOfNumberedGlyphs(fontName: string, glyphs: readonly {
+  readonly name: string;
+  readonly width: number;
+}[]): ReadonlyMap<string, string> | undefined;
 //#endregion
-export { coreFaceGlyphOrder };
+export { coreFaceGlyphOrder, coreFaceNameOfFontName, coreFaceTextsOfNumberedGlyphs, withoutTrailingNumber };

package/dist/core-font-glyph-orders.d.ts

@@ -6,5 +6,27 @@
  * @returns a lookup from a glyph id and the program's own advance width for that glyph to the character the face draws there, answering undefined wherever the width disagrees with the face's or the face draws no character; or undefined when the name is not a core face or the grid is not the face's
  */
 declare function coreFaceGlyphOrder(postScriptName: string, unitsPerEm: number): ((glyphId: number, advanceWidth: number) => string | undefined) | undefined;
+/**
+ * `name` without a trailing size or version number a producer appends to a font name ("Arial.Bold0133", "Arial086.75"): digits, optionally a fraction. Found by one scan back from the end, so the work is the length of the number and not of the name: the end-anchored pattern this replaces (a digit run followed by an optional fraction, then the end) is retried from every offset of a long digit run that a letter follows, which takes time quadratic in its length.
+ * @param name - A `/BaseFont` name.
+ * @returns The name with its trailing number cut off, or the name itself when it does not end in one.
+ */
+declare function withoutTrailingNumber(name: string): string;
+/**
+ * The PostScript name of the core face a font name spells, or `undefined` when it spells none: `TimesNewRoman` and `Times.New.Roman.Bold092` are `TimesNewRomanPSMT` and `TimesNewRomanPS-BoldMT`. A spelling is only a candidate: the glyph order is accepted per glyph, against the font dictionary's own widths (`coreFaceTextOfNumberedGlyph`).
+ * @param fontName - A `/BaseFont` name, with or without its subset tag.
+ * @returns The face's PostScript name, or `undefined`.
+ */
+declare function coreFaceNameOfFontName(fontName: string): string | undefined;
+/**
+ * What a core face draws at the glyphs of a CFF subset that names each `G<id>`, accepted for the whole font only when the font dictionary's widths agree with the face's advances over at least `MIN_NUMBERED_GLYPHS` glyphs and `MIN_AGREEING_SHARE` of them, so a subset of any other face, or of another release of this one, is read as before.
+ * @param fontName - The font's `/BaseFont`.
+ * @param glyphs - Each glyph of the font a `/Differences` array names, with the width, in thousandths of an em, the dictionary gives its code.
+ * @returns The character each numbered glyph name draws, or `undefined` when the font is not taken for a core face.
+ */
+declare function coreFaceTextsOfNumberedGlyphs(fontName: string, glyphs: readonly {
+  readonly name: string;
+  readonly width: number;
+}[]): ReadonlyMap<string, string> | undefined;
 //#endregion
-export { coreFaceGlyphOrder };
+export { coreFaceGlyphOrder, coreFaceNameOfFontName, coreFaceTextsOfNumberedGlyphs, withoutTrailingNumber };

package/dist/core-font-glyph-orders.js

@@ -57,5 +57,99 @@ function coreFaceGlyphOrder(postScriptName, unitsPerEm) {
 	if (face?.unitsPerEm !== unitsPerEm) return;
 	return (glyphId, advanceWidth) => face.advances[glyphId] === advanceWidth ? face.texts[glyphId] : void 0;
 }
+/** The PostScript names of the core faces, by the family and style a font name spells with its punctuation, subset tag and Distiller size suffix taken off. */
+const CORE_FACE_BY_SPELLING = /* @__PURE__ */ new Map([
+	["arial", "ArialMT"],
+	["arialmt", "ArialMT"],
+	["arialbold", "Arial-BoldMT"],
+	["arialboldmt", "Arial-BoldMT"],
+	["arialitalic", "Arial-ItalicMT"],
+	["arialitalicmt", "Arial-ItalicMT"],
+	["arialbolditalic", "Arial-BoldItalicMT"],
+	["arialbolditalicmt", "Arial-BoldItalicMT"],
+	["timesnewroman", "TimesNewRomanPSMT"],
+	["timesnewromanpsmt", "TimesNewRomanPSMT"],
+	["timesnewromanbold", "TimesNewRomanPS-BoldMT"],
+	["timesnewromanpsboldmt", "TimesNewRomanPS-BoldMT"],
+	["timesnewromanitalic", "TimesNewRomanPS-ItalicMT"],
+	["timesnewromanpsitalicmt", "TimesNewRomanPS-ItalicMT"],
+	["timesnewromanbolditalic", "TimesNewRomanPS-BoldItalicMT"],
+	["timesnewromanpsbolditalicmt", "TimesNewRomanPS-BoldItalicMT"],
+	["couriernew", "CourierNewPSMT"],
+	["couriernewpsmt", "CourierNewPSMT"],
+	["couriernewbold", "CourierNewPS-BoldMT"],
+	["couriernewpsboldmt", "CourierNewPS-BoldMT"],
+	["couriernewitalic", "CourierNewPS-ItalicMT"],
+	["couriernewpsitalicmt", "CourierNewPS-ItalicMT"],
+	["couriernewbolditalic", "CourierNewPS-BoldItalicMT"],
+	["couriernewpsbolditalicmt", "CourierNewPS-BoldItalicMT"]
+]);
+const ZERO_CODE = 48;
+const NINE_CODE = 57;
+const FULL_STOP_CODE = 46;
+function isDigitAt(name, index) {
+	const code = name.charCodeAt(index);
+	return code >= ZERO_CODE && code <= NINE_CODE;
+}
+function digitRunStart(name, end) {
+	let start = end;
+	while (start > 0 && isDigitAt(name, start - 1)) start -= 1;
+	return start;
+}
+/**
+* `name` without a trailing size or version number a producer appends to a font name ("Arial.Bold0133", "Arial086.75"): digits, optionally a fraction. Found by one scan back from the end, so the work is the length of the number and not of the name: the end-anchored pattern this replaces (a digit run followed by an optional fraction, then the end) is retried from every offset of a long digit run that a letter follows, which takes time quadratic in its length.
+* @param name - A `/BaseFont` name.
+* @returns The name with its trailing number cut off, or the name itself when it does not end in one.
+*/
+function withoutTrailingNumber(name) {
+	const fractionStart = digitRunStart(name, name.length);
+	if (fractionStart === name.length) return name;
+	const point = fractionStart - 1;
+	if (point > 0 && name.charCodeAt(point) === FULL_STOP_CODE) {
+		const wholeStart = digitRunStart(name, point);
+		if (wholeStart < point) return name.slice(0, wholeStart);
+	}
+	return name.slice(0, fractionStart);
+}
+/**
+* The PostScript name of the core face a font name spells, or `undefined` when it spells none: `TimesNewRoman` and `Times.New.Roman.Bold092` are `TimesNewRomanPSMT` and `TimesNewRomanPS-BoldMT`. A spelling is only a candidate: the glyph order is accepted per glyph, against the font dictionary's own widths (`coreFaceTextOfNumberedGlyph`).
+* @param fontName - A `/BaseFont` name, with or without its subset tag.
+* @returns The face's PostScript name, or `undefined`.
+*/
+function coreFaceNameOfFontName(fontName) {
+	const spelled = withoutTrailingNumber(fontName.replace(/^[A-Z]{6}\+/u, "")).replace(/[^A-Za-z]/gu, "").toLowerCase();
+	return CORE_FACE_BY_SPELLING.get(spelled);
+}
+const NUMBERED_GLYPH_NAME = /^G(\d+)$/u;
+const WIDTH_AGREEMENT_TOLERANCE = 25;
+const THOUSANDTHS_PER_EM = 1e3;
+const MIN_AGREEING_SHARE = .9;
+const MIN_NUMBERED_GLYPHS = 5;
+/**
+* What a core face draws at the glyphs of a CFF subset that names each `G<id>`, accepted for the whole font only when the font dictionary's widths agree with the face's advances over at least `MIN_NUMBERED_GLYPHS` glyphs and `MIN_AGREEING_SHARE` of them, so a subset of any other face, or of another release of this one, is read as before.
+* @param fontName - The font's `/BaseFont`.
+* @param glyphs - Each glyph of the font a `/Differences` array names, with the width, in thousandths of an em, the dictionary gives its code.
+* @returns The character each numbered glyph name draws, or `undefined` when the font is not taken for a core face.
+*/
+function coreFaceTextsOfNumberedGlyphs(fontName, glyphs) {
+	const faceName = coreFaceNameOfFontName(fontName);
+	const face = faceName === void 0 ? void 0 : readFaces().get(faceName);
+	if (face === void 0) return;
+	const texts = /* @__PURE__ */ new Map();
+	let numbered = 0;
+	let agreeing = 0;
+	for (const { name, width } of glyphs) {
+		const id = NUMBERED_GLYPH_NAME.exec(name)?.[1];
+		const advance = id === void 0 ? void 0 : face.advances[Number.parseInt(id, 10)];
+		if (id === void 0 || advance === void 0) continue;
+		numbered++;
+		const text = face.texts[Number.parseInt(id, 10)];
+		if (Math.abs(advance * THOUSANDTHS_PER_EM / face.unitsPerEm - width) <= WIDTH_AGREEMENT_TOLERANCE) {
+			agreeing++;
+			if (text !== void 0) texts.set(name, text);
+		}
+	}
+	return numbered >= MIN_NUMBERED_GLYPHS && agreeing >= numbered * MIN_AGREEING_SHARE ? texts : void 0;
+}
 //#endregion
-export { coreFaceGlyphOrder };
+export { coreFaceGlyphOrder, coreFaceNameOfFontName, coreFaceTextsOfNumberedGlyphs, withoutTrailingNumber };

package/dist/font-read.cjs

@@ -3,6 +3,7 @@ const require_encoding = require("./encoding.cjs");
 const require_afm_widths = require("./afm-widths.cjs");
 const require_objects = require("./objects.cjs");
 const require_filters = require("./filters.cjs");
+const require_core_font_glyph_orders = require("./core-font-glyph-orders.cjs");
 const require_font_style = require("./font-style.cjs");
 const require_glyph_names = require("./glyph-names.cjs");
 const require_builtin_encoding = require("./builtin-encoding.cjs");
@@ -10,6 +11,7 @@ const require_cmap = require("./cmap.cjs");
 const require_encoding_symbol_tables = require("./encoding-symbol-tables.cjs");
 const require_fonts = require("./fonts.cjs");
 const require_symbol_font_private_use = require("./symbol-font-private-use.cjs");
+const require_verified_glyph_tables = require("./verified-glyph-tables.cjs");
 //#region src/font-read.ts
 const BITS_PER_BYTE = 8;
 const SYMBOLIC_FLAG_BIT = 4;
@@ -50,6 +52,33 @@ function lazyFontProgram(descriptor, baseFont, context) {
 		return read.encoding;
 	};
 }
+function lazyVerifiedGlyphTable(descriptor, family, context) {
+	let read;
+	return () => {
+		if (descriptor === void 0 || !require_verified_glyph_tables.VERIFIED_GLYPH_FAMILIES.has(family)) return;
+		read ??= { table: verifiedGlyphTableOfProgram(descriptor, family, context) };
+		return read.table;
+	};
+}
+const PROGRAM_DIGESTS = /* @__PURE__ */ new WeakMap();
+function digestOfFontStream(stream, context) {
+	let digest = PROGRAM_DIGESTS.get(stream);
+	if (digest === void 0) {
+		digest = require_verified_glyph_tables.programDigest(require_filters.decodeStream(stream.raw, stream.dict, context.sink).bytes);
+		PROGRAM_DIGESTS.set(stream, digest);
+	}
+	return digest;
+}
+function verifiedGlyphTableOfProgram(descriptor, family, context) {
+	for (const key of [
+		"FontFile3",
+		"FontFile2",
+		"FontFile"
+	]) {
+		const stream = context.resolver.resolve(require_objects.dictGet(descriptor, key));
+		if (stream?.kind === "stream") return require_verified_glyph_tables.verifiedGlyphTableOfDigest(family, digestOfFontStream(stream, context), context.verifiedGlyphTables);
+	}
+}
 function readDifferencesMap(differences) {
 	const map = /* @__PURE__ */ new Map();
 	if (differences === void 0) return map;
@@ -86,6 +115,7 @@ function buildSimpleFont(fontDict, context) {
 	const symbolic = styleFlags.symbolic ?? false;
 	const builtinGlyphName = builtinSymbolGlyphNameLookup(baseFamily);
 	const symbolFont = require_symbol_font_private_use.symbolFontOf(baseFamily);
+	const verifiedGlyphs = lazyVerifiedGlyphTable(descriptor, baseFamily, context);
 	const widthsArr = resolvedArray(require_objects.dictGet(fontDict, "Widths"), context);
 	const firstChar = require_objects.asNumber(require_objects.dictGet(fontDict, "FirstChar")) ?? 0;
 	const missingWidth = (descriptor !== void 0 ? require_objects.asNumber(require_objects.dictGet(descriptor, "MissingWidth")) : void 0) ?? 0;
@@ -125,9 +155,19 @@ function buildSimpleFont(fontDict, context) {
 	});
 	const differencesMap = readDifferencesMap(encodingDict !== void 0 ? resolvedArray(require_objects.dictGet(encodingDict, "Differences"), context) : void 0);
 	const programEncoding = lazyFontProgram(descriptor, baseFont, context);
+	let numberedTexts;
+	const numberedCoreFaceTexts = () => {
+		numberedTexts ??= require_core_font_glyph_orders.coreFaceTextsOfNumberedGlyphs(baseFont, [...differencesMap].map(([code, name]) => ({
+			name,
+			width: widthOf(code)
+		}))) ?? /* @__PURE__ */ new Map();
+		return numberedTexts;
+	};
 	const unicodeForDifferencesName = (name) => {
 		const named = require_glyph_names.glyphNameToUnicode(name);
 		if (named !== void 0) return named;
+		const ofCoreFace = numberedCoreFaceTexts().get(name);
+		if (ofCoreFace !== void 0) return ofCoreFace;
 		const program = programEncoding();
 		const glyphId = program?.glyphIdOfName(name);
 		return glyphId === void 0 ? void 0 : program?.glyphIdToUnicode(glyphId);
@@ -160,6 +200,12 @@ function buildSimpleFont(fontDict, context) {
 		let out = "";
 		let unmapped = 0;
 		for (const code of codes) {
+			const glyphName = differencesMap.get(code) ?? namedBaseGlyphName?.(code);
+			const verified = glyphName === void 0 ? void 0 : verifiedGlyphs()?.glyphs.get(glyphName);
+			if (verified !== void 0) {
+				out += verified;
+				continue;
+			}
 			const viaToUnicode = toUnicode?.lookup(code);
 			if (viaToUnicode !== void 0) {
 				out += require_symbol_font_private_use.withSymbolFontCharacters(symbolFont, viaToUnicode);

package/dist/font-read.d.cts

@@ -1,6 +1,7 @@
 import { i as PdfDiagnosticSink } from "./diagnostics-BkG_Ej2x.cjs";
 import { n as PdfDict } from "./objects-e2RS3-yT.cjs";
 import { FontMetricsPort, PdfObjectResolver } from "./interpret-types.cjs";
+import { i as VerifiedGlyphTableSource } from "./verified-glyph-tables-B_ZoMhyT.cjs";
 //#region src/font-read.d.ts
 interface VerticalGlyphMetrics {
   readonly displacementY: number;
@@ -19,6 +20,8 @@ interface PdfFont {
 interface FontReadContext {
   readonly resolver: PdfObjectResolver;
   readonly sink: PdfDiagnosticSink;
+  /** The verified font subsets to read a font through, by the SHA-256 of its decoded program; the subsets `verified-glyph-tables.ts` holds when absent. Supplied by a test that builds its own. */
+  readonly verifiedGlyphTables?: ReadonlyMap<string, VerifiedGlyphTableSource>;
 }
 interface FontResolverService {
   readonly metrics: FontMetricsPort;

package/dist/font-read.d.ts

@@ -1,6 +1,7 @@
 import { i as PdfDiagnosticSink } from "./diagnostics-BkG_Ej2x.js";
 import { n as PdfDict } from "./objects-e2RS3-yT.js";
 import { FontMetricsPort, PdfObjectResolver } from "./interpret-types.js";
+import { i as VerifiedGlyphTableSource } from "./verified-glyph-tables-B_ZoMhyT.js";
 //#region src/font-read.d.ts
 interface VerticalGlyphMetrics {
   readonly displacementY: number;
@@ -19,6 +20,8 @@ interface PdfFont {
 interface FontReadContext {
   readonly resolver: PdfObjectResolver;
   readonly sink: PdfDiagnosticSink;
+  /** The verified font subsets to read a font through, by the SHA-256 of its decoded program; the subsets `verified-glyph-tables.ts` holds when absent. Supplied by a test that builds its own. */
+  readonly verifiedGlyphTables?: ReadonlyMap<string, VerifiedGlyphTableSource>;
 }
 interface FontResolverService {
   readonly metrics: FontMetricsPort;

package/dist/font-read.js

@@ -2,6 +2,7 @@ import { namedEncodingGlyphName, winAnsiGlyphName } from "./encoding.js";
 import { afmWidthOfCode } from "./afm-widths.js";
 import { asArray, asName, asNumber, dictGet, isName } from "./objects.js";
 import { decodeStream } from "./filters.js";
+import { coreFaceTextsOfNumberedGlyphs } from "./core-font-glyph-orders.js";
 import { styleFromBaseFontName } from "./font-style.js";
 import { glyphNameToUnicode } from "./glyph-names.js";
 import { readFontProgramEncoding } from "./builtin-encoding.js";
@@ -9,6 +10,7 @@ import { parseToUnicodeCMap } from "./cmap.js";
 import { symbolGlyphName, zapfDingbatsGlyphName } from "./encoding-symbol-tables.js";
 import { resolveStandardFont } from "./fonts.js";
 import { symbolFontOf, withSymbolFontCharacters } from "./symbol-font-private-use.js";
+import { VERIFIED_GLYPH_FAMILIES, programDigest, verifiedGlyphTableOfDigest } from "./verified-glyph-tables.js";
 //#region src/font-read.ts
 const BITS_PER_BYTE = 8;
 const SYMBOLIC_FLAG_BIT = 4;
@@ -49,6 +51,33 @@ function lazyFontProgram(descriptor, baseFont, context) {
 		return read.encoding;
 	};
 }
+function lazyVerifiedGlyphTable(descriptor, family, context) {
+	let read;
+	return () => {
+		if (descriptor === void 0 || !VERIFIED_GLYPH_FAMILIES.has(family)) return;
+		read ??= { table: verifiedGlyphTableOfProgram(descriptor, family, context) };
+		return read.table;
+	};
+}
+const PROGRAM_DIGESTS = /* @__PURE__ */ new WeakMap();
+function digestOfFontStream(stream, context) {
+	let digest = PROGRAM_DIGESTS.get(stream);
+	if (digest === void 0) {
+		digest = programDigest(decodeStream(stream.raw, stream.dict, context.sink).bytes);
+		PROGRAM_DIGESTS.set(stream, digest);
+	}
+	return digest;
+}
+function verifiedGlyphTableOfProgram(descriptor, family, context) {
+	for (const key of [
+		"FontFile3",
+		"FontFile2",
+		"FontFile"
+	]) {
+		const stream = context.resolver.resolve(dictGet(descriptor, key));
+		if (stream?.kind === "stream") return verifiedGlyphTableOfDigest(family, digestOfFontStream(stream, context), context.verifiedGlyphTables);
+	}
+}
 function readDifferencesMap(differences) {
 	const map = /* @__PURE__ */ new Map();
 	if (differences === void 0) return map;
@@ -85,6 +114,7 @@ function buildSimpleFont(fontDict, context) {
 	const symbolic = styleFlags.symbolic ?? false;
 	const builtinGlyphName = builtinSymbolGlyphNameLookup(baseFamily);
 	const symbolFont = symbolFontOf(baseFamily);
+	const verifiedGlyphs = lazyVerifiedGlyphTable(descriptor, baseFamily, context);
 	const widthsArr = resolvedArray(dictGet(fontDict, "Widths"), context);
 	const firstChar = asNumber(dictGet(fontDict, "FirstChar")) ?? 0;
 	const missingWidth = (descriptor !== void 0 ? asNumber(dictGet(descriptor, "MissingWidth")) : void 0) ?? 0;
@@ -124,9 +154,19 @@ function buildSimpleFont(fontDict, context) {
 	});
 	const differencesMap = readDifferencesMap(encodingDict !== void 0 ? resolvedArray(dictGet(encodingDict, "Differences"), context) : void 0);
 	const programEncoding = lazyFontProgram(descriptor, baseFont, context);
+	let numberedTexts;
+	const numberedCoreFaceTexts = () => {
+		numberedTexts ??= coreFaceTextsOfNumberedGlyphs(baseFont, [...differencesMap].map(([code, name]) => ({
+			name,
+			width: widthOf(code)
+		}))) ?? /* @__PURE__ */ new Map();
+		return numberedTexts;
+	};
 	const unicodeForDifferencesName = (name) => {
 		const named = glyphNameToUnicode(name);
 		if (named !== void 0) return named;
+		const ofCoreFace = numberedCoreFaceTexts().get(name);
+		if (ofCoreFace !== void 0) return ofCoreFace;
 		const program = programEncoding();
 		const glyphId = program?.glyphIdOfName(name);
 		return glyphId === void 0 ? void 0 : program?.glyphIdToUnicode(glyphId);
@@ -159,6 +199,12 @@ function buildSimpleFont(fontDict, context) {
 		let out = "";
 		let unmapped = 0;
 		for (const code of codes) {
+			const glyphName = differencesMap.get(code) ?? namedBaseGlyphName?.(code);
+			const verified = glyphName === void 0 ? void 0 : verifiedGlyphs()?.glyphs.get(glyphName);
+			if (verified !== void 0) {
+				out += verified;
+				continue;
+			}
 			const viaToUnicode = toUnicode?.lookup(code);
 			if (viaToUnicode !== void 0) {
 				out += withSymbolFontCharacters(symbolFont, viaToUnicode);

package/dist/verified-glyph-tables-B_ZoMhyT.d.cts

@@ -0,0 +1,38 @@
+//#region src/verified-glyph-tables.d.ts
+/**
+ * The SHA-256 of a decoded font program as lower-case hex, the key the verified subsets are filed under.
+ * @param bytes - The decoded bytes of the embedded font program.
+ * @returns The digest.
+ */
+declare function programDigest(bytes: Uint8Array<ArrayBuffer>): string;
+/** One verified subset: the font family its `/BaseFont` names (the subset tag taken off) and the character each listed glyph draws, by the program's own glyph name. */
+interface VerifiedGlyphTable {
+  readonly family: string;
+  readonly glyphs: ReadonlyMap<string, string>;
+}
+interface VerifiedGlyphTableSource {
+  readonly family: string;
+  readonly glyphs: Readonly<Record<string, string>>;
+}
+/** The subsets checked so far, by the SHA-256 of the decoded font program. */
+declare const VERIFIED_SOURCES: ReadonlyMap<string, VerifiedGlyphTableSource>;
+/** The font families some verified subset belongs to: a font of any other family is not hashed. */
+declare const VERIFIED_GLYPH_FAMILIES: ReadonlySet<string>;
+/**
+ * The verified table for an embedded font program given its digest, or `undefined` for any program that is not exactly one that was checked.
+ * @param family - The font's family as `styleFromBaseFontName` reads it: the table is used only for a font whose family is the one it was checked for.
+ * @param digest - The SHA-256 of the decoded font program (`programDigest`).
+ * @param tables - The verified subsets to look in, by program SHA-256; the checked ones unless a test supplies its own.
+ * @returns The table for that subset, or `undefined`.
+ */
+declare function verifiedGlyphTableOfDigest(family: string, digest: string, tables?: ReadonlyMap<string, VerifiedGlyphTableSource>): VerifiedGlyphTable | undefined;
+/**
+ * The verified table for an embedded font program, or `undefined` for any program that is not exactly one that was checked.
+ * @param family - The font's family as `styleFromBaseFontName` reads it: the table is used only for a font whose family is the one it was checked for.
+ * @param program - The decoded bytes of the embedded font program.
+ * @param tables - The verified subsets to look in, by program SHA-256; the checked ones unless a test supplies its own.
+ * @returns The table for that subset, or `undefined`.
+ */
+declare function verifiedGlyphTableFor(family: string, program: Uint8Array<ArrayBuffer>, tables?: ReadonlyMap<string, VerifiedGlyphTableSource>): VerifiedGlyphTable | undefined;
+//#endregion
+export { programDigest as a, VerifiedGlyphTableSource as i, VERIFIED_SOURCES as n, verifiedGlyphTableFor as o, VerifiedGlyphTable as r, verifiedGlyphTableOfDigest as s, VERIFIED_GLYPH_FAMILIES as t };

package/dist/verified-glyph-tables-B_ZoMhyT.d.ts

@@ -0,0 +1,38 @@
+//#region src/verified-glyph-tables.d.ts
+/**
+ * The SHA-256 of a decoded font program as lower-case hex, the key the verified subsets are filed under.
+ * @param bytes - The decoded bytes of the embedded font program.
+ * @returns The digest.
+ */
+declare function programDigest(bytes: Uint8Array<ArrayBuffer>): string;
+/** One verified subset: the font family its `/BaseFont` names (the subset tag taken off) and the character each listed glyph draws, by the program's own glyph name. */
+interface VerifiedGlyphTable {
+  readonly family: string;
+  readonly glyphs: ReadonlyMap<string, string>;
+}
+interface VerifiedGlyphTableSource {
+  readonly family: string;
+  readonly glyphs: Readonly<Record<string, string>>;
+}
+/** The subsets checked so far, by the SHA-256 of the decoded font program. */
+declare const VERIFIED_SOURCES: ReadonlyMap<string, VerifiedGlyphTableSource>;
+/** The font families some verified subset belongs to: a font of any other family is not hashed. */
+declare const VERIFIED_GLYPH_FAMILIES: ReadonlySet<string>;
+/**
+ * The verified table for an embedded font program given its digest, or `undefined` for any program that is not exactly one that was checked.
+ * @param family - The font's family as `styleFromBaseFontName` reads it: the table is used only for a font whose family is the one it was checked for.
+ * @param digest - The SHA-256 of the decoded font program (`programDigest`).
+ * @param tables - The verified subsets to look in, by program SHA-256; the checked ones unless a test supplies its own.
+ * @returns The table for that subset, or `undefined`.
+ */
+declare function verifiedGlyphTableOfDigest(family: string, digest: string, tables?: ReadonlyMap<string, VerifiedGlyphTableSource>): VerifiedGlyphTable | undefined;
+/**
+ * The verified table for an embedded font program, or `undefined` for any program that is not exactly one that was checked.
+ * @param family - The font's family as `styleFromBaseFontName` reads it: the table is used only for a font whose family is the one it was checked for.
+ * @param program - The decoded bytes of the embedded font program.
+ * @param tables - The verified subsets to look in, by program SHA-256; the checked ones unless a test supplies its own.
+ * @returns The table for that subset, or `undefined`.
+ */
+declare function verifiedGlyphTableFor(family: string, program: Uint8Array<ArrayBuffer>, tables?: ReadonlyMap<string, VerifiedGlyphTableSource>): VerifiedGlyphTable | undefined;
+//#endregion
+export { programDigest as a, VerifiedGlyphTableSource as i, VERIFIED_SOURCES as n, verifiedGlyphTableFor as o, VerifiedGlyphTable as r, verifiedGlyphTableOfDigest as s, VERIFIED_GLYPH_FAMILIES as t };