@podosoft/podokit 1.4.1 → 1.5.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 
 const PNG = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
@@ -173,8 +174,8 @@ test("account security and sessions sub-navigation", async ({ page }) => {
 /**
  * ⚠ THE SUITE ALWAYS SIGNS IN FIRST, WHICH IS WHY THIS NEEDED A MOCK.
  *
- * better-auth guards `/list-sessions` with its freshness middleware and
- * `session.freshAge` defaults to 24 hours, so the endpoint returns 403
+ * The sessions list keeps better-auth's freshness rule, and `session.freshAge`
+ * defaults to 24 hours, so `GET /api/account/sessions` returns 403
  * `SESSION_NOT_FRESH` to anyone who signed in yesterday. The seeded session is
  * minutes old, so the test above passes for every run while the screen is broken for
  * real users — the tab showed an empty table under an untranslated "Session is not
@@ -182,11 +183,14 @@ test("account security and sessions sub-navigation", async ({ page }) => {
  * own setup prevents.
  */
 test("sessions tab explains a session that is too old to list them", async ({ page }) => {
-  await page.route("**/api/auth/list-sessions", (route) =>
+  await page.route("**/api/account/sessions?*", (route) =>
     route.fulfill({
       status: 403,
       contentType: "application/json",
-      body: JSON.stringify({ message: "Session is not fresh", code: "SESSION_NOT_FRESH" }),
+      body: JSON.stringify({
+        success: false,
+        error: { code: "SESSION_NOT_FRESH", message: "Session is not fresh", statusCode: 403 },
+      }),
     }),
   );
 
@@ -227,54 +231,57 @@ test("account nav shows the core sections", async ({ page }) => {
 });
 
 test("connected account unlink uses the local account row id @smoke", async ({ page }) => {
-  const provider = "google";
-  let unlinkBody: unknown;
-  await page.route("**/api/auth/list-accounts", (route) =>
-    route.fulfill({
-      status: 200,
-      contentType: "application/json",
-      body: JSON.stringify([
-        { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
-      ]),
-    }),
-  );
-  await page.route("**/api/auth/unlink-account", async (route) => {
-    unlinkBody = route.request().postDataJSON();
-    await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
-  });
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const provider = "google";
+    let unlinkBody: unknown;
+    await page.route("**/api/auth/list-accounts", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify([
+          { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
+        ]),
+      }),
+    );
+    await page.route("**/api/auth/unlink-account", async (route) => {
+      unlinkBody = route.request().postDataJSON();
+      await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
+    });
 
-  try {
-    const enabled = await page.request.put("/api/account/auth-config", {
-      data: {
-        social: {
-          [provider]: {
-            enabled: true,
-            clientId: "podokit",
-            clientSecret: "podokit",
+    try {
+      const enabled = await page.request.put("/api/account/auth-config", {
+        data: {
+          social: {
+            [provider]: {
+              enabled: true,
+              clientId: "podokit",
+              clientSecret: "podokit",
+            },
           },
         },
-      },
-    });
-    expect(enabled.ok()).toBeTruthy();
-    await expect
-      .poll(async () => {
-        const response = await page.request.get("/api/account/capabilities");
-        const body = (await response.json()) as { providers?: string[] };
-        return body.providers ?? [];
-      }, { timeout: 8_000 })
-      .toContain(provider);
+      });
+      expect(enabled.ok()).toBeTruthy();
+      await expect
+        .poll(async () => {
+          const response = await page.request.get("/api/account/capabilities");
+          const body = (await response.json()) as { providers?: string[] };
+          return body.providers ?? [];
+        }, { timeout: 8_000 })
+        .toContain(provider);
 
-    await ready(page, "/admin/account");
-    await page.getByRole("button", { name: "Connected", exact: true }).click();
-    await page.getByRole("button", { name: "Disconnect", exact: true }).click();
+      await ready(page, "/admin/account");
+      await page.getByRole("button", { name: "Connected", exact: true }).click();
+      await page.getByRole("button", { name: "Disconnect", exact: true }).click();
 
-    await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
-    await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
-  } finally {
-    await page.request.put("/api/account/auth-config", {
-      data: { social: { [provider]: { enabled: false } } },
-    });
-  }
+      await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
+      await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
+    } finally {
+      await page.request.put("/api/account/auth-config", {
+        data: { social: { [provider]: { enabled: false } } },
+      });
+    }
+  });
 });
 
 test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default). The Appearance controls live in their
 // own "Appearance" settings tab.
@@ -49,16 +50,19 @@ test("appearance: advanced reveals per-token pickers", async ({ page }) => {
 });
 
 test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
-  await openAppearance(page);
-  await page.getByRole("button", { name: "Slate" }).click();
-  await page.getByRole("button", { name: "Medium" }).click();
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.").first()).toBeVisible();
-  // Applied globally via the scoped override stylesheet.
-  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+  test.slow();
+  await exclusive("site-theme", async () => {
+    await openAppearance(page);
+    await page.getByRole("button", { name: "Slate" }).click();
+    await page.getByRole("button", { name: "Medium" }).click();
+    await page.getByRole("button", { name: "Save changes" }).click();
+    await expect(page.getByText("General settings saved.").first()).toBeVisible();
+    // Applied globally via the scoped override stylesheet.
+    await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
 
-  // "Restore defaults" reverts everything in one click and persists.
-  await page.getByRole("button", { name: "Restore defaults" }).click();
-  await expect(page.getByText("General settings saved.").first()).toBeVisible();
-  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+    // "Restore defaults" reverts everything in one click and persists.
+    await page.getByRole("button", { name: "Restore defaults" }).click();
+    await expect(page.getByText("General settings saved.").first()).toBeVisible();
+    await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -2,6 +2,7 @@ import { expect, test } from "@playwright/test";
 import { safeAuthRedirect, withAuthRedirect } from "../../apps/web/src/lib/auth-redirect";
 import { anonState, ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -66,39 +67,42 @@ test("closed social registration errors explain that existing users may sign in"
 });
 
 test("configured social providers appear on the login page", async ({ page, playwright }) => {
-  const admin = await playwright.request.newContext({
-    baseURL: base,
-    extraHTTPHeaders: { origin: base },
-  });
-  await admin.post("/api/auth/sign-in/email", {
-    data: { email: ADMIN.email, password: ADMIN.password },
-  });
-  try {
-    expect(
-      (await admin.put("/api/account/auth-config", {
-        data: {
-          social: {
-            google: {
-              enabled: true,
-              clientId: "dummy-google-client-id",
-              clientSecret: "dummy-google-client-secret",
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const admin = await playwright.request.newContext({
+      baseURL: base,
+      extraHTTPHeaders: { origin: base },
+    });
+    await admin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    try {
+      expect(
+        (await admin.put("/api/account/auth-config", {
+          data: {
+            social: {
+              google: {
+                enabled: true,
+                clientId: "dummy-google-client-id",
+                clientSecret: "dummy-google-client-secret",
+              },
             },
           },
-        },
-      })).ok(),
-    ).toBeTruthy();
-    await expect
-      .poll(async () => {
-        await page.goto("/login");
-        return page.getByRole("button", { name: "Continue with Google" }).count();
-      }, { timeout: 8_000 })
-      .toBe(1);
-  } finally {
-    await admin.put("/api/account/auth-config", {
-      data: { social: { google: { enabled: false } } },
-    });
-    await admin.dispose();
-  }
+        })).ok(),
+      ).toBeTruthy();
+      await expect
+        .poll(async () => {
+          await page.goto("/login");
+          return page.getByRole("button", { name: "Continue with Google" }).count();
+        }, { timeout: 8_000 })
+        .toBe(1);
+    } finally {
+      await admin.put("/api/account/auth-config", {
+        data: { social: { google: { enabled: false } } },
+      });
+      await admin.dispose();
+    }
+  });
 });
 
 test("forgot-password shows a sent confirmation", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -1,12 +1,14 @@
 import { expect, test, type Page } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // Verifies that the General settings actually take effect (not just persist).
 // The admin storageState (project default) drives the toggles; a fresh anonymous
-// context checks the public-facing result. Serial workers (workers:1) make the
-// toggle-then-restore pattern safe for the rest of the suite; restores run in a
-// `finally` so a mid-test failure still leaves the shared site settings clean.
+// context checks the public-facing result. The site-general lock keeps other
+// specs that save these settings out while one runs, also with --workers above
+// 1; restores run in a `finally` so a mid-test failure still leaves the shared
+// site settings clean.
 
 async function saveGeneral(
   page: Page,
@@ -29,97 +31,109 @@ async function saveGeneral(
 }
 
 test("general: empty locale displays the application default", async ({ page }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  const settingsUrl = `${origin}/api/site/settings`;
-  const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
-
-  try {
-    expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
-    await expect(page.locator("#locale")).toContainText("English");
-  } finally {
-    await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
-  }
+    const origin = new URL(page.url()).origin;
+    const settingsUrl = `${origin}/api/site/settings`;
+    const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
+
+    try {
+      expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+      await ready(page, "/admin/settings");
+      await expect(page.locator("#locale")).toContainText("English");
+    } finally {
+      await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
+    }
+  });
 });
 
 test("general: footer text and links render on public pages", async ({ page, browser }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  const footer = page.getByLabel("Footer text");
-  const support = page.getByLabel("Support email");
-  const origFooter = await footer.inputValue();
-  const origSupport = await support.inputValue();
-  await saveGeneral(
-    page,
-    async () => {
-      await footer.fill("© 2026 PodoKit Test");
-      await support.fill("help@example.com");
-    },
-    { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
-  );
-  try {
-    const ctx = await browser.newContext({ storageState: anonState });
-    const anon = await ctx.newPage();
-    await anon.goto(`${origin}/login`);
-    await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
-    await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
-    await ctx.close();
-  } finally {
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
+    const origin = new URL(page.url()).origin;
+    const footer = page.getByLabel("Footer text");
+    const support = page.getByLabel("Support email");
+    const origFooter = await footer.inputValue();
+    const origSupport = await support.inputValue();
     await saveGeneral(
       page,
       async () => {
-        await page.getByLabel("Footer text").fill(origFooter);
-        await page.getByLabel("Support email").fill(origSupport);
+        await footer.fill("© 2026 PodoKit Test");
+        await support.fill("help@example.com");
       },
-      { footerText: origFooter, supportEmail: origSupport },
+      { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
     );
-  }
+    try {
+      const ctx = await browser.newContext({ storageState: anonState });
+      const anon = await ctx.newPage();
+      await anon.goto(`${origin}/login`);
+      await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
+      await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+      await ctx.close();
+    } finally {
+      await ready(page, "/admin/settings");
+      await saveGeneral(
+        page,
+        async () => {
+          await page.getByLabel("Footer text").fill(origFooter);
+          await page.getByLabel("Support email").fill(origSupport);
+        },
+        { footerText: origFooter, supportEmail: origSupport },
+      );
+    }
+  });
 });
 
 test("general: maintenance mode holds non-admins on the maintenance page", async ({ page, browser }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  await page.getByRole("switch", { name: "Maintenance mode" }).click();
-  await saveGeneral(page);
-  try {
-    const ctx = await browser.newContext({ storageState: anonState });
-    const anon = await ctx.newPage();
-    await anon.goto(`${origin}/`);
-    await expect(anon).toHaveURL(/\/maintenance$/);
-    await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
-    await ctx.close();
-    // the admin is not held back
-    await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
-  } finally {
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
-    const t = page.getByRole("switch", { name: "Maintenance mode" });
-    if (await t.isChecked()) {
-      await t.click();
-      await saveGeneral(page);
+    const origin = new URL(page.url()).origin;
+    await page.getByRole("switch", { name: "Maintenance mode" }).click();
+    await saveGeneral(page);
+    try {
+      const ctx = await browser.newContext({ storageState: anonState });
+      const anon = await ctx.newPage();
+      await anon.goto(`${origin}/`);
+      await expect(anon).toHaveURL(/\/maintenance$/);
+      await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
+      await ctx.close();
+      // the admin is not held back
+      await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+    } finally {
+      await ready(page, "/admin/settings");
+      const t = page.getByRole("switch", { name: "Maintenance mode" });
+      if (await t.isChecked()) {
+        await t.click();
+        await saveGeneral(page);
+      }
     }
-  }
+  });
 });
 
 test("general: closing sign-up redirects /signup and hides the link", async ({ page, browser }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  await page.getByRole("switch", { name: "Allow public sign-up" }).click();
-  await saveGeneral(page);
-  try {
-    const ctx = await browser.newContext({ storageState: anonState });
-    const anon = await ctx.newPage();
-    await anon.goto(`${origin}/signup`);
-    await expect(anon).toHaveURL(/\/login/);
-    await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
-    await ctx.close();
-  } finally {
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
-    const t = page.getByRole("switch", { name: "Allow public sign-up" });
-    if (!(await t.isChecked())) {
-      await t.click();
-      await saveGeneral(page);
+    const origin = new URL(page.url()).origin;
+    await page.getByRole("switch", { name: "Allow public sign-up" }).click();
+    await saveGeneral(page);
+    try {
+      const ctx = await browser.newContext({ storageState: anonState });
+      const anon = await ctx.newPage();
+      await anon.goto(`${origin}/signup`);
+      await expect(anon).toHaveURL(/\/login/);
+      await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
+      await ctx.close();
+    } finally {
+      await ready(page, "/admin/settings");
+      const t = page.getByRole("switch", { name: "Allow public sign-up" });
+      if (!(await t.isChecked())) {
+        await t.click();
+        await saveGeneral(page);
+      }
     }
-  }
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/i18n.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, adminState, anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -23,23 +24,26 @@ test("language switch updates messages and <html lang>", async ({ page }) => {
 });
 
 test("explicit English overrides a Korean site fallback", async ({ page, playwright }) => {
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await admin.post("/api/auth/sign-in/email", {
-    data: { email: ADMIN.email, password: ADMIN.password },
-  });
-  const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
+  test.slow();
+  await exclusive("site-general", async () => {
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    await admin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
 
-  try {
-    expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
-    await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
-    await ready(page, "/login");
+    try {
+      expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
+      await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
+      await ready(page, "/login");
 
-    await expect(page.locator("html")).toHaveAttribute("lang", "en");
-    await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
-  } finally {
-    await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
-    await admin.dispose();
-  }
+      await expect(page.locator("html")).toHaveAttribute("lang", "en");
+      await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
+    } finally {
+      await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
+      await admin.dispose();
+    }
+  });
 });
 
 test("managed admin labels react to locale changes", async ({ browser }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -1,5 +1,6 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Page } from "@playwright/test";
 import { createHash, randomBytes } from "node:crypto";
+import { exclusive } from "../helpers/exclusive";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — the admin is the resource owner.
@@ -14,6 +15,12 @@ const REDIRECT = "https://example.com/callback";
 // back-channel token exchange is driven by an OIDC client SDK / real RP — see
 // docs/modules.md for the manual round-trip checklist.
 test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
+  // tests/api/auth.api.spec.ts also toggles the provider; the lock keeps the two apart.
+  test.slow();
+  await exclusive("oidc-provider", () => frontChannel(page, baseURL));
+});
+
+async function frontChannel(page: Page, baseURL: string | undefined): Promise<void> {
   const headers = { origin: baseURL ?? "" };
   const enabled = await page.request.put("/api/account/settings", {
     data: { oidcProvider: true },
@@ -30,7 +37,14 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
       expect(typeof disc[field]).toBe("string");
     }
     // JWKS exposes at least one signing key (the OAuth provider needs it for id_tokens).
-    const jwks = await (await page.request.get(disc.jwks_uri)).json();
+    // Discovery names BETTER_AUTH_URL's origin, which can be a public tunnel
+    // (publicUrl in .podokit/dev.json) that this runner cannot reach, so read the
+    // key set's path from the app under test.
+    const jwksUri = new URL(disc.jwks_uri);
+    expect(jwksUri.origin).toBe(new URL(disc.issuer).origin);
+    const jwksResponse = await page.request.get(`${jwksUri.pathname}${jwksUri.search}`);
+    expect(jwksResponse.ok(), await jwksResponse.text()).toBeTruthy();
+    const jwks = await jwksResponse.json();
     expect(Array.isArray(jwks.keys) && jwks.keys.length).toBeTruthy();
 
     // Dynamic client registration returns usable credentials. Retry: right after
@@ -82,4 +96,4 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     });
     expect(disabled.ok(), await disabled.text()).toBeTruthy();
   }
-});
+}

package/dist/templates/modules/admin-dashboard/files/tests/ui/request-budget.ui.spec.ts

@@ -18,6 +18,19 @@ test("the first render does not embed the message catalogs", async ({ page }) =>
 });
 
 test("client navigation keeps the server checks without resending messages", async ({ page }) => {
+  // Read each page-data body on its way to the page. Chromium reports a
+  // __data.json fetch as aborted (net::ERR_ABORTED) once SvelteKit has consumed
+  // its body, and then keeps no body for response.text() to return.
+  const pending = new Map<string, (body: string) => void>();
+  await page.route(
+    (url) => url.pathname.endsWith("/__data.json"),
+    async (route) => {
+      const response = await route.fetch();
+      const body = await response.text();
+      pending.get(new URL(route.request().url()).pathname)?.(body);
+      await route.fulfill({ response, body });
+    },
+  );
   await ready(page, "/admin");
   await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
 
@@ -29,13 +42,9 @@ test("client navigation keeps the server checks without resending messages", asy
     ["Overview", "/admin", "Dashboard"],
   ];
   for (const [link, path, heading] of stops) {
-    // Read each body before the next click: once the page navigates on, the
-    // previous response body is no longer available.
-    const data = page.waitForResponse(
-      (response) => new URL(response.url()).pathname === `${path}/__data.json`,
-    );
+    const data = new Promise<string>((resolve) => pending.set(`${path}/__data.json`, resolve));
     await sidebar.getByRole("link", { name: link, exact: true }).click();
-    const body = await (await data).text();
+    const body = await data;
     expect(body).not.toContain('"messages"');
     expect(body.length).toBeLessThan(20_000);
     await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();