partforge 0.73.0 → 0.74.0

package/bin/cli.js

@@ -9,6 +9,7 @@ import { pathToFileURL } from "node:url";
 import { resolve, dirname } from "node:path";
 import { writeFileSync, mkdirSync } from "node:fs";
 import { detectBackend } from "../src/framework/backend-select.js";
+import { fontsFor } from "../src/framework/fonts.js";
 import { viewAnimations, evaluate, cueAt } from "../src/framework/animation.js";
 import { bootOcctKernel } from "../src/testing/occt.js";
 import { bootManifoldKernel } from "../src/testing/manifold.js";
@@ -78,9 +79,13 @@ async function loadPart(partPath, usage) {
 
 // Pass the part's declared fonts through, mirroring the worker path (jobs.js) —
 // otherwise a part using a named font builds in the browser but dies headlessly
-// with `text2d: unknown font …`.
-const bootKernel = (part) => {
-  const opts = { fonts: part.fonts, imports: part.imports };
+// with `text2d: unknown font …`. A function-form `fonts` is resolved against
+// the CLI's base params; see "CLI limitation" in the design doc — a verify case
+// or animation frame that CHANGES the font param still builds with the
+// base-params face, because the kernel is booted once.
+const bootKernel = (part, params = {}) => {
+  const p = { ...(part.defaults ?? {}), ...params };
+  const opts = { fonts: fontsFor(part, p), imports: part.imports };
   const backend = process.env.PARTFORGE_BACKEND || detectBackend(part); // env: crash()'s NEEDS_OCCT retry
   return backend === "occt" ? bootOcctKernel(opts) : bootManifoldKernel(opts);
 };
@@ -238,7 +243,7 @@ const commands = {
         anim = byView.get(animView).find((x) => x.name === flags.animation);
       }
 
-      const kernel = await bootKernel(part);
+      const kernel = await bootKernel(part, baseParams);
 
       if (anim === null) {
         const files = await renderViews(kernel, part, view, { views, out: outDir, params: baseParams });

package/docs/AUTHORING-PARTS.md

@@ -72,7 +72,7 @@ export default {
   meta: { title, units, background? },     // title string; units e.g. "mm"; background = 0xRRGGBB scene colour
   parameters,                              // the control-panel schema (array of sections — see below)
   defaults,                                // flat { paramKey: value } — seeds params + control values
-  fonts?,                                  // { name: source } — fonts a part's k.text2d() needs; framework preloads before build (see below)
+  fonts?,                                  // { name: source } — or (p) => ({ name: source }) when a control drives the typeface
   imports?,                                // { name: source } — STEP/STL/3MF files a part's k.import() needs; same preload timing as fonts (see below)
   derive?,                                 // (p) => d, or { group: (p, d) => {…}, … } — dependent values computed once per build
   parts: {                                 // named sub-parts; each builds ONE solid
@@ -631,6 +631,7 @@ Every control accepts `key`, `type`, `label`, `description`, `hidden`, `when` an
 | `"checkbox"` | an on/off box: ticked writes `on`, cleared writes `0` | `on` (default `1`) |
 | `"select"` | a dropdown | `options` |
 | `"radio"` | a segmented button row | `options` |
+| `"font"` | a typeface picker, or a URL field with no catalog | `allow`, `preview` |
 
 Numeric controls always show the number box: drag the slider *or* type an exact
 value. Typed values may be finer than `step` and clamp to `[min, max]` on commit.
@@ -645,6 +646,32 @@ each entry is both value and label — or the long form
 types, `12` is not `"12"`). An option's `description` surfaces as a hover tooltip
 on that one option, not as a ⓘ popover.
 
+**`allow` and `preview`** (font) configure the typeface control. `allow` lists the
+source kinds a **param-supplied** value may use — what the picker writes, or what
+arrives in a share link:
+
+| value | accepts |
+|---|---|
+| `"https"` | any `https:` URL. **The default** — omitting `allow` means `["https"]` |
+| `"gstatic"` | `https://fonts.gstatic.com` only (hostname-exact: a lookalike host is refused) |
+| `"asset"` | a `pfc-asset://` token — a font the host has stored for this part |
+
+Name as many as apply (`allow: ["gstatic", "asset"]`); anything unnamed is refused,
+which is how `http:`, `file:`, `data:` and `blob:` are closed off. The check is
+deliberately narrow — **it applies only to values that arrive as params.** A source
+you write into `fonts` yourself is code, not user input, and stays unrestricted:
+`fonts: { label: "https://cdn.example.com/Courier-Prime.ttf" }` keeps working
+whatever `allow` says. A refused param falls back to `defaults[key]`, and the build
+carries a warning naming the key rather than failing (lint's `font-source-scheme`
+catches the case where that default is itself refused). `allow` gates what the
+**picker fetches** too: a family whose files it refuses is dropped from the list
+rather than offered, and neither that family's name-preview face nor its weight
+samples are ever requested.
+
+`preview` is the sample string the picker's weight list renders each face in — set
+it when the generic sample shows the wrong glyphs (`preview: "0123456789"` for a
+part that letters digits). Defaults to `Hamburgefonstiv 0123`.
+
 **`"readout"` is not a control.** It has no `key`, never writes `params`, and can
 never be a preset target. It displays one output of `derive()`, named by
 `derivedKey`, refreshed on every parameter change; `unit` is appended to numeric
@@ -1318,6 +1345,24 @@ fonts: {
 
 Reference a font by name: `k.text2d("text", { font: "heading" })`. Omit the `font` option to use the bundled **Roboto** (Regular, SIL OFL 1.1) default.
 
+**Making the typeface a parameter.** Give `fonts` a function of params instead of a
+static object, and a `type: "font"` control can drive which face `text2d` uses —
+`src/parts/nameplate.js` is the reference:
+
+```js
+{ key: "face", type: "font", label: "Typeface" },   // in `parameters`
+fonts: (p) => (p.face ? { face: p.face } : {}),     // a function, not a static map
+k.text2d(p.label, { font: "face" }),                // only when p.face is set
+```
+
+An empty `face` declares nothing — `fonts` returns `{}`, and `text2d` falls back to
+the bundled Roboto — so the part still builds with no network access. A part with a
+fixed typeface needs none of this: a plain `{ name: source }` object is fine.
+
+The control's `allow` list bounds what a picked — or share-link-supplied — value may
+be, and defaults to `["https"]`; see the control-types table above. It does **not**
+constrain sources you declare yourself.
+
 **Build-time & curve semantics:**
 
 `text2d` is a **build-time operation** (not `derive()`), and **the curve representation differs by backend:**
@@ -1548,6 +1593,18 @@ returns instead:
 Pass `onDownload({ data, filename, mime })` to `mount()` to receive the exported bytes
 yourself (e.g. to download from a different origin) instead of partforge's own DOM download.
 
+- `fontCatalog` — a provider backing every `type: "font"` control in the part:
+
+  - `search(query, { limit }) → Promise<FontFamily[]>`, where a `FontFamily` is
+    `{ id, family, category, variants: [{ variant, label, url, bytes }],
+    menuUrl }`. `url` is what the picker writes into `params`; `menuUrl` is a
+    name-only subset used to draw the list row.
+  - `describe(source) → { family, variant } | null` — optional reverse lookup so
+    the closed control can name a face whose URL carries a hashed filename.
+
+  partforge ships no provider — a host supplies one, and without it every font
+  control renders as a URL field.
+
 **Showcase capture (the mount handle).** The handle can also render the user's *current*
 framing offscreen at a resolution independent of the window size and devicePixelRatio —
 for gallery/preview images, where grabbing the live canvas would be capped at the viewer
@@ -1983,6 +2040,15 @@ runtime authority for those cases), `reference-unknown` (a sub-part's
 `refVolumeDeltaPct`, `refBboxDelta` — but the sub-part declares no `reference`,
 so the deviation gate always reports status "skip") (warning).
 
+**Font controls** — `font-control-not-in-fonts` (a `type: "font"` control's
+`key` is not read by a function-form `fonts` — a static `fonts` object or a
+missing `fonts` field both provably can't depend on a param, so the picker
+changes a param and nothing else happens; the message names which of the two
+it is) (error); `font-source-scheme` (`defaults` holds a value for a font
+control that the control's own `allow` list would refuse — at build time it's
+swapped for `defaults[key]`, i.e. itself, so the part boots with no usable
+font; use a source `allow` accepts, or widen `allow`) (warning).
+
 A rule that itself throws yields an `internal-rule-error` **warning** and the run
 continues: `lintPart` never throws and never blocks a part because of a linter bug.
 
@@ -2135,6 +2201,14 @@ unverified.
 `">=[x,y,z]"` where `*` skips an axis. The parser is strict — a malformed assertion
 fails loudly.
 
+**A part whose typeface is a parameter needs band assertions, not points.** Glyph
+advance widths differ by family, so a `text2d` sub-part's `bbox`/`volume` shifts with
+the picked face even when every other param is unchanged. Write `verify` bounds wide
+enough to hold across the fonts your `allow` list admits (a range, or `<=`/`>=`,
+rather than exact equality). `verify` runs against `defaults`, which is stable — the
+nameplate ships `face: ""` (the bundled Roboto), so its own `verify` cases don't
+need this, but a part whose default already names a specific face does.
+
 ```js
 verify: { expect: {
   stand: { boundsMin: ">=[0,0,0]", centerOfMass: "<=[*,*,25]" },   // sits in +octant, mass kept low

package/docs/KERNEL-CONTRACT.md

@@ -463,7 +463,9 @@ sub-part and attaches `warnings: [{part, message}]` to the `meshes` /
 `capture-meshes` result when any were recorded, so a host can tell its user (or its
 agent) that the part on screen is missing a feature it asked for. A skipped op still
 console.warns as before; the channel is additive. Hosts that ignore the field see
-exactly the old behavior.
+exactly the old behavior. The same array also carries *job-level* notices that
+belong to no single sub-part — currently a font source refused by its control's
+`allow` list — as entries with `part: null`.
 
 ## Shape2D (2-D booleans)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "partforge",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Turn a declarative part definition into a parametric-CAD web app (three.js + Manifold/Replicad). Requires a Vite-based consumer.",
   "type": "module",
   "license": "MIT",

package/src/framework/app.css

@@ -198,6 +198,19 @@ textarea.text-input { min-height: 64px; resize: vertical; }
 .text-input:focus { outline: none; border-color: var(--pf-accent);
   box-shadow: 0 0 0 3px color-mix(in oklab, var(--pf-accent) 35%, transparent); }
 
+/* the `type: "font"` control — a button that shows the current face IN it */
+.font-btn { width: 100%; display: flex; align-items: center; gap: 8px; text-align: left; cursor: pointer;
+  background: var(--pf-input-bg); color: var(--pf-text-strong);
+  border: 1px solid var(--pf-border); border-radius: var(--pf-radius-control); padding: 7px 9px; }
+.font-btn:hover { border-color: color-mix(in oklab, var(--pf-accent) 45%, var(--pf-border)); }
+.font-btn:focus-visible { outline: none; border-color: var(--pf-accent);
+  box-shadow: 0 0 0 3px color-mix(in oklab, var(--pf-accent) 35%, transparent); }
+.font-btn .fname { flex: 1; min-width: 0; font-size: 15px; line-height: 1.25;
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.font-btn .fvar { flex: none; font: 10px/1 var(--pf-mono); color: var(--pf-muted); }
+.font-btn .caret { flex: none; opacity: .5; }
+.text-input.warn { border-color: var(--pf-err); color: var(--pf-err); }
+
 /* crafted range slider — hairline track + CAD-blue handle (the panel's signature control) */
 input[type="range"] { -webkit-appearance: none; appearance: none; width: 100%; height: 18px; margin: 0; background: transparent; cursor: pointer; }
 input[type="range"]::-webkit-slider-runnable-track { height: 3px; border-radius: 2px; background: var(--pf-border); }
@@ -750,3 +763,102 @@ button.action:focus-visible, .adv-toggle:focus-visible, .sec-title:focus-visible
   100% { outline: 3px solid transparent; }
 }
 @media (prefers-reduced-motion: reduce) { .pf-param-flash { animation: none; } }
+
+/* ---- the `type: "font"` picker -------------------------------------------
+   A TAKEOVER panel: it covers the rail on desktop and the single visible pane
+   below the narrow breakpoint, rather than expanding inline under the control.
+   Choosing a typeface is a browse task, not a slider nudge — it earns the whole
+   surface, and one layout for both widths removes a mode from the widget.
+   Ported from spike/font-picker.html; the sizes, timings and densities here
+   were settled against that running build (design spec §6). */
+
+/* The rail is the picker's containing block; nothing else in it is positioned. */
+.pf-rail { position: relative; }
+
+/* `position: absolute` is what places the takeover — and, just as load-bearing,
+   what makes .picker a POSITIONED box for the panes below, which are inset: 0
+   against it. Without that, the variants pane escapes the picker and fills the
+   rail (an hour of the spike went to exactly this). */
+.picker {
+  position: absolute; inset: 0; z-index: 20;
+  display: flex; flex-direction: column;
+  background: var(--pf-surface); color: var(--pf-text);
+}
+
+.pk-head { flex: none; padding: 10px var(--pf-rail-pad) 8px;
+  border-bottom: 1px solid var(--pf-border); background: var(--pf-surface); }
+.pk-titlebar { display: flex; align-items: center; gap: 8px; margin-bottom: 8px; }
+.pk-titlebar b { flex: 1; min-width: 0; font: 600 11px/1 var(--pf-sans);
+  letter-spacing: .04em; text-transform: uppercase; color: var(--pf-muted);
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.pk-x { border: 0; background: transparent; color: var(--pf-muted); cursor: pointer;
+  padding: 2px 4px; font-size: 15px; line-height: 1; }
+.pk-x:hover { color: var(--pf-text); }
+
+.pk-search { width: 100%; font: 12px/1.4 var(--pf-mono); background: var(--pf-input-bg);
+  color: var(--pf-text-strong); border: 1px solid var(--pf-border);
+  border-radius: var(--pf-radius-control); padding: 6px 8px 6px 26px;
+  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Ccircle cx='5' cy='5' r='3.4' fill='none' stroke='%238b8b94' stroke-width='1.3'/%3E%3Cpath d='M7.6 7.6 L10.5 10.5' stroke='%238b8b94' stroke-width='1.3' stroke-linecap='round'/%3E%3C/svg%3E");
+  background-repeat: no-repeat; background-position: 8px center; }
+.pk-search:focus { outline: none; border-color: var(--pf-accent);
+  box-shadow: 0 0 0 3px color-mix(in oklab, var(--pf-accent) 35%, transparent); }
+
+/* The virtualized list: .pk-spacer carries the full scroll height and each row
+   is absolutely placed at translateY(i * 44px). */
+.pk-list { flex: 1; overflow-y: auto; overscroll-behavior: contain; position: relative; }
+.pk-spacer { position: relative; width: 100%; }
+.pk-row { position: absolute; left: 0; right: 0; display: flex; align-items: center; gap: 8px;
+  padding: 0 var(--pf-rail-pad); cursor: pointer;
+  border-bottom: 1px solid color-mix(in oklab, var(--pf-border) 45%, transparent); }
+.pk-row:hover { background: var(--pf-surface-2); }
+.pk-row.sel { background: var(--pf-accent-soft); box-shadow: inset 2px 0 0 var(--pf-accent); }
+.pk-main { flex: 1; min-width: 0; }
+/* 16px, and the row height is reserved by the virtualizer, so a face arriving
+   late swaps glyphs in place instead of shifting the list. */
+.pk-face { font-size: 16px; line-height: 1.15; color: var(--pf-text-strong);
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.pk-sub { font: 9px/1.3 var(--pf-mono); color: var(--pf-hint);
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.pk-meta { flex: none; font: 9px/1 var(--pf-mono); color: var(--pf-hint); }
+/* A row whose own face has not arrived yet reads as pending rather than wrong. */
+.pk-row.loading .pk-face { opacity: .38; }
+
+/* Two panes sliding inside .pk-panes: browse, then that family's weights. The
+   footer sits BELOW this box rather than under it, so Done stays reachable from
+   either pane — picking a weight never has to exit to commit. */
+.pk-panes { position: relative; flex: 1; min-height: 0; overflow: hidden; }
+.pk-pane { position: absolute; inset: 0; display: flex; flex-direction: column;
+  background: var(--pf-surface);
+  transition: transform .26s cubic-bezier(.4, 0, .2, 1), opacity .26s ease; }
+.pk-pane[data-pane="variants"] { transform: translateX(100%); opacity: 0; pointer-events: none; }
+.picker.at-variants .pk-pane[data-pane="browse"] { transform: translateX(-22%); opacity: .3; pointer-events: none; }
+.picker.at-variants .pk-pane[data-pane="variants"] { transform: translateX(0); opacity: 1; pointer-events: auto; }
+@media (prefers-reduced-motion: reduce) { .pk-pane { transition: none; } }
+
+.pk-back { display: flex; align-items: center; gap: 6px; border: 0; background: transparent;
+  color: var(--pf-muted); font: 10px/1 var(--pf-mono); cursor: pointer; padding: 0 0 8px; }
+.pk-back:hover { color: var(--pf-text); }
+.pk-vlist { flex: 1; overflow-y: auto; padding: 4px var(--pf-rail-pad) 12px; }
+.vrow { display: flex; align-items: baseline; gap: 8px; width: 100%; text-align: left; cursor: pointer;
+  background: transparent; border: 0;
+  border-bottom: 1px solid color-mix(in oklab, var(--pf-border) 45%, transparent);
+  padding: 9px 0; color: var(--pf-text-strong); }
+.vrow:hover { background: var(--pf-surface-2); }
+.vrow.on, .vrow.on .vlabel { color: var(--pf-accent); }
+.vrow .vsample { flex: 1; min-width: 0; font-size: 16px;
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.vrow .vlabel { flex: none; font: 10px/1 var(--pf-mono); color: var(--pf-muted); }
+
+.pk-hint { flex: none; padding: 7px var(--pf-rail-pad) 0; font: 9px/1.4 var(--pf-mono); color: var(--pf-hint); }
+.pk-empty { margin: 0; padding: 22px var(--pf-rail-pad); font: 11px/1.6 var(--pf-mono); color: var(--pf-hint); }
+
+.pk-foot { flex: none; display: flex; align-items: center; gap: 10px;
+  padding: 9px var(--pf-rail-pad); border-top: 1px solid var(--pf-border); background: var(--pf-surface); }
+.pk-sel { flex: 1; min-width: 0; font: 10px/1.4 var(--pf-mono); color: var(--pf-hint);
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.pk-sel b { font-weight: 500; color: var(--pf-text-2); }
+.pk-done { flex: none; border: 0; border-radius: var(--pf-radius-control); cursor: pointer;
+  background: var(--pf-accent); color: var(--pf-on-accent); font: 11px/1 var(--pf-mono);
+  letter-spacing: .04em; padding: 8px 17px; }
+.pk-done:hover { filter: brightness(1.09); }
+.picker :where(button, input):focus-visible { outline: 2px solid var(--pf-accent); outline-offset: 2px; }

package/src/framework/font-source.js

@@ -0,0 +1,70 @@
+// What a PARAM-supplied font source may be. Author-declared `fonts` sources are
+// code and get no restriction (see the design doc §4); this file exists only
+// for the other case — a value that arrived in `params`, which on a shared link
+// is attacker-controlled text that would otherwise become a fetch URL.
+//
+// DOM-free and node:-free: jobs.js (worker graph) and the panel both import it.
+
+export const FONT_ALLOW_DEFAULT = ["https"];
+
+// The "unset" font source. An empty value declares NO font — the documented way
+// to opt out of a typeface, after which text2d falls back to the bundled Roboto.
+// It is never a source to fetch, and never a source to refuse: fontSourceAllowed
+// rejects "" under every allow list (new URL("") throws), so a site that forgets
+// this reads "unset" as "disallowed" and warns on every build of a part whose
+// font control is simply blank. Spelled once here because three sites have to
+// agree on it — the allow check, the pre-resolve filter, and lint's default
+// check — and the two bugs this rule has already caused were both a site that
+// had drifted from the others.
+export const isNoFontSource = (v) => v === undefined || v === null || v === "";
+
+const GSTATIC_HOST = "fonts.gstatic.com";
+const ASSET_SCHEME = "pfc-asset:";
+
+// Parse once; an unparseable string is refused rather than guessed at.
+function parse(source) {
+  try { return new URL(source); } catch { return null; }
+}
+
+export function fontSourceAllowed(source, allow = FONT_ALLOW_DEFAULT) {
+  if (typeof source !== "string") return false;   // bytes/thunks are never param-supplied
+  const u = parse(source);
+  if (!u) return false;
+  for (const kind of allow) {
+    // hostname, not host or a suffix test: `fonts.gstatic.com.evil.test` must
+    // not pass, and neither must a userinfo trick like `https://fonts.gstatic.com@evil.test/`
+    // (URL parsing puts `evil.test` in hostname, which is exactly why this
+    // compares the parsed hostname rather than the raw string).
+    if (kind === "gstatic" && u.protocol === "https:" && u.hostname === GSTATIC_HOST) return true;
+    if (kind === "https" && u.protocol === "https:") return true;
+    if (kind === "asset" && u.protocol === ASSET_SCHEME) return true;
+  }
+  return false;
+}
+
+// paramKey → allow list, for every `type: "font"` control in the authored tree —
+// new-shape (`controls`, including nested `group`s) AND legacy-shape
+// (`advanced`/`toggles`/`features`, where panel/legacy.js desugars a
+// descriptor's `control:` field to `type:` — see legacy.js's `toControl`).
+// Missing the legacy arrays here would leave a `{key, control:"font"}`
+// descriptor with no entry in the returned map, and jobs.js's check only
+// looks at keys present in the map — so a legacy-declared font control would
+// get silently unrestricted. Walk is deliberately tolerant of any of these
+// arrays being absent or malformed; it must never throw on an existing part.
+export function fontControlAllows(part) {
+  const out = new Map();
+  const visit = (nodes) => {
+    for (const n of nodes ?? []) {
+      if (!n || typeof n !== "object") continue;
+      if (Array.isArray(n.controls)) visit(n.controls);
+      if (Array.isArray(n.advanced)) visit(n.advanced);
+      if (Array.isArray(n.toggles)) visit(n.toggles);
+      if (Array.isArray(n.features)) visit(n.features);
+      if ((n.type === "font" || n.control === "font") && typeof n.key === "string") {
+        out.set(n.key, Array.isArray(n.allow) && n.allow.length ? n.allow : FONT_ALLOW_DEFAULT);
+      }
+    }
+  };
+  visit(part?.parameters);
+  return out;
+}

package/src/framework/fonts.js

@@ -13,6 +13,21 @@ const resolveOne = makeAssetResolver(
   "resolveFonts: a font source must be bytes, a URL, or a thunk returning one",
 );
 
+// `fonts` may be a plain { name: source } map, or a function of the resolved
+// params — the second form is what lets a `type: "font"` control drive the
+// typeface. Resolving it needs `p`, which is why this is a separate step from
+// resolveFonts rather than folded into it.
+export function fontsFor(part, p) {
+  const decl = part?.fonts;
+  return typeof decl === "function" ? decl(p) : decl;
+}
+
 export async function resolveFonts(fontsDecl) {
+  // A function reaching here means a caller passed `part.fonts` raw. It cannot
+  // be resolved without params, and silently returning an empty map would show
+  // up much later as `text2d: unknown font "…"`.
+  if (typeof fontsDecl === "function") {
+    throw new Error("resolveFonts: `fonts` is a function of params — resolve it with fontsFor(part, p) first");
+  }
   return resolveDecl(fontsDecl, resolveOne);
 }

package/src/framework/jobs.js

@@ -4,7 +4,8 @@
 // kernel-bound module back.
 import { meshTo3MF } from "./geometry/threemf.js";
 import { exportablePartNames } from "./export-select.js";
-import { resolveFonts } from "./fonts.js";
+import { fontControlAllows, fontSourceAllowed, isNoFontSource } from "./font-source.js";
+import { fontsFor, resolveFonts } from "./fonts.js";
 import { normalizeOpentype, parseFont } from "./geometry/opentype-interop.js";
 import { ensureImports, resolveImports } from "./imports.js";
 import { safeName } from "./safe-name.js";
@@ -98,25 +99,106 @@ export async function handle(kernel, part, msg, post, opts = {}) {
   const label = (name) => part.parts[name].label ?? name;
   const exportName = (name) => part.parts[name].export?.name ?? name;
 
+  // Warnings this job raised before any sub-part was built — a refused font
+  // source, today. They ride the result's `warnings` (below) rather than only a
+  // progress phase, which the next busy chip overwrites milliseconds later: a
+  // tampered share link must leave a notice that is still readable once the
+  // build has landed. `part: null` because these belong to the job, not to any
+  // one sub-part.
+  const jobWarnings = [];
   try {
-    // Preload any part-declared fonts into the kernel before building — once per
-    // font name; a lazy dynamic import because this is async context (unlike the
-    // synchronous kernel-front), so it doesn't cost sync callers anything. The
-    // namespace shape differs between bundler and Node resolution (a bare
-    // `.default` here is undefined in every browser bundle) — normalize it.
+    // Params first: the fonts declaration may be a function of them, and a
+    // throwing derive() should surface before a font download rather than
+    // after one. Still inside the try, so that throw posts an error the UI can
+    // show instead of killing the worker turn silently (an endless spinner).
+    //
+    // The font-source check runs as resolveParams' sanitize hook, not after it:
+    // rewriting p[key] afterwards would leave derive() — and therefore `d`, and
+    // therefore the geometry — holding the refused value while build() saw the
+    // default.
+    const { p, d } = resolveParams(part, msg.params, (params) => {
+      // A param bound to a `type: "font"` control is user input — on a shared
+      // link it is arbitrary attacker-supplied text that `fonts: (p) => …` would
+      // turn into a fetch URL. Refuse out-of-`allow` values back to the part's
+      // own default rather than failing the build: a bad link should show the
+      // part, not an error page.
+      for (const [key, allow] of fontControlAllows(part)) {
+        const v = params[key];
+        if (isNoFontSource(v) || fontSourceAllowed(v, allow)) continue;
+        const message = `font source for "${key}" is not allowed — using the default`;
+        onProgress(message);          // the live chip…
+        jobWarnings.push({ part: null, message });   // …and the durable record
+        params[key] = part.defaults?.[key];
+      }
+    });
+    // Preload any part-declared fonts into the kernel before building. A lazy
+    // dynamic import because this is async context (unlike the synchronous
+    // kernel-front), so it doesn't cost sync callers anything. The namespace
+    // shape differs between bundler and Node resolution (a bare `.default`
+    // here is undefined in every browser bundle) — normalize it.
+    const fontsDecl = fontsFor(part, p);
+    // A nullish/empty source means "no font declared" for that name, not an
+    // error — e.g. `fonts: (p) => ({ face: p.face })` when p.face ended up
+    // undefined because the refusal above had no default to fall back to, or
+    // because the author simply left it unset. text2d falls back to the
+    // bundled Roboto for a name with no declared source. Passing it through
+    // to resolveFonts would throw ("must be bytes, a URL, or a thunk…"),
+    // producing exactly the error-page outcome the refusal above exists to
+    // avoid. Drop it here, centrally, rather than teaching resolveFonts about
+    // "empty is fine" (it still must error on a *present* source of the wrong
+    // shape — that's a real authoring bug). The progress note is what keeps a
+    // genuine typo (a name that never resolves) visible instead of silently
+    // swallowed.
+    const fontsToResolve = fontsDecl && Object.fromEntries(
+      Object.entries(fontsDecl).filter(([name, src]) => {
+        if (!isNoFontSource(src)) return true;
+        onProgress(`no font source declared for "${name}" — skipping`);
+        return false;
+      }),
+    );
+    // Gated on the part DECLARING `fonts` at all, not on this job having one to
+    // resolve — the prune below has to run on the empty declaration too, and a
+    // part with no `fonts` field must not touch the map (a host or test harness
+    // may have seeded kernel._fonts directly, e.g. bootManifoldKernel({ fonts })).
     if (part.fonts && kernel._fonts) {
-      const opentype = normalizeOpentype(await import("opentype.js"));
-      const bufs = await resolveFonts(part.fonts);
-      for (const [name, buf] of bufs) if (!kernel._fonts.has(name)) kernel._fonts.set(name, parseFont(opentype, buf, name));
+      const declared = fontsToResolve ?? {};
+      if (Object.keys(declared).length) {
+        onProgress("resolving fonts");
+        const opentype = normalizeOpentype(await import("opentype.js"));
+        const bufs = await resolveFonts(declared);
+        // Keyed on the SOURCE, not the name. A name is not a font identity: one
+        // worker outlives many parts (worker-rebind) and, once a font can come
+        // from a param, many picks — all of which reuse the same declared name.
+        // The old `if (!_fonts.has(name))` made the first bytes ever seen under a
+        // name permanent for the life of the worker.
+        //
+        // The source, not the resolved buffer: the two agree only because the
+        // resolver's own memo is unbounded and hands back the identical object
+        // every time. Key on that and this memo silently degrades to per-fetch
+        // identity — a re-parse per build — the day eviction is added there.
+        kernel._fontsBySource ??= new Map();
+        for (const [name, buf] of bufs) {
+          const source = declared[name];
+          let font = kernel._fontsBySource.get(source);
+          if (!font) { font = parseFont(opentype, buf, name); kernel._fontsBySource.set(source, font); }
+          kernel._fonts.set(name, font);
+        }
+      }
+      // Drop every name this build's declaration does not supply. `_fonts` is
+      // the kernel's, and the kernel outlives the job: without this, a face the
+      // user picked and then CLEARED stays registered under its old name, and an
+      // unconditional `k.text2d(s, { font: "face" })` goes on rendering it
+      // instead of falling back — the stale-registration bug of spec §5, one
+      // step narrower and just as silent.
+      for (const name of [...kernel._fonts.keys()]) {
+        if (!Object.hasOwn(declared, name)) kernel._fonts.delete(name);
+      }
     }
     // Register this part's declared imports on the kernel running this job — the
     // import-asset sibling of the fonts preload above. See ensureImports for the
     // lazy-error policy that keeps a STEP import inert until a build actually
     // calls k.import on it.
     if (part.imports) await ensureImports(kernel, part.imports, opts.importMeshes ?? null);
-    // Inside the try so a throwing derive posts an error the UI can show,
-    // instead of killing the worker turn silently (an endless spinner).
-    const { p, d } = resolveParams(part, msg.params);
     // Local shorthand over the shared helper: kernel/part/view/p/d are fixed per job.
     const posed = (name, purpose, prog) => buildPosed(kernel, part, name, { purpose, view: msg.view, p, d, onProgress: prog });
     // Explicit selection (headless exportParts) overrides view-derived selection.
@@ -136,7 +218,7 @@ export async function handle(kernel, part, msg, post, opts = {}) {
       // first so a previous job's stragglers (an oracle build, an export) cannot be
       // misattributed to this build's first sub-part.
       kernel.takeBuildWarnings?.();
-      const warnings = [];
+      const warnings = [...jobWarnings];   // job-level notices ride along with the per-sub-part ones
       kernel.resetCacheStats?.(); // count hits/misses for just this job
       for (const [i, name] of msg.subparts.entries()) {
         if (useCache) kernel.beginSubPart?.(name); // open the per-sub-part cache round
@@ -171,7 +253,7 @@ export async function handle(kernel, part, msg, post, opts = {}) {
       const useCache = msg.cache !== false;
       const meshes = [];
       kernel.takeBuildWarnings?.(); // discard a previous job's stragglers (same as generate)
-      const warnings = [];
+      const warnings = [...jobWarnings];
       for (const name of msg.subparts) {
         if (useCache) kernel.beginSubPart?.(name);
         try {

package/src/framework/lint/index.js

@@ -16,8 +16,9 @@ import { VERIFY_RULES, resolveExpect } from "./rules-verify.js";
 import { ANIMATION_RULES } from "./rules-animations.js";
 import { PLACE_RULES } from "./rules-place.js";
 import { IMPORT_RULES } from "./rules-imports.js";
+import { FONT_RULES } from "./rules-fonts.js";
 
-export const RULES = [...SHAPE_RULES, ...SCHEMA_RULES, ...BUILD_RULES, ...VERIFY_RULES, ...ANIMATION_RULES, ...PLACE_RULES, ...IMPORT_RULES];
+export const RULES = [...SHAPE_RULES, ...SCHEMA_RULES, ...BUILD_RULES, ...VERIFY_RULES, ...ANIMATION_RULES, ...PLACE_RULES, ...IMPORT_RULES, ...FONT_RULES];
 
 // Every rule runs inside a guard. lintPart is called on a user-facing hosted path
 // (partforge-cloud's sandbox), and a linter that takes down the preview it exists to

package/src/framework/lint/rules-fonts.js

@@ -0,0 +1,45 @@
+// Group 8 — font-control well-formedness. Both conditions here are silent
+// failures at runtime rather than errors: a picker bound to a key no `fonts`
+// declaration reads changes a param and nothing else (the typeface never
+// moves), and a default outside its own `allow` list is swapped for… itself,
+// which is to say the part boots with no font at all.
+//
+// Detecting "does the fonts function read this key?" without executing the
+// function is impossible in general, so the rule asks the cheaper, honest
+// question: is `fonts` a function at all? A static `fonts` provably cannot
+// depend on a param.
+import { err, warn } from "./finding.js";
+import { fontControlAllows, fontSourceAllowed, isNoFontSource } from "../font-source.js";
+
+export const FONT_RULES = [
+  {
+    id: "font-control-not-in-fonts",
+    run: ({ part }) => {
+      const controls = fontControlAllows(part);
+      if (controls.size === 0 || typeof part?.fonts === "function") return [];
+      return [...controls.keys()].map((key) => err("font-control-not-in-fonts",
+        `control "${key}" is a font picker, but this part's \`fonts\` is ${part?.fonts ? "a static object" : "missing"} — the picked value is never resolved.`,
+        `Declare fonts as a function of params, e.g. fonts: (p) => ({ ${key}: p.${key} }), and reference it with k.text2d(str, { font: "${key}" }).`,
+        "fonts"));
+    },
+  },
+  {
+    id: "font-source-scheme",
+    run: ({ part }) => {
+      const out = [];
+      for (const [key, allow] of fontControlAllows(part)) {
+        const v = part?.defaults?.[key];
+        // An empty source declares nothing (jobs.js filters exactly these out
+        // before resolveFonts, and text2d falls back to the bundled Roboto),
+        // which is a legitimate way to author an optional typeface — not a
+        // source the allow list is refusing.
+        if (isNoFontSource(v) || fontSourceAllowed(v, allow)) continue;
+        out.push(warn("font-source-scheme",
+          `defaults.${key} is "${String(v).slice(0, 120)}", which control "${key}" would refuse (allow: ${allow.join(", ")}).`,
+          `Use a source the allow list accepts, or widen \`allow\` on the control. At build time this value is replaced by defaults.${key}, so as written the part has no usable font.`,
+          "defaults"));
+      }
+      return out;
+    },
+  },
+];