fontfetch 1.3.1 → 1.4.0

package/dist/cli.js

@@ -126892,7 +126892,7 @@ var require_decompress = __commonJS({
 
 // ../core/src/pipeline/pull.ts
 import fs4 from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 
 // ../core/src/lib/utils.ts
 import path from "path";
@@ -127103,6 +127103,67 @@ function buildReadme(host, faces, totalFiles, orphans = []) {
   lines.push("");
   return lines.join("\n");
 }
+function buildProvenanceJson(host, sourceUrl, classified, orphans, fileSizes) {
+  const faces = classified.map((c) => ({
+    family: c.face.family,
+    weight: c.face.weight,
+    style: c.face.style,
+    unicodeRange: c.face.unicodeRange,
+    classification: {
+      status: c.classification.status,
+      reason: c.classification.reason,
+      ...c.classification.hasRFN ? { hasRFN: true } : {}
+    },
+    files: c.face.sources.filter((s) => Boolean(s.localFile)).map((s) => {
+      const filePath = `files/${s.localFile}`;
+      const bucket = s.localFile.includes("/") ? s.localFile.split("/")[0] : "self-hosted";
+      return {
+        file: filePath,
+        bucket,
+        url: s.url,
+        format: s.format,
+        bytes: fileSizes.get(s.localFile) ?? null
+      };
+    })
+  }));
+  const familiesWithRFN = [
+    ...new Set(classified.filter((c) => c.classification.hasRFN).map((c) => c.face.family))
+  ];
+  const byStatus = { open: 0, commercial: 0, unknown: 0 };
+  for (const c of classified) byStatus[c.classification.status]++;
+  const byBucket = {};
+  let totalBytes = 0;
+  let totalFiles = 0;
+  for (const f of faces) {
+    for (const file of f.files) {
+      byBucket[file.bucket] = (byBucket[file.bucket] ?? 0) + 1;
+      totalFiles++;
+      if (file.bytes) totalBytes += file.bytes;
+    }
+  }
+  const report = {
+    schemaVersion: "1.0",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    host,
+    sourceUrl,
+    summary: {
+      families: new Set(classified.map((c) => c.face.family)).size,
+      faces: classified.length,
+      files: totalFiles,
+      bytes: totalBytes,
+      byStatus,
+      byBucket,
+      familiesWithRFN
+    },
+    faces,
+    orphans: orphans.map((o) => ({
+      url: o.url,
+      file: `files/${o.file}`,
+      bytes: fileSizes.get(o.file) ?? null
+    }))
+  };
+  return JSON.stringify(report, null, 2);
+}
 function buildLicenseReview(host, classified, summary) {
   const lines = [
     `# License review for ${host}`,
@@ -127167,6 +127228,178 @@ function buildLicenseReview(host, classified, summary) {
   return lines.join("\n");
 }
 
+// ../core/src/license/provenance.ts
+var RULES = [
+  {
+    bucket: "google",
+    patterns: ["fonts.gstatic.com", "fonts.googleapis.com", "cdn.jsdelivr.net/gh/google/fonts"]
+  },
+  {
+    bucket: "adobe-typekit",
+    patterns: ["use.typekit.net", "p.typekit.net", "fonts.adobe.com"]
+  },
+  {
+    bucket: "commercial",
+    patterns: [
+      "fast.fonts.net",
+      "cloud.typography.com",
+      "cloud.typenetwork.com",
+      "use.fontawesome.com",
+      "fontstand.com"
+    ]
+  },
+  {
+    bucket: "open-cdn",
+    patterns: ["cdn.jsdelivr.net/npm/@fontsource/", "rsms.me"]
+  }
+];
+function strip(host) {
+  return host.replace(/^www\./i, "").toLowerCase();
+}
+function sameOrigin(urlHost, pageHost) {
+  const a = strip(urlHost);
+  const b = strip(pageHost);
+  if (a === b) return true;
+  return a.endsWith("." + b) || b.endsWith("." + a);
+}
+function bucketForUrl(url, pageHost) {
+  for (const rule of RULES) {
+    for (const pattern of rule.patterns) {
+      if (url.includes(pattern)) return rule.bucket;
+    }
+  }
+  try {
+    const u = new URL(url);
+    if (sameOrigin(u.hostname, pageHost)) return "self-hosted";
+  } catch {
+  }
+  return "self-hosted";
+}
+
+// ../core/src/emit/gdpr.ts
+var REMEDIATION_BY_BUCKET = {
+  google: {
+    severity: "high",
+    hint: "Self-host the Google Fonts CDN binaries. Use fontfetch to extract them, then serve from your own origin. Avoid bunny.net Fonts only if your DPA also covers Bunny."
+  },
+  "adobe-typekit": {
+    severity: "high",
+    hint: "Adobe Fonts requires an active licence. You cannot self-host the binaries under the standard agreement \u2014 you must remove the family OR negotiate a bespoke licence that allows self-hosting."
+  },
+  commercial: {
+    severity: "high",
+    hint: "Commercial foundry CDN. Check the licence for self-host rights, then download the binaries directly from the foundry portal (not via this CDN)."
+  },
+  "open-cdn": {
+    severity: "medium",
+    hint: "Open CDN (Fontsource, rsms.me, jsdelivr). Self-host the binaries OR use Bunny Fonts as a GDPR-compliant proxy. Fontsource also publishes per-family npm packages."
+  },
+  "self-hosted": {
+    severity: "low",
+    hint: "Already on the same origin. No third-party request; nothing to remediate."
+  }
+};
+function buildGdprReport(host, sourceUrl, faces) {
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const pageHost = (() => {
+    try {
+      return new URL(sourceUrl).hostname;
+    } catch {
+      return host;
+    }
+  })();
+  for (const f of faces) {
+    for (const s of f.sources) {
+      const bucket = bucketForUrl(s.url, pageHost);
+      const key = `${f.family}|${bucket}|${s.url}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const meta = REMEDIATION_BY_BUCKET[bucket];
+      findings.push({
+        family: f.family,
+        bucket,
+        url: s.url,
+        severity: meta.severity,
+        remediation: meta.hint
+      });
+    }
+  }
+  const thirdParty = findings.filter((f) => f.bucket !== "self-hosted").length;
+  const selfHosted = findings.filter((f) => f.bucket === "self-hosted").length;
+  const highSeverity = findings.filter((f) => f.severity === "high").length;
+  return {
+    schemaVersion: "1.0",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    host,
+    sourceUrl,
+    findings,
+    summary: { thirdParty, selfHosted, highSeverity }
+  };
+}
+function formatGdprMarkdown(report) {
+  const lines = [
+    `# GDPR review for ${report.host}`,
+    "",
+    "> Heuristic-only. Not legal advice. Built on the post-LG M\xFCnchen I 20 O 1393/21 understanding that cross-origin font loading from a third-party CDN exposes the visitor's IP address to a controller the site operator has no DPA with.",
+    "",
+    "## Summary",
+    "",
+    `- ${report.summary.thirdParty} third-party font request(s)`,
+    `- ${report.summary.selfHosted} self-hosted request(s)`,
+    `- ${report.summary.highSeverity} high-severity finding(s)`,
+    ""
+  ];
+  if (report.summary.thirdParty === 0) {
+    lines.push("\u2713 No third-party font requests detected. Fonts are served from the same origin.");
+    return lines.join("\n");
+  }
+  lines.push("## Findings");
+  lines.push("");
+  const byBucket = /* @__PURE__ */ new Map();
+  for (const f of report.findings) {
+    if (f.bucket === "self-hosted") continue;
+    const list = byBucket.get(f.bucket) ?? [];
+    list.push(f);
+    byBucket.set(f.bucket, list);
+  }
+  const severityIcon = {
+    high: "\u{1F534}",
+    medium: "\u{1F7E1}",
+    low: "\u{1F7E2}"
+  };
+  for (const [bucket, list] of byBucket) {
+    lines.push(`### ${bucketLabel(bucket)}`);
+    lines.push("");
+    const families = /* @__PURE__ */ new Map();
+    for (const f of list) {
+      const arr = families.get(f.family) ?? [];
+      arr.push(f);
+      families.set(f.family, arr);
+    }
+    for (const [family, occurrences] of families) {
+      const sev = occurrences[0].severity;
+      lines.push(`- ${severityIcon[sev]} **${family}** \u2014 ${occurrences[0].remediation}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function bucketLabel(b) {
+  switch (b) {
+    case "google":
+      return "Google Fonts CDN (high risk \u2014 German court precedent)";
+    case "adobe-typekit":
+      return "Adobe Fonts / Typekit";
+    case "commercial":
+      return "Commercial foundry CDN";
+    case "open-cdn":
+      return "Open-licence CDN";
+    case "self-hosted":
+      return "Self-hosted";
+  }
+}
+
 // ../core/src/license/license-data.ts
 var OPEN_HOSTS = [
   { host: "fonts.gstatic.com", label: "Google Fonts CDN" },
@@ -137897,16 +138130,16 @@ var $f43aec954cdfdf21$export$2e2bcd8739ae039 = class _$f43aec954cdfdf21$export$2
   * @return {Path}
   */
   mapPoints(fn) {
-    let path7 = new _$f43aec954cdfdf21$export$2e2bcd8739ae039();
+    let path8 = new _$f43aec954cdfdf21$export$2e2bcd8739ae039();
     for (let c of this.commands) {
       let args = [];
       for (let i = 0; i < c.args.length; i += 2) {
         let [x, y] = fn(c.args[i], c.args[i + 1]);
         args.push(x, y);
       }
-      path7[c.command](...args);
+      path8[c.command](...args);
     }
-    return path7;
+    return path8;
   }
   /**
   * Transforms the path by the given matrix.
@@ -138599,7 +138832,7 @@ var $69aac16029968692$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
   // Converts contours to a Path object that can be rendered
   _getPath() {
     let contours = this._getContours();
-    let path7 = new (0, $f43aec954cdfdf21$export$2e2bcd8739ae039)();
+    let path8 = new (0, $f43aec954cdfdf21$export$2e2bcd8739ae039)();
     for (let i = 0; i < contours.length; i++) {
       let contour = contours[i];
       let firstPt = contour[0];
@@ -138615,26 +138848,26 @@ var $69aac16029968692$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
           firstPt = new $69aac16029968692$export$baf26146a414f24a(false, false, (firstPt.x + lastPt.x) / 2, (firstPt.y + lastPt.y) / 2);
         var curvePt = firstPt;
       }
-      path7.moveTo(firstPt.x, firstPt.y);
+      path8.moveTo(firstPt.x, firstPt.y);
       for (let j = start; j < contour.length; j++) {
         let pt = contour[j];
         let prevPt = j === 0 ? firstPt : contour[j - 1];
-        if (prevPt.onCurve && pt.onCurve) path7.lineTo(pt.x, pt.y);
+        if (prevPt.onCurve && pt.onCurve) path8.lineTo(pt.x, pt.y);
         else if (prevPt.onCurve && !pt.onCurve) var curvePt = pt;
         else if (!prevPt.onCurve && !pt.onCurve) {
           let midX = (prevPt.x + pt.x) / 2;
           let midY = (prevPt.y + pt.y) / 2;
-          path7.quadraticCurveTo(prevPt.x, prevPt.y, midX, midY);
+          path8.quadraticCurveTo(prevPt.x, prevPt.y, midX, midY);
           var curvePt = pt;
         } else if (!prevPt.onCurve && pt.onCurve) {
-          path7.quadraticCurveTo(curvePt.x, curvePt.y, pt.x, pt.y);
+          path8.quadraticCurveTo(curvePt.x, curvePt.y, pt.x, pt.y);
           var curvePt = null;
         } else throw new Error("Unknown TTF path state");
       }
-      if (curvePt) path7.quadraticCurveTo(curvePt.x, curvePt.y, firstPt.x, firstPt.y);
-      path7.closePath();
+      if (curvePt) path8.quadraticCurveTo(curvePt.x, curvePt.y, firstPt.x, firstPt.y);
+      path8.closePath();
     }
-    return path7;
+    return path8;
   }
   constructor(...args) {
     super(...args);
@@ -138657,7 +138890,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
     let str = cff.topDict.CharStrings[this.id];
     let end = str.offset + str.length;
     stream.pos = str.offset;
-    let path7 = new (0, $f43aec954cdfdf21$export$2e2bcd8739ae039)();
+    let path8 = new (0, $f43aec954cdfdf21$export$2e2bcd8739ae039)();
     let stack = [];
     let trans = [];
     let width = null;
@@ -138685,8 +138918,8 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
       return stack.length = 0;
     }
     function moveTo(x2, y2) {
-      if (open) path7.closePath();
-      path7.moveTo(x2, y2);
+      if (open) path8.closePath();
+      path8.moveTo(x2, y2);
       open = true;
     }
     let parse = function() {
@@ -138713,7 +138946,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
               while (stack.length >= 2) {
                 x += stack.shift();
                 y += stack.shift();
-                path7.lineTo(x, y);
+                path8.lineTo(x, y);
               }
               break;
             case 6:
@@ -138722,7 +138955,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
               while (stack.length >= 1) {
                 if (phase) x += stack.shift();
                 else y += stack.shift();
-                path7.lineTo(x, y);
+                path8.lineTo(x, y);
                 phase = !phase;
               }
               break;
@@ -138734,7 +138967,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                 c2y = c1y + stack.shift();
                 x = c2x + stack.shift();
                 y = c2y + stack.shift();
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               break;
             case 10:
@@ -138758,7 +138991,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
               if (cff.version >= 2) break;
               if (stack.length > 0) checkWidth();
               if (open) {
-                path7.closePath();
+                path8.closePath();
                 open = false;
               }
               break;
@@ -138806,17 +139039,17 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                 c2y = c1y + stack.shift();
                 x = c2x + stack.shift();
                 y = c2y + stack.shift();
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               x += stack.shift();
               y += stack.shift();
-              path7.lineTo(x, y);
+              path8.lineTo(x, y);
               break;
             case 25:
               while (stack.length >= 8) {
                 x += stack.shift();
                 y += stack.shift();
-                path7.lineTo(x, y);
+                path8.lineTo(x, y);
               }
               c1x = x + stack.shift();
               c1y = y + stack.shift();
@@ -138824,7 +139057,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
               c2y = c1y + stack.shift();
               x = c2x + stack.shift();
               y = c2y + stack.shift();
-              path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+              path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               break;
             case 26:
               if (stack.length % 2) x += stack.shift();
@@ -138835,7 +139068,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                 c2y = c1y + stack.shift();
                 x = c2x;
                 y = c2y + stack.shift();
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               break;
             case 27:
@@ -138847,7 +139080,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                 c2y = c1y + stack.shift();
                 x = c2x + stack.shift();
                 y = c2y;
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               break;
             case 28:
@@ -138886,7 +139119,7 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                   x = c2x + stack.shift();
                   y = c2y + (stack.length === 1 ? stack.shift() : 0);
                 }
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
                 phase = !phase;
               }
               break;
@@ -139012,8 +139245,8 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                   c6y = c5y;
                   x = c6x;
                   y = c6y;
-                  path7.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
-                  path7.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
+                  path8.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
+                  path8.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
                   break;
                 case 35:
                   pts = [];
@@ -139022,8 +139255,8 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                     y += stack.shift();
                     pts.push(x, y);
                   }
-                  path7.bezierCurveTo(...pts.slice(0, 6));
-                  path7.bezierCurveTo(...pts.slice(6));
+                  path8.bezierCurveTo(...pts.slice(0, 6));
+                  path8.bezierCurveTo(...pts.slice(6));
                   stack.shift();
                   break;
                 case 36:
@@ -139041,8 +139274,8 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                   c6y = c5y;
                   x = c6x;
                   y = c6y;
-                  path7.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
-                  path7.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
+                  path8.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
+                  path8.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
                   break;
                 case 37:
                   let startx = x;
@@ -139061,8 +139294,8 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
                     y += stack.shift();
                   }
                   pts.push(x, y);
-                  path7.bezierCurveTo(...pts.slice(0, 6));
-                  path7.bezierCurveTo(...pts.slice(6));
+                  path8.bezierCurveTo(...pts.slice(0, 6));
+                  path8.bezierCurveTo(...pts.slice(6));
                   break;
                 default:
                   throw new Error(`Unknown op: 12 ${op}`);
@@ -139082,8 +139315,8 @@ var $62cc5109c6101893$export$2e2bcd8739ae039 = class extends (0, $f92906be28e617
       }
     };
     parse();
-    if (open) path7.closePath();
-    return path7;
+    if (open) path8.closePath();
+    return path8;
   }
   constructor(...args) {
     super(...args);
@@ -139543,7 +139776,7 @@ var $807e58506be70005$var$Glyf = new Struct({
   yPoints: new ArrayT($807e58506be70005$var$Point, 0)
 });
 var $807e58506be70005$export$2e2bcd8739ae039 = class {
-  encodeSimple(path7, instructions = []) {
+  encodeSimple(path8, instructions = []) {
     let endPtsOfContours = [];
     let xPoints = [];
     let yPoints = [];
@@ -139551,14 +139784,14 @@ var $807e58506be70005$export$2e2bcd8739ae039 = class {
     let same = 0;
     let lastX = 0, lastY = 0, lastFlag = 0;
     let pointCount = 0;
-    for (let i = 0; i < path7.commands.length; i++) {
-      let c = path7.commands[i];
+    for (let i = 0; i < path8.commands.length; i++) {
+      let c = path8.commands[i];
       for (let j = 0; j < c.args.length; j += 2) {
         let x = c.args[j];
         let y = c.args[j + 1];
         let flag = 0;
         if (c.command === "quadraticCurveTo" && j === 2) {
-          let next = path7.commands[i + 1];
+          let next = path8.commands[i + 1];
           if (next && next.command === "quadraticCurveTo") {
             let midX = (lastX + next.args[0]) / 2;
             let midY = (lastY + next.args[1]) / 2;
@@ -139585,8 +139818,8 @@ var $807e58506be70005$export$2e2bcd8739ae039 = class {
       }
       if (c.command === "closePath") endPtsOfContours.push(pointCount - 1);
     }
-    if (path7.commands.length > 1 && path7.commands[path7.commands.length - 1].command !== "closePath") endPtsOfContours.push(pointCount - 1);
-    let bbox = path7.bbox;
+    if (path8.commands.length > 1 && path8.commands[path8.commands.length - 1].command !== "closePath") endPtsOfContours.push(pointCount - 1);
+    let bbox = path8.bbox;
     let glyf = {
       numberOfContours: endPtsOfContours.length,
       xMin: bbox.minX,
@@ -139693,7 +139926,7 @@ var $001d739428a71d5a$export$2e2bcd8739ae039 = class extends (0, $5cc7476da92df3
     for (let gid of this.glyphs) {
       this.charstrings.push(this.cff.getCharString(gid));
       let glyph = this.font.getGlyph(gid);
-      let path7 = glyph.path;
+      let path8 = glyph.path;
       for (let subr in glyph._usedGsubrs) gsubrs[subr] = true;
     }
     this.gsubrs = this.subsetSubrs(this.cff.globalSubrIndex, gsubrs);
@@ -139731,7 +139964,7 @@ var $001d739428a71d5a$export$2e2bcd8739ae039 = class extends (0, $5cc7476da92df3
       used_fds[fd] = true;
       topDict.FDSelect.fds.push(fd_select[fd]);
       let glyph = this.font.getGlyph(gid);
-      let path7 = glyph.path;
+      let path8 = glyph.path;
       for (let subr in glyph._usedSubrs) used_subrs[fd_select[fd]][subr] = true;
     }
     for (let i = 0; i < topDict.FDArray.length; i++) {
@@ -139748,7 +139981,7 @@ var $001d739428a71d5a$export$2e2bcd8739ae039 = class extends (0, $5cc7476da92df3
     let used_subrs = {};
     for (let gid of this.glyphs) {
       let glyph = this.font.getGlyph(gid);
-      let path7 = glyph.path;
+      let path8 = glyph.path;
       for (let subr in glyph._usedSubrs) used_subrs[subr] = true;
     }
     let privateDict = Object.assign({}, this.cff.topDict.Private);
@@ -141165,8 +141398,71 @@ var viteEmitter = (faces, ctx) => {
   return { filename: "vite.fonts.md", content: lines.join("\n") };
 };
 
+// ../core/src/emit/emitters/tokens.ts
+var tokensEmitter = (faces) => {
+  const byFamily = groupByFamily(faces);
+  if (byFamily.size === 0) return null;
+  const familyTokens = {};
+  const weightTokens = {};
+  const seenWeights = /* @__PURE__ */ new Set();
+  for (const [family, list] of byFamily) {
+    const key = familyToKebab(family);
+    familyTokens[key] = {
+      $type: "fontFamily",
+      $value: [family, `${family} Fallback`, "system-ui", "sans-serif"]
+    };
+    for (const f of list) {
+      const w = parseInt(f.weight, 10);
+      if (Number.isFinite(w) && !seenWeights.has(w)) {
+        seenWeights.add(w);
+        weightTokens[weightLabel(w)] = { $type: "fontWeight", $value: w };
+      }
+    }
+  }
+  const sizeTokens = {
+    xs: { $type: "dimension", $value: "0.75rem" },
+    sm: { $type: "dimension", $value: "0.875rem" },
+    base: { $type: "dimension", $value: "1rem" },
+    lg: { $type: "dimension", $value: "1.125rem" },
+    xl: { $type: "dimension", $value: "1.25rem" },
+    "2xl": { $type: "dimension", $value: "1.5rem" },
+    "3xl": { $type: "dimension", $value: "1.875rem" },
+    "4xl": { $type: "dimension", $value: "2.25rem" }
+  };
+  const lineHeightTokens = {
+    tight: { $type: "number", $value: 1.2 },
+    snug: { $type: "number", $value: 1.3 },
+    normal: { $type: "number", $value: 1.5 },
+    relaxed: { $type: "number", $value: 1.7 },
+    loose: { $type: "number", $value: 2 }
+  };
+  const out = {
+    $schema: "https://design-tokens.github.io/community-group/format/tokens.schema.json",
+    $description: "Generated by fontfetch \u2014 W3C DTCG-compatible design tokens.",
+    font: {
+      family: familyTokens,
+      weight: weightTokens,
+      size: sizeTokens,
+      lineHeight: lineHeightTokens
+    }
+  };
+  return { filename: "fonts.tokens.json", content: `${JSON.stringify(out, null, 2)}
+` };
+};
+function weightLabel(weight) {
+  if (weight <= 100) return "thin";
+  if (weight <= 200) return "extralight";
+  if (weight <= 300) return "light";
+  if (weight <= 400) return "regular";
+  if (weight <= 500) return "medium";
+  if (weight <= 600) return "semibold";
+  if (weight <= 700) return "bold";
+  if (weight <= 800) return "extrabold";
+  return "black";
+}
+
 // ../core/src/emit/emitters/types.ts
-var EMIT_TARGETS = ["css", "next", "tailwind", "vite"];
+var EMIT_TARGETS = ["css", "next", "tailwind", "vite", "tokens"];
 function isEmitTarget(s) {
   return EMIT_TARGETS.includes(s);
 }
@@ -141175,57 +141471,10 @@ function isEmitTarget(s) {
 var EMITTERS = {
   next: nextEmitter,
   tailwind: tailwindEmitter,
-  vite: viteEmitter
+  vite: viteEmitter,
+  tokens: tokensEmitter
 };
 
-// ../core/src/license/provenance.ts
-var RULES = [
-  {
-    bucket: "google",
-    patterns: ["fonts.gstatic.com", "fonts.googleapis.com", "cdn.jsdelivr.net/gh/google/fonts"]
-  },
-  {
-    bucket: "adobe-typekit",
-    patterns: ["use.typekit.net", "p.typekit.net", "fonts.adobe.com"]
-  },
-  {
-    bucket: "commercial",
-    patterns: [
-      "fast.fonts.net",
-      "cloud.typography.com",
-      "cloud.typenetwork.com",
-      "use.fontawesome.com",
-      "fontstand.com"
-    ]
-  },
-  {
-    bucket: "open-cdn",
-    patterns: ["cdn.jsdelivr.net/npm/@fontsource/", "rsms.me"]
-  }
-];
-function strip(host) {
-  return host.replace(/^www\./i, "").toLowerCase();
-}
-function sameOrigin(urlHost, pageHost) {
-  const a = strip(urlHost);
-  const b = strip(pageHost);
-  if (a === b) return true;
-  return a.endsWith("." + b) || b.endsWith("." + a);
-}
-function bucketForUrl(url, pageHost) {
-  for (const rule of RULES) {
-    for (const pattern of rule.patterns) {
-      if (url.includes(pattern)) return rule.bucket;
-    }
-  }
-  try {
-    const u = new URL(url);
-    if (sameOrigin(u.hostname, pageHost)) return "self-hosted";
-  } catch {
-  }
-  return "self-hosted";
-}
-
 // ../core/src/inspect/fallback.ts
 import fs3 from "fs/promises";
 import path4 from "path";
@@ -145341,16 +145590,16 @@ var Path = class Path2 {
   * Applies a mapping function to each point in the path.
   */
   mapPoints(fn) {
-    const path7 = new Path2();
+    const path8 = new Path2();
     for (const c of this.commands) {
       const args = [];
       for (let i = 0; i < c.args.length; i += 2) {
         const [x, y] = fn(c.args[i], c.args[i + 1]);
         args.push(x, y);
       }
-      path7[c.command](...args);
+      path8[c.command](...args);
     }
-    return path7;
+    return path8;
   }
   /**
   * Transforms the path by the given matrix.
@@ -145992,7 +146241,7 @@ var TTFGlyph = class extends Glyph {
   }
   _getPath() {
     const contours = this._getContours();
-    const path7 = new Path();
+    const path8 = new Path();
     let curvePt;
     for (const contour of contours) {
       let firstPt = contour[0];
@@ -146006,26 +146255,26 @@ var TTFGlyph = class extends Glyph {
         else firstPt = new Point(false, false, (firstPt.x + lastPt.x) / 2, (firstPt.y + lastPt.y) / 2);
         curvePt = firstPt;
       }
-      path7.moveTo(firstPt.x, firstPt.y);
+      path8.moveTo(firstPt.x, firstPt.y);
       for (let j = start; j < contour.length; j++) {
         const pt = contour[j];
         const prevPt = j === 0 ? firstPt : contour[j - 1];
-        if (prevPt.onCurve && pt.onCurve) path7.lineTo(pt.x, pt.y);
+        if (prevPt.onCurve && pt.onCurve) path8.lineTo(pt.x, pt.y);
         else if (prevPt.onCurve && !pt.onCurve) curvePt = pt;
         else if (!prevPt.onCurve && !pt.onCurve) {
           const midX = (prevPt.x + pt.x) / 2;
           const midY = (prevPt.y + pt.y) / 2;
-          path7.quadraticCurveTo(prevPt.x, prevPt.y, midX, midY);
+          path8.quadraticCurveTo(prevPt.x, prevPt.y, midX, midY);
           curvePt = pt;
         } else if (!prevPt.onCurve && pt.onCurve) {
-          path7.quadraticCurveTo(curvePt.x, curvePt.y, pt.x, pt.y);
+          path8.quadraticCurveTo(curvePt.x, curvePt.y, pt.x, pt.y);
           curvePt = null;
         } else throw new Error("Unknown TTF path state");
       }
-      if (curvePt) path7.quadraticCurveTo(curvePt.x, curvePt.y, firstPt.x, firstPt.y);
-      path7.closePath();
+      if (curvePt) path8.quadraticCurveTo(curvePt.x, curvePt.y, firstPt.x, firstPt.y);
+      path8.closePath();
     }
-    return path7;
+    return path8;
   }
 };
 var CFFGlyph = class extends Glyph {
@@ -146043,7 +146292,7 @@ var CFFGlyph = class extends Glyph {
     const str = cff.topDict.CharStrings[this.id];
     let end = str.offset + str.length;
     stream.pos = str.offset;
-    const path7 = new Path();
+    const path8 = new Path();
     const stack = [];
     const trans = [];
     let width = null;
@@ -146071,8 +146320,8 @@ var CFFGlyph = class extends Glyph {
       return stack.length = 0;
     };
     const moveTo = (x2, y2) => {
-      if (open) path7.closePath();
-      path7.moveTo(x2, y2);
+      if (open) path8.closePath();
+      path8.moveTo(x2, y2);
       open = true;
     };
     const parse = () => {
@@ -146099,7 +146348,7 @@ var CFFGlyph = class extends Glyph {
               while (stack.length >= 2) {
                 x += stack.shift();
                 y += stack.shift();
-                path7.lineTo(x, y);
+                path8.lineTo(x, y);
               }
               break;
             case 6:
@@ -146108,7 +146357,7 @@ var CFFGlyph = class extends Glyph {
               while (stack.length >= 1) {
                 if (phase) x += stack.shift();
                 else y += stack.shift();
-                path7.lineTo(x, y);
+                path8.lineTo(x, y);
                 phase = !phase;
               }
               break;
@@ -146120,7 +146369,7 @@ var CFFGlyph = class extends Glyph {
                 c2y = c1y + stack.shift();
                 x = c2x + stack.shift();
                 y = c2y + stack.shift();
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               break;
             case 10:
@@ -146144,7 +146393,7 @@ var CFFGlyph = class extends Glyph {
               if (cff.version >= 2) break;
               if (stack.length > 0) checkWidth();
               if (open) {
-                path7.closePath();
+                path8.closePath();
                 open = false;
               }
               break;
@@ -146192,17 +146441,17 @@ var CFFGlyph = class extends Glyph {
                 c2y = c1y + stack.shift();
                 x = c2x + stack.shift();
                 y = c2y + stack.shift();
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               x += stack.shift();
               y += stack.shift();
-              path7.lineTo(x, y);
+              path8.lineTo(x, y);
               break;
             case 25:
               while (stack.length >= 8) {
                 x += stack.shift();
                 y += stack.shift();
-                path7.lineTo(x, y);
+                path8.lineTo(x, y);
               }
               c1x = x + stack.shift();
               c1y = y + stack.shift();
@@ -146210,7 +146459,7 @@ var CFFGlyph = class extends Glyph {
               c2y = c1y + stack.shift();
               x = c2x + stack.shift();
               y = c2y + stack.shift();
-              path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+              path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               break;
             case 26:
               if (stack.length % 2) x += stack.shift();
@@ -146221,7 +146470,7 @@ var CFFGlyph = class extends Glyph {
                 c2y = c1y + stack.shift();
                 x = c2x;
                 y = c2y + stack.shift();
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               break;
             case 27:
@@ -146233,7 +146482,7 @@ var CFFGlyph = class extends Glyph {
                 c2y = c1y + stack.shift();
                 x = c2x + stack.shift();
                 y = c2y;
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
               }
               break;
             case 28:
@@ -146272,7 +146521,7 @@ var CFFGlyph = class extends Glyph {
                   x = c2x + stack.shift();
                   y = c2y + (stack.length === 1 ? stack.shift() : 0);
                 }
-                path7.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
+                path8.bezierCurveTo(c1x, c1y, c2x, c2y, x, y);
                 phase = !phase;
               }
               break;
@@ -146398,8 +146647,8 @@ var CFFGlyph = class extends Glyph {
                   c6y = c5y;
                   x = c6x;
                   y = c6y;
-                  path7.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
-                  path7.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
+                  path8.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
+                  path8.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
                   break;
                 case 35:
                   pts = [];
@@ -146408,8 +146657,8 @@ var CFFGlyph = class extends Glyph {
                     y += stack.shift();
                     pts.push(x, y);
                   }
-                  path7.bezierCurveTo(...pts.slice(0, 6));
-                  path7.bezierCurveTo(...pts.slice(6));
+                  path8.bezierCurveTo(...pts.slice(0, 6));
+                  path8.bezierCurveTo(...pts.slice(6));
                   stack.shift();
                   break;
                 case 36:
@@ -146427,8 +146676,8 @@ var CFFGlyph = class extends Glyph {
                   c6y = c5y;
                   x = c6x;
                   y = c6y;
-                  path7.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
-                  path7.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
+                  path8.bezierCurveTo(c1x, c1y, c2x, c2y, c3x, c3y);
+                  path8.bezierCurveTo(c4x, c4y, c5x, c5y, c6x, c6y);
                   break;
                 case 37:
                   const startx = x;
@@ -146447,8 +146696,8 @@ var CFFGlyph = class extends Glyph {
                     y += stack.shift();
                   }
                   pts.push(x, y);
-                  path7.bezierCurveTo(...pts.slice(0, 6));
-                  path7.bezierCurveTo(...pts.slice(6));
+                  path8.bezierCurveTo(...pts.slice(0, 6));
+                  path8.bezierCurveTo(...pts.slice(6));
                   break;
                 default:
                   throw new Error(`Unknown op: 12 ${op}`);
@@ -146468,8 +146717,8 @@ var CFFGlyph = class extends Glyph {
       }
     };
     parse();
-    if (open) path7.closePath();
-    return path7;
+    if (open) path8.closePath();
+    return path8;
   }
 };
 var SBIXImage = new Struct2({
@@ -149582,57 +149831,57 @@ async function computeFallback(filePath, options = {}) {
   };
 }
 function formatFallbackCss(metrics) {
+  const variantTag = metrics.fontWeight || metrics.fontStyle ? ` (${metrics.fontWeight ?? "400"}${metrics.fontStyle && metrics.fontStyle !== "normal" ? " " + metrics.fontStyle : ""})` : "";
   const lines = [
-    `/* CLS-killing fallback for ${metrics.familyName} \u2014 generated by fontfetch */`,
+    `/* CLS-killing fallback for ${metrics.familyName}${variantTag} \u2014 generated by fontfetch */`,
     `@font-face {`,
-    `  font-family: '${metrics.fallbackFamily}';`,
+    `  font-family: '${metrics.fallbackFamily}';`
+  ];
+  if (metrics.fontWeight) lines.push(`  font-weight: ${metrics.fontWeight};`);
+  if (metrics.fontStyle) lines.push(`  font-style: ${metrics.fontStyle};`);
+  lines.push(
     `  src: local('${SYSTEM_FALLBACKS[metrics.generic].familyName}');`,
     `  size-adjust: ${metrics.sizeAdjust};`,
     `  ascent-override: ${metrics.ascentOverride};`,
     `  descent-override: ${metrics.descentOverride};`,
     `  line-gap-override: ${metrics.lineGapOverride};`,
     `}`
-  ];
+  );
   return lines.join("\n");
 }
-async function buildFallbacksForDir(filesDir) {
-  let entries;
-  try {
-    entries = await collectFontFiles2(filesDir);
-  } catch (e) {
-    return { css: "", count: 0, errors: [{ file: filesDir, reason: e.message }] };
-  }
-  const seen = /* @__PURE__ */ new Set();
+async function buildPerFaceFallbacks(filesDir, faces) {
   const blocks = [];
   const errors = [];
-  for (const file of entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const metricsByFile = /* @__PURE__ */ new Map();
+  for (const face of faces) {
+    const primary = face.sources.find((s) => s.localFile);
+    if (!primary?.localFile) continue;
+    const key = `${face.family}|${face.weight}|${face.style}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const abs2 = path4.join(filesDir, primary.localFile);
     try {
-      const m = await computeFallback(file);
-      if (seen.has(m.familyName)) continue;
-      seen.add(m.familyName);
-      blocks.push(formatFallbackCss(m));
+      let base = metricsByFile.get(abs2);
+      if (!base) {
+        base = await computeFallback(abs2);
+        metricsByFile.set(abs2, base);
+      }
+      blocks.push(
+        formatFallbackCss({
+          ...base,
+          familyName: face.family,
+          fallbackFamily: `${face.family} Fallback`,
+          fontWeight: face.weight || "400",
+          fontStyle: face.style || "normal"
+        })
+      );
     } catch (e) {
-      errors.push({ file, reason: e.message });
+      errors.push({ file: primary.localFile, reason: e.message });
     }
   }
   return { css: blocks.join("\n\n"), count: blocks.length, errors };
 }
-async function collectFontFiles2(root) {
-  const out = [];
-  async function walk(dir) {
-    const items = await fs3.readdir(dir, { withFileTypes: true });
-    for (const it of items) {
-      const p = path4.join(dir, it.name);
-      if (it.isDirectory()) {
-        await walk(p);
-      } else if (/\.(woff2|woff|ttf|otf)$/i.test(it.name)) {
-        out.push(p);
-      }
-    }
-  }
-  await walk(root);
-  return out;
-}
 
 // ../core/src/parse/crawl.ts
 var CRAWL_PAGE_CAP = 50;
@@ -149679,6 +149928,88 @@ function stripHash(u) {
   return clone.toString();
 }
 
+// ../core/src/parse/consistency.ts
+function computeConsistency(perPage) {
+  if (perPage.length === 0) {
+    return { shared: [], perPage: [], divergent: [] };
+  }
+  const sortedPerPage = perPage.map((p) => ({ url: p.url, families: [...p.families].sort() }));
+  const allFamilySets = sortedPerPage.map((p) => new Set(p.families));
+  const shared = [...allFamilySets[0]].filter(
+    (fam) => allFamilySets.every((s) => s.has(fam))
+  );
+  shared.sort();
+  const entry = allFamilySets[0];
+  const divergent = [];
+  for (let i = 1; i < sortedPerPage.length; i++) {
+    const here = allFamilySets[i];
+    const onlyHere = [...here].filter((f) => !entry.has(f)).sort();
+    const missingHere = [...entry].filter((f) => !here.has(f)).sort();
+    if (onlyHere.length > 0 || missingHere.length > 0) {
+      divergent.push({ url: sortedPerPage[i].url, onlyHere, missingHere });
+    }
+  }
+  return { shared, perPage: sortedPerPage, divergent };
+}
+function buildPageFaceMap(pageUrls, sourceToPage, facesPerSource) {
+  const pageFamilies = /* @__PURE__ */ new Map();
+  for (const url of pageUrls) pageFamilies.set(url, /* @__PURE__ */ new Set());
+  for (let i = 0; i < facesPerSource.length; i++) {
+    const pageIdx = sourceToPage[i];
+    const pageUrl = pageUrls[pageIdx];
+    if (!pageUrl) continue;
+    const set = pageFamilies.get(pageUrl);
+    for (const f of facesPerSource[i]) set.add(f.family);
+  }
+  return pageUrls.map((url) => ({ url, families: [...pageFamilies.get(url) ?? []] }));
+}
+function buildConsistencyReport(report, host) {
+  const lines = [
+    `# Cross-page font consistency for ${host}`,
+    "",
+    `Crawled ${report.perPage.length} page(s). ${report.shared.length} family/families used everywhere; ${report.divergent.length} page(s) diverge from the entry page.`,
+    ""
+  ];
+  lines.push("## Shared across every page");
+  lines.push("");
+  if (report.shared.length === 0) {
+    lines.push("_No families appeared on every page._");
+  } else {
+    for (const fam of report.shared) lines.push(`- ${fam}`);
+  }
+  lines.push("");
+  lines.push("## Per-page families");
+  lines.push("");
+  for (const page of report.perPage) {
+    lines.push(`### ${page.url}`);
+    lines.push("");
+    if (page.families.length === 0) {
+      lines.push("_No @font-face declarations found on this page._");
+    } else {
+      for (const fam of page.families) lines.push(`- ${fam}`);
+    }
+    lines.push("");
+  }
+  if (report.divergent.length > 0) {
+    lines.push("## Divergence from the entry page");
+    lines.push("");
+    lines.push("_The entry page (first URL crawled) is the baseline. Each row below is a page whose typography differs from the entry._");
+    lines.push("");
+    for (const d of report.divergent) {
+      lines.push(`### ${d.url}`);
+      lines.push("");
+      if (d.onlyHere.length > 0) {
+        lines.push(`- **Only here**: ${d.onlyHere.join(", ")}`);
+      }
+      if (d.missingHere.length > 0) {
+        lines.push(`- **Missing here** (but on entry): ${d.missingHere.join(", ")}`);
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+
 // ../core/src/platforms/nextjs.ts
 var NEXT_SUBSET_RE = /^(.+\/_next\/static\/media\/[^/?#]+-s\.)([a-z0-9]+)(\.(?:woff2|woff|ttf|otf))(\?[^#]*)?(#.*)?$/i;
 var SIBLING_LETTERS = "abcdefghijklmnopqrstuvwxyz".split("");
@@ -149716,6 +150047,63 @@ async function probeNextjsSiblings(url, headers = {}) {
   return found.sort();
 }
 
+// ../core/src/inspect/collapse.ts
+import path5 from "path";
+function detectCollapseOpportunities(variableFonts, faces, fileSizes) {
+  const out = [];
+  for (const vf of variableFonts) {
+    const hasWeightAxis = vf.axes.some((a) => a.tag === "wght" && a.min !== a.max);
+    if (!hasWeightAxis) continue;
+    const variableFileName = path5.basename(vf.filePath);
+    const staticFiles = /* @__PURE__ */ new Map();
+    for (const f of faces) {
+      if (f.family !== vf.family) continue;
+      for (const s of f.sources) {
+        if (!s.localFile) continue;
+        const baseName = path5.basename(s.localFile);
+        if (baseName === variableFileName) continue;
+        if (/\.subset\./i.test(baseName)) continue;
+        staticFiles.set(s.localFile, { weight: f.weight, style: f.style });
+      }
+    }
+    if (staticFiles.size < 2) continue;
+    const variableLocalKey = findLocalKeyForFile(faces, variableFileName);
+    const variableBytes = variableLocalKey ? fileSizes.get(variableLocalKey) ?? 0 : 0;
+    const staticEntries = [];
+    let staticBytes = 0;
+    for (const [file, meta] of staticFiles) {
+      const bytes = fileSizes.get(file) ?? 0;
+      staticBytes += bytes;
+      staticEntries.push({ file, bytes, weight: meta.weight, style: meta.style });
+    }
+    const savedBytes = staticBytes - variableBytes;
+    if (savedBytes <= 0) continue;
+    out.push({
+      family: vf.family,
+      variableFile: vf.filePath,
+      variableBytes,
+      staticFiles: staticEntries,
+      staticBytes,
+      savedBytes
+    });
+  }
+  return out;
+}
+function findLocalKeyForFile(faces, baseName) {
+  for (const f of faces) {
+    for (const s of f.sources) {
+      if (s.localFile && path5.basename(s.localFile) === baseName) {
+        return s.localFile;
+      }
+    }
+  }
+  return void 0;
+}
+function formatCollapseHint(op) {
+  const savedKb = (op.savedBytes / 1024).toFixed(1);
+  return `  \u2139 ${op.family}: drop ${op.staticFiles.length} static weight file(s) \u2014 variable font already covers them. Saves ~${savedKb} KB.`;
+}
+
 // ../core/src/formats/formats.ts
 var FONT_FORMATS = ["woff2", "woff", "ttf", "otf", "eot"];
 function isFontFormat(s) {
@@ -149764,11 +150152,12 @@ async function pull({
   onProgress,
   fallback = false,
   pages = 1,
-  formats: formats2
+  formats: formats2,
+  gdprReport = false
 }) {
   const host = siteSlug(url);
-  const outDir = path5.join(path5.resolve(baseDir), host);
-  const filesDir = path5.join(outDir, "files");
+  const outDir = path6.join(path6.resolve(baseDir), host);
+  const filesDir = path6.join(outDir, "files");
   await fs4.mkdir(filesDir, { recursive: true });
   const cappedPages = Math.max(1, Math.min(Math.floor(pages), CRAWL_PAGE_CAP));
   onProgress?.({ type: "phase", phase: "fetch_html" });
@@ -149796,6 +150185,7 @@ async function pull({
   }
   onProgress?.({ type: "phase", phase: "parse_css" });
   const cssSources = [];
+  const sourceToPage = [];
   const cssLinkSet = /* @__PURE__ */ new Set();
   const perPage = [];
   let totalInline = 0;
@@ -149812,12 +150202,17 @@ async function pull({
     perPage.push({ page, uniqueLinks, inline });
   }
   log.info(`  ${cssLinkSet.size} external stylesheet(s), ${totalInline} inline <style> block(s)`);
-  for (const { page, uniqueLinks, inline } of perPage) {
-    for (const text of inline) cssSources.push({ text, base: page.url });
+  for (let pageIdx = 0; pageIdx < perPage.length; pageIdx++) {
+    const { page, uniqueLinks, inline } = perPage[pageIdx];
+    for (const text of inline) {
+      cssSources.push({ text, base: page.url });
+      sourceToPage.push(pageIdx);
+    }
     for (const link of uniqueLinks) {
       try {
         log.info(`\u2192 Fetching CSS: ${link}`);
         cssSources.push({ text: await fetchText(link, { Referer: page.url }), base: link });
+        sourceToPage.push(pageIdx);
         onProgress?.({ type: "css_fetched", url: link });
       } catch (e) {
         const reason = e.message;
@@ -149831,7 +150226,10 @@ async function pull({
     log.info("\u2192 Running headless mode (Playwright)...");
     try {
       const result = await fetchHeadless(url);
-      cssSources.push(...result.cssSources);
+      for (const src of result.cssSources) {
+        cssSources.push(src);
+        sourceToPage.push(0);
+      }
       networkFontUrls = result.networkFontUrls;
       log.info(`  + ${result.cssSources.length} stylesheet block(s) from headless`);
       if (networkFontUrls.length > 0) {
@@ -149842,7 +150240,8 @@ async function pull({
       log.warn("  Continuing with static results.");
     }
   }
-  const allFaces = cssSources.flatMap(({ text, base }) => extractFontFaces(text, base));
+  const facesPerSource = cssSources.map(({ text, base }) => extractFontFaces(text, base));
+  const allFaces = facesPerSource.flat();
   const seen = /* @__PURE__ */ new Set();
   const dedupedFaces = allFaces.filter((f) => {
     const sig = `${f.family}|${f.weight}|${f.style}|${f.sources.map((s) => s.url).sort().join(",")}`;
@@ -149974,13 +150373,13 @@ async function pull({
   });
   if (licenseSummary.allCommercial && !force) {
     await fs4.writeFile(
-      path5.join(outDir, "LICENSE_REVIEW.md"),
+      path6.join(outDir, "LICENSE_REVIEW.md"),
       buildLicenseReview(host, classified, licenseSummary)
     );
     log.warn("");
     log.warn(`\u2717 All ${licenseSummary.commercial} detected font(s) are served from known commercial CDNs.`);
     log.warn("  Downloading and shipping these without a license violates foundry EULAs.");
-    log.warn(`  Wrote ${path5.join(outDir, "LICENSE_REVIEW.md")} with the breakdown.`);
+    log.warn(`  Wrote ${path6.join(outDir, "LICENSE_REVIEW.md")} with the breakdown.`);
     log.warn("  To download anyway (e.g. for a local mockup you have rights to), re-run with --force.");
     log.warn("");
     onProgress?.({ type: "aborted_all_commercial", count: licenseSummary.commercial });
@@ -150001,10 +150400,11 @@ async function pull({
   let downloaded = 0;
   let index = 0;
   const createdBuckets = /* @__PURE__ */ new Set();
+  const fileSizes = /* @__PURE__ */ new Map();
   for (const [fontUrl, name] of urlToLocal) {
     index++;
-    const dest = path5.join(filesDir, name);
-    const bucketDir = path5.dirname(dest);
+    const dest = path6.join(filesDir, name);
+    const bucketDir = path6.dirname(dest);
     if (!createdBuckets.has(bucketDir)) {
       await fs4.mkdir(bucketDir, { recursive: true });
       createdBuckets.add(bucketDir);
@@ -150012,6 +150412,7 @@ async function pull({
     try {
       const buf = await fetchBuffer(fontUrl, { Referer: url });
       await fs4.writeFile(dest, buf);
+      fileSizes.set(name, buf.length);
       log.info(`  \u2713 ${name}  (${buf.length.toLocaleString()} bytes)`);
       const bucket = name.includes("/") ? name.split("/")[0] : "self-hosted";
       onProgress?.({
@@ -150052,35 +150453,82 @@ async function pull({
     }
     onProgress?.({ type: "variable_fonts", fonts: variableFonts });
   }
+  const collapseOpportunities = detectCollapseOpportunities(variableFonts, faces, fileSizes);
+  if (collapseOpportunities.length > 0) {
+    log.info("  \u2139 Variable-font collapse opportunities:");
+    for (const op of collapseOpportunities) log.info(formatCollapseHint(op));
+  }
   let fallbackBlocks = [];
   if (fallback) {
-    log.info("\u2192 Computing CLS-killing fallback metrics (capsize)");
-    const { css, count, errors } = await buildFallbacksForDir(filesDir);
+    log.info("\u2192 Computing CLS-killing fallback metrics (capsize, per weight)");
+    const { css, count, errors } = await buildPerFaceFallbacks(filesDir, faces);
     if (count > 0) {
       fallbackBlocks = [css];
-      log.info(`  + ${count} fallback @font-face block(s) generated`);
+      log.info(`  + ${count} fallback @font-face block(s) generated (one per weight/style)`);
     }
     for (const err of errors) {
-      log.warn(`  ! fallback skipped for ${path5.basename(err.file)}: ${err.reason}`);
+      log.warn(`  ! fallback skipped for ${path6.basename(err.file)}: ${err.reason}`);
     }
   }
   const preloadHints = buildPreloadHints(faces);
   await fs4.writeFile(
-    path5.join(outDir, "fonts.css"),
+    path6.join(outDir, "fonts.css"),
     buildFontsCss(faces, { preloadHints, extraBlocks: fallbackBlocks })
   );
-  await fs4.writeFile(path5.join(outDir, "fonts.json"), buildFontsJson(faces, orphans));
-  await fs4.writeFile(path5.join(outDir, "README.md"), buildReadme(host, faces, downloaded, orphans));
+  await fs4.writeFile(path6.join(outDir, "fonts.json"), buildFontsJson(faces, orphans));
+  await fs4.writeFile(path6.join(outDir, "README.md"), buildReadme(host, faces, downloaded, orphans));
   await fs4.writeFile(
-    path5.join(outDir, "LICENSE_REVIEW.md"),
+    path6.join(outDir, "LICENSE_REVIEW.md"),
     buildLicenseReview(host, refined, refinedSummary)
   );
+  await fs4.writeFile(
+    path6.join(outDir, "provenance.json"),
+    buildProvenanceJson(host, url, refined, orphans, fileSizes)
+  );
+  if (gdprReport) {
+    const report = buildGdprReport(host, url, faces);
+    await fs4.writeFile(path6.join(outDir, "GDPR.md"), formatGdprMarkdown(report));
+    await fs4.writeFile(
+      path6.join(outDir, "gdpr.json"),
+      JSON.stringify(report, null, 2)
+    );
+    if (report.summary.highSeverity > 0) {
+      log.info(
+        `\u2192 GDPR review: ${report.summary.thirdParty} third-party request(s), ${report.summary.highSeverity} high-severity \u2014 see GDPR.md`
+      );
+    } else if (report.summary.thirdParty > 0) {
+      log.info(
+        `\u2192 GDPR review: ${report.summary.thirdParty} third-party request(s) \u2014 see GDPR.md`
+      );
+    } else {
+      log.info("\u2192 GDPR review: no third-party font requests detected");
+    }
+  }
+  let consistencyReport;
+  if (fetchedPages.length > 1) {
+    const pageUrls = fetchedPages.map((p) => p.url);
+    const pageFaceMap = buildPageFaceMap(pageUrls, sourceToPage, facesPerSource);
+    consistencyReport = computeConsistency(pageFaceMap);
+    await fs4.writeFile(
+      path6.join(outDir, "CONSISTENCY.md"),
+      buildConsistencyReport(consistencyReport, host)
+    );
+    if (consistencyReport.divergent.length > 0) {
+      log.info(
+        `\u2192 Cross-page consistency: ${consistencyReport.shared.length} shared / ${consistencyReport.divergent.length} divergent page(s) \u2014 see CONSISTENCY.md`
+      );
+    } else {
+      log.info(
+        `\u2192 Cross-page consistency: ${consistencyReport.shared.length} family/families used on every crawled page`
+      );
+    }
+  }
   for (const target of emit) {
     const emitter = EMITTERS[target];
     if (!emitter) continue;
     const output = emitter(faces, { siteSlug: host, filesDir: "files" });
     if (!output) continue;
-    await fs4.writeFile(path5.join(outDir, output.filename), output.content);
+    await fs4.writeFile(path6.join(outDir, output.filename), output.content);
     log.info(`  + emitted ${output.filename} (--emit ${target})`);
   }
   onProgress?.({ type: "phase", phase: "done" });
@@ -150093,13 +150541,16 @@ async function pull({
     total: urlToLocal.size,
     variableFonts,
     pagesCrawled: fetchedPages.length,
-    discoveredNextjsSiblings
+    discoveredNextjsSiblings,
+    ...consistencyReport ? { consistency: consistencyReport } : {},
+    fileSizes: Object.fromEntries(fileSizes),
+    collapseOpportunities
   };
 }
 
 // ../core/src/pipeline/subset.ts
 import fs5 from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 
 // ../core/src/formats/codepoints.ts
 var ENTRY_RE = /^U\+([0-9A-Fa-f]{1,6})(?:-([0-9A-Fa-f]{1,6}))?$/;
@@ -150239,7 +150690,7 @@ async function subset(options) {
   if (options.skipPull) {
     const host = new URL(options.url).hostname.replace(/^www\./, "").replace(/[^a-zA-Z0-9.-]/g, "_");
     pullResult = {
-      outDir: path6.join(path6.resolve(options.baseDir), host),
+      outDir: path7.join(path7.resolve(options.baseDir), host),
       faces: [],
       orphans: [],
       downloaded: 0,
@@ -150267,8 +150718,8 @@ async function subset(options) {
   if (options.whitelist) extras.push(...options.whitelist);
   const codepoints = uniqueCodepoints(renderedText, extras);
   log.info(`  ${codepoints.length.toLocaleString()} unique codepoint(s) observed`);
-  const filesDir = path6.join(pullResult.outDir, "files");
-  const fontFiles = await collectFontFiles3(filesDir);
+  const filesDir = path7.join(pullResult.outDir, "files");
+  const fontFiles = await collectFontFiles2(filesDir);
   const perFile = [];
   const errors = [];
   let totalOriginal = 0;
@@ -150283,10 +150734,10 @@ async function subset(options) {
       const savedBytes = original.length - subsetBuffer.length;
       const savedPct = original.length > 0 ? savedBytes / original.length * 100 : 0;
       log.info(
-        `  \u2713 ${path6.relative(filesDir, outFile)}  ${(subsetBuffer.length / 1024).toFixed(1)} KB (was ${(original.length / 1024).toFixed(1)} KB, \u2212${savedPct.toFixed(0)}%)`
+        `  \u2713 ${path7.relative(filesDir, outFile)}  ${(subsetBuffer.length / 1024).toFixed(1)} KB (was ${(original.length / 1024).toFixed(1)} KB, \u2212${savedPct.toFixed(0)}%)`
       );
       perFile.push({
-        file: path6.relative(filesDir, outFile),
+        file: path7.relative(filesDir, outFile),
         originalBytes: original.length,
         subsetBytes: subsetBuffer.length,
         saved: savedBytes,
@@ -150296,8 +150747,8 @@ async function subset(options) {
       totalSubset += subsetBuffer.length;
     } catch (e) {
       const reason = e.message;
-      log.warn(`  \u2717 ${path6.relative(filesDir, file)} \u2014 ${reason}`);
-      errors.push({ file: path6.relative(filesDir, file), reason });
+      log.warn(`  \u2717 ${path7.relative(filesDir, file)} \u2014 ${reason}`);
+      errors.push({ file: path7.relative(filesDir, file), reason });
     }
   }
   const totalSaved = totalOriginal - totalSubset;
@@ -150335,8 +150786,8 @@ async function runSplit(pullResult, options, subsetFont) {
     bucket: b,
     codepoints: expandBucket(b)
   }));
-  const filesDir = path6.join(pullResult.outDir, "files");
-  const fontFiles = await collectFontFiles3(filesDir);
+  const filesDir = path7.join(pullResult.outDir, "files");
+  const fontFiles = await collectFontFiles2(filesDir);
   const perFile = [];
   const splits = [];
   const errors = [];
@@ -150356,19 +150807,19 @@ async function runSplit(pullResult, options, subsetFont) {
     try {
       original = await fs5.readFile(file);
     } catch (e) {
-      errors.push({ file: path6.relative(filesDir, file), reason: e.message });
+      errors.push({ file: path7.relative(filesDir, file), reason: e.message });
       continue;
     }
     let charsetInfo;
     try {
       charsetInfo = readFontCharset(original);
     } catch (e) {
-      errors.push({ file: path6.relative(filesDir, file), reason: `fontkit: ${e.message}` });
+      errors.push({ file: path7.relative(filesDir, file), reason: `fontkit: ${e.message}` });
       continue;
     }
-    const localRel = path6.relative(filesDir, file);
+    const localRel = path7.relative(filesDir, file);
     const faceMeta = faceByLocal.get(localRel);
-    const family = faceMeta?.family ?? charsetInfo.family ?? path6.basename(file, path6.extname(file));
+    const family = faceMeta?.family ?? charsetInfo.family ?? path7.basename(file, path7.extname(file));
     const familyReport = {
       family,
       sourceFile: localRel,
@@ -150390,7 +150841,7 @@ async function runSplit(pullResult, options, subsetFont) {
           `.${bucket.name}.subset.woff2`
         );
         await fs5.writeFile(outFile, subsetBuffer);
-        const outRel = path6.relative(filesDir, outFile);
+        const outRel = path7.relative(filesDir, outFile);
         const savedBytes = original.length - subsetBuffer.length;
         const savedPct = original.length > 0 ? savedBytes / original.length * 100 : 0;
         log.info(
@@ -150424,7 +150875,7 @@ async function runSplit(pullResult, options, subsetFont) {
       splits.push(familyReport);
     }
   }
-  const splitCssPath = path6.join(pullResult.outDir, "fonts.subset.css");
+  const splitCssPath = path7.join(pullResult.outDir, "fonts.subset.css");
   await fs5.writeFile(splitCssPath, buildSplitCss(splits, expandedBuckets, faceByLocal));
   const totalSaved = totalOriginal - totalSubset;
   const totalSavedPct = totalOriginal > 0 ? totalSaved / totalOriginal * 100 : 0;
@@ -150442,7 +150893,7 @@ async function runSplit(pullResult, options, subsetFont) {
     perFile,
     errors,
     splits,
-    splitCss: path6.relative(pullResult.outDir, splitCssPath)
+    splitCss: path7.relative(pullResult.outDir, splitCssPath)
   };
 }
 function buildSplitCss(splits, expandedBuckets, faceByLocal) {
@@ -150477,7 +150928,7 @@ function buildSplitCss(splits, expandedBuckets, faceByLocal) {
   }
   return lines.join("\n");
 }
-async function collectFontFiles3(root) {
+async function collectFontFiles2(root) {
   const out = [];
   async function walk(dir) {
     let items;
@@ -150487,7 +150938,7 @@ async function collectFontFiles3(root) {
       return;
     }
     for (const it of items) {
-      const p = path6.join(dir, it.name);
+      const p = path7.join(dir, it.name);
       if (it.isDirectory()) await walk(p);
       else if (/\.(woff2|woff|ttf|otf)$/i.test(it.name)) out.push(p);
     }
@@ -150511,8 +150962,204 @@ function emptyReport(outDir, url) {
   };
 }
 
+// ../core/src/pipeline/diff.ts
+async function diffPulls(urlA, urlB, baseDir, options = {}) {
+  const [resultA, resultB] = await Promise.all([
+    pull({ url: urlA, baseDir, ...options }),
+    pull({ url: urlB, baseDir, ...options })
+  ]);
+  const sideA = summarise(urlA, resultA.faces, resultA.fileSizes);
+  const sideB = summarise(urlB, resultB.faces, resultB.fileSizes);
+  const famSetA = new Set(sideA.families);
+  const famSetB = new Set(sideB.families);
+  const added = [...famSetB].filter((f) => !famSetA.has(f)).sort();
+  const removed = [...famSetA].filter((f) => !famSetB.has(f)).sort();
+  const shared = [...famSetA].filter((f) => famSetB.has(f)).sort();
+  return {
+    schemaVersion: "1.0",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    a: sideA,
+    b: sideB,
+    added,
+    removed,
+    shared,
+    byteDelta: sideB.totalBytes - sideA.totalBytes,
+    commercialDelta: sideB.commercialCount - sideA.commercialCount
+  };
+}
+function summarise(url, faces, fileSizes) {
+  const families = [...new Set(faces.map((f) => f.family))].sort();
+  const sizes = fileSizes ?? {};
+  let totalBytes = 0;
+  let fileCount = 0;
+  const seenFiles = /* @__PURE__ */ new Set();
+  for (const f of faces) {
+    for (const s of f.sources) {
+      if (!s.localFile) continue;
+      if (seenFiles.has(s.localFile)) continue;
+      seenFiles.add(s.localFile);
+      fileCount++;
+      totalBytes += sizes[s.localFile] ?? 0;
+    }
+  }
+  const classified = classifyFaces(faces);
+  const commercialCount = classified.filter((c) => c.classification.status === "commercial").length;
+  return { url, families, totalBytes, commercialCount, fileCount };
+}
+function formatFontDiff(diff) {
+  const lines = [
+    `# Font diff`,
+    "",
+    `- **A** ${diff.a.url}`,
+    `- **B** ${diff.b.url}`,
+    "",
+    `## Summary`,
+    "",
+    `- Added: ${diff.added.length} family/families`,
+    `- Removed: ${diff.removed.length} family/families`,
+    `- Shared: ${diff.shared.length} family/families`,
+    `- Byte delta: ${formatBytes(diff.byteDelta)}`,
+    `- Commercial delta: ${signed(diff.commercialDelta)} face(s)`,
+    ""
+  ];
+  if (diff.added.length > 0) {
+    lines.push("## Added (only in B)");
+    lines.push("");
+    for (const f of diff.added) lines.push(`- ${f}`);
+    lines.push("");
+  }
+  if (diff.removed.length > 0) {
+    lines.push("## Removed (only in A)");
+    lines.push("");
+    for (const f of diff.removed) lines.push(`- ${f}`);
+    lines.push("");
+  }
+  if (diff.shared.length > 0) {
+    lines.push("## Shared");
+    lines.push("");
+    for (const f of diff.shared) lines.push(`- ${f}`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function formatBytes(bytes) {
+  const sign = bytes >= 0 ? "+" : "\u2212";
+  const abs2 = Math.abs(bytes);
+  if (abs2 < 1024) return `${sign}${abs2} B`;
+  if (abs2 < 1024 * 1024) return `${sign}${(abs2 / 1024).toFixed(1)} KB`;
+  return `${sign}${(abs2 / (1024 * 1024)).toFixed(1)} MB`;
+}
+function signed(n) {
+  if (n === 0) return "0";
+  return n > 0 ? `+${n}` : `${n}`;
+}
+
+// ../core/src/pipeline/audit.ts
+async function audit(url, baseDir, options = {}) {
+  const result = await pull({ url, baseDir, ...options.pull });
+  const classified = classifyFaces(result.faces);
+  const sizes = result.fileSizes ?? {};
+  const perFamilyBytes = perFamily(result.faces, sizes);
+  const totalBytes = Object.values(perFamilyBytes).reduce((a, b) => a + b, 0);
+  const files = countFiles(result.faces);
+  const byStatus = { open: 0, commercial: 0, unknown: 0 };
+  for (const c of classified) byStatus[c.classification.status]++;
+  const violations = [];
+  if (options.maxKb !== void 0 && totalBytes / 1024 > options.maxKb) {
+    violations.push({
+      type: "budget_exceeded",
+      message: `Total font bundle is ${(totalBytes / 1024).toFixed(1)} KB, exceeds budget of ${options.maxKb} KB`,
+      detail: { actualKb: Math.round(totalBytes / 1024), budgetKb: options.maxKb }
+    });
+  }
+  if (options.perFamilyKb) {
+    for (const [family, budget] of Object.entries(options.perFamilyKb)) {
+      const actual = perFamilyBytes[family] ?? 0;
+      if (actual / 1024 > budget) {
+        violations.push({
+          type: "family_budget_exceeded",
+          message: `Family "${family}" is ${(actual / 1024).toFixed(1)} KB, exceeds budget of ${budget} KB`,
+          detail: { family, actualKb: Math.round(actual / 1024), budgetKb: budget }
+        });
+      }
+    }
+  }
+  if (options.noCommercial && byStatus.commercial > 0) {
+    const offenders = classified.filter((c) => c.classification.status === "commercial").map((c) => c.face.family);
+    violations.push({
+      type: "commercial_present",
+      message: `${byStatus.commercial} commercial face(s) detected: ${[...new Set(offenders)].join(", ")}`,
+      detail: { count: byStatus.commercial, families: [...new Set(offenders)].join(", ") }
+    });
+  }
+  return {
+    schemaVersion: "1.0",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    url,
+    passed: violations.length === 0,
+    violations,
+    summary: {
+      families: new Set(result.faces.map((f) => f.family)).size,
+      faces: result.faces.length,
+      files,
+      totalBytes,
+      byStatus,
+      perFamilyBytes
+    }
+  };
+}
+function perFamily(faces, sizes) {
+  const out = {};
+  const seenFiles = /* @__PURE__ */ new Set();
+  for (const f of faces) {
+    let familyBytes = 0;
+    for (const s of f.sources) {
+      if (!s.localFile) continue;
+      if (seenFiles.has(s.localFile)) continue;
+      seenFiles.add(s.localFile);
+      familyBytes += sizes[s.localFile] ?? 0;
+    }
+    out[f.family] = (out[f.family] ?? 0) + familyBytes;
+  }
+  return out;
+}
+function countFiles(faces) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const f of faces) {
+    for (const s of f.sources) {
+      if (s.localFile) seen.add(s.localFile);
+    }
+  }
+  return seen.size;
+}
+function formatAuditReport(report) {
+  const lines = [];
+  lines.push(`# Audit: ${report.url}`);
+  lines.push("");
+  if (report.passed) {
+    lines.push(`\u2713 Passed. ${report.summary.faces} face(s), ${(report.summary.totalBytes / 1024).toFixed(1)} KB total.`);
+  } else {
+    lines.push(`\u2717 Failed with ${report.violations.length} violation(s).`);
+    lines.push("");
+    for (const v of report.violations) {
+      lines.push(`- **${v.type}**: ${v.message}`);
+    }
+  }
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`- Families: ${report.summary.families}`);
+  lines.push(`- Faces: ${report.summary.faces}`);
+  lines.push(`- Files: ${report.summary.files}`);
+  lines.push(`- Total bytes: ${(report.summary.totalBytes / 1024).toFixed(1)} KB`);
+  lines.push(
+    `- License: ${report.summary.byStatus.open} open / ${report.summary.byStatus.commercial} commercial / ${report.summary.byStatus.unknown} unknown`
+  );
+  return lines.join("\n");
+}
+
 // src/cli.ts
-var VERSION = "1.3.0";
+var VERSION = "1.4.0";
 function printHelp() {
   log.info(`fontfetch ${VERSION}
 
@@ -150520,6 +151167,9 @@ Usage:
   fontfetch <url> [outDir] [flags]       Extract every webfont from a URL
   fontfetch inspect <file>               Print a terminal report for a font file
   fontfetch subset <url> [outDir]        Extract + subset to glyphs actually rendered on the page
+  fontfetch diff <urlA> <urlB>           Diff the font set between two URLs (v1.4)
+  fontfetch audit <url> [flags]          CI-friendly checks: budget, no-commercial (v1.4, non-zero exit on fail)
+  fontfetch budget <url> --max-kb N      Convenience around audit for the bundle-size dimension (v1.4)
 
 Arguments (default command):
   <url>             Page to download fonts from (https://example.com)
@@ -150547,6 +151197,11 @@ Flags (default command):
                       --emit tailwind        Tailwind fontFamily snippet
                       --emit next,tailwind   Both (pair for CSS variables)
                       --emit vite            Vite integration guide
+                      --emit tokens          W3C / Style Dictionary design tokens (v1.4)
+  --gdpr-report     Emit GDPR.md + gdpr.json listing every third-party font
+                    request with self-host remediation. Post-LG M\xFCnchen I
+                    20 O 1393/21 (2022) German court ruling on Google Fonts
+                    CDN. (v1.4)
   --fallback        Emit a CLS-killing 'Fallback' @font-face for every family,
                     with size-adjust / ascent-override / descent-override /
                     line-gap-override matched to a system fallback (Arial /
@@ -150592,6 +151247,19 @@ Examples:
   fontfetch subset https://stripe.com --split-ranges=latin,latin-ext
   npx fontfetch https://shinobidata.com
 
+Flags (audit / budget subcommand, v1.4):
+  --max-kb <N>      Total bundle size budget in KB; exceeds \u2192 exit 1
+  --per-family-kb <list>
+                    Per-family budgets: "Inter:30,Geist:40"
+  --no-commercial   Exit 1 if any face is classified as commercial
+  --json            Emit machine-readable JSON instead of human-readable output
+
+Examples (v1.4):
+  fontfetch diff https://staging.acme.com https://acme.com
+  fontfetch diff https://staging.acme.com https://acme.com --json
+  fontfetch audit https://acme.com --max-kb 200 --no-commercial
+  fontfetch budget https://acme.com --max-kb 100 --json
+
 Output (per site):
   <outDir>/<hostname>/
     files/          Raw font files (woff2/woff/ttf/otf/eot)
@@ -150600,6 +151268,9 @@ Output (per site):
     fonts.json      Manifest grouped by family/weight/style
     README.md       Human-readable summary
     LICENSE_REVIEW.md  Per-face license verdict (open / commercial / unknown)
+    provenance.json    Machine-readable license + provenance report (v1.4)
+    CONSISTENCY.md     Cross-page font consistency (when --pages > 1, v1.4)
+    fonts.tokens.json  W3C design tokens (when --emit tokens, v1.4)
 
 For local design exploration. You're responsible for licensing the fonts you use.
 `);
@@ -150696,6 +151367,7 @@ async function runPull(args) {
   const headless = args.includes("--headless");
   const force = args.includes("--force");
   const fallback = args.includes("--fallback");
+  const gdprReport = args.includes("--gdpr-report");
   const emit = [];
   const emitIdx = args.findIndex((a) => a === "--emit" || a.startsWith("--emit="));
   if (emitIdx !== -1) {
@@ -150756,7 +151428,8 @@ async function runPull(args) {
     "--force",
     "--fallback",
     "--pages",
-    "--formats"
+    "--formats",
+    "--gdpr-report"
   ]);
   const positional = args.filter((a, i) => {
     if (a.startsWith("--")) return false;
@@ -150784,7 +151457,8 @@ async function runPull(args) {
     force,
     fallback,
     pages,
-    formats: formats2
+    formats: formats2,
+    gdprReport
   });
   log.info("");
   if (result.total === 0) {
@@ -150793,6 +151467,109 @@ async function runPull(args) {
   }
   log.info(`Done. ${result.downloaded}/${result.total} files saved to ${result.outDir}`);
 }
+async function runDiff(args) {
+  const wantJson = args.includes("--json");
+  const positional = args.filter((a) => !a.startsWith("--"));
+  const [urlA, urlB, outDir = "./downloaded-fonts"] = positional;
+  if (!urlA || !urlB) {
+    log.err("Usage: fontfetch diff <urlA> <urlB> [outDir] [--json]");
+    process.exit(1);
+  }
+  try {
+    new URL(urlA);
+    new URL(urlB);
+  } catch {
+    log.err(`Invalid URL passed to diff`);
+    process.exit(1);
+  }
+  try {
+    const diff = await diffPulls(urlA, urlB, outDir);
+    if (wantJson) {
+      process.stdout.write(JSON.stringify(diff, null, 2) + "\n");
+    } else {
+      log.info("");
+      log.info(formatFontDiff(diff));
+    }
+    process.exit(0);
+  } catch (e) {
+    log.err(`diff failed: ${e.message}`);
+    process.exit(1);
+  }
+}
+async function runAudit(args) {
+  const wantJson = args.includes("--json");
+  const noCommercial = args.includes("--no-commercial");
+  let maxKb;
+  const maxKbIdx = args.findIndex((a) => a === "--max-kb" || a.startsWith("--max-kb="));
+  if (maxKbIdx !== -1) {
+    const raw = args[maxKbIdx] === "--max-kb" ? args[maxKbIdx + 1] : args[maxKbIdx].slice("--max-kb=".length);
+    const n = Number.parseInt(raw, 10);
+    if (!Number.isFinite(n) || n <= 0) {
+      log.err(`--max-kb must be a positive integer, got '${raw}'`);
+      process.exit(1);
+    }
+    maxKb = n;
+  }
+  let perFamilyKb;
+  const pfIdx = args.findIndex(
+    (a) => a === "--per-family-kb" || a.startsWith("--per-family-kb=")
+  );
+  if (pfIdx !== -1) {
+    const raw = args[pfIdx] === "--per-family-kb" ? args[pfIdx + 1] : args[pfIdx].slice("--per-family-kb=".length);
+    perFamilyKb = {};
+    for (const part of raw.split(",")) {
+      const [family, kb] = part.split(":");
+      if (!family || !kb) {
+        log.err(`--per-family-kb expects 'Family:KB' pairs; got '${part}'`);
+        process.exit(1);
+      }
+      const n = Number.parseInt(kb, 10);
+      if (!Number.isFinite(n) || n <= 0) {
+        log.err(`--per-family-kb value must be positive integer; got '${kb}'`);
+        process.exit(1);
+      }
+      perFamilyKb[family.trim()] = n;
+    }
+  }
+  const reserved = /* @__PURE__ */ new Set(["--json", "--no-commercial", "--max-kb", "--per-family-kb"]);
+  const positional = args.filter((a, i) => {
+    if (a.startsWith("--")) return false;
+    if (i > 0 && (args[i - 1] === "--max-kb" || args[i - 1] === "--per-family-kb")) return false;
+    if (reserved.has(a)) return false;
+    return true;
+  });
+  const [url, outDir = "./downloaded-fonts"] = positional;
+  if (!url) {
+    log.err("Usage: fontfetch audit <url> [outDir] [--max-kb N] [--no-commercial] [--per-family-kb F:N,...] [--json]");
+    process.exit(1);
+  }
+  try {
+    new URL(url);
+  } catch {
+    log.err(`Invalid URL: ${url}`);
+    process.exit(1);
+  }
+  try {
+    const report = await audit(url, outDir, { maxKb, perFamilyKb, noCommercial });
+    if (wantJson) {
+      process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    } else {
+      log.info("");
+      log.info(formatAuditReport(report));
+    }
+    process.exit(report.passed ? 0 : 1);
+  } catch (e) {
+    log.err(`audit failed: ${e.message}`);
+    process.exit(1);
+  }
+}
+async function runBudget(args) {
+  if (!args.some((a) => a === "--max-kb" || a.startsWith("--max-kb="))) {
+    log.err("Usage: fontfetch budget <url> --max-kb <N> [outDir] [--json]");
+    process.exit(1);
+  }
+  await runAudit(args);
+}
 async function main() {
   const args = process.argv.slice(2);
   if (args.length === 0 || args.includes("-h") || args.includes("--help")) {
@@ -150812,6 +151589,18 @@ async function main() {
     await runSubset(rest);
     return;
   }
+  if (command === "diff") {
+    await runDiff(rest);
+    return;
+  }
+  if (command === "audit") {
+    await runAudit(rest);
+    return;
+  }
+  if (command === "budget") {
+    await runBudget(rest);
+    return;
+  }
   await runPull(args);
 }
 main().catch((e) => {