28 lines
1.7 KiB
Markdown
28 lines
1.7 KiB
Markdown
# Architecture
|
|
|
|
`core/sfnt.ts` validates SFNT/WOFF headers and table boundaries before parsing.
|
|
For TTC/OTC it accepts header versions 1.0 and 2.0, caps face count, validates
|
|
the complete offset array, uniqueness/alignment, each face signature and SFNT
|
|
directory, and the optional DSIG boundary. A selected face is reconstructed by
|
|
copying its bounded tables into a standalone SFNT directory with rewritten
|
|
offsets and checksum adjustment; those bytes exist only as a preview Blob and
|
|
are never offered as a round-trip-safe export.
|
|
For WOFF2 it validates the header, UIntBase128 directory, reconstructed SFNT
|
|
size, transform declarations and compressed-stream bounds before Fontkit's
|
|
browser build performs local Brotli/table decoding. This path needs neither
|
|
WebAssembly nor dynamic evaluation and therefore remains compatible with the
|
|
app's strict CSP. `font.worker.ts` owns the parser instance and source
|
|
bytes; the UI receives only bounded serializable inspection records, collection
|
|
face labels and the selected preview buffer, including variable axes and
|
|
GSUB/GPOS script, feature and lookup inventories. Each load gets a new worker,
|
|
and an unresponsive operation is terminated after eight seconds. Face switching
|
|
reuses that worker and updates its coverage/report model atomically. Subsetting
|
|
is a separate worker command that rebuilds a static outline font from requested
|
|
Unicode glyphs only after OS/2 restrictions are checked; WOFF2, variable and
|
|
collection sources are explicitly blocked.
|
|
|
|
React keeps the last successful inspection after errors. Font rendering and the
|
|
feature/language/direction comparison lab occur in a scriptless sandboxed iframe
|
|
using the browser's shaping engine. Relative assets and a same-origin service
|
|
worker support nested offline deployment.
|