single-file-core 1.5.127 → 1.5.128

package/core/util.js

@@ -63,6 +63,8 @@ const CONTENT_TYPE_EXTENSIONS = {
 	"font/collection": ".ttc"
 };
 const CONTENT_TYPE_OCTET_STREAM = "application/octet-stream";
+const TRANSPORT_STREAM_SYNC_BYTE = 71;
+const TRANSPORT_STREAM_PACKET_SIZE = 188;
 const CONTENT_TYPES_HTML = ["text/html", "application/xhtml+xml"];
 const EXPECTED_TYPES_MEDIA = ["font", "image", "video", "audio"];
 
@@ -295,11 +297,11 @@ function getInstance(utilOptions) {
 		} catch (error) {
 			// ignored
 		}
-		if (!contentType || (contentType == CONTENT_TYPE_OCTET_STREAM && options.asBinary)) {
-			contentType = guessMIMEType(options.expectedType, buffer);
-			if (!contentType) {
-				contentType = options.contentType ? options.contentType : options.asBinary ? CONTENT_TYPE_OCTET_STREAM : "";
-			}
+		const guessedContentType = guessMIMEType(options.expectedType, buffer);
+		if (guessedContentType) {
+			contentType = guessedContentType;
+		} else if (!contentType || (contentType == CONTENT_TYPE_OCTET_STREAM && options.asBinary)) {
+			contentType = options.contentType ? options.contentType : options.asBinary ? CONTENT_TYPE_OCTET_STREAM : "";
 		}
 		if (!charset && options.charset) {
 			charset = options.charset;
@@ -403,6 +405,24 @@ function guessMIMEType(expectedType, buffer) {
 		if (compareBytes([255, 255, 255], [255, 216, 255])) {
 			return "image/jpeg";
 		}
+		if (compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 97, 118, 105, 102]) ||
+			compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 97, 118, 105, 115])) {
+			return "image/avif";
+		}
+		if (compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 104, 101, 105, 99]) ||
+			compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 104, 101, 105, 120]) ||
+			compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 104, 101, 118, 99]) ||
+			compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 104, 101, 118, 120])) {
+			return "image/heic";
+		}
+		if (compareBytes([255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 12, 74, 88, 76, 32, 13, 10, 135, 10]) ||
+			compareBytes([255, 255], [255, 10])) {
+			return "image/jxl";
+		}
+		if (compareBytes([255, 255, 255, 255], [73, 73, 42, 0]) ||
+			compareBytes([255, 255, 255, 255], [77, 77, 0, 42])) {
+			return "image/tiff";
+		}
 	}
 	if (expectedType == "font") {
 		if (compareBytes([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255],
@@ -444,7 +464,7 @@ function guessMIMEType(expectedType, buffer) {
 		if (compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 51, 103])) {
 			return "video/3gpp";
 		}
-		if (compareBytes([255], [71])) {
+		if (isTransportStream()) {
 			return "video/mp2t";
 		}
 	}
@@ -475,6 +495,14 @@ function guessMIMEType(expectedType, buffer) {
 		}
 	}
 
+	function isTransportStream() {
+		const value = new Uint8Array(buffer);
+		return value.length > TRANSPORT_STREAM_PACKET_SIZE * 2 &&
+			value[0] == TRANSPORT_STREAM_SYNC_BYTE &&
+			value[TRANSPORT_STREAM_PACKET_SIZE] == TRANSPORT_STREAM_SYNC_BYTE &&
+			value[TRANSPORT_STREAM_PACKET_SIZE * 2] == TRANSPORT_STREAM_SYNC_BYTE;
+	}
+
 	function compareBytes(mask, pattern) {
 		let patternMatch = true, index = 0;
 		if (buffer.byteLength >= pattern.length) {

package/package.json

@@ -1,26 +1,26 @@
 {
-  "name": "single-file-core",
-  "version": "1.5.127",
-  "description": "SingleFile Core",
-  "author": "Gildas Lormeau",
-  "license": "AGPL-3.0-or-later",
-  "scripts": {
-    "test": "deno run --allow-read test/sfz-harness/format-rules.js && deno run --allow-read test/sfz-harness/stored-trigger.js && deno run --allow-read test/sfz-harness/check-determinism.js && deno run --allow-read test/sfz-harness/option-wiring.js && deno run --allow-read test/sfz-harness/css-property-filter.js && deno run --allow-read test/sfz-harness/adopted-stylesheets-hook.js && deno run --allow-read test/sfz-harness/css-fonts-minifier.js && deno run --allow-read test/sfz-harness/font-face-composite.js && deno run --allow-read test/sfz-harness/inlined-functions.js && deno run --allow-read test/sfz-harness/pages-archive.js && deno run --allow-read test/sfz-harness/filename-max-length.js && deno run --allow-read test/sfz-harness/entry-compression.js && deno run --allow-read test/sfz-harness/filename-characters.js && deno run --allow-read test/sfz-harness/byte-map.js && deno run --allow-read test/sfz-harness/zip64.js && deno run --allow-read test/sfz-harness/charset-round-trip.js",
-    "bump-patch": "npm version patch --no-git-tag-version && npm run bump-commit",
-    "bump-minor": "npm version minor --no-git-tag-version && npm run bump-commit",
-    "bump-major": "npm version major --no-git-tag-version && npm run bump-commit",
-    "bump-commit": "git commit -m \"bump up version\" package.json package-lock.json"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/gildas-lormeau/single-file-core.git"
-  },
-  "bugs": {
-    "url": "https://github.com/gildas-lormeau/single-file-core/issues"
-  },
-  "homepage": "https://github.com/gildas-lormeau/single-file-core#readme",
-  "devDependencies": {
-    "@eslint/js": "^9.39.5",
-    "eslint": "^10.9.1"
-  }
+	"name": "single-file-core",
+	"version": "1.5.128",
+	"description": "SingleFile Core",
+	"author": "Gildas Lormeau",
+	"license": "AGPL-3.0-or-later",
+	"scripts": {
+		"test": "deno run --allow-read test/sfz-harness/format-rules.js && deno run --allow-read test/sfz-harness/stored-trigger.js && deno run --allow-read test/sfz-harness/check-determinism.js && deno run --allow-read test/sfz-harness/option-wiring.js && deno run --allow-read test/sfz-harness/css-property-filter.js && deno run --allow-read test/sfz-harness/adopted-stylesheets-hook.js && deno run --allow-read test/sfz-harness/css-fonts-minifier.js && deno run --allow-read test/sfz-harness/font-face-composite.js && deno run --allow-read test/sfz-harness/inlined-functions.js && deno run --allow-read test/sfz-harness/pages-archive.js && deno run --allow-read test/sfz-harness/pages-router.js && deno run --allow-read test/sfz-harness/filename-max-length.js && deno run --allow-read test/sfz-harness/content-type-sniffing.js && deno run --allow-read test/sfz-harness/entry-compression.js && deno run --allow-read test/sfz-harness/filename-characters.js && deno run --allow-read test/sfz-harness/byte-map.js && deno run --allow-read test/sfz-harness/zip64.js && deno run --allow-read test/sfz-harness/charset-round-trip.js",
+		"bump-patch": "npm version patch --no-git-tag-version && npm run bump-commit",
+		"bump-minor": "npm version minor --no-git-tag-version && npm run bump-commit",
+		"bump-major": "npm version major --no-git-tag-version && npm run bump-commit",
+		"bump-commit": "git commit -m \"bump up version\" package.json package-lock.json"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/gildas-lormeau/single-file-core.git"
+	},
+	"bugs": {
+		"url": "https://github.com/gildas-lormeau/single-file-core/issues"
+	},
+	"homepage": "https://github.com/gildas-lormeau/single-file-core#readme",
+	"devDependencies": {
+		"@eslint/js": "^9.39.5",
+		"eslint": "^10.9.1"
+	}
 }

package/processors/compression/compression-packager.js

@@ -32,7 +32,8 @@ import {
 } from "./../../vendor/zip/zip.js";
 import {
 	createArchive,
-	escapeHTML
+	escapeHTML,
+	PROCESS_OPTION_NAMES
 } from "./compression.js";
 
 const browser = globalThis.browser;
@@ -46,6 +47,13 @@ const TOC_STYLE = "body{font-family:system-ui,sans-serif;margin:2em auto;max-wid
 	"summary{cursor:pointer;font-weight:bold;margin:.5em 0}" +
 	"details{padding-left:1em}ul{margin:.25em 0;padding-left:1.5em}" +
 	"@media(prefers-color-scheme:dark){body{background-color:#111;color:#eee}a{color:#8ab4f8}a:visited{color:#c58af9}}";
+const ARCHIVE_EXCLUDED_OPTION_NAMES = [
+	"createRootDirectory",
+	"disableCompression",
+	"insertTextBody",
+	"password",
+	"url"
+];
 const COMMENT_HEADER = "Page saved with SingleFile";
 const SYMLINK_UNIX_MODE = 0o120777;
 
@@ -80,18 +88,11 @@ async function createPagesArchive(pages, options) {
 	};
 	const archiveOptions = {
 		url: pages[0].url,
-		multiPageArchive: true,
-		selfExtractingArchive: options.selfExtractingArchive,
-		extractDataFromPage: options.extractDataFromPage,
-		preventAppendedData: options.preventAppendedData,
-		declareAppendedData: options.declareAppendedData,
-		embeddedPdf: options.embeddedPdf,
-		embeddedImage: options.embeddedImage,
-		includeBOM: options.includeBOM,
-		insertMetaCSP: options.insertMetaCSP,
-		insertCanonicalLink: options.insertCanonicalLink,
-		insertMetaNoIndex: options.insertMetaNoIndex
+		multiPageArchive: true
 	};
+	PROCESS_OPTION_NAMES
+		.filter(name => !ARCHIVE_EXCLUDED_OPTION_NAMES.includes(name) && !(name in archiveOptions))
+		.forEach(name => archiveOptions[name] = options[name]);
 	const writtenEntries = options.dedupPages ? new Map() : undefined;
 	const aliases = {};
 	const blob = await createArchive(pageData, archiveOptions, options.zipScript, async zipWriter => {

package/processors/compression/compression-router.js

@@ -202,7 +202,7 @@ async function router(content, { extract, display }) {
 	function parseRoute() {
 		const hash = location.hash;
 		const routed = !hash || hash.startsWith(ROUTE_PREFIX);
-		let path = pages[0].path;
+		let path = routed && tocEntry ? TOC_ROUTE : pages[0].path;
 		let fragment;
 		if (routed && hash) {
 			({ path, fragment } = parseRouteHash(hash));

package/test/sfz-harness/README.md

@@ -34,7 +34,9 @@ any check failed.
 | `css-property-filter.js` | That the declaration filter keeps a property css-tree's dictionary does not know (`stop-color`, `flood-opacity`, anything newer than the pinned build) and still drops a genuinely invalid value. |
 | `adopted-stylesheets-hook.js` | That the page-world hook answers the adopted-stylesheets request for a CLOSED shadow root, which its host does not expose. |
 | `inlined-functions.js` | That a function serialized into a self-extracting archive names nothing outside itself. An import survives bundling and still reads correctly, and the archive then throws a bare `ReferenceError` and renders nothing. |
-| `pages-archive.js` | That `createPagesArchive` packs several pages into one archive correctly: the first page at the root and the others in folders, the manifest, the symlink a deduplicated entry leaves behind, and the escaping of crawled titles in both tables of contents. |
+| `pages-archive.js` | That `createPagesArchive` packs several pages into one archive correctly: the first page at the root and the others in folders, the manifest, the symlink a deduplicated entry leaves behind, and the escaping of crawled titles in both tables of contents. Also that the options reaching the archive writer are derived from `PROCESS_OPTION_NAMES` rather than hand-listed — a hand copy dropped `maxAppendedDataLength` for months — and that `password` stays out of that derivation, since forwarding it would make the writer withhold the prologue's title as if the archive were encrypted while the table of contents and every entry comment still rode in that same cleartext prologue. |
+| `pages-router.js` | That the router opens a multi-page archive on the page a reader expects: the table of contents when the archive stores one, the first page when it does not, and the page a route in the hash names whatever else is stored. The router is inlined into the archive as source text and only ever ran inside a saved page, so nothing drove it before; the table of contents shipped stored, routable and unreachable. |
+| `content-type-sniffing.js` | That a magic-byte match beats the `Content-Type` header, and that the header survives when nothing matches. science.org serves its woff2 files as `text/plain`, which used to be trusted, so the fonts were embedded as `data:text/plain` and the SFZ writer deflated a file that is already Brotli-compressed. Two cases guard the rules themselves rather than the outcome: a video whose first byte is `G` must not be relabelled `video/mp2t`, and the generic `mif1` HEIF brand must identify nothing, because an AVIF can carry it and calling it HEIC would name a format no browser decodes. |
 | `entry-compression.js` | That an entry is deflated or stored on the content type the server sent, not on the extension alone — a module served as `text/javascript` from a `.ts` URL used to go in uncompressed — and that an unrecognized `application/octet-stream` still stays stored. |
 | `filename-max-length.js` | That `formatFilename` counts the ellipsis as well as the extension in the budget it truncates to, so a filename at `filenameMaxLength` stays at it, and that a limit shorter than the extension does not reach `Blob.slice` with a negative start. |
 | `filename-characters.js` | That `getValidFilename` maps a full-width lookalike one character at a time — `C++` used to be saved as `C＋` — while a run of characters with no lookalike still collapses to a single replacement. |

package/test/sfz-harness/content-type-sniffing.js

@@ -0,0 +1,83 @@
+// `core/util.js` used to trust any Content-Type the server sent and sniff the bytes only when the
+// header was missing or `application/octet-stream`. science.org serves its woff2 files as
+// `text/plain;charset=UTF-8` — 12 of them — and every one was embedded as `data:text/plain`, which
+// costs twice: a browser with no `format()` hint in the `@font-face` rule has nothing left to
+// identify the font by, and the SFZ writer deflates a file that is already Brotli-compressed
+// because it decides compression from the content type.
+//
+// The rule now: a magic-byte match wins over the header, and the header is kept only when nothing
+// matches. That raises the bar for the sniffer's own rules, which is why `video/mp2t` no longer
+// matches on a single `0x47` byte — as a last resort behind a missing header that was tolerable,
+// as an override of a correct header it would relabel any video whose first byte is `G`. It now
+// wants the sync byte at the 188-byte packet stride, and the case below is the regression guard.
+/* global Response */
+
+import "./dom-stub.js";
+// util.js pulls in the page-world hooks, which register a document listener as they are evaluated.
+// None of it is exercised here; the stubs exist so that importing util.js is possible at all
+globalThis.window = globalThis.window || {};
+globalThis.document = globalThis.document || {};
+globalThis.Document = globalThis.Document || class { };
+globalThis.MutationObserver = globalThis.MutationObserver || class {
+	observe() { }
+};
+const { getInstance } = await import("./../../core/util.js");
+
+const FONT_URL = "https://example.com/font";
+const WOFF2 = bytes([0x77, 0x4F, 0x46, 0x32], 64);
+const PNG = bytes([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A], 64);
+const AVIF = bytes([0, 0, 0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x61, 0x76, 0x69, 0x66], 64);
+const WEBP2 = bytes([0x77, 0x70, 0x32, 0x20], 64);
+const HEIF_MIF1 = bytes([0, 0, 0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x6D, 0x69, 0x66, 0x31], 64);
+const NOT_A_TRANSPORT_STREAM = bytes([0x47, 0x53, 0x54, 0x00], 512);
+
+let failed = false;
+
+// [label, bytes, expectedType, the Content-Type the server sent, the type that must reach the data URI]
+const CASES = [
+	["a woff2 served as text/plain is embedded as font/woff2", WOFF2, "font", "text/plain;charset=UTF-8", "font/woff2"],
+	["a woff2 served as font/woff2 is unchanged", WOFF2, "font", "font/woff2", "font/woff2"],
+	["a woff2 served with no type at all is embedded as font/woff2", WOFF2, "font", undefined, "font/woff2"],
+	["a png served as text/plain is embedded as image/png", PNG, "image", "text/plain", "image/png"],
+	["an avif served as application/octet-stream is embedded as image/avif", AVIF, "image", "application/octet-stream", "image/avif"],
+	// "mif1" is the generic HEIF brand and an AVIF may carry it too, so it identifies nothing on
+	// its own: claiming HEIC here would relabel an AVIF as a format no browser decodes
+	["an ambiguous HEIF brand keeps the type the server sent", HEIF_MIF1, "image", "image/avif", "image/avif"],
+	// nothing matches these bytes, so the header is all there is and it has to survive
+	["a format the sniffer does not know keeps the type the server sent", WEBP2, "image", "image/webp2", "image/webp2"],
+	["a format the sniffer does not know and no type falls back to octet-stream", WEBP2, "image", undefined, "application/octet-stream"],
+	// the byte is 0x47, the packet stride is not, so this is not a transport stream
+	["a video starting with G is not relabelled as mp2t", NOT_A_TRANSPORT_STREAM, "video", "video/quicktime", "video/quicktime"]
+];
+
+for (const [label, data, expectedType, sentContentType, expectedContentType] of CASES) {
+	const { data: dataURI } = await fetchContent(data, expectedType, sentContentType);
+	check(label, readDataURIType(dataURI), expectedContentType);
+}
+
+console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
+Deno.exit(failed ? 1 : 0);
+
+function fetchContent(data, expectedType, contentType) {
+	const util = getInstance({
+		fetch: async () => new Response(data, { headers: contentType ? { "content-type": contentType } : {} })
+	});
+	return util.getContent(FONT_URL, { asBinary: true, inline: true, expectedType });
+}
+
+function readDataURIType(dataURI) {
+	const indexSeparator = dataURI.indexOf(";");
+	return dataURI.substring("data:".length, indexSeparator == -1 ? dataURI.indexOf(",") : indexSeparator);
+}
+
+function bytes(signature, length) {
+	const value = new Uint8Array(length);
+	value.set(signature);
+	return value;
+}
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/sfz-harness/pages-archive.js

@@ -13,7 +13,7 @@
 //   - the titles written into the table of contents are CRAWLED, so they are attacker-controlled
 //     text going into an href attribute and into element content. Both escapers are checked here.
 import "./dom-stub.js";
-import { makePageData, makeOptions, runProcess } from "./common.js";
+import { makePageData, makeOptions, runProcess, freezeDate } from "./common.js";
 import { createPagesArchive } from "../../processors/compression/compression-packager.js";
 import { ZipReader, ZipWriter, BlobReader, TextReader, TextWriter, Uint8ArrayWriter } from "../../vendor/zip/zip.js";
 
@@ -175,6 +175,33 @@ const pages = [
 		new TextDecoder("windows-1252").decode(await createPagesArchive(pages, packagerOptions())).includes("<nav><ul>"), false);
 }
 
+// the options handed to the archive writer are DERIVED from PROCESS_OPTION_NAMES, not hand-listed.
+// The hand copy carried eleven names and silently dropped maxAppendedDataLength, so
+// --max-appended-data-length did nothing on any multi-page save and nothing failed for months.
+// A one-byte budget has to reach the writer, where it is indistinguishable from refusing to append
+{
+	const unfreeze = freezeDate();
+	try {
+		const budgeted = await createPagesArchive(pages, packagerOptions({ maxAppendedDataLength: 1 }));
+		const prevented = await createPagesArchive(pages, packagerOptions({ preventAppendedData: true }));
+		const unbudgeted = await createPagesArchive(pages, packagerOptions());
+		check("a one-byte appended-data budget reaches the archive writer", equalData(budgeted, prevented), true);
+		check("and appending is what the writer does without one", equalData(unbudgeted, prevented), false);
+	} finally {
+		unfreeze();
+	}
+}
+
+// `password` is the one name the derivation must NOT forward. An encrypted multi-page archive
+// cannot be written yet, and forwarding the password would half-ship it: the writer would start
+// withholding the prologue's title as if the archive were encrypted, while the table of contents
+// and every entry comment — each one a resource URL — kept riding in that same cleartext prologue
+{
+	const prologue = new TextDecoder("windows-1252").decode(await createPagesArchive(pages, packagerOptions({ password: "secret" })));
+	check("a password is not forwarded to the archive writer",
+		prologue.includes("<title>Intro &#38; &#34;start&#34; &#60;b&#62;</title>"), true);
+}
+
 console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
 Deno.exit(failed ? 1 : 0);
 

package/test/sfz-harness/pages-router.js

@@ -0,0 +1,117 @@
+// The router picks the page a multi-page archive opens on. Nothing drove it until this file: the
+// function is inlined into the archive as source text, so it only ever ran inside a saved page,
+// and the suites around it checked what the packager WROTE rather than what a reader would see.
+// That is how the table of contents shipped unreachable. It was stored, the route existed, and
+// no link and no landing rule pointed at it, so --crawl-save-archive-toc looked like it did
+// nothing at all.
+//
+// The rule this file pins: an archive that stores a table of contents opens on it, and one that
+// does not opens on the first page. Two cases guard the edges of that rule. A route in the hash
+// names a page explicitly and has to win over the landing rule, or every deep link into an
+// archive would land on the table of contents instead. A hash that is NOT a route is a plain
+// fragment, and the only page it can mean is the first one, which is where the archive used to
+// land before the fragment was ever read.
+import "./dom-stub.js";
+import { makePageData, makeOptions, runProcess } from "./common.js";
+import { createPagesArchive } from "../../processors/compression/compression-packager.js";
+import { router } from "../../processors/compression/compression-router.js";
+import * as zip from "../../vendor/zip/zip.js";
+
+const ARCHIVE_URL = "https://example.com/archive.html";
+
+let failed = false;
+
+const pages = [
+	await makePage(1, { url: "https://example.com/docs/intro.html", title: "Intro" }),
+	await makePage(2, { url: "https://example.com/docs/api/reference.html", title: "Reference" })
+];
+const withTOC = await createPagesArchive(pages, packagerOptions({ tocPage: true }));
+const withoutTOC = await createPagesArchive(pages, packagerOptions());
+
+{
+	const content = await open(withTOC);
+	check("an archive holding a table of contents opens on it", content.includes("<h1>Table of contents</h1>"), true);
+}
+
+{
+	const content = await open(withoutTOC);
+	check("an archive holding no table of contents opens on the first page", content, "page at \"\"");
+}
+
+{
+	const content = await open(withTOC, "#sfz/pages/2/");
+	check("a route in the hash names the page to open", content, "page at \"pages/2/\"");
+}
+
+// a bare fragment is what a hand-written link into the saved page looks like. The router scrolls
+// to it after rendering, and the table of contents is not the document it belongs to
+{
+	const content = await open(withTOC, "#introduction");
+	check("a hash that is not a route opens the first page", content, "page at \"\"");
+}
+
+console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
+Deno.exit(failed ? 1 : 0);
+
+// the router reads its world out of globalThis and renders through the two functions it is given,
+// so a stub of each is enough to see the page it chose. Only what the first render touches is
+// stubbed here; navigation, scroll restoration and link marking read more of the DOM than this
+async function open(bytes, hash = "") {
+	let displayed;
+	installEnvironment(hash);
+	await router(new Blob([bytes]), {
+		extract: (content, { pagePath }) => ({ docContent: "page at " + JSON.stringify(pagePath) }),
+		display: (document, docContent) => displayed = docContent
+	});
+	return displayed;
+}
+
+function installEnvironment(hash) {
+	// the router asks for web workers, which the archive serves from its own extension URL. There
+	// is no such URL here, so the request is answered with the synchronous codec instead
+	globalThis.zip = { ...zip, configure: options => zip.configure({ ...options, useWebWorkers: false }) };
+	globalThis.document = {
+		head: { appendChild() { } },
+		styleSheets: [],
+		createElement: () => ({ setAttribute() { }, remove() { } }),
+		querySelectorAll: () => [],
+		querySelector: () => null,
+		getElementById: () => null
+	};
+	globalThis.history = {
+		state: null,
+		scrollRestoration: "auto",
+		replaceState(state) {
+			this.state = state;
+		}
+	};
+	// Deno defines location as a getter that throws without --location, so it is replaced rather
+	// than assigned
+	Object.defineProperty(globalThis, "location", {
+		value: { href: ARCHIVE_URL + hash, hash },
+		configurable: true,
+		writable: true
+	});
+}
+
+async function makePage(seed, { url, title }) {
+	const pageData = makePageData(seed, 2 * 1024);
+	pageData.title = title;
+	const { bytes } = await runProcess(pageData, makeOptions({ url }));
+	return { url, title, getData: async () => bytes };
+}
+
+function packagerOptions(overrides = {}) {
+	return {
+		selfExtractingArchive: true,
+		extractDataFromPage: true,
+		zipScript: "/* zip script stub */",
+		...overrides
+	};
+}
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}