slicetest 0.4.0 → 0.6.0

package/dist/webhook.d.ts

@@ -0,0 +1,40 @@
+/** A custom HMAC scheme: `header: prefix + hmac(secret, body)`. */
+export interface HmacScheme {
+    header: string;
+    /** Default `sha256`. */
+    algorithm?: string;
+    /** Default `hex`. */
+    encoding?: "hex" | "base64";
+    /** Prepended to the digest, e.g. `sha256=`. */
+    prefix?: string;
+}
+export type WebhookProvider = "stripe" | "github" | "slack" | "shopify" | "standard" | HmacScheme;
+export interface WebhookOptions {
+    provider: WebhookProvider;
+    /** The signing secret the app is configured with. For `standard` (Svix), `whsec_<base64>` or the raw key. */
+    secret: string;
+    /** Event type, sent where the provider puts it: `X-GitHub-Event`, `X-Shopify-Topic`. */
+    event?: string;
+    /** Unix seconds the signature is made for. Default: now. */
+    timestamp?: number;
+    /** Signed ten minutes ago: an app that rejects replays must refuse it. */
+    stale?: boolean;
+    /** Signed with a different secret: the app must refuse it. */
+    invalidSignature?: boolean;
+    /** Message id for `standard` (`webhook-id`). Default: a random `msg_…`. */
+    id?: string;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
+}
+/**
+ * The headers a provider sends with `body`, signed with `secret` the way its
+ * SDK verifies them: Stripe's `Stripe-Signature`, GitHub's
+ * `X-Hub-Signature-256`, Slack's `v0` signature, Shopify's base64 HMAC and
+ * Standard Webhooks (Svix, Resend, Clerk, …).
+ */
+export declare function signWebhook(body: string, opts: WebhookOptions): Record<string, string>;
+/** The bytes to send and their content type: objects as JSON, URLSearchParams as a form (Slack commands), strings as-is. */
+export declare function webhookBody(payload: unknown): {
+    body: string;
+    type: string;
+};

package/dist/webhook.js

@@ -0,0 +1,52 @@
+import { createHmac, randomUUID } from "node:crypto";
+const hmac = (algorithm, key, data) => createHmac(algorithm, key).update(data);
+/**
+ * The headers a provider sends with `body`, signed with `secret` the way its
+ * SDK verifies them: Stripe's `Stripe-Signature`, GitHub's
+ * `X-Hub-Signature-256`, Slack's `v0` signature, Shopify's base64 HMAC and
+ * Standard Webhooks (Svix, Resend, Clerk, …).
+ */
+export function signWebhook(body, opts) {
+    const now = Math.floor(Date.now() / 1000);
+    const ts = opts.timestamp ?? (opts.stale ? now - 600 : now);
+    const secret = opts.invalidSignature ? `${opts.secret}-not-the-real-secret` : opts.secret;
+    const p = opts.provider;
+    if (typeof p === "object") {
+        if (!p.header)
+            throw new Error("slicetest: a custom webhook provider needs `header`, e.g. { header: \"X-Signature\", prefix: \"sha256=\" }");
+        return { [p.header]: `${p.prefix ?? ""}${hmac(p.algorithm ?? "sha256", secret, body).digest(p.encoding ?? "hex")}` };
+    }
+    switch (p) {
+        case "stripe":
+            return { "stripe-signature": `t=${ts},v1=${hmac("sha256", secret, `${ts}.${body}`).digest("hex")}` };
+        case "github":
+            return {
+                "x-hub-signature-256": `sha256=${hmac("sha256", secret, body).digest("hex")}`,
+                "x-github-event": opts.event ?? "ping",
+                "x-github-delivery": randomUUID(),
+            };
+        case "slack":
+            return { "x-slack-request-timestamp": String(ts), "x-slack-signature": `v0=${hmac("sha256", secret, `v0:${ts}:${body}`).digest("hex")}` };
+        case "shopify":
+            return {
+                "x-shopify-hmac-sha256": hmac("sha256", secret, body).digest("base64"),
+                ...(opts.event ? { "x-shopify-topic": opts.event } : {}),
+                "x-shopify-webhook-id": randomUUID(),
+            };
+        case "standard": {
+            const id = opts.id ?? `msg_${randomUUID().replace(/-/g, "")}`;
+            const key = secret.startsWith("whsec_") ? Buffer.from(secret.slice(6), "base64") : Buffer.from(secret);
+            return { "webhook-id": id, "webhook-timestamp": String(ts), "webhook-signature": `v1,${hmac("sha256", key, `${id}.${ts}.${body}`).digest("base64")}` };
+        }
+        default:
+            throw new Error(`slicetest: unknown webhook provider ${JSON.stringify(p)} (expected stripe, github, slack, shopify, standard or { header, prefix, encoding })`);
+    }
+}
+/** The bytes to send and their content type: objects as JSON, URLSearchParams as a form (Slack commands), strings as-is. */
+export function webhookBody(payload) {
+    if (typeof payload === "string")
+        return { body: payload, type: "application/json" };
+    if (payload instanceof URLSearchParams)
+        return { body: payload.toString(), type: "application/x-www-form-urlencoded" };
+    return { body: JSON.stringify(payload ?? {}), type: "application/json" };
+}

package/dist/x509.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Just enough X.509 to impersonate hosts in tests: a throwaway certificate
+ * authority, leaf certificates for the intercepted hosts, and the CA in the
+ * formats apps read it from (PEM bundle, and a PKCS#12 trust store for Java).
+ * DER is written by hand so the package needs no crypto dependency.
+ */
+import { KeyObject } from "node:crypto";
+export declare const seq: (...items: Buffer[]) => Buffer<ArrayBuffer>;
+interface Issued {
+    key: KeyObject;
+    der: Buffer;
+    pem: string;
+}
+/** A certificate authority that exists for one test run. */
+export declare class Authority {
+    #private;
+    readonly key: KeyObject;
+    readonly der: Buffer;
+    readonly pem: string;
+    constructor();
+    /** A certificate for `host`, signed by this authority (cached). */
+    leaf(host: string): Issued;
+}
+/** PEM bundle of `extra` plus the usual public roots, for SSL_CERT_FILE and friends (which replace the default store). */
+export declare function pemBundle(roots: readonly string[], extra: string): string;
+/**
+ * A PKCS#12 trust store of certificates, readable by Java without a password
+ * (`-Djavax.net.ssl.trustStoreType=PKCS12`, no `trustStorePassword`): no MAC and
+ * unencrypted certificate bags, each marked as a trusted certificate entry.
+ */
+export declare function pkcs12TrustStore(certs: {
+    alias: string;
+    der: Buffer;
+}[]): Buffer<ArrayBuffer>;
+/** DER of a PEM certificate, or undefined when it doesn't parse. */
+export declare function pemToDer(pem: string): Buffer<ArrayBuffer> | undefined;
+export {};

package/dist/x509.js

@@ -0,0 +1,150 @@
+/**
+ * Just enough X.509 to impersonate hosts in tests: a throwaway certificate
+ * authority, leaf certificates for the intercepted hosts, and the CA in the
+ * formats apps read it from (PEM bundle, and a PKCS#12 trust store for Java).
+ * DER is written by hand so the package needs no crypto dependency.
+ */
+import { createHash, createPublicKey, generateKeyPairSync, randomBytes, sign, X509Certificate } from "node:crypto";
+// --- DER ---
+function len(n) {
+    if (n < 0x80)
+        return Buffer.from([n]);
+    const bytes = [];
+    for (let v = n; v > 0; v >>= 8)
+        bytes.unshift(v & 0xff);
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+const tlv = (tag, ...content) => {
+    const body = Buffer.concat(content);
+    return Buffer.concat([Buffer.from([tag]), len(body.length), body]);
+};
+export const seq = (...items) => tlv(0x30, ...items);
+const set = (...items) => tlv(0x31, ...items);
+const octets = (b) => tlv(0x04, b);
+const bits = (b) => tlv(0x03, Buffer.from([0]), b);
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, "utf8"));
+const bmp = (s) => tlv(0x1e, Buffer.from(s, "utf16le").swap16());
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0]));
+const explicit = (n, ...content) => tlv(0xa0 + n, ...content);
+const int = (b) => {
+    let i = 0;
+    while (i < b.length - 1 && b[i] === 0)
+        i++;
+    const v = b.subarray(i);
+    return tlv(0x02, v[0] & 0x80 ? Buffer.concat([Buffer.from([0]), v]) : v);
+};
+const oid = (dotted) => {
+    const [a, b, ...rest] = dotted.split(".").map(Number);
+    const out = [a * 40 + b];
+    for (const n of rest) {
+        const chunk = [];
+        let v = n;
+        do {
+            chunk.unshift(v & 0x7f);
+            v = Math.floor(v / 128);
+        } while (v > 0);
+        for (let i = 0; i < chunk.length - 1; i++)
+            chunk[i] |= 0x80;
+        out.push(...chunk);
+    }
+    return tlv(0x06, Buffer.from(out));
+};
+const time = (d) => {
+    // UTCTime up to 2049, GeneralizedTime after, as RFC 5280 requires.
+    const iso = d.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+    return d.getUTCFullYear() < 2050 ? tlv(0x17, Buffer.from(`${iso.slice(2)}Z`)) : tlv(0x18, Buffer.from(`${iso}Z`));
+};
+const OID = {
+    ecdsaSha256: "1.2.840.10045.4.3.2",
+    commonName: "2.5.4.3",
+    organization: "2.5.4.10",
+    basicConstraints: "2.5.29.19",
+    keyUsage: "2.5.29.15",
+    extKeyUsage: "2.5.29.37",
+    serverAuth: "1.3.6.1.5.5.7.3.1",
+    subjectAltName: "2.5.29.17",
+    subjectKeyId: "2.5.29.14",
+    authorityKeyId: "2.5.29.35",
+    data: "1.2.840.113549.1.7.1",
+    certBag: "1.2.840.113549.1.12.10.1.3",
+    x509Certificate: "1.2.840.113549.1.9.22.1",
+    friendlyName: "1.2.840.113549.1.9.20",
+    // Java only treats a PKCS#12 certificate as trusted when it carries this attribute.
+    oracleTrustedKeyUsage: "2.16.840.1.113894.746875.1.1",
+    anyExtendedKeyUsage: "2.5.29.37.0",
+};
+const name = (cn) => seq(set(seq(oid(OID.organization), utf8("slicetest"))), set(seq(oid(OID.commonName), utf8(cn))));
+const extension = (id, critical, value) => seq(oid(id), ...(critical ? [bool(true)] : []), octets(value));
+const keyId = (key) => createHash("sha1").update(createPublicKey(key).export({ type: "spki", format: "der" })).digest();
+function certificate(opts) {
+    const now = Date.now();
+    const ski = keyId(opts.publicKey);
+    const extensions = [
+        extension(OID.basicConstraints, true, seq(...(opts.ca ? [bool(true)] : []))),
+        // CA: keyCertSign + cRLSign. Leaf: digitalSignature.
+        extension(OID.keyUsage, true, opts.ca ? tlv(0x03, Buffer.from([1, 0x06])) : tlv(0x03, Buffer.from([7, 0x80]))),
+        extension(OID.subjectKeyId, false, octets(ski)),
+        ...(opts.ca
+            ? []
+            : [
+                extension(OID.authorityKeyId, false, seq(tlv(0x80, opts.issuerKeyId))),
+                extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))),
+                extension(OID.subjectAltName, false, seq(...opts.hosts.map((h) => tlv(0x82, Buffer.from(h, "ascii"))))),
+            ]),
+    ];
+    const algorithm = seq(oid(OID.ecdsaSha256));
+    const tbs = seq(explicit(0, int(Buffer.from([2]))), // v3
+    int(randomBytes(16)), algorithm, name(opts.issuer), seq(time(new Date(now - 60 * 60_000)), time(new Date(now + (opts.ca ? 7 : 2) * 24 * 60 * 60_000))), name(opts.subject), createPublicKey(opts.publicKey).export({ type: "spki", format: "der" }), explicit(3, seq(...extensions)));
+    return seq(tbs, algorithm, bits(sign("sha256", tbs, opts.signer)));
+}
+const toPem = (der) => `-----BEGIN CERTIFICATE-----\n${der.toString("base64").replace(/.{64}/g, "$&\n").replace(/\n?$/, "\n")}-----END CERTIFICATE-----\n`;
+/** A certificate authority that exists for one test run. */
+export class Authority {
+    key;
+    der;
+    pem;
+    #keyId;
+    #leaves = new Map();
+    constructor() {
+        const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+        this.key = privateKey;
+        this.#keyId = keyId(privateKey);
+        this.der = certificate({ subject: "slicetest test CA", publicKey: privateKey, issuer: "slicetest test CA", signer: privateKey, issuerKeyId: this.#keyId, ca: true });
+        this.pem = toPem(this.der);
+    }
+    /** A certificate for `host`, signed by this authority (cached). */
+    leaf(host) {
+        let issued = this.#leaves.get(host);
+        if (!issued) {
+            const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+            const der = certificate({ subject: host, publicKey: privateKey, issuer: "slicetest test CA", signer: this.key, issuerKeyId: this.#keyId, ca: false, hosts: [host] });
+            issued = { key: privateKey, der, pem: toPem(der) };
+            this.#leaves.set(host, issued);
+        }
+        return issued;
+    }
+}
+/** PEM bundle of `extra` plus the usual public roots, for SSL_CERT_FILE and friends (which replace the default store). */
+export function pemBundle(roots, extra) {
+    return `${extra}${roots.map((r) => (r.endsWith("\n") ? r : `${r}\n`)).join("")}`;
+}
+/**
+ * A PKCS#12 trust store of certificates, readable by Java without a password
+ * (`-Djavax.net.ssl.trustStoreType=PKCS12`, no `trustStorePassword`): no MAC and
+ * unencrypted certificate bags, each marked as a trusted certificate entry.
+ */
+export function pkcs12TrustStore(certs) {
+    const bags = certs.map(({ alias, der }) => seq(oid(OID.certBag), explicit(0, seq(oid(OID.x509Certificate), explicit(0, octets(der)))), set(seq(oid(OID.friendlyName), set(bmp(alias))), seq(oid(OID.oracleTrustedKeyUsage), set(oid(OID.anyExtendedKeyUsage))))));
+    const safeContents = seq(...bags);
+    const authSafe = seq(seq(oid(OID.data), explicit(0, octets(safeContents))));
+    return seq(int(Buffer.from([3])), seq(oid(OID.data), explicit(0, octets(authSafe))));
+}
+/** DER of a PEM certificate, or undefined when it doesn't parse. */
+export function pemToDer(pem) {
+    try {
+        return Buffer.from(new X509Certificate(pem).raw);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/yaml-runtime.js

@@ -4,6 +4,8 @@ import "./provided.js";
 import { formatChanges } from "./db.js";
 import "./matchers.js";
 import { scenario } from "./scenario.js";
+import { signWebhook, webhookBody } from "./webhook.js";
+import { sse } from "./stub.js";
 /** Registers the scenarios of one parsed YAML file. Called from the module the plugin generates for it. */
 export function defineYamlScenarios(doc) {
     for (const sc of doc.scenarios) {
@@ -39,6 +41,8 @@ async function runSteps(doc, sc, steps, ctx, vars) {
     }
 }
 function describeStep(step) {
+    if ("submit" in step)
+        return step.submit === true ? "submit" : `submit ${JSON.stringify(step.submit)}`;
     if ("request" in step)
         return step.concurrency ? `${step.request} ×${step.concurrency}` : step.request;
     if ("stub" in step)
@@ -47,6 +51,10 @@ function describeStep(step) {
         return `received ${step.received}${step.call ? ` ${step.call}` : ""}`;
     if ("insert" in step)
         return `insert ${step.insert}`;
+    if ("make" in step)
+        return `make ${step.make}`;
+    if ("chaos" in step)
+        return `chaos ${step.chaos}`;
     if ("db" in step)
         return `db ${step.db}`;
     if ("changes" in step)
@@ -144,7 +152,10 @@ async function runStep(step, ctx, vars) {
         if (step.delay !== undefined)
             route = route.delay(step.delay);
         // Replies are interpolated when a call arrives, so they can echo it: {{call.params.id}}, {{call.json.name}}.
-        const answer = (template) => (call) => interpolate(template, { ...vars, call: callVars(call) });
+        const answer = (template) => (call) => {
+            const { sse: events, ...response } = interpolate(template, { ...vars, call: callVars(call) });
+            return events ? sse(events, response) : response;
+        };
         if (step.networkError)
             route.networkError();
         else if (step.sequence) {
@@ -156,32 +167,42 @@ async function runStep(step, ctx, vars) {
             route.reply(answer(step.reply ?? {}));
         return;
     }
+    if ("submit" in step) {
+        const page = ctx.http.history.at(-1);
+        if (!page)
+            throw new Error("submit needs a page with a form: request it first, e.g. `- request: GET /signup`");
+        const res = await ctx.http.submit(page, {
+            button: step.submit === true ? undefined : interpolate(step.submit, vars),
+            form: interpolate(step.form, vars),
+            fields: interpolate(step.fields, vars),
+            headers: interpolate(step.headers, vars),
+            follow: step.follow,
+        });
+        verifyResponse(res, step.expect, vars);
+        capture(step.capture, { status: res.status, json: res.json, text: res.text, headers: Object.fromEntries(res.headers) }, vars);
+        return;
+    }
     if ("request" in step) {
         const [method, rawPath] = splitCall(step.request);
         const path = interpolate(rawPath, vars);
+        const headers = interpolate(step.headers, vars);
         const opts = {
-            headers: interpolate(step.headers, vars),
+            headers: step.auth ? { ...ctx.auth.header(step.auth === true ? {} : interpolate(step.auth, vars)), ...headers } : headers,
             query: interpolate(step.query, vars),
             follow: step.follow,
         };
-        const body = step.json !== undefined
+        let body = step.json !== undefined
             ? interpolate(step.json, vars)
             : step.form !== undefined
                 ? ctx.http.form(interpolate(step.form, vars))
                 : interpolate(step.body, vars);
+        if (step.webhook) {
+            const signed = webhookBody(body);
+            body = signed.body;
+            opts.headers = { "content-type": signed.type, ...signWebhook(signed.body, interpolate(step.webhook, vars)), ...opts.headers };
+        }
         const e = step.expect;
-        const verify = (res) => {
-            if (e?.status !== undefined)
-                expect(res).toHaveStatus(interpolate(e.status, vars));
-            if (e?.headers !== undefined) {
-                const expected = Object.fromEntries(Object.entries(e.headers).map(([k, v]) => [k.toLowerCase(), v]));
-                check(Object.fromEntries(res.headers), expected, vars, "response headers");
-            }
-            if (e?.json !== undefined)
-                check(res.json, e.json, vars, "response JSON");
-            if (e?.text !== undefined)
-                check(res.text, e.text, vars, "response text");
-        };
+        const verify = (res) => verifyResponse(res, e, vars);
         if (step.concurrency !== undefined) {
             // Each request gets its own body: a URLSearchParams body can only be read once.
             const all = await ctx.http.concurrently(step.concurrency, () => ctx.http.request(method, path, body instanceof URLSearchParams ? new URLSearchParams(body) : body, opts));
@@ -190,7 +211,18 @@ async function runStep(step, ctx, vars) {
             all.forEach(verify);
             return;
         }
-        const res = await ctx.http.request(method, path, body, opts);
+        const max = e?.queries === undefined ? undefined : interpolate(e.queries, vars);
+        let res;
+        const queries = await (max === undefined ? undefined : ctx.db.queries(async () => (res = await ctx.http.request(method, path, body, opts))));
+        if (!queries)
+            res = await ctx.http.request(method, path, body, opts);
+        if (queries && max !== undefined) {
+            const ran = queries.withoutTransactions();
+            if (ran.length > max) {
+                const shapes = ran.shapes().map((s) => `  ${s.count > 1 ? `×${s.count} ` : ""}${s.sql}`);
+                throw new Error(`expected at most ${max} SQL statements for ${method} ${path}, the app ran ${ran.length}:\n${shapes.join("\n")}`);
+            }
+        }
         verify(res);
         capture(step.capture, { status: res.status, json: res.json, text: res.text, headers: Object.fromEntries(res.headers) }, vars);
         return;
@@ -200,6 +232,22 @@ async function runStep(step, ctx, vars) {
         capture(step.capture, { rows, row: rows[0] }, vars);
         return;
     }
+    if ("chaos" in step) {
+        const { chaos, name: _, ...opts } = step;
+        ctx.stub(chaos).chaos(opts);
+        return;
+    }
+    if ("make" in step) {
+        const given = interpolate(step.rows, vars) ?? {};
+        const rows = [];
+        if (Array.isArray(given))
+            for (const r of given)
+                rows.push(await ctx.db.make(step.make, r));
+        else
+            rows.push(...(await ctx.db.makeMany(step.make, step.count ?? 1, given)));
+        capture(step.capture, { rows, row: rows[0] }, vars);
+        return;
+    }
     if ("sql" in step) {
         const rows = await ctx.db.query(step.sql, interpolate(step.params, vars) ?? []);
         expectRows(step.expect, rows, vars);
@@ -358,3 +406,15 @@ function interpolateTitle(name, row, index) {
         return v === undefined ? m : typeof v === "object" ? JSON.stringify(v) : String(v);
     });
 }
+function verifyResponse(res, e, vars) {
+    if (e?.status !== undefined)
+        expect(res).toHaveStatus(interpolate(e.status, vars));
+    if (e?.headers !== undefined) {
+        const expected = Object.fromEntries(Object.entries(e.headers).map(([k, v]) => [k.toLowerCase(), v]));
+        check(Object.fromEntries(res.headers), expected, vars, "response headers");
+    }
+    if (e?.json !== undefined)
+        check(res.json, e.json, vars, "response JSON");
+    if (e?.text !== undefined)
+        check(res.text, e.text, vars, "response text");
+}

package/dist/yaml.d.ts

@@ -21,7 +21,7 @@ export interface YamlScenario {
     timeout?: number;
     steps: Step[];
 }
-export type Step = (StubStep | RequestStep | InsertStep | SqlStep | DbStep | ReceivedStep | ChangesStep | CheckpointStep | LogStep | SnapshotStep | MailStep) & {
+export type Step = (StubStep | RequestStep | SubmitStep | InsertStep | MakeStep | ChaosStep | SqlStep | DbStep | ReceivedStep | ChangesStep | CheckpointStep | LogStep | SnapshotStep | MailStep) & {
     line: number;
     name?: string;
 };
@@ -29,15 +29,26 @@ export interface StubStep {
     stub: string;
     on: string;
     when?: Conditions;
+    /** `sse`: a streamed reply, a list of { event, data, id } (instead of `body`). */
     reply?: {
         status?: number;
         headers?: Record<string, string>;
         body?: unknown;
+        sse?: {
+            event?: string;
+            data: unknown;
+            id?: string;
+        }[];
     };
     sequence?: {
         status?: number;
         headers?: Record<string, string>;
         body?: unknown;
+        sse?: {
+            event?: string;
+            data: unknown;
+            id?: string;
+        }[];
     }[];
     networkError?: boolean;
     times?: number;
@@ -57,14 +68,51 @@ export interface RequestStep {
     form?: Record<string, unknown>;
     body?: string;
     follow?: boolean;
+    /** Send `Authorization: Bearer` with a token from the `auth` issuer: `true`, or the claims, e.g. { sub: u1, roles: [admin] }. */
+    auth?: true | Record<string, unknown>;
+    /** Sign the body as this provider would deliver a webhook: { provider: stripe, secret: whsec_test, event, stale, invalidSignature }. */
+    webhook?: {
+        provider: string | {
+            header: string;
+            algorithm?: string;
+            encoding?: "hex" | "base64";
+            prefix?: string;
+        };
+        secret: string;
+        event?: string;
+        stale?: boolean;
+        invalidSignature?: boolean;
+    };
     /** Send the request this many times at once. `expect` applies to every response; `statuses` counts them. */
     concurrency?: number;
+    /** `queries`: at most this many SQL statements (not counting BEGIN/COMMIT), with `db.queries` on. */
     expect?: {
         status?: number;
         statuses?: Record<string, number>;
         headers?: Record<string, unknown>;
         json?: unknown;
         text?: unknown;
+        queries?: number;
+    };
+    capture?: Record<string, string>;
+}
+/**
+ * Submit a form of the page the last request returned, as a browser with JavaScript off would.
+ * `submit:` names the button to press (its text, value, name or id), or is `true` for the form's only button.
+ */
+export interface SubmitStep {
+    submit: string | true;
+    /** The form by id, name or 0-based position, when the page has several. */
+    form?: string | number;
+    /** Values typed into the form by field name; true / false / a list check checkboxes and radios. */
+    fields?: Record<string, string | number | boolean | (string | number)[]>;
+    headers?: Record<string, string>;
+    follow?: boolean;
+    expect?: {
+        status?: number;
+        headers?: Record<string, unknown>;
+        json?: unknown;
+        text?: unknown;
     };
     capture?: Record<string, string>;
 }
@@ -73,6 +121,24 @@ export interface InsertStep {
     rows: Record<string, unknown> | Record<string, unknown>[];
     capture?: Record<string, string>;
 }
+/** Rows built by `db.make()`: only the columns given are fixed, the rest is filled from the schema. */
+export interface MakeStep {
+    make: string;
+    rows?: Record<string, unknown> | Record<string, unknown>[];
+    /** Make this many rows, each with `rows` (a mapping). */
+    count?: number;
+    capture?: Record<string, string>;
+}
+/** Faults injected into a stub's answers for the rest of the scenario, like `stub(name).chaos()`. */
+export interface ChaosStep {
+    chaos: string;
+    failFirst?: number;
+    errorRate?: number;
+    statuses?: number[];
+    networkErrorRate?: number;
+    latency?: number | [number, number];
+    seed?: number;
+}
 export interface SqlStep {
     sql: string;
     params?: unknown[];