single-file-core 1.5.128 → 1.5.130

package/test/capture/maff-metadata.js

@@ -0,0 +1,205 @@
+import "./dom.js";
+
+// core/util.js captures globalThis.DOMParser when it loads, and deno-dom throws on "text/xml", so
+// the MAFF metadata could not be parsed here at all. This substitutes a stub for that one mime type,
+// installed before common.js imports core, the same ordering constraint dom.js itself documents.
+//
+// What the stub stands for and what it does not. The two defects fixed alongside this suite are both
+// about what core does with what the parser HANDS BACK — an attribute that came back null, and which
+// of two almost-identical option fields gets written out — so a stub returning null or a string
+// covers them faithfully. It does NOT cover the parse: that `RDF > Description > originalurl` matches
+// `<RDF:RDF><RDF:Description><MAF:originalurl>` by local name, and that getAttributeNS resolves the
+// RDF prefix, are properties of a real XML DOM that only a browser suite can confirm.
+const XML_DOCUMENTS = new Map();
+const NativeDOMParser = globalThis.DOMParser;
+
+class StubXMLDocument {
+	constructor(values) {
+		this.values = values;
+	}
+	// undefined means the element is absent, null means it is present with no RDF:resource attribute
+	querySelector(selector) {
+		const localName = selector.split(">").pop().trim();
+		const value = this.values[localName];
+		return value === undefined ? null : { getAttributeNS: () => value };
+	}
+}
+
+globalThis.DOMParser = class {
+	parseFromString(content, mimeType) {
+		if (mimeType == "text/xml") {
+			return new StubXMLDocument(XML_DOCUMENTS.get(content) || {});
+		}
+		return new NativeDOMParser().parseFromString(content, mimeType);
+	}
+};
+
+const { capture, frameData, html, WIN_ID_ATTRIBUTE_NAME } = await import("./common.js");
+
+const PAGE_URL = "https://example.com/page.html";
+const RDF_URL = "https://example.com/index.rdf";
+const FRAME_URL = "https://example.com/frame-dir/frame.html";
+const FRAME_RDF_URL = "https://example.com/frame-dir/index.rdf";
+const ORIGINAL_URL = "https://original.example/real.html";
+const ARCHIVE_TIME = "Mon, 01 Jan 2024 10:20:30 GMT";
+const ARCHIVE_TIME_MS = new Date(ARCHIVE_TIME).getTime();
+const COMPLETE = { originalurl: ORIGINAL_URL, archivetime: ARCHIVE_TIME };
+const PAGE = html("<h1>page</h1>");
+const FRAME_PAGE = html("<h1>frame</h1>");
+const HOST_PAGE = html("<h1>host</h1><iframe src=\"" + FRAME_URL + "\" " + WIN_ID_ATTRIBUTE_NAME + "=\"0.1\"></iframe>");
+
+// The canonical link would be the obvious place to read the recovered url, but deno-dom reflects
+// neither the href nor the type property, so core's `element.href = ...` leaves no attribute behind.
+// Two observables survive that: the SingleFile comment, which core builds from options.saveUrl, and
+// the embedded options block, which is where the second defect lives.
+const OPTIONS_BLOCK = /<script data-single-file-options[^>]*>([^<]*)<\/script>/;
+
+let fixtureIndex = 0;
+
+function rdf(values) {
+	const content = "<?xml version=\"1.0\"?><!-- fixture " + (fixtureIndex++) + " -->";
+	XML_DOCUMENTS.set(content, values);
+	return content;
+}
+
+class CountingResources extends Map {
+	constructor(entries) {
+		super(entries);
+		this.counts = new Map();
+	}
+	get(key) {
+		this.counts.set(key, (this.counts.get(key) || 0) + 1);
+		return super.get(key);
+	}
+	countOf(key) {
+		return this.counts.get(key) || 0;
+	}
+}
+
+function resources(rdfContent) {
+	const entries = [
+		[PAGE_URL, { body: PAGE }],
+		[FRAME_URL, { body: FRAME_PAGE }]
+	];
+	if (rdfContent !== undefined) {
+		entries.push([RDF_URL, { body: rdfContent, contentType: "text/xml" }]);
+	}
+	return new CountingResources(entries);
+}
+
+function commentURL(content) {
+	const match = content.match(/ url: ([^\n]*)/);
+	return match && match[1].trim();
+}
+
+function embeddedOptions(content) {
+	const match = content.match(OPTIONS_BLOCK);
+	return match && JSON.parse(match[1]);
+}
+
+let failed = false;
+
+// readMaffMetadata is the new name of enableMaff, which was implemented in core and set by nothing:
+// no CLI flag, no config key, no UI anywhere. That is what made renaming it free, and exposing it is
+// what made the two defects below reachable by a user.
+{
+	const map = resources(rdf(COMPLETE));
+	const content = await capture(map, { url: PAGE_URL, content: PAGE, insertSingleFileComment: true });
+	check("index.rdf is not requested when the option is off", map.countOf(RDF_URL), 0);
+	check("the page url is saved when the option is off", commentURL(content), PAGE_URL);
+}
+
+{
+	const map = resources(rdf(COMPLETE));
+	const content = await capture(map, { url: PAGE_URL, content: PAGE, readMaffMetadata: true, insertSingleFileComment: true });
+	check("index.rdf is requested when the option is on", map.countOf(RDF_URL), 1);
+	check("the original url is recovered", commentURL(content), ORIGINAL_URL);
+}
+
+// THE CRASH. An originalurl with no RDF:resource made getAttributeNS return null, saveUrl became
+// null, and the canonical link then called .match() on it and failed the whole capture with a
+// TypeError. The archivetime branch beside it had always guarded its own value, so the two halves of
+// one method disagreed with each other.
+{
+	let threw = false;
+	let content = "";
+	try {
+		content = await capture(resources(rdf({ originalurl: null, archivetime: ARCHIVE_TIME })), {
+			url: PAGE_URL,
+			content: PAGE,
+			readMaffMetadata: true,
+			insertSingleFileComment: true
+		});
+	} catch {
+		threw = true;
+	}
+	check("an originalurl with no resource attribute does not fail the capture", threw, false);
+	check("and the page url is kept", commentURL(content), PAGE_URL);
+}
+
+{
+	const content = await capture(resources(rdf({ originalurl: ORIGINAL_URL, archivetime: null })), {
+		url: PAGE_URL,
+		content: PAGE,
+		readMaffMetadata: true,
+		insertSingleFileComment: true
+	});
+	check("an archivetime with no resource attribute is tolerated", commentURL(content), ORIGINAL_URL);
+}
+
+{
+	const content = await capture(resources(), { url: PAGE_URL, content: PAGE, readMaffMetadata: true, insertSingleFileComment: true });
+	check("a missing index.rdf leaves the page url in place", commentURL(content), PAGE_URL);
+}
+
+// THE INCONSISTENCY. saveFilenameTemplateData wrote saveUrl from options.url, one line above writing
+// saveDate from the value MAFF had just recovered, so the embedded block paired the archive's date
+// with the extracted copy's path, and a recompute in the editor resolved {url-*} against the wrong
+// one. options.saveUrl and options.url are identical on every other code path, which is what let it
+// sit unnoticed.
+{
+	const content = await capture(resources(rdf(COMPLETE)), {
+		url: PAGE_URL,
+		content: PAGE,
+		readMaffMetadata: true,
+		saveFilenameTemplateData: true
+	});
+	const embedded = embeddedOptions(content);
+	check("the embedded options block exists", Boolean(embedded), true);
+	if (embedded) {
+		check("the embedded saveUrl is the recovered one", embedded.saveUrl, ORIGINAL_URL);
+		check("the embedded saveDate is the recovered one", embedded.saveDate, ARCHIVE_TIME_MS);
+	}
+}
+
+{
+	const content = await capture(resources(rdf(COMPLETE)), { url: PAGE_URL, content: PAGE, saveFilenameTemplateData: true });
+	const embedded = embeddedOptions(content);
+	check("the embedded saveUrl is the page url when the option is off", embedded && embedded.saveUrl, PAGE_URL);
+}
+
+// Only the root document reaches Processor.initialize, because Runner.run guards that call with
+// `if (this.root)`. That guard is the whole reason a page with twenty frames does not make twenty
+// pointless index.rdf requests, and nothing else pins it. Note initializeProcessor resets a list of
+// root-only options for frames and readMaffMetadata is deliberately NOT in it: next to this guard
+// such a reset is dead code, which is exactly what adding one and watching nothing change proved.
+{
+	const map = resources(rdf(COMPLETE));
+	const frames = [frameData("0.1", FRAME_URL, FRAME_PAGE)];
+	const content = await capture(map, { url: PAGE_URL, content: HOST_PAGE, frames, readMaffMetadata: true });
+	check("the root asks for its index.rdf", map.countOf(RDF_URL), 1);
+	check("a frame does not ask for one of its own", map.countOf(FRAME_RDF_URL), 0);
+	check("the frame is still captured", content.includes("frame"), true);
+}
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+}
+console.log("OK");
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/capture/resource-cap.js

@@ -0,0 +1,79 @@
+import { capture, frameData, html, WIN_ID_ATTRIBUTE_NAME } from "./common.js";
+
+const PAGE_URL = "https://example.com/big.html";
+const HOST_URL = "https://example.com/host.html";
+const IMAGE_URL = "https://example.com/big.png";
+const PAGE_MARKER = "BIG PAGE MARKER";
+const HOST_MARKER = "HOST PAGE MARKER";
+
+// One paragraph of 2.1 MB rather than many small ones, for the reason common.js gives.
+const BIG_PAGE = html("<h1>" + PAGE_MARKER + "</h1><p>" + "filler ".repeat(300000) + "</p>");
+const HOST_PAGE = html("<h1>" + HOST_MARKER + "</h1><iframe src=\"" + PAGE_URL + "\" " + WIN_ID_ATTRIBUTE_NAME + "=\"0.1\"></iframe>");
+const IMAGE_PAGE = html("<h1>" + HOST_MARKER + "</h1><img src=\"" + IMAGE_URL + "\">");
+const BIG_IMAGE = new Uint8Array(2 * 1024 * 1024).fill(0x21);
+
+const resources = {
+	[PAGE_URL]: { body: BIG_PAGE },
+	[HOST_URL]: { body: HOST_PAGE },
+	[IMAGE_URL]: { body: BIG_IMAGE, contentType: "image/png" }
+};
+
+// One megabyte, so every fixture above is over it and the default of ten is not in the way.
+const CAP = { maxResourceSizeEnabled: true, maxResourceSize: 1 };
+
+let failed = false;
+
+// The content a browser captured is handed to core as a string and never fetched, so the cap has no
+// point at which it could fire. This is what every extension save and every non-raw CLI capture does.
+{
+	const content = await capture(resources, { url: PAGE_URL, content: BIG_PAGE, ...CAP });
+	check("a page supplied as content is never capped", content.includes(PAGE_MARKER), true);
+}
+
+// The regression test. loadPage fetches the document itself in raw mode, and until rootDocument was
+// excluded the cap emptied it: a 2.5 MB page came out as 525 bytes with no body at all, exit code 0
+// and no warning. The cap is documented to apply to "images, fonts, stylesheets, scripts, frames,
+// videos and audios", never to the page.
+{
+	const content = await capture(resources, { url: PAGE_URL, saveRawPage: true, ...CAP });
+	check("a raw page over the cap keeps its content", content.includes(PAGE_MARKER), true);
+}
+
+// The control for the test above: the same cap, in the same capture, still has to drop a resource.
+// A fix that exempted everything would pass the raw-page check and break the option.
+{
+	const capped = await capture(resources, { url: HOST_URL, content: IMAGE_PAGE, ...CAP });
+	const uncapped = await capture(resources, { url: HOST_URL, content: IMAGE_PAGE });
+	check("an image over the cap is left out", capped.includes("data:image/png;base64"), false);
+	check("the page holding it is kept", capped.includes(HOST_MARKER), true);
+	check("the same image is embedded with the cap off", uncapped.includes("data:image/png;base64"), true);
+}
+
+// Frame content captured by the content script arrives as data, like the top document above, so the
+// cap cannot reach it either.
+{
+	const frames = [frameData("0.1", PAGE_URL, BIG_PAGE)];
+	const content = await capture(resources, { url: HOST_URL, content: HOST_PAGE, frames, ...CAP });
+	check("a frame supplied as data is never capped", content.includes(PAGE_MARKER), true);
+	check("its host is kept", content.includes(HOST_MARKER), true);
+}
+
+// In raw mode there is no frame data: resolveFrameURLs pushes a frame with no content and its runner
+// fetches the frame document, which is the one caller the cap is meant for. Dropping it is correct.
+{
+	const content = await capture(resources, { url: HOST_URL, saveRawPage: true, ...CAP });
+	check("a raw frame over the cap is dropped", content.includes(PAGE_MARKER), false);
+	check("its host is kept", content.includes(HOST_MARKER), true);
+}
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+}
+console.log("OK");
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/capture/script-uri-sanitization.js

@@ -0,0 +1,82 @@
+import { capture, html } from "./common.js";
+
+const PAGE_URL = "https://example.com/page.html";
+
+// blockScripts is what removeEmbedScripts is wired to, and it is the option every save turns on to
+// promise that the saved page holds no script. These fixtures are the ways a javascript: URL used to
+// survive that promise.
+const BLOCK = { blockScripts: true };
+
+// The sanitizer used to read the resolved IDL property, element.href and element.src, and rewrite the
+// attribute only when the property was a string starting with "javascript:". That missed every SVG
+// link, because SVGAElement.href is an SVGAnimatedString and the guard skipped it, and it never
+// looked at form submission targets at all. Each of these executed on one click in a saved page.
+const VECTORS = [
+	["svg link", "<svg xmlns=\"http://www.w3.org/2000/svg\"><a id=\"target\" href=\"javascript:alert(1)\"><rect/></a></svg>"],
+	["form action", "<form action=\"javascript:alert(1)\"><input type=\"submit\"></form>"],
+	["button formaction", "<form><button formaction=\"javascript:alert(1)\">go</button></form>"],
+	["image input formaction", "<form><input type=\"image\" formaction=\"javascript:alert(1)\"></form>"],
+	["object data", "<object data=\"javascript:alert(1)\"></object>"],
+	["anchor href", "<a href=\"javascript:alert(1)\">go</a>"],
+	["iframe src", "<iframe src=\"javascript:alert(1)\"></iframe>"]
+];
+
+let failed = false;
+
+for (const [label, body] of VECTORS) {
+	const content = await capture({}, { url: PAGE_URL, content: html(body), ...BLOCK });
+	check(`${label} is neutralized`, content.includes("javascript:alert"), false);
+}
+
+// The URL parser decides what a javascript: URL is, so the obfuscations it folds away have to be
+// folded away here too: leading whitespace is stripped, a tab inside the scheme is removed, and the
+// scheme is compared case-insensitively.
+const OBFUSCATIONS = [
+	["leading whitespace and mixed case", "  \tJaVaScRiPt:alert(1)"],
+	["tab inside the scheme", "ja&#9;vascript:alert(1)"],
+	["newline before the scheme", "&#10;javascript:alert(1)"],
+	["uppercase scheme", "JAVASCRIPT:alert(1)"]
+];
+
+for (const [label, value] of OBFUSCATIONS) {
+	const content = await capture({}, { url: PAGE_URL, content: html(`<a href="${value}">go</a>`), ...BLOCK });
+	check(`${label} is neutralized`, content.includes("alert(1)"), false);
+}
+
+// The control. A space inside the scheme is not a javascript: URL, and neither is a relative path, so
+// a sanitizer that rewrote either would be matching on text rather than on what the URL parser says.
+// Neither href survives as written, because resolveHrefs makes both absolute afterwards; what the
+// control asserts is that the sanitizer did not claim them.
+{
+	const content = await capture({}, { url: PAGE_URL, content: html("<a href=\"java script:alert(1)\">go</a><a href=\"page.html\">go</a>"), ...BLOCK });
+	check("a space inside the scheme is not treated as a script URI", content.includes("javascript:void(0)"), false);
+	check("a relative href is not treated as a script URI", content.includes("page.html"), true);
+}
+
+// The other half of removeEmbedScripts, kept here so that a rewrite of the attribute walk cannot drop
+// it silently. Only the script elements can be checked from here: the event handler attribute names
+// come from enumerating the on* IDL properties of an element, and deno-dom implements none of them,
+// so the set is empty in this harness and a handler fixture would pass whatever the code did. The
+// browser suite in single-file-cli covers the handlers.
+{
+	const scripts = await capture({}, { url: PAGE_URL, content: html("<script>alert(1)</script><svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(2)</script></svg>"), ...BLOCK });
+	check("html and svg script elements are removed", scripts.includes("alert("), false);
+}
+
+// The option still has to be an option: with blockScripts off none of this is rewritten.
+{
+	const content = await capture({}, { url: PAGE_URL, content: html("<a href=\"javascript:alert(1)\">go</a>") });
+	check("nothing is rewritten with blockScripts off", content.includes("javascript:alert(1)"), true);
+}
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+}
+console.log("OK");
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/run.js

@@ -0,0 +1,109 @@
+// Runs every suite under test/, so that adding one means adding a file rather than editing a chain
+// of shell commands. Two failure modes are worth naming, because this exists to remove the first
+// without introducing the second: a suite nobody added to a hand-written list is never run and
+// nobody notices, and a runner that takes every file it finds runs a scratch file that was never a
+// test — single-file-tests did exactly that inside a release gate. So the files that are NOT suites
+// are named below and anything else in these directories is run, which fails loudly rather than
+// quietly. Keep this list in step when a helper or a tool is added.
+//
+// Unlike the chain it replaces, one red suite no longer hides the nineteen behind it: everything
+// runs, and the summary says what failed.
+//
+//   deno run --allow-read --allow-run test/run.js            every suite
+//   deno run --allow-read --allow-run test/run.js cap font   suites whose path matches an argument
+//   deno run --allow-read --allow-run test/run.js --verbose  with the output of the suites that pass
+
+const SUITE_DIRECTORIES = ["sfz-harness", "capture"];
+const NOT_SUITES = [
+	"sfz-harness/common.js",
+	"sfz-harness/dom-stub.js",
+	"sfz-harness/gen-e2e-page.js",
+	"sfz-harness/search-triggers.js",
+	"sfz-harness/smoke.js",
+	"capture/common.js",
+	"capture/dom.js"
+];
+
+const verbose = Deno.args.includes("--verbose");
+const filters = Deno.args.filter(argument => !argument.startsWith("--"));
+const suites = await findSuites();
+const selected = filters.length ? suites.filter(suite => filters.some(filter => suite.includes(filter))) : suites;
+
+if (!selected.length) {
+	console.log(filters.length ? `no suite matches ${filters.join(", ")}` : "no suite found");
+	Deno.exit(1);
+}
+
+let checksPassed = 0, checksFailed = 0;
+const failures = [];
+for (const suite of selected) {
+	const result = await runSuite(suite);
+	checksPassed += result.passed;
+	checksFailed += result.failed;
+	if (result.ok) {
+		console.log(`PASS ${suite}${result.passed ? ` (${result.passed} checks)` : ""}`);
+		if (verbose) {
+			console.log(indent(result.output));
+		}
+	} else {
+		failures.push(suite);
+		console.log(`FAIL ${suite}${result.failed ? ` (${result.failed} of ${result.passed + result.failed} checks)` : ` (exit ${result.code})`}`);
+		// a suite that fails a check has already said which one; a suite that crashed has not, and
+		// its output is the only thing that explains the exit code
+		console.log(indent(result.failed ? result.failedLines : result.output));
+	}
+}
+
+const skipped = NOT_SUITES.length;
+console.log(`\n${selected.length} suites, ${checksPassed + checksFailed} checks, ${skipped} files skipped as tools or helpers`);
+if (failures.length) {
+	console.log(`FAILED: ${failures.join(", ")}`);
+	Deno.exit(1);
+}
+console.log("all suites passed");
+
+async function findSuites() {
+	const found = [];
+	for (const directory of SUITE_DIRECTORIES) {
+		const names = [];
+		for await (const entry of Deno.readDir(new URL(directory + "/", import.meta.url))) {
+			if (entry.isFile && entry.name.endsWith(".js")) {
+				names.push(entry.name);
+			}
+		}
+		names.sort();
+		for (const name of names) {
+			const path = directory + "/" + name;
+			if (!NOT_SUITES.includes(path)) {
+				found.push(path);
+			}
+		}
+	}
+	return found;
+}
+
+async function runSuite(suite) {
+	const command = new Deno.Command(Deno.execPath(), {
+		args: ["run", "--allow-read", new URL(suite, import.meta.url).pathname],
+		stdout: "piped",
+		stderr: "piped"
+	});
+	const { code, stdout, stderr } = await command.output();
+	const decoder = new TextDecoder();
+	const output = (decoder.decode(stdout) + decoder.decode(stderr)).trimEnd();
+	// the space matters: a suite ends on a bare "FAILED" line, which is a verdict and not a check
+	const lines = output.split("\n");
+	const failedLines = lines.filter(line => line.startsWith("FAIL ")).join("\n");
+	return {
+		code,
+		ok: code === 0,
+		output,
+		failedLines,
+		passed: lines.filter(line => line.startsWith("PASS ")).length,
+		failed: lines.filter(line => line.startsWith("FAIL ")).length
+	};
+}
+
+function indent(text) {
+	return text.split("\n").map(line => "  " + line).join("\n");
+}

package/test/sfz-harness/README.md

@@ -14,7 +14,14 @@ Run them with Deno, from the repository root:
 npm test
 ```
 
-or one at a time:
+which is [`test/run.js`](../run.js), the runner for every suite under `test/`. It takes
+name filters, so this directory alone is:
+
+```
+deno run --allow-read --allow-run test/run.js sfz-harness
+```
+
+or one at a time, which needs no runner:
 
 ```
 deno run --allow-read test/sfz-harness/format-rules.js
@@ -42,12 +49,16 @@ any check failed.
 | `filename-characters.js` | That `getValidFilename` maps a full-width lookalike one character at a time — `C++` used to be saved as `C＋` — while a run of characters with no lookalike still collapses to a single replacement. |
 | `zip64.js` | That the `page.pdf` record injection accounts for the zip64 end of central directory record (§5.7): all four EOCD fields left at their sentinels, the entry counts and directory size carried in the zip64 record, the directory offset pointing at the injected record, and the archive still readable. The branch runs only past 4 GiB or 65535 entries, so nothing reached it before; the suite forces zip64 through `zipWriter.options` from inside the `writeEntries` callback, with no production lever. |
 | `byte-map.js` | That the byte offsets §8.2 of the specification prints still describe what the writer emits: the prologue order, the doctype and root tag with nothing between them, the identifier's length ahead of the region, absolute EOCD offsets, and the entry order. The specimen §8.2 documents is saved from a live URL and has never been in this repository, so none of its numbers could be checked; three of them were wrong. This builds an equivalent with no network. |
+| `relocation-cost.js` | That the figures §5.2 prints for relocating the extra-data element reconstruct. Two of the three came from live captures and did not: the paragraph subtracted the terminator and the end tags from the reservation without subtracting the element, which the appended placement carries too, so it over-counted by the whole element. This pins the corrected arithmetic — the cost is the reservation margin alone, it is positive on every rung whenever an element exists, and the only way relocation saves bytes is to have no element to relocate. |
 | `charset-round-trip.js` | That the encoding tables §8.4 prints still describe the WHATWG index: which 20 of the 38 encodings carry all 256 byte values through a decode injectively, the sizes of the reverse tables they need, and the five windows-1252 positions a platform codec of the same name leaves undefined. It also re-derives the reverse table the extractor ships as a literal, which no build step checks and which corrupts one byte per occurrence when wrong. |
 | `css-fonts-minifier.js` | That `removeUnusedFonts` reads the font families it prunes on correctly: a `var()` family resolved from the values the document declares and not only from the ones the body inherits, every font kept when the value is genuinely undetermined, and a multi-word family name that does not also claim a font named after its own tail. |
+| `font-face-composite.js` | That several `@font-face` rules declaring the same family with the same style descriptors are one composite face and not a stack where the last rule wins, which is what CSS Fonts 4 §5.2 and §4.5.1 say: both members are kept with their own sources, faces split by `unicode-range` are all kept, an outright duplicate rule is emitted once, and a source repeated inside one rule is listed once, at the position of its later declaration. |
 
 ## The tools
 
-Not tests — they print, they do not assert, and CI does not run them.
+Not tests — they print, they do not assert, and CI does not run them. The runner skips
+them by name, in the `NOT_SUITES` list of [`test/run.js`](../run.js). Everything else in
+this directory IS run, so a new file is either a suite or a line in that list.
 
 | Script | Use |
 |---|---|

package/test/sfz-harness/pages-archive.js

@@ -4,9 +4,11 @@
 //
 // Three of its rules are worth stating, because they look arbitrary in the code:
 //
-//   - the first page is stored at the ROOT and the others under pages/N/. The root page is what a
-//     reader opens, so it cannot be moved into a folder without changing every relative URL the
-//     capture already resolved.
+//   - the first page is stored at the ROOT and the others under pages/N/, unless
+//     createRootDirectory asks for a folder for the first page too. A page's resources travel with
+//     it, so either layout resolves; what the root buys is a reader who unzips the archive and
+//     opens index.html without being told where to look, and what it costs is that the first page
+//     shares the root with the archive's own files.
 //   - a duplicate entry becomes a SYMLINK rather than being dropped. The router resolves it from
 //     the alias map in the manifest and never reads it, but a plain unzip has to produce complete
 //     page folders, and only a symlink gives both.
@@ -46,6 +48,37 @@ const pages = [
 		(manifest.pages[0].originalUrls || []).join(" "), "https://example.com/docs/");
 }
 
+// createRootDirectory gives the first page a folder of its own. Without it the first page is
+// written at the root, mixed in with the archive's own files, which is the reason the router needs
+// a special case at all: belongsToPage() has to read "everything not under pages/ and not named
+// sfz-*" as the first page. With every page under pages/N/ that rule is a plain prefix match.
+{
+	const entries = await readArchive(await createPagesArchive(pages, packagerOptions({ createRootDirectory: true, tocPage: true })));
+	const manifest = JSON.parse(await readEntry(entries, "sfz-pages.json"));
+	const toc = await readEntry(entries, "sfz-toc.html");
+	check("the first page is stored in a folder of its own when a root directory is asked for",
+		entries.has("pages/1/index.html"), true);
+	check("and the first page is no longer at the root", entries.has("index.html"), false);
+	check("the manifest names the folder of the first page too",
+		manifest.pages.map(page => page.path).join(" "), "pages/1/ pages/2/");
+	check("the table of contents links to the first page in its folder",
+		toc.includes("href=\"pages/1/index.html\""), true);
+	// the archive's own files stay at the root whatever the option says: the router finds them by
+	// exact name, and an archive whose sfz-pages.json moved stops being read as multi-page at all
+	check("the archive's own files are the only thing left at the root",
+		[...entries.keys()].filter(filename => !filename.includes("/")).sort().join(" "),
+		"sfz-pages.json sfz-toc.html");
+}
+
+// deduplication writes the link target relative to the folder the repeated entry sits in. With the
+// first page at the root that walk never has a common prefix to drop; with both pages in folders it
+// has to climb out of one and back into the other, which nothing exercised before
+{
+	const entries = await readArchive(await createPagesArchive(pages, packagerOptions({ createRootDirectory: true, dedupPages: true })));
+	check("a repeated entry points across folders at the one that was kept",
+		await readEntry(entries, "pages/2/styles.css"), "../1/styles.css");
+}
+
 // the router reads these two out of the manifest, and "auto" is the absence of a choice rather
 // than a value: writing it would pin the default of the day into every archive
 {
@@ -216,8 +249,8 @@ async function makePage(seed, { url, title, originalUrls }) {
 
 // a page archive holding, on purpose, nothing the packager's own writer would produce by default:
 // a directory record, a name that needs the language encoding flag, a stored entry beside one
-// deflated at the highest level, unix ownership, an extra field zip.js does not interpret, and
-// dates outside the one the packager pins on its writer
+// deflated at the highest level, unix ownership, a non-default version-made-by spec byte, an
+// extra field zip.js does not interpret, and dates outside the one the packager pins on its writer
 async function makeMetadataPage() {
 	const zipWriter = new ZipWriter(new Uint8ArrayWriter(), { lastModDate: SOURCE_DATE });
 	await zipWriter.add("folder/", null, { directory: true, comment: "a folder" });
@@ -228,6 +261,9 @@ async function makeMetadataPage() {
 		lastAccessDate: SOURCE_DATE,
 		internalFileAttributes: 1,
 		msDosCompatible: false,
+		// only the high byte is rewritten to host Unix, so the 0x32 spec byte survives and the
+		// copied value differs from the 0x0300 both writers land on by default
+		versionMadeBy: 0x0332,
 		unixMode: 0o100755,
 		uid: 501,
 		gid: 20,

package/test/sfz-harness/pages-router.js

@@ -20,6 +20,7 @@ import * as zip from "../../vendor/zip/zip.js";
 const ARCHIVE_URL = "https://example.com/archive.html";
 
 let failed = false;
+let openedEntries;
 
 const pages = [
 	await makePage(1, { url: "https://example.com/docs/intro.html", title: "Intro" }),
@@ -50,6 +51,28 @@ const withoutTOC = await createPagesArchive(pages, packagerOptions());
 	check("a hash that is not a route opens the first page", content, "page at \"\"");
 }
 
+// createRootDirectory moves the first page into pages/1/, so the landing rule has to come from the
+// manifest rather than from the root. belongsToPage() also leaves its special case behind: while
+// the first page is at the root it can only be described as "everything not under pages/ and not
+// named sfz-*", and a page in a folder is selected by prefix like any other. The entries handed to
+// extract are the assertion, because a landing path alone would still read right if that selection
+// silently picked up the archive's own files
+{
+	const rooted = await createPagesArchive(pages, packagerOptions({ createRootDirectory: true }));
+	const content = await open(rooted);
+	check("an archive with a root directory opens on the first page in its folder", content, "page at \"pages/1/\"");
+	check("and the router hands it only the entries of that folder",
+		openedEntries.join(" "), "pages/1/index.html pages/1/manifest.json pages/1/styles.css");
+}
+
+{
+	const rooted = await createPagesArchive(pages, packagerOptions({ createRootDirectory: true, tocPage: true }));
+	check("an archive with a root directory still opens on its table of contents",
+		(await open(rooted)).includes("<h1>Table of contents</h1>"), true);
+	check("and a route still names a page in it",
+		await open(rooted, "#sfz/pages/1/"), "page at \"pages/1/\"");
+}
+
 console.log(failed ? "\nsome checks FAILED" : "\nall checks passed");
 Deno.exit(failed ? 1 : 0);
 
@@ -60,7 +83,10 @@ async function open(bytes, hash = "") {
 	let displayed;
 	installEnvironment(hash);
 	await router(new Blob([bytes]), {
-		extract: (content, { pagePath }) => ({ docContent: "page at " + JSON.stringify(pagePath) }),
+		extract: (content, { entries, pagePath }) => {
+			openedEntries = entries.map(entry => entry.filename).sort();
+			return { docContent: "page at " + JSON.stringify(pagePath) };
+		},
 		display: (document, docContent) => displayed = docContent
 	});
 	return displayed;