single-file-core 1.5.126 → 1.5.127

package/core/lib/processor-helper-common.js

@@ -449,12 +449,17 @@ class ProcessorHelperCommon {
 				await this.processFontFaceRules(ruleData.block.children, sheetIndex, fontsDetails.layers.get("layer-" + sheetIndex + "-" + layerIndex + "-" + layerText), fonts, fontTests, stats);
 				layerIndex++;
 			} else if (ruleData.type == "Atrule" && ruleData.name == "font-face") {
-				const key = this.getFontKey(ruleData);
-				const fontInfo = fontsDetails.fonts.get(key);
-				if (fontInfo && fontsDetails.lastRules.get(key) == ruleData) {
-					const keptRule = await this.processFontFaceRule(ruleData, fontInfo, fonts, fontTests, stats);
-					if (!keptRule) {
+				const fontInfo = fontsDetails.fonts.get(ruleData);
+				if (fontInfo) {
+					const ruleKey = this.getFontKey(ruleData) + " " + this.getPropertyValue(ruleData, "src");
+					if (fontsDetails.emittedFonts.has(ruleKey)) {
 						removedRules.push(cssRule);
+					} else {
+						fontsDetails.emittedFonts.add(ruleKey);
+						const keptRule = await this.processFontFaceRule(ruleData, fontInfo, fonts, fontTests, stats);
+						if (!keptRule) {
+							removedRules.push(cssRule);
+						}
 					}
 				} else {
 					removedRules.push(cssRule);
@@ -486,28 +491,19 @@ class ProcessorHelperCommon {
 				layerIndex++;
 				this.getFontsDetails(doc, ruleData.block.children, sheetIndex, fontsDetails);
 			} else if (ruleData.type == "Atrule" && ruleData.name == "font-face" && ruleData.block && ruleData.block.children) {
-				const fontKey = this.getFontKey(ruleData);
-				let fontInfo = mediaFontsDetails.fonts.get(fontKey);
-				if (!fontInfo) {
-					fontInfo = [];
-					mediaFontsDetails.fonts.set(fontKey, fontInfo);
-				}
-				mediaFontsDetails.lastRules.set(fontKey, ruleData);
+				const fontInfo = [];
+				mediaFontsDetails.fonts.set(ruleData, fontInfo);
 				const src = this.getPropertyValue(ruleData, "src");
 				if (src) {
 					const fontSources = src.match(REGEXP_URL_FUNCTION);
 					if (fontSources) {
-						const ruleSources = [];
-						fontSources.forEach(source => {
+						fontSources.forEach(fontSource => {
+							const source = fontSource.match(REGEXP_FONT_SRC)[1];
 							if (fontInfo.includes(source)) {
 								fontInfo.splice(fontInfo.indexOf(source), 1);
 							}
-							if (ruleSources.includes(source)) {
-								ruleSources.splice(ruleSources.indexOf(source), 1);
-							}
-							ruleSources.unshift(source);
+							fontInfo.unshift(source);
 						});
-						ruleSources.forEach(source => fontInfo.push(source));
 					}
 				}
 			}
@@ -520,7 +516,7 @@ class ProcessorHelperCommon {
 			medias: new Map(),
 			supports: new Map(),
 			layers: new Map(),
-			lastRules: new Map()
+			emittedFonts: new Set()
 		};
 	}
 

package/doc/singlefile-archive.md

@@ -357,7 +357,7 @@ face adds, then the regions the PNG face adds.
 | `central-directory · eocd` | ZIP | always | The central-directory records followed by the End Of Central Directory record. All offsets are absolute file positions (§5.3). In the HTML+PDF variants the EOCD accounts for the injected `pdf-central-record` (how the writer achieves that is §6). |
 | `extra-data` | extractor | universal | `<sfz-extra-data>` element holding the base64, deflate-compressed recovery payload (§5.5). It always sits outside the wrapper, so it parses as a real element the extractor can address. Normal placement: after the EOCD, between the wrapper close tag and the end tags. Relocated placement, used when the payload exceeds the appended-data budget (§5.2) or `preventAppendedData` is set: immediately before the wrapper start tag. In the relocated form the element is followed by space padding: its room is reserved before the archive is written, because the region precedes the ZIP data and resizing it would shift every central-directory offset (§6). Neither placement carries positional meaning — the extractor finds the ZIP region by identifier, not relative to this element (§4.5). |
 | `</body></html>` | HTML | HTML face | The end tags closing the document after the wrapper close tag. Omitted whenever the recovery payload is relocated (§5.2), and in the PNG variants so the file can end with the PNG tail. |
-| `pdf-local-header` | ZIP | PDF face with HTML | The hand-built local file header for `page.pdf` (STORE, checksum precomputed, language encoding flag set as on every other entry — §5.8), written immediately before the PDF document so ZIP readers see an ordinary entry whose data is the PDF (§6). |
+| `pdf-local-header` | ZIP | PDF face with HTML | The hand-built local file header for `page.pdf` (STORE, checksum precomputed, language encoding flag left clear as on every other ASCII name — §5.8), written immediately before the PDF document so ZIP readers see an ordinary entry whose data is the PDF (§6). |
 | `pdf-document` | PDF | PDF face | The raw PDF bytes. With the HTML face, wrapped together with `pdf-local-header` in a wrapper tag pair inside `html-prologue`, placed so `%PDF-` starts at offset 1024 or lower — the range PDF readers search for the header, which is what lets a PDF document start after other bytes at all (§4.3). Without the HTML face and without the PNG face, the file simply *starts* with the PDF document, as prepended data the ZIP face tolerates; `page.pdf` is then not an archive entry at all — no local header, no central record. |
 | `pdf-central-record` | ZIP | PDF face with HTML | The central-directory record for `page.pdf`, injected *before* the writer's own central directory. The start of the central directory is the one place a record can be added without moving any offset the writer already committed, and it makes `page.pdf` the first entry ZIP tools list (§6). |
 | `png-signature · IHDR` | PNG | PNG face | The 8-byte PNG signature and the `IHDR` chunk declaring the source image's dimensions — the first 33 bytes of the file. |
@@ -1291,18 +1291,26 @@ How a name is encoded is ZIP's own business, not this format's: bit 11 of the ge
 purpose bit flag selects UTF-8, and its absence selects the legacy code page. This
 document adds two requirements to that and specifies nothing else about it.
 
-**A writer MUST set bit 11 on every entry**, not only on the entries whose names need
-it. The two encodings agree over printable ASCII, so setting it unconditionally costs
-nothing, and it means no name in the archive is decoded through the legacy path at all.
+**A writer MUST set bit 11 whenever a name or a comment needs it**, and the rule for
+when it does is ZIP's, not this format's: an encoded name or comment holding a byte
+outside printable ASCII needs it, one holding only printable ASCII does not, since the
+two encodings agree there. Control characters count as needing it, the legacy code page
+mapping them to graphic characters rather than to themselves. Setting it on names that
+do not need it is allowed and used to be required here; it was dropped because readers
+disagree about the flag more than they disagree about ASCII, so the safest name is the
+one that does not exercise the question. A writer MUST NOT set it on a name it then
+encodes in the legacy code page, which is the one combination that is simply wrong.
 
 **A reader MUST honor the flag** rather than assume one encoding, and MUST expect to
-meet a clear one: the hand-built `page.pdf` records (§3.1, §6) are the only ones the
-reference writer does not produce through its ZIP writer, and an archive may carry them
-with no flag set at all. That single entry is then decoded as legacy while every other
-name in the same file is UTF-8.
-Its name is ASCII, where the two encodings agree, so a correct reader sees `page.pdf`
-either way — but a reader that hardcodes UTF-8 on the strength of the other entries has
-not covered it.
+meet a clear one — which, in an archive from the reference writer, is most of them:
+that writer percent-encodes every name it produces, so every name is printable ASCII
+and carries no flag, while an entry comment holding the original URL of a resource can
+carry one when that URL is not ASCII. The hand-built `page.pdf` records (§3.1, §6) are
+the only ones the reference writer does not produce through its ZIP writer, and they
+follow the same rule: `page.pdf` is ASCII, so they carry no flag either, and no entry
+in the archive is decoded differently from the rest. Archives written before this rule
+was relaxed carry the flag on every entry instead. Both decode identically, which is
+the point, but a reader that hardcodes either answer meets the other one eventually.
 
 A name is not a path. §7.3's rule that entry names are untrusted applies to the decoded
 name, and decoding is the step before that check, not a substitute for it.
@@ -1399,7 +1407,7 @@ pages can stop at the first row; the files it produces are accepted by every rea
    wrapper start tag chosen for the PDF payload (§5.1), the hand-built `page.pdf`
    local file header, the PDF document, the wrapper end tag, and record the local
    header's absolute position; then resume the prologue. The reference writer's
-   header declares version 2.0, the language encoding flag alone, method STORE, the
+   header declares version 2.0, no general purpose bit flag, method STORE, the
    build's modification date in DOS form, the precomputed CRC-32, the document's
    length as both sizes, and no extra field; its central record adds a Unix
    "made by" version and external attributes of a regular file, mode 0644.
@@ -1892,6 +1900,7 @@ predicts.
 | August 2026 | Core 1.5.115: password-protected archives withhold the provenance comment and the canonical link as well (§5.6). Both wrote the page's own URL into the prologue, beside the title that was already withheld, so the address the archive was saved from stayed in the clear |
 | August 2026 | Core 1.5.119: the inlined ZIP library is built ASCII-only, and §2.1 now requires it of any bootstrap. Its CP437 table had been emitted as literal characters, which the page re-decoded as windows-1252, growing the table from 256 entries to 508 and shifting every lookup by 60 — so the one entry read without the UTF-8 flag, `page.pdf`, came back mangled and no archive with a PDF face extracted in any engine (§5.8) |
 | August 2026 | Core 1.5.120: the hand-built `page.pdf` records set the language encoding flag, like every entry the ZIP writer produces (§5.8). Its name is ASCII, so no decoded name changes; what changes is that no entry in an archive is read through CP437 any more, closing the path the 1.5.119 defect surfaced on |
+| September 2026 | §5.8 no longer requires bit 11 on every entry, deferring to ZIP's own rule: the flag is set when a name or a comment holds a byte outside printable ASCII, and left clear otherwise, because readers disagree about the flag more than they disagree about ASCII. The reference writer's names are all percent-encoded, so in practice none of them carries it now, and the hand-built `page.pdf` records follow the writer instead of overriding it — reversing the 1.5.120 row below, whose reason was that `page.pdf` would otherwise be the only entry read through the legacy path. It no longer is: every name in the archive takes the same path again, the other one |
 | September 2026 | Core 1.5.126: the appended-data budget becomes the `maxAppendedDataLength` writer option and its default drops from 65535 to 16361 bytes, so the EOCD record stays inside libarchive's scan and `bsdtar` opens archives it used to reject (§5.2, §8.1). The 65535-byte comment ceiling is now a separate limit, stated in §4.2: a budget raised past it produces a run that cannot be declared |
 
 This document was itself revised in August 2026, against core 1.5.108, after several

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "single-file-core",
-  "version": "1.5.126",
+  "version": "1.5.127",
   "description": "SingleFile Core",
   "author": "Gildas Lormeau",
   "license": "AGPL-3.0-or-later",
   "scripts": {
-    "test": "deno run --allow-read test/sfz-harness/format-rules.js && deno run --allow-read test/sfz-harness/stored-trigger.js && deno run --allow-read test/sfz-harness/check-determinism.js && deno run --allow-read test/sfz-harness/option-wiring.js && deno run --allow-read test/sfz-harness/css-property-filter.js && deno run --allow-read test/sfz-harness/adopted-stylesheets-hook.js && deno run --allow-read test/sfz-harness/css-fonts-minifier.js && deno run --allow-read test/sfz-harness/inlined-functions.js && deno run --allow-read test/sfz-harness/pages-archive.js && deno run --allow-read test/sfz-harness/filename-max-length.js && deno run --allow-read test/sfz-harness/entry-compression.js && deno run --allow-read test/sfz-harness/filename-characters.js && deno run --allow-read test/sfz-harness/byte-map.js && deno run --allow-read test/sfz-harness/zip64.js && deno run --allow-read test/sfz-harness/charset-round-trip.js",
+    "test": "deno run --allow-read test/sfz-harness/format-rules.js && deno run --allow-read test/sfz-harness/stored-trigger.js && deno run --allow-read test/sfz-harness/check-determinism.js && deno run --allow-read test/sfz-harness/option-wiring.js && deno run --allow-read test/sfz-harness/css-property-filter.js && deno run --allow-read test/sfz-harness/adopted-stylesheets-hook.js && deno run --allow-read test/sfz-harness/css-fonts-minifier.js && deno run --allow-read test/sfz-harness/font-face-composite.js && deno run --allow-read test/sfz-harness/inlined-functions.js && deno run --allow-read test/sfz-harness/pages-archive.js && deno run --allow-read test/sfz-harness/filename-max-length.js && deno run --allow-read test/sfz-harness/entry-compression.js && deno run --allow-read test/sfz-harness/filename-characters.js && deno run --allow-read test/sfz-harness/byte-map.js && deno run --allow-read test/sfz-harness/zip64.js && deno run --allow-read test/sfz-harness/charset-round-trip.js",
     "bump-patch": "npm version patch --no-git-tag-version && npm run bump-commit",
     "bump-minor": "npm version minor --no-git-tag-version && npm run bump-commit",
     "bump-major": "npm version major --no-git-tag-version && npm run bump-commit",

package/processors/compression/compression-packager.js

@@ -100,16 +100,12 @@ async function createPagesArchive(pages, options) {
 			const zipReader = new ZipReader(new Uint8ArrayReader(await pages[pageIndex].getData()));
 			for (const entry of await zipReader.getEntries()) {
 				const filename = pagePath + entry.filename;
-				const rawData = await entry.getData(new Uint8ArrayWriter(), { passThrough: true, checkCrc32: false });
+				const rawData = entry.directory ? undefined : await entry.getData(new Uint8ArrayWriter(), { passThrough: true, checkCrc32: false });
 				const canonicalFilename = writtenEntries && findDuplicate(writtenEntries, filename, entry, rawData);
 				if (canonicalFilename === undefined) {
-					await zipWriter.add(filename, new Uint8ArrayReader(rawData), {
+					await zipWriter.add(filename, entry.directory ? null : new Uint8ArrayReader(rawData), {
 						passThrough: true,
-						compressionMethod: entry.compressionMethod,
-						uncompressedSize: entry.uncompressedSize,
-						crc32: entry.crc32,
-						comment: entry.comment,
-						lastModDate: entry.lastModDate
+						entry
 					});
 				} else {
 					aliases[filename] = canonicalFilename;

package/processors/compression/compression.js

@@ -40,9 +40,7 @@ import {
 	router
 } from "./compression-router.js";
 
-const { Blob, fetch, TextEncoder, TextDecoder, DOMParser } = globalThis;
-
-const TEXT_DECODER = new TextDecoder("windows-1252");
+const { Blob, fetch, TextEncoder, DOMParser } = globalThis;
 
 const COMPRESSIBLE_CONTENT_TYPES = ["application/javascript", "application/x-javascript", "application/ecmascript", "application/json", "application/ld+json", "application/manifest+json", "application/xml", "application/xhtml+xml", "application/rss+xml", "application/atom+xml", "image/svg+xml"];
 const TEXT_CONTENT_TYPE_PREFIX = "text/";
@@ -63,19 +61,20 @@ const EMBEDDED_DATA_TAGS = [
 	...EXTRA_DATA_TAGS,
 ];
 const DATA_IDENTIFIER = "sfz-data";
-const EXTRA_DATA_REGEXPS = [
-	[/<script/i, /<\/script[\t\n\f\r />]/i],
-	[/<style/i, /<\/style[\t\n\f\r />]/i],
-	[/<noframes/i, /<\/noframes[\t\n\f\r />]/i],
-	[/<noembed/i, /<\/noembed[\t\n\f\r />]/i],
-	[/<iframe/i, /<\/iframe[\t\n\f\r />]/i],
-	[/<xmp/i, /<\/xmp[\t\n\f\r />]/i],
-	[/<!\[CDATA\[/i, /\]\]>/],
-	[/<plaintext/i, /<\/plaintext[\t\n\f\r />]/i]
+const TAG_NAME_TERMINATORS = "\t\n\f\r />";
+const EXTRA_DATA_PATTERNS = [
+	[["<script"], ["</script", TAG_NAME_TERMINATORS]],
+	[["<style"], ["</style", TAG_NAME_TERMINATORS]],
+	[["<noframes"], ["</noframes", TAG_NAME_TERMINATORS]],
+	[["<noembed"], ["</noembed", TAG_NAME_TERMINATORS]],
+	[["<iframe"], ["</iframe", TAG_NAME_TERMINATORS]],
+	[["<xmp"], ["</xmp", TAG_NAME_TERMINATORS]],
+	[["<![CDATA["], ["]]>"]],
+	[["<plaintext"], ["</plaintext", TAG_NAME_TERMINATORS]]
 ];
-const EMBEDDED_DATA_REGEXPS = [
-	[/<!--/i, /--!?>|<!-$/i],
-	...EXTRA_DATA_REGEXPS,
+const EMBEDDED_DATA_PATTERNS = [
+	[["<!--"], ["-->"], ["--!>"], ["<!-", undefined, true]],
+	...EXTRA_DATA_PATTERNS,
 ];
 const CRC32_TABLE = new Uint32Array(256).map((_, indexTable) => {
 	let crc = indexTable;
@@ -106,7 +105,6 @@ const CENTRAL_FILE_HEADER_SIGNATURE = 0x02014b50;
 const END_OF_CENTRAL_DIR_SIGNATURE = 0x06054b50;
 const ZIP64_END_OF_CENTRAL_DIR_SIGNATURE = 0x06064b50;
 const ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE = 0x07064b50;
-const LANGUAGE_ENCODING_FLAG = 0x0800;
 
 const browser = globalThis.browser;
 
@@ -229,18 +227,14 @@ async function buildArchive(pageData, options, script, entriesData, zipWriterOpt
 		const lfCodes = [];
 		let crc32 = -1;
 		if (!options.extractDataFromPageTags || options.extractDataFromPageTags[0] != "<plaintext>") {
-			const textContent = TEXT_DECODER.decode(data.subarray(startOffset));
+			const zipData = data.subarray(startOffset);
 			if (options.extractDataFromPageTags) {
 				const tagIndex = getExtraDataTagIndex(options.extractDataFromPageTags);
-				const regExpsTag = EXTRA_DATA_REGEXPS[tagIndex];
-				if (textContent.match(regExpsTag[0]) || textContent.match(regExpsTag[1])) {
-					return findExtraDataTags(textContent, pageData, options, script, entriesData, zipWriterOptions, tagIndex + 1);
-				}
-			} else {
-				const [startRegExp, endRegExp] = EMBEDDED_DATA_REGEXPS[0];
-				if (textContent.match(startRegExp) || textContent.match(endRegExp)) {
-					return findExtraDataTags(textContent, pageData, options, script, entriesData, zipWriterOptions);
+				if (containsDataPattern(zipData, EXTRA_DATA_PATTERNS[tagIndex])) {
+					return findExtraDataTags(zipData, pageData, options, script, entriesData, zipWriterOptions, tagIndex + 1);
 				}
+			} else if (containsDataPattern(zipData, EMBEDDED_DATA_PATTERNS[0])) {
+				return findExtraDataTags(zipData, pageData, options, script, entriesData, zipWriterOptions);
 			}
 		}
 		if (options.extractDataFromPage) {
@@ -337,9 +331,7 @@ function isDeclaredLengthHidden(pageContent, zipDataEnd, appendedDataLength, opt
 	const tail = pageContent.slice(zipDataEnd - WRAPPER_PATTERN_WINDOW_LENGTH, zipDataEnd + COMMENT_LENGTH_FIELD_LENGTH);
 	new DataView(tail.buffer).setUint16(WRAPPER_PATTERN_WINDOW_LENGTH, appendedDataLength, true);
 	const tagIndex = options.extractDataFromPageTags ? getExtraDataTagIndex(options.extractDataFromPageTags) + 1 : 0;
-	const [startRegExp, endRegExp] = EMBEDDED_DATA_REGEXPS[tagIndex];
-	const tailText = TEXT_DECODER.decode(tail);
-	return !tailText.match(startRegExp) && !tailText.match(endRegExp);
+	return !containsDataPattern(tail, EMBEDDED_DATA_PATTERNS[tagIndex]);
 }
 
 function getCRC32(data, indexData = 0) {
@@ -365,7 +357,6 @@ function getPDFEntry(embeddedPdf, lastModDate = new Date()) {
 	const localHeaderView = new DataView(localHeader.buffer);
 	localHeaderView.setUint32(0, LOCAL_FILE_HEADER_SIGNATURE, true);
 	localHeaderView.setUint16(4, 20, true);
-	localHeaderView.setUint16(6, LANGUAGE_ENCODING_FLAG, true);
 	localHeaderView.setUint16(10, dosTime, true);
 	localHeaderView.setUint16(12, dosDate, true);
 	localHeaderView.setUint32(14, crc32, true);
@@ -378,7 +369,6 @@ function getPDFEntry(embeddedPdf, lastModDate = new Date()) {
 	centralRecordView.setUint32(0, CENTRAL_FILE_HEADER_SIGNATURE, true);
 	centralRecordView.setUint16(4, 0x0300, true);
 	centralRecordView.setUint16(6, 20, true);
-	centralRecordView.setUint16(8, LANGUAGE_ENCODING_FLAG, true);
 	centralRecordView.setUint16(12, dosTime, true);
 	centralRecordView.setUint16(14, dosDate, true);
 	centralRecordView.setUint32(16, crc32, true);
@@ -552,8 +542,7 @@ function getStartHTMLArray(pageData, options, lastModDate, startTag = "") {
 		const embeddedPdf = new Uint8Array(options.embeddedPdf);
 		pdfEntry = options.preventEmbeddedPdfEntry ? undefined : getPDFEntry(embeddedPdf, lastModDate);
 		const localHeader = pdfEntry ? pdfEntry.localHeader : new Uint8Array(0);
-		const embeddedPdfText = TEXT_DECODER.decode(localHeader) + TEXT_DECODER.decode(embeddedPdf);
-		const pdfTagIndex = findEmbeddedDataTagIndex(embeddedPdfText);
+		const pdfTagIndex = findEmbeddedDataTagIndex(concatArrays(localHeader, embeddedPdf));
 		if (pdfTagIndex == -1) {
 			dropUnhiddenFace(options, "embeddedPdf", EMBEDDED_PDF_LABEL);
 			pdfEntry = undefined;
@@ -629,12 +618,11 @@ function getExtraDataTagIndex(extractDataFromPageTags) {
 	return tagIndex;
 }
 
-function findExtraDataTags(textContent, pageData, options, script, entriesData, zipWriterOptions, indexExtractDataFromPageTags = 0) {
-	const regExpsTag = EXTRA_DATA_REGEXPS[indexExtractDataFromPageTags];
+function findExtraDataTags(zipData, pageData, options, script, entriesData, zipWriterOptions, indexExtractDataFromPageTags = 0) {
 	const plaintextTag = EXTRA_DATA_TAGS[indexExtractDataFromPageTags][0] == "<plaintext>";
-	const matchTag = !plaintextTag && (textContent.match(regExpsTag[0]) || textContent.match(regExpsTag[1]));
+	const matchTag = !plaintextTag && containsDataPattern(zipData, EXTRA_DATA_PATTERNS[indexExtractDataFromPageTags]);
 	if (matchTag) {
-		return findExtraDataTags(textContent, pageData, options, script, entriesData, zipWriterOptions, indexExtractDataFromPageTags + 1);
+		return findExtraDataTags(zipData, pageData, options, script, entriesData, zipWriterOptions, indexExtractDataFromPageTags + 1);
 	} else {
 		options.extractDataFromPageTags = EXTRA_DATA_TAGS[indexExtractDataFromPageTags];
 		if (options.extractDataFromPageTags[0] == "<plaintext>") {
@@ -644,24 +632,93 @@ function findExtraDataTags(textContent, pageData, options, script, entriesData,
 	}
 }
 
-function findEmbeddedDataTagIndex(text, fromIndex = 0) {
-	const tagIndex = EMBEDDED_DATA_REGEXPS.slice(fromIndex, -1).findIndex(([startRegExp, endRegExp]) => !text.match(startRegExp) && !text.match(endRegExp));
+function findEmbeddedDataTagIndex(data, fromIndex = 0) {
+	const tagIndex = EMBEDDED_DATA_PATTERNS.slice(fromIndex, -1).findIndex(patterns => !containsDataPattern(data, patterns));
 	return tagIndex == -1 ? -1 : tagIndex + fromIndex;
 }
 
+function containsDataPattern(data, patterns) {
+	const patternsByCharCode = new Map();
+	for (const pattern of patterns) {
+		const [text, , atEnd] = pattern;
+		if (atEnd) {
+			if (matchesDataPatternAt(data, pattern, data.length - text.length)) {
+				return true;
+			}
+		} else {
+			const charCode = text.charCodeAt(0);
+			indexPatternByCharCode(patternsByCharCode, charCode, pattern);
+			const alternateCharCode = getAlternateCharCode(charCode);
+			if (alternateCharCode != -1) {
+				indexPatternByCharCode(patternsByCharCode, alternateCharCode, pattern);
+			}
+		}
+	}
+	for (const [charCode, candidates] of patternsByCharCode) {
+		for (let index = data.indexOf(charCode); index != -1; index = data.indexOf(charCode, index + 1)) {
+			for (let indexCandidate = 0; indexCandidate < candidates.length; indexCandidate++) {
+				if (matchesDataPatternAt(data, candidates[indexCandidate], index)) {
+					return true;
+				}
+			}
+		}
+	}
+	return false;
+}
+
+function indexPatternByCharCode(patternsByCharCode, charCode, pattern) {
+	if (!patternsByCharCode.has(charCode)) {
+		patternsByCharCode.set(charCode, []);
+	}
+	patternsByCharCode.get(charCode).push(pattern);
+}
+
+function matchesDataPatternAt(data, [text, terminators], index) {
+	const textLength = text.length;
+	if (index < 0 || index + textLength > data.length) {
+		return false;
+	}
+	for (let indexText = 0; indexText < textLength; indexText++) {
+		const charCode = text.charCodeAt(indexText);
+		const code = data[index + indexText];
+		if (code != charCode && code != getAlternateCharCode(charCode)) {
+			return false;
+		}
+	}
+	return terminators === undefined || isTerminatorCode(terminators, data[index + textLength]);
+}
+
+function isTerminatorCode(terminators, code) {
+	return code !== undefined && terminators.includes(String.fromCharCode(code));
+}
+
+function getAlternateCharCode(charCode) {
+	const lowerCharCode = charCode | 0x20;
+	return lowerCharCode >= 0x61 && lowerCharCode <= 0x7a ? charCode ^ 0x20 : -1;
+}
+
+function concatArrays(...arrays) {
+	const result = new Uint8Array(arrays.reduce((length, array) => length + array.length, 0));
+	let offset = 0;
+	arrays.forEach(array => {
+		result.set(array, offset);
+		offset += array.length;
+	});
+	return result;
+}
+
 function getImageHTMLChunk(pageData, options, lastModDate) {
-	const embeddedImageText = TEXT_DECODER.decode(getEmbeddedImageData(options.embeddedImage)) +
-		TEXT_DECODER.decode(new Uint8Array(4)) + TEXT_DECODER.decode(PNG_ZIP_CHUNK_TYPE_KEYWORD);
-	let tagIndex = findEmbeddedDataTagIndex(embeddedImageText);
+	const embeddedImageData = concatArrays(getEmbeddedImageData(options.embeddedImage), new Uint8Array(4), PNG_ZIP_CHUNK_TYPE_KEYWORD);
+	let tagIndex = findEmbeddedDataTagIndex(embeddedImageData);
 	while (tagIndex != -1) {
 		const [startTag, endTag] = EMBEDDED_DATA_TAGS[tagIndex];
 		const startHTMLData = getStartHTMLArray(pageData, options, lastModDate, startTag);
 		const htmlData = new Uint8Array([...getLength(startHTMLData.htmlArray.length + 4), ...[0x74, 0x45, 0x58, 0x74, 0x50, 0x4e, 0x47, 0], ...startHTMLData.htmlArray]);
 		const htmlDataCRC = getCRC32(htmlData, 4);
-		const wrappedText = TEXT_DECODER.decode(htmlDataCRC) + embeddedImageText;
+		const wrappedData = concatArrays(htmlDataCRC, embeddedImageData);
 		if ((tagIndex == 0 && (htmlDataCRC[0] == 0x3e || (htmlDataCRC[0] == 0x2d && htmlDataCRC[1] == 0x3e))) ||
-			findEmbeddedDataTagIndex(wrappedText, tagIndex) != tagIndex) {
-			tagIndex = findEmbeddedDataTagIndex(embeddedImageText, tagIndex + 1);
+			findEmbeddedDataTagIndex(wrappedData, tagIndex) != tagIndex) {
+			tagIndex = findEmbeddedDataTagIndex(embeddedImageData, tagIndex + 1);
 		} else {
 			return { endTag, startHTMLData, htmlData, htmlDataCRC };
 		}

package/test/sfz-harness/font-face-composite.js

@@ -0,0 +1,135 @@
+// Several @font-face rules that declare the same family with the same style descriptors are one
+// composite face, not a stack where the last rule wins. CSS Fonts 4 §5.2: "When the matched face is
+// a composite face, user agents must use the procedure above on each of the faces in the composite
+// face in reverse order of @font-face rule definition", selecting a face only "if the effective
+// character map supports the character in question". §4.5.1 says the same for the case where the
+// ranges are identical rather than merely overlapping: "If the unicode ranges overlap for a set of
+// @font-face rules with the same family and style descriptor values, the rules are ordered in the
+// reverse order they were defined; the last rule defined is the first to be checked for a given
+// character." So the later rule wins per character, and a character it has no glyph for falls back
+// to the earlier rule of the same family.
+//
+// Dropping the earlier rule therefore loses glyphs. science.org declares icomoon twice, weight 400
+// style normal in both, first a 103-codepoint icon set and then a 30-codepoint one holding only the
+// slideshow arrows. The banner close button is content:"\e928", which lives in the first font only,
+// so keeping the last rule alone rendered a tofu box reading "E9 28" where the X had been.
+//
+// Pooling the sources of every rule sharing a key breaks it the same way even when both rules are
+// kept: one winning source gets written into all of them, so both rules end up naming the same font
+// and the other one is gone just as surely. Each rule keeps its own sources.
+//
+// Rules that are duplicates outright, same key and same src, are still emitted once: they are the
+// same member of the composite declared twice, so dropping one changes nothing.
+import * as cssTree from "../../vendor/css-tree.js";
+
+// helper.js reaches the frame hooks, which install themselves against window and document as they
+// are evaluated: the stubs go in before the dynamic import
+globalThis.window = globalThis;
+globalThis.document = {};
+globalThis.Document = class Document { };
+globalThis.MutationObserver = class MutationObserver { observe() { } };
+const { getProcessorHelperCommonClass } = await import("../../core/lib/processor-helper-common.js");
+
+const ProcessorHelperCommon = getProcessorHelperCommonClass({}, cssTree);
+
+// the real subclasses pick one source out of the list and rewrite the rule with it; the contract
+// under test is which rules survive and which sources each one is handed, so this records that and
+// keeps every rule
+class TestProcessorHelper extends ProcessorHelperCommon {
+	constructor() {
+		super();
+		this.processedRules = [];
+	}
+	async processFontFaceRule(ruleData, fontInfo) {
+		this.processedRules.push({
+			family: this.getPropertyValue(ruleData, "font-family"),
+			sources: fontInfo.map(source => source.src)
+		});
+		return true;
+	}
+}
+
+async function run(css) {
+	const helper = new TestProcessorHelper();
+	const stylesheets = new Map([[0, { stylesheet: cssTree.parse(css) }]]);
+	await helper.removeAlternativeFonts({}, stylesheets, new Map(), new Map());
+	const remaining = [];
+	stylesheets.get(0).stylesheet.children.forEach(ruleData => {
+		if (ruleData.type == "Atrule" && ruleData.name == "font-face") {
+			remaining.push(helper.getPropertyValue(ruleData, "src"));
+		}
+	});
+	return { processed: helper.processedRules, remaining };
+}
+
+let failures = 0;
+
+// a rule that was dropped when it should have been kept leaves a hole in the list, and reporting
+// that as a failed comparison is more use than throwing on the way to the assertion
+function sourcesOf(processedRules, index) {
+	const rule = processedRules[index];
+	return rule ? rule.sources : null;
+}
+
+function check(label, actual, expected) {
+	const pass = JSON.stringify(actual) == JSON.stringify(expected);
+	console.log((pass ? "PASS " : "FAIL ") + label + ": " + JSON.stringify(actual));
+	if (!pass) {
+		console.log("     expected: " + JSON.stringify(expected));
+		failures++;
+	}
+}
+
+const TWO_FACES = `
+	@font-face{font-family:icomoon;src:url(big.ttf) format("truetype"),url(big.woff) format("woff");font-weight:400;font-style:normal}
+	@font-face{font-family:icomoon;src:url(small.ttf) format("truetype"),url(small.woff) format("woff");font-weight:400;font-style:normal}`;
+
+const two = await run(TWO_FACES);
+check("both members of the composite face are kept", two.processed.length, 2);
+check("the earlier rule keeps its own sources", sourcesOf(two.processed, 0).sort(), ["url(big.ttf)format(\"truetype\")", "url(big.woff)format(\"woff\")"]);
+check("the later rule keeps its own sources", (sourcesOf(two.processed, 1) || []).sort(), ["url(small.ttf)format(\"truetype\")", "url(small.woff)format(\"woff\")"]);
+check("neither rule is removed from the stylesheet", two.remaining.length, 2);
+
+const DUPLICATE = `
+	@font-face{font-family:icomoon;src:url(one.woff) format("woff");font-weight:400;font-style:normal}
+	@font-face{font-family:icomoon;src:url(one.woff) format("woff");font-weight:400;font-style:normal}`;
+
+const duplicate = await run(DUPLICATE);
+check("an outright duplicate rule is emitted once", duplicate.processed.length, 1);
+check("the duplicate is removed from the stylesheet", duplicate.remaining.length, 1);
+
+// unicode-range is part of the font key, so the subsetting idiom was never affected by the
+// shadowing bug; it is pinned here because the fix moved what the key is used for
+const RANGES = `
+	@font-face{font-family:sub;src:url(latin.woff2) format("woff2");unicode-range:U+0-7F}
+	@font-face{font-family:sub;src:url(greek.woff2) format("woff2");unicode-range:U+370-3FF}`;
+
+const ranges = await run(RANGES);
+check("faces split by unicode-range are all kept", ranges.processed.length, 2);
+check("each range keeps its own source", ranges.processed.map(rule => rule.sources), [["url(latin.woff2)format(\"woff2\")"], ["url(greek.woff2)format(\"woff2\")"]]);
+
+// a rule declaring the same source twice contributes it once, in the position its later declaration
+// gives it. The sources are compared after the separating comma is stripped, so a repeat is
+// recognised wherever it sits: the value is split by a regexp that keeps that comma, and comparing
+// the raw pieces made the last source in a list unequal to the same source anywhere before it
+const REPEATED = `
+	@font-face{font-family:repeat;src:url(a.woff) format("woff"),url(b.woff) format("woff"),url(a.woff) format("woff"),url(c.woff) format("woff");font-weight:400}`;
+
+const repeated = await run(REPEATED);
+check("a source repeated inside one rule is listed once", (sourcesOf(repeated.processed, 0) || []).length, 3);
+
+const REPEATED_LAST = `
+	@font-face{font-family:repeat;src:url(a.woff) format("woff"),url(b.woff) format("woff"),url(a.woff) format("woff");font-weight:400}`;
+
+const repeatedLast = await run(REPEATED_LAST);
+check("a repeat in last position is recognised too", (sourcesOf(repeatedLast.processed, 0) || []).length, 2);
+// the list is held in reverse of the order it is written back in, so the entry the rule declares
+// last comes first here: a.woff keeps the position its second declaration gives it
+check("the repeat keeps the position of its later declaration", sourcesOf(repeatedLast.processed, 0), ["url(a.woff)format(\"woff\")", "url(b.woff)format(\"woff\")"]);
+
+if (failures) {
+	console.log("\n" + failures + " check(s) failed");
+	Deno.exit(1);
+} else {
+	console.log("\nall checks passed");
+}

package/test/sfz-harness/format-rules.js

@@ -432,9 +432,13 @@ const ALL_FACE_RUNGS = "<!--sfz-data<script<style<noframes<noembed<iframe<xmp<![
 	check("no page.pdf entry is left behind", entries.some(entry => entry.filename.endsWith("page.pdf")), false);
 }
 
-// page.pdf is the only record the writer builds by hand, so it is the only place the
-// language encoding flag can go missing: without it a reader decodes that one name
-// through CP437 while reading every other name in the same archive as UTF-8
+// page.pdf is the only record the writer builds by hand, so it is the only place the language
+// encoding flag can disagree with the rest of the archive, and a reader would then decode that one
+// name through a different path than every other name in the same file. Which way the flag goes is
+// the ZIP writer's business, not this format's: it sets bit 11 only when a name or a comment holds
+// a byte outside printable ASCII, so every name in this fixture is flagless. What is asserted here
+// is the agreement, so this still fails if the hand-built record diverges and still passes if the
+// writer changes its rule again
 {
 	const options = makeOptions({ embeddedPdf: PDF });
 	const pageData = makePageData(23, 4 * 1024);
@@ -443,11 +447,14 @@ const ALL_FACE_RUNGS = "<!--sfz-data<script<style<noframes<noembed<iframe<xmp<![
 	const zipReader = new ZipReader(new BlobReader(new Blob([bytes])));
 	const entries = await zipReader.getEntries();
 	await zipReader.close();
-	check("the pdf entry is listed", entries.some(entry => entry.filename == "page.pdf"), true);
-	check("every central record declares utf-8 names", entries.every(entry => entry.filenameUTF8), true);
+	const pdfEntry = entries.find(entry => entry.filename == "page.pdf");
+	check("the pdf entry is listed", Boolean(pdfEntry), true);
+	check("the hand-built central record declares its name like the records the writer produces",
+		entries.every(entry => Boolean(entry.filenameUTF8) == Boolean(pdfEntry.filenameUTF8)), true);
 	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-	const localFlags = entries.map(entry => view.getUint16(entry.offset + 6, true));
-	check("every local header declares utf-8 names", localFlags.every(flags => Boolean(flags & 0x0800)), true);
+	const localFlags = new Map(entries.map(entry => [entry.filename, view.getUint16(entry.offset + 6, true) & 0x0800]));
+	check("the hand-built local header declares its name like the headers the writer produces",
+		[...localFlags.values()].every(flag => flag == localFlags.get("page.pdf")), true);
 }
 
 {