single-file-core 1.5.115 → 1.5.117

package/processors/compression/compression-packager.js

@@ -31,7 +31,8 @@ import {
 	ZipReader
 } from "./../../vendor/zip/zip.js";
 import {
-	createArchive
+	createArchive,
+	escapeHTML
 } from "./compression.js";
 
 const browser = globalThis.browser;
@@ -232,13 +233,3 @@ function getTOCContent(pages) {
 		pages.map(page => "<li><a href=\"" + escapeHTML(page.url) + "\">" + escapeHTML(page.title || page.url) + "</a></li>").join("") +
 		"</ul></nav>";
 }
-
-// the prelude declares the windows-1252 charset, non-ASCII characters must be
-// encoded as HTML entities to survive it
-function escapeHTML(value) {
-	return Array.from(value).map(character => {
-		const codePoint = character.codePointAt(0);
-		return codePoint < 32 || codePoint > 126 || character == "&" || character == "<" || character == ">" || character == "\"" ?
-			"&#" + codePoint + ";" : character;
-	}).join("");
-}

package/processors/compression/compression.js

@@ -151,15 +151,27 @@ const PROCESS_OPTION_NAMES = [
 export {
 	process,
 	createArchive,
+	escapeHTML,
 	PROCESS_OPTION_NAMES
 };
 
 async function process(pageData, options, lastModDate = new Date()) {
 	let script;
+	// The worker is configured before anything else, and outside the extension it is turned off
+	// rather than left alone. Given no address, zip.js resolves its default one against the page
+	// being saved, so the browser asks the CAPTURED SITE for a file that site has never heard of:
+	// three 404s in the user's own server logs for every archive, and then a fallback to the main
+	// thread anyway, which is where the work was always going to happen. Choosing the fallback
+	// costs nothing that was ever gained and asks the site for nothing.
+	const extensionContext = Boolean(browser && browser.runtime && browser.runtime.getURL);
+	if (extensionContext) {
+		configure({ workerURI: "/lib/single-file-z-worker.js" });
+	} else {
+		configure({ useWebWorkers: false });
+	}
 	if (options.zipScript) {
 		script = options.zipScript;
-	} else if (browser && browser.runtime && browser.runtime.getURL) {
-		configure({ workerURI: "/lib/single-file-z-worker.js" });
+	} else if (extensionContext) {
 		script = await (await fetch(browser.runtime.getURL(SCRIPT_PATH))).text();
 	}
 	return createArchive(pageData, options, script, zipWriter => {
@@ -253,7 +265,10 @@ async function createArchive(pageData, options, script, writeEntries, lastModDat
 		if (!options.extractDataFromPageTags || options.extractDataFromPageTags[0] != "<plaintext>") {
 			const textContent = TEXT_DECODER.decode(data.subarray(startOffset));
 			if (options.extractDataFromPageTags) {
-				const tagIndex = EXTRA_DATA_TAGS.indexOf(options.extractDataFromPageTags);
+				// the rung is matched on its start tag, not on the identity of the array holding it:
+				// the option is set from EXTRA_DATA_TAGS internally, but a caller passing an equal
+				// pair of its own would otherwise index the regexps with -1
+				const tagIndex = getExtraDataTagIndex(options.extractDataFromPageTags);
 				const regExpsTag = EXTRA_DATA_REGEXPS[tagIndex];
 				if (textContent.match(regExpsTag[0]) || textContent.match(regExpsTag[1])) {
 					return findExtraDataTags(textContent, pageData, options, script, writeEntries, lastModDate, tagIndex + 1);
@@ -619,7 +634,7 @@ function getHTMLHeadData(pageData, options) {
 	let pageContent = "";
 	// the title is left out of a password-protected archive: manifest.json carries it too and
 	// is encrypted, so emitting it here would publish what the password is meant to cover
-	const title = options.password ? "" : getPageTitle(pageData);
+	const title = options.password ? "" : escapeHTML(pageData.title || "");
 	pageContent += "<title>" + title + "</title>";
 	// the canonical link publishes the URL the archive was saved from, for the same reason
 	// the title above is left out of a password-protected archive
@@ -641,16 +656,25 @@ function getHTMLHeadData(pageData, options) {
 	return pageContent;
 }
 
-function getPageTitle(pageData) {
-	// numeric character references are ASCII bytes, so the title survives the single-byte
-	// charset universal mode declares, and any parser decodes them back to the original text
-	return Array.from(pageData.title || "").map(character => {
+// every piece of text in the prelude goes through this, wherever it is assembled: the prelude
+// declares a single-byte charset, and numeric character references are ASCII bytes, so they
+// survive it and any parser decodes them back to the original text
+function escapeHTML(value) {
+	return Array.from(value).map(character => {
 		const codePoint = character.codePointAt(0);
-		return codePoint < 32 || codePoint > 126 || character == "&" || character == "<" || character == ">" ?
+		return codePoint < 32 || codePoint > 126 || character == "&" || character == "<" || character == ">" || character == "\"" ?
 			"&#" + codePoint + ";" : character;
 	}).join("");
 }
 
+function getExtraDataTagIndex(extractDataFromPageTags) {
+	const tagIndex = EXTRA_DATA_TAGS.findIndex(([startTag]) => startTag == extractDataFromPageTags[0]);
+	if (tagIndex == -1) {
+		throw new Error("Unknown data tags: " + extractDataFromPageTags[0]);
+	}
+	return tagIndex;
+}
+
 function findExtraDataTags(textContent, pageData, options, script, writeEntries, lastModDate, indexExtractDataFromPageTags = 0) {
 	const regExpsTag = EXTRA_DATA_REGEXPS[indexExtractDataFromPageTags];
 	const plaintextTag = EXTRA_DATA_TAGS[indexExtractDataFromPageTags][0] == "<plaintext>";

package/processors/hooks/content/content-hooks-frames-web.js

@@ -83,6 +83,7 @@
 
 	let dispatchScrollEvent;
 	let adoptedStylesheetsData = new WeakMap();
+	const shadowRootsData = new WeakMap();
 
 	init();
 	new MutationObserver(init).observe(document, { childList: true });
@@ -534,14 +535,28 @@
 	};
 	CSSStyleSheet.prototype.deleteRule.toString = function () { return "function deleteRule() { [native code] }"; };
 
+	// the listener below is reached through the host element, and a closed shadow root is
+	// not reachable from it, so the roots are recorded as they are created
+	const originalAttachShadow = Element.prototype.attachShadow;
+	Element.prototype.attachShadow = function (init) {
+		try {
+			const shadowRoot = originalAttachShadow.apply(this, [init]);
+			shadowRootsData.set(this, shadowRoot);
+			return shadowRoot;
+		} catch (error) {
+			error.stack = error.message + "\n" + "    \n" + error.stack.trim().split("\n").slice(-1).join("\n");
+			throw error;
+		}
+	};
+	Element.prototype.attachShadow.toString = function () { return "function attachShadow() { [native code] }"; };
+	setFunctionName(Element.prototype.attachShadow, "attachShadow");
+
 	function getAdoptedStylesheetsListener(event) {
-		const shadowRoot = event.target.shadowRoot;
+		const shadowRoot = event.target.shadowRoot || shadowRootsData.get(event.target);
 		event.stopPropagation();
 		if (shadowRoot) {
 			shadowRoot.addEventListener(GET_ADOPTED_STYLESHEETS_REQUEST_EVENT, getAdoptedStylesheetsListener, { capture: true });
-			shadowRoot.addEventListener(UNREGISTER_GET_ADOPTED_STYLESHEETS_REQUEST_EVENT, () => {
-				shadowRoot.removeEventListener(GET_ADOPTED_STYLESHEETS_REQUEST_EVENT, getAdoptedStylesheetsListener);
-			}, { once: true });
+			shadowRoot.addEventListener(UNREGISTER_GET_ADOPTED_STYLESHEETS_REQUEST_EVENT, unregisterGetAdoptedStylesheetsListener, { once: true });
 			const adoptedStyleSheets = Array.from(shadowRoot.adoptedStyleSheets).map(stylesheet => {
 				if (adoptedStylesheetsData.has(stylesheet)) {
 					return adoptedStylesheetsData.get(stylesheet);
@@ -555,6 +570,14 @@
 		}
 	}
 
+	// the root is read from the event rather than captured, so one function serves every shadow root:
+	// a closure per root would be a distinct callback each time and would accumulate instead of being
+	// the no-op that re-adding an already registered listener is. The capture flag has to be repeated
+	// here because it is part of what identifies the listener to remove
+	function unregisterGetAdoptedStylesheetsListener(event) {
+		event.currentTarget.removeEventListener(GET_ADOPTED_STYLESHEETS_REQUEST_EVENT, getAdoptedStylesheetsListener, { capture: true });
+	}
+
 	async function getDetailObject(fontFamily, src, descriptors) {
 		const detail = {};
 		detail["font-family"] = fontFamily;

package/test/sfz-harness/README.md

@@ -18,7 +18,7 @@ deno run --allow-read test/sfz-harness/format-rules.js
 
 ## The suites
 
-CI runs these three. Each prints one `PASS`/`FAIL` line per check and exits non-zero if
+CI runs these. Each prints one `PASS`/`FAIL` line per check and exits non-zero if
 any check failed.
 
 | Script | What it covers |
@@ -26,7 +26,10 @@ any check failed.
 | `format-rules.js` | The rules of the format: charset round trip, the wrapper-tag ladder and its selection tests, the identifier, appended-data placement and declaration, password scope, the PDF and PNG faces. |
 | `stored-trigger.js` | That a stored (uncompressed) entry whose bytes contain a rung's pattern moves the writer to the right rung. |
 | `check-determinism.js` | That the same inputs produce the same bytes, and that the levers which should change the output do. |
-| `option-wiring.js` | That every option `compression.js` reads is either declared as a caller option or classified as internal, and that `single-file.js` still builds its argument from that declaration. Guards the layer the other three suites sit below. |
+| `option-wiring.js` | That every option `compression.js` reads is either declared as a caller option or classified as internal, and that `single-file.js` still builds its argument from that declaration. Guards the layer the other suites sit below. |
+| `css-property-filter.js` | That the declaration filter keeps a property css-tree's dictionary does not know (`stop-color`, `flood-opacity`, anything newer than the pinned build) and still drops a genuinely invalid value. |
+| `adopted-stylesheets-hook.js` | That the page-world hook answers the adopted-stylesheets request for a CLOSED shadow root, which its host does not expose. |
+| `css-fonts-minifier.js` | That `removeUnusedFonts` reads the font families it prunes on correctly: a `var()` family resolved from the values the document declares and not only from the ones the body inherits, every font kept when the value is genuinely undetermined, and a multi-word family name that does not also claim a font named after its own tail. |
 
 ## The tools
 

package/test/sfz-harness/adopted-stylesheets-hook.js

@@ -0,0 +1,240 @@
+/*
+ * Copyright 2010-2026 Gildas Lormeau
+ * contact : gildas.lormeau <at> gmail.com
+ *
+ * This file is part of SingleFile.
+ *
+ *   The code in this file is free software: you can redistribute it and/or
+ *   modify it under the terms of the GNU Affero General Public License
+ *   (GNU AGPL) as published by the Free Software Foundation, either version 3
+ *   of the License, or (at your option) any later version.
+ *
+ *   The code in this file is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero
+ *   General Public License for more details.
+ *
+ *   As additional permission under GNU AGPL version 3 section 7, you may
+ *   distribute UNMODIFIED VERSIONS OF THIS file without the copy of the GNU
+ *   AGPL normally required by section 4, provided you include this license
+ *   notice and a URL through which recipients can access the Corresponding
+ *   Source.
+ */
+
+// A shadow root's constructed stylesheets cannot be read from the extension's own
+// world, so the page-world hook reads them and answers a request event. It used to
+// resolve the root with `event.target.shadowRoot`, which is null for a CLOSED root,
+// and then answered nothing at all. The extension still captured the root's content,
+// because it reaches closed roots through openOrClosedShadowRoot, so a closed root
+// came back in the saved page with its markup intact and its styles gone, with no
+// error anywhere. Measured on 2026-08-30 in Firefox and in Chrome, and again after
+// the fix, with tmp/closed-shadow-root-probe.html.
+//
+// The hook now records every root as it is attached and falls back to that record.
+// This test drives the hook's own listener over a stub of the one browser rule the
+// bug turns on: attachShadow returns the root to its caller either way, and leaves
+// host.shadowRoot null when the mode is closed.
+
+const REQUEST_EVENT = "single-file-request-get-adopted-stylesheets";
+const RESPONSE_EVENT = "single-file-response-get-adopted-stylesheets";
+const UNREGISTER_EVENT = "single-file-unregister-request-get-adopted-stylesheets";
+const HOOK_PATH = new URL("../../processors/hooks/content/content-hooks-frames-web.js", import.meta.url);
+
+let failures = 0;
+
+const documentListeners = new Map();
+installStubs();
+const originalAttachShadow = globalThis.Element.prototype.attachShadow;
+new Function(await Deno.readTextFile(HOOK_PATH))();
+const listener = documentListeners.get(REQUEST_EVENT);
+
+check("the hook registers a listener for the request event", Boolean(listener));
+check("the hook patches attachShadow", globalThis.Element.prototype.attachShadow !== originalAttachShadow);
+check("the patched attachShadow still looks native",
+	globalThis.Element.prototype.attachShadow.toString() === "function attachShadow() { [native code] }" &&
+	globalThis.Element.prototype.attachShadow.name === "attachShadow");
+
+// an open root: the host exposes it, which is the path that always worked
+const openHost = new StubElement();
+const openRoot = openHost.attachShadow({ mode: "open" });
+adopt(openRoot, ".open { color: red }");
+check("attachShadow returns the root for an open mode", openRoot instanceof StubShadowRoot);
+check("an open root answers with its stylesheets",
+	sameStrings(request(openHost, openRoot), [".open { color: red }"]));
+
+// a closed root: the host exposes nothing, so only the record can resolve it
+const closedHost = new StubElement();
+const closedRoot = closedHost.attachShadow({ mode: "closed" });
+adopt(closedRoot, ".closed { color: blue }");
+check("a closed root is hidden from its host", closedHost.shadowRoot === null);
+check("attachShadow returns the root for a closed mode", closedRoot instanceof StubShadowRoot);
+check("a closed root answers with its stylesheets",
+	sameStrings(request(closedHost, closedRoot), [".closed { color: blue }"]));
+
+// the same, for a sheet the page never passed through replaceSync, so that the
+// answer comes from cssRules rather than from the recorded text
+const rulesHost = new StubElement();
+const rulesRoot = rulesHost.attachShadow({ mode: "closed" });
+rulesRoot.adoptedStyleSheets = [{ cssRules: [{ cssText: ".rules { color: green }" }] }];
+check("a closed root answers from cssRules when the text was not recorded",
+	sameStrings(request(rulesHost, rulesRoot), [".rules { color: green }"]));
+
+// an empty root still registers the hook's listener on itself, which is what lets a
+// NESTED host inside it be reached later; only the answer is withheld
+const emptyHost = new StubElement();
+const emptyRoot = emptyHost.attachShadow({ mode: "closed" });
+check("an empty root answers nothing", request(emptyHost, emptyRoot) === undefined);
+check("an empty root is still listened to for nested hosts", emptyRoot.listenerCount(REQUEST_EVENT) > 0);
+
+// a target that is neither a host nor a recorded root must not throw
+check("an unrelated target is ignored", request(new StubElement(), new StubShadowRoot()) === undefined);
+
+// the cleanup the hook installs on each root it answers for. Both halves of it were dead:
+// the unregister handler was a fresh closure per handshake, so it was never the no-op that
+// re-adding a registered listener is and one was left behind per root per save, and it
+// removed the request listener without the capture flag it had been added with, which
+// matches nothing at all
+const repeatHost = new StubElement();
+const repeatRoot = repeatHost.attachShadow({ mode: "open" });
+adopt(repeatRoot, ".repeat { color: teal }");
+request(repeatHost, repeatRoot);
+const unregisterAfterFirst = repeatRoot.listenerCount(UNREGISTER_EVENT);
+request(repeatHost, repeatRoot);
+request(repeatHost, repeatRoot);
+check("one handshake installs one unregister listener", unregisterAfterFirst === 1);
+check("repeated handshakes do not accumulate unregister listeners",
+	repeatRoot.listenerCount(UNREGISTER_EVENT) === 1);
+check("the root is listened to for requests until it is unregistered",
+	repeatRoot.listenerCount(REQUEST_EVENT) === 1);
+repeatRoot.dispatchEvent(new globalThis.CustomEvent(UNREGISTER_EVENT, { bubbles: true }));
+check("unregistering removes the request listener the hook added with capture",
+	repeatRoot.listenerCount(REQUEST_EVENT) === 0);
+check("the unregister listener removes itself once it has fired",
+	repeatRoot.listenerCount(UNREGISTER_EVENT) === 0);
+
+console.log(failures ? `\n${failures} check(s) FAILED` : "\nall checks passed");
+Deno.exit(failures ? 1 : 0);
+
+function request(target, listeningRoot) {
+	let answer;
+	const responseListener = event => answer = event.detail.adoptedStyleSheets;
+	listeningRoot.addEventListener(RESPONSE_EVENT, responseListener);
+	listener({ target, stopPropagation() { } });
+	listeningRoot.removeEventListener(RESPONSE_EVENT, responseListener);
+	return answer;
+}
+
+function adopt(root, text) {
+	const sheet = new globalThis.CSSStyleSheet();
+	sheet.replaceSync(text);
+	root.adoptedStyleSheets = [sheet];
+}
+
+function sameStrings(value, expected) {
+	return Array.isArray(value) && value.length === expected.length && value.every((item, index) => item === expected[index]);
+}
+
+function check(label, condition) {
+	if (!condition) {
+		failures++;
+	}
+	console.log((condition ? "PASS" : "FAIL") + " " + label);
+}
+
+// the stub below models only what the hook touches while it installs itself and
+// while it answers one request; it is deliberately not a DOM
+function StubShadowRoot() {
+	this.adoptedStyleSheets = [];
+	this.listeners = new Map();
+}
+
+function StubElement() {
+	this.shadowRoot = null;
+	this.listeners = new Map();
+}
+
+function installStubs() {
+	// a listener is identified by type, callback AND capture: adding one that is already
+	// registered is a no-op, and removing one with a different capture flag matches nothing.
+	// The stub has to model both, because those are the two rules the cleanup code got wrong
+	const listenerMethods = {
+		addEventListener(type, listener, options) {
+			const capture = Boolean(options && options.capture);
+			if (!this.listeners.has(type)) {
+				this.listeners.set(type, []);
+			}
+			const listeners = this.listeners.get(type);
+			if (!listeners.some(entry => entry.listener === listener && entry.capture === capture)) {
+				listeners.push({ listener, capture, once: Boolean(options && options.once) });
+			}
+		},
+		removeEventListener(type, listener, options) {
+			const capture = Boolean(options && options.capture);
+			const listeners = this.listeners.get(type) || [];
+			const index = listeners.findIndex(entry => entry.listener === listener && entry.capture === capture);
+			if (index !== -1) {
+				listeners.splice(index, 1);
+			}
+		},
+		dispatchEvent(event) {
+			event.currentTarget = this;
+			(this.listeners.get(event.type) || []).slice().forEach(entry => {
+				if (entry.once) {
+					this.removeEventListener(event.type, entry.listener, { capture: entry.capture });
+				}
+				entry.listener(event);
+			});
+			event.currentTarget = null;
+			return true;
+		},
+		listenerCount(type) {
+			return (this.listeners.get(type) || []).length;
+		}
+	};
+	Object.assign(StubShadowRoot.prototype, listenerMethods);
+	Object.assign(StubElement.prototype, listenerMethods);
+
+	// the rule the bug turns on: the caller gets the root whatever the mode, while the
+	// host exposes it only when the mode is open
+	StubElement.prototype.attachShadow = function (init) {
+		const shadowRoot = new StubShadowRoot();
+		shadowRoot.host = this;
+		this.shadowRoot = init && init.mode === "closed" ? null : shadowRoot;
+		return shadowRoot;
+	};
+
+	const recordedText = new WeakMap();
+	class StubCSSStyleSheet {
+		replaceSync(text) {
+			recordedText.set(this, text);
+		}
+		get cssRules() {
+			return [{ cssText: recordedText.get(this) }];
+		}
+	}
+
+	globalThis.Element = StubElement;
+	globalThis.CSSStyleSheet = StubCSSStyleSheet;
+	globalThis.CustomEvent = class CustomEvent {
+		constructor(type, init = {}) {
+			this.type = type;
+			this.detail = init.detail;
+			this.bubbles = Boolean(init.bubbles);
+		}
+	};
+	globalThis.Event = class Event { constructor(type) { this.type = type; } };
+	globalThis.UIEvent = globalThis.Event;
+	globalThis.screen = { width: 0, height: 0 };
+	globalThis.MutationObserver = class MutationObserver { observe() { } };
+	globalThis.fetch = () => Promise.reject(new Error("the hook test makes no request"));
+	globalThis.document = {
+		addEventListener(type, listener) {
+			documentListeners.set(type, listener);
+		},
+		removeEventListener() { },
+		dispatchEvent() { return true; },
+		querySelectorAll: () => [],
+		documentElement: {},
+		fonts: { add() { }, delete() { }, clear() { }, forEach() { } }
+	};
+}

package/test/sfz-harness/css-fonts-minifier.js

@@ -0,0 +1,235 @@
+// removeUnusedFonts decides which @font-face rules to keep by reading the font-family declarations
+// out of the stylesheets. When a family is written as var(--name), the value has to be resolved
+// first, and the only resolution the module had was getComputedStyle(body).getPropertyValue(name).
+// Custom properties inherit downward, so that answers for a property declared on :root and returns
+// nothing for one declared on any descendant — and a single unresolved variable anywhere sets
+// unusedFonts to [], which switches pruning off for the WHOLE document. One declaration moved from
+// :root to .card took a probe page from 7,611 to 43,648 bytes with every unused font embedded.
+//
+// The fix keeps the computed value as the first answer and falls back to the union of every value
+// the document declares for that property. The union is a superset of what any one element sees,
+// so it can only keep too much, never too little — and options.usedFonts, which comes from the
+// rendered computed styles, gates the result anyway.
+//
+// What happens when even the union cannot answer changed with it. Switching pruning off for the
+// whole document was never a policy about uncertainty — a page naming its families plainly has
+// always dropped a face it had not drawn yet, and only a page holding one unreadable value anywhere
+// was spared, all of it. So the rendered list decides in that case too: a family the browser
+// resolved when it drew the page is in that list whatever the stylesheets can be made to say. The
+// one case that still keeps everything is the one where the rendering itself is missing.
+//
+// The other var() defects this pins, all found alongside it:
+//   - custom property names are case-sensitive; they were lowercased with the family names, so
+//     var(--ProbeFont) never resolved, not even from :root
+//   - the "font" shorthand's var() regexp required var(--name) exactly, so a fallback in it made
+//     the shorthand unreadable and switched pruning off
+//   - a var() fallback is one raw token, so a list in it was pushed as a single mangled name and
+//     the families it holds were dropped
+import * as cssTree from "../../vendor/css-tree.js";
+
+// the module reaches core/helper.js, which pulls in the frame hooks, and those install themselves
+// against window and document as they are evaluated: the stubs go in before the dynamic import
+globalThis.window = globalThis;
+globalThis.document = {};
+globalThis.Document = class Document { };
+globalThis.MutationObserver = class MutationObserver { observe() { } };
+const { process: removeUnusedFonts } = await import("../../modules/css-fonts-minifier.js");
+
+const FONT_FACES = `
+	@font-face{font-family:"UsedOne";src:url(one.woff2)}
+	@font-face{font-family:"UsedTwo";src:url(two.woff2)}
+	@font-face{font-family:"UsedThree";src:url(three.woff2)}
+	@font-face{font-family:"Unused";src:url(unused.woff2)}`;
+
+// what the rendered page reports as actually drawn: [family, weight, style, variant]. A family
+// missing from this list is dropped whatever the stylesheets say, so it holds every family the
+// tests below may legitimately keep
+const USED_FONTS = [
+	["usedone", "400", "normal", "normal"],
+	["usedtwo", "400", "normal", "normal"],
+	["usedthree", "400", "normal", "normal"]
+];
+
+const ALL_FAMILIES = ["usedone", "usedtwo", "usedthree", "unused"];
+
+// what survives when the stylesheets cannot say which family a value names: the faces the page
+// declares AND the rendering reports having drawn with. It is USED_FONTS that decides there, so a
+// face nothing drew is dropped even though nothing could be shown to name it either
+const RENDERED_FAMILIES = ["usedone", "usedtwo", "usedthree"];
+
+let failures = 0;
+
+check("a plain family name prunes the rest",
+	run({ rules: ".card p{font-family:\"UsedOne\",serif}" }),
+	["usedone"]);
+
+check("a property declared on :root resolves through the computed style",
+	run({ rules: ":root{--probe-font:\"UsedOne\"}.card p{font-family:var(--probe-font),serif}", computed: { "--probe-font": "\"UsedOne\"" } }),
+	["usedone"]);
+
+check("a property declared on a descendant resolves through the declared values",
+	run({ rules: ".card{--probe-font:\"UsedOne\"}.card p{font-family:var(--probe-font),serif}" }),
+	["usedone"]);
+
+check("a mixed-case property name is not lowercased away",
+	run({ rules: ".card{--ProbeFont:\"UsedOne\"}.card p{font-family:var(--ProbeFont),serif}" }),
+	["usedone"]);
+
+check("a property declared inside a media query resolves too",
+	run({ rules: "@media screen{.card{--probe-font:\"UsedOne\"}}.card p{font-family:var(--probe-font),serif}" }),
+	["usedone"]);
+
+check("several declared values are all kept as candidates",
+	run({ rules: ".card{--probe-font:\"UsedOne\"}.note{--probe-font:\"UsedTwo\"}p{font-family:var(--probe-font),serif}" }),
+	["usedone", "usedtwo"]);
+
+check("a fallback list is parsed as a list, not as one name",
+	run({ rules: ":root{--probe-font:\"UsedOne\"}.card p{font-family:var(--probe-font,\"UsedTwo\",\"UsedThree\"),serif}", computed: { "--probe-font": "\"UsedOne\"" } }),
+	["usedone", "usedtwo", "usedthree"]);
+
+check("the font shorthand resolves a uniquely declared property",
+	run({ rules: ".card{--probe-font:\"UsedOne\"}.card p{font:italic 1em var(--probe-font)}" }),
+	["usedone"]);
+
+check("the font shorthand resolves a property written with a fallback",
+	run({ rules: ".card{--probe-font:\"UsedOne\"}.card p{font:italic 1em var(--probe-font,serif)}" }),
+	["usedone"]);
+
+// The other half of the contract: what happens when the value genuinely cannot be determined. The
+// stylesheets no longer decide there — the rendering does. The browser resolved the value when it
+// drew the page, so whatever the property named is in the list of fonts reported as used, and a
+// face absent from that list was drawn by nothing.
+//
+// It used to keep EVERY declared face, and not as a decision about uncertainty: a page naming its
+// families plainly has always dropped a face it had not drawn yet, and only a page holding one
+// value that happened not to parse was spared — the whole document, over one unreadable name. The
+// case these checks still guard is the one below them, where the rendering itself is unavailable.
+check("a property declared nowhere falls back to the fonts that were drawn",
+	run({ rules: ".card p{font-family:var(--set-by-script),serif}" }),
+	RENDERED_FAMILIES);
+
+// the shorthand cannot be substituted with several candidate values, but its var() sits in family
+// position, so the parser hands it back as the family and the union answers it there instead
+check("a font shorthand with several candidates resolves through the family",
+	run({ rules: ".card{--probe-font:\"UsedOne\"}.note{--probe-font:\"UsedTwo\"}p{font:italic 1em var(--probe-font)}" }),
+	["usedone", "usedtwo"]);
+
+// a property holding the whole shorthand is the case the union must NOT touch: its values are not
+// family lists, and reading them as such would name families the document never had
+check("a property holding a whole shorthand falls back to the fonts that were drawn",
+	run({ rules: ".card{--font:italic 1em \"UsedOne\"}.note{--font:italic 1em \"UsedTwo\"}p{font:var(--font)}" }),
+	RENDERED_FAMILIES);
+
+check("a var() nested in a fallback falls back to the fonts that were drawn",
+	run({ rules: ".card{--probe-font:\"UsedOne\"}.card p{font-family:var(--other,var(--probe-font),serif)}" }),
+	RENDERED_FAMILIES);
+
+// the check above leaves the family undetermined because the OUTER property is declared nowhere.
+// A var() written in the font-family itself is split by the AST walk, which hands each branch over
+// separately, so nesting alone was never the problem there. The chain that did give up is a var()
+// inside a property VALUE: it was read one level deep and whatever it named stayed unresolved,
+// which switched pruning off for the whole document
+check("a property whose value is another declared property resolves through it",
+	run({ rules: ".card{--first-font:var(--second-font)}.note{--second-font:\"UsedOne\"}.card p{font-family:var(--first-font),serif}" }),
+	["usedone"]);
+
+// splitting that value on every comma cut this one into "var(--second-font" and "\"UsedTwo\")",
+// two names that resolve to nothing, and the document went undetermined over a value it holds in full
+check("a value holding a var() with its own fallback is split on the top-level comma",
+	run({ rules: ".card{--first-font:var(--second-font,\"UsedTwo\"),serif}.note{--second-font:\"UsedOne\"}.card p{font-family:var(--first-font)}" }),
+	["usedone", "usedtwo"]);
+
+// two properties naming each other resolve for ever without the guard: this check hangs rather
+// than fails when it regresses
+check("a property naming itself through another one falls back to the fonts that were drawn",
+	run({ rules: ".card{--first-font:var(--second-font)}.note{--second-font:var(--first-font)}.card p{font-family:var(--first-font),serif}" }),
+	RENDERED_FAMILIES);
+
+// The rendered-fonts list is what says a declared face is really drawn, and an EMPTY one is not
+// the same answer as a short one: every rendered element has a computed font-family, so an empty
+// list means the computed styles could not be read at all. It happens for real. A frame whose
+// contentDocument is unreachable is re-parsed from its srcdoc with DOMParser
+// (processors/frame-tree/content/content-frame-tree.js), and that document is never rendered, so
+// it reports no font and the frame lost EVERY face it declared — measured on derstandard.at,
+// where the newsletter box inside such a frame fell back to a system font, and on MDN, where the
+// text in the CSS-demo frame reflowed. The families are named right there in the frame's own CSS.
+check("a document that reports no rendered font keeps every font",
+	run({ rules: ".card p{font-family:\"UsedOne\",serif}", usedFonts: [] }),
+	ALL_FAMILIES);
+
+check("a property whose value is another undetermined property falls back to the fonts that were drawn",
+	run({ rules: ".card{--probe-font:var(--set-by-script)}.card p{font-family:var(--probe-font),serif}" }),
+	RENDERED_FAMILIES);
+
+// An unquoted family name is a sequence of identifier tokens, and the walk that joins them has to
+// resume after the LAST of them. Resuming after the first pushed every word but that one again as a
+// family in its own right, so "Helvetica Neue Light" also claimed fonts named "Neue Light" and
+// "Light". It only ever kept too much, which is why it went unnoticed; a page declaring a family
+// whose name is the tail of another one paid for it.
+const TAIL_FACES = `
+	@font-face{font-family:"Helvetica Neue Light";src:url(one.woff2)}
+	@font-face{font-family:"Neue Light";src:url(two.woff2)}
+	@font-face{font-family:"Light";src:url(three.woff2)}`;
+
+const TAIL_USED_FONTS = [
+	["helvetica neue light", "400", "normal", "normal"],
+	["neue light", "400", "normal", "normal"],
+	["light", "400", "normal", "normal"]
+];
+
+check("a multi-word family name is read whole",
+	run({ faces: TAIL_FACES, usedFonts: TAIL_USED_FONTS, rules: "p{font-family:Helvetica Neue Light,serif}" }),
+	["helvetica neue light"]);
+
+check("a quoted name is still matched by its quoted declaration",
+	run({ faces: TAIL_FACES, usedFonts: TAIL_USED_FONTS, rules: "p{font-family:\"Neue Light\",serif}" }),
+	["neue light"]);
+
+// the token that ends a name is not always the comma: a string or a number ends it too, and the
+// walk used to append the token's absent `name` to the family as the text "undefined"
+check("a name is ended by a token that is not an identifier",
+	run({ faces: TAIL_FACES, usedFonts: TAIL_USED_FONTS, rules: "p{font-family:Light \"Neue Light\"}" }),
+	["neue light", "light"]);
+
+console.log(failures ? `\n${failures} check(s) FAILED` : "\nall checks passed");
+Deno.exit(failures ? 1 : 0);
+
+function run({ rules, computed, faces = FONT_FACES, usedFonts = USED_FONTS }) {
+	const stylesheet = cssTree.parse(faces + rules);
+	const options = { usedFonts };
+	const originalGetComputedStyle = globalThis.getComputedStyle;
+	if (computed) {
+		options.doc = { body: {} };
+		globalThis.getComputedStyle = () => ({ getPropertyValue: name => computed[name] || "" });
+	}
+	try {
+		removeUnusedFonts(createStubDocument(), [{ stylesheet }], [], options);
+	} finally {
+		globalThis.getComputedStyle = originalGetComputedStyle;
+	}
+	const families = [];
+	stylesheet.children.forEach(ruleData => {
+		if (ruleData.type == "Atrule" && ruleData.name == "font-face") {
+			const declaration = ruleData.block.children.filter(node => node.property == "font-family").tail;
+			families.push(cssTree.generate(declaration.data.value).replace(/^"|"$/g, "").toLowerCase());
+		}
+	});
+	return families;
+}
+
+function check(label, actual, expected) {
+	const ok = actual.length == expected.length && actual.every((family, index) => family == expected[index]);
+	if (!ok) {
+		failures++;
+	}
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual.join(", ") || "(none)"}${ok ? "" : " (expected " + expected.join(", ") + ")"}`);
+}
+
+// the module only reaches the document to borrow a <style> element for unescaping content values
+// and to read the body text, so a full DOM is not needed here
+function createStubDocument() {
+	return {
+		createElement: () => ({ textContent: "", remove() { } }),
+		body: { appendChild() { }, innerText: "" }
+	};
+}