oxideav-otf 0.1.3

//! CFF (Compact Font Format) parser — Adobe Technical Note #5176.
//!
//! The CFF table is a self-contained mini-container with its own
//! offset-style header, a small set of "INDEX" arrays (Name, Top
//! DICT, String, Global Subrs), per-font Top DICT entries, a
//! charset, an encoding, a CharStrings INDEX (one Type 2 charstring
//! per glyph), one or more Private DICTs, and Local Subr INDEXes.
//!
//! This module is split into one file per substructure to keep each
//! one short and individually testable. Top-level dispatch (parsing
//! the whole table into a `Cff` struct that the public `Font` API
//! holds) lives in [`Cff::parse`] below.
//!
//! Public surface from this module is re-exported through
//! `crate::lib::CubicOutline` etc. — callers don't usually need to
//! reach into `cff::*` directly.

pub mod charset;
pub mod charstring;
pub mod dict;
pub mod encoding;
pub mod fdselect;
pub mod header;
pub mod index;
pub mod private;
pub mod strings;
pub mod subrs;

use crate::outline::CubicOutline;
use crate::Error;

use self::charset::Charset;
use self::charstring::Interpreter;
use self::dict::{Dict, Operand, Operator};
use self::encoding::Encoding;
use self::fdselect::FdSelect;
use self::header::CffHeader;
use self::index::Index;
use self::private::PrivateDict;
pub use self::private::PrivateHints;
use self::strings::Strings;

/// CFF Top DICT metadata surfaced for callers.
///
/// All fields are pre-extracted from the Top DICT during `Cff::parse`
/// and cached here so accessors are O(1). String fields are SID
/// indices resolved through the CFF Strings table at lookup time.
#[derive(Debug, Clone, Default)]
pub struct TopMetadata {
    /// `FontBBox` (Top DICT op 5) — font-wide bounding box covering
    /// every glyph, in font-unit coordinates. Per TN5176 §9 the
    /// default is `[0 0 0 0]` (which is itself a sentinel meaning
    /// "consumer should compute the actual bbox from the glyph
    /// outlines").
    pub font_bbox: [f32; 4],
    /// `ItalicAngle` (Top DICT op 12 02), in degrees counterclockwise
    /// from vertical. `0.0` for upright fonts. Default: 0.
    pub italic_angle: f64,
    /// `UnderlinePosition` (Top DICT op 12 03), in font units. Default:
    /// -100 per TN5176 §9.
    pub underline_position: f64,
    /// `UnderlineThickness` (Top DICT op 12 04), in font units.
    /// Default: 50 per TN5176 §9.
    pub underline_thickness: f64,
    /// `isFixedPitch` (Top DICT op 12 01): true if the font is
    /// monospaced. Default: false.
    pub is_fixed_pitch: bool,
    /// `FontMatrix` (Top DICT op 12 07) — six-element affine matrix
    /// `[a, b, c, d, tx, ty]` mapping glyph-space coordinates into
    /// PostScript user space. Per TN5176 §9 Table 9 the spec default
    /// is `[0.001 0 0 0.001 0 0]` (i.e. the upem == 1000 convention
    /// that maps a 1000-unit em into a 1.0-unit user-space em).
    /// Application: `x_user = a*x + c*y + tx`,
    /// `y_user = b*x + d*y + ty` — the standard PostScript /
    /// PDF convention.
    pub font_matrix: [f64; 6],
    /// `PaintType` (Top DICT op 12 05) — 0 for a filled outline (the
    /// usual case), 2 for a stroked outline whose pen width is
    /// `StrokeWidth`. Default: 0. (Type 1 also defines 1 = outlined
    /// fill, deprecated; the CFF spec only lists 0 and 2.)
    pub paint_type: i32,
    /// `CharstringType` (Top DICT op 12 06) — 2 for Type 2
    /// charstrings (the only kind embedded in OpenType CFF tables),
    /// other values for legacy PostScript packaging. Default: 2.
    pub charstring_type: i32,
    /// `StrokeWidth` (Top DICT op 12 08) — pen width applied when
    /// `PaintType == 2`, in font units. Default: 0. Ignored when the
    /// font is filled (`PaintType == 0`).
    pub stroke_width: f64,

    // --- SID-valued string operators -----------------------------------
    /// `Notice` (Top DICT op 1) — copyright / trademark notice. SID.
    pub notice_sid: Option<u16>,
    /// `Copyright` (Top DICT op 12 00) — extended copyright field. SID.
    pub copyright_sid: Option<u16>,
    /// `Version` (Top DICT op 0) — version string. SID.
    pub version_sid: Option<u16>,
    /// `FullName` (Top DICT op 2). SID.
    pub full_name_sid: Option<u16>,
    /// `FamilyName` (Top DICT op 3). SID.
    pub family_name_sid: Option<u16>,
    /// `Weight` (Top DICT op 4) — e.g. "Regular", "Bold". SID.
    pub weight_sid: Option<u16>,
    /// `PostScript` (Top DICT op 12 21) — embedded PostScript language
    /// code (TN5176 §9 Table 10). Per spec the value is "a SID whose
    /// referenced string contains arbitrary PostScript code that is
    /// added to the font dictionary"; almost never present in shipping
    /// OpenType-CFF fonts but spec-defined and surfaced here so callers
    /// inspecting unusual fonts don't have to detour through the raw
    /// Top DICT. SID.
    pub postscript_sid: Option<u16>,
    /// `BaseFontName` (Top DICT op 12 22) — for synthetic fonts derived
    /// from a multiple-master master, the FontName of the underlying
    /// master font (TN5176 §9 Table 10). SID.
    pub base_font_name_sid: Option<u16>,

    // --- Identity operators ---------------------------------------------
    /// `UniqueID` (Top DICT op 13) — legacy PostScript Type 1 unique
    /// identifier number assigned by Adobe (TN5176 §9 Table 9). Modern
    /// CFF fonts prefer `XUID`; many recent OpenType-CFF fonts omit
    /// `UniqueID` entirely.
    pub unique_id: Option<i32>,
    /// `XUID` (Top DICT op 14) — extended unique identifier, an array
    /// of 32-bit numbers (TN5176 §9 Table 9). Deprecated in OpenType
    /// CFF per Adobe TN5176 4 Dec 03 Appendix H but still emitted by
    /// older Type 1 / OpenType-CFF font tooling. Returned in spec
    /// (parse) order; an empty vector indicates the operator was
    /// absent.
    pub xuid: Vec<i32>,
    /// `SyntheticBase` (Top DICT op 12 20) — for synthetic fonts (i.e.
    /// fonts that derive their glyph shapes from another font by some
    /// transformation), the index in the Name INDEX of the base font
    /// (TN5176 §9 Table 10). Almost never present in shipping
    /// OpenType-CFF fonts because OpenType packaging is one-font-per-CFF.
    pub synthetic_base: Option<i32>,
    /// `BaseFontBlend` (Top DICT op 12 23) — for synthetic fonts
    /// derived from a multiple-master font, the User Design Vector
    /// (a delta-encoded list of numbers, TN5176 §9 Table 10). Returned
    /// undeltified into absolute values per TN5176 §15 / Table 4 "delta"
    /// type semantics — each successive entry is the running sum of all
    /// raw operands up to and including itself. An empty vector
    /// indicates the operator was absent.
    pub base_font_blend: Vec<f64>,
}

/// CID-keyed font registry/ordering/supplement, from the Top DICT
/// `ROS` operator (TN5176 Table 10, op 12 30). Identifies the
/// character collection the font's CIDs index into — e.g.
/// `Adobe-Japan1-7` is `registry = "Adobe"`, `ordering = "Japan1"`,
/// `supplement = 7`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RegistryOrdering {
    /// Registry SID (resolves through the CFF Strings table — usually
    /// `"Adobe"`).
    pub registry_sid: u16,
    /// Ordering SID (e.g. `"Japan1"`, `"GB1"`, `"Identity"`).
    pub ordering_sid: u16,
    /// Supplement number — increments as glyphs are added to the
    /// character collection.
    pub supplement: i32,
}

/// Whether a CFF is a plain (single Private DICT) font or a CID-keyed
/// font whose glyphs are partitioned across an FDArray of Font DICTs
/// (TN5176 §18). The two cases differ only in how a glyph's
/// Private-DICT context (Local Subrs + width defaults) is located.
#[derive(Debug, Clone)]
enum FontKind<'a> {
    /// Non-CID font: one Top-level Private DICT for every glyph.
    /// Boxed so the variants stay similar in size (the `Cid` arm holds
    /// a `Vec` + `FdSelect` + `RegistryOrdering`).
    NonCid(Box<PrivateDict<'a>>),
    /// CID-keyed font: each glyph picks its Font DICT via the
    /// FDSelect map, and each Font DICT carries its own Private DICT.
    Cid {
        /// Per-FD Private DICTs, parsed from the FDArray Font DICT
        /// INDEX. Indexed by the FD index from `fd_select`.
        fd_array: Vec<PrivateDict<'a>>,
        /// GID → FD-index map (TN5176 §19).
        fd_select: FdSelect<'a>,
        /// Registry / Ordering / Supplement from the `ROS` operator.
        ros: RegistryOrdering,
    },
}

/// Parsed CFF table — supports both single-font (one Private DICT)
/// CFF and CID-keyed CFF (FDArray / FDSelect, TN5176 §18). The
/// multi-font Name INDEX form is legacy PostScript packaging and not
/// produced by OpenType.
#[derive(Debug, Clone)]
pub struct Cff<'a> {
    /// Original CFF table bytes — every offset in CFF is relative to
    /// the start of the table, so we keep the slice around for
    /// follow-up subroutine / charstring lookups.
    bytes: &'a [u8],

    /// PostScript font name from the Name INDEX (single-font: just
    /// the first entry).
    name: &'a [u8],

    /// All strings (standard + custom). SIDs index into this.
    strings: Strings<'a>,

    /// Global subroutines INDEX — shared by every font in a CFF set;
    /// for our single-font case it's just "the global subrs".
    global_subrs: Index<'a>,

    /// CharStrings INDEX — entry `gid` is the Type 2 charstring for
    /// glyph `gid`.
    charstrings: Index<'a>,

    /// Charset map: gid → SID. `gid == 0` is always `.notdef`; the
    /// charset table only stores `gid >= 1`.
    charset: Charset<'a>,

    /// Encoding map: codepoint → gid (only useful as a fallback —
    /// real OpenType fonts route through the sfnt `cmap` table).
    encoding: Encoding<'a>,

    /// How this font locates a glyph's Private DICT: a single
    /// top-level Private DICT (non-CID) or a per-glyph FDArray /
    /// FDSelect routing (CID-keyed, TN5176 §18).
    kind: FontKind<'a>,

    /// Pre-extracted Top DICT metadata.
    top: TopMetadata,
}

impl<'a> Cff<'a> {
    /// Parse the contents of a `CFF ` (TN5176, version 1) table.
    pub fn parse(bytes: &'a [u8]) -> Result<Self, Error> {
        let header = CffHeader::parse(bytes)?;
        // Per spec, Name INDEX immediately follows the header.
        let mut cursor = header.size as usize;

        let name_index = Index::parse(bytes, cursor)?;
        cursor = name_index.end;
        if name_index.count == 0 {
            return Err(Error::Cff("empty Name INDEX"));
        }
        // Single-font CFF: just take entry 0.
        let name = name_index.entry(0)?;

        let top_index = Index::parse(bytes, cursor)?;
        cursor = top_index.end;
        if top_index.count != name_index.count {
            return Err(Error::Cff("Top DICT INDEX count mismatch"));
        }
        let top_bytes = top_index.entry(0)?;
        let top_dict = Dict::parse(top_bytes)?;

        let string_index = Index::parse(bytes, cursor)?;
        cursor = string_index.end;
        let strings = Strings::new(string_index);

        let global_subrs = Index::parse(bytes, cursor)?;
        // We deliberately don't advance `cursor` past Global Subrs —
        // every subsequent table is referenced by absolute offset
        // from Top DICT.

        // CharStrings: required, offset operator 17.
        let cs_off = top_dict
            .get_int(Operator::CharStrings)
            .ok_or(Error::Cff("Top DICT missing CharStrings offset"))?;
        if cs_off < 0 {
            return Err(Error::Cff("negative CharStrings offset"));
        }
        let charstrings = Index::parse(bytes, cs_off as usize)?;

        // Charset: optional offset operator 15. 0 = ISOAdobe (predefined),
        // 1 = Expert (predefined), 2 = ExpertSubset (predefined), >=3 =
        // custom offset into the table.
        let charset_off = top_dict.get_int(Operator::Charset).unwrap_or(0);
        let charset = Charset::parse(bytes, charset_off, charstrings.count)?;

        // Encoding: optional offset operator 16. 0 = Standard, 1 =
        // Expert, >=2 = custom offset. CID fonts omit Encoding
        // entirely (TN5176 §18) — `Encoding::parse(0)` then yields the
        // (unused) Standard encoding, which is harmless because CID
        // lookups never route through it.
        let encoding_off = top_dict.get_int(Operator::Encoding).unwrap_or(0);
        let encoding = Encoding::parse(bytes, encoding_off)?;

        // A CID-keyed font begins with the ROS operator (TN5176 §18 /
        // Table 10). When present, the font has no top-level Private
        // DICT; instead each glyph selects a Font DICT via FDSelect,
        // and each Font DICT in the FDArray carries its own Private
        // DICT. Detect CID by the presence of ROS.
        let kind = if let Some(ros) = parse_ros(&top_dict)? {
            // FDArray: offset to a Font DICT INDEX (op 12 36).
            let fd_array_off = top_dict
                .get_int(Operator::FdArray)
                .ok_or(Error::Cff("CIDFont missing FDArray"))?;
            if fd_array_off < 0 {
                return Err(Error::Cff("negative FDArray offset"));
            }
            let fd_index = Index::parse(bytes, fd_array_off as usize)?;
            let mut fd_array = Vec::with_capacity(fd_index.count as usize);
            for i in 0..fd_index.count {
                let fd_bytes = fd_index.entry(i)?;
                let fd_dict = Dict::parse(fd_bytes)?;
                // Each Font DICT carries a Private operator pointing at
                // its own Private DICT (TN5176 §18).
                let priv_dict = parse_private_from_dict(bytes, &fd_dict)?
                    .ok_or(Error::Cff("CIDFont Font DICT missing Private"))?;
                fd_array.push(priv_dict);
            }
            if fd_array.is_empty() {
                return Err(Error::Cff("CIDFont FDArray is empty"));
            }

            // FDSelect: offset to the GID → FD-index map (op 12 37).
            let fd_select_off = top_dict
                .get_int(Operator::FdSelect)
                .ok_or(Error::Cff("CIDFont missing FDSelect"))?;
            if fd_select_off < 0 {
                return Err(Error::Cff("negative FDSelect offset"));
            }
            let fd_select = FdSelect::parse(bytes, fd_select_off as usize, charstrings.count)?;

            FontKind::Cid {
                fd_array,
                fd_select,
                ros,
            }
        } else {
            // Non-CID font: required top-level Private DICT.
            let private = parse_private_from_dict(bytes, &top_dict)?
                .ok_or(Error::Cff("Top DICT missing Private"))?;
            FontKind::NonCid(Box::new(private))
        };

        let top = extract_top_metadata(&top_dict);

        Ok(Self {
            bytes,
            name,
            strings,
            global_subrs,
            charstrings,
            charset,
            encoding,
            kind,
            top,
        })
    }

    /// Borrow the extracted Top DICT metadata (FontBBox, italic
    /// angle, underline metrics, fixed-pitch flag, name SIDs).
    pub fn top_metadata(&self) -> &TopMetadata {
        &self.top
    }

    /// Resolve a Top DICT string operator's SID to its actual string,
    /// looked up through the CFF Strings table.
    pub(crate) fn resolve_sid(&self, sid: u16) -> Option<&str> {
        self.strings.get(sid)
    }

    /// Number of glyphs (== CharStrings INDEX count).
    pub fn glyph_count(&self) -> u16 {
        // Practical fonts cap at u16; CFF technically allows u32 but
        // OpenType bolts a u16 maxp.numGlyphs on top, so we mirror.
        self.charstrings.count.min(u16::MAX as u32) as u16
    }

    /// PostScript font name (typically ASCII, but spec allows any
    /// printable bytes other than `[(){}<>/%`).
    pub fn ps_name(&self) -> &'a [u8] {
        self.name
    }

    /// Look up a glyph id by codepoint via the CFF Encoding (legacy
    /// PostScript path — most callers should route through the sfnt
    /// `cmap` table instead).
    pub fn encoding_lookup(&self, codepoint: u8) -> Option<u16> {
        self.encoding
            .lookup(codepoint, &self.charset, &self.strings)
    }

    /// Resolve the Private DICT context (Local Subrs + width
    /// defaults) for `gid`. For non-CID fonts this is the single
    /// top-level Private DICT; for CID fonts it is the per-glyph Font
    /// DICT selected through FDSelect → FDArray (TN5176 §§18, 19).
    fn private_for(&self, gid: u16) -> Result<&PrivateDict<'a>, Error> {
        match &self.kind {
            FontKind::NonCid(p) => Ok(p),
            FontKind::Cid {
                fd_array,
                fd_select,
                ..
            } => {
                let fd = fd_select
                    .fd_index(gid)
                    .ok_or(Error::Cff("FDSelect has no entry for glyph"))?;
                fd_array
                    .get(fd as usize)
                    .ok_or(Error::Cff("FDSelect FD index out of FDArray range"))
            }
        }
    }

    /// Decode the Type 2 charstring for `gid` into a cubic-Bezier
    /// outline.
    pub fn glyph_outline(&self, gid: u16) -> Result<CubicOutline, Error> {
        let gid_u = gid as u32;
        if gid_u >= self.charstrings.count {
            return Err(Error::GlyphOutOfRange(gid));
        }
        let private = self.private_for(gid)?;
        let cs = self.charstrings.entry(gid_u)?;
        let mut interp = Interpreter::new(
            &self.global_subrs,
            private.local_subrs.as_ref(),
            private.nominal_width_x,
            private.default_width_x,
        )
        .with_seac_resolver(&self.charstrings, &self.charset);
        interp.run(cs)?;
        let mut outline = interp.into_outline();
        outline.recompute_bounds();
        Ok(outline)
    }

    /// `true` if this is a CID-keyed CFF font (carries a `ROS`
    /// operator + FDArray / FDSelect, TN5176 §18).
    pub fn is_cid(&self) -> bool {
        matches!(self.kind, FontKind::Cid { .. })
    }

    /// Registry / Ordering / Supplement of a CID-keyed font (the `ROS`
    /// operator). `None` for non-CID fonts.
    pub fn registry_ordering(&self) -> Option<&RegistryOrdering> {
        match &self.kind {
            FontKind::Cid { ros, .. } => Some(ros),
            FontKind::NonCid(_) => None,
        }
    }

    /// Number of Font DICTs in the FDArray of a CID-keyed font.
    /// `0` for non-CID fonts.
    pub fn fd_count(&self) -> usize {
        match &self.kind {
            FontKind::Cid { fd_array, .. } => fd_array.len(),
            FontKind::NonCid(_) => 0,
        }
    }

    /// PostScript-style hint zones (TN5176 §15 Table 23) attached to
    /// the *first* Private DICT this CFF carries — for non-CID fonts
    /// that is the unique top-level Private DICT (every glyph shares
    /// it); for CID-keyed fonts it is the Font DICT at FDArray index
    /// `0`. Callers that need per-FD hints on a CID-keyed font should
    /// use [`Cff::private_hints_fd`].
    pub fn private_hints(&self) -> &PrivateHints {
        match &self.kind {
            FontKind::NonCid(p) => &p.hints,
            FontKind::Cid { fd_array, .. } => &fd_array[0].hints,
        }
    }

    /// Per-FD hint zones for a CID-keyed font's FDArray entry `fd_index`
    /// (TN5176 §18 routes each glyph through `FDSelect` to one of these
    /// Font DICTs, and each Font DICT carries its own Private DICT).
    /// Returns `None` for a non-CID font (use [`Cff::private_hints`]
    /// instead) or when `fd_index >= self.fd_count()`.
    pub fn private_hints_fd(&self, fd_index: usize) -> Option<&PrivateHints> {
        match &self.kind {
            FontKind::Cid { fd_array, .. } => fd_array.get(fd_index).map(|p| &p.hints),
            FontKind::NonCid(_) => None,
        }
    }

    /// Hint zones of the Private DICT that applies to `gid` — non-CID
    /// fonts return the single Private DICT, CID-keyed fonts route
    /// through `FDSelect` to the correct Font DICT (TN5176 §19).
    /// Returns `None` if `gid` falls outside the FDSelect range on a
    /// CID-keyed font (always succeeds for non-CID fonts).
    pub fn private_hints_for_glyph(&self, gid: u16) -> Option<&PrivateHints> {
        self.private_for(gid).ok().map(|p| &p.hints)
    }

    /// Borrowed CFF table bytes (mostly useful for diagnostics).
    pub fn bytes(&self) -> &'a [u8] {
        self.bytes
    }

    /// Borrow the strings table (used by the higher-level glyph-name
    /// accessors on `Font`).
    pub(crate) fn strings(&self) -> &Strings<'a> {
        &self.strings
    }

    /// Borrow the charset (used to resolve glyph names by gid).
    pub(crate) fn charset(&self) -> &Charset<'a> {
        &self.charset
    }
}

/// Parse the `ROS` operator (TN5176 Table 10, op 12 30) from a Top
/// DICT. Returns `Ok(None)` for a non-CID font (no ROS present) and
/// `Ok(Some(..))` for a CID font. `ROS` carries three operands:
/// `registry_SID ordering_SID supplement` — the first two are SIDs
/// (integers), the supplement is a number.
fn parse_ros(top: &Dict) -> Result<Option<RegistryOrdering>, Error> {
    let Some(operands) = top.get_array(Operator::Ros) else {
        return Ok(None);
    };
    if operands.len() != 3 {
        return Err(Error::Cff("ROS operator must have 3 operands"));
    }
    let registry_sid = operands[0]
        .as_int()
        .and_then(|v| u16::try_from(v).ok())
        .ok_or(Error::Cff("ROS registry SID"))?;
    let ordering_sid = operands[1]
        .as_int()
        .and_then(|v| u16::try_from(v).ok())
        .ok_or(Error::Cff("ROS ordering SID"))?;
    // Supplement is a "number" per Table 10 — accept int or real.
    let supplement = match operands[2] {
        Operand::Int(n) => n,
        Operand::Real(r) => r as i32,
    };
    Ok(Some(RegistryOrdering {
        registry_sid,
        ordering_sid,
        supplement,
    }))
}

/// Parse the Private DICT referenced by a DICT's `Private` operator
/// (op 18), which carries a `[size, offset]` operand pair. Used both
/// for the non-CID top-level Private DICT and for each Font DICT in a
/// CID font's FDArray. Returns `Ok(None)` when the DICT has no
/// `Private` operator at all (only valid for the non-CID Top DICT,
/// where the caller turns it into an error).
fn parse_private_from_dict<'a>(
    bytes: &'a [u8],
    dict: &Dict,
) -> Result<Option<PrivateDict<'a>>, Error> {
    let Some(private_arr) = dict.get_array(Operator::Private) else {
        return Ok(None);
    };
    if private_arr.len() != 2 {
        return Err(Error::Cff("Private operand must be [size, offset]"));
    }
    let priv_size = private_arr[0].as_int().ok_or(Error::Cff("Private size"))?;
    let priv_off = private_arr[1]
        .as_int()
        .ok_or(Error::Cff("Private offset"))?;
    if priv_size < 0 || priv_off < 0 {
        return Err(Error::Cff("negative Private size/offset"));
    }
    Ok(Some(PrivateDict::parse(
        bytes,
        priv_off as usize,
        priv_size as usize,
    )?))
}

/// Pull the Top DICT metadata fields we surface on the public API out
/// of the parsed DICT. Operators not present in the font fall back to
/// the TN5176 §9 / Table 9 defaults (italicAngle = 0,
/// underlinePosition = -100, underlineThickness = 50, isFixedPitch =
/// false, FontBBox = [0, 0, 0, 0]).
fn extract_top_metadata(dict: &Dict) -> TopMetadata {
    let font_bbox = dict
        .get_array(Operator::FontBBox)
        .map(|operands| {
            // FontBBox is a 4-number array [xMin yMin xMax yMax].
            // Tolerate non-conforming fonts that emit the wrong count
            // by zero-filling missing slots.
            let mut out = [0.0f32; 4];
            for (i, o) in operands.iter().take(4).enumerate() {
                out[i] = o.as_f64() as f32;
            }
            out
        })
        .unwrap_or([0.0; 4]);

    let italic_angle = dict.get_number(Operator::ItalicAngle).unwrap_or(0.0);
    let underline_position = dict
        .get_number(Operator::UnderlinePosition)
        .unwrap_or(-100.0);
    let underline_thickness = dict
        .get_number(Operator::UnderlineThickness)
        .unwrap_or(50.0);
    let is_fixed_pitch = dict.get_int(Operator::IsFixedPitch).unwrap_or(0) != 0;

    // FontMatrix is a 6-number array [a b c d tx ty]. Default per
    // TN5176 §9 Table 9: [0.001 0 0 0.001 0 0]. Non-conforming fonts
    // that emit a wrong-length array get zero-filled / truncated rather
    // than rejected — same tolerance as FontBBox above.
    let font_matrix = dict
        .get_array(Operator::FontMatrix)
        .map(|operands| {
            let mut out = [0.0f64; 6];
            for (i, o) in operands.iter().take(6).enumerate() {
                out[i] = o.as_f64();
            }
            out
        })
        .unwrap_or([0.001, 0.0, 0.0, 0.001, 0.0, 0.0]);

    let paint_type = dict.get_int(Operator::PaintType).unwrap_or(0);
    let charstring_type = dict.get_int(Operator::CharstringType).unwrap_or(2);
    let stroke_width = dict.get_number(Operator::StrokeWidth).unwrap_or(0.0);

    // SID-valued operators — these are simple integer SIDs.
    let to_sid = |op| dict.get_int(op).and_then(|i| u16::try_from(i).ok());
    let notice_sid = to_sid(Operator::Notice);
    let copyright_sid = to_sid(Operator::Copyright);
    let version_sid = to_sid(Operator::Version);
    let full_name_sid = to_sid(Operator::FullName);
    let family_name_sid = to_sid(Operator::FamilyName);
    let weight_sid = to_sid(Operator::Weight);
    let postscript_sid = to_sid(Operator::PostScript);
    let base_font_name_sid = to_sid(Operator::BaseFontName);

    let unique_id = dict.get_int(Operator::UniqueID);
    let synthetic_base = dict.get_int(Operator::SyntheticBase);
    // XUID is an array of integers (TN5176 §9 Table 9 — "array" type).
    let xuid = dict
        .get_array(Operator::XUID)
        .map(|ops| ops.iter().filter_map(|o| o.as_int()).collect::<Vec<_>>())
        .unwrap_or_default();
    // BaseFontBlend is a "delta" array — each operand is the difference
    // from the running sum, so we accumulate to absolute values for the
    // caller. Per TN5176 §4 Table 4 the delta type is defined as: the
    // first operand is absolute; each subsequent operand is added to the
    // running total to yield the next absolute value.
    let base_font_blend = dict
        .get_array(Operator::BaseFontBlend)
        .map(|ops| {
            let mut acc = 0.0f64;
            let mut out = Vec::with_capacity(ops.len());
            for o in ops {
                acc += o.as_f64();
                out.push(acc);
            }
            out
        })
        .unwrap_or_default();

    TopMetadata {
        font_bbox,
        italic_angle,
        underline_position,
        underline_thickness,
        is_fixed_pitch,
        font_matrix,
        paint_type,
        charstring_type,
        stroke_width,
        notice_sid,
        copyright_sid,
        version_sid,
        full_name_sid,
        family_name_sid,
        weight_sid,
        postscript_sid,
        base_font_name_sid,
        unique_id,
        xuid,
        synthetic_base,
        base_font_blend,
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn top_metadata_defaults_when_dict_empty() {
        let dict = Dict::parse(&[]).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.font_bbox, [0.0, 0.0, 0.0, 0.0]);
        assert_eq!(m.italic_angle, 0.0);
        assert_eq!(m.underline_position, -100.0);
        assert_eq!(m.underline_thickness, 50.0);
        assert!(!m.is_fixed_pitch);
        // TN5176 §9 Table 9 defaults: FontMatrix = [0.001 0 0 0.001 0 0],
        // PaintType = 0, CharstringType = 2, StrokeWidth = 0.
        assert_eq!(m.font_matrix, [0.001, 0.0, 0.0, 0.001, 0.0, 0.0]);
        assert_eq!(m.paint_type, 0);
        assert_eq!(m.charstring_type, 2);
        assert_eq!(m.stroke_width, 0.0);
        assert_eq!(m.notice_sid, None);
        assert_eq!(m.copyright_sid, None);
        assert_eq!(m.version_sid, None);
        assert_eq!(m.family_name_sid, None);
        // r176-added identity / synthetic-font operators default to absent.
        assert_eq!(m.unique_id, None);
        assert!(m.xuid.is_empty());
        assert_eq!(m.synthetic_base, None);
        assert!(m.base_font_blend.is_empty());
        assert_eq!(m.postscript_sid, None);
        assert_eq!(m.base_font_name_sid, None);
    }

    #[test]
    fn top_metadata_picks_up_font_matrix_paint_stroke() {
        // FontMatrix = [0.0005, 0, 0, 0.0005, 100, 200] under op 12 07.
        // The first four are BCD reals; the last two are integers.
        //
        // BCD layout for 0.0005:
        //   nibbles: 0, ., 0, 0, 0, 5, end
        //   bytes:   0x0a, 0x00, 0x05, 0xf?  → pad final nibble with f.
        //   Concretely: 0a 00 05 ff -> nibbles 0 a 0 0 0 5 f f (second f
        //   ignored after first f, but we keep parsing simple). Our
        //   parser stops at the first 0xf so trailing nibble is dropped.
        let bcd_5em4: [u8; 5] = [30, 0x0a, 0x00, 0x05, 0xff];

        let mut buf = Vec::new();
        // a = 0.0005
        buf.extend_from_slice(&bcd_5em4);
        // b = 0 → 139
        buf.push(139);
        // c = 0 → 139
        buf.push(139);
        // d = 0.0005
        buf.extend_from_slice(&bcd_5em4);
        // tx = 100 → opcode 32..246: 139 + 100 = 239
        buf.push(239);
        // ty = 200 via opcode 28 (i16) for unambiguous encoding
        buf.push(28);
        buf.extend_from_slice(&200i16.to_be_bytes());
        // FontMatrix operator (12 07)
        buf.push(12);
        buf.push(7);

        // PaintType = 2 → 139 + 2 = 141; op 12 05.
        buf.push(141);
        buf.extend_from_slice(&[12, 5]);

        // CharstringType = 2 (the OpenType-CFF expected value).
        buf.push(141);
        buf.extend_from_slice(&[12, 6]);

        // StrokeWidth = 10 → 139 + 10 = 149; op 12 08.
        buf.push(149);
        buf.extend_from_slice(&[12, 8]);

        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);

        // Floating-point: the BCD parse goes through f64::parse on
        // "0.0005" which is bit-exact at f64.
        assert_eq!(m.font_matrix[0], 0.0005);
        assert_eq!(m.font_matrix[1], 0.0);
        assert_eq!(m.font_matrix[2], 0.0);
        assert_eq!(m.font_matrix[3], 0.0005);
        assert_eq!(m.font_matrix[4], 100.0);
        assert_eq!(m.font_matrix[5], 200.0);

        assert_eq!(m.paint_type, 2);
        assert_eq!(m.charstring_type, 2);
        assert_eq!(m.stroke_width, 10.0);
    }

    #[test]
    fn top_metadata_short_font_matrix_zero_filled() {
        // Non-conforming font emits only 3 operands instead of 6 —
        // mirror the FontBBox tolerance and zero-fill the rest.
        // Operands: 1, 2, 3 (all in 1-byte form). Op 12 07.
        let buf = vec![140, 141, 142, 12, 7];
        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.font_matrix, [1.0, 2.0, 3.0, 0.0, 0.0, 0.0]);
    }

    #[test]
    fn top_metadata_picks_up_fontbbox_and_italic() {
        // FontBBox = [-100, -200, 1000, 800] under operator 5.
        // Operands encoded with TN5176 integer encoding.
        // -100 → 139 + (-100) is out of range for 32..246; use 251..254 form.
        //   -100 = -((b0-251)*256) - b1 - 108. Pick b0=251 → 0 - b1 - 108
        //   = -b1 - 108 = -100 → b1 = -8 (invalid). So pick b0=251, then
        //   -100 = -((251-251)*256) - b1 - 108 → b1 = -100 - 108 = -208
        //   (out of range). Use 28+i16 instead.
        // We'll just use opcode 28 (3-byte i16) for all four for clarity.
        let mut buf = Vec::new();
        for v in [-100i16, -200, 1000, 800] {
            buf.push(28);
            buf.extend_from_slice(&v.to_be_bytes());
        }
        buf.push(5); // FontBBox operator

        // italicAngle = -12 (op 12 02). -12 via opcode 32..246: 139 + (-12)
        // = 127, in range.
        buf.push(127);
        buf.push(12);
        buf.push(2);

        // isFixedPitch = 1 (op 12 01). 1 → 140.
        buf.push(140);
        buf.push(12);
        buf.push(1);

        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.font_bbox, [-100.0, -200.0, 1000.0, 800.0]);
        assert_eq!(m.italic_angle, -12.0);
        assert!(m.is_fixed_pitch);
        // Underline defaults still applied because we didn't set them.
        assert_eq!(m.underline_position, -100.0);
        assert_eq!(m.underline_thickness, 50.0);
    }

    // --- CID-keyed CFF (FDArray / FDSelect, TN5176 §18) -----------------
    //
    // The tests below build a complete, minimal CID-keyed CFF byte
    // buffer entirely from the spec layout (no external font) and then
    // parse it back through `Cff::parse`, exercising ROS detection,
    // FDArray Font-DICT walking, FDSelect routing, and per-FD Private
    // DICT / width selection.

    /// Encode an integer as a CFF DICT operand using the fixed 5-byte
    /// `29` (int32) form. Fixed width keeps the Top DICT layout stable
    /// so we can compute absolute offsets in one pass.
    fn op_int32(v: i32) -> [u8; 5] {
        let b = v.to_be_bytes();
        [29, b[0], b[1], b[2], b[3]]
    }

    /// Encode a small non-negative integer with the 1-byte `32..246`
    /// form (`b0 = v + 139`); valid for v in -107..=107.
    fn op_int1(v: i32) -> u8 {
        (v + 139) as u8
    }

    /// Build a single-entry CFF INDEX wrapping `payload`.
    fn index_one(payload: &[u8]) -> Vec<u8> {
        let mut out = Vec::new();
        out.extend_from_slice(&1u16.to_be_bytes()); // count = 1
        out.push(1); // offSize = 1
        out.push(1); // offset[0] = 1
        out.push((payload.len() + 1) as u8); // offset[1]
        out.extend_from_slice(payload);
        out
    }

    /// Build a String INDEX from a list of custom strings.
    fn string_index(strings: &[&str]) -> Vec<u8> {
        let mut out = Vec::new();
        out.extend_from_slice(&(strings.len() as u16).to_be_bytes());
        if strings.is_empty() {
            return out;
        }
        out.push(2); // offSize = 2 (room for longer payloads)
        let mut off = 1u16;
        out.extend_from_slice(&off.to_be_bytes());
        for s in strings {
            off += s.len() as u16;
            out.extend_from_slice(&off.to_be_bytes());
        }
        for s in strings {
            out.extend_from_slice(s.as_bytes());
        }
        out
    }

    /// Assemble a CID-keyed CFF with 3 glyphs split across 2 FDs.
    ///
    /// Glyph 0 (.notdef) and glyph 1 use FD 0; glyph 2 uses FD 1. Each
    /// glyph's charstring draws a small square via `rmoveto` + three
    /// `rlineto`s + `endchar`. FD 0 and FD 1 carry different
    /// `defaultWidthX` so a width-bearing routing bug would surface.
    fn build_cid_cff() -> Vec<u8> {
        // A charstring: width? dx dy rmoveto  then a tiny square.
        // We rely on defaultWidthX (no leading width operand).
        // rmoveto(0,0); rlineto pairs (100,0)(0,100)(-100,0); endchar.
        let charstring: Vec<u8> = vec![
            op_int1(0),
            op_int1(0),
            21, // rmoveto 0 0
            op_int1(100),
            op_int1(0),
            op_int1(0),
            op_int1(100),
            op_int1(-100),
            op_int1(0),
            5,  // rlineto (three pairs)
            14, // endchar
        ];

        // CharStrings INDEX: 3 identical glyphs.
        let mut charstrings = Vec::new();
        charstrings.extend_from_slice(&3u16.to_be_bytes());
        charstrings.push(1); // offSize
        let len = charstring.len() as u8;
        charstrings.push(1);
        charstrings.push(1 + len);
        charstrings.push(1 + 2 * len);
        charstrings.push(1 + 3 * len);
        for _ in 0..3 {
            charstrings.extend_from_slice(&charstring);
        }

        // charset format 0: CIDs for gid 1..2 (gid 0 omitted). In a CID
        // font these are CIDs; pick CID 1 → gid 1, CID 2 → gid 2.
        let charset = vec![0u8, 0x00, 0x01, 0x00, 0x02];

        // FDSelect format 3: gid 0..1 → FD 0, gid 2 → FD 1, sentinel 3.
        let fdselect = vec![
            3u8, // format
            0x00, 0x02, // nRanges
            0x00, 0x00, 0x00, // first=0, fd=0
            0x00, 0x02, 0x01, // first=2, fd=1
            0x00, 0x03, // sentinel = 3
        ];

        // Two Private DICTs (no local subrs). FD 0: defaultWidthX=500;
        // FD 1: defaultWidthX=700. Op 20 = defaultWidthX, encoded with
        // the fixed 5-byte int32 form.
        let priv0: Vec<u8> = {
            let mut v = Vec::new();
            v.extend_from_slice(&op_int32(500));
            v.push(20);
            v
        };
        let priv1: Vec<u8> = {
            let mut v = Vec::new();
            v.extend_from_slice(&op_int32(700));
            v.push(20);
            v
        };

        // Each Font DICT carries a Private operator [size, offset].
        // We'll patch the offsets after we know the absolute layout, so
        // reserve the FontDICT bodies with int32 placeholders.
        // FontDICT i = [size(int32) offset(int32) 18 (Private)].
        // FDArray is an INDEX of these two Font DICTs.

        // --- Front matter (fixed) ---------------------------------------
        // header (4) + Name INDEX + Top DICT INDEX + String INDEX +
        // Global Subr INDEX. Then the offset-referenced blobs.

        let header = vec![1u8, 0, 4, 1];
        let name_index = index_one(b"CIDFontTest");

        // String INDEX: SID 391="Adobe", 392="Identity".
        let strings = string_index(&["Adobe", "Identity"]);
        let gsubr = vec![0u8, 0]; // empty Global Subr INDEX

        // We must know the Top DICT INDEX size before placing the rest.
        // The Top DICT body uses fixed-width operands so its length is
        // deterministic regardless of the offsets we plug in.
        //
        // Top DICT contents (order arbitrary per spec):
        //   ROS: registry_sid ordering_sid supplement  (op 12 30)
        //   CharStrings: off  (op 17)
        //   charset: off      (op 15)
        //   FDArray: off      (op 12 36)
        //   FDSelect: off     (op 12 37)
        //
        // Build with placeholder offsets first to size it, then rebuild.
        let build_top = |cs_off: i32, charset_off: i32, fdarray_off: i32, fdselect_off: i32| {
            let mut t = Vec::new();
            // ROS: SID 391 (Adobe), SID 392 (Identity), supplement 0.
            t.extend_from_slice(&op_int32(391));
            t.extend_from_slice(&op_int32(392));
            t.push(op_int1(0));
            t.extend_from_slice(&[12, 30]); // ROS
                                            // CharStrings
            t.extend_from_slice(&op_int32(cs_off));
            t.push(17);
            // charset
            t.extend_from_slice(&op_int32(charset_off));
            t.push(15);
            // FDArray
            t.extend_from_slice(&op_int32(fdarray_off));
            t.extend_from_slice(&[12, 36]);
            // FDSelect
            t.extend_from_slice(&op_int32(fdselect_off));
            t.extend_from_slice(&[12, 37]);
            t
        };

        let top_body_len = build_top(0, 0, 0, 0).len();
        // Top DICT INDEX wrapping a fixed-size body. Use a 2-byte
        // offSize so payloads up to 65 KB fit.
        let top_index_len = {
            let mut tmp = Vec::new();
            tmp.extend_from_slice(&1u16.to_be_bytes()); // count
            tmp.push(2); // offSize
            tmp.extend_from_slice(&1u16.to_be_bytes());
            tmp.extend_from_slice(&((top_body_len + 1) as u16).to_be_bytes());
            tmp.len() + top_body_len
        };

        // Now compute absolute offsets for the trailing structures.
        let front_len =
            header.len() + name_index.len() + top_index_len + strings.len() + gsubr.len();

        // Layout order after front matter:
        //   charstrings, charset, fdselect, priv0, priv1, fdarray
        let cs_off = front_len;
        let charset_off = cs_off + charstrings.len();
        let fdselect_off = charset_off + charset.len();
        let priv0_off = fdselect_off + fdselect.len();
        let priv1_off = priv0_off + priv0.len();
        let fdarray_off = priv1_off + priv1.len();

        // Build the two Font DICTs now that Private offsets are known.
        let fd0_body = {
            let mut v = Vec::new();
            v.extend_from_slice(&op_int32(priv0.len() as i32)); // size
            v.extend_from_slice(&op_int32(priv0_off as i32)); // offset
            v.push(18); // Private
            v
        };
        let fd1_body = {
            let mut v = Vec::new();
            v.extend_from_slice(&op_int32(priv1.len() as i32));
            v.extend_from_slice(&op_int32(priv1_off as i32));
            v.push(18);
            v
        };
        // FDArray = INDEX of [fd0_body, fd1_body], offSize 1.
        let fdarray = {
            let mut v = Vec::new();
            v.extend_from_slice(&2u16.to_be_bytes()); // count
            v.push(1); // offSize
            let mut off = 1u8;
            v.push(off);
            off += fd0_body.len() as u8;
            v.push(off);
            off += fd1_body.len() as u8;
            v.push(off);
            v.extend_from_slice(&fd0_body);
            v.extend_from_slice(&fd1_body);
            v
        };

        // Rebuild the Top DICT with real offsets.
        let top_body = build_top(
            cs_off as i32,
            charset_off as i32,
            fdarray_off as i32,
            fdselect_off as i32,
        );
        assert_eq!(top_body.len(), top_body_len, "Top DICT must be fixed-size");
        let top_index = {
            let mut v = Vec::new();
            v.extend_from_slice(&1u16.to_be_bytes());
            v.push(2);
            v.extend_from_slice(&1u16.to_be_bytes());
            v.extend_from_slice(&((top_body.len() + 1) as u16).to_be_bytes());
            v.extend_from_slice(&top_body);
            v
        };
        assert_eq!(top_index.len(), top_index_len);

        // Assemble.
        let mut out = Vec::new();
        out.extend_from_slice(&header);
        out.extend_from_slice(&name_index);
        out.extend_from_slice(&top_index);
        out.extend_from_slice(&strings);
        out.extend_from_slice(&gsubr);
        assert_eq!(out.len(), front_len);
        out.extend_from_slice(&charstrings);
        out.extend_from_slice(&charset);
        out.extend_from_slice(&fdselect);
        out.extend_from_slice(&priv0);
        out.extend_from_slice(&priv1);
        out.extend_from_slice(&fdarray);
        out
    }

    #[test]
    fn parses_cid_keyed_font() {
        let buf = build_cid_cff();
        let cff = Cff::parse(&buf).expect("CID CFF parse");
        assert!(cff.is_cid(), "should detect CID-keyed font via ROS");
        assert_eq!(cff.glyph_count(), 3);
        assert_eq!(cff.fd_count(), 2);

        let ros = cff.registry_ordering().expect("ROS present");
        assert_eq!(ros.registry_sid, 391);
        assert_eq!(ros.ordering_sid, 392);
        assert_eq!(ros.supplement, 0);
        // SID 391/392 are custom strings → "Adobe" / "Identity".
        assert_eq!(cff.resolve_sid(ros.registry_sid), Some("Adobe"));
        assert_eq!(cff.resolve_sid(ros.ordering_sid), Some("Identity"));
    }

    #[test]
    fn cid_fdselect_routes_glyphs_to_correct_fd() {
        let buf = build_cid_cff();
        let cff = Cff::parse(&buf).expect("CID CFF parse");
        // gid 0,1 → FD 0 (defaultWidthX 500); gid 2 → FD 1 (700).
        let p0 = cff.private_for(0).unwrap();
        let p1 = cff.private_for(1).unwrap();
        let p2 = cff.private_for(2).unwrap();
        assert_eq!(p0.default_width_x, 500.0);
        assert_eq!(p1.default_width_x, 500.0);
        assert_eq!(p2.default_width_x, 700.0);
    }

    #[test]
    fn cid_glyph_outlines_decode() {
        let buf = build_cid_cff();
        let cff = Cff::parse(&buf).expect("CID CFF parse");
        for gid in 0u16..3 {
            let outline = cff.glyph_outline(gid).expect("decode");
            assert!(!outline.is_empty(), "gid {gid} outline empty");
            // Square of side 100.
            assert!((outline.bounds.width() - 100.0).abs() < 1e-3);
            assert!((outline.bounds.height() - 100.0).abs() < 1e-3);
        }
    }

    #[test]
    fn non_cid_font_reports_no_cid_metadata() {
        // The Source Sans fixture is exercised in tests/source_sans.rs;
        // here we only assert the negative API contract on the synthetic
        // non-CID DICT path via a minimal hand-built non-CID CFF would
        // be heavy, so we assert the FontKind invariants indirectly:
        // a CID font yields Some(ROS) and fd_count > 0, the inverse of
        // the non-CID contract verified by the integration test.
        let buf = build_cid_cff();
        let cff = Cff::parse(&buf).unwrap();
        assert!(cff.is_cid());
        assert!(cff.registry_ordering().is_some());
        assert!(cff.fd_count() > 0);
    }

    // --- r176-added identity / synthetic-font Top-DICT operators ---------
    //
    // TN5176 §9 Table 9 covers UniqueID (op 13) + XUID (op 14); Table 10
    // covers SyntheticBase (12 20), PostScript (12 21), BaseFontName
    // (12 22), BaseFontBlend (12 23). These tests hand-encode a Top DICT
    // carrying each operator and assert `extract_top_metadata` surfaces
    // it correctly.

    #[test]
    fn top_metadata_picks_up_unique_id() {
        // UniqueID = 28416 under operator 13 (op 28416 is the value
        // TN5176 §9 uses in its annotated example dump, p. 19).
        // Encode 28416 via op 28 (3-byte i16): 28416 fits in i16
        // (range -32768..=32767, 28416 < 32768).
        let mut buf = Vec::new();
        buf.push(28);
        buf.extend_from_slice(&28416i16.to_be_bytes());
        buf.push(13);
        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.unique_id, Some(28416));
    }

    #[test]
    fn top_metadata_picks_up_xuid_array() {
        // XUID = [1, 11, 89, 12345] under operator 14.
        // Encode each with the 1-byte 32..246 form where possible:
        // 1 → 140, 11 → 150, 89 → 228. 12345 needs op 28 (3-byte i16,
        // since 12345 < 32768).
        let mut buf = vec![140, 150, 228];
        buf.push(28);
        buf.extend_from_slice(&12345i16.to_be_bytes());
        buf.push(14);
        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.xuid, vec![1, 11, 89, 12345]);
    }

    #[test]
    fn top_metadata_picks_up_synthetic_and_postscript_sids() {
        // SyntheticBase = 42 (op 12 20). 42 → 181 (32..246 form).
        // PostScript SID = 391 (op 12 21). 391 needs the 247..250
        // 2-byte form: 391 = (b0 - 247) * 256 + b1 + 108. Pick b0=247
        // → b1 = 391 - 108 = 283 (out of range). Pick b0=248 → b1 = 391
        // - 256 - 108 = 27 (in range). So bytes 248, 27.
        // BaseFontName SID = 400 (op 12 22). 400 = (248-247)*256 + b1
        // + 108 = 256 + b1 + 108 → b1 = 36. So bytes 248, 36.
        let mut buf = vec![181, 12, 20]; // SyntheticBase = 42
        buf.extend_from_slice(&[248, 27, 12, 21]); // PostScript SID 391
        buf.extend_from_slice(&[248, 36, 12, 22]); // BaseFontName SID 400
        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.synthetic_base, Some(42));
        assert_eq!(m.postscript_sid, Some(391));
        assert_eq!(m.base_font_name_sid, Some(400));
    }

    #[test]
    fn top_metadata_undeltifies_base_font_blend() {
        // BaseFontBlend = delta-encoded design vector. TN5176 §4
        // Table 4 says the delta type's first operand is absolute and
        // each subsequent operand is the difference from the running
        // total. So raw [10, 5, -3, 2] → absolute [10, 15, 12, 14].
        // Encode each with op 28 (3-byte i16) for uniformity. Op 12 23.
        let mut buf = Vec::new();
        for v in [10i16, 5, -3, 2] {
            buf.push(28);
            buf.extend_from_slice(&v.to_be_bytes());
        }
        buf.extend_from_slice(&[12, 23]);
        let dict = Dict::parse(&buf).unwrap();
        let m = extract_top_metadata(&dict);
        assert_eq!(m.base_font_blend, vec![10.0, 15.0, 12.0, 14.0]);
    }

    #[test]
    fn top_metadata_empty_xuid_and_blend_default_to_empty_vec() {
        // No operators in the dict ⇒ both vectors empty (not None /
        // not [0]). Distinct from "the operator is present but emits
        // zero operands" which a malformed font could produce; for now
        // we accept the latter as also-empty since it equally yields
        // no caller-visible value.
        let dict = Dict::parse(&[]).unwrap();
        let m = extract_top_metadata(&dict);
        assert!(m.xuid.is_empty());
        assert!(m.base_font_blend.is_empty());
    }
}