Avalonia

Commit Graph

Author	SHA1	Message	Date
Benedikt Stebner	b709c58c6b	[Text] Glyph Outline Part 2/13 - GlyphTypeface.GetGlyphOutline implementation (#21406 ) * Harden cmap/name/post parsing against malformed fonts Fonts are untrusted input, but several pre-existing table parsers throw out of the GlyphTypeface constructor on hostile data, denying the whole font instead of degrading the affected (cosmetic) table. - name: wrap NameTable.Load in try/catch so a malformed table falls back to a default family name (same outcome as an absent name), and bounds-check NameRecord.GetValue's (offset,length) slice — the record array is validated at load but each record's storage slice is read later during construction. - post: wrap PostTable.Load so a malformed cosmetic-hint table degrades to defaults rather than denying the font. - cmap format 12/13: clamp the declared length and group count to the buffer, computing the group span in long to avoid the nGroups12 int overflow a hostile count would wrap to a negative slice length. - cmap format 4 selection: score a Windows Symbol subtable worse than any Unicode subtable so ASCII resolves regardless of subtable order, while a Symbol-only font still selects its only subtable. maxp/cmap remain fatal by design. Behavioural hardening only; public API unchanged. Backportable independently of the glyph-outline stack. Clamp cmap range contents and harden binary reader primitives Format 12/13 group contents are attacker-controlled: TryGetRange used to hand the raw uint32 end straight to per-codepoint consumers, so a group with endCharCode 0x7FFFFFFF turned range enumeration into an unbounded (for int.MaxValue, non-terminating) loop. Clamp ranges to the Unicode range and map inverted/out-of-range groups to empty ranges so later groups still enumerate. Give the format 4 constructor the same treatment its format 12 sibling already received: clamp the declared length and segment count to what the buffer actually holds instead of slicing unchecked (debug asserts replaced by the clamps). In BigEndianBinaryReader, bounds-check array reads before allocating (a hostile length is rejected instead of attempting the allocation), make EnsureAvailable overflow-proof, and clamp ReadBytes against negative counts. * Add font parsing infrastructure for glyph outline/color drawing Introduces shared utility types that subsequent PRs will use to implement GetGlyphOutline (glyf table) and GetGlyphDrawing (COLR v0/v1) on GlyphTypeface: - ObjectPool<T>: thread-safe object pool used by Decyclers - Decycler<T> / CycleGuard<T> / DecyclerException: generic cycle-detection and depth-limiting utility for recursive font-table traversal (composite glyphs, paint graphs) - FontVariationSettings: parameter type for the upcoming GetGlyphOutline / GetGlyphDrawing overloads - IGlyphDrawing / GlyphDrawingType: return-type contract for color glyph drawings (outline, color layers, SVG, bitmap) - CharacterToGlyphMapDictionary: lightweight, allocation-free IReadOnlyDictionary<int, ushort> view over the cmap, plus CharacterToGlyphMap.AsReadOnlyDictionary() to expose it No behavior change; types are not yet consumed in this PR. * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Validate ObjectPool maxSize and add unit tests The ObjectPool<T> constructor previously accepted any maxSize value. A value of 0 or below silently caused every Return to be discarded, which is hard to diagnose at the call site. - Reject maxSize < 1 with ArgumentOutOfRangeException at construction. - Document the new precondition in the XML comment. - Add ObjectPoolTests covering: factory null guard, maxSize bounds, Rent/Return basics, Return ignoring null, max-size enforcement, validator invocation and rejection, validator-as-reset, plus concurrent stress tests for cap enforcement and parallel use. * Validate Decycler maxDepth and add unit tests The Decycler<T> constructor previously accepted any maxDepth value. A value of 0 or below made the very first Enter throw DepthLimitExceeded, which presents as a cycle/depth error at use time instead of pointing at the construction site. - Reject maxDepth < 1 with ArgumentOutOfRangeException at construction. - Document the new precondition in the XML comment. - Add DecyclerTests covering: maxDepth bounds, Enter/Exit lifecycle, nested depth, cycle detection, depth-limit-exceeded, depth-vs-cycle ordering, no state mutation on failed Enter, Reset semantics, guard idempotency, MaxDepth/CurrentDepth properties, and a struct type other than int. * Add tests for CharacterToGlyphMap.AsReadOnlyDictionary Covers the IReadOnlyDictionary<int, ushort> view returned by AsReadOnlyDictionary, using the existing Inter font asset: - ContainsKey agrees with the underlying map for both mapped and unmapped code points. - Indexer returns the same glyph id as map.GetGlyph for several representative ASCII characters. - Indexer throws KeyNotFoundException for an unmapped code point. - TryGetValue: positive and negative paths. - Count is positive and matches the enumerated pair count. - Enumeration yields (key, value) pairs that round-trip through the underlying CharacterToGlyphMap. - Keys enumeration and pair-key enumeration agree. - Two AsReadOnlyDictionary() calls produce functionally equivalent views (no identity assumption). Tests live alongside the existing CharacterToGlyphMap tests in GlyphTypefaceTests so they can reuse the CustomPlatformTypeface helper. * Redesign FontVariationSettings; add GlyphDrawingOptions FontVariationSettings is changed from a public record to a sealed class with internal factory methods (FromCoordinates / FromInstance), a FrozenDictionary backing for NormalizedCoordinates, and structural Equals/GetHashCode. The type now exclusively models variable-font axis configuration; palette and bitmap-strike concerns are moved out. GlyphDrawingOptions is a new public sealed record that carries the drawing options that are independent of axis configuration: an optional CPAL palette index (≥ 0) and an optional bitmap-strike pixel size (≥ 1). Both properties validate at init time and the type participates in record-equality and with-expressions. Tests are added for both types (48 new assertions). * Make FontVariationSettings factories public FromCoordinates and FromInstance are promoted from internal to public. They were kept internal while the consuming public API was being designed; that design is now settled (GlyphTypeface.CreateVariationSettings / VariationAxes / VariationInstances, planned for PR2). Class-level remarks are updated to describe the typeface-agnostic design rationale and point to GlyphTypeface.CreateVariationSettings as the preferred entry point for user-space axis values. * Tighten contracts and docs on font-parsing infra Polish pass on the shared infrastructure types so the contract surface is unambiguous before PR2 (GetGlyphOutline) and PR3 (GetGlyphDrawing) build on it: - IGlyphDrawing now exposes GlyphDrawingType Type so callers can branch on format without downcasting. The GlyphDrawingType enum was already defined but unreferenced by the interface; this closes the loop. PR3's ColorGlyphDrawing and ColorGlyphV1Drawing already implement the property, so the rebase is a no-op. - IGlyphDrawing.Bounds and Draw(origin) get explicit coordinate-space docs (drawing-space, Y-down; origin is the post-flipped glyph anchor). - Decycler<T> gets a class-level remarks block stating it is not thread-safe (one instance per traversal) and that Enter throws on cycle / depth-limit so callers can catch at the outermost site. - FontVariationSettings.Default documents that null and Default are interchangeable for parameters typed as FontVariationSettings?. - ObjectPool.Return documents that callers must not return the same item twice without an intervening Rent — the pool does not detect duplicate returns by design. Tests: - ObjectPool: validator must not be invoked on Rent (pins the validate-on-return contract). - GlyphDrawingOptions: parameterless ctor equals Default (record equality should make them interchangeable). - FontVariationSettings: FromCoordinates with both coordinates AND instanceIndex populated (combined form documented in the API). 83 tests pass (was 76). * Reshape FontVariationSettings for cache-key use Switch from a class wrapping FrozenDictionary + nullable instance index to a readonly struct backed by a sorted ImmutableArray of a dedicated FontVariationCoordinate record-struct. Driven by the type's role as a field on FontCollectionKey: - Hash code is computed once at construction and cached. Lookups in the font-resolution cache no longer pay an OrderBy allocation per call. - Equality is a parallel walk over two sorted arrays — no hash lookup, no TryGetValue per element. Short-circuits on cached-hash mismatch. - TryGetCoordinate / GetCoordinateOrDefault are linear scans, faster than hash lookup for the typical handful-of-axes case. - default(FontVariationSettings) is the "no variation" value. The old Default singleton goes away; nullable-handling at the cache layer becomes unnecessary. - InstanceIndex is dropped from the type. Named-instance selection is a typeface-level concern that resolves to coordinates; the runtime settings carry coordinates only, matching CSS / HarfBuzz / DirectWrite conventions. Tests rewritten: 34 cases covering struct semantics, sorting, TryGetCoordinate, hash caching, equality short-circuits, and the FontVariationCoordinate record's own equality. * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix auto suggestion * Add synthetic-font test harness SyntheticFont / BigEndianBuffer build and mutate in-memory sfnt fonts so the table parsers can be exercised against hand-crafted malformed input without a platform shaper. Shared by every parser PR's malformed-font tests. * Characterize cmap/name/post degradation on malformed input Regression guards over the synthetic-font harness: a truncated post/name table degrades to defaults / a fallback family name instead of denying the font, the cmap format-12 nGroups12 overflow is clamped, and Format-4 selection prefers a Unicode subtable over Windows Symbol regardless of directory order. Fix dictionary wrapper contract, guard double-exit, and zero-coordinate canonicalization CharacterToGlyphMapDictionary mixed two membership predicates: Keys and Count filtered by ContainsGlyph while the indexer, TryGetValue and the enumerator used TryGetGlyph, so glyph-0 mappings produced keys the indexer rejected. Everything now answers through TryGetGlyph, and the Count walk (O(codepoints) over the mapped ranges) is computed once and cached. Decycler.Exit decremented the depth unconditionally: CycleGuard is a copyable ref struct, so a copied guard could exit the same id twice and grant later traversals extra depth budget. Depth is now only returned when the id was actually removed from the visited set. FontVariationSettings.FromCoordinates kept zero-valued coordinates, so an explicitly-default axis (wght=0 normalized) hashed and compared as a distinct value from settings omitting the axis - producing duplicate variation clones and font-collection cache entries downstream. Both factories now canonicalize zeros away (after the duplicate-axis check, which the dictionary overload previously skipped entirely). * Document the cmap dictionary view and tighten Decycler/ObjectPool internals Add XML docs to CharacterToGlyphMapDictionary's members. Collapse Decycler.Enter's Contains-then-Add into a single HashSet.Add (a false return means the id was already visited - a cycle). Make ObjectPool's lock-free count fast-check a volatile read. * Simplify FontVariationSettings.Equals to a span SequenceEqual Map the coordinate comparison onto the inner array via the span overload (Coordinates normalizes default to Empty, so both spans are valid). The span SequenceEqual avoids the boxing the LINQ overload would incur on this dictionary-key type, and FontVariationCoordinate's record-struct value equality drives the element compare. The cached-hash early-out is kept. * Add pre-allocation validation in NameTable.Load so malformed name tables are rejected before creating the names array. * Make PostTable.Load to catch only the malformed-data exception raised by this parsing path, instead of catching everything. * Raise ArgumentOutOfRangeException for negative count * Validate tableLength for CmapFormat12Or13Table ctor * Fixes GlyphDrawingOptions ArgumentOutOfRangeException nameof usage * Fix CmapFormat4Table ctor: clamp parallel-array offsets to tableLength When a malformed subtable declares a length that drives _segCount to 0, startCodeOffset = endCodeOffset + 02 + 2 (reservedPad) can exceed tableLength, causing Slice() to throw and denying the font entirely. Apply Math.Min(offset, tableLength) to each derived array offset so that zero-length slices always start at a valid position, degrading silently to an empty mapping instead of crashing. Revert change * Only handle specific exceptions in NameTable.Load Guard against negative count in BigEndianBuffer.Zeros * Speak user space in the public variation API Normalized coordinates are font-relative - the same value means different user positions under different fvar ranges and avar maps - so they cannot be authored in a style before font resolution and do not interpolate meaningfully. Every mainstream API (CSS font-variation-settings, DirectWrite, HarfBuzz, Skia) traffics in user-space values, and a public normalized type named like theirs invites passing wght=700 into a [-1,1] slot. - new public currency: FontVariation (tag=value in designer units) and an immutable FontVariationSettings with Parse/ToString ("wght=700,wdth=85"), order-independent structural equality, a cached hash, and CSS last-wins duplicate handling - usable as a style value and a cache key - the normalized pair moves out of public view: FontVariationCoordinate becomes internal NormalizedVariationCoordinate and the normalized settings struct becomes internal NormalizedVariationPosition, unchanged in behavior - the user-space -> normalized conversion stays a per-font, application- time concern; the fvar/avar reader lands in a follow-up PR * Accept infinite font variation values Infinities clamp to the axis range at apply time like any out-of-range value, so only NaN is rejected now. Parse also uses explicit number styles instead of NumberStyles.Float since the value text is pre-trimmed and the whitespace flags were redundant. * Guard NameRecord.GetValue against decoder exceptions The selected encodings use replacement fallback and never throw on malformed bytes, but degrade to an empty value anyway so an exception-throwing fallback can never deny the font. * Use nameof(value) in GlyphDrawingOptions setter exceptions Matches the .NET runtime convention for property setters, also used elsewhere in this repo (e.g. FormattedText). * Add GetGlyphOutline API with glyf/loca table parsing Implements vector outline retrieval for TrueType glyphs: - LocaTable: parses the 'loca' table (short/long offset variants) to map glyph IDs to glyf offsets - GlyfTable: parses the 'glyf' table, supporting simple and composite glyphs, and builds geometry into an IGeometryContext - SimpleGlyph / CompositeGlyph / GlyphDescriptor / GlyphComponent / GlyphFlag / CompositeFlags: data model for the parsed glyph records - GlyphDecycler: pooled cycle/depth guard for composite-glyph recursion (derives from the shared Decycler<int>) GlyphTypeface now eagerly loads the glyf table when a head table is present and exposes: Geometry? GetGlyphOutline(ushort glyphId, Matrix transform, FontVariationSettings? variation = null) Returns null when the font has no outline data for the glyph or the glyph index is out of range. * Drop variation parameter from GetGlyphOutline The FontVariationSettings? variation parameter was a forward-compat placeholder that was never wired through to the glyph parser. Remove it so the API doesn't advertise capability it doesn't have. Variable-font support will land as an instance-level concern on GlyphTypeface itself (mirroring how FontSimulations is already baked in at construction time), resolved through IFontCollection alongside FontWeight/Style/Stretch. Adding variation back as a per-call parameter would be additive at that point if a concrete need emerges. * Add unit tests for loca/glyf parsing Covers the glyph-outline parser that GetGlyphOutline builds on, exercised directly against the Inter test font without a platform render interface: - LocaTableTests: glyph-count parity with maxp, out-of-range handling, ascending ranges for every glyph, empty-glyph (space) zero-length range. - GlyfTableTests: TryGetGlyphData for out-of-range / empty / letter glyphs; TryBuildGlyphGeometry into a recording IGeometryContext for simple, empty, out-of-range and composite glyphs; transform application; closed- figure invariants. Tables are loaded via their internal factories and geometry is captured through a fake IGeometryContext, so the parser logic is tested in isolation. * Add glyph-outline render tests with Inter Variable Render-comparison coverage for GetGlyphOutline, drawing the returned Geometry filled in black on a white background and diffing against an expected PNG (RMSE, 2.2% tolerance, both immediate and compositor paths): - Should_Render_Inter_Latin_Glyph — Inter-Regular 'A' (simple glyph). - Should_Render_Inter_Composite_Glyph — Inter-Regular 'Á' (composite glyph: base + accent), exercises the recursive component path. - Should_Render_MiSans_CJK_Glyph — MiSans-Normal '中' (CJK ideograph, many contours / counters). - Should_Render_InterVariable_At_Default — new Inter Variable asset rendered at the default variation point. PR2 doesn't apply variation, so this baselines the default-instance outline against which the future variable-font work can compare deformed outputs. - Blank_Variable_Font_Returns_Null_Outline — AdobeBlank2VF (variable font with intentionally empty glyphs) verifies GetGlyphOutline returns null without throwing. Fonts are loaded via SKData.CreateCopy + SKTypeface.FromData so the typeface's lifetime survives the source stream's disposal. This also sidesteps a family-name collision: Inter-Regular and InterVariable both identify as family "Inter", so FontManager resolution would be ambiguous — direct loading targets each file unambiguously. InterVariable.ttf is added under Assets/ and picked up by the existing EmbeddedResource wildcard in both render-test projects. * Set non-zero fill rule on glyph outlines Avalonia geometries default to FillRule.EvenOdd. TrueType outlines expect the non-zero winding rule: where same-orientation contours overlap (an 'A' crossbar over its diagonal strokes, an accent over its base glyph in a composite), EvenOdd XORs the regions and leaves visible gaps. Setting the fill rule once on the outer context at the entry to TryBuildGlyphGeometry fills the geometry correctly, including through the composite path's TransformingGeometryContext wrapping (the wrapping applies to transforms, not to the geometry-level fill rule). Baselines for the three Inter glyphs were regenerated; the MiSans ideograph is unaffected because CJK strokes don't overlap. * Drop per-point debug logging from TransformingGeometryContext The glyph-outline transform wrapper logged every ArcTo / BeginFigure / CubicBezierTo / QuadraticBezierTo / LineTo / EndFigure / SetFillRule / Dispose call through Logger.TryGet(LogEventLevel.Debug, ...). That was useful while bringing up the glyf parser but runs a guard check per contour point on every glyph outline build — pure overhead now that the path is stable. Each method is back to a plain transform-and-delegate; Dispose is a no-op (the wrapper never owned the inner context). The exceptional-path warning in TryBuildGlyphGeometry (cyclic composite glyphs) is unrelated and stays. * Add InterVariable.ttf to Should_AddGlyphTypeface_By_Stream font list The glyph-outline render tests embed InterVariable.ttf under Avalonia.RenderTests/Assets, which the Skia unit-test project picks up via its `EmbeddedResource Include="..\Avalonia.RenderTests\Assets\*\.ttf"` glob. The asset enumeration therefore returns 16 fonts while the test's hard-coded `infos` list had 15, failing the count assertion. Add the missing entry in its ordinal-case-insensitive sort position (after Inter-Regular.ttf). Its production identity — FamilyName "Inter Variable", Weight Normal (the default fvar instance, usWeightClass 400) — is distinct from the "Inter" family of Inter-Regular/Inter-Bold, so the (family, weight) round-trip lookup stays unique. * Fix off-by-one glyph-id bounds check; drop unused usings GetGlyphOutline rejected out-of-range ids with `glyphId > GlyphCount`, which let the id equal to GlyphCount slip through — valid glyph ids are 0..GlyphCount-1, and reading at index GlyphCount walks past the end of the loca offsets. Use `>=` so the upper bound is excluded. Also remove unused using directives from the glyf parsers (CompositeGlyph, GlyfTable, GlyphDescriptor, SimpleGlyph). * Allocate batch glyph-metric buffers only when their source is present Batch TryGetGlyphMetrics unconditionally sized the hMetrics and vMetrics temporary buffers to glyphIds.Length even when the font has no hmtx or no vmtx. Most fonts ship no vmtx, so a large batch heap-allocated a per-glyph vertical-metric array that was never read. Size each buffer to zero — a free, empty stackalloc — when its source table is absent, so it only materialises (and only spills to the heap past 256 glyphs) when it will actually be filled and read. * Bail out of composite glyphs that use point matching A composite component with ARGS_ARE_XY_VALUES clear positions itself by point matching: arg1/arg2 are point indices, and the component is placed so one of its points coincides with a point in the already-assembled parent glyph. CreateComponentTransform only applied a translation when ARGS_ARE_XY_VALUES was set, so a point-matched component was rendered at zero translation — a visibly wrong outline. Point matching isn't implemented. Rather than emit an incorrect glyph, return false for any composite that uses it (checked before any geometry is emitted) so the caller falls back to "no outline". XY-value composites (the overwhelming common case, e.g. accented Latin letters) are unaffected. * Support composite glyph point matching Composite components with ARGS_ARE_XY_VALUES clear are positioned by aligning one of their points onto a point of the already-assembled glyph rather than by an x/y offset. The streaming build path cannot retain points, so route these (rare) composites through a new materialising path: resolve every component into a pooled buffer, apply the point-match translation, then emit the assembled contours. Out-of-range point indices, phantom-point references, and nested composite components bail out (no outline) rather than render incorrectly. Replaces the previous bail-out, and adds a synthetic-font test covering matched-point alignment and the bail-out cases. * Add point-matching composite render test No production font encodes composite point matching (ARGS_ARE_XY_VALUES clear) — verified across the Inter, Noto, Source, SIL (Gentium/Charis/Andika) and Oswald families, which all use x/y offsets. To exercise GlyfTable's point-matching path through the full Skia pipeline, this adds a small purpose-built fixture (PointMatch.ttf, 880 bytes) whose 'P' glyph is a composite: a base rectangle plus a square placed by point matching, aligning the square's bottom-left point onto the rectangle's top-right point. The baseline shows the square fused to the rectangle's top-right corner; a regression that mishandled point matching would drop it at the origin, which the image diff catches. * Add missing test font to the list of expected fonts in the Should_AddGlyphTypeface_By_Stream test * Return an immutable IGeometryImpl from GetGlyphOutline GetGlyphOutline(ushort, Matrix) returned a mutable StreamGeometry (an AvaloniaObject) with the transform baked in — neither cacheable (every pen position is a distinct geometry) nor safe to share. Reshape to GetGlyphOutline(ushort) returning design-unit-space geometry as an immutable IGeometryImpl (a small sealed wrapper that exposes only the read-only surface and can't be re-opened), so a single instance is safe to cache and share on the future glyph-run hot path. Callers apply scale/position via IGeometryImpl.WithTransform or a drawing-context transform, and draw through the existing DrawGeometry(IGeometryImpl) overload. * Add SyntheticFont harness self-tests Round-trip, table patch/replace/remove/truncate, and asset-load tests for the synthetic-font harness over Inter-Regular and InterVariable. * Reject non-monotonic contour endpoints in simple glyph parsing numPoints is derived from the last contour endpoint alone, so a glyph whose endPtsOfContours array is not strictly increasing sized its point buffers too small and sent every consumer walk indexing past them - an IndexOutOfRangeException on each outline build of that glyph. Validate the endpoints up front and return the default (empty) glyph instead. * Rename glyph-index parameters to glyphIndex / glyphIndices Review feedback on the glyph-outline API: the ushort values these members take are glyph indices, and the platform already speaks that language (GlyphRun.GlyphIndices), so the parameters say what they are instead of the looser glyphId/glyphIds. Applies to GetGlyphOutline and the advance/metrics members this series reworks, plus the tests exercising them. Purely a naming change - no call site uses named arguments. * Add failing tests for the off-curve contour walk The off-curve-start branch of the glyph walker drops one quadratic per extra point in runs of consecutive off-curve points and ignores an on-curve last point when picking the figure start. Pins the correct TrueType decomposition; the on-curve-start case is pinned as-is. * Unify the contour walkers into one EmitContour Both geometry emitters carried the same on-curve/off-curve branch pair, and the off-curve branch had two defects: it advanced past both points of an off-curve pair (dropping one quadratic per extra point in longer off-curve runs) and always started at the implied midpoint even when the last point of the contour is on-curve. One shared walker now does the TrueType decomposition with a pending-control state machine and an explicit close, and both the simple-glyph path and the point-matching composite path route every contour through it. * Add failing tests for truncated glyf and loca data The counts in a simple glyph header and in maxp are untrusted: a body shorter than they promise currently throws out of SimpleGlyph.Create, and a short loca table reports a glyph count it cannot index. * Degrade to an empty outline on truncated glyf/loca data SimpleGlyph.Create bounds-checks the endpoint array, the declared instruction run and every flag/coordinate read, returning default (and the rented buffers) instead of throwing when the body is shorter than its untrusted counts promise. LocaTable clamps its glyph count to the entries the table data actually covers, replacing an empty validation block that only claimed to handle short tables. * Name bit 6 of the simple glyph flags OVERLAP_SIMPLE The OpenType spec assigns bit 6 (0x40) OVERLAP_SIMPLE; only bit 7 is reserved. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Julien Lebosquain <julien@lebosquain.net>	2 weeks ago

Author

SHA1

Message

Date

Benedikt Stebner

b709c58c6b

[Text] Glyph Outline Part 2/13 - GlyphTypeface.GetGlyphOutline implementation (#21406 )

* Harden cmap/name/post parsing against malformed fonts

Fonts are untrusted input, but several pre-existing table parsers throw out
of the GlyphTypeface constructor on hostile data, denying the whole font
instead of degrading the affected (cosmetic) table.

- name: wrap NameTable.Load in try/catch so a malformed table falls back to a
default family name (same outcome as an absent name), and bounds-check
NameRecord.GetValue's (offset,length) slice — the record array is validated
at load but each record's storage slice is read later during construction.
- post: wrap PostTable.Load so a malformed cosmetic-hint table degrades to
defaults rather than denying the font.
- cmap format 12/13: clamp the declared length and group count to the buffer,
computing the group span in long to avoid the nGroups*12 int overflow a
hostile count would wrap to a negative slice length.
- cmap format 4 selection: score a Windows Symbol subtable worse than any
Unicode subtable so ASCII resolves regardless of subtable order, while a
Symbol-only font still selects its only subtable.

maxp/cmap remain fatal by design. Behavioural hardening only; public API
unchanged. Backportable independently of the glyph-outline stack.

* Clamp cmap range contents and harden binary reader primitives

Format 12/13 group contents are attacker-controlled: TryGetRange used to
hand the raw uint32 end straight to per-codepoint consumers, so a group
with endCharCode 0x7FFFFFFF turned range enumeration into an unbounded
(for int.MaxValue, non-terminating) loop. Clamp ranges to the Unicode
range and map inverted/out-of-range groups to empty ranges so later
groups still enumerate.

Give the format 4 constructor the same treatment its format 12 sibling
already received: clamp the declared length and segment count to what
the buffer actually holds instead of slicing unchecked (debug asserts
replaced by the clamps).

In BigEndianBinaryReader, bounds-check array reads before allocating
(a hostile length is rejected instead of attempting the allocation),
make EnsureAvailable overflow-proof, and clamp ReadBytes against
negative counts.

* Add font parsing infrastructure for glyph outline/color drawing

Introduces shared utility types that subsequent PRs will use to
implement GetGlyphOutline (glyf table) and GetGlyphDrawing
(COLR v0/v1) on GlyphTypeface:

- ObjectPool<T>: thread-safe object pool used by Decyclers
- Decycler<T> / CycleGuard<T> / DecyclerException: generic
cycle-detection and depth-limiting utility for recursive
font-table traversal (composite glyphs, paint graphs)
- FontVariationSettings: parameter type for the upcoming
GetGlyphOutline / GetGlyphDrawing overloads
- IGlyphDrawing / GlyphDrawingType: return-type contract for color
glyph drawings (outline, color layers, SVG, bitmap)
- CharacterToGlyphMapDictionary: lightweight, allocation-free
IReadOnlyDictionary<int, ushort> view over the cmap, plus
CharacterToGlyphMap.AsReadOnlyDictionary() to expose it

No behavior change; types are not yet consumed in this PR.

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Validate ObjectPool maxSize and add unit tests

The ObjectPool<T> constructor previously accepted any maxSize value.
A value of 0 or below silently caused every Return to be discarded,
which is hard to diagnose at the call site.

- Reject maxSize < 1 with ArgumentOutOfRangeException at construction.
- Document the new precondition in the XML comment.
- Add ObjectPoolTests covering: factory null guard, maxSize bounds,
Rent/Return basics, Return ignoring null, max-size enforcement,
validator invocation and rejection, validator-as-reset, plus
concurrent stress tests for cap enforcement and parallel use.

* Validate Decycler maxDepth and add unit tests

The Decycler<T> constructor previously accepted any maxDepth value.
A value of 0 or below made the very first Enter throw
DepthLimitExceeded, which presents as a cycle/depth error at use time
instead of pointing at the construction site.

- Reject maxDepth < 1 with ArgumentOutOfRangeException at construction.
- Document the new precondition in the XML comment.
- Add DecyclerTests covering: maxDepth bounds, Enter/Exit lifecycle,
nested depth, cycle detection, depth-limit-exceeded, depth-vs-cycle
ordering, no state mutation on failed Enter, Reset semantics,
guard idempotency, MaxDepth/CurrentDepth properties, and a struct
type other than int.

* Add tests for CharacterToGlyphMap.AsReadOnlyDictionary

Covers the IReadOnlyDictionary<int, ushort> view returned by
AsReadOnlyDictionary, using the existing Inter font asset:

- ContainsKey agrees with the underlying map for both mapped and
unmapped code points.
- Indexer returns the same glyph id as map.GetGlyph for several
representative ASCII characters.
- Indexer throws KeyNotFoundException for an unmapped code point.
- TryGetValue: positive and negative paths.
- Count is positive and matches the enumerated pair count.
- Enumeration yields (key, value) pairs that round-trip through the
underlying CharacterToGlyphMap.
- Keys enumeration and pair-key enumeration agree.
- Two AsReadOnlyDictionary() calls produce functionally equivalent
views (no identity assumption).

Tests live alongside the existing CharacterToGlyphMap tests in
GlyphTypefaceTests so they can reuse the CustomPlatformTypeface
helper.

* Redesign FontVariationSettings; add GlyphDrawingOptions

FontVariationSettings is changed from a public record to a sealed class
with internal factory methods (FromCoordinates / FromInstance), a
FrozenDictionary backing for NormalizedCoordinates, and structural
Equals/GetHashCode. The type now exclusively models variable-font axis
configuration; palette and bitmap-strike concerns are moved out.

GlyphDrawingOptions is a new public sealed record that carries the
drawing options that are independent of axis configuration: an optional
CPAL palette index (≥ 0) and an optional bitmap-strike pixel size (≥ 1).
Both properties validate at init time and the type participates in
record-equality and with-expressions.

Tests are added for both types (48 new assertions).

* Make FontVariationSettings factories public

FromCoordinates and FromInstance are promoted from internal to public.
They were kept internal while the consuming public API was being designed;
that design is now settled (GlyphTypeface.CreateVariationSettings /
VariationAxes / VariationInstances, planned for PR2).

Class-level remarks are updated to describe the typeface-agnostic design
rationale and point to GlyphTypeface.CreateVariationSettings as the
preferred entry point for user-space axis values.

* Tighten contracts and docs on font-parsing infra

Polish pass on the shared infrastructure types so the contract surface is
unambiguous before PR2 (GetGlyphOutline) and PR3 (GetGlyphDrawing) build
on it:

- IGlyphDrawing now exposes GlyphDrawingType Type so callers can branch
on format without downcasting. The GlyphDrawingType enum was already
defined but unreferenced by the interface; this closes the loop.
PR3's ColorGlyphDrawing and ColorGlyphV1Drawing already implement the
property, so the rebase is a no-op.
- IGlyphDrawing.Bounds and Draw(origin) get explicit coordinate-space
docs (drawing-space, Y-down; origin is the post-flipped glyph anchor).
- Decycler<T> gets a class-level remarks block stating it is not
thread-safe (one instance per traversal) and that Enter throws on
cycle / depth-limit so callers can catch at the outermost site.
- FontVariationSettings.Default documents that null and Default are
interchangeable for parameters typed as FontVariationSettings?.
- ObjectPool.Return documents that callers must not return the same
item twice without an intervening Rent — the pool does not detect
duplicate returns by design.

Tests:
- ObjectPool: validator must not be invoked on Rent (pins the
validate-on-return contract).
- GlyphDrawingOptions: parameterless ctor equals Default (record
equality should make them interchangeable).
- FontVariationSettings: FromCoordinates with both coordinates AND
instanceIndex populated (combined form documented in the API).

83 tests pass (was 76).

* Reshape FontVariationSettings for cache-key use

Switch from a class wrapping FrozenDictionary + nullable instance index
to a readonly struct backed by a sorted ImmutableArray of a dedicated
FontVariationCoordinate record-struct. Driven by the type's role as a
field on FontCollectionKey:

- Hash code is computed once at construction and cached. Lookups in the
font-resolution cache no longer pay an OrderBy allocation per call.
- Equality is a parallel walk over two sorted arrays — no hash lookup,
no TryGetValue per element. Short-circuits on cached-hash mismatch.
- TryGetCoordinate / GetCoordinateOrDefault are linear scans, faster
than hash lookup for the typical handful-of-axes case.
- default(FontVariationSettings) is the "no variation" value. The old
Default singleton goes away; nullable-handling at the cache layer
becomes unnecessary.
- InstanceIndex is dropped from the type. Named-instance selection is
a typeface-level concern that resolves to coordinates; the runtime
settings carry coordinates only, matching CSS / HarfBuzz / DirectWrite
conventions.

Tests rewritten: 34 cases covering struct semantics, sorting,
TryGetCoordinate, hash caching, equality short-circuits, and the
FontVariationCoordinate record's own equality.

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Fix auto suggestion

* Add synthetic-font test harness

SyntheticFont / BigEndianBuffer build and mutate in-memory sfnt fonts so the
table parsers can be exercised against hand-crafted malformed input without a
platform shaper. Shared by every parser PR's malformed-font tests.

* Characterize cmap/name/post degradation on malformed input

Regression guards over the synthetic-font harness: a truncated post/name table
degrades to defaults / a fallback family name instead of denying the font, the
cmap format-12 nGroups*12 overflow is clamped, and Format-4 selection prefers a
Unicode subtable over Windows Symbol regardless of directory order.

* Fix dictionary wrapper contract, guard double-exit, and zero-coordinate canonicalization

CharacterToGlyphMapDictionary mixed two membership predicates: Keys and
Count filtered by ContainsGlyph while the indexer, TryGetValue and the
enumerator used TryGetGlyph, so glyph-0 mappings produced keys the
indexer rejected. Everything now answers through TryGetGlyph, and the
Count walk (O(codepoints) over the mapped ranges) is computed once and
cached.

Decycler.Exit decremented the depth unconditionally: CycleGuard is a
copyable ref struct, so a copied guard could exit the same id twice and
grant later traversals extra depth budget. Depth is now only returned
when the id was actually removed from the visited set.

FontVariationSettings.FromCoordinates kept zero-valued coordinates, so
an explicitly-default axis (wght=0 normalized) hashed and compared as a
distinct value from settings omitting the axis - producing duplicate
variation clones and font-collection cache entries downstream. Both
factories now canonicalize zeros away (after the duplicate-axis check,
which the dictionary overload previously skipped entirely).

* Document the cmap dictionary view and tighten Decycler/ObjectPool internals

Add XML docs to CharacterToGlyphMapDictionary's members. Collapse
Decycler.Enter's Contains-then-Add into a single HashSet.Add (a false
return means the id was already visited - a cycle). Make ObjectPool's
lock-free count fast-check a volatile read.

* Simplify FontVariationSettings.Equals to a span SequenceEqual

Map the coordinate comparison onto the inner array via the span overload
(Coordinates normalizes default to Empty, so both spans are valid). The
span SequenceEqual avoids the boxing the LINQ overload would incur on
this dictionary-key type, and FontVariationCoordinate's record-struct
value equality drives the element compare. The cached-hash early-out is
kept.

* Add pre-allocation validation in NameTable.Load so malformed name tables are rejected before creating the names array.

* Make PostTable.Load to catch only the malformed-data exception raised by this parsing path, instead of catching everything.

* Raise ArgumentOutOfRangeException for negative count

* Validate tableLength for CmapFormat12Or13Table ctor

* Fixes GlyphDrawingOptions ArgumentOutOfRangeException nameof usage

* Fix CmapFormat4Table ctor: clamp parallel-array offsets to tableLength

When a malformed subtable declares a length that drives _segCount to 0,
startCodeOffset = endCodeOffset + 0*2 + 2 (reservedPad) can exceed
tableLength, causing Slice() to throw and denying the font entirely.

Apply Math.Min(offset, tableLength) to each derived array offset so that
zero-length slices always start at a valid position, degrading silently
to an empty mapping instead of crashing.

* Revert change

* Only handle specific exceptions in NameTable.Load
Guard against negative count in BigEndianBuffer.Zeros

* Speak user space in the public variation API

Normalized coordinates are font-relative - the same value means different
user positions under different fvar ranges and avar maps - so they cannot
be authored in a style before font resolution and do not interpolate
meaningfully. Every mainstream API (CSS font-variation-settings,
DirectWrite, HarfBuzz, Skia) traffics in user-space values, and a public
normalized type named like theirs invites passing wght=700 into a [-1,1]
slot.

- new public currency: FontVariation (tag=value in designer units) and an
immutable FontVariationSettings with Parse/ToString ("wght=700,wdth=85"),
order-independent structural equality, a cached hash, and CSS last-wins
duplicate handling - usable as a style value and a cache key
- the normalized pair moves out of public view: FontVariationCoordinate
becomes internal NormalizedVariationCoordinate and the normalized
settings struct becomes internal NormalizedVariationPosition, unchanged
in behavior
- the user-space -> normalized conversion stays a per-font, application-
time concern; the fvar/avar reader lands in a follow-up PR

* Accept infinite font variation values

Infinities clamp to the axis range at apply time like any out-of-range
value, so only NaN is rejected now. Parse also uses explicit number
styles instead of NumberStyles.Float since the value text is pre-trimmed
and the whitespace flags were redundant.

* Guard NameRecord.GetValue against decoder exceptions

The selected encodings use replacement fallback and never throw on
malformed bytes, but degrade to an empty value anyway so an
exception-throwing fallback can never deny the font.

* Use nameof(value) in GlyphDrawingOptions setter exceptions

Matches the .NET runtime convention for property setters, also used
elsewhere in this repo (e.g. FormattedText).

* Add GetGlyphOutline API with glyf/loca table parsing

Implements vector outline retrieval for TrueType glyphs:

- LocaTable: parses the 'loca' table (short/long offset variants)
to map glyph IDs to glyf offsets
- GlyfTable: parses the 'glyf' table, supporting simple and
composite glyphs, and builds geometry into an IGeometryContext
- SimpleGlyph / CompositeGlyph / GlyphDescriptor / GlyphComponent /
GlyphFlag / CompositeFlags: data model for the parsed glyph
records
- GlyphDecycler: pooled cycle/depth guard for composite-glyph
recursion (derives from the shared Decycler<int>)

GlyphTypeface now eagerly loads the glyf table when a head table is
present and exposes:

Geometry? GetGlyphOutline(ushort glyphId, Matrix transform,
FontVariationSettings? variation = null)

Returns null when the font has no outline data for the glyph or the
glyph index is out of range.

* Drop variation parameter from GetGlyphOutline

The FontVariationSettings? variation parameter was a forward-compat
placeholder that was never wired through to the glyph parser. Remove it
so the API doesn't advertise capability it doesn't have.

Variable-font support will land as an instance-level concern on
GlyphTypeface itself (mirroring how FontSimulations is already baked in
at construction time), resolved through IFontCollection alongside
FontWeight/Style/Stretch. Adding variation back as a per-call parameter
would be additive at that point if a concrete need emerges.

* Add unit tests for loca/glyf parsing

Covers the glyph-outline parser that GetGlyphOutline builds on, exercised
directly against the Inter test font without a platform render interface:

- LocaTableTests: glyph-count parity with maxp, out-of-range handling,
ascending ranges for every glyph, empty-glyph (space) zero-length range.
- GlyfTableTests: TryGetGlyphData for out-of-range / empty / letter glyphs;
TryBuildGlyphGeometry into a recording IGeometryContext for simple,
empty, out-of-range and composite glyphs; transform application; closed-
figure invariants.

Tables are loaded via their internal factories and geometry is captured
through a fake IGeometryContext, so the parser logic is tested in isolation.

* Add glyph-outline render tests with Inter Variable

Render-comparison coverage for GetGlyphOutline, drawing the returned
Geometry filled in black on a white background and diffing against an
expected PNG (RMSE, 2.2% tolerance, both immediate and compositor paths):

- Should_Render_Inter_Latin_Glyph — Inter-Regular 'A' (simple glyph).
- Should_Render_Inter_Composite_Glyph — Inter-Regular 'Á' (composite
glyph: base + accent), exercises the recursive component path.
- Should_Render_MiSans_CJK_Glyph — MiSans-Normal '中' (CJK ideograph,
many contours / counters).
- Should_Render_InterVariable_At_Default — new Inter Variable asset
rendered at the default variation point. PR2 doesn't apply variation,
so this baselines the default-instance outline against which the
future variable-font work can compare deformed outputs.
- Blank_Variable_Font_Returns_Null_Outline — AdobeBlank2VF (variable
font with intentionally empty glyphs) verifies GetGlyphOutline returns
null without throwing.

Fonts are loaded via SKData.CreateCopy + SKTypeface.FromData so the
typeface's lifetime survives the source stream's disposal. This also
sidesteps a family-name collision: Inter-Regular and InterVariable both
identify as family "Inter", so FontManager resolution would be
ambiguous — direct loading targets each file unambiguously.

InterVariable.ttf is added under Assets/ and picked up by the existing
EmbeddedResource wildcard in both render-test projects.

* Set non-zero fill rule on glyph outlines

Avalonia geometries default to FillRule.EvenOdd. TrueType outlines
expect the non-zero winding rule: where same-orientation contours
overlap (an 'A' crossbar over its diagonal strokes, an accent over its
base glyph in a composite), EvenOdd XORs the regions and leaves visible
gaps. Setting the fill rule once on the outer context at the entry to
TryBuildGlyphGeometry fills the geometry correctly, including through
the composite path's TransformingGeometryContext wrapping (the
wrapping applies to transforms, not to the geometry-level fill rule).

Baselines for the three Inter glyphs were regenerated; the MiSans
ideograph is unaffected because CJK strokes don't overlap.

* Drop per-point debug logging from TransformingGeometryContext

The glyph-outline transform wrapper logged every ArcTo / BeginFigure /
CubicBezierTo / QuadraticBezierTo / LineTo / EndFigure / SetFillRule /
Dispose call through Logger.TryGet(LogEventLevel.Debug, ...). That was
useful while bringing up the glyf parser but runs a guard check per
contour point on every glyph outline build — pure overhead now that the
path is stable. Each method is back to a plain transform-and-delegate;
Dispose is a no-op (the wrapper never owned the inner context).

The exceptional-path warning in TryBuildGlyphGeometry (cyclic composite
glyphs) is unrelated and stays.

* Add InterVariable.ttf to Should_AddGlyphTypeface_By_Stream font list

The glyph-outline render tests embed InterVariable.ttf under
Avalonia.RenderTests/Assets, which the Skia unit-test project picks up
via its `EmbeddedResource Include="..\Avalonia.RenderTests\Assets\**\*.ttf"`
glob. The asset enumeration therefore returns 16 fonts while the test's
hard-coded `infos` list had 15, failing the count assertion.

Add the missing entry in its ordinal-case-insensitive sort position
(after Inter-Regular.ttf). Its production identity — FamilyName
"Inter Variable", Weight Normal (the default fvar instance, usWeightClass
400) — is distinct from the "Inter" family of Inter-Regular/Inter-Bold,
so the (family, weight) round-trip lookup stays unique.

* Fix off-by-one glyph-id bounds check; drop unused usings

GetGlyphOutline rejected out-of-range ids with `glyphId > GlyphCount`,
which let the id equal to GlyphCount slip through — valid glyph ids are
0..GlyphCount-1, and reading at index GlyphCount walks past the end of
the loca offsets. Use `>=` so the upper bound is excluded.

Also remove unused using directives from the glyf parsers
(CompositeGlyph, GlyfTable, GlyphDescriptor, SimpleGlyph).

* Allocate batch glyph-metric buffers only when their source is present

Batch TryGetGlyphMetrics unconditionally sized the hMetrics and vMetrics
temporary buffers to glyphIds.Length even when the font has no hmtx or no
vmtx. Most fonts ship no vmtx, so a large batch heap-allocated a per-glyph
vertical-metric array that was never read.

Size each buffer to zero — a free, empty stackalloc — when its source
table is absent, so it only materialises (and only spills to the heap
past 256 glyphs) when it will actually be filled and read.

* Bail out of composite glyphs that use point matching

A composite component with ARGS_ARE_XY_VALUES clear positions itself by
point matching: arg1/arg2 are point indices, and the component is placed
so one of its points coincides with a point in the already-assembled
parent glyph. CreateComponentTransform only applied a translation when
ARGS_ARE_XY_VALUES was set, so a point-matched component was rendered at
zero translation — a visibly wrong outline.

Point matching isn't implemented. Rather than emit an incorrect glyph,
return false for any composite that uses it (checked before any geometry
is emitted) so the caller falls back to "no outline". XY-value composites
(the overwhelming common case, e.g. accented Latin letters) are
unaffected.

* Support composite glyph point matching

Composite components with ARGS_ARE_XY_VALUES clear are positioned by aligning one of their points onto a point of the already-assembled glyph rather than by an x/y offset. The streaming build path cannot retain points, so route these (rare) composites through a new materialising path: resolve every component into a pooled buffer, apply the point-match translation, then emit the assembled contours.

Out-of-range point indices, phantom-point references, and nested composite components bail out (no outline) rather than render incorrectly. Replaces the previous bail-out, and adds a synthetic-font test covering matched-point alignment and the bail-out cases.

* Add point-matching composite render test

No production font encodes composite point matching (ARGS_ARE_XY_VALUES clear) — verified across the Inter, Noto, Source, SIL (Gentium/Charis/Andika) and Oswald families, which all use x/y offsets. To exercise GlyfTable's point-matching path through the full Skia pipeline, this adds a small purpose-built fixture (PointMatch.ttf, 880 bytes) whose 'P' glyph is a composite: a base rectangle plus a square placed by point matching, aligning the square's bottom-left point onto the rectangle's top-right point.

The baseline shows the square fused to the rectangle's top-right corner; a regression that mishandled point matching would drop it at the origin, which the image diff catches.

* Add missing test font to the list of expected fonts in the Should_AddGlyphTypeface_By_Stream test

* Return an immutable IGeometryImpl from GetGlyphOutline

GetGlyphOutline(ushort, Matrix) returned a mutable StreamGeometry (an AvaloniaObject) with the transform baked in — neither cacheable (every pen position is a distinct geometry) nor safe to share. Reshape to GetGlyphOutline(ushort) returning design-unit-space geometry as an immutable IGeometryImpl (a small sealed wrapper that exposes only the read-only surface and can't be re-opened), so a single instance is safe to cache and share on the future glyph-run hot path. Callers apply scale/position via IGeometryImpl.WithTransform or a drawing-context transform, and draw through the existing DrawGeometry(IGeometryImpl) overload.

* Add SyntheticFont harness self-tests

Round-trip, table patch/replace/remove/truncate, and asset-load tests for the
synthetic-font harness over Inter-Regular and InterVariable.

* Reject non-monotonic contour endpoints in simple glyph parsing

numPoints is derived from the last contour endpoint alone, so a glyph
whose endPtsOfContours array is not strictly increasing sized its point
buffers too small and sent every consumer walk indexing past them - an
IndexOutOfRangeException on each outline build of that glyph. Validate
the endpoints up front and return the default (empty) glyph instead.

* Rename glyph-index parameters to glyphIndex / glyphIndices

Review feedback on the glyph-outline API: the ushort values these members
take are glyph indices, and the platform already speaks that language
(GlyphRun.GlyphIndices), so the parameters say what they are instead of
the looser glyphId/glyphIds. Applies to GetGlyphOutline and the
advance/metrics members this series reworks, plus the tests exercising
them. Purely a naming change - no call site uses named arguments.

* Add failing tests for the off-curve contour walk

The off-curve-start branch of the glyph walker drops one quadratic per
extra point in runs of consecutive off-curve points and ignores an
on-curve last point when picking the figure start. Pins the correct
TrueType decomposition; the on-curve-start case is pinned as-is.

* Unify the contour walkers into one EmitContour

Both geometry emitters carried the same on-curve/off-curve branch pair,
and the off-curve branch had two defects: it advanced past both points
of an off-curve pair (dropping one quadratic per extra point in longer
off-curve runs) and always started at the implied midpoint even when
the last point of the contour is on-curve. One shared walker now does
the TrueType decomposition with a pending-control state machine and an
explicit close, and both the simple-glyph path and the point-matching
composite path route every contour through it.

* Add failing tests for truncated glyf and loca data

The counts in a simple glyph header and in maxp are untrusted: a body
shorter than they promise currently throws out of SimpleGlyph.Create,
and a short loca table reports a glyph count it cannot index.

* Degrade to an empty outline on truncated glyf/loca data

SimpleGlyph.Create bounds-checks the endpoint array, the declared
instruction run and every flag/coordinate read, returning default (and
the rented buffers) instead of throwing when the body is shorter than
its untrusted counts promise. LocaTable clamps its glyph count to the
entries the table data actually covers, replacing an empty validation
block that only claimed to handle short tables.

* Name bit 6 of the simple glyph flags OVERLAP_SIMPLE

The OpenType spec assigns bit 6 (0x40) OVERLAP_SIMPLE; only bit 7 is
reserved.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Julien Lebosquain <julien@lebosquain.net>

2 weeks ago

1 Commits (main)