single-file-core 1.5.126 → 1.5.128

package/test/sfz-harness/content-type-sniffing.js

@@ -0,0 +1,83 @@
+// `core/util.js` used to trust any Content-Type the server sent and sniff the bytes only when the
+// header was missing or `application/octet-stream`. science.org serves its woff2 files as
+// `text/plain;charset=UTF-8` — 12 of them — and every one was embedded as `data:text/plain`, which
+// costs twice: a browser with no `format()` hint in the `@font-face` rule has nothing left to
+// identify the font by, and the SFZ writer deflates a file that is already Brotli-compressed
+// because it decides compression from the content type.
+//
+// The rule now: a magic-byte match wins over the header, and the header is kept only when nothing
+// matches. That raises the bar for the sniffer's own rules, which is why `video/mp2t` no longer
+// matches on a single `0x47` byte — as a last resort behind a missing header that was tolerable,
+// as an override of a correct header it would relabel any video whose first byte is `G`. It now
+// wants the sync byte at the 188-byte packet stride, and the case below is the regression guard.
+/* global Response */
+
+import "./dom-stub.js";
+// util.js pulls in the page-world hooks, which register a document listener as they are evaluated.
+// None of it is exercised here; the stubs exist so that importing util.js is possible at all
+globalThis.window = globalThis.window || {};
+globalThis.document = globalThis.document || {};
+globalThis.Document = globalThis.Document || class { };
+globalThis.MutationObserver = globalThis.MutationObserver || class {
+	observe() { }
+};
+const { getInstance } = await import("./../../core/util.js");
+
+const FONT_URL = "https://example.com/font";
+const WOFF2 = bytes([0x77, 0x4F, 0x46, 0x32], 64);
+const PNG = bytes([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A], 64);
+const AVIF = bytes([0, 0, 0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x61, 0x76, 0x69, 0x66], 64);
+const WEBP2 = bytes([0x77, 0x70, 0x32, 0x20], 64);
+const HEIF_MIF1 = bytes([0, 0, 0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x6D, 0x69, 0x66, 0x31], 64);
+const NOT_A_TRANSPORT_STREAM = bytes([0x47, 0x53, 0x54, 0x00], 512);
+
+let failed = false;
+
+// [label, bytes, expectedType, the Content-Type the server sent, the type that must reach the data URI]
+const CASES = [
+	["a woff2 served as text/plain is embedded as font/woff2", WOFF2, "font", "text/plain;charset=UTF-8", "font/woff2"],
+	["a woff2 served as font/woff2 is unchanged", WOFF2, "font", "font/woff2", "font/woff2"],
+	["a woff2 served with no type at all is embedded as font/woff2", WOFF2, "font", undefined, "font/woff2"],
+	["a png served as text/plain is embedded as image/png", PNG, "image", "text/plain", "image/png"],
+	["an avif served as application/octet-stream is embedded as image/avif", AVIF, "image", "application/octet-stream", "image/avif"],
+	// "mif1" is the generic HEIF brand and an AVIF may carry it too, so it identifies nothing on
+	// its own: claiming HEIC here would relabel an AVIF as a format no browser decodes
+	["an ambiguous HEIF brand keeps the type the server sent", HEIF_MIF1, "image", "image/avif", "image/avif"],
+	// nothing matches these bytes, so the header is all there is and it has to survive
+	["a format the sniffer does not know keeps the type the server sent", WEBP2, "image", "image/webp2", "image/webp2"],
+	["a format the sniffer does not know and no type falls back to octet-stream", WEBP2, "image", undefined, "application/octet-stream"],
+	// the byte is 0x47, the packet stride is not, so this is not a transport stream
+	["a video starting with G is not relabelled as mp2t", NOT_A_TRANSPORT_STREAM, "video", "video/quicktime", "video/quicktime"]
+];
+
+for (const [label, data, expectedType, sentContentType, expectedContentType] of CASES) {
+	const { data: dataURI } = await fetchContent(data, expectedType, sentContentType);
+	check(label, readDataURIType(dataURI), expectedContentType);
+}
+
+console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
+Deno.exit(failed ? 1 : 0);
+
+function fetchContent(data, expectedType, contentType) {
+	const util = getInstance({
+		fetch: async () => new Response(data, { headers: contentType ? { "content-type": contentType } : {} })
+	});
+	return util.getContent(FONT_URL, { asBinary: true, inline: true, expectedType });
+}
+
+function readDataURIType(dataURI) {
+	const indexSeparator = dataURI.indexOf(";");
+	return dataURI.substring("data:".length, indexSeparator == -1 ? dataURI.indexOf(",") : indexSeparator);
+}
+
+function bytes(signature, length) {
+	const value = new Uint8Array(length);
+	value.set(signature);
+	return value;
+}
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/sfz-harness/font-face-composite.js

@@ -0,0 +1,135 @@
+// Several @font-face rules that declare the same family with the same style descriptors are one
+// composite face, not a stack where the last rule wins. CSS Fonts 4 §5.2: "When the matched face is
+// a composite face, user agents must use the procedure above on each of the faces in the composite
+// face in reverse order of @font-face rule definition", selecting a face only "if the effective
+// character map supports the character in question". §4.5.1 says the same for the case where the
+// ranges are identical rather than merely overlapping: "If the unicode ranges overlap for a set of
+// @font-face rules with the same family and style descriptor values, the rules are ordered in the
+// reverse order they were defined; the last rule defined is the first to be checked for a given
+// character." So the later rule wins per character, and a character it has no glyph for falls back
+// to the earlier rule of the same family.
+//
+// Dropping the earlier rule therefore loses glyphs. science.org declares icomoon twice, weight 400
+// style normal in both, first a 103-codepoint icon set and then a 30-codepoint one holding only the
+// slideshow arrows. The banner close button is content:"\e928", which lives in the first font only,
+// so keeping the last rule alone rendered a tofu box reading "E9 28" where the X had been.
+//
+// Pooling the sources of every rule sharing a key breaks it the same way even when both rules are
+// kept: one winning source gets written into all of them, so both rules end up naming the same font
+// and the other one is gone just as surely. Each rule keeps its own sources.
+//
+// Rules that are duplicates outright, same key and same src, are still emitted once: they are the
+// same member of the composite declared twice, so dropping one changes nothing.
+import * as cssTree from "../../vendor/css-tree.js";
+
+// helper.js reaches the frame hooks, which install themselves against window and document as they
+// are evaluated: the stubs go in before the dynamic import
+globalThis.window = globalThis;
+globalThis.document = {};
+globalThis.Document = class Document { };
+globalThis.MutationObserver = class MutationObserver { observe() { } };
+const { getProcessorHelperCommonClass } = await import("../../core/lib/processor-helper-common.js");
+
+const ProcessorHelperCommon = getProcessorHelperCommonClass({}, cssTree);
+
+// the real subclasses pick one source out of the list and rewrite the rule with it; the contract
+// under test is which rules survive and which sources each one is handed, so this records that and
+// keeps every rule
+class TestProcessorHelper extends ProcessorHelperCommon {
+	constructor() {
+		super();
+		this.processedRules = [];
+	}
+	async processFontFaceRule(ruleData, fontInfo) {
+		this.processedRules.push({
+			family: this.getPropertyValue(ruleData, "font-family"),
+			sources: fontInfo.map(source => source.src)
+		});
+		return true;
+	}
+}
+
+async function run(css) {
+	const helper = new TestProcessorHelper();
+	const stylesheets = new Map([[0, { stylesheet: cssTree.parse(css) }]]);
+	await helper.removeAlternativeFonts({}, stylesheets, new Map(), new Map());
+	const remaining = [];
+	stylesheets.get(0).stylesheet.children.forEach(ruleData => {
+		if (ruleData.type == "Atrule" && ruleData.name == "font-face") {
+			remaining.push(helper.getPropertyValue(ruleData, "src"));
+		}
+	});
+	return { processed: helper.processedRules, remaining };
+}
+
+let failures = 0;
+
+// a rule that was dropped when it should have been kept leaves a hole in the list, and reporting
+// that as a failed comparison is more use than throwing on the way to the assertion
+function sourcesOf(processedRules, index) {
+	const rule = processedRules[index];
+	return rule ? rule.sources : null;
+}
+
+function check(label, actual, expected) {
+	const pass = JSON.stringify(actual) == JSON.stringify(expected);
+	console.log((pass ? "PASS " : "FAIL ") + label + ": " + JSON.stringify(actual));
+	if (!pass) {
+		console.log("     expected: " + JSON.stringify(expected));
+		failures++;
+	}
+}
+
+const TWO_FACES = `
+	@font-face{font-family:icomoon;src:url(big.ttf) format("truetype"),url(big.woff) format("woff");font-weight:400;font-style:normal}
+	@font-face{font-family:icomoon;src:url(small.ttf) format("truetype"),url(small.woff) format("woff");font-weight:400;font-style:normal}`;
+
+const two = await run(TWO_FACES);
+check("both members of the composite face are kept", two.processed.length, 2);
+check("the earlier rule keeps its own sources", sourcesOf(two.processed, 0).sort(), ["url(big.ttf)format(\"truetype\")", "url(big.woff)format(\"woff\")"]);
+check("the later rule keeps its own sources", (sourcesOf(two.processed, 1) || []).sort(), ["url(small.ttf)format(\"truetype\")", "url(small.woff)format(\"woff\")"]);
+check("neither rule is removed from the stylesheet", two.remaining.length, 2);
+
+const DUPLICATE = `
+	@font-face{font-family:icomoon;src:url(one.woff) format("woff");font-weight:400;font-style:normal}
+	@font-face{font-family:icomoon;src:url(one.woff) format("woff");font-weight:400;font-style:normal}`;
+
+const duplicate = await run(DUPLICATE);
+check("an outright duplicate rule is emitted once", duplicate.processed.length, 1);
+check("the duplicate is removed from the stylesheet", duplicate.remaining.length, 1);
+
+// unicode-range is part of the font key, so the subsetting idiom was never affected by the
+// shadowing bug; it is pinned here because the fix moved what the key is used for
+const RANGES = `
+	@font-face{font-family:sub;src:url(latin.woff2) format("woff2");unicode-range:U+0-7F}
+	@font-face{font-family:sub;src:url(greek.woff2) format("woff2");unicode-range:U+370-3FF}`;
+
+const ranges = await run(RANGES);
+check("faces split by unicode-range are all kept", ranges.processed.length, 2);
+check("each range keeps its own source", ranges.processed.map(rule => rule.sources), [["url(latin.woff2)format(\"woff2\")"], ["url(greek.woff2)format(\"woff2\")"]]);
+
+// a rule declaring the same source twice contributes it once, in the position its later declaration
+// gives it. The sources are compared after the separating comma is stripped, so a repeat is
+// recognised wherever it sits: the value is split by a regexp that keeps that comma, and comparing
+// the raw pieces made the last source in a list unequal to the same source anywhere before it
+const REPEATED = `
+	@font-face{font-family:repeat;src:url(a.woff) format("woff"),url(b.woff) format("woff"),url(a.woff) format("woff"),url(c.woff) format("woff");font-weight:400}`;
+
+const repeated = await run(REPEATED);
+check("a source repeated inside one rule is listed once", (sourcesOf(repeated.processed, 0) || []).length, 3);
+
+const REPEATED_LAST = `
+	@font-face{font-family:repeat;src:url(a.woff) format("woff"),url(b.woff) format("woff"),url(a.woff) format("woff");font-weight:400}`;
+
+const repeatedLast = await run(REPEATED_LAST);
+check("a repeat in last position is recognised too", (sourcesOf(repeatedLast.processed, 0) || []).length, 2);
+// the list is held in reverse of the order it is written back in, so the entry the rule declares
+// last comes first here: a.woff keeps the position its second declaration gives it
+check("the repeat keeps the position of its later declaration", sourcesOf(repeatedLast.processed, 0), ["url(a.woff)format(\"woff\")", "url(b.woff)format(\"woff\")"]);
+
+if (failures) {
+	console.log("\n" + failures + " check(s) failed");
+	Deno.exit(1);
+} else {
+	console.log("\nall checks passed");
+}

package/test/sfz-harness/format-rules.js

@@ -432,9 +432,13 @@ const ALL_FACE_RUNGS = "<!--sfz-data<script<style<noframes<noembed<iframe<xmp<![
 	check("no page.pdf entry is left behind", entries.some(entry => entry.filename.endsWith("page.pdf")), false);
 }
 
-// page.pdf is the only record the writer builds by hand, so it is the only place the
-// language encoding flag can go missing: without it a reader decodes that one name
-// through CP437 while reading every other name in the same archive as UTF-8
+// page.pdf is the only record the writer builds by hand, so it is the only place the language
+// encoding flag can disagree with the rest of the archive, and a reader would then decode that one
+// name through a different path than every other name in the same file. Which way the flag goes is
+// the ZIP writer's business, not this format's: it sets bit 11 only when a name or a comment holds
+// a byte outside printable ASCII, so every name in this fixture is flagless. What is asserted here
+// is the agreement, so this still fails if the hand-built record diverges and still passes if the
+// writer changes its rule again
 {
 	const options = makeOptions({ embeddedPdf: PDF });
 	const pageData = makePageData(23, 4 * 1024);
@@ -443,11 +447,14 @@ const ALL_FACE_RUNGS = "<!--sfz-data<script<style<noframes<noembed<iframe<xmp<![
 	const zipReader = new ZipReader(new BlobReader(new Blob([bytes])));
 	const entries = await zipReader.getEntries();
 	await zipReader.close();
-	check("the pdf entry is listed", entries.some(entry => entry.filename == "page.pdf"), true);
-	check("every central record declares utf-8 names", entries.every(entry => entry.filenameUTF8), true);
+	const pdfEntry = entries.find(entry => entry.filename == "page.pdf");
+	check("the pdf entry is listed", Boolean(pdfEntry), true);
+	check("the hand-built central record declares its name like the records the writer produces",
+		entries.every(entry => Boolean(entry.filenameUTF8) == Boolean(pdfEntry.filenameUTF8)), true);
 	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-	const localFlags = entries.map(entry => view.getUint16(entry.offset + 6, true));
-	check("every local header declares utf-8 names", localFlags.every(flags => Boolean(flags & 0x0800)), true);
+	const localFlags = new Map(entries.map(entry => [entry.filename, view.getUint16(entry.offset + 6, true) & 0x0800]));
+	check("the hand-built local header declares its name like the headers the writer produces",
+		[...localFlags.values()].every(flag => flag == localFlags.get("page.pdf")), true);
 }
 
 {

package/test/sfz-harness/pages-archive.js

@@ -13,14 +13,15 @@
 //   - the titles written into the table of contents are CRAWLED, so they are attacker-controlled
 //     text going into an href attribute and into element content. Both escapers are checked here.
 import "./dom-stub.js";
-import { makePageData, makeOptions, runProcess } from "./common.js";
+import { makePageData, makeOptions, runProcess, freezeDate } from "./common.js";
 import { createPagesArchive } from "../../processors/compression/compression-packager.js";
-import { ZipReader, BlobReader, TextWriter } from "../../vendor/zip/zip.js";
+import { ZipReader, ZipWriter, BlobReader, TextReader, TextWriter, Uint8ArrayWriter } from "../../vendor/zip/zip.js";
 
 // a title as it comes back from a crawl: the quote closes the href it is written into, the angle
 // bracket opens an element, and the ampersand is what a naive escaper double-encodes
 const HOSTILE_TITLE = "Intro & \"start\" <b>";
 const SYMLINK_UNIX_MODE = 0o120777;
+const SOURCE_DATE = new Date("2021-03-04T05:06:08Z");
 
 let failed = false;
 
@@ -89,6 +90,42 @@ const pages = [
 		(await readEntry(entries, "pages/2/styles.css")).includes("font-family"), true);
 }
 
+// Every entry is copied with passThrough, i.e. its stored bytes are written back without being
+// decompressed, so everything that DESCRIBES those bytes has to travel with them. Forwarding a
+// subset does not make a partial copy, it makes a corrupt one: the writer cannot tell that a
+// compression method it did not choose describes data it is about to store verbatim.
+//
+// The pages the rest of this file uses cannot show that, because they are written by the same
+// writer with the same defaults as the archive they are copied into, so every value the copy
+// drops is replaced by the one it had. This page carries values the packager's own defaults do
+// not produce. It is the first page, so it is copied to the root under its own names.
+{
+	const metadataPages = [await makeMetadataPage(), pages[1]];
+	const sourceEntries = await readArchive(await metadataPages[0].getData());
+	const entries = await readArchive(await createPagesArchive(metadataPages, packagerOptions()));
+	const copied = [...sourceEntries.keys()].filter(filename => entries.has(filename));
+	check("every entry of the first page is copied", copied.length, sourceEntries.size);
+	for (const property of ["comment", "compressionMethod", "uncompressedSize", "crc32", "filenameUTF8", "externalFileAttributes", "versionMadeBy", "internalFileAttributes", "uid", "gid", "directory"]) {
+		check("a copied entry keeps its " + property,
+			copied.every(filename => entries.get(filename)[property] === sourceEntries.get(filename)[property]), true);
+	}
+	for (const property of ["lastModDate", "creationDate", "lastAccessDate"]) {
+		check("a copied entry keeps its " + property,
+			copied.every(filename => dateOf(entries.get(filename)[property]) === dateOf(sourceEntries.get(filename)[property])), true);
+	}
+	// the level bits say how hard the deflater tried, and a copy that drops them reports the
+	// packager's default instead of the level the entry was actually written at
+	check("a copied entry keeps the deflate level it was written at",
+		copied.every(filename => entries.get(filename).bitFlag.level === sourceEntries.get(filename).bitFlag.level), true);
+	// zip.js rebuilds the fields it interprets itself, so what has to survive is the rest
+	check("a copied entry keeps an extra field zip.js does not interpret",
+		extraFieldOf(entries.get("styles.css")), extraFieldOf(sourceEntries.get("styles.css")));
+	const sameBytes = await Promise.all(copied.map(async filename => equalData(
+		await readRawData(entries.get(filename)),
+		await readRawData(sourceEntries.get(filename)))));
+	check("a copied entry holds the bytes it was read from", sameBytes.every(Boolean), true);
+}
+
 {
 	const entries = await readArchive(await createPagesArchive(pages, packagerOptions({ tocPage: true })));
 	const toc = await readEntry(entries, "sfz-toc.html");
@@ -138,6 +175,33 @@ const pages = [
 		new TextDecoder("windows-1252").decode(await createPagesArchive(pages, packagerOptions())).includes("<nav><ul>"), false);
 }
 
+// the options handed to the archive writer are DERIVED from PROCESS_OPTION_NAMES, not hand-listed.
+// The hand copy carried eleven names and silently dropped maxAppendedDataLength, so
+// --max-appended-data-length did nothing on any multi-page save and nothing failed for months.
+// A one-byte budget has to reach the writer, where it is indistinguishable from refusing to append
+{
+	const unfreeze = freezeDate();
+	try {
+		const budgeted = await createPagesArchive(pages, packagerOptions({ maxAppendedDataLength: 1 }));
+		const prevented = await createPagesArchive(pages, packagerOptions({ preventAppendedData: true }));
+		const unbudgeted = await createPagesArchive(pages, packagerOptions());
+		check("a one-byte appended-data budget reaches the archive writer", equalData(budgeted, prevented), true);
+		check("and appending is what the writer does without one", equalData(unbudgeted, prevented), false);
+	} finally {
+		unfreeze();
+	}
+}
+
+// `password` is the one name the derivation must NOT forward. An encrypted multi-page archive
+// cannot be written yet, and forwarding the password would half-ship it: the writer would start
+// withholding the prologue's title as if the archive were encrypted, while the table of contents
+// and every entry comment — each one a resource URL — kept riding in that same cleartext prologue
+{
+	const prologue = new TextDecoder("windows-1252").decode(await createPagesArchive(pages, packagerOptions({ password: "secret" })));
+	check("a password is not forwarded to the archive writer",
+		prologue.includes("<title>Intro &#38; &#34;start&#34; &#60;b&#62;</title>"), true);
+}
+
 console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
 Deno.exit(failed ? 1 : 0);
 
@@ -150,6 +214,39 @@ async function makePage(seed, { url, title, originalUrls }) {
 	return { url, title, originalUrls, getData: async () => bytes };
 }
 
+// a page archive holding, on purpose, nothing the packager's own writer would produce by default:
+// a directory record, a name that needs the language encoding flag, a stored entry beside one
+// deflated at the highest level, unix ownership, an extra field zip.js does not interpret, and
+// dates outside the one the packager pins on its writer
+async function makeMetadataPage() {
+	const zipWriter = new ZipWriter(new Uint8ArrayWriter(), { lastModDate: SOURCE_DATE });
+	await zipWriter.add("folder/", null, { directory: true, comment: "a folder" });
+	await zipWriter.add("styles.css", new TextReader("body{font-family:serif}"), {
+		level: 9,
+		comment: "https://example.com/café.css",
+		creationDate: SOURCE_DATE,
+		lastAccessDate: SOURCE_DATE,
+		internalFileAttributes: 1,
+		msDosCompatible: false,
+		unixMode: 0o100755,
+		uid: 501,
+		gid: 20,
+		extraField: new Map([[0x7777, new Uint8Array([1, 2, 3, 4])]])
+	});
+	await zipWriter.add("café.txt", new TextReader("un café"), { level: 0 });
+	const bytes = await zipWriter.close();
+	return { url: "https://example.com/metadata.html", title: "Metadata", getData: async () => bytes };
+}
+
+function dateOf(value) {
+	return value === undefined ? undefined : value.getTime();
+}
+
+function extraFieldOf(entry) {
+	const value = entry.extraField && entry.extraField.get(0x7777);
+	return value ? value.data.join(",") : undefined;
+}
+
 function packagerOptions(overrides = {}) {
 	return {
 		selfExtractingArchive: true,
@@ -170,6 +267,14 @@ function readEntry(entries, filename) {
 	return entries.get(filename).getData(new TextWriter());
 }
 
+function readRawData(entry) {
+	return entry.getData(new Uint8ArrayWriter(), { passThrough: true, checkCrc32: false });
+}
+
+function equalData(dataLeft, dataRight) {
+	return dataLeft.length == dataRight.length && dataLeft.every((value, index) => value == dataRight[index]);
+}
+
 function check(label, actual, expected) {
 	const ok = actual === expected;
 	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);

package/test/sfz-harness/pages-router.js

@@ -0,0 +1,117 @@
+// The router picks the page a multi-page archive opens on. Nothing drove it until this file: the
+// function is inlined into the archive as source text, so it only ever ran inside a saved page,
+// and the suites around it checked what the packager WROTE rather than what a reader would see.
+// That is how the table of contents shipped unreachable. It was stored, the route existed, and
+// no link and no landing rule pointed at it, so --crawl-save-archive-toc looked like it did
+// nothing at all.
+//
+// The rule this file pins: an archive that stores a table of contents opens on it, and one that
+// does not opens on the first page. Two cases guard the edges of that rule. A route in the hash
+// names a page explicitly and has to win over the landing rule, or every deep link into an
+// archive would land on the table of contents instead. A hash that is NOT a route is a plain
+// fragment, and the only page it can mean is the first one, which is where the archive used to
+// land before the fragment was ever read.
+import "./dom-stub.js";
+import { makePageData, makeOptions, runProcess } from "./common.js";
+import { createPagesArchive } from "../../processors/compression/compression-packager.js";
+import { router } from "../../processors/compression/compression-router.js";
+import * as zip from "../../vendor/zip/zip.js";
+
+const ARCHIVE_URL = "https://example.com/archive.html";
+
+let failed = false;
+
+const pages = [
+	await makePage(1, { url: "https://example.com/docs/intro.html", title: "Intro" }),
+	await makePage(2, { url: "https://example.com/docs/api/reference.html", title: "Reference" })
+];
+const withTOC = await createPagesArchive(pages, packagerOptions({ tocPage: true }));
+const withoutTOC = await createPagesArchive(pages, packagerOptions());
+
+{
+	const content = await open(withTOC);
+	check("an archive holding a table of contents opens on it", content.includes("<h1>Table of contents</h1>"), true);
+}
+
+{
+	const content = await open(withoutTOC);
+	check("an archive holding no table of contents opens on the first page", content, "page at \"\"");
+}
+
+{
+	const content = await open(withTOC, "#sfz/pages/2/");
+	check("a route in the hash names the page to open", content, "page at \"pages/2/\"");
+}
+
+// a bare fragment is what a hand-written link into the saved page looks like. The router scrolls
+// to it after rendering, and the table of contents is not the document it belongs to
+{
+	const content = await open(withTOC, "#introduction");
+	check("a hash that is not a route opens the first page", content, "page at \"\"");
+}
+
+console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
+Deno.exit(failed ? 1 : 0);
+
+// the router reads its world out of globalThis and renders through the two functions it is given,
+// so a stub of each is enough to see the page it chose. Only what the first render touches is
+// stubbed here; navigation, scroll restoration and link marking read more of the DOM than this
+async function open(bytes, hash = "") {
+	let displayed;
+	installEnvironment(hash);
+	await router(new Blob([bytes]), {
+		extract: (content, { pagePath }) => ({ docContent: "page at " + JSON.stringify(pagePath) }),
+		display: (document, docContent) => displayed = docContent
+	});
+	return displayed;
+}
+
+function installEnvironment(hash) {
+	// the router asks for web workers, which the archive serves from its own extension URL. There
+	// is no such URL here, so the request is answered with the synchronous codec instead
+	globalThis.zip = { ...zip, configure: options => zip.configure({ ...options, useWebWorkers: false }) };
+	globalThis.document = {
+		head: { appendChild() { } },
+		styleSheets: [],
+		createElement: () => ({ setAttribute() { }, remove() { } }),
+		querySelectorAll: () => [],
+		querySelector: () => null,
+		getElementById: () => null
+	};
+	globalThis.history = {
+		state: null,
+		scrollRestoration: "auto",
+		replaceState(state) {
+			this.state = state;
+		}
+	};
+	// Deno defines location as a getter that throws without --location, so it is replaced rather
+	// than assigned
+	Object.defineProperty(globalThis, "location", {
+		value: { href: ARCHIVE_URL + hash, hash },
+		configurable: true,
+		writable: true
+	});
+}
+
+async function makePage(seed, { url, title }) {
+	const pageData = makePageData(seed, 2 * 1024);
+	pageData.title = title;
+	const { bytes } = await runProcess(pageData, makeOptions({ url }));
+	return { url, title, getData: async () => bytes };
+}
+
+function packagerOptions(overrides = {}) {
+	return {
+		selfExtractingArchive: true,
+		extractDataFromPage: true,
+		zipScript: "/* zip script stub */",
+		...overrides
+	};
+}
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/sfz-harness/stored-trigger.js

@@ -33,7 +33,7 @@ function check(label, actual, expected) {
 	const options = makeOptions();
 	const pageData = makePageData(2, 64 * 1024);
 	pageData.resources.images.push(storedResource("photo.jpg",
-		["-->", "</noscript>", "</noframes>", "</noembed>", "</script>", "</style>", "</iframe>", "</xmp>", "]]>"]));
+		["-->", "</script>", "</style>", "</noframes>", "</noembed>", "</iframe>", "</xmp>", "]]>"]));
 	const result = await runProcess(pageData, options);
 	check("all closers exhaust to", result.fallbackTag, "<plaintext>");
 	check("all closers keep extraction", result.extractionDisabled, false);
@@ -47,4 +47,49 @@ function check(label, actual, expected) {
 	check("stored '</xmp>' alone stays on comment path", result.fallbackTag, null);
 }
 
+// the rung patterns are matched over the archive BYTES rather than a decoded string, so these
+// four pin the parts of that match a byte scan is easy to get wrong: closers are matched
+// case-insensitively, a closer only counts when a tag-name terminator follows it, and the
+// comment closer is '-->' or '--!>' and nothing else in between
+
+{
+	const options = makeOptions();
+	const pageData = makePageData(4, 64 * 1024);
+	pageData.resources.images.push(storedResource("photo.jpg", ["-->", "</SCRIPT>"]));
+	const result = await runProcess(pageData, options);
+	check("an upper-case closer counts, so '</SCRIPT>' escalates to", result.fallbackTag, "<style type=sfz-data>");
+}
+
+{
+	const options = makeOptions();
+	const pageData = makePageData(5, 64 * 1024);
+	pageData.resources.images.push(storedResource("photo.jpg", ["-->", "</script\tsrc"]));
+	const result = await runProcess(pageData, options);
+	check("a tab terminates a closer, so '</script\\t' escalates to", result.fallbackTag, "<style type=sfz-data>");
+}
+
+{
+	const options = makeOptions();
+	const pageData = makePageData(6, 64 * 1024);
+	pageData.resources.images.push(storedResource("photo.jpg", ["-->", "</scriptx"]));
+	const result = await runProcess(pageData, options);
+	check("'</scriptx' is not a closer, so it stops at", result.fallbackTag, "<script type=sfz-data>");
+}
+
+{
+	const options = makeOptions();
+	const pageData = makePageData(7, 64 * 1024);
+	pageData.resources.images.push(storedResource("photo.jpg", ["--!>"]));
+	const result = await runProcess(pageData, options);
+	check("'--!>' closes a comment, so it falls back to", result.fallbackTag, "<script type=sfz-data>");
+}
+
+{
+	const options = makeOptions();
+	const pageData = makePageData(8, 64 * 1024);
+	pageData.resources.images.push(storedResource("photo.jpg", ["--?>"]));
+	const result = await runProcess(pageData, options);
+	check("'--?>' does not close a comment", result.fallbackTag, null);
+}
+
 Deno.exit(failed ? 1 : 0);