slicetest 0.3.0 → 0.5.0

package/dist/record.js

@@ -0,0 +1,201 @@
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import http from "node:http";
+import path from "node:path";
+import { stringify } from "yaml";
+import { mask } from "./trace.js";
+export const SESSION_ENV = "SLICETEST_RECORD_SESSION";
+/** Requests a browser makes on its own, not part of what the scenario is about. */
+const ASSET = /\.(ico|png|jpe?g|gif|webp|avif|svg|css|js|mjs|map|woff2?|ttf|eot)(\?|$)/i;
+/** Hop-by-hop headers, and the ones fetch rewrites. */
+const DROP_REQUEST = new Set(["host", "connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-connection", "content-length", "accept-encoding"]);
+const DROP_RESPONSE = new Set(["connection", "keep-alive", "transfer-encoding", "content-encoding", "content-length"]);
+export async function runSession(ctx, session) {
+    const exchanges = [];
+    const target = ctx.app.url;
+    const proxy = http.createServer(async (req, res) => {
+        const chunks = [];
+        for await (const c of req)
+            chunks.push(c);
+        const body = Buffer.concat(chunks);
+        const headers = new Headers();
+        for (const [k, v] of Object.entries(req.headers)) {
+            if (v === undefined || DROP_REQUEST.has(k))
+                continue;
+            for (const value of Array.isArray(v) ? v : [v])
+                headers.append(k, value);
+        }
+        try {
+            const upstream = await fetch(new URL(req.url ?? "/", target), {
+                method: req.method,
+                headers,
+                body: body.length && req.method !== "GET" && req.method !== "HEAD" ? body : undefined,
+                redirect: "manual",
+            });
+            const payload = Buffer.from(await upstream.arrayBuffer());
+            const out = {};
+            upstream.headers.forEach((v, k) => {
+                if (!DROP_RESPONSE.has(k) && k !== "set-cookie")
+                    out[k] = v;
+            });
+            const cookies = upstream.headers.getSetCookie();
+            if (cookies.length)
+                out["set-cookie"] = cookies;
+            res.writeHead(upstream.status, out).end(payload);
+            exchanges.push({
+                method: req.method ?? "GET",
+                path: req.url ?? "/",
+                contentType: req.headers["content-type"],
+                body: body.toString("utf8"),
+                status: upstream.status,
+                responseType: upstream.headers.get("content-type") ?? undefined,
+                response: payload.toString("utf8"),
+            });
+        }
+        catch (e) {
+            res.writeHead(502, { "content-type": "text/plain" }).end(`slicetest record: the app didn't answer: ${e.message}\n`);
+        }
+    });
+    await new Promise((resolve, reject) => {
+        proxy.once("error", reject);
+        proxy.listen(session.port, "127.0.0.1", resolve);
+    });
+    const url = `http://127.0.0.1:${proxy.address().port}`;
+    await writeFile(session.stateFile, JSON.stringify({ url, app: target }));
+    while (!existsSync(session.stopFile))
+        await new Promise((r) => setTimeout(r, 200));
+    await new Promise((resolve) => proxy.close(() => resolve()));
+    proxy.closeAllConnections();
+    const calls = Object.fromEntries(session.stubs.map((name) => [name, ctx.stub(name).calls()]));
+    const changes = await ctx.db.changes();
+    const { yaml, summary } = buildScenario(exchanges, calls, changes, { name: path.basename(session.out).replace(/\.scenario\.ya?ml$/, "") });
+    await writeFile(session.out, yaml);
+    await writeFile(session.stateFile, JSON.stringify({ url, done: true, summary }));
+}
+/** The recorded session as a YAML scenario, with a comment header of what to review. */
+export function buildScenario(exchanges, calls, changes, { name = "recorded session", now = new Date() } = {}) {
+    const kept = exchanges.filter((x) => !ASSET.test(x.path));
+    const steps = [];
+    const notes = [];
+    // Stubs first: the answers the services gave, so the replay doesn't need them.
+    const unanswered = [];
+    let stubRoutes = 0;
+    for (const [stub, list] of Object.entries(calls)) {
+        const groups = new Map();
+        for (const c of list) {
+            if (!c.response || c.response.status === 501) {
+                unanswered.push(`${stub}: ${c.method} ${c.path}`);
+                continue;
+            }
+            const key = `${c.method} ${c.path}`;
+            groups.set(key, [...(groups.get(key) ?? []), c]);
+        }
+        for (const [on, group] of groups) {
+            const replies = group.map((c) => ({ status: c.response.status, ...(c.response.body ? { body: parse(c.response.body, c.response.headers["content-type"]) } : {}) }));
+            const same = replies.every((r) => JSON.stringify(r) === JSON.stringify(replies[0]));
+            steps.push({ stub, on, ...(same ? { reply: replies[0] } : { sequence: replies }) });
+            stubRoutes++;
+        }
+    }
+    if (unanswered.length)
+        notes.push(`These calls got no answer while recording (register a route, or give the stub an upstream / autoReply): ${unanswered.join(", ")}`);
+    // Values from earlier responses that later requests use (ids in paths, tokens in bodies) become captures.
+    const captured = new Map();
+    kept.forEach((x, i) => {
+        let reqPath = x.path;
+        let reqBody = x.body;
+        for (const [value, variable] of captured) {
+            reqPath = reqPath.split(value).join(`{{${variable}}}`);
+            reqBody = reqBody.split(value).join(`{{${variable}}}`);
+        }
+        const [method, pathOnly] = [x.method, reqPath];
+        const step = { request: `${method} ${pathOnly}` };
+        if (x.body) {
+            if (/json/i.test(x.contentType ?? ""))
+                step.json = parse(reqBody, "application/json");
+            else if (/x-www-form-urlencoded/i.test(x.contentType ?? ""))
+                step.form = Object.fromEntries(new URLSearchParams(reqBody));
+            else
+                step.body = reqBody;
+        }
+        const expectation = { status: x.status };
+        const json = /json/i.test(x.responseType ?? "") ? parse(x.response, "application/json") : undefined;
+        if (json !== undefined && typeof json === "object")
+            expectation.json = loosen(json);
+        else if (!/html/i.test(x.responseType ?? "") && x.response && x.response.length <= 200)
+            expectation.text = x.response;
+        step.expect = expectation;
+        // Capture top-level values that show up again later.
+        if (json && typeof json === "object" && !Array.isArray(json)) {
+            const later = kept.slice(i + 1).map((y) => `${y.path}\n${y.body}`).join("\n");
+            const capture = {};
+            for (const [key, value] of Object.entries(json)) {
+                if ((typeof value !== "string" && typeof value !== "number") || String(value).length < 3 || !later.includes(String(value)))
+                    continue;
+                let variable = key.replace(/\W/g, "_");
+                while ([...captured.values()].includes(variable))
+                    variable += "_";
+                capture[variable] = `json.${key}`;
+                captured.set(String(value), variable);
+            }
+            if (Object.keys(capture).length)
+                step.capture = capture;
+        }
+        steps.push(step);
+    });
+    for (const [stub, list] of Object.entries(calls)) {
+        const byCall = new Map();
+        for (const c of list)
+            if (c.response && c.response.status !== 501)
+                byCall.set(`${c.method} ${c.path}`, (byCall.get(`${c.method} ${c.path}`) ?? 0) + 1);
+        for (const [call, times] of byCall)
+            steps.push({ received: stub, call, times });
+    }
+    const tables = Object.keys(changes);
+    const counts = Object.fromEntries(Object.entries(changes).map(([table, c]) => [
+        table,
+        Object.fromEntries(Object.entries({ inserted: c.inserted.length, updated: c.updated.length, deleted: c.deleted.length }).filter(([, n]) => n > 0)),
+    ]));
+    steps.push({ changes: counts });
+    const skipped = exchanges.length - kept.length;
+    if (skipped)
+        notes.push(`${skipped} request(s) for static files (scripts, styles, images) were left out.`);
+    if (kept.length === 0)
+        notes.push("No requests to the app were recorded; send them to the proxy URL printed when recording started.");
+    const header = [
+        `# Recorded with \`npx slicetest record\` on ${now.toISOString().slice(0, 10)}. Review it before committing:`,
+        "# - give the scenario a name that says what it checks, and split it if it checks several things;",
+        "# - dates and UUIDs in responses are matched by type only, and `changes` only counts rows;",
+        "#   tighten what matters (see https://github.com/revo1290/slicetest#yaml-scenarios).",
+        ...notes.map((n) => `# - ${n}`),
+        "# yaml-language-server: $schema=https://unpkg.com/slicetest/schema/scenario.schema.json",
+        "",
+    ].join("\n");
+    const yaml = header + stringify({ scenarios: [{ name, steps }] }, { lineWidth: 0 });
+    const summary = { requests: kept.length, skippedAssets: skipped, stubs: stubRoutes, tables, unanswered };
+    return { yaml, summary };
+}
+function parse(text, contentType) {
+    if (/json/i.test(contentType ?? "")) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    return text;
+}
+/** Dates and UUIDs change from run to run: expect their type instead of their value. */
+function loosen(value) {
+    const walk = (v) => {
+        if (v === "[date]" || v === "[uuid]")
+            return { $type: "string" };
+        if (Array.isArray(v))
+            return v.map(walk);
+        if (v && typeof v === "object")
+            return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)]));
+        return v;
+    };
+    return walk(mask(value));
+}

package/dist/runtime.d.ts

@@ -1,8 +1,11 @@
 import { App } from "./app.js";
+import { Issuer } from "./auth.js";
 import type { ResolvedOptions } from "./config.js";
 import { Dependency } from "./containers.js";
 import { Db } from "./db.js";
 import { HttpClient } from "./http.js";
+import { Mailbox } from "./mail.js";
+import { QueryLog } from "./query-log.js";
 import { Stub } from "./stub.js";
 import { type MaskOptions, type Trace } from "./trace.js";
 export interface ScenarioContext {
@@ -19,6 +22,10 @@ export interface ScenarioContext {
      * with timestamps and UUIDs masked. `expect(await trace()).toMatchSnapshot()`.
      */
     trace: (opts?: MaskOptions) => Promise<Trace>;
+    /** Mail the app sent during the scenario. Needs `mail: true` in the config. */
+    mail: Mailbox;
+    /** The OpenID Connect issuer the app trusts: `auth.token(claims)`. Needs `auth` in the config. */
+    auth: Issuer;
 }
 /** Everything one test file needs: its own database, stub servers and app process. */
 export declare class Runtime {
@@ -34,6 +41,9 @@ export declare class Runtime {
     private readonly recorders;
     private readonly recordDir?;
     readonly containers: Map<string, Dependency>;
+    readonly mailbox?: Mailbox | undefined;
+    readonly issuer?: Issuer | undefined;
+    readonly queryLog?: QueryLog | undefined;
     private constructor();
     get http(): HttpClient;
     static start(opts: ResolvedOptions, shared: {

package/dist/runtime.js

@@ -2,11 +2,14 @@ import { randomUUID } from "node:crypto";
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { App } from "./app.js";
+import { Issuer } from "./auth.js";
 import { Dependency } from "./containers.js";
 import { Db, formatChanges } from "./db.js";
 import { engineFor } from "./drivers/index.js";
 import { formatHistory, HttpClient } from "./http.js";
+import { Mailbox } from "./mail.js";
 import { OpenApiSpec } from "./openapi.js";
+import { QueryLog } from "./query-log.js";
 import { Recorder } from "./recording.js";
 import { Stub } from "./stub.js";
 import { buildTrace, mask } from "./trace.js";
@@ -23,12 +26,15 @@ export class Runtime {
     recorders;
     recordDir;
     containers;
+    mailbox;
+    issuer;
+    queryLog;
     #http;
     /** Responses from the app that don't match its OpenAPI spec, this scenario. */
     #contract = [];
     /** Documented responses seen in this file, for the run's coverage report. */
     #covered = new Set();
-    constructor(app, services, db, stubs, opts, vars, specs, coverageDir, recorders = new Map(), recordDir, containers = new Map()) {
+    constructor(app, services, db, stubs, opts, vars, specs, coverageDir, recorders = new Map(), recordDir, containers = new Map(), mailbox, issuer, queryLog) {
         this.app = app;
         this.services = services;
         this.db = db;
@@ -40,6 +46,9 @@ export class Runtime {
         this.recorders = recorders;
         this.recordDir = recordDir;
         this.containers = containers;
+        this.mailbox = mailbox;
+        this.issuer = issuer;
+        this.queryLog = queryLog;
         this.#http = this.#client();
     }
     #client() {
@@ -72,6 +81,9 @@ export class Runtime {
         const containers = new Map();
         const services = new Map();
         let db;
+        let mailbox;
+        let issuer;
+        let queryLog;
         try {
             // Loaded first: a broken spec should fail before anything is started.
             const specs = {
@@ -102,6 +114,22 @@ export class Runtime {
             if (failed)
                 throw failed.reason;
             const vars = { "db.url": url };
+            if (opts.db.queries && engine.name !== "sqlite") {
+                const u = new URL(url);
+                queryLog = await QueryLog.start(engine.name, { host: u.hostname, port: Number(u.port || (engine.name === "mysql" ? 3306 : 5432)) });
+                vars["db.url"] = queryLog.proxyUrl(url);
+                db.attachQueryLog(queryLog);
+            }
+            if (engine.name === "sqlite")
+                vars["db.path"] = (await import("./drivers/sqlite.js")).sqlitePath(url);
+            if (opts.mail) {
+                mailbox = await Mailbox.start();
+                Object.assign(vars, { "mail.host": mailbox.host, "mail.port": String(mailbox.port), "mail.url": mailbox.url });
+            }
+            if (opts.auth) {
+                issuer = await Issuer.start(opts.auth);
+                Object.assign(vars, { "auth.issuer": issuer.url, "auth.jwks": issuer.jwksUrl, "auth.audience": issuer.audience });
+            }
             for (const [name, c] of containers) {
                 vars[`container.${name}`] = c.address;
                 vars[`container.${name}.host`] = c.host;
@@ -116,17 +144,22 @@ export class Runtime {
                 vars[`service.${name}.port`] = String(started.port);
             }
             const app = await App.start(opts.app, opts.root, vars);
-            return new Runtime(app, services, db, stubs, opts, vars, specs, shared.coverageDir, recorders, shared.recordDir, containers);
+            return new Runtime(app, services, db, stubs, opts, vars, specs, shared.coverageDir, recorders, shared.recordDir, containers, mailbox, issuer, queryLog);
         }
         catch (e) {
             await Promise.all([...services.values()].map((s) => s.stop()));
             await db?.close();
             await Promise.all([...stubs.values()].map((s) => s.close()));
             await Promise.allSettled([...containers.values()].map((c) => c.stop()));
+            await mailbox?.close();
+            await issuer?.close();
+            await queryLog?.close();
             throw e;
         }
     }
     context() {
+        const mailbox = this.mailbox;
+        const issuer = this.issuer;
         return {
             http: this.http,
             db: this.db,
@@ -151,7 +184,17 @@ export class Runtime {
                     throw new Error(`slicetest: unknown container "${name}". Declared containers: ${[...this.containers.keys()].join(", ") || "(none)"}`);
                 return c;
             },
-            trace: async (opts) => mask(buildTrace(this.http.history, this.stubs.values(), await this.db.changesSinceStart()), opts),
+            trace: async (opts) => mask(buildTrace(this.http.history, this.stubs.values(), await this.db.changesSinceStart(), this.mailbox), opts),
+            get mail() {
+                if (!mailbox)
+                    throw new Error("slicetest: mail is off. Add `mail: true` to the config and point the app's SMTP settings at {{mail.host}} / {{mail.port}}.");
+                return mailbox;
+            },
+            get auth() {
+                if (!issuer)
+                    throw new Error("slicetest: auth is off. Add `auth: true` to the config and point the app's JWT settings at {{auth.issuer}} / {{auth.jwks}}.");
+                return issuer;
+            },
         };
     }
     /** The app and every service, for checks that apply to all of them. */
@@ -177,6 +220,9 @@ export class Runtime {
             stub.reset();
         for (const recorder of this.recorders.values())
             recorder.reset();
+        this.mailbox?.reset();
+        this.issuer?.reset();
+        this.queryLog?.reset();
         await Promise.all([...this.containers.values()].map((c) => c.reset()));
         this.http.reset();
         for (const p of this.#processes())
@@ -247,6 +293,9 @@ export class Runtime {
         const unmatched = this.#unmatched();
         if (unmatched.length > 0)
             sections.push(`stub calls with no matching route:\n${unmatched.join("\n")}`);
+        const chaos = [...this.stubs.values()].map((s) => s.describeChaos()).filter((c) => c !== undefined);
+        if (chaos.length > 0)
+            sections.push(chaos.join("\n"));
         const contract = this.#contractViolations();
         if (contract.length > 0)
             sections.push(`OpenAPI mismatches:\n${contract.map((c) => `  ${c}`).join("\n")}`);
@@ -259,6 +308,13 @@ export class Runtime {
         catch (e) {
             sections.push(`database changes during this scenario: unavailable (${e.message})`);
         }
+        if (this.mailbox)
+            sections.push(this.mailbox.describe());
+        if (this.queryLog) {
+            const q = this.queryLog.queries();
+            const top = q.shapes().slice(0, 5).map((s) => `  ${s.count > 1 ? `×${s.count} ` : ""}${s.sql.length > 160 ? `${s.sql.slice(0, 157)}...` : s.sql}`);
+            sections.push(q.length ? `SQL the app ran during this scenario (${q.length} statements, most frequent first):\n${top.join("\n")}` : "SQL the app ran during this scenario: (none)");
+        }
         const logs = this.app.scenarioLogs();
         sections.push(logs ? `app output during this scenario:\n${logs}` : "app output during this scenario: (none)");
         for (const [name, service] of this.services) {
@@ -282,6 +338,9 @@ export class Runtime {
             this.db.close(),
             ...[...this.stubs.values()].map((s) => s.close()),
             ...[...this.containers.values()].map((c) => c.stop()),
+            this.mailbox?.close(),
+            this.issuer?.close(),
+            this.queryLog?.close(),
         ]);
         const failed = results.find((r) => r.status === "rejected");
         if (failed)

package/dist/stub.d.ts

@@ -19,6 +19,27 @@ export interface RecordedCall {
     };
     /** Answered by the fallback (e.g. an example from the provider's OpenAPI spec), not a registered route. */
     fallback?: boolean;
+    /** The fault `chaos()` injected instead of the normal answer: `503`, `reset`. */
+    fault?: string;
+}
+/**
+ * Faults injected into a stub's answers, to test the app's retries, timeouts and
+ * fallbacks. Random faults come from a seeded generator, so a failing run can be
+ * replayed with the seed printed in the failure output.
+ */
+export interface ChaosOptions {
+    /** Fail the first `n` calls, then answer normally: the shape of a retry test. */
+    failFirst?: number;
+    /** Share of calls (0–1) answered with one of `statuses`. */
+    errorRate?: number;
+    /** Error statuses to pick from. Default [500, 502, 503]; 429 and 503 come with `Retry-After: 1`. */
+    statuses?: number[];
+    /** Share of calls (0–1) whose connection is dropped without an answer. */
+    networkErrorRate?: number;
+    /** Extra delay for every call, in ms: a fixed value or a [min, max] range. */
+    latency?: number | [number, number];
+    /** Seed for the random choices. Default: `SLICETEST_CHAOS_SEED`, else random. */
+    seed?: number;
 }
 export interface StubResponse {
     status?: number;
@@ -70,6 +91,17 @@ export declare class Stub {
      * `call.params`) or be a RegExp; `method` may be `*`. Later routes win.
      */
     on(method: string, path: string | RegExp, match?: MatchOptions): RouteBuilder;
+    /**
+     * Inject faults into this stub's answers for the rest of the scenario:
+     * `stub("payments").chaos({ failFirst: 2 })` to test a retry,
+     * `chaos({ errorRate: 0.3, latency: [50, 200] })` to test resilience.
+     * Calls that fault don't use up `once()` / `times()` routes.
+     */
+    chaos(opts: ChaosOptions): this;
+    /** Calls `chaos()` answered with a fault. */
+    faults(): RecordedCall[];
+    /** The active `chaos()` settings and what they did, for failure output; undefined when off. */
+    describeChaos(): string | undefined;
     /** Calls received so far, optionally filtered by method, path and conditions (same syntax as `on()`). */
     calls(method?: string, path?: string | RegExp, match?: MatchOptions): RecordedCall[];
     unmatched(): RecordedCall[];

package/dist/stub.js

@@ -12,6 +12,7 @@ export class Stub {
     #fallback;
     /** Appended to the 501 answer for a call nothing could answer. */
     #hint;
+    #chaos;
     url = "";
     constructor(name) {
         this.name = name;
@@ -61,6 +62,74 @@ export class Stub {
         };
         return builder;
     }
+    /**
+     * Inject faults into this stub's answers for the rest of the scenario:
+     * `stub("payments").chaos({ failFirst: 2 })` to test a retry,
+     * `chaos({ errorRate: 0.3, latency: [50, 200] })` to test resilience.
+     * Calls that fault don't use up `once()` / `times()` routes.
+     */
+    chaos(opts) {
+        for (const key of ["errorRate", "networkErrorRate"]) {
+            const v = opts[key];
+            if (v !== undefined && !(v >= 0 && v <= 1))
+                throw new Error(`slicetest: chaos ${key} must be between 0 and 1, got ${v}`);
+        }
+        if (opts.statuses && (opts.statuses.length === 0 || opts.statuses.some((s) => !Number.isInteger(s) || s < 400 || s > 599))) {
+            throw new Error(`slicetest: chaos statuses must be 4xx/5xx codes, got ${JSON.stringify(opts.statuses)}`);
+        }
+        const envSeed = Number(process.env.SLICETEST_CHAOS_SEED);
+        const seed = opts.seed ?? (Number.isInteger(envSeed) ? envSeed : Math.floor(Math.random() * 2 ** 31));
+        this.#chaos = { opts, seed, random: mulberry32(seed), calls: 0 };
+        return this;
+    }
+    /** Calls `chaos()` answered with a fault. */
+    faults() {
+        return this.#calls.filter((c) => c.fault !== undefined);
+    }
+    /** The active `chaos()` settings and what they did, for failure output; undefined when off. */
+    describeChaos() {
+        const c = this.#chaos;
+        if (!c)
+            return undefined;
+        const settings = Object.entries(c.opts)
+            .filter(([k]) => k !== "seed")
+            .map(([k, v]) => `${k} ${JSON.stringify(v)}`)
+            .join(", ");
+        return `chaos on ${this.name}: ${settings}; ${this.faults().length} of ${c.calls} calls faulted. Replay with SLICETEST_CHAOS_SEED=${c.seed}`;
+    }
+    /** Delay and fault for the next call, consuming the random sequence in a fixed order. */
+    async #injectFault() {
+        const c = this.#chaos;
+        if (!c)
+            return undefined;
+        const { opts, random } = c;
+        const n = ++c.calls;
+        const lat = opts.latency;
+        const ms = lat === undefined ? 0 : Array.isArray(lat) ? lat[0] + Math.floor(random() * (lat[1] - lat[0] + 1)) : lat;
+        if (ms > 0)
+            await new Promise((r) => setTimeout(r, ms));
+        const statuses = opts.statuses ?? [500, 502, 503];
+        const pick = () => statuses[Math.floor(random() * statuses.length)];
+        if (opts.failFirst !== undefined && n <= opts.failFirst)
+            return { status: pick() };
+        const roll = random();
+        if (roll < (opts.networkErrorRate ?? 0))
+            return "reset";
+        if (roll < (opts.networkErrorRate ?? 0) + (opts.errorRate ?? 0))
+            return { status: pick() };
+        return undefined;
+    }
+    #fail(call, req, res, fault) {
+        call.matched = true;
+        if (fault === "reset") {
+            call.fault = "reset";
+            req.socket.destroy();
+            return;
+        }
+        call.fault = String(fault.status);
+        const retry = fault.status === 429 || fault.status === 503 ? { "retry-after": "1" } : undefined;
+        this.#send(call, res, { status: fault.status, headers: retry, body: { error: "slicetest chaos", status: fault.status } });
+    }
     /** Calls received so far, optionally filtered by method, path and conditions (same syntax as `on()`). */
     calls(method, path, match = {}) {
         const compiled = path === undefined ? undefined : compilePath(path);
@@ -82,6 +151,7 @@ export class Stub {
     reset() {
         this.#routes = [];
         this.#calls = [];
+        this.#chaos = undefined;
     }
     /**
      * Answer calls that no registered route matches, instead of failing with 501.
@@ -127,6 +197,12 @@ export class Stub {
             route = r;
             break;
         }
+        // Faults only replace answers the stub would give: an unknown route still fails as unmatched.
+        if (route || this.#fallback) {
+            const fault = await this.#injectFault();
+            if (fault)
+                return this.#fail(call, req, res, fault);
+        }
         if (!route) {
             let out;
             try {
@@ -262,3 +338,14 @@ function parseJson(body) {
         return undefined;
     }
 }
+/** A small seeded PRNG: the same seed gives the same faults on every run. */
+function mulberry32(seed) {
+    let a = seed >>> 0;
+    return () => {
+        a = (a + 0x6d2b79f5) >>> 0;
+        let t = a;
+        t = Math.imul(t ^ (t >>> 15), t | 1);
+        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}

package/dist/trace.d.ts

@@ -1,5 +1,6 @@
 import type { Changes } from "./db.js";
 import type { HttpResponse } from "./http.js";
+import type { Mailbox } from "./mail.js";
 import type { Stub } from "./stub.js";
 /**
  * Everything one scenario did at the three boundaries: the requests it made to
@@ -19,6 +20,13 @@ export interface Trace {
         status?: number;
     }[]>;
     db: Changes;
+    /** Mail the app sent, when the `mail` option is on. */
+    mail?: {
+        from: string;
+        to: string[];
+        subject: string;
+        text: string;
+    }[];
 }
 export interface MaskOptions {
     /** Keys whose values are always replaced, e.g. `["token", "password_hash"]`. Matched at any depth. */
@@ -32,4 +40,4 @@ export interface MaskOptions {
  * `[uuid]`, and the values of `keys` / strings matching `patterns` by `[masked]`.
  */
 export declare function mask<T>(value: T, opts?: MaskOptions): T;
-export declare function buildTrace(history: readonly HttpResponse[], stubs: Iterable<Stub>, db: Changes): Trace;
+export declare function buildTrace(history: readonly HttpResponse[], stubs: Iterable<Stub>, db: Changes, mailbox?: Mailbox): Trace;

package/dist/trace.js

@@ -30,7 +30,7 @@ export function mask(value, opts = {}) {
     };
     return walk(value);
 }
-export function buildTrace(history, stubs, db) {
+export function buildTrace(history, stubs, db, mailbox) {
     const trace = {
         http: history.map((r) => {
             const url = new URL(r.url, "http://app");
@@ -53,5 +53,7 @@ export function buildTrace(history, stubs, db) {
             };
         });
     }
+    if (mailbox)
+        trace.mail = mailbox.messages().map((m) => ({ from: m.from, to: m.to, subject: m.subject, text: m.text }));
     return trace;
 }

package/dist/vitest.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { configDefaults } from "vitest/config";
 import { resolveOptions } from "./config.js";
+import { SESSION_ENV } from "./record.js";
 import { parseScenarioFile } from "./yaml.js";
 /** YAML scenario files are picked up next to the regular test files. */
 export const YAML_SCENARIOS = "**/*.scenario.{yaml,yml}";
@@ -17,7 +18,9 @@ export function slicetest(options) {
             const root = path.resolve(config.root ?? process.cwd());
             // Mutated rather than returned: a returned list would replace Vitest's default include instead of extending it.
             const test = (config.test ??= {});
-            test.include = [...(test.include ?? configDefaults.include), YAML_SCENARIOS];
+            // `slicetest record` runs only its session file.
+            if (!process.env[SESSION_ENV])
+                test.include = [...(test.include ?? configDefaults.include), YAML_SCENARIOS];
             return {
                 test: {
                     globalSetup: [path.join(here, `global-setup${ext}`)],
@@ -31,7 +34,7 @@ export function slicetest(options) {
             const file = id.split("?")[0];
             if (!YAML_ID.test(file))
                 return;
-            const doc = parseScenarioFile(code, path.relative(root ?? process.cwd(), file) || file);
+            const doc = { ...parseScenarioFile(code, path.relative(root ?? process.cwd(), file) || file), path: file };
             const runtime = JSON.stringify(path.join(here, `yaml-runtime${ext}`));
             return { code: `import { defineYamlScenarios } from ${runtime};\ndefineYamlScenarios(${JSON.stringify(doc)});\n`, map: null };
         },

package/dist/webhook.d.ts

@@ -0,0 +1,40 @@
+/** A custom HMAC scheme: `header: prefix + hmac(secret, body)`. */
+export interface HmacScheme {
+    header: string;
+    /** Default `sha256`. */
+    algorithm?: string;
+    /** Default `hex`. */
+    encoding?: "hex" | "base64";
+    /** Prepended to the digest, e.g. `sha256=`. */
+    prefix?: string;
+}
+export type WebhookProvider = "stripe" | "github" | "slack" | "shopify" | "standard" | HmacScheme;
+export interface WebhookOptions {
+    provider: WebhookProvider;
+    /** The signing secret the app is configured with. For `standard` (Svix), `whsec_<base64>` or the raw key. */
+    secret: string;
+    /** Event type, sent where the provider puts it: `X-GitHub-Event`, `X-Shopify-Topic`. */
+    event?: string;
+    /** Unix seconds the signature is made for. Default: now. */
+    timestamp?: number;
+    /** Signed ten minutes ago: an app that rejects replays must refuse it. */
+    stale?: boolean;
+    /** Signed with a different secret: the app must refuse it. */
+    invalidSignature?: boolean;
+    /** Message id for `standard` (`webhook-id`). Default: a random `msg_…`. */
+    id?: string;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
+}
+/**
+ * The headers a provider sends with `body`, signed with `secret` the way its
+ * SDK verifies them: Stripe's `Stripe-Signature`, GitHub's
+ * `X-Hub-Signature-256`, Slack's `v0` signature, Shopify's base64 HMAC and
+ * Standard Webhooks (Svix, Resend, Clerk, …).
+ */
+export declare function signWebhook(body: string, opts: WebhookOptions): Record<string, string>;
+/** The bytes to send and their content type: objects as JSON, URLSearchParams as a form (Slack commands), strings as-is. */
+export declare function webhookBody(payload: unknown): {
+    body: string;
+    type: string;
+};