1.7 KiB
Architecture
core/sfnt.ts validates SFNT/WOFF headers and table boundaries before parsing.
For TTC/OTC it accepts header versions 1.0 and 2.0, caps face count, validates
the complete offset array, uniqueness/alignment, each face signature and SFNT
directory, and the optional DSIG boundary. A selected face is reconstructed by
copying its bounded tables into a standalone SFNT directory with rewritten
offsets and checksum adjustment; those bytes exist only as a preview Blob and
are never offered as a round-trip-safe export.
For WOFF2 it validates the header, UIntBase128 directory, reconstructed SFNT
size, transform declarations and compressed-stream bounds before Fontkit's
browser build performs local Brotli/table decoding. This path needs neither
WebAssembly nor dynamic evaluation and therefore remains compatible with the
app's strict CSP. font.worker.ts owns the parser instance and source
bytes; the UI receives only bounded serializable inspection records, collection
face labels and the selected preview buffer, including variable axes and
GSUB/GPOS script, feature and lookup inventories. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Face switching
reuses that worker and updates its coverage/report model atomically. Subsetting
is a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked; WOFF2, variable and
collection sources are explicitly blocked.
React keeps the last successful inspection after errors. Font rendering and the feature/language/direction comparison lab occur in a scriptless sandboxed iframe using the browser's shaping engine. Relative assets and a same-origin service worker support nested offline deployment.