lotobo/font-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release Font Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 12:18:37 +02:00
parent 25ff321f2a
commit 873cf3c04b
39 changed files with 2431 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/verify.yml
+39
View File
@@ -0,0 +1,39 @@
name: Verify
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
concurrency:
group: verify-${{ gitea.repository }}-${{ gitea.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
verify:
runs-on: ubuntu-latest
timeout-minutes: 45
env:
CI: "true"
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
cache: npm
- name: Select declared npm version
run: npm install --global npm@11.17.0
- name: Install dependencies
run: npm ci
- name: Audit runtime dependencies
run: npm audit --omit=dev --audit-level=moderate
- name: Check, test, and build
run: npm run check
- name: Install browser engines
run: npx playwright install --with-deps chromium firefox webkit
- name: Browser tests
run: npm run test:browser
CHANGELOG.md
+10
View File
@@ -1,5 +1,15 @@
# Changelog
## 0.2.0 - 2026-09-02
- Add local WOFF2 decompression, GSUB/GPOS inventories and a browser-backed
OpenType shaping comparison lab.
- Add bounded TTC/OTC 1.0/2.0 validation, per-face selection, isolated
standalone-face preview reconstruction and explicit collection export/subset
limits.
- Reject reserved WOFF2 table-transform versions before the third-party decoder
receives the input.
## 0.1.0 - 2026-09-01
- Add bounded TTF/OTF/WOFF inspection in an isolated worker.
README.md
+26 -9
View File
@@ -1,19 +1,36 @@
# Font Tools
Font Tools is a GPL-3.0-or-later, local-first browser workbench for inspecting
TTF, OTF and WOFF fonts. It inventories SFNT tables, names, metrics, Unicode
coverage, variable axes and OS/2 embedding restrictions; previews arbitrary
text against local fallbacks; generates inert CSS; and can rebuild a deliberately
simple static outline subset when the machine-readable restrictions permit it.
TTF, OTF, TTC, OTC, WOFF and WOFF2 fonts. It inventories SFNT and OpenType-layout
tables, names, metrics, Unicode coverage, variable axes and OS/2 embedding
restrictions; provides a browser shaping/comparison lab; generates inert CSS;
and can rebuild a deliberately simple static outline subset when
machine-readable restrictions permit it.
Files never leave the browser. Parsing and subsetting run in a disposable worker
with an 8-second operation limit. Preview rendering is contained in a scriptless
sandboxed frame. WOFF2 is detected but not parsed in v0.1.0.
sandboxed frame. WOFF2 inspection uses Fontkit's pinned browser build and local
Brotli decoder under the strict no-`unsafe-eval` CSP; it never calls a
conversion service. TTC/OTC 1.0 and 2.0 headers, up to 64 unique aligned face
offsets, every selected SFNT directory and optional DSIG boundaries are
validated before Fontkit exposes the face list. Selecting a face rebuilds a
bounded standalone SFNT only for the sandboxed in-memory preview.
Limits: 16 MiB input, 64 MiB declared expanded SFNT size, 128 tables, 65,535
glyphs, 250,000 Unicode mappings, 20,000 preview characters and 1,024 subset
glyphs. Suspicious WOFF ratios and invalid table bounds are rejected before the
font library sees the data.
WOFF2 and collection static subset export remain disabled until those paths can
preserve the same source-metadata guarantees as the SFNT/WOFF writer. Font
Tools does not export a selected collection face or rebuild TTC/OTC containers:
shared tables, face ordering and DSIG data would require a dedicated
round-trip-safe writer. Generated collection CSS uses `format("collection")`,
but CSS cannot portably address the selected face by numeric index; verify
family/style matching or deploy an authorized standalone face prepared by
suitable tooling.
Limits: 16 MiB input, 64 MiB declared or reconstructed SFNT size, 64 collection
faces, 128 tables per face, 65,535 glyphs, 250,000 Unicode mappings, 20,000
preview characters and 1,024 subset glyphs. Suspicious WOFF ratios, invalid
WOFF2/TTC declarations and SFNT table bounds are rejected before the font
library sees the data. Shaping comparisons use the browser engine and therefore
reflect that browser rather than a portable HarfBuzz reference result.
Run `npm ci`, then `npm run check`, `npm run test:browser`, and
`npm run package:release -- --force`. Copyright © 2026 Albrecht Degering.
SOURCE.md
+1 -1
View File
@@ -2,7 +2,7 @@
- Repository: https://git.add-ideas.de/lotobo/font-tools
- Application ID: `de.add-ideas.font-tools`
- Version: `0.1.0`
- Version: `0.2.0`
- License: `GPL-3.0-or-later`
The release ZIP is deterministically assembled from the production build and
THIRD_PARTY_NOTICES.md
+7 -3
View File
@@ -1,5 +1,9 @@
# Third-party notices
Font Tools uses React, the add·ideas Toolbox packages, and opentype.js. The
generated runtime-license inventory in `LICENSES/npm-runtime-licenses.txt`
records package versions and license metadata. No third-party font is bundled.
Font Tools uses React, add·ideas Toolbox Contract and Shell React 0.3.0
(Apache-2.0), Toolbox Helpers 0.2.0 (GPL-3.0-or-later), opentype.js and the
MIT-licensed Fontkit browser build for WOFF2 inspection. Fontkit's local Brotli
decoder and transitive runtime licences are recorded by the generated inventory
in `LICENSES/npm-runtime-licenses.txt`. The development-only `wawoff2` package
creates project-authored WOFF2 test fixtures and is not bundled in production.
No third-party font, network font or conversion service is used.
docs/ARCHITECTURE.md
+22 -7
View File
@@ -1,12 +1,27 @@
# Architecture
`core/sfnt.ts` validates SFNT/WOFF headers and table boundaries before parsing.
`font.worker.ts` owns the opentype.js instance and the source bytes; the UI only
receives bounded serializable inspection records. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Subsetting is
a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked.
For TTC/OTC it accepts header versions 1.0 and 2.0, caps face count, validates
the complete offset array, uniqueness/alignment, each face signature and SFNT
directory, and the optional DSIG boundary. A selected face is reconstructed by
copying its bounded tables into a standalone SFNT directory with rewritten
offsets and checksum adjustment; those bytes exist only as a preview Blob and
are never offered as a round-trip-safe export.
For WOFF2 it validates the header, UIntBase128 directory, reconstructed SFNT
size, transform declarations and compressed-stream bounds before Fontkit's
browser build performs local Brotli/table decoding. This path needs neither
WebAssembly nor dynamic evaluation and therefore remains compatible with the
app's strict CSP. `font.worker.ts` owns the parser instance and source
bytes; the UI receives only bounded serializable inspection records, collection
face labels and the selected preview buffer, including variable axes and
GSUB/GPOS script, feature and lookup inventories. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Face switching
reuses that worker and updates its coverage/report model atomically. Subsetting
is a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked; WOFF2, variable and
collection sources are explicitly blocked.
React keeps the last successful inspection after errors. Font rendering occurs
in a scriptless sandboxed iframe. Relative assets and a same-origin service
React keeps the last successful inspection after errors. Font rendering and the
feature/language/direction comparison lab occur in a scriptless sandboxed iframe
using the browser's shaping engine. Relative assets and a same-origin service
worker support nested offline deployment.
docs/PRIVACY-SECURITY.md
+6
View File
@@ -6,6 +6,12 @@ downloads are the only output. Parsing uses strict size/table/expansion/glyph
caps, a disposable worker and a deadline. User metadata is rendered as text;
preview HTML is escaped and confined to a scriptless sandbox.
Collection face selection keeps the original TTC/OTC in its disposable worker.
Only the selected face is reconstructed into a bounded temporary Blob for the
sandboxed preview; it is revoked on replacement and is not exposed as an export.
TTC 2.0 DSIG boundaries are validated and reported, but signatures are not
cryptographically verified.
The OS/2 `fsType` field is technical metadata, not legal advice. Font Tools
blocks subsetting when it declares restricted embedding, no-subsetting or
bitmap-only embedding, but users must still comply with the actual licence.
package-lock.json
Generated
+169 -22
View File
@@ -1,28 +1,30 @@
{
"name": "font-tools",
"version": "0.1.0",
"version": "0.2.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "font-tools",
"version": "0.1.0",
"version": "0.2.0",
"license": "GPL-3.0-or-later",
"dependencies": {
"@add-ideas/toolbox-contract": "0.2.3",
"@add-ideas/toolbox-helpers": "0.1.0",
"@add-ideas/toolbox-shell-react": "0.2.3",
"@add-ideas/toolbox-contract": "0.3.0",
"@add-ideas/toolbox-helpers": "0.2.0",
"@add-ideas/toolbox-shell-react": "0.3.0",
"fontkit": "2.0.4",
"opentype.js": "2.0.0",
"react": "19.2.8",
"react-dom": "19.2.8"
},
"devDependencies": {
"@add-ideas/toolbox-testkit": "0.2.3",
"@add-ideas/toolbox-testkit": "0.3.0",
"@eslint/js": "10.0.1",
"@playwright/test": "1.62.1",
"@testing-library/jest-dom": "6.9.1",
"@testing-library/react": "16.3.2",
"@testing-library/user-event": "14.6.1",
"@types/fontkit": "2.0.9",
"@types/node": "25.9.5",
"@types/opentype.js": "1.3.10",
"@types/react": "19.2.17",
@@ -37,31 +39,32 @@
"typescript": "6.0.3",
"typescript-eslint": "8.64.0",
"vite": "8.2.2",
"vitest": "4.1.11"
"vitest": "4.1.11",
"wawoff2": "2.0.1"
},
"engines": {
"node": ">=22"
}
},
"node_modules/@add-ideas/toolbox-contract": {
"version": "0.2.3",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-contract/-/0.2.3/toolbox-contract-0.2.3.tgz",
"integrity": "sha512-T0PVSuMT40GjTDfQJhEEY3ZawQq8zz1/ry95JdKI6W39CdLacaRXdGnEpDCMHt+jUbf1Jz7Nat/M5dFCgKVM9A==",
"version": "0.3.0",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-contract/-/0.3.0/toolbox-contract-0.3.0.tgz",
"integrity": "sha512-dKrK7BjOFwqJaBfJuhKxZKIld4sH0AKjEn6a0yLnbdMUFY+fFv4VSLGV2tNSBD016gumc2iNqOjUj/ld7x4rtA==",
"license": "Apache-2.0"
},
"node_modules/@add-ideas/toolbox-helpers": {
"version": "0.1.0",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-helpers/-/0.1.0/toolbox-helpers-0.1.0.tgz",
"integrity": "sha512-UKl1Oxekedf8D2df86VrnVA53AcMhrnh6iUPXY+k8frirBXotb0yd8SGT+IF/3hcqYwcYe/v9WVFuSgKtIYVnw==",
"version": "0.2.0",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-helpers/-/0.2.0/toolbox-helpers-0.2.0.tgz",
"integrity": "sha512-SdOqkw+P+3J3fa5iVkzb5P15rVepB001GNV21Oh8w0CZcVL+YRltgD/s+MVcTyrNijWQf3E5vtQON/3N2LLyKg==",
"license": "GPL-3.0-or-later"
},
"node_modules/@add-ideas/toolbox-shell-react": {
"version": "0.2.3",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-shell-react/-/0.2.3/toolbox-shell-react-0.2.3.tgz",
"integrity": "sha512-DT5lQDH48BFkFcmFLZnQh7+Cm73JzBPcmp5WzUXypfkUXpEyDYHzaXgmW4kZ0edSwh4RK4sPmx+JPtK0X4aKCQ==",
"version": "0.3.0",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-shell-react/-/0.3.0/toolbox-shell-react-0.3.0.tgz",
"integrity": "sha512-74p6JzAOG0YCAKdlc1hLofV4ZIko7vb448S75cIiM88PKm93EHl5VD7g8YVyfM56Ui97UY9dmy+Whiq4sGzpsg==",
"license": "Apache-2.0",
"dependencies": {
"@add-ideas/toolbox-contract": "0.2.3"
"@add-ideas/toolbox-contract": "0.3.0"
},
"peerDependencies": {
"react": ">=18 <20",
@@ -69,13 +72,13 @@
}
},
"node_modules/@add-ideas/toolbox-testkit": {
"version": "0.2.3",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-testkit/-/0.2.3/toolbox-testkit-0.2.3.tgz",
"integrity": "sha512-sq1MwhKWfFKen+N+124hl74qQimRSvmQ9sOU7jdcI+2qCKZ67+2B8rWyezeV80uTFu4Jv6deHksfYQ/tKNV6XQ==",
"version": "0.3.0",
"resolved": "https://git.add-ideas.de/api/packages/lotobo/npm/%40add-ideas%2Ftoolbox-testkit/-/0.3.0/toolbox-testkit-0.3.0.tgz",
"integrity": "sha512-4Fk+oSvZFspOMIXr8Xy040nhAaBsIQAzsGyXWSpjn3+k3yBKq7nB1r5zCHhsXzfdLzvPDAx2KcmSNOhM330D9w==",
"dev": true,
"license": "Apache-2.0",
"dependencies": {
"@add-ideas/toolbox-contract": "0.2.3"
"@add-ideas/toolbox-contract": "0.3.0"
},
"bin": {
"toolbox-check": "dist/cli.js"
@@ -1117,6 +1120,15 @@
"dev": true,
"license": "MIT"
},
"node_modules/@swc/helpers": {
"version": "0.5.23",
"resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
"integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
"license": "Apache-2.0",
"dependencies": {
"tslib": "^2.8.0"
}
},
"node_modules/@testing-library/dom": {
"version": "10.4.1",
"resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
@@ -1247,6 +1259,16 @@
"dev": true,
"license": "MIT"
},
"node_modules/@types/fontkit": {
"version": "2.0.9",
"resolved": "https://registry.npmjs.org/@types/fontkit/-/fontkit-2.0.9.tgz",
"integrity": "sha512-qNYerFky3muCmZPq+R+B3cUDRA5OONw/oh6aGGFxx2LOBz6yu8eamKusrhkHnC6rc2fm76+G9z9QoWSB2SaQaw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/@types/json-schema": {
"version": "7.0.15",
"resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -1738,6 +1760,13 @@
"url": "https://github.com/chalk/ansi-styles?sponsor=1"
}
},
"node_modules/argparse": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
"integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
"dev": true,
"license": "Python-2.0"
},
"node_modules/aria-query": {
"version": "5.3.0",
"resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
@@ -1768,6 +1797,26 @@
"node": "18 || 20 || >=22"
}
},
"node_modules/base64-js": {
"version": "1.5.1",
"resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
"integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/feross"
},
{
"type": "patreon",
"url": "https://www.patreon.com/feross"
},
{
"type": "consulting",
"url": "https://feross.org/support"
}
],
"license": "MIT"
},
"node_modules/baseline-browser-mapping": {
"version": "2.11.20",
"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
@@ -1804,6 +1853,15 @@
"node": "20 || >=22"
}
},
"node_modules/brotli": {
"version": "1.3.3",
"resolved": "https://registry.npmjs.org/brotli/-/brotli-1.3.3.tgz",
"integrity": "sha512-oTKjJdShmDuGW94SyyaoQvAjf30dZaHnjJ8uAF+u2/vGJkJbJPJAT1gDiOJP5v1Zb6f9KEyW/1HpuaWIXtGHPg==",
"license": "MIT",
"dependencies": {
"base64-js": "^1.1.2"
}
},
"node_modules/browserslist": {
"version": "4.28.8",
"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
@@ -1869,6 +1927,15 @@
"node": ">=18"
}
},
"node_modules/clone": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/clone/-/clone-2.1.2.tgz",
"integrity": "sha512-3Pe/CF1Nn94hyhIYpjtiLhdCoEoz0DqQ+988E9gmeEdQZlojxnOb74wctFyuwWQHzqyf9X7C7MG8juUpqBJT8w==",
"license": "MIT",
"engines": {
"node": ">=0.8"
}
},
"node_modules/convert-source-map": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@@ -1985,6 +2052,12 @@
"node": ">=8"
}
},
"node_modules/dfa": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/dfa/-/dfa-1.2.0.tgz",
"integrity": "sha512-ED3jP8saaweFTjeGX8HQPjeC1YYyZs98jGNZx6IiBvxW7JG5v492kamAQB3m2wop07CvU/RQmzcKr6bgcC5D/Q==",
"license": "MIT"
},
"node_modules/dom-accessibility-api": {
"version": "0.5.16",
"resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
@@ -2252,7 +2325,6 @@
"version": "3.1.3",
"resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
"integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
"dev": true,
"license": "MIT"
},
"node_modules/fast-json-stable-stringify": {
@@ -2338,6 +2410,23 @@
"dev": true,
"license": "ISC"
},
"node_modules/fontkit": {
"version": "2.0.4",
"resolved": "https://registry.npmjs.org/fontkit/-/fontkit-2.0.4.tgz",
"integrity": "sha512-syetQadaUEDNdxdugga9CpEYVaQIxOwk7GlwZWWZ19//qW4zE5bknOKeMBDYAASwnpaSHKJITRLMF9m1fp3s6g==",
"license": "MIT",
"dependencies": {
"@swc/helpers": "^0.5.12",
"brotli": "^1.3.2",
"clone": "^2.1.2",
"dfa": "^1.2.0",
"fast-deep-equal": "^3.1.3",
"restructure": "^3.0.0",
"tiny-inflate": "^1.0.3",
"unicode-properties": "^1.4.0",
"unicode-trie": "^2.0.0"
}
},
"node_modules/fsevents": {
"version": "2.3.2",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
@@ -3084,6 +3173,12 @@
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/pako": {
"version": "0.2.9",
"resolved": "https://registry.npmjs.org/pako/-/pako-0.2.9.tgz",
"integrity": "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==",
"license": "MIT"
},
"node_modules/parse5": {
"version": "8.0.1",
"resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
@@ -3310,6 +3405,12 @@
"node": ">=0.10.0"
}
},
"node_modules/restructure": {
"version": "3.0.2",
"resolved": "https://registry.npmjs.org/restructure/-/restructure-3.0.2.tgz",
"integrity": "sha512-gSfoiOEA0VPE6Tukkrr7I0RBdE0s7H1eFCDBk05l1KIQT1UIKNc5JZy6jdyW6eYH3aR3g5b3PuL77rq0hvwtAw==",
"license": "MIT"
},
"node_modules/rolldown": {
"version": "1.2.6",
"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.6.tgz",
@@ -3447,6 +3548,12 @@
"dev": true,
"license": "MIT"
},
"node_modules/tiny-inflate": {
"version": "1.0.3",
"resolved": "https://registry.npmjs.org/tiny-inflate/-/tiny-inflate-1.0.3.tgz",
"integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==",
"license": "MIT"
},
"node_modules/tinybench": {
"version": "2.9.0",
"resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -3550,6 +3657,12 @@
"typescript": ">=4.8.4"
}
},
"node_modules/tslib": {
"version": "2.8.1",
"resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
"integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
"license": "0BSD"
},
"node_modules/type-check": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -3618,6 +3731,26 @@
"dev": true,
"license": "MIT"
},
"node_modules/unicode-properties": {
"version": "1.4.1",
"resolved": "https://registry.npmjs.org/unicode-properties/-/unicode-properties-1.4.1.tgz",
"integrity": "sha512-CLjCCLQ6UuMxWnbIylkisbRj31qxHPAurvena/0iwSVbQ2G1VY5/HjV0IRabOEbDHlzZlRdCrD4NhB0JtU40Pg==",
"license": "MIT",
"dependencies": {
"base64-js": "^1.3.0",
"unicode-trie": "^2.0.0"
}
},
"node_modules/unicode-trie": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/unicode-trie/-/unicode-trie-2.0.0.tgz",
"integrity": "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ==",
"license": "MIT",
"dependencies": {
"pako": "^0.2.5",
"tiny-inflate": "^1.0.0"
}
},
"node_modules/update-browserslist-db": {
"version": "1.3.2",
"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
@@ -3855,6 +3988,20 @@
"node": ">=18"
}
},
"node_modules/wawoff2": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/wawoff2/-/wawoff2-2.0.1.tgz",
"integrity": "sha512-r0CEmvpH63r4T15ebFqeOjGqU4+EgTx4I510NtK35EMciSdcTxCw3Byy3JnBonz7iyIFZ0AbVo0bbFpEVuhCYA==",
"dev": true,
"license": "MIT",
"dependencies": {
"argparse": "^2.0.1"
},
"bin": {
"woff2_compress.js": "bin/woff2_compress.js",
"woff2_decompress.js": "bin/woff2_decompress.js"
}
},
"node_modules/webidl-conversions": {
"version": "8.0.1",
"resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-8.0.1.tgz",
package.json
+9 -6
View File
@@ -1,6 +1,6 @@
{
"name": "font-tools",
"version": "0.1.0",
"version": "0.2.0",
"description": "Inspect, compare, preview, and safely subset local fonts.",
"license": "GPL-3.0-or-later",
"author": "Albrecht Degering",
@@ -39,20 +39,22 @@
"release:artifact": "npm run check && npm run test:browser && npm run package:release -- --force"
},
"dependencies": {
"@add-ideas/toolbox-contract": "0.2.3",
"@add-ideas/toolbox-helpers": "0.1.0",
"@add-ideas/toolbox-shell-react": "0.2.3",
"@add-ideas/toolbox-contract": "0.3.0",
"@add-ideas/toolbox-helpers": "0.2.0",
"@add-ideas/toolbox-shell-react": "0.3.0",
"fontkit": "2.0.4",
"opentype.js": "2.0.0",
"react": "19.2.8",
"react-dom": "19.2.8"
},
"devDependencies": {
"@add-ideas/toolbox-testkit": "0.2.3",
"@add-ideas/toolbox-testkit": "0.3.0",
"@eslint/js": "10.0.1",
"@playwright/test": "1.62.1",
"@testing-library/jest-dom": "6.9.1",
"@testing-library/react": "16.3.2",
"@testing-library/user-event": "14.6.1",
"@types/fontkit": "2.0.9",
"@types/node": "25.9.5",
"@types/opentype.js": "1.3.10",
"@types/react": "19.2.17",
@@ -67,7 +69,8 @@
"typescript": "6.0.3",
"typescript-eslint": "8.64.0",
"vite": "8.2.2",
"vitest": "4.1.11"
"vitest": "4.1.11",
"wawoff2": "2.0.1"
},
"packageManager": "npm@11.17.0"
}
playwright.config.ts
+20 -2
View File
@@ -16,7 +16,25 @@ export default defineConfig({
timeout: 180_000,
},
projects: [
{ name: "chromium", use: { ...devices["Desktop Chrome"] } },
{ name: "firefox", use: { ...devices["Desktop Firefox"] } },
{
name: "chromium",
testIgnore: /responsive\.spec\.ts/,
use: { ...devices["Desktop Chrome"] },
},
{
name: "firefox",
testIgnore: /responsive\.spec\.ts/,
use: { ...devices["Desktop Firefox"] },
},
{
name: "webkit",
testIgnore: /responsive\.spec\.ts/,
use: { ...devices["Desktop Safari"] },
},
{
name: "mobile-chromium",
testMatch: /responsive\.spec\.ts/,
use: { ...devices["Pixel 5"] },
},
],
});
public/CHANGELOG.md
+10
View File
@@ -1,5 +1,15 @@
# Changelog
## 0.2.0 - 2026-09-02
- Add local WOFF2 decompression, GSUB/GPOS inventories and a browser-backed
OpenType shaping comparison lab.
- Add bounded TTC/OTC 1.0/2.0 validation, per-face selection, isolated
standalone-face preview reconstruction and explicit collection export/subset
limits.
- Reject reserved WOFF2 table-transform versions before the third-party decoder
receives the input.
## 0.1.0 - 2026-09-01
- Add bounded TTF/OTF/WOFF inspection in an isolated worker.
public/LICENSES/npm-runtime-licenses.txt
+428 -6
View File
@@ -1,5 +1,5 @@
==============================================================================
@add-ideas/toolbox-contract@0.2.3
@add-ideas/toolbox-contract@0.3.0
Declared licence: Apache-2.0
==============================================================================
--- LICENSE ---
@@ -196,9 +196,8 @@ Declared licence: Apache-2.0
See the License for the specific language governing permissions and
limitations under the License.
==============================================================================
@add-ideas/toolbox-helpers@0.1.0
@add-ideas/toolbox-helpers@0.2.0
Declared licence: GPL-3.0-or-later
==============================================================================
--- LICENSE ---
@@ -877,9 +876,8 @@ the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.
==============================================================================
@add-ideas/toolbox-shell-react@0.2.3
@add-ideas/toolbox-shell-react@0.3.0
Declared licence: Apache-2.0
==============================================================================
--- LICENSE ---
@@ -1076,6 +1074,308 @@ Declared licence: Apache-2.0
See the License for the specific language governing permissions and
limitations under the License.
==============================================================================
@swc/helpers@0.5.23
Declared licence: Apache-2.0
==============================================================================
--- LICENSE ---
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright 2024 SWC contributors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
==============================================================================
base64-js@1.5.1
Declared licence: MIT
==============================================================================
--- LICENSE ---
The MIT License (MIT)
Copyright (c) 2014 Jameson Little
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
==============================================================================
brotli@1.3.3
Declared licence: MIT
==============================================================================
See upstream package metadata.
==============================================================================
clone@2.1.2
Declared licence: MIT
==============================================================================
--- LICENSE ---
Copyright © 2011-2015 Paul Vorbach <paul@vorba.ch>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the “Software”), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
==============================================================================
dfa@1.2.0
Declared licence: MIT
==============================================================================
See upstream package metadata.
==============================================================================
fast-deep-equal@3.1.3
Declared licence: MIT
==============================================================================
--- LICENSE ---
MIT License
Copyright (c) 2017 Evgeny Poberezkin
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
==============================================================================
fontkit@2.0.4
Declared licence: MIT
==============================================================================
See upstream package metadata.
==============================================================================
opentype.js@2.0.0
@@ -1103,6 +1403,32 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
==============================================================================
pako@0.2.9
Declared licence: MIT
==============================================================================
--- LICENSE ---
(The MIT License)
Copyright (C) 2014-2016 by Vitaly Puzrin
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
==============================================================================
react@19.2.8
@@ -1131,7 +1457,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
==============================================================================
react-dom@19.2.8
Declared licence: MIT
@@ -1159,6 +1484,32 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
==============================================================================
restructure@3.0.2
Declared licence: MIT
==============================================================================
--- LICENSE ---
MIT License
Copyright (c) 2015-present Devon Govett
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
==============================================================================
scheduler@0.27.0
@@ -1186,3 +1537,74 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
==============================================================================
tiny-inflate@1.0.3
Declared licence: MIT
==============================================================================
--- LICENSE ---
MIT License
Copyright (c) 2015-present Devon Govett
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
==============================================================================
tslib@2.8.1
Declared licence: 0BSD
==============================================================================
--- LICENSE.txt ---
Copyright (c) Microsoft Corporation.
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
==============================================================================
unicode-properties@1.4.1
Declared licence: MIT
==============================================================================
--- LICENSE ---
Copyright 2018
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
==============================================================================
unicode-trie@2.0.0
Declared licence: MIT
==============================================================================
--- LICENSE ---
Copyright 2018
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
public/README.md
+26 -9
View File
@@ -1,19 +1,36 @@
# Font Tools
Font Tools is a GPL-3.0-or-later, local-first browser workbench for inspecting
TTF, OTF and WOFF fonts. It inventories SFNT tables, names, metrics, Unicode
coverage, variable axes and OS/2 embedding restrictions; previews arbitrary
text against local fallbacks; generates inert CSS; and can rebuild a deliberately
simple static outline subset when the machine-readable restrictions permit it.
TTF, OTF, TTC, OTC, WOFF and WOFF2 fonts. It inventories SFNT and OpenType-layout
tables, names, metrics, Unicode coverage, variable axes and OS/2 embedding
restrictions; provides a browser shaping/comparison lab; generates inert CSS;
and can rebuild a deliberately simple static outline subset when
machine-readable restrictions permit it.
Files never leave the browser. Parsing and subsetting run in a disposable worker
with an 8-second operation limit. Preview rendering is contained in a scriptless
sandboxed frame. WOFF2 is detected but not parsed in v0.1.0.
sandboxed frame. WOFF2 inspection uses Fontkit's pinned browser build and local
Brotli decoder under the strict no-`unsafe-eval` CSP; it never calls a
conversion service. TTC/OTC 1.0 and 2.0 headers, up to 64 unique aligned face
offsets, every selected SFNT directory and optional DSIG boundaries are
validated before Fontkit exposes the face list. Selecting a face rebuilds a
bounded standalone SFNT only for the sandboxed in-memory preview.
Limits: 16 MiB input, 64 MiB declared expanded SFNT size, 128 tables, 65,535
glyphs, 250,000 Unicode mappings, 20,000 preview characters and 1,024 subset
glyphs. Suspicious WOFF ratios and invalid table bounds are rejected before the
font library sees the data.
WOFF2 and collection static subset export remain disabled until those paths can
preserve the same source-metadata guarantees as the SFNT/WOFF writer. Font
Tools does not export a selected collection face or rebuild TTC/OTC containers:
shared tables, face ordering and DSIG data would require a dedicated
round-trip-safe writer. Generated collection CSS uses `format("collection")`,
but CSS cannot portably address the selected face by numeric index; verify
family/style matching or deploy an authorized standalone face prepared by
suitable tooling.
Limits: 16 MiB input, 64 MiB declared or reconstructed SFNT size, 64 collection
faces, 128 tables per face, 65,535 glyphs, 250,000 Unicode mappings, 20,000
preview characters and 1,024 subset glyphs. Suspicious WOFF ratios, invalid
WOFF2/TTC declarations and SFNT table bounds are rejected before the font
library sees the data. Shaping comparisons use the browser engine and therefore
reflect that browser rather than a portable HarfBuzz reference result.
Run `npm ci`, then `npm run check`, `npm run test:browser`, and
`npm run package:release -- --force`. Copyright © 2026 Albrecht Degering.
public/SOURCE.md
+1 -1
View File
@@ -2,7 +2,7 @@
- Repository: https://git.add-ideas.de/lotobo/font-tools
- Application ID: `de.add-ideas.font-tools`
- Version: `0.1.0`
- Version: `0.2.0`
- License: `GPL-3.0-or-later`
The release ZIP is deterministically assembled from the production build and
public/THIRD_PARTY_NOTICES.md
+7 -3
View File
@@ -1,5 +1,9 @@
# Third-party notices
Font Tools uses React, the add·ideas Toolbox packages, and opentype.js. The
generated runtime-license inventory in `LICENSES/npm-runtime-licenses.txt`
records package versions and license metadata. No third-party font is bundled.
Font Tools uses React, add·ideas Toolbox Contract and Shell React 0.3.0
(Apache-2.0), Toolbox Helpers 0.2.0 (GPL-3.0-or-later), opentype.js and the
MIT-licensed Fontkit browser build for WOFF2 inspection. Fontkit's local Brotli
decoder and transitive runtime licences are recorded by the generated inventory
in `LICENSES/npm-runtime-licenses.txt`. The development-only `wawoff2` package
creates project-authored WOFF2 test fixtures and is not bundled in production.
No third-party font, network font or conversion service is used.
public/docs/ARCHITECTURE.md
+22 -7
View File
@@ -1,12 +1,27 @@
# Architecture
`core/sfnt.ts` validates SFNT/WOFF headers and table boundaries before parsing.
`font.worker.ts` owns the opentype.js instance and the source bytes; the UI only
receives bounded serializable inspection records. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Subsetting is
a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked.
For TTC/OTC it accepts header versions 1.0 and 2.0, caps face count, validates
the complete offset array, uniqueness/alignment, each face signature and SFNT
directory, and the optional DSIG boundary. A selected face is reconstructed by
copying its bounded tables into a standalone SFNT directory with rewritten
offsets and checksum adjustment; those bytes exist only as a preview Blob and
are never offered as a round-trip-safe export.
For WOFF2 it validates the header, UIntBase128 directory, reconstructed SFNT
size, transform declarations and compressed-stream bounds before Fontkit's
browser build performs local Brotli/table decoding. This path needs neither
WebAssembly nor dynamic evaluation and therefore remains compatible with the
app's strict CSP. `font.worker.ts` owns the parser instance and source
bytes; the UI receives only bounded serializable inspection records, collection
face labels and the selected preview buffer, including variable axes and
GSUB/GPOS script, feature and lookup inventories. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Face switching
reuses that worker and updates its coverage/report model atomically. Subsetting
is a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked; WOFF2, variable and
collection sources are explicitly blocked.
React keeps the last successful inspection after errors. Font rendering occurs
in a scriptless sandboxed iframe. Relative assets and a same-origin service
React keeps the last successful inspection after errors. Font rendering and the
feature/language/direction comparison lab occur in a scriptless sandboxed iframe
using the browser's shaping engine. Relative assets and a same-origin service
worker support nested offline deployment.
public/docs/PRIVACY-SECURITY.md
+6
View File
@@ -6,6 +6,12 @@ downloads are the only output. Parsing uses strict size/table/expansion/glyph
caps, a disposable worker and a deadline. User metadata is rendered as text;
preview HTML is escaped and confined to a scriptless sandbox.
Collection face selection keeps the original TTC/OTC in its disposable worker.
Only the selected face is reconstructed into a bounded temporary Blob for the
sandboxed preview; it is revoked on replacement and is not exposed as an export.
TTC 2.0 DSIG boundaries are validated and reported, but signatures are not
cryptographically verified.
The OS/2 `fsType` field is technical metadata, not legal advice. Font Tools
blocks subsetting when it declares restricted embedding, no-subsetting or
bitmap-only embedding, but users must still comply with the actual licence.
public/sw.js
+1 -1
View File
@@ -1,4 +1,4 @@
const CACHE = "font-tools-v0.1.0",
const CACHE = "font-tools-v0.2.0",
APP = [
"./",
"./index.html",
public/toolbox-app.json
+29 -3
View File
@@ -3,12 +3,22 @@
"schemaVersion": 1,
"id": "de.add-ideas.font-tools",
"name": "Font Tools",
"version": "0.1.0",
"description": "Inspect and prepare fonts locally.",
"version": "0.2.0",
"description": "Inspect, compare and prepare fonts locally.",
"entry": "./",
"icon": "./favicon.svg",
"categories": ["design", "developer"],
"tags": ["font", "ttf", "otf", "woff", "glyph", "typography", "subset"],
"tags": [
"font",
"ttf",
"otf",
"ttc",
"otc",
"woff",
"glyph",
"typography",
"subset"
],
"integration": {
"contextVersion": 1,
"launchModes": ["navigate", "new-tab"],
@@ -21,6 +31,22 @@
"crossOriginIsolated": false,
"topLevelContext": false
},
"io": {
"accepts": [
{ "mediaType": "font/ttf", "extensions": [".ttf"] },
{ "mediaType": "font/otf", "extensions": [".otf"] },
{ "mediaType": "font/collection", "extensions": [".ttc", ".otc"] },
{ "mediaType": "font/woff", "extensions": [".woff"] },
{ "mediaType": "font/woff2", "extensions": [".woff2"] }
],
"produces": [
{ "mediaType": "text/css", "extensions": [".css"] },
{ "mediaType": "application/json", "extensions": [".json"] },
{ "mediaType": "font/ttf", "extensions": [".ttf"] },
{ "mediaType": "font/otf", "extensions": [".otf"] }
]
},
"capabilities": { "required": ["workers"], "optional": [] },
"privacy": {
"processing": "local",
"fileUploads": true,
scripts/prepare-release-files.mjs
+9 -6
View File
@@ -38,12 +38,15 @@ for (const [location, locked] of Object.entries(lock.packages ?? {}).sort(
const texts = [];
for (const candidate of candidates) {
try {
texts.push(
"--- " +
candidate +
" ---\n" +
(await readFile(path.join(packageDirectory, candidate), "utf8")),
);
const licenceText = (
await readFile(path.join(packageDirectory, candidate), "utf8")
)
.replace(/\r\n?/gu, "\n")
.split("\n")
.map((line) => line.trimEnd())
.join("\n")
.trimEnd();
texts.push("--- " + candidate + " ---\n" + licenceText);
} catch {
/* directory */
}
src/components/FontPreview.tsx
+13 -2
View File
@@ -7,16 +7,27 @@ export function FontPreview({
fontSize,
lineHeight,
axes,
features,
language,
direction,
}: {
fontUrl: string;
text: string;
fontSize: number;
lineHeight: number;
axes: Record<string, number>;
features: string;
language: string;
direction: "auto" | "ltr" | "rtl";
}) {
const source = useMemo(
() => previewDocument(fontUrl, text, fontSize, lineHeight, axes),
[fontUrl, text, fontSize, lineHeight, axes],
() =>
previewDocument(fontUrl, text, fontSize, lineHeight, axes, {
features,
language,
direction,
}),
[fontUrl, text, fontSize, lineHeight, axes, features, language, direction],
);
return (
<iframe
src/components/HelpDialog.tsx
+12 -5
View File
@@ -32,19 +32,26 @@ export function HelpDialog({
</button>
</div>
<p>
Open one local TTF, OTF or WOFF file. The table directory is checked
before opentype.js parses it in a disposable worker. WOFF2 and font
collections are identified but deliberately unsupported in v0.1.
Open one local TTF, OTF, TTC, OTC, WOFF or WOFF2 file. Container bounds
are checked before a pinned local parser inspects it in a disposable
worker. TTC/OTC headers, face offsets and every selected SFNT directory
are validated before you switch between at most 64 faces. WOFF2 is
decoded there by Fontkit&apos;s browser-safe Brotli path, without a
service or unsafe-eval.
</p>
<p>
Preview text is rendered in a scriptless sandbox. Coverage results are
based on the font&apos;s Unicode cmap and do not promise that every
shaping sequence or colour glyph will render in every browser.
based on the font&apos;s Unicode cmap. The shaping lab lets you compare
selected OpenType features, direction and language, but browser and
colour-glyph support still varies.
</p>
<p>
OS/2 embedding flags are shown as technical evidence, not legal advice.
Static subsetting is blocked for restricted, no-subsetting, bitmap-only
and variable fonts, and always requires a rights confirmation.
Collection faces are reconstructed only for the isolated in-memory
preview; collection export and subsetting are unavailable because shared
tables, face ordering and DSIG data are not round-tripped by this tool.
</p>
</dialog>
);
src/components/Workbench.tsx
+184 -11
View File
@@ -3,6 +3,7 @@ import { triggerBlobDownload } from "@add-ideas/toolbox-helpers";
import { generateFontFace, suggestedFamily } from "../core/css";
import { FontWorkerClient } from "../core/fontClient";
import type {
CollectionFaceSummary,
CoverageInspection,
FontInspection,
SubsetResult,
@@ -22,13 +23,16 @@ export function Workbench() {
[previewText, setPreviewText] = useState(SAMPLE),
[fontSize, setFontSize] = useState(42),
[lineHeight, setLineHeight] = useState(1.25),
[features, setFeatures] = useState('"kern" 1, "liga" 1'),
[language, setLanguage] = useState("en"),
[direction, setDirection] = useState<"auto" | "ltr" | "rtl">("auto"),
[axes, setAxes] = useState<Record<string, number>>({}),
[url, setUrl] = useState<string | null>(null),
[operation, setOperation] = useState<"load" | "coverage" | "subset" | null>(
null,
),
[operation, setOperation] = useState<
"load" | "face" | "coverage" | "subset" | null
>(null),
[status, setStatus] = useState(
"Choose a local TTF, OTF or WOFF font to begin.",
"Choose a local TTF, OTF, TTC, OTC, WOFF or WOFF2 font to begin.",
),
[tableFilter, setTableFilter] = useState(""),
[cssFamily, setCssFamily] = useState("Local font"),
@@ -70,13 +74,20 @@ export function Workbench() {
setOperation("load");
setStatus(`Inspecting ${file.name} in an isolated worker…`);
try {
const next = await candidate.load(file),
const result = await candidate.load(file),
next = result.inspection,
nextCoverage = await candidate.coverage(previewText);
if (token !== generation.current) return candidate.terminate();
client.current?.terminate();
client.current = candidate;
if (previewUrl.current) URL.revokeObjectURL(previewUrl.current);
const nextUrl = URL.createObjectURL(file);
const nextUrl = URL.createObjectURL(
result.preview
? new Blob([result.preview.buffer], {
type: result.preview.mediaType,
})
: file,
);
previewUrl.current = nextUrl;
setUrl(nextUrl);
setInspection(next);
@@ -89,7 +100,7 @@ export function Workbench() {
setSubsetReport(null);
setRightsConfirmed(false);
setStatus(
`Inspected ${next.glyphCount.toLocaleString()} glyphs, ${next.unicodeCount.toLocaleString()} Unicode values and ${next.tables.length} tables locally.`,
`${next.collection ? `Inspected collection face ${next.collection.selectedFace + 1} of ${next.collection.faces.length}: ` : "Inspected "}${next.glyphCount.toLocaleString()} glyphs, ${next.unicodeCount.toLocaleString()} Unicode values and ${next.tables.length} tables locally.`,
);
} catch (error) {
candidate.terminate();
@@ -100,6 +111,49 @@ export function Workbench() {
}
}
async function selectFace(faceIndex: number) {
if (!client.current || !inspection?.collection) return;
const token = ++generation.current;
setOperation("face");
setStatus(
`Inspecting collection face ${faceIndex + 1} in the existing isolated worker…`,
);
try {
const result = await client.current.selectFace(faceIndex),
next = result.inspection,
nextCoverage = await client.current.coverage(previewText);
if (token !== generation.current) return;
if (!result.preview)
throw new Error(
"The selected collection face has no safe preview font.",
);
if (previewUrl.current) URL.revokeObjectURL(previewUrl.current);
const nextUrl = URL.createObjectURL(
new Blob([result.preview.buffer], { type: result.preview.mediaType }),
);
previewUrl.current = nextUrl;
setUrl(nextUrl);
setInspection(next);
setCoverage(nextCoverage);
setAxes(
Object.fromEntries(next.axes.map((axis) => [axis.tag, axis.default])),
);
setCssFamily(suggestedFamily(next));
setSubsetReport(null);
setRightsConfirmed(false);
setStatus(
`Selected collection face ${faceIndex + 1} of ${next.collection?.faces.length ?? 0}: ${next.names.fullName || next.names.family || "unnamed face"}.`,
);
} catch (error) {
if (token === generation.current)
setStatus(
`${message(error)} The previously selected face remains visible.`,
);
} finally {
if (token === generation.current) setOperation(null);
}
}
async function analyzeCoverage() {
if (!client.current) return;
setOperation("coverage");
@@ -169,7 +223,7 @@ export function Workbench() {
{operation === "load" ? "Inspecting…" : "Open font"}
<input
type="file"
accept=".ttf,.otf,.woff,.woff2,font/ttf,font/otf,font/woff,font/woff2"
accept=".ttf,.otf,.ttc,.otc,.woff,.woff2,font/ttf,font/otf,font/collection,font/woff,font/woff2"
disabled={operation === "load"}
onChange={(event) => {
const file = event.currentTarget.files?.[0];
@@ -191,8 +245,10 @@ export function Workbench() {
</div>
<h2>Everything stays on this device</h2>
<p>
TTF, OTF and WOFF up to 16 MiB are accepted. WOFF2 is identified and
rejected clearly because opentype.js does not decode it.
TTF, OTF, TTC, OTC, WOFF and WOFF2 up to 16 MiB are accepted.
Collections are capped at 64 validated faces. WOFF2 is decoded
locally by pinned Fontkit/Brotli code inside the disposable worker,
without unsafe-eval.
</p>
<dl className="limit-grid">
<div>
@@ -211,6 +267,53 @@ export function Workbench() {
</section>
) : (
<>
{inspection.collection && (
<section className="panel collection-panel">
<div className="section-heading">
<div>
<p className="eyebrow">Validated TTC/OTC collection</p>
<h2>{inspection.collection.faces.length} selectable faces</h2>
</div>
<span className="isolation">
TTC {inspection.collection.version}
</span>
</div>
<label>
Selected collection face
<select
value={inspection.collection.selectedFace}
disabled={operation !== null}
onChange={(event) =>
void selectFace(Number(event.currentTarget.value))
}
>
{inspection.collection.faces.map((face) => (
<option
key={`${face.index}-${face.offset}`}
value={face.index}
>
{face.index + 1}. {collectionFaceLabel(face)} ·{" "}
{face.flavor}
</option>
))}
</select>
</label>
<p className="note">
The selected face is reconstructed in memory for this preview;
the source collection is never changed. Collection export and
static subsetting are deliberately unavailable because this
version does not promise round-trip-safe shared-table or DSIG
preservation.
</p>
{inspection.collection.hasDigitalSignature && (
<p className="block-reason">
The TTC 2.0 header declares a DSIG block. It is bounded and
inventoried, but its signature is not cryptographically
validated.
</p>
)}
</section>
)}
<section className="summary-grid" aria-label="Font summary">
<Summary
label="Identity"
@@ -282,6 +385,39 @@ export function Workbench() {
<span>{lineHeight.toFixed(2)}</span>
</label>
</div>
<div className="preview-controls shaping-controls">
<label>
OpenType features
<input
value={features}
maxLength={256}
onChange={(event) => setFeatures(event.target.value)}
placeholder={'"kern" 1, "liga" 1'}
/>
</label>
<label>
Language
<input
value={language}
maxLength={35}
onChange={(event) => setLanguage(event.target.value)}
placeholder="en, ar, de…"
/>
</label>
<label>
Direction
<select
value={direction}
onChange={(event) =>
setDirection(event.target.value as typeof direction)
}
>
<option value="auto">Auto</option>
<option value="ltr">Left to right</option>
<option value="rtl">Right to left</option>
</select>
</label>
</div>
{inspection.axes.length > 0 && (
<fieldset className="axes">
<legend>Variable axes</legend>
@@ -328,6 +464,9 @@ export function Workbench() {
fontSize={fontSize}
lineHeight={lineHeight}
axes={axes}
features={features}
language={language}
direction={direction}
/>
{[...previewText].length > 5_000 && (
<p className="note">
@@ -496,6 +635,27 @@ export function Workbench() {
/>
</label>
</div>
{inspection.layout.length > 0 && (
<div
className="layout-summary"
aria-label="OpenType layout inspection"
>
{inspection.layout.map((item) => (
<article key={item.table}>
<h3>{item.table}</h3>
<p>{item.lookupCount.toLocaleString()} lookups</p>
<p>
<strong>Scripts:</strong>{" "}
{item.scripts.join(", ") || "not named"}
</p>
<p>
<strong>Features:</strong>{" "}
{item.features.join(", ") || "not named"}
</p>
</article>
))}
</div>
)}
<div className="table-scroll">
<table>
<thead>
@@ -726,15 +886,28 @@ function nameEntries(inspection: FontInspection): [string, string][] {
}
function subsetBlockReason(inspection: FontInspection) {
if (inspection.collection)
return "TTC/OTC face selection is supported for inspection and in-memory preview only; this version does not export or subset collections safely.";
if (!inspection.embedding.subsetAllowed)
return `OS/2 fsType ${inspection.embedding.rawHex} declares a restriction that blocks this outline subset.`;
if (inspection.container === "woff2")
return "WOFF2 inspection and preview are supported, but this subset path cannot yet preserve its source metadata guarantees.";
if (inspection.axes.length)
return "Variable fonts are inspected and previewed, but v0.1 does not flatten their variation model.";
return "Variable fonts are inspected and previewed, but v0.2 does not flatten their variation model.";
if (!inspection.tables.some((table) => ["glyf", "CFF "].includes(table.tag)))
return "No supported static glyf or CFF outline table is present.";
return "";
}
function collectionFaceLabel(face: CollectionFaceSummary) {
return (
face.fullName ||
[face.family, face.subfamily].filter(Boolean).join(" ") ||
face.postScriptName ||
`Unnamed face at byte ${face.offset.toLocaleString()}`
);
}
function safeAssetName(name: string) {
return (
name.replace(/[^\p{Letter}\p{Number}._-]+/gu, "-").slice(0, 120) ||
src/core/css.ts
+4
View File
@@ -63,6 +63,10 @@ export function generateFontFace(options: CssOptions): CssResult {
warnings.push(
"Confirm the actual font licence before deploying this @font-face rule.",
);
if (options.inspection.collection)
warnings.push(
'This rule references the original collection with format("collection"). CSS cannot portably identify the currently inspected face by index; verify family/style matching or deploy an authorized standalone face prepared by suitable font tooling.',
);
return { css: lines.join("\n"), warnings };
}
src/core/font.worker.ts
+423 -39
View File
@@ -1,30 +1,62 @@
/// <reference lib="webworker" />
import { create as createFontkit, type Font as FontkitFont } from "fontkit";
import * as opentype from "opentype.js";
import type {
CoverageBlock,
CoverageInspection,
CoverageRange,
DirectoryInspection,
FontCollectionInfo,
FontInspection,
FontLoadResult,
LayoutTableInspection,
SubsetResult,
VariableAxis,
WorkerRequest,
WorkerResponse,
} from "./model";
import { decodeEmbedding, FONT_LIMITS, inspectDirectory } from "./sfnt";
import {
decodeEmbedding,
extractCollectionFace,
FONT_LIMITS,
inspectCollection,
inspectDirectory,
} from "./sfnt";
const worker = self as DedicatedWorkerGlobalScope;
let font: opentype.Font | null = null,
inspection: FontInspection | null = null;
browserFont: FontkitFont | null = null,
inspection: FontInspection | null = null,
collectionBuffer: ArrayBuffer | null = null,
collectionFonts: FontkitFont[] | null = null,
collectionDirectory: ReturnType<typeof inspectCollection> | null = null,
collectionInfo: Omit<FontCollectionInfo, "selectedFace"> | null = null,
collectionFileName = "",
collectionFileSize = 0;
worker.addEventListener("message", (event: MessageEvent<WorkerRequest>) => {
const request = event.data;
void handle(event.data);
});
async function handle(request: WorkerRequest) {
try {
if (request.command === "load") {
const result = load(request.buffer, request.fileName, request.fileSize);
respond(request.id, result);
const result = await load(
request.buffer,
request.fileName,
request.fileSize,
);
respond(
request.id,
result,
result.preview ? [result.preview.buffer] : [],
);
} else if (request.command === "select-face") {
const result = selectCollectionFace(request.faceIndex);
respond(request.id, result, [result.preview!.buffer]);
} else if (request.command === "coverage") {
respond(request.id, inspectTextCoverage(request.text));
} else {
} else if (request.command === "subset") {
const result = subset(
request.text,
request.familyName,
@@ -40,22 +72,29 @@ worker.addEventListener("message", (event: MessageEvent<WorkerRequest>) => {
};
worker.postMessage(response);
}
});
}
function respond(id: number, result: unknown, transfer: Transferable[] = []) {
const response: WorkerResponse = { id, ok: true, result };
worker.postMessage(response, transfer);
}
function load(
async function load(
buffer: ArrayBuffer,
fileName: string,
fileSize: number,
): FontInspection {
const directory = inspectDirectory(buffer);
): Promise<FontLoadResult> {
if (fileSize !== buffer.byteLength)
throw new Error("Transferred font size does not match the selected file.");
const parsed = opentype.parse(buffer);
resetCollection();
const signature =
buffer.byteLength >= 4 ? new DataView(buffer).getUint32(0, false) : 0;
if (signature === 0x7474_6366)
return loadCollection(buffer, fileName, fileSize);
if (signature === 0x774f4632)
return { inspection: loadWoff2(buffer, fileName, fileSize) };
const directory = inspectDirectory(buffer),
parsed = opentype.parse(buffer);
if (parsed.glyphs.length > FONT_LIMITS.glyphs)
throw new Error(
`Font exceeds the ${FONT_LIMITS.glyphs.toLocaleString()}-glyph limit.`,
@@ -66,32 +105,12 @@ function load(
os2 = object(tables.os2),
rawFsType = finiteInteger(os2.fsType),
axes = readAxes(tables.fvar),
layout = [
readLayoutTable(tables.gsub, "GSUB"),
readLayoutTable(tables.gpos, "GPOS"),
].filter((value): value is LayoutTableInspection => value !== null),
names = readNames(parsed.names as unknown as Record<string, unknown>),
warnings = [...directory.warnings];
if (!directory.tables.some((table) => table.tag === "cmap"))
warnings.push("No cmap table is present; Unicode coverage may be empty.");
if (!directory.tables.some((table) => table.tag === "name"))
warnings.push("No name table is present; identity fields may be empty.");
if (directory.tables.some((table) => table.tag === "DSIG"))
warnings.push(
"A DSIG table is present; this inventory does not validate signatures.",
);
if (
directory.tables.some((table) =>
["COLR", "CPAL", "SVG ", "sbix", "CBDT", "CBLC"].includes(table.tag),
)
)
warnings.push(
"Colour glyph tables are present; browser preview support varies.",
);
if (
!directory.tables.some((table) =>
["glyf", "CFF ", "CFF2"].includes(table.tag),
)
)
warnings.push(
"No supported outline table was identified; static subsetting is unavailable.",
);
warnings = directoryWarnings(directory.tables, directory.warnings);
const next: FontInspection = {
fileName,
fileSize,
@@ -107,16 +126,252 @@ function load(
coverageRangesTruncated: ranges.truncated,
coverageBlocks: coverageBlocks(unicode),
axes,
layout,
embedding: decodeEmbedding(rawFsType),
tables: directory.tables,
expandedSize: directory.expandedSize,
warnings,
};
font = parsed;
browserFont = null;
inspection = next;
return { inspection: next };
}
function loadCollection(
buffer: ArrayBuffer,
fileName: string,
fileSize: number,
): FontLoadResult {
const directory = inspectCollection(buffer),
created = createFontkit(new Uint8Array(buffer) as never);
if (!("fonts" in created))
throw new Error("The validated TTC header did not decode as a collection.");
const fonts = created.fonts;
if (fonts.length !== directory.faces.length)
throw new Error(
"The collection decoder disagrees with the validated TTC face count.",
);
const faces = fonts.map((parsed, index) => {
const names = readFontkitNames(parsed),
source = directory.faces[index]!;
return {
index,
offset: source.offset,
flavor: source.directory.flavor,
family: names.family ?? "",
subfamily: names.subfamily ?? "",
fullName: names.fullName ?? "",
postScriptName: names.postScriptName ?? "",
};
});
collectionBuffer = buffer;
collectionFonts = fonts;
collectionDirectory = directory;
collectionInfo = {
version: directory.version,
hasDigitalSignature: directory.hasDigitalSignature,
faces,
};
collectionFileName = fileName;
collectionFileSize = fileSize;
return selectCollectionFace(0);
}
function selectCollectionFace(faceIndex: number): FontLoadResult {
if (
!collectionBuffer ||
!collectionFonts ||
!collectionDirectory ||
!collectionInfo
)
throw new Error("Load a TrueType/OpenType Collection first.");
if (
!Number.isInteger(faceIndex) ||
faceIndex < 0 ||
faceIndex >= collectionFonts.length
)
throw new Error(
`Collection face must be between 1 and ${collectionFonts.length}.`,
);
const parsed = collectionFonts[faceIndex]!,
face = collectionDirectory.faces[faceIndex]!,
previewBuffer = extractCollectionFace(collectionBuffer, faceIndex),
next = inspectFontkitFont(
parsed,
face.directory,
collectionFileName,
collectionFileSize,
"collection",
`TTC/OTC face ${faceIndex + 1} · ${face.directory.flavor}`,
[
...collectionDirectory.warnings,
`Selected face ${faceIndex + 1} of ${collectionFonts.length} from TTC ${collectionDirectory.version}.`,
"The selected face is reconstructed only as a bounded in-memory preview font. Collection export and static subsetting remain disabled.",
],
);
next.collection = { ...collectionInfo, selectedFace: faceIndex };
font = null;
browserFont = parsed;
inspection = next;
return {
inspection: next,
preview: {
buffer: previewBuffer,
mediaType:
face.directory.container === "opentype-cff" ? "font/otf" : "font/ttf",
},
};
}
function loadWoff2(
buffer: ArrayBuffer,
fileName: string,
fileSize: number,
): FontInspection {
const directory = inspectDirectory(buffer),
created = createFontkit(new Uint8Array(buffer) as never);
if ("fonts" in created)
throw new Error("WOFF2 font collections are not supported.");
const next = inspectFontkitFont(
created,
directory,
fileName,
fileSize,
"woff2",
directory.flavor,
[
"WOFF2 tables are decoded locally by Fontkit's browser build; static subset export remains disabled for this container.",
],
);
font = null;
browserFont = created;
inspection = next;
return next;
}
function inspectFontkitFont(
parsed: FontkitFont,
directory: DirectoryInspection,
fileName: string,
fileSize: number,
container: FontInspection["container"],
flavor: string,
extraWarnings: readonly string[],
): FontInspection {
if (parsed.numGlyphs > FONT_LIMITS.glyphs)
throw new Error(
`Font exceeds the ${FONT_LIMITS.glyphs.toLocaleString()}-glyph limit.`,
);
if (parsed.characterSet.length > FONT_LIMITS.unicodeMappings)
throw new Error(
`Font exceeds the ${FONT_LIMITS.unicodeMappings.toLocaleString()} Unicode-mapping limit.`,
);
const unicode = new Set(
parsed.characterSet.filter(
(code) => Number.isInteger(code) && code >= 0 && code <= 0x10ffff,
),
),
ranges = compressRanges([...unicode].sort((a, b) => a - b)),
axes = readFontkitAxes(parsed),
warnings = directoryWarnings(directory.tables, [
...directory.warnings,
...extraWarnings,
]);
// Force a lookup before accepting the face so lazy table-decoding failures
// remain inside this disposable operation.
if (unicode.size > 0)
parsed.glyphForCodePoint(unicode.values().next().value!);
return {
fileName,
fileSize,
container,
flavor,
names: readFontkitNames(parsed),
unitsPerEm: parsed.unitsPerEm,
ascender: parsed.ascent,
descender: parsed.descent,
glyphCount: parsed.numGlyphs,
unicodeCount: unicode.size,
coverageRanges: ranges.ranges,
coverageRangesTruncated: ranges.truncated,
coverageBlocks: coverageBlocks(unicode),
axes,
layout: readFontkitLayout(
parsed,
directory.tables.map((item) => item.tag),
),
embedding: decodeEmbedding(readFontkitFsType(parsed)),
tables: directory.tables,
expandedSize: directory.expandedSize,
warnings,
};
}
function resetCollection() {
collectionBuffer = null;
collectionFonts = null;
collectionDirectory = null;
collectionInfo = null;
collectionFileName = "";
collectionFileSize = 0;
}
function directoryWarnings(
tables: readonly { tag: string }[],
initial: readonly string[],
): string[] {
const warnings = [...initial];
if (!tables.some((table) => table.tag === "cmap"))
warnings.push("No cmap table is present; Unicode coverage may be empty.");
if (!tables.some((table) => table.tag === "name"))
warnings.push("No name table is present; identity fields may be empty.");
if (tables.some((table) => table.tag === "DSIG"))
warnings.push(
"A DSIG table is present; this inventory does not validate signatures.",
);
if (
tables.some((table) =>
["COLR", "CPAL", "SVG ", "sbix", "CBDT", "CBLC"].includes(table.tag),
)
)
warnings.push(
"Colour glyph tables are present; browser preview support varies.",
);
if (!tables.some((table) => ["glyf", "CFF ", "CFF2"].includes(table.tag)))
warnings.push(
"No supported outline table was identified; static subsetting is unavailable.",
);
return warnings;
}
function readLayoutTable(
value: unknown,
table: LayoutTableInspection["table"],
): LayoutTableInspection | null {
const source = object(value);
if (!Object.keys(source).length) return null;
const tags = (input: unknown) =>
[
...new Set(
(Array.isArray(input) ? input : [])
.slice(0, 2_048)
.map((item) => object(item).tag)
.filter((tag): tag is string => typeof tag === "string")
.map((tag) => tag.slice(0, 16)),
),
].sort();
return {
table,
scripts: tags(source.scripts),
features: tags(source.features),
lookupCount: Math.min(
65_535,
Array.isArray(source.lookups) ? source.lookups.length : 0,
),
};
}
function collectUnicode(parsed: opentype.Font) {
const values = new Set<number>();
let mappings = 0;
@@ -220,6 +475,114 @@ function readAxes(value: unknown): VariableAxis[] {
});
}
function readFontkitAxes(parsed: FontkitFont): VariableAxis[] {
const entries = Object.entries(parsed.variationAxes ?? {});
if (entries.length > 32)
throw new Error("Font exceeds the 32-variable-axis limit.");
return entries.flatMap(([tag, value]) => {
if (!value) return [];
const min = finite(value.min),
defaultValue = finite(value.default),
max = finite(value.max);
if (
min === null ||
defaultValue === null ||
max === null ||
min > defaultValue ||
defaultValue > max
)
return [];
return [
{
tag: tag.slice(0, 4),
name: String(value.name || tag).slice(0, 200),
min,
default: defaultValue,
max,
},
];
});
}
function readFontkitNames(parsed: FontkitFont): Record<string, string> {
const fields: Array<[string, string, string | null | undefined]> = [
["family", "fontFamily", parsed.familyName],
["subfamily", "fontSubfamily", parsed.subfamilyName],
["fullName", "fullName", parsed.fullName],
["postScriptName", "postscriptName", parsed.postscriptName],
["version", "version", parsed.getName("version", "en")],
["manufacturer", "manufacturer", parsed.getName("manufacturer", "en")],
["designer", "designer", parsed.getName("designer", "en")],
["description", "description", parsed.getName("description", "en")],
["copyright", "copyright", parsed.copyright],
["trademark", "trademark", parsed.getName("trademark", "en")],
["license", "license", parsed.getName("license", "en")],
["licenseUrl", "licenseURL", parsed.getName("licenseURL", "en")],
];
return Object.fromEntries(
fields.flatMap(([output, input, fallback]) => {
const value = parsed.getName(input, "en") ?? fallback;
return typeof value === "string" && value.trim()
? [[output, value.slice(0, 4_000)]]
: [];
}),
);
}
function readFontkitFsType(parsed: FontkitFont): number | null {
const fsType = object(object(parsed["OS/2"]).fsType);
if (Object.keys(fsType).length === 0) return null;
let raw = 0;
if (fsType.noEmbedding === true) raw |= 0x0002;
if (fsType.viewOnly === true) raw |= 0x0004;
if (fsType.editable === true) raw |= 0x0008;
if (fsType.noSubsetting === true) raw |= 0x0100;
if (fsType.bitmapOnly === true) raw |= 0x0200;
return raw;
}
function readFontkitLayout(
parsed: FontkitFont,
tableTags: readonly string[],
): LayoutTableInspection[] {
const source = parsed as unknown as Record<string, unknown>,
available = [...new Set(parsed.availableFeatures ?? [])]
.filter((tag): tag is string => typeof tag === "string")
.slice(0, 2_048)
.map((tag) => tag.slice(0, 16))
.sort();
return (["GSUB", "GPOS"] as const).flatMap((table) => {
if (!tableTags.includes(table)) return [];
const decoded = object(source[table]),
scripts = tagsFromRecords(decoded.scriptList),
features = tagsFromRecords(decoded.featureList),
lookups = decoded.lookupList;
return [
{
table,
scripts,
features: features.length ? features : available,
lookupCount: Math.min(
65_535,
Array.isArray(lookups) ? lookups.length : 0,
),
},
];
});
}
function tagsFromRecords(value: unknown): string[] {
return [
...new Set(
(Array.isArray(value) ? value : [])
.slice(0, 2_048)
.map((item) => object(item).tag)
.filter((tag): tag is string => typeof tag === "string")
.map((tag) => tag.slice(0, 16)),
),
].sort();
}
function readNames(names: Record<string, unknown>) {
const fields: [string, string][] = [
["family", "fontFamily"],
@@ -267,13 +630,26 @@ function localized(value: unknown): string {
}
function inspectTextCoverage(text: string): CoverageInspection {
const current = requireFont();
if (!font && !browserFont) throw new Error("Load a font first.");
if ([...text].length > FONT_LIMITS.previewCharacters)
throw new Error("Preview text exceeds 20,000 Unicode characters.");
const unique = [...new Set([...text])],
truncated = unique.length > 2_048,
characters = unique.slice(0, 2_048).map((character) => {
const codePoint = character.codePointAt(0)!,
const codePoint = character.codePointAt(0)!;
if (browserFont) {
const glyph = browserFont.glyphForCodePoint(codePoint),
covered = browserFont.hasGlyphForCodePoint(codePoint);
return {
character,
codePoint,
glyphIndex: glyph.id,
glyphName:
glyph.name || (glyph.id === 0 ? ".notdef" : `glyph ${glyph.id}`),
covered,
};
}
const current = font!,
glyphIndex = current.charToGlyphIndex(character),
glyph = current.glyphs.get(glyphIndex);
return {
@@ -310,7 +686,7 @@ function subset(
);
if (report.axes.length)
throw new Error(
"Variable fonts are not flattened or subset in v0.1; use a licensed static instance.",
"Variable fonts are not flattened or subset in v0.2; use a licensed static instance.",
);
if (!report.tables.some((table) => ["glyf", "CFF "].includes(table.tag)))
throw new Error(
@@ -419,6 +795,14 @@ function safeFileName(value: string) {
}
function requireFont() {
if (inspection?.collection)
throw new Error(
"Static subset export from a TTC/OTC collection is disabled. Face selection reconstructs a bounded font only for in-memory preview and does not claim a round-trip-safe collection export.",
);
if (browserFont)
throw new Error(
"Static subset export from WOFF2 is disabled because this path cannot yet preserve the source's licence metadata guarantees. Convert an authorized source to TTF/OTF/WOFF first.",
);
if (!font) throw new Error("Load a font first.");
return font;
}
src/core/fontClient.ts
+14 -5
View File
@@ -1,6 +1,6 @@
import type {
CoverageInspection,
FontInspection,
FontLoadResult,
SubsetResult,
WorkerRequest,
WorkerResponse,
@@ -37,8 +37,13 @@ export class FontWorkerClient {
else pending.reject(new Error(response.error));
},
);
this.worker.addEventListener("error", () => {
this.failAll(new Error("The isolated font parser stopped unexpectedly."));
this.worker.addEventListener("error", (event) => {
const detail = event.message?.trim();
this.failAll(
new Error(
`The isolated font parser stopped unexpectedly${detail ? `: ${detail}` : "."}`,
),
);
});
this.worker.addEventListener("messageerror", () => {
this.failAll(
@@ -47,16 +52,20 @@ export class FontWorkerClient {
});
}
async load(file: File): Promise<FontInspection> {
async load(file: File): Promise<FontLoadResult> {
if (file.size > FONT_LIMITS.fileBytes)
throw new Error("Font exceeds the 16 MiB input limit.");
const buffer = await file.arrayBuffer();
return this.request<FontInspection>(
return this.request<FontLoadResult>(
{ command: "load", fileName: file.name, fileSize: file.size, buffer },
[buffer],
);
}
selectFace(faceIndex: number) {
return this.request<FontLoadResult>({ command: "select-face", faceIndex });
}
coverage(text: string) {
return this.request<CoverageInspection>({ command: "coverage", text });
}
src/core/model.ts
+50 -1
View File
@@ -1,4 +1,5 @@
export type FontContainer = "truetype" | "opentype-cff" | "woff";
export type FontContainer =
"truetype" | "opentype-cff" | "woff" | "woff2" | "collection";
export interface TableRecord {
tag: string;
@@ -19,6 +20,36 @@ export interface DirectoryInspection {
warnings: string[];
}
export interface CollectionDirectoryFace {
index: number;
offset: number;
directory: DirectoryInspection;
}
export interface CollectionDirectoryInspection {
version: "1.0" | "2.0";
faces: CollectionDirectoryFace[];
hasDigitalSignature: boolean;
warnings: string[];
}
export interface CollectionFaceSummary {
index: number;
offset: number;
flavor: string;
family: string;
subfamily: string;
fullName: string;
postScriptName: string;
}
export interface FontCollectionInfo {
version: "1.0" | "2.0";
selectedFace: number;
hasDigitalSignature: boolean;
faces: CollectionFaceSummary[];
}
export interface VariableAxis {
tag: string;
name: string;
@@ -27,6 +58,13 @@ export interface VariableAxis {
max: number;
}
export interface LayoutTableInspection {
table: "GSUB" | "GPOS";
scripts: string[];
features: string[];
lookupCount: number;
}
export interface CoverageRange {
start: number;
end: number;
@@ -66,10 +104,20 @@ export interface FontInspection {
coverageRangesTruncated: boolean;
coverageBlocks: CoverageBlock[];
axes: VariableAxis[];
layout: LayoutTableInspection[];
embedding: EmbeddingInfo;
tables: TableRecord[];
expandedSize: number;
warnings: string[];
collection?: FontCollectionInfo;
}
export interface FontLoadResult {
inspection: FontInspection;
preview?: {
buffer: ArrayBuffer;
mediaType: "font/ttf" | "font/otf";
};
}
export interface GlyphCoverage {
@@ -104,6 +152,7 @@ export type WorkerRequest =
fileSize: number;
buffer: ArrayBuffer;
}
| { id: number; command: "select-face"; faceIndex: number }
| { id: number; command: "coverage"; text: string }
| {
id: number;
src/core/preview.ts
+32 -7
View File
@@ -4,29 +4,54 @@ export function previewDocument(
fontSize: number,
lineHeight: number,
axes: Record<string, number>,
options: {
features?: string;
language?: string;
direction?: "auto" | "ltr" | "rtl";
} = {},
) {
const safeText = escapeHtml([...text].slice(0, 5_000).join("")),
variation = Object.entries(axes)
.filter(
([tag, value]) =>
/^[\x20-\x7e]{1,4}$/u.test(tag) && Number.isFinite(value),
)
.map(
([tag, value]) =>
`&quot;${escapeHtml(tag)}&quot; ${Number(value.toFixed(4))}`,
/^[A-Za-z0-9 ]{1,4}$/u.test(tag) && Number.isFinite(value),
)
.map(([tag, value]) => `"${tag}" ${Number(value.toFixed(4))}`)
.join(", "),
size = Math.min(160, Math.max(12, fontSize)),
leading = Math.min(2.5, Math.max(0.8, lineHeight)),
url = fontUrl.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
const features = featureSettings(options.features ?? ""),
language = /^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/u.test(
options.language ?? "",
)
? options.language
: "und",
direction = ["ltr", "rtl"].includes(options.direction ?? "")
? options.direction
: "auto";
return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; font-src blob: data:"><style>
@font-face{font-family:FontToolsPreview;src:url("${url}");font-display:block}
:root{color-scheme:light dark}body{margin:0;padding:1rem;background:transparent;color:CanvasText;font:14px system-ui,sans-serif}
.row{border-bottom:1px solid color-mix(in srgb,CanvasText 18%,transparent);padding:.7rem 0}.row:last-child{border:0}
.label{display:block;font:600 11px/1.2 system-ui,sans-serif;letter-spacing:.08em;text-transform:uppercase;opacity:.7;margin-bottom:.35rem}
.sample{overflow-wrap:anywhere;font-size:${size}px;line-height:${leading};font-variation-settings:${variation || "normal"}}
.sample{overflow-wrap:anywhere;font-size:${size}px;line-height:${leading};font-variation-settings:${variation || "normal"};font-feature-settings:${features || "normal"}}
.features-off{font-feature-settings:"kern" 0,"liga" 0,"clig" 0,"calt" 0}
.loaded{font-family:FontToolsPreview,system-ui,sans-serif}.system{font-family:system-ui,sans-serif}.serif{font-family:serif}.mono{font-family:monospace}
</style></head><body><div class="row"><span class="label">Loaded font, then system fallback</span><div class="sample loaded">${safeText}</div></div><div class="row"><span class="label">System sans-serif</span><div class="sample system">${safeText}</div></div><div class="row"><span class="label">System serif</span><div class="sample serif">${safeText}</div></div><div class="row"><span class="label">System monospace</span><div class="sample mono">${safeText}</div></div></body></html>`;
</style></head><body lang="${language}" dir="${direction}"><div class="row"><span class="label">Loaded font · selected shaping</span><div class="sample loaded">${safeText}</div></div><div class="row"><span class="label">Loaded font · common shaping disabled</span><div class="sample loaded features-off">${safeText}</div></div><div class="row"><span class="label">System sans-serif</span><div class="sample system">${safeText}</div></div><div class="row"><span class="label">System serif</span><div class="sample serif">${safeText}</div></div><div class="row"><span class="label">System monospace</span><div class="sample mono">${safeText}</div></div></body></html>`;
}
function featureSettings(value: string) {
if (!value.trim()) return "";
const entries = value.split(",").map((entry) => entry.trim());
if (
entries.length > 32 ||
entries.some(
(entry) => !/^"[A-Za-z0-9 ]{1,4}"\s+(?:0|1|on|off)$/u.test(entry),
)
)
return "";
return entries.join(", ");
}
function escapeHtml(value: string) {
src/core/sfnt.ts
+451 -16
View File
@@ -1,4 +1,5 @@
import type {
CollectionDirectoryInspection,
DirectoryInspection,
EmbeddingInfo,
FontContainer,
@@ -10,6 +11,7 @@ export const FONT_LIMITS = {
expandedBytes: 64 * 1024 * 1024,
tableBytes: 32 * 1024 * 1024,
tables: 128,
collectionFaces: 64,
glyphs: 65_535,
unicodeMappings: 250_000,
previewCharacters: 20_000,
@@ -58,19 +60,87 @@ const TABLE_DESCRIPTIONS: Record<string, string> = {
vmtx: "Vertical metrics",
};
export function inspectDirectory(buffer: ArrayBuffer): DirectoryInspection {
if (buffer.byteLength > FONT_LIMITS.fileBytes)
throw new Error("Font exceeds the 16 MiB input limit.");
const WOFF2_KNOWN_TAGS = [
"cmap",
"head",
"hhea",
"hmtx",
"maxp",
"name",
"OS/2",
"post",
"cvt ",
"fpgm",
"glyf",
"loca",
"prep",
"CFF ",
"VORG",
"EBDT",
"EBLC",
"gasp",
"hdmx",
"kern",
"LTSH",
"PCLT",
"VDMX",
"vhea",
"vmtx",
"BASE",
"GDEF",
"GPOS",
"GSUB",
"EBSC",
"JSTF",
"MATH",
"CBDT",
"CBLC",
"COLR",
"CPAL",
"SVG ",
"sbix",
"acnt",
"avar",
"bdat",
"bloc",
"bsln",
"cvar",
"fdsc",
"feat",
"fmtx",
"fvar",
"gvar",
"hsty",
"just",
"lcar",
"mort",
"morx",
"opbd",
"prop",
"trak",
"Zapf",
"Silf",
"Glat",
"Gloc",
"Feat",
"Sill",
] as const;
export function inspectDirectory(
buffer: ArrayBuffer,
maximumBytes = FONT_LIMITS.fileBytes,
): DirectoryInspection {
if (buffer.byteLength > maximumBytes)
throw new Error(
`Font exceeds the ${(maximumBytes / 1024 / 1024).toLocaleString()} MiB inspection limit.`,
);
if (buffer.byteLength < 4) throw new Error("File is too short to be a font.");
const view = new DataView(buffer),
signature = tagAt(view, 0);
if (signature === "wOF2")
throw new Error(
"WOFF2 is recognized but not supported by the local v0.1 parser. Convert it to WOFF, OTF or TTF first.",
);
if (signature === "wOF2") return inspectWoff2Directory(buffer);
if (signature === "ttcf")
throw new Error(
"TrueType Collections (TTC/OTC) are not supported in v0.1.",
"This is a TrueType/OpenType Collection; select and inspect one of its validated faces instead.",
);
if (signature === "wOFF") return inspectWoff(view);
if (
@@ -81,18 +151,371 @@ export function inspectDirectory(buffer: ArrayBuffer): DirectoryInspection {
)
return inspectSfnt(view, signature);
throw new Error(
`Unsupported font signature ${displayTag(signature)}; expected TTF, OTF or WOFF.`,
`Unsupported font signature ${displayTag(signature)}; expected TTF, OTF, WOFF or WOFF2.`,
);
}
function inspectSfnt(view: DataView, signature: string): DirectoryInspection {
requireBytes(view, 0, 12, "SFNT header");
const count = view.getUint16(4, false);
export function inspectCollection(
buffer: ArrayBuffer,
maximumBytes = FONT_LIMITS.fileBytes,
): CollectionDirectoryInspection {
if (buffer.byteLength > maximumBytes)
throw new Error(
`Font collection exceeds the ${(maximumBytes / 1024 / 1024).toLocaleString()} MiB inspection limit.`,
);
const view = new DataView(buffer);
requireBytes(view, 0, 12, "TTC header");
if (tagAt(view, 0) !== "ttcf")
throw new Error("Not a TrueType/OpenType Collection.");
const rawVersion = view.getUint32(4, false),
version =
rawVersion === 0x0001_0000
? "1.0"
: rawVersion === 0x0002_0000
? "2.0"
: null;
if (!version)
throw new Error(
`Unsupported TTC header version 0x${rawVersion.toString(16).padStart(8, "0")}; expected 1.0 or 2.0.`,
);
const count = view.getUint32(8, false);
if (count < 1) throw new Error("The font collection declares no faces.");
if (count > FONT_LIMITS.collectionFaces)
throw new Error(
`The font collection exceeds the ${FONT_LIMITS.collectionFaces}-face limit.`,
);
const offsetsBytes = checkedMultiply(count, 4, "TTC face-offset array"),
baseHeaderSize = checkedAdd(12, offsetsBytes, "TTC header"),
headerSize =
version === "2.0"
? checkedAdd(baseHeaderSize, 12, "TTC 2.0 header")
: baseHeaderSize;
requireBytes(view, 0, headerSize, "TTC header and face offsets");
let hasDigitalSignature = false;
const warnings: string[] = [];
if (version === "2.0") {
const signatureTag = view.getUint32(baseHeaderSize, false),
signatureLength = view.getUint32(baseHeaderSize + 4, false),
signatureOffset = view.getUint32(baseHeaderSize + 8, false);
if (signatureTag || signatureLength || signatureOffset) {
if (signatureTag !== 0x4453_4947)
throw new Error("TTC 2.0 has an invalid digital-signature tag.");
if (!signatureLength || !signatureOffset)
throw new Error(
"TTC 2.0 has an incomplete digital-signature boundary.",
);
requireBytes(
view,
signatureOffset,
signatureLength,
"TTC digital signature",
);
hasDigitalSignature = true;
warnings.push(
"The collection declares a DSIG block; its presence is inventoried but its signature is not validated.",
);
}
}
const offsets = new Set<number>(),
faces = [];
for (let index = 0; index < count; index += 1) {
const offset = view.getUint32(12 + index * 4, false);
if (offset < headerSize)
throw new Error(
`TTC face ${index + 1} starts inside the collection header.`,
);
if (offset % 4 !== 0)
throw new Error(`TTC face ${index + 1} offset is not four-byte aligned.`);
if (offsets.has(offset))
throw new Error(
`TTC faces contain a duplicate directory offset ${offset}.`,
);
offsets.add(offset);
const signature = tagAt(view, offset);
if (
signature !== "OTTO" &&
signature !== "true" &&
signature !== "typ1" &&
view.getUint32(offset, false) !== 0x0001_0000
)
throw new Error(
`TTC face ${index + 1} has unsupported SFNT signature ${displayTag(signature)}.`,
);
faces.push({
index,
offset,
directory: inspectSfnt(view, signature, offset),
});
}
return { version, faces, hasDigitalSignature, warnings };
}
export function extractCollectionFace(
buffer: ArrayBuffer,
faceIndex: number,
): ArrayBuffer {
const collection = inspectCollection(buffer),
face = collection.faces[faceIndex];
if (!face || !Number.isInteger(faceIndex))
throw new Error(
`Collection face index must be between 0 and ${collection.faces.length - 1}.`,
);
const directoryBytes = checkedAdd(
12,
checkedMultiply(face.directory.tables.length, 16, "SFNT table directory"),
"SFNT header",
);
let outputSize = directoryBytes;
for (const table of face.directory.tables)
outputSize = checkedAdd(
outputSize,
align4(table.length),
"extracted collection face",
);
if (outputSize > FONT_LIMITS.expandedBytes)
throw new Error(
"The selected collection face exceeds the 64 MiB reconstructed-face limit.",
);
const source = new Uint8Array(buffer),
output = new Uint8Array(outputSize),
target = new DataView(output.buffer);
output.set(source.subarray(face.offset, face.offset + 12), 0);
let cursor = directoryBytes;
const outputOffsets = new Map<string, number>();
face.directory.tables.forEach((table, index) => {
const base = 12 + index * 16;
for (let offset = 0; offset < 4; offset += 1)
target.setUint8(base + offset, table.tag.charCodeAt(offset));
target.setUint32(
base + 4,
Number.parseInt(table.checksum.slice(2), 16),
false,
);
target.setUint32(base + 8, cursor, false);
target.setUint32(base + 12, table.length, false);
output.set(
source.subarray(table.offset, table.offset + table.length),
cursor,
);
outputOffsets.set(table.tag, cursor);
cursor += align4(table.length);
});
const head = face.directory.tables.find((table) => table.tag === "head"),
headOffset = outputOffsets.get("head");
if (head && headOffset !== undefined && head.length >= 12) {
target.setUint32(headOffset + 8, 0, false);
target.setUint32(
headOffset + 8,
(0xb1b0_afba - sfntChecksum(target)) >>> 0,
false,
);
}
return output.buffer;
}
export function inspectWoff2Header(buffer: ArrayBuffer) {
if (buffer.byteLength > FONT_LIMITS.fileBytes)
throw new Error("Font exceeds the 16 MiB input limit.");
const view = new DataView(buffer);
requireBytes(view, 0, 48, "WOFF2 header");
if (tagAt(view, 0) !== "wOF2") throw new Error("Not a WOFF2 font.");
const declaredSize = view.getUint32(8, false),
count = view.getUint16(12, false),
reserved = view.getUint16(14, false),
expandedSize = view.getUint32(16, false),
compressedSize = view.getUint32(20, false);
validateTableCount(count);
requireBytes(view, 12, count * 16, "SFNT table directory");
if (reserved !== 0)
throw new Error("WOFF2 reserved header field is non-zero.");
if (declaredSize !== buffer.byteLength)
throw new Error("WOFF2 declared length differs from the file length.");
if (expandedSize > FONT_LIMITS.expandedBytes)
throw new Error("WOFF2 expanded size exceeds the 64 MiB safety limit.");
if (expandedSize < 12)
throw new Error("WOFF2 expanded SFNT size is too small.");
if (compressedSize === 0 || compressedSize > buffer.byteLength - 48)
throw new Error("WOFF2 compressed payload has invalid bounds.");
return { declaredSize, expandedSize, count };
}
export function inspectWoff2Directory(
buffer: ArrayBuffer,
): DirectoryInspection {
const header = inspectWoff2Header(buffer),
view = new DataView(buffer),
flavor = tagAt(view, 4);
if (flavor === "ttcf")
throw new Error("WOFF2 font collections are not supported.");
let cursor = 48,
expandedTableBytes = 0,
transformedBytes = 0;
const tables: TableRecord[] = [],
seen = new Set<string>();
for (let index = 0; index < header.count; index += 1) {
requireBytes(view, cursor, 1, "WOFF2 table flags");
const flags = view.getUint8(cursor++),
tagIndex = flags & 0x3f,
transformVersion = flags >>> 6;
let tag: string;
if (tagIndex === 0x3f) {
requireBytes(view, cursor, 4, "WOFF2 custom table tag");
tag = tagAt(view, cursor);
cursor += 4;
} else tag = WOFF2_KNOWN_TAGS[tagIndex] ?? "";
if (!/^[\x20-\x7e]{4}$/u.test(tag))
throw new Error("WOFF2 contains an invalid table tag.");
if (seen.has(tag))
throw new Error(`WOFF2 contains duplicate ${displayTag(tag)} tables.`);
seen.add(tag);
const original = readUIntBase128(view, cursor);
cursor = original.next;
if (original.value > FONT_LIMITS.tableBytes)
throw new Error(
`Table ${displayTag(tag)} exceeds the 32 MiB expanded-table limit.`,
);
const isGlyfOrLoca = tag === "glyf" || tag === "loca";
let transformed: boolean;
if (isGlyfOrLoca) {
if (transformVersion !== 0 && transformVersion !== 3)
throw new Error(`WOFF2 ${tag} uses an invalid transform version.`);
transformed = transformVersion === 0;
} else if (tag === "hmtx") {
if (transformVersion !== 0 && transformVersion !== 1)
throw new Error("WOFF2 hmtx uses an invalid transform version.");
transformed = transformVersion === 1;
} else {
if (transformVersion !== 0)
throw new Error(
`WOFF2 ${displayTag(tag)} uses a reserved transform version.`,
);
transformed = false;
}
let streamLength = original.value;
if (transformed) {
const transformedLength = readUIntBase128(view, cursor);
cursor = transformedLength.next;
streamLength = transformedLength.value;
if (streamLength > FONT_LIMITS.tableBytes)
throw new Error(
`Transformed ${displayTag(tag)} table exceeds the 32 MiB limit.`,
);
}
tables.push({
tag,
description: TABLE_DESCRIPTIONS[tag] ?? "OpenType table",
offset: transformedBytes,
length: original.value,
storedLength: streamLength,
checksum: "WOFF2 stream",
compressed: true,
});
expandedTableBytes = checkedAdd(
expandedTableBytes,
align4(original.value),
"WOFF2 expanded table sizes",
);
transformedBytes = checkedAdd(
transformedBytes,
streamLength,
"WOFF2 transformed table sizes",
);
}
const expectedSfntSize = checkedAdd(
12 + header.count * 16,
expandedTableBytes,
"WOFF2 expanded SFNT size",
);
if (expectedSfntSize !== header.expandedSize)
throw new Error(
"WOFF2 reconstructed SFNT size disagrees with its table directory.",
);
const compressedSize = view.getUint32(20, false);
requireBytes(view, cursor, compressedSize, "WOFF2 compressed table stream");
if (transformedBytes > FONT_LIMITS.expandedBytes)
throw new Error("WOFF2 transformed table stream exceeds the 64 MiB limit.");
validateOptionalBlock(
view,
view.getUint32(28, false),
view.getUint32(32, false),
"WOFF2 metadata",
);
validateOptionalBlock(
view,
view.getUint32(40, false),
view.getUint32(44, false),
"WOFF2 private data",
);
return {
container: "woff2",
flavor:
flavor === "OTTO"
? "WOFF2 with CFF outlines"
: "WOFF2 with TrueType outlines",
declaredSize: header.declaredSize,
expandedSize: header.expandedSize,
tables,
warnings: [
"WOFF2 stores one Brotli-compressed table stream; displayed stored lengths are pre-Brotli transform lengths and checksums are not present in the container.",
],
};
}
function readUIntBase128(
view: DataView,
start: number,
): { value: number; next: number } {
let value = 0,
cursor = start;
for (let index = 0; index < 5; index += 1) {
requireBytes(view, cursor, 1, "WOFF2 UIntBase128");
const byte = view.getUint8(cursor++);
if (index === 0 && byte === 0x80)
throw new Error("WOFF2 UIntBase128 has a leading zero continuation.");
if (value & 0xfe00_0000)
throw new Error("WOFF2 UIntBase128 overflows 32 bits.");
value = value * 128 + (byte & 0x7f);
if ((byte & 0x80) === 0) return { value, next: cursor };
}
throw new Error("WOFF2 UIntBase128 is longer than five bytes.");
}
function align4(value: number): number {
return (value + 3) & ~3;
}
function checkedAdd(left: number, right: number, label: string): number {
const result = left + right;
if (!Number.isSafeInteger(result)) throw new Error(`${label} overflow.`);
return result;
}
function checkedMultiply(left: number, right: number, label: string): number {
const result = left * right;
if (!Number.isSafeInteger(result)) throw new Error(`${label} overflow.`);
return result;
}
function sfntChecksum(view: DataView) {
let sum = 0;
for (let offset = 0; offset < view.byteLength; offset += 4)
sum = (sum + view.getUint32(offset, false)) >>> 0;
return sum;
}
function inspectSfnt(
view: DataView,
signature: string,
baseOffset = 0,
): DirectoryInspection {
requireBytes(view, baseOffset, 12, "SFNT header");
const count = view.getUint16(baseOffset + 4, false);
validateTableCount(count);
requireBytes(view, baseOffset + 12, count * 16, "SFNT table directory");
const tables: TableRecord[] = [];
for (let index = 0; index < count; index += 1) {
const base = 12 + index * 16,
const base = baseOffset + 12 + index * 16,
tag = tagAt(view, base),
checksum = view.getUint32(base + 4, false),
offset = view.getUint32(base + 8, false),
@@ -101,11 +524,20 @@ function inspectSfnt(view: DataView, signature: string): DirectoryInspection {
tables.push(record(tag, offset, length, length, checksum));
}
const warnings = directoryWarnings(tables);
let reconstructedSize = 12 + count * 16;
for (const table of tables)
reconstructedSize = checkedAdd(
reconstructedSize,
align4(table.length),
"reconstructed SFNT size",
);
if (reconstructedSize > FONT_LIMITS.expandedBytes)
throw new Error("SFNT face exceeds the 64 MiB reconstructed-size limit.");
return {
container: signature === "OTTO" ? "opentype-cff" : "truetype",
flavor: signature === "OTTO" ? "OpenType/CFF" : "TrueType outlines",
declaredSize: view.byteLength,
expandedSize: view.byteLength,
declaredSize: baseOffset === 0 ? view.byteLength : reconstructedSize,
expandedSize: baseOffset === 0 ? view.byteLength : reconstructedSize,
tables,
warnings,
};
@@ -337,7 +769,10 @@ export function decodeEmbedding(raw: number | null): EmbeddingInfo {
export function extensionFormat(fileName: string, container?: FontContainer) {
const extension = fileName.split(".").at(-1)?.toLowerCase();
if (extension === "ttc" || extension === "otc" || container === "collection")
return "collection";
if (extension === "woff" || container === "woff") return "woff";
if (extension === "woff2" || container === "woff2") return "woff2";
if (extension === "ttf" || container === "truetype") return "truetype";
if (extension === "otf" || container === "opentype-cff") return "opentype";
return "opentype";
src/styles.css
+41
View File
@@ -227,6 +227,20 @@ summary:focus-visible {
grid-template-columns: repeat(4, minmax(0, 1fr));
}
.collection-panel {
display: grid;
gap: 0.75rem;
border-left: 4px solid var(--accent);
}
.collection-panel .section-heading {
margin-bottom: 0;
}
.collection-panel select {
width: min(100%, 52rem);
}
.summary-card {
display: grid;
align-content: start;
@@ -296,6 +310,10 @@ textarea {
align-items: center;
}
.shaping-controls label {
grid-template-columns: auto minmax(8rem, 18rem);
}
input[type="range"] {
padding: 0;
accent-color: var(--accent);
@@ -495,6 +513,29 @@ summary {
align-items: center;
}
.layout-summary {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr));
gap: 0.7rem;
margin-bottom: 1rem;
}
.layout-summary article {
border: 1px solid var(--line);
border-radius: 0.7rem;
background: Canvas;
padding: 0.75rem;
}
.layout-summary h3,
.layout-summary p {
margin: 0;
}
.layout-summary p + p {
margin-top: 0.35rem;
}
.table-scroll {
max-height: 35rem;
overflow: auto;
src/toolbox/manifest.source.json
+59 -3
View File
@@ -3,12 +3,22 @@
"schemaVersion": 1,
"id": "de.add-ideas.font-tools",
"name": "Font Tools",
"version": "0.1.0",
"description": "Inspect and prepare fonts locally.",
"version": "0.2.0",
"description": "Inspect, compare and prepare fonts locally.",
"entry": "./",
"icon": "./favicon.svg",
"categories": ["design", "developer"],
"tags": ["font", "ttf", "otf", "woff", "glyph", "typography", "subset"],
"tags": [
"font",
"ttf",
"otf",
"ttc",
"otc",
"woff",
"glyph",
"typography",
"subset"
],
"integration": {
"contextVersion": 1,
"launchModes": ["navigate", "new-tab"],
@@ -21,6 +31,52 @@
"crossOriginIsolated": false,
"topLevelContext": false
},
"io": {
"accepts": [
{
"mediaType": "font/ttf",
"extensions": [".ttf"]
},
{
"mediaType": "font/otf",
"extensions": [".otf"]
},
{
"mediaType": "font/collection",
"extensions": [".ttc", ".otc"]
},
{
"mediaType": "font/woff",
"extensions": [".woff"]
},
{
"mediaType": "font/woff2",
"extensions": [".woff2"]
}
],
"produces": [
{
"mediaType": "text/css",
"extensions": [".css"]
},
{
"mediaType": "application/json",
"extensions": [".json"]
},
{
"mediaType": "font/ttf",
"extensions": [".ttf"]
},
{
"mediaType": "font/otf",
"extensions": [".otf"]
}
]
},
"capabilities": {
"required": ["workers"],
"optional": []
},
"privacy": {
"processing": "local",
"fileUploads": true,
src/types/wawoff2.d.ts
Vendored
+3
View File
@@ -0,0 +1,3 @@
declare module "wawoff2/compress.js" {
export default function compress(input: Uint8Array): Promise<Uint8Array>;
}
src/version.ts
+1 -1
View File
@@ -1 +1 @@
export const APP_VERSION = "0.1.0";
export const APP_VERSION = "0.2.0";
tests/browser/app.spec.ts
+94 -3
View File
@@ -1,6 +1,7 @@
import { expect, test, type Page } from "@playwright/test";
import { readFile } from "node:fs/promises";
import opentype from "opentype.js";
import compressWoff2 from "wawoff2/compress.js";
const ORIGIN = "http://127.0.0.1:4202";
const { Font, Glyph, Path } = opentype;
@@ -82,6 +83,65 @@ test("enforces the no-subsetting fsType bit", async ({ page }) => {
).toBeVisible();
});
test("decompresses and inspects a local WOFF2 font", async ({ page }) => {
await page.goto("/font/");
const compressed = await compressWoff2(fixtureFont(0));
await page.locator('input[type="file"]').setInputFiles({
name: "fixture.woff2",
mimeType: "font/woff2",
buffer: Buffer.from(compressed),
});
await expect(page.locator('p[role="status"]')).toContainText("Inspected");
await expect(page.getByText("woff2", { exact: false }).first()).toBeVisible();
await expect(
page.getByText("Fixture Sans", { exact: true }).first(),
).toBeVisible();
});
test("validates a real TTC container and switches its selected face", async ({
page,
}) => {
const external = await blockExternal(page);
await page.goto("/font/");
await page.locator('input[type="file"]').setInputFiles({
name: "fixture.ttc",
mimeType: "font/collection",
buffer: fixtureCollection([
fixtureFont(0, "Fixture Sans"),
fixtureFont(0, "Fixture Serif"),
]),
});
await expect(page.locator('p[role="status"]')).toContainText(
"collection face 1 of 2",
);
await expect(page.getByLabel("Selected collection face")).toHaveValue("0");
await expect(
page.getByText("Fixture Sans", { exact: true }).first(),
).toBeVisible();
await page.getByLabel("Selected collection face").selectOption("1");
await expect(page.locator('p[role="status"]')).toContainText(
"Selected collection face 2 of 2",
);
await expect(
page.getByText("Fixture Serif", { exact: true }).first(),
).toBeVisible();
await expect(
page.getByRole("button", { name: "Build & download .otf subset" }),
).toBeDisabled();
await expect(
page.getByText(/does not export or subset collections/u),
).toBeVisible();
await expect(page.getByLabel("Generated CSS")).toContainText(
'format("collection")',
);
await expect(page.getByText(/cannot portably identify/u)).toBeVisible();
await expect(page.locator("iframe.font-preview-frame")).toHaveAttribute(
"srcdoc",
/blob:/u,
);
expect(external).toEqual([]);
});
test("shell, CSP, manifest and nested offline PWA", async ({
page,
context,
@@ -116,7 +176,7 @@ test("shell, CSP, manifest and nested offline PWA", async ({
const manifest = await request.get("/font/toolbox-app.json");
await expect(manifest.json()).resolves.toMatchObject({
id: "de.add-ideas.font-tools",
version: "0.1.0",
version: "0.2.0",
requirements: { workers: true },
});
});
@@ -133,7 +193,7 @@ async function blockExternal(page: Page) {
return requests;
}
function fixtureFont(fsType: number) {
function fixtureFont(fsType: number, familyName = "Fixture Sans") {
const notdef = new Glyph({
name: ".notdef",
advanceWidth: 600,
@@ -158,7 +218,7 @@ function fixtureFont(fsType: number) {
path: rectanglePath(60, 0, 530, 700),
}),
font = new Font({
familyName: "Fixture Sans",
familyName,
styleName: "Regular",
unitsPerEm: 1_000,
ascender: 800,
@@ -172,6 +232,37 @@ function fixtureFont(fsType: number) {
return Buffer.from(bytes);
}
function fixtureCollection(fonts: Buffer[]) {
const headerSize = 12 + fonts.length * 4,
offsets: number[] = [];
let size = align4(headerSize);
for (const font of fonts) {
offsets.push(size);
size += align4(font.byteLength);
}
const output = Buffer.alloc(size);
output.write("ttcf", 0, "ascii");
output.writeUInt32BE(0x0001_0000, 4);
output.writeUInt32BE(fonts.length, 8);
fonts.forEach((font, index) => {
const faceOffset = offsets[index]!;
output.writeUInt32BE(faceOffset, 12 + index * 4);
font.copy(output, faceOffset);
const tableCount = font.readUInt16BE(4);
for (let tableIndex = 0; tableIndex < tableCount; tableIndex += 1) {
const sourceRecord = 12 + tableIndex * 16,
targetRecord = faceOffset + sourceRecord,
sourceOffset = font.readUInt32BE(sourceRecord + 8);
output.writeUInt32BE(faceOffset + sourceOffset, targetRecord + 8);
}
});
return output;
}
function align4(value: number) {
return (value + 3) & ~3;
}
function patchFsType(bytes: Uint8Array, fsType: number) {
const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength),
count = view.getUint16(4, false);
tests/browser/responsive.spec.ts
+18
View File
@@ -0,0 +1,18 @@
import { expect, test } from "@playwright/test";
test("keeps the primary workspace inside a narrow viewport", async ({
page,
}) => {
await page.goto("/font/");
await expect(page.locator("main").first()).toBeVisible();
await expect(
page.locator("main .loading, main .workbench-loading"),
).toHaveCount(0);
const widths = await page.evaluate(() => ({
content: document.documentElement.scrollWidth,
viewport: document.documentElement.clientWidth,
}));
expect(widths.viewport).toBeLessThanOrEqual(430);
expect(widths.content).toBeLessThanOrEqual(widths.viewport + 1);
});
tests/components/Workbench.test.tsx
+4
View File
@@ -16,6 +16,10 @@ describe("Font Workbench", () => {
"accept",
expect.stringContaining(".woff2"),
);
expect(screen.getByLabelText("Open font")).toHaveAttribute(
"accept",
expect.stringContaining(".ttc"),
);
expect(screen.getByText(/Disposable worker/u)).toBeVisible();
expect(screen.getByRole("status")).toHaveTextContent("Choose a local");
});
tests/core/css.test.ts
+25
View File
@@ -17,6 +17,7 @@ const inspection: FontInspection = {
coverageRangesTruncated: false,
coverageBlocks: [],
axes: [{ tag: "wght", name: "Weight", min: 200, default: 400, max: 900 }],
layout: [],
embedding: {
raw: 0,
rawHex: "0x0000",
@@ -52,4 +53,28 @@ describe("safe CSS generation", () => {
);
expect(() => validateLocalPath("./font\n.woff")).toThrow(/control/u);
});
it("labels collection CSS as non-portable face selection", () => {
const result = generateFontFace({
family: "Fixture collection face",
sourcePath: "./fonts/fixture.ttc",
display: "swap",
inspection: {
...inspection,
fileName: "fixture.ttc",
container: "collection",
collection: {
version: "1.0",
selectedFace: 0,
hasDigitalSignature: false,
faces: [],
},
},
includeUnicodeRange: false,
});
expect(result.css).toContain('format("collection")');
expect(result.warnings).toContainEqual(
expect.stringMatching(/cannot portably identify/u),
);
});
});
tests/core/preview.test.ts
+4 -1
View File
@@ -9,10 +9,13 @@ describe("sandbox preview document", () => {
42,
1.2,
{ wght: 550 },
{ features: '"liga" 1', language: "ar", direction: "rtl" },
);
expect(html).toContain("&lt;script&gt;");
expect(html).not.toContain('<script>alert("x")</script>');
expect(html).toContain("default-src 'none'");
expect(html).toContain("&quot;wght&quot; 550");
expect(html).toContain('"wght" 550');
expect(html).toContain('font-feature-settings:"liga" 1');
expect(html).toContain('lang="ar" dir="rtl"');
});
});
tests/core/sfnt.test.ts
+151 -1
View File
@@ -1,5 +1,12 @@
import { describe, expect, it } from "vitest";
import { decodeEmbedding, inspectDirectory } from "../../src/core/sfnt";
import {
decodeEmbedding,
extractCollectionFace,
inspectCollection,
inspectDirectory,
inspectWoff2Directory,
inspectWoff2Header,
} from "../../src/core/sfnt";
describe("SFNT directory validation", () => {
it("inventories bounded TrueType tables", () => {
@@ -21,6 +28,93 @@ describe("SFNT directory validation", () => {
view.setUint32(12 + 12, 12, false);
expect(() => inspectDirectory(invalid)).toThrow(/file boundary/u);
});
it("validates WOFF2 container sizes before decompression", () => {
const buffer = new ArrayBuffer(52),
bytes = new Uint8Array(buffer),
view = new DataView(buffer);
bytes.set(new TextEncoder().encode("wOF2"), 0);
bytes.set(new TextEncoder().encode("\u0000\u0001\u0000\u0000"), 4);
view.setUint32(8, buffer.byteLength, false);
view.setUint16(12, 1, false);
view.setUint32(16, 32, false);
view.setUint32(20, 4, false);
expect(inspectWoff2Header(buffer)).toEqual({
declaredSize: 52,
expandedSize: 32,
count: 1,
});
view.setUint32(16, 70 * 1024 * 1024, false);
expect(() => inspectWoff2Header(buffer)).toThrow(/64 MiB/u);
});
it("rejects reserved WOFF2 transform versions before decoding", () => {
expect(() => inspectWoff2Directory(woff2Table(5, 1))).toThrow(
/reserved transform version/u,
);
expect(() => inspectWoff2Directory(woff2Table(3, 2))).toThrow(
/invalid transform version/u,
);
expect(inspectWoff2Directory(woff2Table(5, 0)).tables[0]).toMatchObject({
tag: "name",
storedLength: 4,
});
expect(inspectWoff2Directory(woff2Table(3, 1)).tables[0]).toMatchObject({
tag: "hmtx",
storedLength: 4,
});
});
it("validates TTC face offsets and reconstructs a standalone selected face", () => {
const source = ttc([
sfnt(["head", "cmap"]),
sfnt(["head", "name", "CFF "]),
]),
collection = inspectCollection(source);
expect(collection).toMatchObject({
version: "1.0",
hasDigitalSignature: false,
});
expect(collection.faces.map((face) => face.directory.flavor)).toEqual([
"TrueType outlines",
"TrueType outlines",
]);
const extracted = extractCollectionFace(source, 1),
report = inspectDirectory(extracted);
expect(report.tables.map((table) => table.tag)).toEqual([
"head",
"name",
"CFF ",
]);
expect(
report.tables.every((table) => table.offset < extracted.byteLength),
).toBe(true);
});
it("rejects malformed TTC versions, counts, duplicate and unaligned offsets", () => {
const invalidVersion = ttc([sfnt(["head"])]),
invalidCount = ttc([sfnt(["head"])]),
duplicate = ttc([sfnt(["head"]), sfnt(["head"])]),
unaligned = ttc([sfnt(["head"])]);
new DataView(invalidVersion).setUint32(4, 0x0003_0000, false);
expect(() => inspectCollection(invalidVersion)).toThrow(/version/u);
new DataView(invalidCount).setUint32(8, 65, false);
expect(() => inspectCollection(invalidCount)).toThrow(/64-face/u);
const duplicateView = new DataView(duplicate);
duplicateView.setUint32(16, duplicateView.getUint32(12, false), false);
expect(() => inspectCollection(duplicate)).toThrow(/duplicate/u);
new DataView(unaligned).setUint32(12, 17, false);
expect(() => inspectCollection(unaligned)).toThrow(/aligned/u);
});
it("validates the optional TTC 2.0 DSIG boundary", () => {
const source = ttc([sfnt(["head"])], 0x0002_0000),
headerEnd = 12 + 4;
expect(inspectCollection(source).version).toBe("2.0");
const view = new DataView(source);
view.setUint32(headerEnd, 0x4453_4947, false);
expect(() => inspectCollection(source)).toThrow(/incomplete/u);
});
});
describe("embedding flags", () => {
@@ -47,6 +141,27 @@ function signature(value: string) {
return bytes.buffer;
}
function woff2Table(tagIndex: number, transformVersion: number) {
const glyfOrLoca = tagIndex === 10 || tagIndex === 11,
declaresTransform = glyfOrLoca
? transformVersion === 0
: transformVersion !== 0,
directoryBytes = declaresTransform ? 3 : 2,
buffer = new ArrayBuffer(48 + directoryBytes + 1),
bytes = new Uint8Array(buffer),
view = new DataView(buffer);
bytes.set(new TextEncoder().encode("wOF2"), 0);
view.setUint32(4, 0x0001_0000, false);
view.setUint32(8, buffer.byteLength, false);
view.setUint16(12, 1, false);
view.setUint32(16, 32, false);
view.setUint32(20, 1, false);
bytes[48] = (transformVersion << 6) | tagIndex;
bytes[49] = 4;
if (declaresTransform) bytes[50] = 4;
return buffer;
}
function sfnt(tags: string[]) {
const directoryBytes = 12 + tags.length * 16,
tableBytes = 12,
@@ -65,3 +180,38 @@ function sfnt(tags: string[]) {
});
return buffer;
}
function ttc(fonts: ArrayBuffer[], version = 0x0001_0000) {
const extra = version === 0x0002_0000 ? 12 : 0,
headerSize = 12 + fonts.length * 4 + extra,
offsets: number[] = [];
let size = align4(headerSize);
for (const font of fonts) {
offsets.push(size);
size += align4(font.byteLength);
}
const buffer = new ArrayBuffer(size),
output = new Uint8Array(buffer),
view = new DataView(buffer);
output.set(new TextEncoder().encode("ttcf"), 0);
view.setUint32(4, version, false);
view.setUint32(8, fonts.length, false);
fonts.forEach((font, index) => {
const faceOffset = offsets[index]!,
source = new Uint8Array(font),
sourceView = new DataView(font);
view.setUint32(12 + index * 4, faceOffset, false);
output.set(source, faceOffset);
const tableCount = sourceView.getUint16(4, false);
for (let tableIndex = 0; tableIndex < tableCount; tableIndex += 1) {
const recordOffset = faceOffset + 12 + tableIndex * 16,
sourceOffset = sourceView.getUint32(12 + tableIndex * 16 + 8, false);
view.setUint32(recordOffset + 8, faceOffset + sourceOffset, false);
}
});
return buffer;
}
function align4(value: number) {
return (value + 3) & ~3;
}