capybara-simulated 0.10.0 → 0.11.0

data/lib/capybara/simulated/browser.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'base64'
+require 'brotli'
 require 'date'
 require 'digest'
 require 'fileutils'
@@ -2465,6 +2466,7 @@ module Capybara
         # *before* the page's own setup code that the test expects
         # to be active.
         tick_real_time
+        flush_module_rt
         invalidate_find_cache
         # Routes to the active frame realm inside `within_frame` (Selenium
         # parity: `evaluate_script` runs in the current browsing context).
@@ -2479,6 +2481,7 @@ module Capybara
       # …) that the marshaller would recurse into.
       def execute_script(code, args = [])
         tick_real_time
+        flush_module_rt
         invalidate_find_cache
         dom_call('__csimExecScript', code.to_s, marshal_args(args || []))
         drain_pending_navigation
@@ -3350,6 +3353,7 @@ module Capybara
         # is discarding — firing it against the next one would be a load event for a
         # document that never loaded.
         @window_load_due = false
+        @font_file_failed = nil   # a 404'd @font-face refetches on the next navigation (Chrome)
         # Background app requests must not cross the session boundary — QUIESCE them
         # before touching anything else. Diagnosed on Discourse (2026-08-22): a
         # leftover async image fetch, holding ActiveRecord's pinned-connection + pool
@@ -3494,10 +3498,97 @@ module Capybara
 
       def rack_fetch_body(url)
         result = rack_fetch('GET', url, '', {}, 'follow')
+        # What the asset's Resource Timing entry reports — kept beside the cached body (see
+        # `external_asset_source`), since the body alone is what the loader hands back.
+        Thread.current[:csim_asset_meta] = result && resource_timing_meta(result)
         return nil unless result && result['status'].to_i < 400
         result['body'].to_s
       end
 
+      # A module the graph loader just fetched (via `rack_fetch_body`, whose facts are stashed in
+      # `csim_asset_meta`) — collected so the bridge can file its 'script' Resource Timing entry.
+      # One per URL: the V8 loader's handle cache already skips a re-import before it fetches, but
+      # the QuickJS loader dedupes compilation only after the block returns, so it fetches a shared
+      # child once per importer — dedup here gives both engines the browser's one-entry-per-URL.
+      def note_module_fetch(url)
+        meta = Thread.current[:csim_asset_meta]
+        return unless meta
+
+        url  = url.to_s
+        list = (Thread.current[:csim_module_rt] ||= [])
+        list << {'url' => url, 'meta' => meta} unless list.any? {|m| m['url'] == url }
+      end
+      # The modules fetched since the last call, for the bridge to time as 'script' — cleared on read.
+      def take_module_rt
+        list = Thread.current[:csim_module_rt] || []
+        Thread.current[:csim_module_rt] = []
+        list
+      end
+
+      # The `{url, meta}` for the worker main-script fetch the last `worker_spawn` made (or nil) —
+      # the Worker / SharedWorker constructor reads it right after the spawn to file a 'other'
+      # (classic) / 'script' (module) Resource Timing entry in the creating realm. Cleared on read.
+      def take_worker_rt
+        rt = Thread.current[:csim_worker_rt]
+        Thread.current[:csim_worker_rt] = nil
+        rt
+      end
+
+      # File the Resource Timing entries for any module a dynamic `import()` fetched since the last
+      # drain, before a script reads `performance`. A static `<script type=module>` graph files its
+      # own entries inline (see `runModuleScript`, before the element's `load`); a dynamic import has
+      # no such follow-up, so this read-boundary flush is what files it — at the next driver read, so
+      # every Capybara assertion on `performance` sees it. Two known gaps of this backstop, kept
+      # small deliberately (the alternative — recording in the loader mid-resolution — re-enters V8
+      # from the host during module resolution, which the rusty_racer rendezvous makes risky): a
+      # dynamic import's entry is filed at drain time rather than fetch time, and a page that reads
+      # `performance` from within the import's own `.then` (before any driver read) won't see it yet.
+      # Gated on the thread-local so a module-free page never crosses into JS; routed through
+      # `dom_call` so the flush runs in the active realm (a `within_frame` dynamic import read from a
+      # different realm is filed there, not in the frame's `performance` — the remaining gap).
+      def flush_module_rt
+        return if (Thread.current[:csim_module_rt] || []).empty?
+
+        dom_call('__csimFlushModuleRt')
+      end
+
+      # A resource fetched only for its Resource Timing entry — a `<video>` / `<audio>` / `<embed>` /
+      # `<object>` / `<track>` source the driver does not otherwise decode or play. Returns the fetch
+      # facts (`resource_timing_meta`), or nil when the URL can't resolve; a 4xx/5xx still returns
+      # facts so the entry records, as a browser files one for a failed media load.
+      def resource_timing_fetch(url, cors = false, credentials = 'same-origin')
+        key = resolve_against_current(url.to_s)
+        return nil unless key.is_a?(String)
+        result = rack_fetch('GET', key, '', {}, 'follow', cors ? 'cors' : 'no-cors',
+                            credentials: credentials, client_url: @current_url, referrer: @current_url)
+        result && resource_timing_meta(result)
+      end
+
+      # The response facts a `PerformanceResourceTiming` entry is built from, without the body.
+      def resource_timing_meta(result)
+        {
+          'url'             => result['url'],
+          'status'          => result['status'].to_i,
+          'headers'         => {'content-type' => result['headers']&.find {|k, _| k.to_s.casecmp?('content-type') }&.last},
+          'bytes'           => result['bytes'].to_i,
+          'encoded'         => result['encoded'].to_i,
+          'cached'          => result['cached'],
+          'redirected'      => result['redirected'] == true,
+          'type'            => result['type'],
+          'tao'             => result['tao'],
+          'serverTiming'    => result['serverTiming'],
+          'contentEncoding' => result['contentEncoding']
+        }
+      end
+
+      # The metadata of the asset `external_asset_source` last served for `url` (nil when it
+      # never loaded).
+      def external_asset_meta(url)
+        needs_base = @current_url.to_s.start_with?('blob:', 'data:', 'about:')
+        key = resolve_against_current(url.to_s, use_base: needs_base)
+        key.is_a?(String) ? (@asset_meta ||= {})[key] : nil
+      end
+
       # Fetch a source body and report how long it stays safely reusable per its
       # OWN response headers — an absolute freshness deadline (Time), or nil when
       # the response is not durably cacheable (no-store / no-cache / max-age=0 /
@@ -3552,6 +3643,7 @@ module Capybara
       @@font_file_cache      = {}
       @@font_file_lock       = Mutex.new
       @@font_files           = []   # pins the Tempfiles for the PROCESS (the cache is cross-visit)
+      @@local_font_cache     = {}   # `local(<name>)` resolution — installed fonts don't change per process
 
       # Empty the process-wide HTTP cache: the RFC 9111 store behind `rack_fetch` plus
       # the URL-keyed memos layered on it — script / stylesheet source, @font-face
@@ -3588,14 +3680,20 @@ module Capybara
         return nil unless key.is_a?(String)
         @@asset_src_lock.synchronize do
           if (e = @@asset_src[key])
-            return e[0] if e[1].nil? || Time.now < e[1]
+            if e[1].nil? || Time.now < e[1]
+              (@asset_meta ||= {})[key] = e[2]
+              return e[0]
+            end
             @@asset_src.delete(key)
           end
         end
         # `durable_source` already does the spec-compliant fetch + header-driven
         # freshness (RFC 9111 max-age → absolute deadline); reuse it instead of
         # re-deriving `fresh_until` here.
+        Thread.current[:csim_asset_meta] = nil
         body, fresh_until = durable_source(key)
+        meta = Thread.current[:csim_asset_meta]
+        (@asset_meta ||= {})[key] = meta
         return nil unless body
         # Script / stylesheet source is TEXT, but the raw Rack / binread body
         # arrives BINARY-tagged (see `RuntimeShared.utf8_text`).
@@ -3603,7 +3701,7 @@ module Capybara
         if fresh_until
           @@asset_src_lock.synchronize do
             @@asset_src.clear if @@asset_src.size >= ASSET_SRC_MAX
-            @@asset_src[key] = [body, fresh_until]
+            @@asset_src[key] = [body, fresh_until, meta]
           end
         end
         body
@@ -4332,6 +4430,9 @@ module Capybara
         parent_worker = realm_id.to_i.negative? ? -realm_id.to_i : nil
         # The handle counter is bumped from worker threads too (nested spawns) — lock it.
         handle = @worker_init_lock.synchronize { @worker_seq += 1 }
+        # Clear any Resource Timing fact a preceding spawn left, so an early `worker_fail` below (which
+        # still returns a handle the JS registers) can't hand its constructor a stale entry.
+        Thread.current[:csim_worker_rt] = nil
         # A NESTED blob:/data: worker script would need the MAIN VM's blob registry from a
         # non-owning thread (the documented SEGV hazard) — fail it cleanly (onerror), the
         # same observable as before nested workers existed. Marshalling the blob read to
@@ -4379,6 +4480,18 @@ module Capybara
         elsif !sw_script
           fetch_worker_script(target)
         end
+        # Resource Timing for a DEDICATED worker's own main-script fetch — a browser files it in the
+        # creating context's timeline (a classic worker as 'other', a module worker as 'script'; the
+        # JS Worker constructor knows the type and reads this back after the spawn returns, filing it
+        # in its own realm). A SHARED worker's script is NOT a subresource of any one document, so it
+        # generates no entry (resource-timing/shared-worker-rt-entry); nor does a service worker's
+        # registration. Only for a script actually fetched over the network here: a blob:/data: script
+        # has no fetch to time, and an SW-intercepted worker script (`sw_script`, deferred) is timed
+        # by the SW path. `csim_asset_meta` is the fetch fact `fetch_worker_script`'s `rack_fetch_body`
+        # just stashed (cleared at the top of the spawn so a failed one can't leak).
+        if !service && !shared && !sw_script && body && target.match?(%r{\Ahttps?://}i)
+          Thread.current[:csim_worker_rt] = {'url' => target, 'meta' => Thread.current[:csim_asset_meta]}
+        end
         # A blob: worker script that didn't resolve (revoked / unavailable) fails the
         # same way — fire onerror rather than spawn a worker that runs nothing.
         return worker_fail(handle, 'Worker script could not be loaded') if target.start_with?('blob:') && body.to_s.empty?
@@ -7184,6 +7297,7 @@ module Capybara
       def load_image(url, cors = false, credentials = 'same-origin')
         key = resolve_against_current(url.to_s)
         return nil unless key.is_a?(String)
+        Thread.current[:csim_image_meta] = nil
         entry = cached_image(key, cors, credentials)
         return {'unsupported' => true} if entry == :unsupported
         # A valid zero-area image: complete + not broken, but no pixels. rsvg throws
@@ -7193,8 +7307,8 @@ module Capybara
         # non-zero area.
         tainted = image_tainted?(key, cors)
         return {'zeroSize' => true, 'width' => 0, 'height' => 0, 'tainted' => tainted} if entry == :zero_size
-        return nil unless entry
-        r = {'width' => entry['width'], 'height' => entry['height'], 'refId' => transfer_buffer_stash(entry['bytes']), 'colorSpace' => entry['colorSpace'], 'tainted' => tainted}
+        return undecodable_image_result unless entry
+        r = {'width' => entry['width'], 'height' => entry['height'], 'refId' => transfer_buffer_stash(entry['bytes']), 'colorSpace' => entry['colorSpace'], 'tainted' => tainted, 'encoded' => entry['encoded'], 'meta' => Thread.current[:csim_image_meta]}
         r['refIdP3'] = transfer_buffer_stash(entry['bytesP3']) if entry['bytesP3']
         r
       end
@@ -7258,12 +7372,19 @@ module Capybara
       # The thread-side body: everything except the transfer stash (engine-affine, done at
       # delivery on the main thread). Result mirrors `load_image`'s shapes with the raw entry.
       private def image_load_result(key, cors, credentials, origin_base)
+        Thread.current[:csim_image_meta] = nil
         entry = cached_image(key, cors, credentials, origin_base: origin_base)
         return {'unsupported' => true} if entry == :unsupported
         tainted = origin_tainted?(key, cors, client_url: origin_base)
         return {'zeroSize' => true, 'width' => 0, 'height' => 0, 'tainted' => tainted} if entry == :zero_size
-        return nil unless entry
-        { entry: entry, tainted: tainted }
+        return undecodable_image_result unless entry
+        { entry: entry, tainted: tainted, meta: Thread.current[:csim_image_meta] }
+      end
+      # A response that arrived but is no image: the element is broken, the resource was still
+      # fetched — its Resource Timing entry carries the real status and size.
+      private def undecodable_image_result
+        meta = Thread.current[:csim_image_meta]
+        meta ? {'broken' => true, 'meta' => meta} : nil
       end
 
       def image_loads_pending?
@@ -7319,7 +7440,7 @@ module Capybara
         return nil if r.nil?
         return r unless r.is_a?(Hash) && r.key?(:entry)
         entry = r[:entry]
-        out = {'width' => entry['width'], 'height' => entry['height'], 'refId' => transfer_buffer_stash(entry['bytes']), 'colorSpace' => entry['colorSpace'], 'tainted' => r[:tainted]}
+        out = {'width' => entry['width'], 'height' => entry['height'], 'refId' => transfer_buffer_stash(entry['bytes']), 'colorSpace' => entry['colorSpace'], 'tainted' => r[:tainted], 'encoded' => entry['encoded'], 'meta' => r[:meta]}
         out['refIdP3'] = transfer_buffer_stash(entry['bytesP3']) if entry['bytesP3']
         out
       end
@@ -7365,6 +7486,7 @@ module Capybara
         entry = decode_or_nil(bytes)
         # nil (broken) and :zero_size (valid but zero-area) both carry no bitmap to cache.
         return entry unless entry.is_a?(Hash)
+        entry['encoded'] = bytes.bytesize   # the resource's size for its Resource Timing entry
         @@image_cache_lock.synchronize do
           @@image_cache.clear if @@image_cache.size >= IMAGE_CACHE_MAX
           @@image_cache[cache_key] = entry
@@ -7389,6 +7511,18 @@ module Capybara
           # issued this request.
           result = rack_fetch('GET', key, '', {}, 'follow', cors ? 'cors' : nil, credentials: credentials,
                               client_url: origin_base, referrer: origin_base, body_raw: true)
+          # What the image's Resource Timing entry reports of the response — its content type,
+          # whether it was redirected to, its status and size — read back on this thread right
+          # after; a 404 is a response too (the element breaks, the entry keeps the status).
+          if result
+            Thread.current[:csim_image_meta] = {
+              'contentType' => result['headers'].find {|k, _| k.to_s.casecmp?('content-type') }&.last,
+              'tao'         => result['tao'],
+              'redirected'  => result['redirected'] == true,
+              'status'      => result['status'].to_i,
+              'encoded'     => result['encoded'].to_i
+            }
+          end
           return nil unless result && result['status'].to_i < 400
           bytes = result['body_raw'].to_s
           bytes.empty? ? nil : bytes
@@ -7542,6 +7676,11 @@ module Capybara
       # back to the mean.
       private def build_font_advance_table(family, weight_style)
         file = font_file_for_family(family, weight_style) or return nil
+        font_table_from_file(file)
+      end
+      # The table `__csim_fontAdvances` hands the flow, from one font FILE: printable-ASCII
+      # advances as em fractions, their mean, the x-height and the hhea line metrics.
+      private def font_table_from_file(file)
         g = font_glyph_data(file) or return nil
         upm = g[:upm].to_f
         return nil unless upm.positive?
@@ -8061,17 +8200,41 @@ module Capybara
       # the bytes through the Rack app (binary-safe) once and caching the temp path for
       # the process. Returns nil when the fetch fails.
       def font_file_for(url)
+        font_file_and_meta_for(url).first
+      end
+
+      # `[path, meta]`: the face's file on disk (nil when it could not be fetched or read) and
+      # the facts of the fetch that brought it (`resource_timing_meta`); a cross-visit cache hit
+      # reports the same facts as served from the cache (Chrome files a cached font with
+      # `transferSize` 0).
+      def font_file_and_meta_for(url)
         key = resolve_against_current(url.to_s)
-        return nil unless key.is_a?(String)
-        @@font_file_lock.synchronize { return @@font_file_cache[key] if @@font_file_cache.key?(key) }
+        return [nil, nil] unless key.is_a?(String)
+        @@font_file_lock.synchronize do
+          if @@font_file_cache.key?(key)
+            path, meta = @@font_file_cache[key]
+            return [path, meta && meta.merge('cached' => 'cache')]
+          end
+        end
+        if (failed = (@font_file_failed ||= {})[key])
+          return [nil, failed]
+        end
+        Thread.current[:csim_font_meta] = nil
         path = build_font_file(key)
-        @@font_file_lock.synchronize { @@font_file_cache[key] = path }
-        path
+        meta = Thread.current[:csim_font_meta]
+        if path
+          @@font_file_lock.synchronize { @@font_file_cache[key] = [path, meta] }
+        else
+          @font_file_failed[key] = meta          # remembered for THIS session only
+        end
+        [path, meta]
       end
 
       private def build_font_file(key)
         bytes = font_source_bytes(key)
         return nil unless bytes && !bytes.empty?
+        bytes = woff_to_sfnt(bytes)
+        return nil unless bytes
         require 'tempfile'
         # Keep the Tempfile object alive for the process so its file isn't reaped while
         # fontconfig may still read it; the cache holds the path.
@@ -8093,13 +8256,213 @@ module Capybara
           bytes = decode_data_url_body(key)
           bytes.empty? ? nil : bytes
         elsif key.match?(%r{\Ahttps?://}i)
-          result = rack_fetch('GET', key, '', {}, 'follow', body_raw: true)
+          # A font is a CORS fetch (CSS Fonts 4 §4.9.1): a cross-origin face without
+          # `Access-Control-Allow-Origin` fails, as in Chrome.
+          result = rack_fetch('GET', key, '', {}, 'follow', 'cors', credentials: 'same-origin',
+                              client_url: @current_url, referrer: @current_url, body_raw: true)
+          # The fetch's facts for the font's Resource Timing entry (read back by the caller
+          # on this thread), a 404 included.
+          Thread.current[:csim_font_meta] = result && resource_timing_meta(result)
           return nil unless result && result['status'].to_i < 400
           bytes = result['body_raw'].to_s
           bytes.empty? ? nil : bytes
         end
       end
 
+      # A WOFF container holds an SFNT's tables compressed; the metrics parser and pango want the
+      # plain SFNT, so it is rebuilt here. WOFF 1.0 (`wOFF`) zlib-inflates each table on its own;
+      # WOFF 2.0 (`wOF2`) Brotli-decompresses all of them as one stream and drops the glyf/loca
+      # GLYPH transform (which measurement doesn't need). Anything else is already an SFNT and is
+      # returned unchanged; nil means "not a font we can rebuild" and the face measures with the
+      # fallback family, as a WOFF2 file did before there was a decoder.
+      def woff_to_sfnt(bytes)
+        # Every parse below advances a byte cursor with `getbyte` but slices with `String#[]`,
+        # which counts CHARACTERS — so a font body that arrived tagged UTF-8 (a Rack app that did
+        # not mark its font response binary) would misalign the moment a high byte before an offset
+        # formed a valid multibyte sequence. Force binary once, at the door.
+        bytes = bytes.b
+        return woff1_to_sfnt(bytes) if bytes.bytesize > 44 && bytes[0, 4] == 'wOFF'
+        return woff2_to_sfnt(bytes) if bytes.bytesize > 48 && bytes[0, 4] == 'wOF2'
+        bytes
+      end
+
+      private def woff1_to_sfnt(bytes)
+        flavor, _len, num = bytes[4, 10].unpack('a4Nn')   # flavor @4, length @8, numTables @12
+        return nil unless num.positive? && bytes.bytesize >= 44 + num * 20
+        entries = (0...num).map {|i|
+          tag, off, comp, orig = bytes[44 + i * 20, 20].unpack('a4NNN')   # csum @16 recomputed on assembly
+          return nil if off + comp > bytes.bytesize
+          data = bytes[off, comp].to_s
+          data = Zlib::Inflate.inflate(data) if comp < orig
+          [tag, data]
+        }
+        assemble_sfnt(flavor, entries)
+      rescue StandardError
+        nil
+      end
+
+      # WOFF 2.0: the 48-byte header, a compact table directory (a flags byte, an optional tag,
+      # then UIntBase128 lengths), and a single Brotli stream holding every table's data in
+      # directory order. A `glyf` / `loca` pair is stored in a transformed GLYPH representation
+      # (its outlines), which the metrics tables — `head` / `hhea` / `hmtx` / `cmap` / `maxp` /
+      # `OS/2`, none of which an encoder transforms — don't depend on, so the transformed tables
+      # are skipped and the rest assembled into a metrics-faithful SFNT. `ttcf` collections and a
+      # transformed metric table (a rare `hmtx` transform) fall through to the fallback family.
+      WOFF2_KNOWN_TAGS = %w[
+        cmap head hhea hmtx maxp name OS/2 post cvt\  fpgm glyf loca prep CFF\  VORG EBDT EBLC gasp
+        hdmx kern LTSH PCLT VDMX vhea vmtx BASE GDEF GPOS GSUB EBSC JSTF MATH CBDT CBLC COLR CPAL
+        SVG\  sbix acnt avar bdat bloc bsln cvar fdsc feat fmtx fvar gcid hsty just lcar mort morx
+        opbd prop trak Zapf Silf Glat Gloc Feat Sill
+      ].freeze
+      private def woff2_to_sfnt(bytes)
+        flavor = bytes[4, 4]
+        return nil if flavor == 'ttcf'                    # font collections: not rebuilt
+        num, total_comp = bytes[12, 2].unpack1('n'), bytes[20, 4].unpack1('N')
+        return nil unless num.positive?
+        i = 48
+        tables = []
+        num.times do
+          return nil if i >= bytes.bytesize
+          flags = bytes.getbyte(i); i += 1
+          idx = flags & 0x3f
+          if idx == 0x3f                                  # 63: an arbitrary 4-byte tag follows
+            tag = bytes[i, 4]; i += 4
+          else
+            tag = WOFF2_KNOWN_TAGS[idx] or return nil
+          end
+          orig, i = uint_base128(bytes, i)
+          return nil unless orig
+          transformed = (tag == 'glyf' || tag == 'loca') ? ((flags >> 6).zero?) : ((flags >> 6) != 0)
+          len = orig
+          if transformed
+            len, i = uint_base128(bytes, i)
+            return nil unless len
+          end
+          tables << [tag, len, transformed]
+        end
+        comp = bytes[i, total_comp]
+        return nil unless comp && comp.bytesize == total_comp
+        data = brotli_decompress(comp) or return nil
+        # Slice each table out of the decompressed stream (directory order), keeping only the ones
+        # stored untransformed — the transformed glyf/loca occupy their bytes in the stream but are
+        # glyph outlines, not metrics.
+        off = 0
+        entries = []
+        tables.each do |tag, len, transformed|
+          entries << [tag, data[off, len]] unless transformed
+          off += len
+        end
+        return nil if off > data.bytesize || entries.empty?
+        assemble_sfnt(flavor, entries)
+      rescue StandardError
+        nil
+      end
+
+      # A UIntBase128 (WOFF2 §4.4): up to five 7-bit groups, most significant first, the top bit a
+      # continuation flag. Returns `[value, next_index]`, or `[nil, i]` on a malformed encoding (a
+      # leading `0x80`, over five bytes, or a value past 2³²−1) so the caller bails to the fallback.
+      private def uint_base128(bytes, i)
+        v = 0
+        5.times do |n|
+          return [nil, i] if i >= bytes.bytesize
+          b = bytes.getbyte(i); i += 1
+          return [nil, i] if n.zero? && b == 0x80        # no leading zero group
+          return [nil, i] if v > 0x01ff_ffff             # would overflow 32 bits after the shift
+          v = (v << 7) | (b & 0x7f)
+          return [v, i] if (b & 0x80).zero?
+        end
+        [nil, i]
+      end
+
+      # Assemble an SFNT from `[tag, data]` tables: the 12-byte offset table, a directory sorted by
+      # tag (spec order), then each table's data padded to a 4-byte boundary with a freshly summed
+      # table checksum. Shared by both WOFF rebuilders.
+      private def assemble_sfnt(flavor, entries)
+        entries = entries.map {|tag, data| [tag.to_s, data.to_s] }.sort_by {|tag, _| tag }
+        num = entries.size
+        entry_selector = Math.log2(num).floor
+        search_range   = (2**entry_selector) * 16
+        out    = [flavor, num, search_range, entry_selector, num * 16 - search_range].pack('a4nnnn')
+        offset = 12 + num * 16
+        dir  = +''
+        body = +''
+        entries.each do |tag, data|
+          dir  << [tag, sfnt_table_checksum(data), offset + body.bytesize, data.bytesize].pack('a4NNN')
+          body << data << ("\0" * ((4 - data.bytesize % 4) % 4))
+        end
+        (out << dir << body).b
+      end
+
+      # An SFNT table checksum: the sum of its 32-bit big-endian words (zero-padded to a 4-byte
+      # boundary), truncated to 32 bits.
+      private def sfnt_table_checksum(data)
+        padded = data + ("\0" * ((4 - data.bytesize % 4) % 4))
+        padded.unpack('N*').sum & 0xffff_ffff
+      end
+
+      # Brotli-decompress a raw stream (a WOFF2 font block) with the `brotli` gem (in-process, its
+      # own vendored C library). A decode error yields nil, so a malformed face falls back to the
+      # substitute family rather than crashing.
+      private def brotli_decompress(data)
+        out = Brotli.inflate(data)
+        out && out.b
+      rescue StandardError
+        nil
+      end
+
+      # The advance table of a downloaded face (an `@font-face` src), fetched through the
+      # HTTP layer like any resource, with the fetch's facts for its Resource Timing entry.
+      # `table` is nil when the file is no SFNT the parser reads (WOFF2, a 404, a broken file).
+      def font_advance_table_from_url(url)
+        file, meta = font_file_and_meta_for(url)
+        # `ok`: bytes arrived (a data: face has no fetch facts; an unreadable container no
+        # a face's `status` follows.
+        {'table' => file ? font_table_from_file(file) : nil, 'meta' => meta,
+         'ok'    => !file.nil? || (meta && meta['status'].to_i.between?(200, 399)) == true}
+      end
+
+      # A `local(<name>)` `@font-face` source: the advance table of the font INSTALLED under that
+      # name, or `ok: false` when this machine has no such font (fontconfig SUBSTITUTES silently, so
+      # `resolved_family_file` — the same exact-match test the family stack uses — is what tells a
+      # real installed face from a fallback). A face whose every `local()` misses and that has no
+      # readable `url()` then fails, as a browser rejects a UA font load it cannot satisfy.
+      def local_font_table(name, weight_style = '')
+        key = "#{name} #{weight_style}"
+        @@font_file_lock.synchronize do
+          return @@local_font_cache[key] if @@local_font_cache.key?(key)
+        end
+        file   = resolved_family_file(name.to_s, weight_style.to_s)
+        result = file ? {'table' => font_table_from_file(file), 'ok' => true} : {'table' => nil, 'ok' => false}
+        @@font_file_lock.synchronize { @@local_font_cache[key] = result }
+        result
+      end
+
+      # A face's own bytes (a `FontFace` built from a buffer, a `blob:` src): parsed like a
+      # downloaded file. `ok` is whether the bytes are a recognised font container (an
+      # OpenType-CFF buffer loads even though the metrics parser reads no glyf/loca table from
+      # it, so it measures with the fallback family). Content-addressed so identical bytes reuse
+      # one temp file, not one per call.
+      FONT_MAGIC = ["\x00\x01\x00\x00".b, 'OTTO'.b, 'true'.b, 'ttcf'.b, 'wOFF'.b, 'wOF2'.b].freeze
+      def font_advance_table_from_bytes(b64)
+        bytes = Base64.decode64(b64.to_s)
+        ok    = bytes.bytesize >= 4 && FONT_MAGIC.include?(bytes[0, 4].b)
+        return {'table' => nil, 'ok' => ok} unless ok
+        sfnt = woff_to_sfnt(bytes)
+        return {'table' => nil, 'ok' => true} if sfnt.nil? || sfnt.bytesize < 12
+        key  = "bytes:#{Digest::SHA256.hexdigest(sfnt)}"
+        path = @@font_file_lock.synchronize { @@font_file_cache[key]&.first }
+        unless path
+          require 'tempfile'
+          file = Tempfile.new(['csim-font', '.bin'])
+          file.binmode
+          file.write(sfnt)
+          file.flush
+          @@font_file_lock.synchronize { @@font_files << file; @@font_file_cache[key] = [file.path, nil] }
+          path = file.path
+        end
+        {'table' => font_table_from_file(path), 'ok' => true}
+      end
+
       def reset_workers
         # Ask first, and stop the JS half in the same pass: the `:terminate` message is only read
         # BETWEEN messages, so a worker inside a long JS call would otherwise not see it until that
@@ -9271,10 +9634,12 @@ module Capybara
 
       def resolve_against(url, base)
         return url if url =~ %r{\A[a-z]+://}i
-        # quickjs.rb's module_loader passes the importer for nested
-        # relative imports; if the importer was an inline-script
-        # pseudo-name (no scheme), fall through to the page URL.
-        base = nil unless base.is_a?(String) && base =~ %r{\A[a-z]+://}i
+        # quickjs.rb's module_loader passes the importer for nested relative imports (and for a
+        # dynamic `import()`, the importer is the referring script). An inline script / module has no
+        # real URL — its pseudo-name is `<eval>` (no scheme, from V8) or `inline://<hash>` (from
+        # `__csim_runScript`) — so a specifier must resolve against the PAGE URL, not the pseudo-name.
+        # Fall through for a base that is not a real URL or is one of those `inline:` pseudo-names.
+        base = nil unless base.is_a?(String) && base =~ %r{\A[a-z]+://}i && !base.start_with?('inline:')
         eff = base || @current_url || @default_host
         # Memo of `URI.join(eff, url)` — a pure function of (effective base, url).
         # A heavy ESM app re-resolves the same ~80 module specifiers against the
@@ -9539,7 +9904,7 @@ module Capybara
             end
             # Cached asset — log headers/type/size but skip the (boring) body.
             trace_network(method, target, cache_entry.status, headers, body, cache_entry.headers, nil, t0, false)
-            return response_hash(cache_entry.status, cache_entry.headers, cache_entry.body, target, redirected, body_raw: body_raw)
+            return response_hash(cache_entry.status, cache_entry.headers, cache_entry.body, target, redirected, body_raw: body_raw, cached: 'cache', encoded: cache_entry.encoded)
           end
           # only-if-cached forbids the network: no usable stored response → a network error.
           return nil if cache_mode == 'only-if-cached'
@@ -9687,7 +10052,7 @@ module Capybara
             # be re-filtered through the CORS exposed-header set on the way back to script —
             # a 304 revalidation must not leak headers the original cross-origin fetch hid.
             cached_headers = cross_origin ? cors_exposed_headers(cache_entry.headers, with_credentials) : cache_entry.headers
-            return response_hash(cache_entry.status, cached_headers, cache_entry.body, target, redirected, body_raw: body_raw)
+            return response_hash(cache_entry.status, cached_headers, cache_entry.body, target, redirected, body_raw: body_raw, cached: 'validated', raw_headers: cache_entry.headers, encoded: cache_entry.encoded)
           end
           # Fetch "CORS check" runs on EVERY cross-origin response — including a 3xx the
           # UA is about to follow (a redirect whose response lacks a valid Access-Control
@@ -9797,7 +10162,9 @@ module Capybara
           null_body = method.to_s.upcase == 'HEAD' || NULL_BODY_STATUSES.include?(status.to_i)
           body_str = '' if null_body
           # The UA transparently decodes a Content-Encoding'd body (gzip/deflate); the
-          # header stays, the bytes are inflated (response-data-gzip / -deflate).
+          # header stays, the bytes are inflated (response-data-gzip / -deflate). The size on
+          # the wire is what Resource Timing's `encodedBodySize` reports.
+          encoded_size = body_str.bytesize
           body_str = decode_content_encoding(body_str, resp_headers)
           # A cross-origin response only EXPOSES (getResponseHeader / getAllResponseHeaders)
           # the CORS-safelisted response headers plus those named in Access-Control-Expose
@@ -9817,12 +10184,12 @@ module Capybara
           # the author's own conditional bypasses the UA cache entirely (read AND write) — it's
           # "treated similarly to no-store" (request-cache-default-conditional). Every other mode
           # (incl. reload, which refreshes it) stores a cacheable GET response.
-          @@asset_cache.store(target, status, resp_headers, body_str) if method == 'GET' && cache_mode != 'no-store' && !skip_cache
+          @@asset_cache.store(target, status, resp_headers, body_str, encoded: encoded_size) if method == 'GET' && cache_mode != 'no-store' && !skip_cache
           # A no-cors cross-origin response is OPAQUE: status 0, empty body, no exposed
           # headers, empty URL (cors-basic "Opaque filter"). Otherwise the type is 'cors'
           # for a cross-origin (CORS-allowed) response, else 'basic'.
-          return response_hash(0, {}, '', '', false, type: 'opaque', body_null: true, opaque_render: body_str) if no_cors_mode && crossed
-          return response_hash(status, exposed_headers, body_str, target, redirected, type: crossed ? 'cors' : 'basic', body_null: null_body, body_raw: body_raw)
+          return response_hash(0, {}, '', '', false, type: 'opaque', body_null: true, opaque_render: body_str, encoded: encoded_size) if no_cors_mode && crossed
+          return response_hash(status, exposed_headers, body_str, target, redirected, type: crossed ? 'cors' : 'basic', body_null: null_body, body_raw: body_raw, encoded: encoded_size, raw_headers: resp_headers)
         end
         raise StandardError, "[capybara-simulated] fetch exceeded #{MAX_FETCH_REDIRECTS} redirects"
       rescue StandardError => e
@@ -9931,15 +10298,28 @@ module Capybara
       # that decodes the bytes here and never shows them to script): the bytes ride
       # `body_raw` untouched and the text decode + base64 are skipped — they would be
       # ~15 ms per MB of pure waste on a path that runs for EVERY image load.
-      def response_hash(status, headers, body, url, redirected, type: 'basic', body_null: false, opaque_render: nil, body_raw: false)
+      def response_hash(status, headers, body, url, redirected, type: 'basic', body_null: false, opaque_render: nil, body_raw: false, cached: nil, encoded: nil, raw_headers: nil)
         raw     = body.to_s
         hdrs    = stringify(headers)
+        # Resource Timing's sizes: the decoded body, the body on the wire (before a
+        # Content-Encoding was undone), and whether the HTTP cache served it — fresh
+        # (`'cache'`: nothing crossed the wire) or after a 304 (`'validated'`: headers did) —
+        # plus the three headers its checks read from the UNFILTERED response (a cross-origin
+        # fetch exposes only the CORS-safelisted headers to script, and none of these is).
+        timing  = {'bytes' => raw.bytesize, 'encoded' => encoded || raw.bytesize, 'cached' => cached}
+        (raw_headers || headers).each do |k, v|
+          case k.to_s.downcase
+          when 'timing-allow-origin' then timing['tao'] = v.is_a?(Array) ? v.join(', ') : v.to_s
+          when 'server-timing'       then timing['serverTiming'] = v.is_a?(Array) ? v.join(', ') : v.to_s
+          when 'content-encoding'    then timing['contentEncoding'] = v.is_a?(Array) ? v.join(', ') : v.to_s
+          end
+        end
         # A NUL in a header value is not a valid HTTP message; a real server can't
         # put it on the wire, so the fetch is a network error (nil → status 0 / a
         # thrown NetworkError for a sync XHR). See headers-normalize-response.
         return nil if hdrs.any? {|_, v| v.include?("\u0000") }
         if body_raw
-          return {
+          return timing.merge(
             'status'     => status,
             'statusText' => '',
             'headers'    => hdrs,
@@ -9948,7 +10328,7 @@ module Capybara
             'url'        => url,
             'redirected' => redirected,
             'type'       => type
-          }
+          )
         end
         is_text = text_response?(hdrs)
         # `body` crosses as TEXT — `responseText` semantics: the bytes decoded
@@ -9979,7 +10359,7 @@ module Capybara
         # off the document URL — the same signal WPT uses to serve the resource over h2
         # (fetch/xhr status.h2 "statusText over H2 … should be the empty string").
         reason = '' if @current_url.to_s.include?('.h2.')
-        out = {
+        out = timing.merge(
           'status'     => status,
           'statusText' => reason,
           'headers'    => hdrs,
@@ -9987,7 +10367,7 @@ module Capybara
           'url'        => url,
           'redirected' => redirected,
           'type'       => type
-        }
+        )
         out['body_null'] = true if body_null   # null-body status / HEAD → response.body is null
         # The BOM-detected encoding (if any) — a frame load pins its document's
         # characterSet to it (see __csimFrameWindow); highest-precedence signal.