@sdods/core 0.3.2 → 0.5.2

package/dist/steps/net.steps.js

@@ -1,25 +1,24 @@
 import { expect } from '@playwright/test';
 import './params.js';
 import { Given, Then, When } from '../fixtures/test.js';
+import { applyAuth, encodeBody, resolveAuth, } from '../api/client.js';
 import { coerce, getPath } from '../api/json-path.js';
-import { render } from '../api/template.js';
+import { render, renderStrict } from '../api/template.js';
 import { SdodsError } from '../errors.js';
 const scopesOf = (apiContext, env) => [
     apiContext.vars.toObject(),
     env.vars,
 ];
-/**
- * Render, then refuse a surviving `{{var}}`. Used for every argument whose non-resolution would
- * produce a PASS rather than a failure: negative assertions, URL globs and request paths.
- */
-function renderStrict(value, what, ...scopes) {
-    const out = render(value, ...scopes);
-    if (out.includes('{{')) {
-        throw new SdodsError('CONFIG_UNRESOLVED_VAR', `${what} did not resolve: "${out}".`, {
-            hint: 'No scenario variable or env var of that name exists yet. Save it first (for example with "I save the response JSON path ... as ..."), or fix the spelling — an unresolved placeholder here would make the assertion pass without testing anything.',
-        });
+/** `renderStrict`, with the message naming which argument held the unresolved variable. */
+function renderArg(value, what, ...scopes) {
+    try {
+        return renderStrict(value, ...scopes);
+    }
+    catch (e) {
+        if (e instanceof SdodsError)
+            e.message = `${what}: ${e.message}`;
+        throw e;
     }
-    return out;
 }
 /** Comma-separated Gherkin list → trimmed, rendered, non-empty items. */
 function renderList(raw, what, ...scopes) {
@@ -27,7 +26,7 @@ function renderList(raw, what, ...scopes) {
         .split(',')
         .map((s) => s.trim())
         .filter(Boolean)
-        .map((s) => renderStrict(s, what, ...scopes));
+        .map((s) => renderArg(s, what, ...scopes));
     if (items.length === 0)
         throw new SdodsError('RUN_FAILED', `${what} is empty.`, {
             hint: 'List at least one comma-separated value; an empty list would make this assertion pass over nothing.',
@@ -70,28 +69,17 @@ function savedBodies(apiContext) {
     }
     return bag;
 }
-/** The auth the ApiClient would have applied, so a raw request is not silently anonymous. */
-function envAuth(auth) {
-    switch (auth.type) {
-        case 'bearer':
-            return { type: 'bearer', token: auth.token };
-        case 'basic':
-            return { type: 'basic', username: auth.username, password: auth.password };
-        case 'header':
-            return { type: 'header', name: auth.name, value: auth.value };
-        default:
-            return undefined;
-    }
-}
 /**
- * Mirrors `ApiClient.buildHeaders` — env headers, then the scenario's pending headers, then auth.
- * A raw request that dropped auth would report the anonymous redirect instead of the
- * authenticated one, which is the same class of defect as a step that does not interpolate.
+ * Mirrors `ApiClient.buildHeaders` — env headers, then the scenario's pending headers, then auth,
+ * resolved by the same function the client uses (so `I use no authentication` and every
+ * `env.api.auth` type behave identically here). A raw request that dropped auth would report the
+ * anonymous redirect instead of the authenticated one, which is the same class of defect as a step
+ * that does not interpolate.
  * `accept: application/json` is the default; override it with
  * `Given I set the request header "accept" to "text/html"` when the gate under test negotiates
  * on content type.
  */
-function rawHeaders(apiContext, env, hasBody, isForm) {
+async function rawHeaders(apiContext, env, hasBody, isForm) {
     const headers = { accept: 'application/json' };
     for (const [k, v] of Object.entries(env.api.headers ?? {}))
         headers[k.toLowerCase()] = v;
@@ -99,17 +87,20 @@ function rawHeaders(apiContext, env, hasBody, isForm) {
         headers[k.toLowerCase()] = v;
     if (hasBody && !isForm && !headers['content-type'])
         headers['content-type'] = 'application/json';
-    const auth = apiContext.auth ?? envAuth(env.api.auth);
-    if (auth) {
-        if (auth.type === 'bearer')
-            headers.authorization = `Bearer ${auth.token}`;
-        else if (auth.type === 'basic')
-            headers.authorization = `Basic ${Buffer.from(`${auth.username}:${auth.password}`).toString('base64')}`;
-        else if (auth.type === 'header')
-            headers[auth.name.toLowerCase()] = auth.value;
-    }
+    applyAuth(headers, await resolveAuth(undefined, apiContext.auth, env.api.auth));
     return headers;
 }
+/** The shared `request` fixture, or the isolated context after `I use an isolated API client`. */
+async function rawRequest(deps) {
+    if (!deps.apiContext.isolated)
+        return deps.request;
+    if (!deps.api) {
+        throw new SdodsError('NOT_SUPPORTED', 'No isolated request context is available here.', {
+            hint: 'Raw requests reach the isolated client through the `api` fixture; pass it in the step fixtures.',
+        });
+    }
+    return deps.api.requestContext();
+}
 /** Mirrors `ApiClient.resolveUrl`, so `Given I set the query parameter …` applies here too. */
 function rawUrl(apiContext, env, pathOrUrl) {
     const base = env.api.baseUrl.replace(/\/+$/, '');
@@ -126,11 +117,13 @@ function rawUrl(apiContext, env, pathOrUrl) {
  */
 export async function sendRaw(deps, method, pathOrUrl, opts = {}) {
     const url = rawUrl(deps.apiContext, deps.env, pathOrUrl);
-    const headers = rawHeaders(deps.apiContext, deps.env, opts.body !== undefined || opts.form !== undefined, opts.form !== undefined);
-    const res = await deps.request.fetch(url, {
+    const headers = await rawHeaders(deps.apiContext, deps.env, opts.body !== undefined || opts.form !== undefined, opts.form !== undefined);
+    const request = await rawRequest(deps);
+    const res = await request.fetch(url, {
         method,
         headers,
-        data: opts.form ? undefined : opts.body,
+        // A Buffer, so Playwright does not JSON-encode a body that does not parse.
+        data: opts.form ? undefined : encodeBody(opts.body),
         form: opts.form,
         maxRedirects: 0,
         failOnStatusCode: false,
@@ -173,25 +166,25 @@ const SECRET_HEADERS = /^(authorization|cookie|set-cookie|x-api-key|proxy-author
 export function redactForReport(headers) {
     return Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, SECRET_HEADERS.test(k) ? '***' : v]));
 }
-When('I send a {method} request to {string} without following redirects', async ({ request, apiContext, env, config, $testInfo }, method, path) => {
+When('I send a {method} request to {string} without following redirects', async ({ request, api, apiContext, env, config, $testInfo }, method, path) => {
     // PROVES the edge itself answered. The built-in step would follow the 3xx and report the
     // page it landed on, so an auth/locale/maintenance gate is unobservable through it.
-    await sendRaw({ request, apiContext, env, config, testInfo: $testInfo }, method, renderStrict(path, 'the request path', ...scopesOf(apiContext, env)));
+    await sendRaw({ request, api, apiContext, env, config, testInfo: $testInfo }, method, renderArg(path, 'the request path', ...scopesOf(apiContext, env)));
 });
-When('I send a {method} request to {string} without following redirects with body:', async ({ request, apiContext, env, config, $testInfo }, method, path, body) => {
+When('I send a {method} request to {string} without following redirects with body:', async ({ request, api, apiContext, env, config, $testInfo }, method, path, body) => {
     // Body stays TEXT, never re-serialised JSON: the byte-identical comparison below is only an
     // oracle for enumeration safety if nothing normalises whitespace or key order on the way in.
     const scopes = scopesOf(apiContext, env);
-    await sendRaw({ request, apiContext, env, config, testInfo: $testInfo }, method, renderStrict(path, 'the request path', ...scopes), { body: render(body, ...scopes) });
+    await sendRaw({ request, api, apiContext, env, config, testInfo: $testInfo }, method, renderArg(path, 'the request path', ...scopes), { body: render(body, ...scopes) });
 });
-When('I send a {method} request to {string} without following redirects with form:', async ({ request, apiContext, env, config, $testInfo }, method, path, table) => {
+When('I send a {method} request to {string} without following redirects with form:', async ({ request, api, apiContext, env, config, $testInfo }, method, path, table) => {
     // PROVES a form POST's gate. Most real redirect gates — sign-in, consent, locale switch —
     // are urlencoded form posts, so a JSON-only raw request cannot reach the common case.
     const scopes = scopesOf(apiContext, env);
     const form = {};
     for (const row of table.raw())
-        form[String(row[0] ?? '')] = render(String(row[1] ?? ''), ...scopes);
-    await sendRaw({ request, apiContext, env, config, testInfo: $testInfo }, method, renderStrict(path, 'the request path', ...scopes), { form });
+        form[String(row[0] ?? '')] = renderStrict(String(row[1] ?? ''), ...scopes);
+    await sendRaw({ request, api, apiContext, env, config, testInfo: $testInfo }, method, renderArg(path, 'the request path', ...scopes), { form });
 });
 Then('the raw response status should be {int}', async ({ apiContext }, status) => {
     // PROVES the gate fired at this hop. A 307 that a following client turns into a 200 is the
@@ -215,39 +208,39 @@ Then('the raw response Location should be {string}', async ({ apiContext, env },
     // Exact, not substring: the surviving return-to/callback parameter IS the assertion, and a
     // `contains` check would pass on a truncated one that silently drops where the user came from.
     const snap = rawOf(apiContext);
-    expect(snap.headers.location ?? '(no Location header)', `Location of ${snap.url}`).toBe(render(expected, ...scopesOf(apiContext, env)));
+    expect(snap.headers.location ?? '(no Location header)', `Location of ${snap.url}`).toBe(renderStrict(expected, ...scopesOf(apiContext, env)));
 });
 Then('the raw response Location should contain {string}', async ({ apiContext, env }, expected) => {
     const snap = rawOf(apiContext);
-    expect(snap.headers.location ?? '(no Location header)', `Location of ${snap.url}`).toContain(render(expected, ...scopesOf(apiContext, env)));
+    expect(snap.headers.location ?? '(no Location header)', `Location of ${snap.url}`).toContain(renderStrict(expected, ...scopesOf(apiContext, env)));
 });
 Then('the raw response header {string} should contain {string}', async ({ apiContext, env }, name, value) => {
     const scopes = scopesOf(apiContext, env);
-    const wanted = render(name, ...scopes);
+    const wanted = renderStrict(name, ...scopes);
     const snap = rawOf(apiContext);
-    expect(snap.headers[wanted.toLowerCase()] ?? `(no ${wanted} header)`, `${wanted} of ${snap.url}`).toContain(render(value, ...scopes));
+    expect(snap.headers[wanted.toLowerCase()] ?? `(no ${wanted} header)`, `${wanted} of ${snap.url}`).toContain(renderStrict(value, ...scopes));
 });
 Then('the raw response should have no {string} header', async ({ apiContext, env }, name) => {
     // The deny direction, and NOT the same as "does not contain": an `Allow` header present but
     // empty, or a `Set-Cookie` present but rejected, are both absences a contains-check would miss.
-    const wanted = renderStrict(name, 'the header name', ...scopesOf(apiContext, env));
+    const wanted = renderArg(name, 'the header name', ...scopesOf(apiContext, env));
     const snap = rawOf(apiContext);
     expect(snap.headers[wanted.toLowerCase()], `unexpected ${wanted} header on ${snap.url}`).toBeUndefined();
 });
 Then('the raw response body should contain {string}', async ({ apiContext, env }, text) => {
-    expect(rawOf(apiContext).body).toContain(render(text, ...scopesOf(apiContext, env)));
+    expect(rawOf(apiContext).body).toContain(renderStrict(text, ...scopesOf(apiContext, env)));
 });
 Then('the raw response should set the {string} cookie', async ({ apiContext, env }, name) => {
     // PROVES the credential was actually issued. Unreachable through the built-in header step,
     // which sees `set-cookie: ***` because the ApiSnapshot redacts it.
-    const wanted = renderStrict(name, 'the cookie name', ...scopesOf(apiContext, env));
+    const wanted = renderArg(name, 'the cookie name', ...scopesOf(apiContext, env));
     const snap = rawOf(apiContext);
     expect(snap.setCookies.some((c) => c.startsWith(`${wanted}=`)), `Set-Cookie for "${wanted}" (got ${JSON.stringify(snap.setCookies.map((c) => c.split('=')[0]))})`).toBe(true);
 });
 Then('the raw response should not set the {string} cookie', async ({ apiContext, env }, name) => {
     // PROVES a refusal left no credential behind. A `Max-Age=0` line is a deletion, not a grant,
     // so it must not count as one — otherwise a correct sign-out would read as a session leak.
-    const wanted = renderStrict(name, 'the cookie name', ...scopesOf(apiContext, env));
+    const wanted = renderArg(name, 'the cookie name', ...scopesOf(apiContext, env));
     const snap = rawOf(apiContext);
     expect(snap.setCookies.filter((c) => c.startsWith(`${wanted}=`) && !isCleared(c)), `no Set-Cookie granting "${wanted}"`).toEqual([]);
 });
@@ -255,8 +248,8 @@ Then('the raw response cookie {string} should carry {string}', async ({ apiConte
     // HttpOnly / Secure / SameSite=Lax / Path=/ — the session contract every downstream gate
     // reads. Matched case-insensitively because servers disagree on the casing of attributes.
     const scopes = scopesOf(apiContext, env);
-    const wanted = renderStrict(name, 'the cookie name', ...scopes);
-    const attr = render(attribute, ...scopes);
+    const wanted = renderArg(name, 'the cookie name', ...scopes);
+    const attr = renderStrict(attribute, ...scopes);
     const cookie = rawOf(apiContext).setCookies.find((c) => c.startsWith(`${wanted}=`));
     expect(cookie, `Set-Cookie for "${wanted}"`).toBeTruthy();
     expect(String(cookie).toLowerCase(), `attributes of the "${wanted}" cookie`).toContain(attr.toLowerCase());
@@ -264,7 +257,7 @@ Then('the raw response cookie {string} should carry {string}', async ({ apiConte
 Then('the raw response cookie {string} should be cleared', async ({ apiContext, env }, name) => {
     // PROVES sign-out server-side: a deletion is a Set-Cookie with an immediate expiry, which is
     // what "the browser no longer holds the credential" actually means over the wire.
-    const wanted = renderStrict(name, 'the cookie name', ...scopesOf(apiContext, env));
+    const wanted = renderArg(name, 'the cookie name', ...scopesOf(apiContext, env));
     const cookie = rawOf(apiContext).setCookies.find((c) => c.startsWith(`${wanted}=`));
     expect(cookie, `Set-Cookie clearing "${wanted}"`).toBeTruthy();
     expect(isCleared(String(cookie)), `expiry of the "${wanted}" cookie`).toBe(true);
@@ -325,32 +318,33 @@ async function captureDownload(page, timeout, click) {
 When('I click the {string} {role} and capture the download', async ({ page, heal, config, apiContext, env }, name, role) => {
     // PROVES an export produced a file at all. Without this the whole export feature can only be
     // asserted as "the click did not throw", which is true of a button wired to nothing.
-    const n = render(name, ...scopesOf(apiContext, env));
+    const n = renderStrict(name, ...scopesOf(apiContext, env));
     const loc = await heal.resolve(page.getByRole(role, { name: n }), { role: role, name: n, text: n, description: `${role} "${n}"` }, 'click');
     await captureDownload(page, config.project.timeouts.navigation, () => loc.click());
 });
-When('I click the element with test id {string} and capture the download', async ({ page, heal, config }, id) => {
-    const loc = await heal.resolve(page.getByTestId(id), { testId: id, description: `test id "${id}"` }, 'click');
+When('I click the element with test id {string} and capture the download', async ({ page, heal, config, apiContext, env }, id) => {
+    const testId = renderStrict(id, ...scopesOf(apiContext, env));
+    const loc = await heal.resolve(page.getByTestId(testId), { testId, description: `test id "${testId}"` }, 'click');
     await captureDownload(page, config.project.timeouts.navigation, () => loc.click());
 });
 Then('the downloaded file name should end with {string}', async ({ page, apiContext, env }, suffix) => {
     // `endsWith`, not `contains`: a ".json" that appears mid-name (report.json.txt) is the exact
     // mis-typed export this assertion exists to catch.
-    const wanted = render(suffix, ...scopesOf(apiContext, env));
+    const wanted = renderStrict(suffix, ...scopesOf(apiContext, env));
     const actual = downloadOf(page).suggestedFilename();
     expect(actual.endsWith(wanted), `download filename "${actual}" should end with "${wanted}"`).toBe(true);
 });
 Then('the downloaded file name should contain {string}', async ({ page, apiContext, env }, part) => {
-    expect(downloadOf(page).suggestedFilename(), 'download filename').toContain(render(part, ...scopesOf(apiContext, env)));
+    expect(downloadOf(page).suggestedFilename(), 'download filename').toContain(renderStrict(part, ...scopesOf(apiContext, env)));
 });
 Then('the downloaded text first line should be {string}', async ({ page, apiContext, env }, expected) => {
     // PROVES the header row of a CSV export matches the columns the UI promised. Exact, because a
     // reordered or renamed column silently breaks every consumer of the file.
     const text = await downloadedText(page);
-    expect(text.split(/\r?\n/)[0] ?? '', 'first line of the downloaded file').toBe(render(expected, ...scopesOf(apiContext, env)));
+    expect(text.split(/\r?\n/)[0] ?? '', 'first line of the downloaded file').toBe(renderStrict(expected, ...scopesOf(apiContext, env)));
 });
 Then('the downloaded text should contain {string}', async ({ page, apiContext, env }, text) => {
-    expect(await downloadedText(page), 'downloaded file').toContain(render(text, ...scopesOf(apiContext, env)));
+    expect(await downloadedText(page), 'downloaded file').toContain(renderStrict(text, ...scopesOf(apiContext, env)));
 });
 Then('the downloaded text should have at least {int} data rows', async ({ page }, min) => {
     expect(dataRows(await downloadedText(page)), 'data rows in the downloaded file').toBeGreaterThanOrEqual(min);
@@ -380,7 +374,7 @@ Then('the downloaded JSON path {string} should equal {string}', async ({ page, a
     // PROVES the export/import round trip, not just that a file arrived: a scenario that can
     // export but never read what it exported proves only that a click did not throw.
     const actual = getPath(await downloadedJson(page), path);
-    expect(actual, `downloaded JSON path ${path}`).toEqual(coerce(render(expected, ...scopesOf(apiContext, env))));
+    expect(actual, `downloaded JSON path ${path}`).toEqual(coerce(renderStrict(expected, ...scopesOf(apiContext, env))));
 });
 Then('the downloaded JSON path {string} should have {int} items', async ({ page }, path, count) => {
     // Arrays and keyed records both count, because exports model collections either way; anything
@@ -446,16 +440,17 @@ function streamOf(apiContext) {
     return capture;
 }
 async function readStream(deps, method, pathOrUrl, body) {
-    const headers = rawHeaders(deps.apiContext, deps.env, body !== undefined, false);
+    const headers = await rawHeaders(deps.apiContext, deps.env, body !== undefined, false);
     headers.accept = 'text/event-stream';
     const url = rawUrl(deps.apiContext, deps.env, pathOrUrl);
     const timeout = STREAM_TIMEOUT.get(deps.apiContext) ?? deps.config.project.timeouts.api;
+    const request = await rawRequest(deps);
     let capture;
     try {
-        const res = await deps.request.fetch(url, {
+        const res = await request.fetch(url, {
             method,
             headers,
-            data: body,
+            data: encodeBody(body),
             maxRedirects: 0,
             failOnStatusCode: false,
             timeout,
@@ -495,12 +490,12 @@ Given('I allow {int} seconds for the event stream', async ({ apiContext }, secon
     // exactly like a product bug — the worst kind of false failure.
     STREAM_TIMEOUT.set(apiContext, seconds * 1000);
 });
-When('I read the event stream from a {method} request to {string}', async ({ request, apiContext, env, config, $testInfo }, method, path) => {
-    await readStream({ request, apiContext, env, config, testInfo: $testInfo }, method, renderStrict(path, 'the request path', ...scopesOf(apiContext, env)));
+When('I read the event stream from a {method} request to {string}', async ({ request, api, apiContext, env, config, $testInfo }, method, path) => {
+    await readStream({ request, api, apiContext, env, config, testInfo: $testInfo }, method, renderArg(path, 'the request path', ...scopesOf(apiContext, env)));
 });
-When('I read the event stream from a {method} request to {string} with body:', async ({ request, apiContext, env, config, $testInfo }, method, path, body) => {
+When('I read the event stream from a {method} request to {string} with body:', async ({ request, api, apiContext, env, config, $testInfo }, method, path, body) => {
     const scopes = scopesOf(apiContext, env);
-    await readStream({ request, apiContext, env, config, testInfo: $testInfo }, method, renderStrict(path, 'the request path', ...scopes), render(body, ...scopes));
+    await readStream({ request, api, apiContext, env, config, testInfo: $testInfo }, method, renderArg(path, 'the request path', ...scopes), render(body, ...scopes));
 });
 Then('the stream status should be {int}', async ({ apiContext }, status) => {
     const capture = streamOf(apiContext);
@@ -510,7 +505,7 @@ Then('the stream content type should be {string}', async ({ apiContext, env }, e
     // PROVES the endpoint actually streamed. An endpoint that quietly fell back to a buffered
     // JSON response still returns 200, and every event assertion below would then fail
     // confusingly.
-    expect(streamOf(apiContext).contentType, 'stream content type').toContain(render(expected, ...scopesOf(apiContext, env)));
+    expect(streamOf(apiContext).contentType, 'stream content type').toContain(renderStrict(expected, ...scopesOf(apiContext, env)));
 });
 Then('the stream should have at least {int} events', async ({ apiContext }, min) => {
     if (min < 1)
@@ -522,14 +517,14 @@ Then('the stream should have at least {int} events', async ({ apiContext }, min)
 Then('the first stream event type should be {string}', async ({ apiContext, env }, expected) => {
     const { events } = streamOf(apiContext);
     expect(events.length, 'the stream carried no events at all').toBeGreaterThan(0);
-    expect(events[0]?.type, 'first stream event type').toBe(render(expected, ...scopesOf(apiContext, env)));
+    expect(events[0]?.type, 'first stream event type').toBe(renderStrict(expected, ...scopesOf(apiContext, env)));
 });
 Then('the last stream event type should be {string}', async ({ apiContext, env }, expected) => {
     // PROVES the turn finished. A streaming endpoint returns 200 on its first byte, so the status
     // says nothing about whether the model/producer ever reached its terminal event.
     const { events } = streamOf(apiContext);
     expect(events.length, 'the stream carried no events at all').toBeGreaterThan(0);
-    expect(events[events.length - 1]?.type, 'last stream event type — a 200 that never reaches this is a stream that died mid-flight').toBe(render(expected, ...scopesOf(apiContext, env)));
+    expect(events[events.length - 1]?.type, 'last stream event type — a 200 that never reaches this is a stream that died mid-flight').toBe(renderStrict(expected, ...scopesOf(apiContext, env)));
 });
 Then('the stream should have terminated cleanly', async ({ apiContext }) => {
     // Three clauses, and all three are load-bearing: no transport error, at least one frame parsed
@@ -572,7 +567,7 @@ export function globToRegExp(glob) {
  * whole section exists to prevent.
  */
 function urlGlob(raw, scopes) {
-    const pattern = renderStrict(raw, 'the URL pattern', ...scopes);
+    const pattern = renderArg(raw, 'the URL pattern', ...scopes);
     if (!/[*?]/.test(pattern) && !/^(https?:\/\/|\/)/.test(pattern))
         throw new SdodsError('RUN_FAILED', `"${pattern}" cannot match a request URL.`, {
             hint: 'These steps use Playwright route globs, matched against the whole URL. Write "**analytics**" for a fragment, "**/api/users" for a path, or a full URL.',
@@ -611,10 +606,10 @@ When('I start counting requests to {string}', async ({ page, apiContext, env },
     // Start it before navigating if the initial page load's requests are part of the count.
     urlGlob(glob, scopesOf(apiContext, env));
     const log = ensureLog(page);
-    log.counters.set(render(glob, ...scopesOf(apiContext, env)), log.entries.length);
+    log.counters.set(renderStrict(glob, ...scopesOf(apiContext, env)), log.entries.length);
 });
 function counted(page, glob, scopes, why) {
-    const rendered = renderStrict(glob, 'the URL pattern', ...scopes);
+    const rendered = renderArg(glob, 'the URL pattern', ...scopes);
     const log = logOf(page, why);
     const from = log.counters.get(rendered);
     if (from === undefined)
@@ -664,13 +659,13 @@ Then('the response should have no {string} header', async ({ apiContext, env },
     // Absence, which is NOT "does not contain": a header present with an empty or unexpected value
     // satisfies a contains-check written as a negative, and this is the assertion behind
     // "no cache header was set" and "the debug header never reaches production".
-    const wanted = renderStrict(name, 'the header name', ...scopesOf(apiContext, env));
+    const wanted = renderArg(name, 'the header name', ...scopesOf(apiContext, env));
     expect(apiContext.last().response.headers[wanted.toLowerCase()], `unexpected ${wanted} header`).toBeUndefined();
 });
 Then('the response JSON path {string} should not exist', async ({ apiContext, env }, path) => {
     // PROVES a field was withheld — the password hash, the internal id, the other tenant's row.
     // Strict rendering matters most here: an unresolved path would be absent by construction.
-    const wanted = renderStrict(path, 'the JSON path', ...scopesOf(apiContext, env));
+    const wanted = renderArg(path, 'the JSON path', ...scopesOf(apiContext, env));
     expect(getPath(apiContext.last().response.body, wanted), `JSON path ${wanted}`).toBeUndefined();
 });
 Then('the response should not contain any of {string}', async ({ apiContext, env }, list) => {

package/dist/steps/perf.steps.js

@@ -3,7 +3,7 @@ import { expect } from '@playwright/test';
 import './params.js';
 import { Then, When } from '../fixtures/test.js';
 import { attachmentNames, pad2, scenarioFiles } from '@sdods/contracts';
-import { render, renderJson } from '../api/template.js';
+import { renderJson, renderStrict } from '../api/template.js';
 import { SdodsError } from '../errors.js';
 /**
  * Performance budgets.
@@ -323,7 +323,7 @@ When('I record the page vitals', recordPageVitals);
  */
 export const assertVitalWithinBudget = async ({ scenario, config, apiContext, env }, metricName) => {
     const recording = lastRecording(scenario);
-    const metric = requireVitalKey(render(metricName, apiContext.vars.toObject(), env.vars));
+    const metric = requireVitalKey(renderStrict(metricName, apiContext.vars.toObject(), env.vars));
     const budget = requireBudget(config, metric);
     const value = measured(recording, metric);
     expect(value, `${metric} measured ${value} ms on ${recording.url}, against a budget of ${budget} ms for environment "${config.env.name ?? 'unknown'}"`).toBeLessThanOrEqual(budget);
@@ -336,7 +336,7 @@ Then('the recorded {string} should be within its configured budget', assertVital
  */
 export const assertVitalUnderThreshold = async ({ scenario, apiContext, env }, metricName, maxMs) => {
     const recording = lastRecording(scenario);
-    const metric = requireVitalKey(render(metricName, apiContext.vars.toObject(), env.vars));
+    const metric = requireVitalKey(renderStrict(metricName, apiContext.vars.toObject(), env.vars));
     const value = measured(recording, metric);
     expect(value, `${metric} measured ${value} ms on ${recording.url}, against a scenario-local limit of ${maxMs} ms`).toBeLessThan(maxMs);
 };
@@ -351,7 +351,7 @@ Then('the recorded {string} should be under {int} ms', assertVitalUnderThreshold
  * recording with itself always passes.
  */
 export const assertVitalNoWorseThanPrevious = async ({ scenario, apiContext, env }, metricName, toleranceMs) => {
-    const metric = requireVitalKey(render(metricName, apiContext.vars.toObject(), env.vars));
+    const metric = requireVitalKey(renderStrict(metricName, apiContext.vars.toObject(), env.vars));
     const recordings = perfStore(scenario).recordings;
     if (recordings.length < 2) {
         throw new SdodsError('RUN_FAILED', `Only ${recordings.length} page-vitals recording(s) in this scenario; comparing needs two.`, {
@@ -372,7 +372,7 @@ Then('the recorded {string} should be no worse than the previous recording plus
  * gap fails loudly, once, naming the key.
  */
 export const assertBudgetsConfigured = async ({ config, apiContext, env }, names) => {
-    const wanted = render(names, apiContext.vars.toObject(), env.vars)
+    const wanted = renderStrict(names, apiContext.vars.toObject(), env.vars)
         .split(/[,\s]+/)
         .filter(Boolean);
     if (wanted.length === 0) {
@@ -405,7 +405,7 @@ async function collectSamples(fx, method, pathTemplate, times, bodyTemplate) {
         });
     }
     const scopes = [fx.apiContext.vars.toObject(), fx.env.vars];
-    const path = render(pathTemplate, ...scopes);
+    const path = renderStrict(pathTemplate, ...scopes);
     const body = bodyTemplate === undefined ? undefined : renderJson(bodyTemplate, ...scopes);
     const samples = [];
     for (let i = 0; i < times; i++) {

package/dist/steps/tabs.steps.js

@@ -1,7 +1,7 @@
 import { expect } from '@playwright/test';
 import './params.js';
 import { Given, Then, When } from '../fixtures/test.js';
-import { render } from '../api/template.js';
+import { renderStrict } from '../api/template.js';
 import { SdodsError } from '../errors.js';
 /**
  * Multi-tab and popup steps.
@@ -44,16 +44,16 @@ async function openedBy(page, action, what) {
 }
 /* ── opening ──────────────────────────────────────────────────────────── */
 When('I open a new tab by clicking the {role} {string}', async ({ page, apiContext, env }, role, name) => {
-    const label = render(name, ...scopesOf(apiContext, env));
+    const label = renderStrict(name, ...scopesOf(apiContext, env));
     await openedBy(page, () => activePage(page).getByRole(role, { name: label }).first().click(), `clicking the ${role} "${label}"`);
 });
 When('I open a new tab by clicking the element {string}', async ({ page, apiContext, env }, selector) => {
-    const sel = render(selector, ...scopesOf(apiContext, env));
+    const sel = renderStrict(selector, ...scopesOf(apiContext, env));
     await openedBy(page, () => activePage(page).locator(sel).first().click(), `clicking "${sel}"`);
 });
 /* ── switching ────────────────────────────────────────────────────────── */
 Given('I switch to the tab with URL containing {string}', async ({ page, apiContext, env }, part) => {
-    const needle = render(part, ...scopesOf(apiContext, env));
+    const needle = renderStrict(part, ...scopesOf(apiContext, env));
     const found = page
         .context()
         .pages()
@@ -96,14 +96,14 @@ Then('there should be {int} open tab(s)', async ({ page }, count) => {
         .toBe(count);
 });
 Then('the current tab URL should contain {string}', async ({ page, apiContext, env }, part) => {
-    const needle = render(part, ...scopesOf(apiContext, env));
+    const needle = renderStrict(part, ...scopesOf(apiContext, env));
     await expect
         .poll(() => activePage(page).url(), { message: `the tab URL should contain "${needle}"` })
         .toContain(needle);
 });
 Then('the current tab should contain the text {string}', async ({ page, apiContext, env }, text) => {
     await expect(activePage(page)
-        .getByText(render(text, ...scopesOf(apiContext, env)))
+        .getByText(renderStrict(text, ...scopesOf(apiContext, env)))
         .first()).toBeVisible();
 });
 //# sourceMappingURL=tabs.steps.js.map