@sdods/core 0.3.2 → 0.5.1

package/dist/load-module.js

@@ -0,0 +1,70 @@
+import { pathToFileURL } from 'node:url';
+/**
+ * Import a TypeScript module that belongs to a project (`steps/auth.ts` and friends) from outside
+ * the Playwright runner.
+ *
+ * `sdods run` loads project files through Playwright's TS loader, which transpiles full
+ * TypeScript, remaps `import './helper.js'` to `helper.ts`, and treats a file as ESM or CommonJS
+ * by its package type. A bare `import()` from a CLI command hands the file to Node's native type
+ * stripping instead, which does none of the remapping — so a helper imported the conventional way
+ * worked under `sdods run` and crashed `sdods auth capture` with "Cannot find module .../helper.js"
+ * (#86). In the workspace the gap was invisible, because bin/sdods.js registers tsx globally.
+ *
+ * tsx gives the same three behaviours as Playwright's loader. Both its ESM and CommonJS hooks are
+ * registered — a project without `"type": "module"` loads `.ts` as CommonJS, and a CommonJS
+ * `require('./helper.js')` only goes through tsx's CJS hook — and removed again once the import
+ * settles, so nothing else in the process is affected. Registrations are reference-counted so
+ * overlapping imports do not unregister each other's hooks mid-load.
+ */
+let active = 0;
+let hooks;
+async function acquire() {
+    active++;
+    hooks ??= (async () => {
+        const [esm, cjs] = await Promise.all([import('tsx/esm/api'), import('tsx/cjs/api')]);
+        const offEsm = esm.register();
+        const offCjs = cjs.register();
+        return async () => {
+            offCjs();
+            await offEsm();
+        };
+    })();
+    try {
+        await hooks;
+    }
+    catch (e) {
+        // Do not leave a rejected registration cached for every later import.
+        if (--active === 0)
+            hooks = undefined;
+        throw e;
+    }
+}
+async function releaseOne() {
+    if (--active > 0 || !hooks)
+        return;
+    const off = hooks;
+    hooks = undefined;
+    await (await off)();
+}
+export async function importProjectModule(file) {
+    await acquire();
+    try {
+        return (await import(pathToFileURL(file).href));
+    }
+    finally {
+        await releaseOne();
+    }
+}
+/**
+ * A named export from a module loaded by {@link importProjectModule}. A CommonJS-format file (no
+ * `"type": "module"` in the project) arrives with its exports under `default`.
+ */
+export function namedExport(mod, name) {
+    if (mod[name] !== undefined)
+        return mod[name];
+    const def = mod.default;
+    if (def && typeof def === 'object' && def[name] !== undefined)
+        return def[name];
+    return undefined;
+}
+//# sourceMappingURL=load-module.js.map

package/dist/logger.d.ts

@@ -1,4 +1,5 @@
 export type LogLevel = 'silent' | 'error' | 'warn' | 'info' | 'step' | 'debug';
+export declare function isSecretKey(name: string): boolean;
 export declare function setLogLevel(level: LogLevel): void;
 export declare function setLogJson(enabled: boolean): void;
 export declare function getLogLevel(): LogLevel;

package/dist/logger.js

@@ -9,7 +9,11 @@ const ORDER = {
 };
 let globalLevel = process.env.SDODS_LOG_LEVEL || 'info';
 let jsonMode = process.env.SDODS_LOG_JSON === '1';
-const SECRET_KEY = /(password|secret|token|apikey|api_key|authorization|cookie)/i;
+/** Key names whose string values are credentials: config fields, header names, log fields. */
+const SECRET_KEY = /(passw(or)?d|secret|token|api[-_]?key|[-_]key$|authorization|cookie|credential)/i;
+export function isSecretKey(name) {
+    return SECRET_KEY.test(name);
+}
 export function setLogLevel(level) {
     globalLevel = level;
 }
@@ -26,9 +30,11 @@ export function redact(value, depth = 0) {
         return value.map((v) => redact(v, depth + 1));
     if (value && typeof value === 'object') {
         const out = {};
+        // Header auth (`{ type: header, name, value }`) keeps its secret under a neutral key.
+        const headerAuth = value.type === 'header';
         for (const [k, v] of Object.entries(value)) {
-            out[k] =
-                SECRET_KEY.test(k) && typeof v === 'string' && v.length > 0 ? '***' : redact(v, depth + 1);
+            const secret = SECRET_KEY.test(k) || (headerAuth && k === 'value');
+            out[k] = secret && typeof v === 'string' && v.length > 0 ? '***' : redact(v, depth + 1);
         }
         return out;
     }

package/dist/steps/a11y.steps.js

@@ -3,7 +3,7 @@ import { expect } from '@playwright/test';
 import { attachmentNames, scenarioFiles } from '@sdods/contracts';
 import './params.js';
 import { Then } from '../fixtures/test.js';
-import { render } from '../api/template.js';
+import { renderStrict } from '../api/template.js';
 import { SdodsError } from '../errors.js';
 import { Logger } from '../logger.js';
 /**
@@ -449,7 +449,7 @@ Then('the page should have no accessibility violations', async ({ page, scenario
  * an empty context happily and reports zero violations, which is indistinguishable from a pass.
  */
 Then('the page should have no accessibility violations within {string}', async ({ page, scenario, apiContext, env, $bddContext, $testInfo }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     await requireRegion(page, sel);
     const results = await runAxe(page, { include: sel });
     attachA11y({ scenario, testInfo: $testInfo, stepIndex: $bddContext.stepIndex }, results);
@@ -462,7 +462,7 @@ Then('the page should have no accessibility violations within {string}', async (
  * nothing — "or worse than banana" would otherwise be the greenest step in the suite.
  */
 Then('the page should have no accessibility violations of impact {string} or worse', async ({ page, scenario, apiContext, env, $bddContext, $testInfo }, level) => {
-    const floor = parseImpactFloor(render(level, ...scopesOf(apiContext, env)));
+    const floor = parseImpactFloor(renderStrict(level, ...scopesOf(apiContext, env)));
     const results = await runAxe(page, {});
     attachA11y({ scenario, testInfo: $testInfo, stepIndex: $bddContext.stepIndex }, results);
     assertAxeChecked(results, `on ${page.url()}`);
@@ -472,8 +472,8 @@ Then('the page should have no accessibility violations of impact {string} or wor
 /** PROVES a region carries no violation at or above a severity — the scoped form of the above. */
 Then('the page should have no accessibility violations of impact {string} or worse within {string}', async ({ page, scenario, apiContext, env, $bddContext, $testInfo }, level, selector) => {
     const scopes = scopesOf(apiContext, env);
-    const floor = parseImpactFloor(render(level, ...scopes));
-    const sel = render(selector, ...scopes);
+    const floor = parseImpactFloor(renderStrict(level, ...scopes));
+    const sel = renderStrict(selector, ...scopes);
     await requireRegion(page, sel);
     const results = await runAxe(page, { include: sel });
     attachA11y({ scenario, testInfo: $testInfo, stepIndex: $bddContext.stepIndex }, results);
@@ -489,7 +489,7 @@ Then('the page should have no accessibility violations of impact {string} or wor
  * step fails on either, because a rule that never ran cannot have passed.
  */
 Then('the page should have no accessibility violations of rule {string}', async ({ page, scenario, apiContext, env, $bddContext, $testInfo }, ruleId) => {
-    const rule = render(ruleId, ...scopesOf(apiContext, env));
+    const rule = renderStrict(ruleId, ...scopesOf(apiContext, env));
     const results = await runAxe(page, { rules: [rule] });
     attachA11y({ scenario, testInfo: $testInfo, stepIndex: $bddContext.stepIndex }, results);
     const bucket = assertRuleRan(results, rule, `on ${page.url()}`);
@@ -510,7 +510,7 @@ Then('the page should have no colour-contrast violations', async ({ page, scenar
 });
 /** PROVES one region's text meets AA contrast — for auditing a themed component in isolation. */
 Then('the page should have no colour-contrast violations within {string}', async ({ page, scenario, apiContext, env, $bddContext, $testInfo }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     await requireRegion(page, sel);
     const results = await runAxe(page, { include: sel, rules: ['color-contrast'] });
     attachA11y({ scenario, testInfo: $testInfo, stepIndex: $bddContext.stepIndex }, results);
@@ -556,7 +556,7 @@ Then('every image on the page should carry an alt attribute', async ({ page }) =
 });
 /** PROVES every image inside one region declares its alt intent — the scoped form of the above. */
 Then('every image within {string} should carry an alt attribute', async ({ page, apiContext, env }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     const gathered = await page.evaluate(gatherImages, sel);
     const images = assertGathered(assertRegion(gathered, sel), 'img elements', `within "${sel}"`);
     const missing = imagesWithoutAlt(images);
@@ -571,7 +571,7 @@ Then('every image within {string} should carry an alt attribute', async ({ page,
  * itself — axe sees a non-empty name and passes it.
  */
 Then('every icon-only control within {string} should expose an accessible name', async ({ page, apiContext, env }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     const gathered = await page.evaluate(gatherControls, sel);
     const controls = assertRegion(gathered, sel);
     const iconOnly = assertGathered(iconOnlyControls(controls), 'icon-only controls', `within "${sel}" (${controls.length} control(s) there render text)`);
@@ -588,7 +588,7 @@ Then('every icon-only control within {string} should expose an accessible name',
  * enter keyboard modality and never blurs between elements.
  */
 Then('every focusable element within {string} should show a visible focus indicator', async ({ page, apiContext, env }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     await page.keyboard.press('Tab');
     const gathered = await page.evaluate(gatherFocusIndicators, sel);
     const focusables = assertGathered(assertRegion(gathered, sel), 'focusable elements', `within "${sel}"`);

package/dist/steps/api.steps.js

@@ -2,30 +2,41 @@ import { expect } from '@playwright/test';
 import './params.js';
 import { Given, Then, When } from '../fixtures/test.js';
 import { coerce, getPath } from '../api/json-path.js';
-import { render, renderJson } from '../api/template.js';
+import { renderJson, renderStrict } from '../api/template.js';
 import { pollUntil } from '../api/poll.js';
 import { loadJsonSchema, loadZodSchema, validateAgainstOpenApi, validateJsonSchema, validateZod, } from '../api/validate.js';
 import { SdodsError } from '../errors.js';
 /* ── requests ─────────────────────────────────────────────────────────── */
 When('I send a {method} request to {string}', async ({ api, apiContext, env }, method, path) => {
-    await api.send(method, render(path, apiContext.vars.toObject(), env.vars));
+    await api.send(method, renderStrict(path, apiContext.vars.toObject(), env.vars));
 });
 When('I send a {method} request to {string} with body:', async ({ api, apiContext, env }, method, path, body) => {
     const scopes = [apiContext.vars.toObject(), env.vars];
-    await api.send(method, render(path, ...scopes), { body: renderJson(body, ...scopes) });
+    await api.send(method, renderStrict(path, ...scopes), { body: renderJson(body, ...scopes) });
+});
+/**
+ * The doc string goes out byte-for-byte: not parsed, not re-serialised, and not template-rendered
+ * (only the path is). This is how a malformed-input scenario sends `{ this is not json`; the
+ * `with body:` step parses a `json` doc string and would throw before sending.
+ * The content-type defaults to `application/json`; set another with `I set the request header`.
+ */
+When('I send a {method} request to {string} with the raw body:', async ({ api, apiContext, env }, method, path, body) => {
+    await api.send(method, renderStrict(path, apiContext.vars.toObject(), env.vars), {
+        body: Buffer.from(body, 'utf8'),
+    });
 });
 When('I send a {method} request to {string} with form:', async ({ api, apiContext, env }, method, path, table) => {
     const scopes = [apiContext.vars.toObject(), env.vars];
     const form = {};
     for (const [k, v] of table.raw())
-        form[k] = render(String(v ?? ''), ...scopes);
-    await api.send(method, render(path, ...scopes), { form });
+        form[k] = renderStrict(String(v ?? ''), ...scopes);
+    await api.send(method, renderStrict(path, ...scopes), { form });
 });
 Given('I set the request header {string} to {string}', async ({ apiContext, env }, name, value) => {
-    apiContext.headers.set(name, render(value, apiContext.vars.toObject(), env.vars));
+    apiContext.headers.set(name, renderStrict(value, apiContext.vars.toObject(), env.vars));
 });
 Given('I set the query parameter {string} to {string}', async ({ apiContext, env }, name, value) => {
-    apiContext.query.set(name, render(value, apiContext.vars.toObject(), env.vars));
+    apiContext.query.set(name, renderStrict(value, apiContext.vars.toObject(), env.vars));
 });
 Given('I clear the request headers and query parameters', async ({ apiContext }) => {
     apiContext.resetRequestState();
@@ -40,8 +51,8 @@ Given('I authenticate with basic credentials {string} and {string}', async ({ ap
     const scopes = [apiContext.vars.toObject(), env.vars];
     apiContext.auth = {
         type: 'basic',
-        username: render(username, ...scopes),
-        password: render(password, ...scopes),
+        username: renderStrict(username, ...scopes),
+        password: renderStrict(password, ...scopes),
     };
 });
 Given('I use no authentication', async ({ apiContext }) => {
@@ -51,6 +62,14 @@ Given('I use no authentication', async ({ apiContext }) => {
     // refusal matters.
     apiContext.auth = null;
 });
+/**
+ * Send the rest of the scenario's API calls through a request context with an empty cookie jar,
+ * so they carry only the credentials the scenario set. Without it, @ui/@hybrid calls also carry the
+ * leased role's session cookie, and "credential X alone is refused" can pass on the session.
+ */
+Given('I use an isolated API client', async ({ apiContext }) => {
+    apiContext.isolated = true;
+});
 /* ── assertions ───────────────────────────────────────────────────────── */
 Then('the response status should be {int}', async ({ apiContext }, status) => {
     expect(apiContext.last().response.status, `expected HTTP ${status}, got ${apiContext.last().response.status} ${apiContext.last().response.statusText}`).toBe(status);
@@ -65,70 +84,88 @@ Then('the response status should be one of {string}', async ({ apiContext }, lis
 Then('the response should contain {string}', async ({ apiContext, env }, text) => {
     const body = apiContext.last().response.body;
     const haystack = typeof body === 'string' ? body : JSON.stringify(body);
-    expect(haystack).toContain(render(text, apiContext.vars.toObject(), env.vars));
+    expect(haystack).toContain(renderStrict(text, apiContext.vars.toObject(), env.vars));
 });
-Then('the response JSON path {string} should equal {string}', async ({ apiContext, env }, path, expected) => {
+Then('the response JSON path {string} should equal {string}', async ({ apiContext, env }, jsonPath, expected) => {
+    const scopes = [apiContext.vars.toObject(), env.vars];
+    const path = renderStrict(jsonPath, ...scopes);
     const actual = getPath(apiContext.last().response.body, path);
-    expect(actual, `JSON path ${path}`).toEqual(coerce(render(expected, apiContext.vars.toObject(), env.vars)));
+    expect(actual, `JSON path ${path}`).toEqual(coerce(renderStrict(expected, ...scopes)));
 });
-Then('the response JSON path {string} should exist', async ({ apiContext }, path) => {
+Then('the response JSON path {string} should exist', async ({ apiContext, env }, jsonPath) => {
+    const path = renderStrict(jsonPath, apiContext.vars.toObject(), env.vars);
     expect(getPath(apiContext.last().response.body, path), `JSON path ${path}`).toBeDefined();
 });
-Then('the response JSON path {string} should match {string}', async ({ apiContext }, path, pattern) => {
+Then('the response JSON path {string} should match {string}', async ({ apiContext, env }, jsonPath, pattern) => {
+    const scopes = [apiContext.vars.toObject(), env.vars];
+    const path = renderStrict(jsonPath, ...scopes);
     const actual = getPath(apiContext.last().response.body, path);
-    expect(String(actual), `JSON path ${path}`).toMatch(new RegExp(pattern));
+    expect(String(actual), `JSON path ${path}`).toMatch(new RegExp(renderStrict(pattern, ...scopes)));
 });
-Then('the response JSON path {string} should have {int} items', async ({ apiContext }, path, count) => {
+Then('the response JSON path {string} should have {int} items', async ({ apiContext, env }, jsonPath, count) => {
+    const path = renderStrict(jsonPath, apiContext.vars.toObject(), env.vars);
     const actual = getPath(apiContext.last().response.body, path);
     expect(Array.isArray(actual) ? actual.length : -1, `JSON path ${path} length`).toBe(count);
 });
-Then('the response JSON path {string} should have at least {int} items', async ({ apiContext }, path, count) => {
+Then('the response JSON path {string} should have at least {int} items', async ({ apiContext, env }, jsonPath, count) => {
+    const path = renderStrict(jsonPath, apiContext.vars.toObject(), env.vars);
     const actual = getPath(apiContext.last().response.body, path);
     expect(Array.isArray(actual) ? actual.length : -1, `JSON path ${path} length`).toBeGreaterThanOrEqual(count);
 });
 Then('the response body should be an array', async ({ apiContext }) => {
     expect(Array.isArray(apiContext.last().response.body)).toBe(true);
 });
-Then('the response header {string} should contain {string}', async ({ apiContext }, name, value) => {
-    expect(apiContext.last().response.headers[name.toLowerCase()] ?? '').toContain(value);
+Then('the response header {string} should contain {string}', async ({ apiContext, env }, name, value) => {
+    const scopes = [apiContext.vars.toObject(), env.vars];
+    const header = renderStrict(name, ...scopes).toLowerCase();
+    expect(apiContext.last().response.headers[header] ?? '').toContain(renderStrict(value, ...scopes));
 });
 Then('the response time should be under {int} ms', async ({ apiContext }, maxMs) => {
     expect(apiContext.last().response.responseTime).toBeLessThan(maxMs);
 });
-Then('the response should match the JSON schema {string}', async ({ apiContext, config }, file) => {
+Then('the response should match the JSON schema {string}', async ({ apiContext, config, env }, schemaFile) => {
+    const file = renderStrict(schemaFile, apiContext.vars.toObject(), env.vars);
     const result = validateJsonSchema(apiContext.last().response.body, loadJsonSchema(config, file));
     expect(result.ok, `schema ${file} violations:\n${result.errors.join('\n')}`).toBe(true);
 });
-Then('the response should match the zod schema {string}', async ({ apiContext, config }, spec) => {
+Then('the response should match the zod schema {string}', async ({ apiContext, config, env }, zodSpec) => {
+    const spec = renderStrict(zodSpec, apiContext.vars.toObject(), env.vars);
     const result = validateZod(apiContext.last().response.body, await loadZodSchema(config, spec));
     expect(result.ok, `zod schema ${spec} violations:\n${result.errors.join('\n')}`).toBe(true);
 });
-Then('the response should match the OpenAPI schema for {method} {string}', async ({ apiContext, config }, method, path) => {
+Then('the response should match the OpenAPI schema for {method} {string}', async ({ apiContext, config, env }, method, openApiPath) => {
+    // Single-brace `{id}` path parameters are not placeholders, so they pass through untouched.
+    const path = renderStrict(openApiPath, apiContext.vars.toObject(), env.vars);
     const last = apiContext.last();
     const result = await validateAgainstOpenApi(config, method, path, last.response.status, last.response.body);
     expect(result.ok, `OpenAPI ${method} ${path} violations:\n${result.errors.join('\n')}`).toBe(true);
 });
 /* ── chaining & polling ───────────────────────────────────────────────── */
-When('I save the response JSON path {string} as {string}', async ({ apiContext }, path, name) => {
+When('I save the response JSON path {string} as {string}', async ({ apiContext, env }, jsonPath, name) => {
+    // `name` is the variable being written, an identifier rather than a template.
+    const path = renderStrict(jsonPath, apiContext.vars.toObject(), env.vars);
     const value = getPath(apiContext.last().response.body, path);
     if (value === undefined)
         throw new SdodsError('RUN_FAILED', `JSON path ${path} is undefined in the last response; cannot save as {{${name}}}.`);
     apiContext.vars.set(name, value);
 });
 Given('I set the variable {string} to {string}', async ({ apiContext, env }, name, value) => {
-    apiContext.vars.set(name, coerce(render(value, apiContext.vars.toObject(), env.vars)));
+    apiContext.vars.set(name, coerce(renderStrict(value, apiContext.vars.toObject(), env.vars)));
 });
 When('I poll {method} {string} until JSON path {string} equals {string} within {int} seconds', async ({ api, apiContext, env }, method, path, jsonPath, expected, seconds) => {
     const scopes = [apiContext.vars.toObject(), env.vars];
-    const want = coerce(render(expected, ...scopes));
-    await pollUntil(() => api.send(method, render(path, ...scopes)), (snap) => JSON.stringify(getPath(snap.response.body, jsonPath)) === JSON.stringify(want), {
+    // Rendered before polling, so an unset variable fails at once rather than inside every attempt.
+    const want = coerce(renderStrict(expected, ...scopes));
+    const url = renderStrict(path, ...scopes);
+    const at = renderStrict(jsonPath, ...scopes);
+    await pollUntil(() => api.send(method, url), (snap) => JSON.stringify(getPath(snap.response.body, at)) === JSON.stringify(want), {
         timeoutMs: seconds * 1000,
         intervalMs: 1000,
         description: `${method} ${path} → ${jsonPath} == ${expected}`,
     });
 });
 When('I poll {method} {string} until the status is {int} within {int} seconds', async ({ api, apiContext, env }, method, path, status, seconds) => {
-    await pollUntil(() => api.send(method, render(path, apiContext.vars.toObject(), env.vars)), (snap) => snap.response.status === status, {
+    await pollUntil(() => api.send(method, renderStrict(path, apiContext.vars.toObject(), env.vars)), (snap) => snap.response.status === status, {
         timeoutMs: seconds * 1000,
         intervalMs: 1000,
         description: `${method} ${path} → HTTP ${status}`,

package/dist/steps/browser.steps.js

@@ -1,6 +1,6 @@
 import { expect } from '@playwright/test';
 import { Given, Then, When } from '../fixtures/test.js';
-import { render } from '../api/template.js';
+import { renderStrict } from '../api/template.js';
 import { SdodsError } from '../errors.js';
 /**
  * Browser-state steps: cookies, web storage, viewport, colour scheme, locale and console.
@@ -10,7 +10,8 @@ import { SdodsError } from '../errors.js';
  * step PROVES; where a step exists because of a specific trap, the trap is named.
  *
  * Two rules govern the whole file:
- *   * every string argument is interpolated through `render()`, so `{{vars}}` work everywhere;
+ *   * every string argument is interpolated through `renderStrict()`, so `{{vars}}` work everywhere
+ *     and an unset one fails the step instead of being matched literally;
  *   * no assertion may pass over an empty set. A selector that matches nothing, a body that
  *     rendered no text, a recorder that was never armed and a page that never navigated are all
  *     failures, because a green step that observed nothing is worse than no step at all.
@@ -43,8 +44,8 @@ Given('I set the browser cookie {string} to {string}', async ({ page, apiContext
     const scopes = scopesOf(apiContext, env);
     await page.context().addCookies([
         {
-            name: render(name, ...scopes),
-            value: render(value, ...scopes),
+            name: renderStrict(name, ...scopes),
+            value: renderStrict(value, ...scopes),
             url: baseUrlOf(env, 'I set the browser cookie'),
         },
     ]);
@@ -54,7 +55,7 @@ Given('I set the browser cookie {string} to {string}', async ({ page, apiContext
 // read-filter-restore. Clearing the jar to drop a session cookie would also drop the consent and
 // locale cookies the scenario set up, and the failure would look like a bug in the app.
 Given('I clear the browser cookie {string}', async ({ page, apiContext, env }, name) => {
-    const wanted = render(name, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(name, ...scopesOf(apiContext, env));
     const context = page.context();
     const all = await context.cookies();
     const survivors = all.filter((c) => c.name !== wanted);
@@ -71,19 +72,19 @@ Given('I clear all browser cookies', async ({ page }) => {
 // `document.cookie`, so the browser context is the only place its value is observable at all.
 Then('the browser cookie {string} should equal {string}', async ({ page, apiContext, env }, name, expected) => {
     const scopes = scopesOf(apiContext, env);
-    const wanted = render(name, ...scopes);
+    const wanted = renderStrict(name, ...scopes);
     const cookie = await findCookie(page, wanted);
     expect(cookie, `cookie "${wanted}" is not in the jar`).toBeTruthy();
-    expect(cookie.value, `cookie "${wanted}"`).toBe(render(expected, ...scopes));
+    expect(cookie.value, `cookie "${wanted}"`).toBe(renderStrict(expected, ...scopes));
 });
 // Proves the cookie was issued at all, for cases where the value is opaque or random.
 Then('the browser cookie {string} should exist', async ({ page, apiContext, env }, name) => {
-    const wanted = render(name, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(name, ...scopesOf(apiContext, env));
     expect(await findCookie(page, wanted), `cookie "${wanted}" is not in the jar`).toBeTruthy();
 });
 // Proves a logout, a rejected consent or a declined attribution left nothing behind.
 Then('the browser cookie {string} should not exist', async ({ page, apiContext, env }, name) => {
-    const wanted = render(name, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(name, ...scopesOf(apiContext, env));
     expect(await findCookie(page, wanted), `unexpected cookie "${wanted}"`).toBeUndefined();
 });
 /** The attributes Playwright actually reports. Anything else is an authoring mistake. */
@@ -94,8 +95,8 @@ const COOKIE_ATTRIBUTES = ['domain', 'path', 'expires', 'httpOnly', 'secure', 's
 // string "undefined", so the step would pass while asserting nothing; the allowlist refuses it.
 Then('the browser cookie {string} should carry {string} equal to {string}', async ({ page, apiContext, env }, name, attribute, value) => {
     const scopes = scopesOf(apiContext, env);
-    const wanted = render(name, ...scopes);
-    const attr = render(attribute, ...scopes);
+    const wanted = renderStrict(name, ...scopes);
+    const attr = renderStrict(attribute, ...scopes);
     if (!COOKIE_ATTRIBUTES.includes(attr))
         throw new SdodsError('RUN_FAILED', `"${attr}" is not a cookie attribute.`, {
             hint: `Use one of: ${COOKIE_ATTRIBUTES.join(', ')}.`,
@@ -103,7 +104,7 @@ Then('the browser cookie {string} should carry {string} equal to {string}', asyn
     const cookie = await findCookie(page, wanted);
     expect(cookie, `cookie "${wanted}" is not in the jar`).toBeTruthy();
     const actual = cookie[attr];
-    expect(String(actual), `${wanted}.${attr}`).toBe(render(value, ...scopes));
+    expect(String(actual), `${wanted}.${attr}`).toBe(renderStrict(value, ...scopes));
 });
 async function findCookie(page, name) {
     return (await page.context().cookies()).find((c) => c.name === name);
@@ -172,17 +173,17 @@ async function readStorage(page, kind, key) {
 // banner — reaches it before the first paint rather than after it.
 Given('I seed local storage {string} with {string}', async ({ page, apiContext, env }, key, value) => {
     const scopes = scopesOf(apiContext, env);
-    await seedStorage(page, 'local', render(key, ...scopes), render(value, ...scopes));
+    await seedStorage(page, 'local', renderStrict(key, ...scopes), renderStrict(value, ...scopes));
 });
 // Same contract as local storage, for the per-tab values an app keeps out of the persistent store.
 Given('I seed session storage {string} with {string}', async ({ page, apiContext, env }, key, value) => {
     const scopes = scopesOf(apiContext, env);
-    await seedStorage(page, 'session', render(key, ...scopes), render(value, ...scopes));
+    await seedStorage(page, 'session', renderStrict(key, ...scopes), renderStrict(value, ...scopes));
 });
 // Proves the DEFAULT path: what the app does for a visitor with no stored preference. Removal is
 // armed as an init script as well as applied in place, so the next navigation cannot resurrect it.
 Given('I clear the local storage key {string}', async ({ page, apiContext, env }, key) => {
-    const wanted = render(key, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(key, ...scopesOf(apiContext, env));
     await page.addInitScript((k) => {
         try {
             window.localStorage.removeItem(k);
@@ -228,25 +229,25 @@ Given('I clear all browser storage', async ({ page }) => {
 // reaches storage looks identical on screen until the next page load.
 Then('local storage {string} should equal {string}', async ({ page, apiContext, env }, key, expected) => {
     const scopes = scopesOf(apiContext, env);
-    const k = render(key, ...scopes);
-    expect(await readStorage(page, 'local', k), `local storage "${k}"`).toBe(render(expected, ...scopes));
+    const k = renderStrict(key, ...scopes);
+    expect(await readStorage(page, 'local', k), `local storage "${k}"`).toBe(renderStrict(expected, ...scopes));
 });
 // Proves a sign-out, a reset or a decline actually removed the key rather than blanking the UI.
 Then('local storage {string} should be absent', async ({ page, apiContext, env }, key) => {
-    const k = render(key, ...scopesOf(apiContext, env));
+    const k = renderStrict(key, ...scopesOf(apiContext, env));
     expect(await readStorage(page, 'local', k), `local storage "${k}"`).toBeNull();
 });
 // Per-tab equivalent of the local-storage absence assertion, so a tab-scoped value that outlives
 // the flow which set it fails as loudly as a persisted one.
 Then('session storage {string} should be absent', async ({ page, apiContext, env }, key) => {
-    const k = render(key, ...scopesOf(apiContext, env));
+    const k = renderStrict(key, ...scopesOf(apiContext, env));
     expect(await readStorage(page, 'session', k), `session storage "${k}"`).toBeNull();
 });
 // Per-tab equivalent of the local-storage assertion.
 Then('session storage {string} should equal {string}', async ({ page, apiContext, env }, key, expected) => {
     const scopes = scopesOf(apiContext, env);
-    const k = render(key, ...scopes);
-    expect(await readStorage(page, 'session', k), `session storage "${k}"`).toBe(render(expected, ...scopes));
+    const k = renderStrict(key, ...scopes);
+    expect(await readStorage(page, 'session', k), `session storage "${k}"`).toBe(renderStrict(expected, ...scopes));
 });
 /* ── viewport and reflow ──────────────────────────────────────────────── */
 // Proves a layout at a width the project's fixed viewport never visits. WCAG 2.2 reflow is a
@@ -300,7 +301,7 @@ Then('the page should not scroll horizontally', async ({ page }) => {
 // to scroll internally must not push the page. Fails when the selector matches nothing, because a
 // containment claim about an element that is not on the page is not a claim.
 Then('the element matching {string} should not overflow horizontally', async ({ page, apiContext, env }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     const info = (await page.evaluate((s) => {
         const el = document.querySelector(s);
         if (!el)
@@ -316,7 +317,7 @@ const COLOUR_SCHEMES = ['light', 'dark', 'no-preference'];
 // its own preference is seeded with `Given I seed local storage …` instead, and a complete dark-mode
 // scenario usually needs both.
 Given('I emulate the {string} colour scheme', async ({ page, apiContext, env }, scheme) => {
-    const wanted = render(scheme, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(scheme, ...scopesOf(apiContext, env));
     if (!COLOUR_SCHEMES.includes(wanted))
         throw new SdodsError('RUN_FAILED', `"${wanted}" is not a colour scheme.`, {
             hint: `Use one of: ${COLOUR_SCHEMES.join(', ')}.`,
@@ -386,13 +387,13 @@ function expectLight(painted, subject) {
 // Proves the CLASS was applied. Necessary but never sufficient: a `dark` class with no CSS behind
 // it is not dark mode, which is why the painted-background steps exist alongside it.
 Then('the html element should carry the {string} class', async ({ page, apiContext, env }, cls) => {
-    const wanted = render(cls, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(cls, ...scopesOf(apiContext, env));
     const classes = await page.evaluate(() => document.documentElement.className);
     expect(String(classes).split(/\s+/).filter(Boolean), `html class list is "${classes}"`).toContain(wanted);
 });
 // Proves the theme class was REMOVED — the direction that catches a toggle which only ever adds.
 Then('the html element should not carry the {string} class', async ({ page, apiContext, env }, cls) => {
-    const wanted = render(cls, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(cls, ...scopesOf(apiContext, env));
     const classes = await page.evaluate(() => document.documentElement.className);
     expect(String(classes).split(/\s+/).filter(Boolean), `html class list is "${classes}"`).not.toContain(wanted);
 });
@@ -408,7 +409,7 @@ Then('the painted page background should be light', async ({ page }) => {
 // Proves ONE surface themed — a panel, a modal, a sidebar. Whole-page checks miss the component
 // that kept a hardcoded white while everything around it went dark.
 Then('the element matching {string} should paint a dark background', async ({ page, apiContext, env }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     expectDark(await paintedColour(page, sel, `the element matching "${sel}"`), `"${sel}"`);
 });
 /** Where the first-frame sample is parked. Stable by design: the assertion step reads it back. */
@@ -477,8 +478,8 @@ Given('I switch the interface locale to {string} using the {string} cookie', asy
     requireNavigated(page, 'I switch the interface locale');
     await page.context().addCookies([
         {
-            name: render(cookieName, ...scopes),
-            value: render(locale, ...scopes),
+            name: renderStrict(cookieName, ...scopes),
+            value: renderStrict(locale, ...scopes),
             url: baseUrlOf(env, 'I switch the interface locale'),
         },
     ]);
@@ -491,14 +492,14 @@ Given('I switch the interface locale to {string} using the {string} cookie', asy
 Given('I request the locale {string} with the Accept-Language header', async ({ page, apiContext, env }, locale) => {
     requireNavigated(page, 'I request the locale with the Accept-Language header');
     await page.setExtraHTTPHeaders({
-        'Accept-Language': render(locale, ...scopesOf(apiContext, env)),
+        'Accept-Language': renderStrict(locale, ...scopesOf(apiContext, env)),
     });
     await page.reload({ waitUntil: 'domcontentloaded' });
 });
 // Proves the document declared the language it served. Screen readers, hyphenation and every
 // `:lang()` rule key off this, and it is the one machine-checkable trace of the negotiation.
 Then('the html lang attribute should be {string}', async ({ page, apiContext, env }, lang) => {
-    const wanted = render(lang, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(lang, ...scopesOf(apiContext, env));
     const actual = await page.evaluate(() => document.documentElement.getAttribute('lang'));
     expect(actual, 'html lang attribute').toBe(wanted);
 });
@@ -623,7 +624,7 @@ Then('no console error should have been recorded', async ({ apiContext }) => {
 // hydration mismatch, a blocked request — while tolerating noise the team has accepted.
 Then('no console error should match {string}', async ({ apiContext, env }, pattern) => {
     const recording = recordingFor(apiContext, 'no console error should match');
-    const rendered = render(pattern, apiContext.vars.toObject(), env.vars);
+    const rendered = renderStrict(pattern, apiContext.vars.toObject(), env.vars);
     const re = compilePattern(rendered, 'no console error should match');
     expect(recording.errors.filter((line) => re.test(line)), `console errors matching /${rendered}/`).toEqual([]);
 });
@@ -631,7 +632,7 @@ Then('no console error should match {string}', async ({ apiContext, env }, patte
 // deprecated API — never at error level.
 Then('no console warning should match {string}', async ({ apiContext, env }, pattern) => {
     const recording = recordingFor(apiContext, 'no console warning should match');
-    const rendered = render(pattern, apiContext.vars.toObject(), env.vars);
+    const rendered = renderStrict(pattern, apiContext.vars.toObject(), env.vars);
     const re = compilePattern(rendered, 'no console warning should match');
     expect(recording.warnings.filter((line) => re.test(line)), `console warnings matching /${rendered}/`).toEqual([]);
 });
@@ -640,7 +641,7 @@ Then('no console warning should match {string}', async ({ apiContext, env }, pat
 // a recorder that silently stopped working would leave every "no console error" step green.
 Then('a console error matching {string} should have been recorded', async ({ apiContext, env }, pattern) => {
     const recording = recordingFor(apiContext, 'a console error matching … should have been recorded');
-    const rendered = render(pattern, apiContext.vars.toObject(), env.vars);
+    const rendered = renderStrict(pattern, apiContext.vars.toObject(), env.vars);
     const re = compilePattern(rendered, 'a console error matching … should have been recorded');
     expect(recording.errors.filter((line) => re.test(line)).length, `no console error matched /${rendered}/. Recorded: ${recording.errors.slice(0, 10).join(' | ') || '(none)'}`).toBeGreaterThan(0);
 });