single-file-cli 2.9.2 → 2.11.0

package/lib/single-file-script.js

@@ -93,14 +93,15 @@ function initSingleFile(constants) {
 	});
 }
 
-async function getScriptSource(options) {
+async function getScriptSource(options, globalAssignment = "") {
 	let source = "";
 	source += script;
-	source += await readScriptFiles(options && options.browserScripts ? options.browserScripts : []);
+	source += "\n" + globalAssignment;
+	source += "\n" + await readScriptFiles(options && options.browserScripts ? options.browserScripts : []);
 	if (options.browserStylesheets && options.browserStylesheets.length) {
-		source += "addEventListener(\"load\",()=>{const styleElement=document.createElement(\"style\");styleElement.textContent=" + JSON.stringify(await readScriptFiles(options.browserStylesheets)) + ";document.body.appendChild(styleElement);});";
+		source += "\naddEventListener(\"load\",()=>{const styleElement=document.createElement(\"style\");styleElement.textContent=" + JSON.stringify(await readScriptFiles(options.browserStylesheets)) + ";document.body.appendChild(styleElement);});";
 	}
-	source += "(" + initSingleFile.toString() + ")(" + JSON.stringify({
+	source += "\n(" + initSingleFile.toString() + ")(" + JSON.stringify({
 		FETCH_FUNCTION_NAME,
 		RESOLVE_FETCH_FUNCTION_NAME,
 		REJECT_FETCH_FUNCTION_NAME
@@ -161,5 +162,5 @@ function getPageDataScriptSource(options, [SET_SCREENSHOT_FUNCTION_NAME, SET_PDF
 
 
 async function readScriptFiles(paths) {
-	return (await Promise.all(paths.map(path => readTextFile(path)))).join("");
+	return (await Promise.all(paths.map(path => readTextFile(path)))).join("\n");
 }

package/lib/version.js

@@ -1 +1 @@
-export const version = "2.9.2";
+export const version = "2.11.0";

package/options.js

@@ -104,7 +104,7 @@ const OPTIONS_INFO = [{
 	"block-scripts": { description: "Block scripts", type: "boolean", defaultValue: true },
 	"block-stylesheets": { description: "Block stylesheets", type: "boolean", defaultValue: false },
 	"block-videos": { description: "Block videos", type: "boolean", defaultValue: true },
-	"block-mixed-content": { description: "Block mixed contents", type: "boolean" },
+	"block-mixed-content": { description: "Block active content (i.e. stylesheets, scripts, fonts) served from HTTP in HTTPS pages, like browsers do; images, videos and audios are unaffected", type: "boolean" },
 	"blocked-url-pattern": { key: "blockedURLPatterns", description: "Regular expression matching URLs to block (e.g. 'annoying-banners\\.com')", type: "string[]" }
 }, {
 	"load-deferred-images": { description: "Load deferred (a.k.a. lazy-loaded) images", type: "boolean", defaultValue: true },
@@ -113,7 +113,7 @@ const OPTIONS_INFO = [{
 	"load-deferred-images-keep-zoom-level": { description: "Load deferred images by keeping zoomed out the page", type: "boolean" },
 	"load-deferred-images-before-frames": { description: "Load deferred frames before before saving fame contents", type: "boolean" },
 	"max-resource-size-enabled": { description: "Enable removal of embedded resources exceeding a given size", type: "boolean" },
-	"max-resource-size": { description: "Maximum size of embedded resources in MB (i.e. images, stylesheets, scripts and iframes)", type: "number", defaultValue: 10 }
+	"max-resource-size": { description: "Maximum size of embedded resources in MB. It applies to every fetched resource, i.e. images, fonts, stylesheets, scripts, frames, videos and audios; a resource above the limit is left out of the saved page", type: "number", defaultValue: 10 }
 }, {
 	"compress-css": { key: "compressCSS", description: "Compress CSS stylesheets", type: "boolean" },
 	"compress-html": { key: "compressHTML", description: "Compress HTML content", type: "boolean", defaultValue: true },
@@ -141,6 +141,7 @@ const OPTIONS_INFO = [{
 	"extract-data-from-page": { description: "Extract compressed data from the page instead of fetching the page in order to create universal self-extracting HTML files", type: "boolean", defaultValue: true },
 	"prevent-appended-data": { description: "Prevent appending data after the compressed data when creating self-extracting HTML files", type: "boolean" },
 	"declare-appended-data": { description: "Declare the data appended after the compressed data as the comment of the ZIP archive, for readers rejecting undeclared trailing bytes (e.g. java.util.zip); ZIP tools then print that data when listing the archive. Has no effect when the extra data is relocated ahead of the compressed data, because nothing is appended then", type: "boolean" },
+	"max-appended-data-length": { description: "Maximum number of bytes appended after the compressed data when creating self-extracting HTML files, 16361 by default. Readers only tolerate trailing bytes as far back as their end-of-archive scan reaches (16383 bytes for libarchive, 32768 for perl Archive::Zip, 65557 for Python zipfile); the default fits the narrowest. Data over the limit is relocated ahead of the compressed data instead. Raising the limit above 65535 silently defeats --declare-appended-data: the declaration is the length of the ZIP comment, a 16-bit field, so a longer run is appended undeclared and without a warning", type: "number" },
 	"embed-screenshot": { description: "Embed a screenshot of the page as a PNG file in the compressed file (self-extracting HTML or ZIP file). When enabled, the resulting file can be read as a ZIP file or a PNG image.", type: "boolean" },
 	"embed-screenshot-options": { description: "Options passed to the CDP method `Page.captureScreenshot()` given as a JSON string (e.g. { \"captureBeyondViewport\": false })", type: "string" },
 	"embedded-image": { description: "Path to a PNG image to embed in the compressed file. Unlike --embed-screenshot it is also compatible with --crawl-save-archive, where it becomes the image of the whole archive.", type: "string" },
@@ -192,6 +193,7 @@ const OPTIONS_INFO = [{
 }, {
 	"include-bom": { key: "includeBOM", description: "Include the UTF-8 BOM into the HTML page, ignored when the page is compressed unless --extract-data-from-page is disabled and no image is embedded", type: "boolean" },
 	"insert-meta-csp": { key: "insertMetaCSP", description: "Include a <meta> tag with a CSP to avoid potential requests to internet when viewing a page", type: "boolean", defaultValue: true },
+	"insert-meta-noindex": { key: "insertMetaNoIndex", description: "Insert a <meta name=robots content=noindex> element, so a saved page served on a public host is not indexed. Ignored when the page already declares noindex", type: "boolean" },
 	"remove-saved-date": { description: "Remove saved date metadata in HTML header", type: "boolean" },
 	"save-original-urls": { key: "saveOriginalURLs", description: "Save the original URLS in the embedded contents", type: "boolean" },
 	"insert-single-file-comment": { description: "Insert a comment in the HTML header with the URL of the page", type: "boolean", defaultValue: true },
@@ -211,6 +213,7 @@ const OPTIONS_INFO = [{
 
 	"save-raw-page": { description: "Save the original page without interpreting it into the browser", type: "boolean" },
 	"output-json": { description: "Output the result as a JSON string containing the page and network info", type: "boolean" },
+	"dump-json": { description: "Write the same JSON as --output-json to stdout, without the page content, and leave the page file alone. Unlike --output-json the page is still written where it would have been, so the two outputs can be combined. Incompatible with --output-json, and with --dump-content unless --output is set, because both write to stdout", type: "boolean" },
 	"create-browser-profile": { description: "Path of the browser profile directory to create or update instead of saving a page. The browser is started with a visible window on the URL passed as argument, log in to the website and quit the browser to save the profile, then pass it to --browser-profile when saving pages", type: "string" },
 
 }, {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "single-file-cli",
-	"version": "2.9.2",
+	"version": "2.11.0",
 	"description": "SingleFile CLI",
 	"author": "Gildas Lormeau",
 	"license": "AGPL-3.0-or-later",

package/single-file-cli-api.js

@@ -27,11 +27,13 @@ import { Buffer } from "node:buffer";
 import * as cdpBackend from "./lib/cdp-client.js";
 import * as bidiBackend from "./lib/bidi-client.js";
 import { getZipScriptSource } from "./lib/single-file-script.js";
-import { createPagesArchive } from "./lib/single-file-archive.js";
+import { createPagesArchive, PROCESS_OPTION_NAMES } from "./lib/single-file-archive.js";
 import { Deno, path } from "./lib/deno-polyfill.js";
 
 const VALID_URL_TEST = /^(https?|file):\/\//;
 
+const ARCHIVE_EXCLUDED_OPTION_NAMES = ["createRootDirectory", "disableCompression", "insertTextBody", "password", "url"];
+
 const DEFAULT_OPTIONS = {
 	removeHiddenElements: true,
 	removeUnusedStyles: true,
@@ -64,7 +66,7 @@ const STATE_PROCESSED = "processed";
 const { readTextFile, writeTextFile, readFile, writeFile, stdout, mkdir, makeTempDir, remove, stat, errors } = Deno;
 let backend = cdpBackend, tasks = [], maxParallelWorkers, sessionFilename, archiveTempDirectory, errorCount = 0;
 
-export { initialize, closeBrowser };
+export { initialize, closeBrowser, getArchiveOptions, ARCHIVE_EXCLUDED_OPTION_NAMES };
 
 async function closeBrowser() {
 	await backend.closeBrowser();
@@ -75,6 +77,12 @@ async function initialize(options) {
 	if ((options.embedPdf || options.embeddedPdf || options.embedScreenshot || options.embeddedImage) && !options.compressContent) {
 		throw new Error("--embed-pdf, --embedded-pdf, --embed-screenshot and --embedded-image require --compress-content");
 	}
+	if (options.dumpJson && options.outputJson) {
+		throw new Error("--dump-json is not compatible with --output-json, which already writes the JSON in place of the page");
+	}
+	if (options.dumpJson && options.dumpContent && !options.output) {
+		throw new Error("--dump-json is not compatible with --dump-content unless --output is set, because both write to stdout");
+	}
 	if (options.crawlSaveArchiveDedup && !options.crawlSaveArchive) {
 		throw new Error("--crawl-save-archive-dedup requires --crawl-save-archive");
 	}
@@ -196,6 +204,23 @@ async function finish(options) {
 	return errorCount;
 }
 
+function getArchiveOptions(options) {
+	const archiveOptions = {
+		zipScript: getZipScriptSource(),
+		dedupPages: options.crawlSaveArchiveDedup,
+		markUnarchivedLinks: options.crawlSaveArchiveMarkUnarchivedLinks,
+		tocPage: options.crawlSaveArchiveToc,
+		pageList: options.crawlSaveArchivePageList,
+		pageTransitions: options.crawlSaveArchivePageTransitions,
+		insertSingleFileComment: options.insertSingleFileComment,
+		removeSavedDate: options.removeSavedDate
+	};
+	PROCESS_OPTION_NAMES
+		.filter(name => !ARCHIVE_EXCLUDED_OPTION_NAMES.includes(name) && !(name in archiveOptions))
+		.forEach(name => archiveOptions[name] = options[name]);
+	return archiveOptions;
+}
+
 async function savePagesArchive(options) {
 	const archiveTasks = tasks.filter(task => task.archiveFilename);
 	if (archiveTasks.length) {
@@ -205,26 +230,7 @@ async function savePagesArchive(options) {
 			title: task.title,
 			getData: () => readFile(task.archiveFilename)
 		}));
-		const content = await createPagesArchive(pages, {
-			zipScript: getZipScriptSource(),
-			dedupPages: options.crawlSaveArchiveDedup,
-			markUnarchivedLinks: options.crawlSaveArchiveMarkUnarchivedLinks,
-			tocPage: options.crawlSaveArchiveToc,
-			pageList: options.crawlSaveArchivePageList,
-			pageTransitions: options.crawlSaveArchivePageTransitions,
-			selfExtractingArchive: options.selfExtractingArchive,
-			extractDataFromPage: options.extractDataFromPage,
-			preventAppendedData: options.preventAppendedData,
-			declareAppendedData: options.declareAppendedData,
-			embeddedPdf: options.embeddedPdf,
-			embeddedImage: options.embeddedImage,
-			includeBOM: options.includeBOM,
-			insertMetaCSP: options.insertMetaCSP,
-			insertCanonicalLink: options.insertCanonicalLink,
-			insertMetaNoIndex: options.insertMetaNoIndex,
-			insertSingleFileComment: options.insertSingleFileComment,
-			removeSavedDate: options.removeSavedDate
-		});
+		const content = await createPagesArchive(pages, getArchiveOptions(options));
 		if (options.dumpContent && !options.output) {
 			await stdout.write(content);
 		} else {
@@ -400,6 +406,7 @@ async function capturePage(options) {
 		if (options.archiveFilename) {
 			await writeFile(options.archiveFilename, content);
 			pageData.archiveFilename = options.archiveFilename;
+			dumpJsonMetadata(pageData, options);
 			return pageData;
 		}
 		if (options.outputJson) {
@@ -429,6 +436,7 @@ async function capturePage(options) {
 			const outputDirectory = getOutputDirectory(options);
 			pageData.filename = filename.startsWith(outputDirectory) ? filename.substring(outputDirectory.length) : filename;
 		}
+		dumpJsonMetadata(pageData, options);
 		return pageData;
 	} catch (error) {
 		errorCount++;
@@ -453,6 +461,18 @@ async function capturePage(options) {
 	}
 }
 
+function dumpJsonMetadata(pageData, options) {
+	if (options.dumpJson) {
+		const metadata = Object.assign({}, pageData);
+		delete metadata.content;
+		delete metadata.binaryContent;
+		delete metadata.doctype;
+		delete metadata.viewport;
+		delete metadata.comment;
+		console.log(JSON.stringify(metadata, null, 2)); // eslint-disable-line no-console
+	}
+}
+
 function getOutputDirectory(options) {
 	if (Array.isArray(options.outputDirectory)) {
 		const outputDirectory = options.outputDirectory.pop();

package/test/e2e/browser-script.test.js

@@ -58,6 +58,46 @@ test("a browser script that throws fails the save instead of degrading it", { ti
 	});
 });
 
+// The same concatenation swallowed code across file boundaries. The scripts were joined with "",
+// and the initSingleFile call appended straight onto the last one, so a file whose final line was a
+// // comment commented out whatever came next. It only bites when that file has no trailing newline,
+// which is why it went unnoticed: an editor that adds one hides it completely. The last-file case
+// failed loudly (initSingleFile never ran, "no valid SingleFile execution context"), but a file
+// eating the NEXT script was silent — exit 0, a valid save, and one script quietly skipped.
+test("a browser script ending in a comment does not swallow the next one", { timeout: TEST_TIMEOUT }, async () => {
+	const MARKER = "second-script-marker";
+	await withPage(async ({ url, directory }) => {
+		const firstPath = join(directory, "first.js");
+		const secondPath = join(directory, "second.js");
+		// deliberately no trailing newline: that is the whole trigger
+		await writeFile(firstPath, "globalThis.__first = 1; // a trailing comment");
+		await writeFile(secondPath, "addEventListener(\"DOMContentLoaded\",()=>{" +
+			"const marker=document.createElement(\"p\");marker.id=\"" + MARKER + "\";document.body.appendChild(marker);});\n");
+		const outputPath = join(directory, "out.html");
+		await execFileAsync(process.execPath, [
+			"single-file-node.js", url, outputPath,
+			"--browser-script", firstPath,
+			"--browser-script", secondPath
+		], { cwd: cliDirectory });
+		assert.match(await readFile(outputPath, "utf8"), new RegExp(MARKER),
+			"the first script's trailing comment swallowed the second one");
+	});
+});
+
+test("a lone browser script ending in a comment still saves the page", { timeout: TEST_TIMEOUT }, async () => {
+	await withPage(async ({ url, directory }) => {
+		const scriptPath = join(directory, "only.js");
+		await writeFile(scriptPath, "globalThis.__only = 1; // a trailing comment");
+		const outputPath = join(directory, "out.html");
+		await execFileAsync(process.execPath, [
+			"single-file-node.js", url, outputPath,
+			"--browser-script", scriptPath
+		], { cwd: cliDirectory });
+		assert.match(await readFile(outputPath, "utf8"), /<h1>page<\/h1>/,
+			"the trailing comment reached the initSingleFile call");
+	});
+});
+
 async function withPage(run) {
 	const server = createServer((request, response) =>
 		response.writeHead(200, { "content-type": "text/html" }).end("<html><body><h1>page</h1></body></html>"));

package/test/e2e/canvas-round-trip.test.js

@@ -84,7 +84,11 @@ async function capture(pathname, generations) {
 }
 
 function getCanvasImage(html) {
-	const match = html.match(/background-image:\s*url\(["']?data:image\/png;base64,([^"')]+)["']?\)/);
+	// either property name is correct: core pins every background longhand on the canvas, and once
+	// background-attachment joined them CSSOM had a complete set and serialised them as the
+	// `background` shorthand. Only cssText changed — core reads the value back through
+	// getPropertyValue("background-image"), which is why the round trip above still holds
+	const match = html.match(/background(?:-image)?:\s*url\(["']?data:image\/png;base64,([^"')]+)["']?\)/);
 	return match && match[1];
 }
 

package/test/e2e/dump-json.test.js

@@ -0,0 +1,111 @@
+/* global URL */
+
+// --dump-json exists because --output-json replaces the page with its JSON: given an explicit
+// output path it wrote <output>.json and no page file at all, so a script that wanted the saved
+// page AND its metadata got neither. --dump-json writes the metadata to stdout and leaves the page
+// file exactly where it would have been, so the two outputs combine.
+//
+// Two things have to hold for that to be worth anything. The page file must still be written where
+// it was asked for, and the JSON must NOT carry the page content, which is what made the
+// --output-json file 34 MB in the first place. The network info is the third: it is captured only
+// when the JSON is asked for, so a flag that reaches the writer but not the capture would emit a
+// JSON with the request and response fields silently missing.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { cliDirectory } from "../target.js";
+
+const execFileAsync = promisify(execFile);
+const TEST_TIMEOUT = 120000;
+const PAGE = "<html><head><title>Dumped Page</title></head><body><a href=\"/other\">other</a></body></html>";
+
+let capturePromise;
+
+test("--dump-json still writes the page file where it was asked for", { timeout: TEST_TIMEOUT }, async () => {
+	const { pageContent } = await getCaptureResult();
+	assert.match(pageContent, /<title>Dumped Page<\/title>/, "the page file is missing or is not the saved page");
+});
+
+test("--dump-json writes the metadata to stdout as JSON", { timeout: TEST_TIMEOUT }, async () => {
+	const { metadata } = await getCaptureResult();
+	assert.equal(metadata.title, "Dumped Page");
+	assert.ok(Array.isArray(metadata.links), "the links are missing from the dumped metadata");
+});
+
+test("--dump-json leaves the page content out of the JSON", { timeout: TEST_TIMEOUT }, async () => {
+	const { metadata } = await getCaptureResult();
+	assert.equal(metadata.content, undefined, "the page content was dumped, which is what --output-json already does");
+	assert.equal(metadata.binaryContent, undefined, "the page content was dumped as base64");
+});
+
+test("--dump-json reaches the network capture, not only the writer", { timeout: TEST_TIMEOUT }, async () => {
+	const { metadata } = await getCaptureResult();
+	assert.ok(metadata.response, "no response info: the flag reached the writer but not the capture");
+	assert.equal(metadata.response.status, 200);
+});
+
+test("--dump-json is refused with --output-json", { timeout: TEST_TIMEOUT }, async () => {
+	const { stderr } = await runCapture(["--dump-json", "--output-json"], { expectFailure: true });
+	assert.match(stderr, /--dump-json is not compatible with --output-json/);
+});
+
+test("--dump-json is refused with --dump-content writing to the same stream", { timeout: TEST_TIMEOUT }, async () => {
+	const { stderr } = await runCapture(["--dump-json", "--dump-content"], { expectFailure: true, noOutput: true });
+	assert.match(stderr, /--dump-json is not compatible with --dump-content/);
+});
+
+function getCaptureResult() {
+	if (!capturePromise) {
+		capturePromise = runDumpCapture();
+	}
+	return capturePromise;
+}
+
+async function runDumpCapture() {
+	const { stdout, outputPath, directory } = await runCapture(["--dump-json"], { keep: true });
+	try {
+		return { metadata: JSON.parse(stdout), pageContent: (await readFile(outputPath)).toString("utf8") };
+	} finally {
+		await rm(directory, { recursive: true });
+	}
+}
+
+async function runCapture(extraArguments, { expectFailure = false, noOutput = false, keep = false } = {}) {
+	const server = createServer((request, response) => {
+		const { pathname } = new URL(request.url, "http://localhost");
+		if (pathname === "/") {
+			response.writeHead(200, { "content-type": "text/html" }).end(PAGE);
+		} else {
+			response.writeHead(404).end();
+		}
+	});
+	await new Promise(resolve => server.listen(0, "localhost", resolve));
+	const directory = await mkdtemp(join(tmpdir(), "single-file-test-"));
+	const outputPath = join(directory, "page.html");
+	try {
+		const args = ["single-file-node.js", "http://localhost:" + server.address().port + "/"];
+		if (!noOutput) {
+			args.push(outputPath);
+		}
+		const { stdout, stderr } = await execFileAsync(process.execPath, args.concat(extraArguments), { cwd: cliDirectory, maxBuffer: 64 * 1024 * 1024 });
+		assert.ok(!expectFailure, "the run was expected to fail, stderr: " + stderr);
+		return { stdout, stderr, outputPath, directory };
+	} catch (error) {
+		if (!expectFailure) {
+			throw error;
+		}
+		return { stdout: error.stdout || "", stderr: error.stderr || "", outputPath, directory };
+	} finally {
+		server.close();
+		if (!keep) {
+			await rm(directory, { recursive: true });
+		}
+	}
+}

package/test/e2e/font-face-source-order.test.js

@@ -0,0 +1,137 @@
+/* global URL */
+
+// CSS orders @font-face sources two ways at once, and a saved page has to honour both.
+// Within one rule the browser uses the FIRST source that loads. Across rules sharing the same
+// family, style, weight and stretch the rules form a single COMPOSITE face: they are checked in
+// reverse declaration order for each character, so a character the last rule's font lacks is drawn
+// from an earlier rule's font, under that rule's own descriptors. Measured in Chrome with two
+// generated fonts, one mapping A-Z and one mapping only A: both are fetched, the later font draws
+// A, the earlier draws B, and each glyph carries its own rule's size-adjust. A control with the
+// same page and only the later rule draws B in serif and never fetches the other font, so the
+// fallback is real and not an eager download. size-adjust does NOT split the composite face.
+// SingleFile merged every rule sharing a font key into one array built with unshift, which reversed
+// both axes at once, and a later fix dropped the earlier rule outright, which lost every glyph only
+// its font carried. The cases below pin the axes against each other, because a fix that satisfies
+// only one of them is the bug in the other direction.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import process from "node:process";
+import { Buffer } from "node:buffer";
+import { cliDirectory } from "../target.js";
+
+const execFileAsync = promisify(execFile);
+const TEST_TIMEOUT = 120000;
+const FONTS_DIRECTORY = join(dirname(fileURLToPath(import.meta.url)), "..", "fidelity", "pages", "fonts");
+// three distinct fixtures, told apart in the save by their byte length
+const FONT_NAMES = ["band.ttf", "bar.ttf", "block.ttf"];
+// the two Dup rules differ in size-adjust, which getFontKey does not cover, so they share a key
+// while rendering differently. That is what makes per-rule pairing the thing to test: any reduction
+// that keeps one rule pairs its metrics with the other rule's font
+const PAGE = "<html><head><style>" +
+	"@font-face{font-family:\"Dup\";src:url(/fonts/band.ttf) format(\"truetype\");size-adjust:50%}" +
+	"@font-face{font-family:\"Dup\";src:url(/fonts/bar.ttf) format(\"truetype\");size-adjust:150%}" +
+	"@font-face{font-family:\"Solo\";src:url(/fonts/block.ttf) format(\"truetype\"),url(/fonts/band.ttf) format(\"truetype\")}" +
+	"h1{font-family:\"Dup\",serif}p{font-family:\"Solo\",serif}" +
+	"</style></head><body><h1>Head</h1><p>Body</p></body></html>";
+
+let capturePromise;
+
+test("every @font-face rule of a composite face is kept", { timeout: TEST_TIMEOUT }, async () => {
+	const { embedded } = await getCaptureResult();
+	const dup = embedded.filter(rule => rule.family === "Dup");
+	assert.equal(dup.length, 2, "a rule of the composite face was dropped, so it lost the glyphs only its font carries");
+});
+
+test("each rule of a composite face keeps its own source", { timeout: TEST_TIMEOUT }, async () => {
+	const { embedded, sizes } = await getCaptureResult();
+	const { earlier, later } = getCompositeRules(embedded);
+	assert.equal(earlier.length, sizes["band.ttf"],
+		`the size-adjust:50% rule embedded ${describe(earlier.length, sizes)} instead of band.ttf, its own source`);
+	assert.equal(later.length, sizes["bar.ttf"],
+		`the size-adjust:150% rule embedded ${describe(later.length, sizes)} instead of bar.ttf, its own source`);
+});
+
+test("a composite face keeps its declaration order", { timeout: TEST_TIMEOUT }, async () => {
+	const { embedded } = await getCaptureResult();
+	const { earlier, later } = getCompositeRules(embedded);
+	assert.ok(embedded.indexOf(earlier) < embedded.indexOf(later),
+		"the rules were reordered, which inverts which font the browser reaches for first");
+});
+
+function getCompositeRules(embedded) {
+	const dup = embedded.filter(rule => rule.family === "Dup");
+	const earlier = dup.find(rule => /size-adjust:\s*50%/.test(rule.text));
+	const later = dup.find(rule => /size-adjust:\s*150%/.test(rule.text));
+	assert.ok(earlier, "no rule carries the earlier rule's size-adjust:50%");
+	assert.ok(later, "no rule carries the later rule's size-adjust:150%");
+	return { earlier, later };
+}
+
+test("a single @font-face rule still resolves to its first source", { timeout: TEST_TIMEOUT }, async () => {
+	const { embedded, sizes } = await getCaptureResult();
+	const solo = embedded.filter(rule => rule.family === "Solo");
+	assert.equal(solo.length, 1, "expected one Solo rule");
+	assert.equal(solo[0].length, sizes["block.ttf"],
+		`the Solo rule embedded ${describe(solo[0].length, sizes)} instead of block.ttf, its first source`);
+});
+
+function describe(length, sizes) {
+	const name = Object.keys(sizes).find(fontName => sizes[fontName] === length);
+	return name || length + " bytes";
+}
+
+function getCaptureResult() {
+	if (!capturePromise) {
+		capturePromise = runCapture();
+	}
+	return capturePromise;
+}
+
+async function runCapture() {
+	const fonts = new Map();
+	const sizes = {};
+	for (const name of FONT_NAMES) {
+		const data = await readFile(join(FONTS_DIRECTORY, name));
+		fonts.set(name, data);
+		sizes[name] = data.length;
+	}
+	const server = createServer((request, response) => {
+		const { pathname } = new URL(request.url, "http://localhost");
+		const name = pathname.startsWith("/fonts/") && pathname.slice("/fonts/".length);
+		if (name && fonts.has(name)) {
+			response.writeHead(200, { "content-type": "font/ttf" }).end(fonts.get(name));
+		} else if (pathname === "/") {
+			response.writeHead(200, { "content-type": "text/html" }).end(PAGE);
+		} else {
+			response.writeHead(404).end();
+		}
+	});
+	await new Promise(resolve => server.listen(0, "localhost", resolve));
+	const directory = await mkdtemp(join(tmpdir(), "single-file-test-"));
+	try {
+		const outputPath = join(directory, "out.html");
+		await execFileAsync(process.execPath, ["single-file-node.js", "http://localhost:" + server.address().port + "/", outputPath], { cwd: cliDirectory });
+		const content = (await readFile(outputPath)).toString("utf8");
+		const embedded = [...content.matchAll(/@font-face\s*{[^}]*}/g)].map(match => {
+			const family = match[0].match(/font-family:\s*"?([^;"}]+)"?/);
+			const data = match[0].match(/base64,([A-Za-z0-9+/=]+)/);
+			return {
+				family: family && family[1].trim(),
+				length: data ? Buffer.from(data[1], "base64").length : 0,
+				text: match[0].replace(/base64,[A-Za-z0-9+/=]+/, "base64,...")
+			};
+		});
+		return { embedded, sizes };
+	} finally {
+		await rm(directory, { recursive: true });
+		server.close();
+	}
+}

package/test/e2e/html-at-media-url.test.js

@@ -5,6 +5,8 @@
 // so a plain save embedded the HTML as src:url(data:text/html;base64,...) inside the @font-face,
 // while --compress-content dropped it because only that path tests the bytes with FontFace. An
 // HTML body at a media URL is never a usable resource, so both modes now treat it like a 404.
+// A @font-face left with no source at all is dropped whole, rather than kept as an "src:" with
+// nothing after it, which is the invalid declaration a browser discards anyway.
 //
 // The controls are a real font and a real image on the same page: they must still be embedded.
 
@@ -39,7 +41,7 @@ const capturePromises = new Map();
 test("an HTML page served at a font URL is dropped from a plain save", { timeout: TEST_TIMEOUT }, async () => {
 	const content = (await getCaptureResult(false)).toString("utf8");
 	assert.ok(!content.includes("data:text/html"), "an HTML body was embedded as a resource");
-	assert.match(content, /font-family:\s*"?Fake"?;\s*src:\s*[;}]/, "the unusable font source was not removed");
+	assert.doesNotMatch(content, /@font-face\s*{[^}]*font-family:\s*"?Fake"?/, "the unusable @font-face rule was kept");
 	assert.match(content, /font-family:\s*"?Real"?;\s*src:\s*url\("?data:font\/ttf;base64,/, "the real font was not embedded");
 });
 

package/test/e2e/insert-head-elements.test.js

@@ -0,0 +1,71 @@
+/* global URL */
+
+// --insert-meta-noindex is a core option that had no CLI flag at all until now, so nothing here
+// ever proved it arrives. That is the failure this file guards: an option can be declared, parsed
+// and documented and still do nothing, because the value has to survive the whole trip from the
+// command line into the page's own context.
+//
+// The baseline capture is the half that makes it mean something: without the flag the element may
+// not appear, otherwise the assertion above would pass on a page that was going to carry it anyway.
+//
+// Its neighbour insertCanonicalLink deliberately has NO flag. It sits in the same core list, but
+// single-file.js forces it to true on every capture, so a flag for it would be a switch that reads
+// as configurable and cannot turn anything off.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { cliDirectory } from "../target.js";
+
+const execFileAsync = promisify(execFile);
+const TEST_TIMEOUT = 120000;
+const PAGE = "<html><head><title>Head Page</title></head><body>content</body></html>";
+const ROBOTS_META = /<meta[^>]*name=["']?robots["']?[^>]*content=["']?noindex/i;
+
+const capturePromises = new Map();
+
+test("--insert-meta-noindex inserts the robots meta", { timeout: TEST_TIMEOUT }, async () => {
+	const content = await getCaptureResult("inserted");
+	assert.match(content, ROBOTS_META, "the robots meta is missing, so the flag never reached core");
+});
+
+test("the robots meta is not inserted without the flag", { timeout: TEST_TIMEOUT }, async () => {
+	const content = await getCaptureResult("baseline");
+	assert.doesNotMatch(content, ROBOTS_META, "the robots meta appears without --insert-meta-noindex");
+});
+
+function getCaptureResult(variant) {
+	if (!capturePromises.has(variant)) {
+		capturePromises.set(variant, runCapture(variant == "inserted" ? ["--insert-meta-noindex"] : []));
+	}
+	return capturePromises.get(variant);
+}
+
+async function runCapture(extraArguments) {
+	const server = createServer((request, response) => {
+		const { pathname } = new URL(request.url, "http://localhost");
+		if (pathname === "/") {
+			response.writeHead(200, { "content-type": "text/html" }).end(PAGE);
+		} else {
+			response.writeHead(404).end();
+		}
+	});
+	await new Promise(resolve => server.listen(0, "localhost", resolve));
+	const directory = await mkdtemp(join(tmpdir(), "single-file-test-"));
+	try {
+		const outputPath = join(directory, "page.html");
+		await execFileAsync(process.execPath, [
+			"single-file-node.js", "http://localhost:" + server.address().port + "/", outputPath
+		].concat(extraArguments), { cwd: cliDirectory });
+		return (await readFile(outputPath)).toString("utf8");
+	} finally {
+		await rm(directory, { recursive: true });
+		server.close();
+	}
+}