@specific.dev/spectest 0.88.3 → 0.89.1

package/dist/harness/ws-bridge.js

@@ -0,0 +1,180 @@
+/**
+ * The ingress WebSocket bridge: one client WebSocket on an ingress
+ * listener, one upstream WebSocket to the service, frames copied in both
+ * directions.
+ *
+ * The handshake is the part that matters. A client that sends
+ * `Sec-WebSocket-Protocol: console, <ticket>` expects the upstream to see
+ * the full list, and expects to get back the one the upstream selected.
+ * The first version of this bridge opened the upstream with no protocols
+ * and no headers, so a ticket or a cookie that rode on the handshake never
+ * reached the service, and the service refused the connection after the
+ * client already saw a 101. So the bridge now opens the upstream FIRST,
+ * with the client's protocol list and forwardable headers, waits for the
+ * upstream handshake, and only then upgrades the client with the protocol
+ * the upstream selected. An upstream that refuses the handshake becomes a
+ * 502 to the client, the same as the HTTP proxy path.
+ *
+ * `daemon.ts` owns the listener and the route lookup; this module owns
+ * the handshake and the frame relay so the two can be tested on loopback
+ * without a VM.
+ */
+import { forwardableHeaders } from "./http-proxy.js";
+/** Headers that belong to the client's own WebSocket handshake. Bun's
+ *  WebSocket client mints its own key and version, and the protocol list
+ *  goes through the constructor option, so these never travel as plain
+ *  headers. */
+const HANDSHAKE_HEADERS = new Set([
+    "sec-websocket-key",
+    "sec-websocket-version",
+    "sec-websocket-protocol",
+    "sec-websocket-extensions",
+    "sec-websocket-accept",
+]);
+/** `Sec-WebSocket-Protocol` is a comma-separated list; each token is
+ *  trimmed, empty tokens are dropped, order is kept (RFC 6455 §4.1 lets
+ *  the server pick from the list, so order is the client's preference). */
+export function parseSubprotocols(header) {
+    if (!header)
+        return [];
+    return header
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/**
+ * The headers the upstream handshake carries: everything forwardable from
+ * the client's request (cookies, authorization, origin, user-agent …),
+ * minus the client's own handshake fields, plus the proxy provenance
+ * headers and a Host that names the service.
+ */
+export function upstreamHandshakeHeaders(req, opts) {
+    const out = {};
+    forwardableHeaders(req).forEach((value, key) => {
+        if (HANDSHAKE_HEADERS.has(key))
+            return;
+        out[key] = value;
+    });
+    const priorXff = req.get("x-forwarded-for");
+    const xff = opts.clientIp
+        ? priorXff
+            ? `${priorXff}, ${opts.clientIp}`
+            : opts.clientIp
+        : priorXff;
+    if (xff)
+        out["x-forwarded-for"] = xff;
+    out["x-forwarded-proto"] = opts.proto;
+    const publicHost = req.get("host");
+    if (publicHost)
+        out["x-forwarded-host"] = publicHost;
+    out["host"] = `${opts.service}:${opts.port}`;
+    return out;
+}
+/**
+ * Open the upstream WebSocket and wait for its handshake. Resolves once
+ * the socket is open, or once it failed; the handshake listeners are
+ * removed either way so a later close does not fire them again.
+ */
+export function openUpstreamWebSocket(url, opts) {
+    const Ctor = WebSocket;
+    let socket;
+    try {
+        socket = new Ctor(url, { protocols: opts.protocols, headers: opts.headers });
+    }
+    catch (err) {
+        return Promise.resolve({ ok: false, reason: String(err) });
+    }
+    // ArrayBuffer so binary frames can be sent to the client verbatim.
+    socket.binaryType = "arraybuffer";
+    return new Promise((resolve) => {
+        let settled = false;
+        const timeoutMs = opts.timeoutMs ?? 30_000;
+        const timer = setTimeout(() => finish({ ok: false, reason: "upstream handshake timed out" }), timeoutMs);
+        const onOpen = () => finish({ ok: true, socket });
+        const onError = (ev) => {
+            const msg = ev.message;
+            finish({ ok: false, reason: msg ? `upstream handshake failed: ${msg}` : "upstream handshake failed" });
+        };
+        const onClose = (ev) => finish({ ok: false, reason: `upstream closed during handshake (${ev.code}${ev.reason ? ` ${ev.reason}` : ""})` });
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.removeEventListener("open", onOpen);
+            socket.removeEventListener("error", onError);
+            socket.removeEventListener("close", onClose);
+            if (!result.ok) {
+                try {
+                    socket.close();
+                }
+                catch {
+                    /* already closed */
+                }
+            }
+            resolve(result);
+        };
+        socket.addEventListener("open", onOpen);
+        socket.addEventListener("error", onError);
+        socket.addEventListener("close", onClose);
+    });
+}
+/**
+ * The `websocket` handler set for `Bun.serve`. The upstream is already
+ * open when `open()` runs, so frames go straight through in both
+ * directions, and a close on either side closes the other with the same
+ * code and reason.
+ */
+export const WS_BRIDGE_HANDLERS = {
+    open(ws) {
+        const { upstream } = ws.data;
+        upstream.addEventListener("message", (ev) => {
+            try {
+                ws.send(ev.data);
+            }
+            catch {
+                /* client gone */
+            }
+        });
+        upstream.addEventListener("close", (ev) => {
+            try {
+                ws.close(ev.code, ev.reason);
+            }
+            catch {
+                /* already closed */
+            }
+        });
+        upstream.addEventListener("error", () => {
+            try {
+                ws.close(1011, "upstream error");
+            }
+            catch {
+                /* already closed */
+            }
+        });
+        // The upstream can have closed between the handshake and this
+        // callback; the close listener above was not attached yet then.
+        if (upstream.readyState !== WebSocket.OPEN) {
+            try {
+                ws.close(1011, "upstream closed");
+            }
+            catch {
+                /* already closed */
+            }
+        }
+    },
+    message(ws, message) {
+        const { upstream } = ws.data;
+        const payload = typeof message === "string" ? message : new Uint8Array(message);
+        if (upstream.readyState === WebSocket.OPEN)
+            upstream.send(payload);
+    },
+    close(ws, code, reason) {
+        try {
+            ws.data.upstream.close(code, reason);
+        }
+        catch {
+            /* ignore */
+        }
+    },
+};

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { strict as nodeAssert } from "node:assert";
-export type { Carrier, Wrapped, WrappedObject, WrappedArray, WrappedResponse, Provenanced, SpectestFetch, Unwrap, } from "./inspect.js";
+export type { Carrier, Wrapped, WrappedObject, WrappedArray, WrappedHeaders, WrappedBuffer, WrappedBinaryView, WrappedBytes, WrappedBlob, WrappedFile, WrappedFormData, WrappedStream, WrappedReader, WrappedBYOBReader, WrappedReadResult, WrappedResponse, Provenanced, SpectestFetch, SpectestRequestInit, Unwrap, } from "./inspect.js";
 import type { Provenanced, SpectestFetch, Wrapped } from "./inspect.js";
 export { field } from "./inspect.js";
 export { annotate } from "./annotate.js";
@@ -300,11 +300,15 @@ export interface SpectestContext<S extends ServicesMap = ServicesMap, F extends
     /**
      * Instrumented `fetch`. In a test each call is recorded on the timeline
      * and resolves to a {@link WrappedResponse}: reads carry provenance so
-     * `expect(res.status)` / `expect(await res.json())` nest under the HTTP
+     * `expect(res.status)`, `expect(res.headers.get("content-type"))`, and
+     * `expect(await res.json())` nest under the HTTP
      * call. Because the status-line accessors are {@link Carrier}s, a raw
      * `res.status === 200` is a *type error* — use `res.status.unwrap()` /
      * `res.unwrap().status`, or assert via `expect`. Outside a test the
      * result is wrapped the same way, just with no timeline to link to.
+     * Body readers (`bytes`, `arrayBuffer`, `blob`, `formData`, `json`, `text`)
+     * and stream reader values also retain provenance. Use `captureBody: false`
+     * for open-ended streams; SSE responses skip recorder body capture automatically.
      *
      * (The plain global `fetch` is wrapped the same way at runtime but keeps
      * the standard `Response` type, so prefer `ctx.fetch` for honestly-typed

package/dist/inspect.d.ts

@@ -163,7 +163,7 @@ export type Provenanced = {
  * recovered at runtime by {@link adoptNullishTag}; `Provenanced` admits it because
  * it includes `null | undefined`.
  */
-export type Wrapped<T> = T extends null | undefined ? T : T extends readonly (infer U)[] ? WrappedArray<U> : T extends (...args: never[]) => unknown ? T : T extends object ? WrappedObject<T> : Carrier<T>;
+export type Wrapped<T> = T extends null | undefined ? T : T extends readonly (infer U)[] ? WrappedArray<U> : T extends ArrayBuffer | SharedArrayBuffer ? WrappedBuffer<T> : T extends ArrayBufferView ? WrappedBinaryView<T> : T extends File ? WrappedFile : T extends Blob ? WrappedBlob : T extends FormData ? WrappedFormData : T extends ReadableStream<infer C> ? WrappedStream<C> : T extends (...args: never[]) => unknown ? T : T extends object ? WrappedObject<T> : Carrier<T>;
 /** A wrapped object: every own property is itself {@link Wrapped}, plus an
  *  `.unwrap()` that recovers the fully-raw value (all nested leaves raw). */
 export type WrappedObject<T> = {
@@ -214,6 +214,69 @@ export interface WrappedArray<U> {
     /** Iteration yields *raw* elements (the runtime forwards the raw iterator). */
     [Symbol.iterator](): IterableIterator<U>;
 }
+/** Native objects need their own views: getters and methods must receive the
+ * real native receiver, and method results must be wrapped after they resolve.
+ * Iteration, callbacks, and control-flow flags on stream readers remain raw.
+ */
+type NativeResult<T> = T extends Promise<infer R> ? Promise<Wrapped<R>> : Wrapped<T>;
+type NativeView<T, K extends keyof T> = Omit<T, K> & {
+    readonly [P in K]: T[P] extends (...args: infer A) => infer R ? (...args: A) => NativeResult<R> : Wrapped<T[P]>;
+} & {
+    unwrap(): T;
+    transform<R>(label: string, fn: (raw: T) => R): Wrapped<R>;
+};
+export type WrappedBuffer<T extends ArrayBuffer | SharedArrayBuffer = ArrayBuffer> = NativeView<T, Extract<keyof T, "byteLength" | "maxByteLength" | "resizable" | "growable" | "detached" | "slice" | "transfer" | "transferToFixedLength">>;
+declare const BINARY_METHOD_NAMES: readonly ["at", "slice", "subarray", "includes", "indexOf", "lastIndexOf", "find", "findLast", "findIndex", "findLastIndex", "some", "every", "filter", "map", "join", "fill", "copyWithin", "reverse", "sort", "toReversed", "toSorted", "with", "toHex", "toBase64", "getInt8", "getUint8", "getInt16", "getUint16", "getInt32", "getUint32", "getFloat16", "getFloat32", "getFloat64", "getBigInt64", "getBigUint64"];
+/** Numeric indexes carry provenance. Like WrappedArray, length and iteration
+ * stay raw; callbacks receive native values. Unwrap for native API inputs. */
+export type WrappedBinaryView<T extends ArrayBufferView> = NativeView<T, Extract<keyof T, number | "buffer" | "byteLength" | "byteOffset" | typeof BINARY_METHOD_NAMES[number]>>;
+export type WrappedBytes = WrappedBinaryView<Uint8Array>;
+export type WrappedBlob = NativeView<Blob, "size" | "type" | "slice" | "text" | "bytes" | "arrayBuffer" | "stream">;
+export type WrappedFile = NativeView<File, "name" | "lastModified" | "webkitRelativePath" | "size" | "type" | "slice" | "text" | "bytes" | "arrayBuffer" | "stream">;
+export type WrappedFormData = NativeView<FormData, "get" | "getAll" | "has">;
+export type WrappedReadResult<T> = {
+    done: false;
+    value: Wrapped<T>;
+} | {
+    done: true;
+    value: Wrapped<T> | undefined;
+};
+export interface WrappedReader<T> extends Omit<ReadableStreamDefaultReader<T>, "read"> {
+    read(): Promise<WrappedReadResult<T>>;
+    unwrap(): ReadableStreamDefaultReader<T>;
+}
+export interface WrappedBYOBReader extends Omit<ReadableStreamBYOBReader, "read"> {
+    read<T extends ArrayBufferView>(view: T, options?: {
+        min?: number;
+    }): Promise<WrappedReadResult<T>>;
+    unwrap(): ReadableStreamBYOBReader;
+}
+export interface WrappedStream<T> extends Omit<ReadableStream<T>, "getReader" | "tee" | "pipeThrough"> {
+    getReader(): WrappedReader<T>;
+    getReader(options: {
+        mode: "byob";
+    }): WrappedBYOBReader;
+    getReader(options: ReadableStreamGetReaderOptions): WrappedReader<T> | WrappedBYOBReader;
+    tee(): [WrappedStream<T>, WrappedStream<T>];
+    pipeThrough<R>(transform: ReadableWritablePair<R, any>, options?: StreamPipeOptions): WrappedStream<R>;
+    unwrap(): ReadableStream<T>;
+    transform<R>(label: string, fn: (raw: ReadableStream<T>) => R): Wrapped<R>;
+}
+/** Response headers whose lookups retain the originating HTTP call's provenance.
+ * Missing headers remain `null`; `expect(headers.get(name)).toBe(null)` still
+ * links to the call. Iterators and other native methods return raw values.
+ */
+export interface WrappedHeaders extends Omit<Headers, "get" | "has" | "getSetCookie" | "getAll" | "toJSON" | "count"> {
+    get(name: string): Carrier<string> | null;
+    /** Unwrap before using the result as a condition. */
+    has(name: string): Carrier<boolean>;
+    getSetCookie(): WrappedArray<string>;
+    getAll(name: "set-cookie" | "Set-Cookie"): WrappedArray<string>;
+    toJSON(): Wrapped<Record<string, string | string[]>>;
+    readonly count: Carrier<number>;
+    unwrap(): Headers;
+    transform<R = unknown>(label: string, fn: (raw: Headers) => R): Wrapped<R>;
+}
 /**
  * The view `ctx.fetch` resolves to in every context (a spectest op wraps
  * unconditionally): a {@link Response} whose status-line accessors are
@@ -222,8 +285,9 @@ export interface WrappedArray<U> {
  * used to silently always be false. Compare `res.status.unwrap() === 200`
  * or `res.unwrap().status === 200`, or assert with `expect(res.status)`.
  *
- * `json<T>()` / `text()` return {@link Wrapped} body values; `.unwrap()`
- * (or {@link unwrap the whole response}) recovers the plain `Response`.
+ * All body readers return provenance-carrying values, including binary bodies,
+ * blobs and form data. `.unwrap()` recovers the native response or body value.
+ * Stream reader `done` and stream `locked` remain raw control-flow booleans.
  */
 export interface WrappedResponse {
     readonly status: Carrier<number>;
@@ -232,13 +296,15 @@ export interface WrappedResponse {
     readonly url: Carrier<string>;
     readonly redirected: Carrier<boolean>;
     readonly type: Carrier<string>;
-    readonly headers: Headers;
-    readonly bodyUsed: boolean;
+    readonly headers: WrappedHeaders;
+    readonly bodyUsed: Carrier<boolean>;
+    readonly body: WrappedStream<Uint8Array> | null;
     json<T = unknown>(): Promise<Wrapped<T>>;
     text(): Promise<Carrier<string>>;
-    arrayBuffer(): Promise<ArrayBuffer>;
-    blob(): Promise<Blob>;
-    formData(): Promise<FormData>;
+    arrayBuffer(): Promise<WrappedBuffer>;
+    bytes(): Promise<WrappedBytes>;
+    blob(): Promise<WrappedBlob>;
+    formData(): Promise<WrappedFormData>;
     clone(): WrappedResponse;
     /** Recover the underlying raw {@link Response} (a real `number` status,
      *  an unwrapped body, etc.). */
@@ -246,12 +312,19 @@ export interface WrappedResponse {
 }
 /** The signature of `ctx.fetch`: a `fetch` that resolves to a
  *  {@link WrappedResponse} so reads carry provenance into assertions. */
-export type SpectestFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<WrappedResponse>;
+export type SpectestFetch = (input: RequestInfo | URL, init?: SpectestRequestInit) => Promise<WrappedResponse>;
+export interface SpectestRequestInit extends RequestInit {
+    /** Skip the recorder's body capture for open-ended streams. SSE skips it
+     * automatically. The response and assertions remain recorded. */
+    captureBody?: boolean;
+}
 /**
  * Bespoke wrapper for `fetch` responses. Reads on `status` / `ok` /
  * `statusText` / `url` / `redirected` / `type` return carriers tagged
- * to `sourceSeq`. The body-reading methods (`json`, `text`) return the
- * resolved value wrapped under `path: ["body"]`. Everything else passes
- * through bound to the real Response.
+ * to `sourceSeq`. Every body-reading method returns its resolved value
+ * wrapped under `path: ["body"]`. Header lookups carry paths
+ * under `headers`, and clones retain the same provenance. Everything else
+ * passes through bound to the real Response.
  */
 export declare function wrapResponse(res: Response, sourceSeq: number | undefined): WrappedResponse;
+export {};

package/dist/inspect.js

@@ -210,6 +210,20 @@ export function wrap(raw, sourceSeq, path = []) {
         return raw;
     const t = typeof raw;
     if (t === "object") {
+        const native = readRaw(raw);
+        if (native instanceof ArrayBuffer || (typeof SharedArrayBuffer !== "undefined" && native instanceof SharedArrayBuffer)) {
+            return wrapNative(native, sourceSeq, path, new Set(["byteLength", "maxByteLength", "resizable", "growable", "detached"]), new Set(["slice", "transfer", "transferToFixedLength"]));
+        }
+        if (ArrayBuffer.isView(native)) {
+            return wrapNative(native, sourceSeq, path, new Set(["buffer", "byteLength", "byteOffset"]), BINARY_METHODS, true);
+        }
+        if (native instanceof Blob) {
+            return wrapNative(native, sourceSeq, path, new Set(["size", "type", "name", "lastModified", "webkitRelativePath"]), new Set(["slice", "text", "bytes", "arrayBuffer", "stream"]));
+        }
+        if (native instanceof FormData)
+            return wrapFormData(native, sourceSeq, path);
+        if (native instanceof ReadableStream)
+            return wrapStream(native, sourceSeq, path);
         return wrapObject(raw, sourceSeq, path);
     }
     if (t === "function")
@@ -437,15 +451,140 @@ export function field(value, ...path) {
         return cur;
     return retag(cur, tag.sourceSeq, [...tag.path, ...path.map(String)]);
 }
+const BINARY_METHOD_NAMES = [
+    "at", "slice", "subarray", "includes", "indexOf", "lastIndexOf", "find", "findLast",
+    "findIndex", "findLastIndex", "some", "every", "filter", "map", "join",
+    "fill", "copyWithin", "reverse", "sort", "toReversed", "toSorted", "with", "toHex", "toBase64",
+    "getInt8", "getUint8", "getInt16", "getUint16", "getInt32", "getUint32",
+    "getFloat16", "getFloat32", "getFloat64", "getBigInt64", "getBigUint64",
+];
+const BINARY_METHODS = new Set(BINARY_METHOD_NAMES);
+function wrapNative(raw, sourceSeq, path, properties, methods, indexes = false) {
+    const tag = { sourceSeq, path };
+    return new Proxy(raw, {
+        get(target, prop) {
+            if (prop === OP_TAG)
+                return tag;
+            if (prop === UNWRAP)
+                return target;
+            if (prop === "unwrap")
+                return () => target;
+            if (prop === "transform")
+                return makeTransform(target, sourceSeq, path);
+            const value = Reflect.get(target, prop, target);
+            if (typeof prop === "string") {
+                if (properties.has(prop) || (indexes && /^(0|[1-9]\d*)$/.test(prop))) {
+                    return wrapChild(value, sourceSeq, [...path, prop]);
+                }
+                if (methods.has(prop) && typeof value === "function") {
+                    return (...args) => {
+                        const result = value.apply(target, args);
+                        const resultPath = [...path, `<${prop}>`];
+                        return result instanceof Promise
+                            ? result.then((v) => wrapChild(v, sourceSeq, resultPath))
+                            : wrapChild(result, sourceSeq, resultPath);
+                    };
+                }
+            }
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+        has(target, prop) {
+            return prop === OP_TAG || prop === UNWRAP || Reflect.has(target, prop);
+        },
+    });
+}
+function wrapFormData(raw, sourceSeq, path) {
+    const base = wrapNative(raw, sourceSeq, path, new Set(), new Set());
+    return new Proxy(base, {
+        get(target, prop) {
+            if (prop === "get" || prop === "getAll" || prop === "has") {
+                return (name) => wrapChild(raw[prop](name), sourceSeq, prop === "get" ? [...path, name] : [...path, name, `<${prop}>`]);
+            }
+            return Reflect.get(target, prop);
+        },
+    });
+}
+function wrapStream(raw, sourceSeq, path) {
+    const base = wrapNative(raw, sourceSeq, path, new Set(), new Set(["pipeThrough"]));
+    return new Proxy(base, {
+        get(target, prop) {
+            if (prop === "tee")
+                return () => raw.tee().map((s, i) => wrapStream(s, sourceSeq, [...path, `<tee>`, String(i)]));
+            if (prop === "getReader")
+                return (options) => {
+                    const reader = raw.getReader(options);
+                    let index = 0;
+                    return new Proxy(reader, {
+                        get(r, key) {
+                            if (key === "unwrap" || key === UNWRAP)
+                                return key === "unwrap" ? () => r : r;
+                            if (key === OP_TAG)
+                                return { sourceSeq, path };
+                            if (key === "read")
+                                return async (...args) => {
+                                    const read = r.read;
+                                    const result = await read.apply(r, args);
+                                    const valuePath = [...path, "<read>", String(index++)];
+                                    // done stays a real boolean so normal reader loops terminate.
+                                    return { done: result.done, get value() { return wrapChild(result.value, sourceSeq, valuePath); } };
+                                };
+                            const value = Reflect.get(r, key, r);
+                            return typeof value === "function" ? value.bind(r) : value;
+                        },
+                        has(r, key) { return key === UNWRAP || key === OP_TAG || Reflect.has(r, key); },
+                    });
+                };
+            return Reflect.get(target, prop);
+        },
+    });
+}
+function wrapHeaders(headers, sourceSeq) {
+    const path = ["headers"];
+    const tag = { sourceSeq, path };
+    return new Proxy(headers, {
+        get(target, prop) {
+            if (prop === OP_TAG)
+                return tag;
+            if (prop === UNWRAP)
+                return target;
+            if (prop === "unwrap")
+                return () => target;
+            if (prop === "transform")
+                return makeTransform(target, sourceSeq, path);
+            if (prop === "get" || prop === "has") {
+                return (name) => wrapChild(target[prop](name), sourceSeq, prop === "get" ? [...path, name.toLowerCase()] : [...path, name.toLowerCase(), "<has>"]);
+            }
+            if (prop === "count")
+                return wrap(target.count, sourceSeq, [...path, "count"]);
+            if (prop === "getAll")
+                return (name) => wrap(target.getAll(name), sourceSeq, [...path, name.toLowerCase()]);
+            if (prop === "toJSON")
+                return () => wrap(target.toJSON(), sourceSeq, path);
+            if (prop === "getSetCookie") {
+                return () => wrap(target.getSetCookie(), sourceSeq, [...path, "set-cookie"]);
+            }
+            const value = Reflect.get(target, prop, target);
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+        has(target, prop) {
+            if (prop === OP_TAG || prop === UNWRAP)
+                return true;
+            return Reflect.has(target, prop);
+        },
+    });
+}
 /**
  * Bespoke wrapper for `fetch` responses. Reads on `status` / `ok` /
  * `statusText` / `url` / `redirected` / `type` return carriers tagged
- * to `sourceSeq`. The body-reading methods (`json`, `text`) return the
- * resolved value wrapped under `path: ["body"]`. Everything else passes
- * through bound to the real Response.
+ * to `sourceSeq`. Every body-reading method returns its resolved value
+ * wrapped under `path: ["body"]`. Header lookups carry paths
+ * under `headers`, and clones retain the same provenance. Everything else
+ * passes through bound to the real Response.
  */
 export function wrapResponse(res, sourceSeq) {
     const tag = { sourceSeq, path: [] };
+    let headers;
+    let body;
     const carrierProps = new Set([
         "status",
         "ok",
@@ -453,8 +592,9 @@ export function wrapResponse(res, sourceSeq) {
         "url",
         "redirected",
         "type",
+        "bodyUsed",
     ]);
-    const bodyMethods = new Set(["json", "text"]);
+    const bodyMethods = new Set(["json", "text", "bytes", "arrayBuffer", "blob", "formData"]);
     const handler = {
         get(target, prop) {
             if (prop === OP_TAG)
@@ -466,6 +606,15 @@ export function wrapResponse(res, sourceSeq) {
                 return () => readRaw(target);
             if (prop === "then")
                 return undefined;
+            if (prop === "headers")
+                return headers ??= wrapHeaders(target.headers, sourceSeq);
+            if (prop === "body") {
+                if (target.body === null)
+                    return wrapChild(null, sourceSeq, ["body"]);
+                return body ??= wrapStream(target.body, sourceSeq, ["body"]);
+            }
+            if (prop === "clone")
+                return () => wrapResponse(target.clone(), sourceSeq);
             if (typeof prop === "string" && carrierProps.has(prop)) {
                 const value = target[prop];
                 return wrap(value, sourceSeq, [prop]);
@@ -476,7 +625,7 @@ export function wrapResponse(res, sourceSeq) {
                     return fn;
                 return async (...args) => {
                     const value = await fn.apply(target, args);
-                    return wrap(value, sourceSeq, ["body"]);
+                    return wrapChild(value, sourceSeq, ["body"]);
                 };
             }
             const value = target[prop];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.88.3",
+  "version": "0.89.1",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/electron-chrome.ts

@@ -1,7 +1,55 @@
+// Trust for the environment CA, applied per session. Chromium on Linux
+// reads its own root store (NSS), never the container's mounted bundle, so
+// the renderer rejects every certificate the environment mints while Node
+// in the main process accepts them through NODE_EXTRA_CA_CERTS. This verify
+// procedure accepts exactly the chains that CA issued for the requested
+// host, and defers to Chromium's own verdict for everything else. An app
+// that installs its own procedure later replaces it, as in production.
+// Kept free of Electron so the unit test can run it under Bun.
+export const ELECTRON_CA_TRUST = String.raw`
+const { X509Certificate } = require('node:crypto');
+function loadEnvironmentCa(path) {
+  try { return path ? new X509Certificate(require('node:fs').readFileSync(path)) : null; }
+  catch { return null; }
+}
+// request: { hostname, errorCode, certificate: { data, issuerCert? } }.
+// Returns true only for a chain that ends at the CA and names the host.
+function issuedByEnvironmentCa(ca, request) {
+  try {
+    const leaf = new X509Certificate(request.certificate.data);
+    const host = request.hostname;
+    const named = leaf.checkHost(host) !== undefined || leaf.checkIP(host) !== undefined;
+    if (!named) return false;
+    const chain = [leaf];
+    for (let c = request.certificate; c.issuerCert && c.issuerCert !== c && chain.length < 8; c = c.issuerCert) {
+      chain.push(new X509Certificate(c.issuerCert.data));
+    }
+    for (let i = 0; i < chain.length; i++) {
+      const cert = chain[i];
+      if (cert.fingerprint256 === ca.fingerprint256) return i > 0;
+      const issuer = chain[i + 1] ?? ca;
+      if (!cert.checkIssued(issuer) || !cert.verify(issuer.publicKey)) return false;
+    }
+    return true;
+  } catch { return false; }
+}
+`;
+
 // Runs before the application's main entry, like Playwright's Electron loader.
 // Observe constructor options; do not replace the app entry, preload, IPC, or OS.
 export const ELECTRON_CHROME_HOOK = String.raw`
 const electron = require('electron');
+${ELECTRON_CA_TRUST}
+const environmentCa = loadEnvironmentCa(process.env.NODE_EXTRA_CA_CERTS);
+if (environmentCa) {
+  // Every session, including the default one and app-created partitions.
+  electron.app.on('session-created', session => {
+    session.setCertificateVerifyProc((request, callback) => {
+      if (request.errorCode === 0) return callback(0);
+      callback(issuedByEnvironmentCa(environmentCa, request) ? 0 : -3);
+    });
+  });
+}
 const NativeBrowserWindow = electron.BrowserWindow;
 const WrappedBrowserWindow = new Proxy(NativeBrowserWindow, {
   construct(Target, args, NewTarget) {