slicetest 0.7.0 → 0.9.0

package/dist/form.js

@@ -37,7 +37,12 @@ export function parseForms(html) {
     let open;
     let select;
     let option;
+    let groupDisabled = false;
+    // Controls inside a disabled <fieldset> are disabled too (and not submitted).
+    const fieldsets = [];
     const add = (control) => {
+        if (fieldsets.includes(true))
+            control.attrs.disabled ??= "";
         const formId = control.attrs.form;
         if (formId !== undefined)
             orphans.push({ formId, control });
@@ -48,7 +53,7 @@ export function parseForms(html) {
         if (!option || !select)
             return;
         const value = option.attrs.value ?? textOf(html.slice(option.start, end));
-        select.options.push({ value, selected: "selected" in option.attrs });
+        select.options.push({ value, selected: "selected" in option.attrs, disabled: "disabled" in option.attrs || groupDisabled });
         option = undefined;
     };
     TAG.lastIndex = 0;
@@ -62,6 +67,13 @@ export function parseForms(html) {
             TAG.lastIndex = end < 0 ? html.length : end;
             continue;
         }
+        if (tag === "fieldset") {
+            if (closing)
+                fieldsets.pop();
+            else
+                fieldsets.push("disabled" in parseAttrs(m[3] ?? ""));
+            continue;
+        }
         if (tag === "form") {
             if (closing)
                 current = undefined;
@@ -96,6 +108,7 @@ export function parseForms(html) {
             if (closing) {
                 closeOption(m.index);
                 select = undefined;
+                groupDisabled = false;
             }
             else {
                 select = { tag, attrs: parseAttrs(m[3] ?? ""), text: "", options: [] };
@@ -105,6 +118,8 @@ export function parseForms(html) {
         }
         if (tag === "option" || tag === "optgroup") {
             closeOption(m.index);
+            if (tag === "optgroup")
+                groupDisabled = !closing && "disabled" in parseAttrs(m[3] ?? "");
             if (tag === "option" && !closing && select)
                 option = { attrs: parseAttrs(m[3] ?? ""), start: TAG.lastIndex };
             continue;
@@ -162,12 +177,22 @@ export function formRequest(html, opts = {}) {
         throw new Error(`slicetest: submit: the button ${JSON.stringify(label(button))} is disabled`);
     const names = new Set(form.controls.filter((c) => c.attrs.name !== undefined && !isSubmit(c) && c.tag !== "button").map((c) => c.attrs.name));
     const typed = new Map();
+    const files = new Map();
+    const fileInputs = new Set(form.controls.filter((c) => c.tag === "input" && c.attrs.type?.toLowerCase() === "file").map((c) => c.attrs.name));
     for (const [name, value] of Object.entries(opts.fields ?? {})) {
         if (!names.has(name)) {
             const shown = [...names].filter((n) => !n.startsWith("$ACTION_"));
             throw new Error(`slicetest: submit: the form has no field "${name}". Fields: ${shown.join(", ") || "(none)"}`);
         }
-        typed.set(name, typeof value === "boolean" ? value : (Array.isArray(value) ? value : [value]).map(String));
+        if (fileInputs.has(name) !== value instanceof Blob) {
+            throw new Error(fileInputs.has(name)
+                ? `slicetest: submit: "${name}" is a file input; give it a file (a Blob or File, or { file: path } in YAML)`
+                : `slicetest: submit: "${name}" isn't a file input, so it can't take a file`);
+        }
+        if (value instanceof Blob)
+            files.set(name, value);
+        else
+            typed.set(name, typeof value === "boolean" ? value : (Array.isArray(value) ? value : [value]).map(String));
     }
     // The successful controls, in document order (HTML's "constructing the entry list").
     // A typed value replaces what the page had: text for a field, the checked state for
@@ -176,6 +201,12 @@ export function formRequest(html, opts = {}) {
     const done = new Set();
     for (const c of form.controls) {
         const name = c.attrs.name;
+        if (c === button && c.attrs.type?.toLowerCase() === "image") {
+            // An image button sends the click position, as name.x / name.y (x / y without a name).
+            const prefix = name ? `${name}.` : "";
+            entries.push([`${prefix}x`, "0"], [`${prefix}y`, "0"]);
+            continue;
+        }
         if (name === undefined || "disabled" in c.attrs)
             continue;
         if (c.tag === "button" || isSubmit(c)) {
@@ -184,8 +215,16 @@ export function formRequest(html, opts = {}) {
             continue;
         }
         const type = c.tag === "input" ? (c.attrs.type ?? "text").toLowerCase() : c.tag;
-        if (type === "reset" || type === "button" || type === "file")
+        if (type === "reset" || type === "button")
+            continue;
+        if (type === "file") {
+            // With no file chosen, browsers still send the field: an empty file without a name.
+            const file = files.get(name);
+            if (!done.has(name))
+                entries.push([name, file ?? new File([], "", { type: "application/octet-stream" })]);
+            done.add(name);
             continue;
+        }
         const want = typed.get(name);
         if (type === "checkbox" || type === "radio") {
             const value = c.attrs.value ?? "on";
@@ -203,10 +242,15 @@ export function formRequest(html, opts = {}) {
         else if (c.tag === "textarea")
             entries.push([name, c.text]);
         else if (c.tag === "select") {
-            const selected = c.options.filter((o) => o.selected);
-            const chosen = selected.length ? selected : "multiple" in c.attrs || c.options.length === 0 ? [] : [c.options[0]];
+            // With nothing selected, a single select shows its first option that isn't disabled; disabled options are never sent.
+            // A single select keeps only the last option marked selected.
+            const marked = c.options.filter((o) => o.selected);
+            const selected = "multiple" in c.attrs ? marked : marked.slice(-1);
+            const first = c.options.find((o) => !o.disabled);
+            const chosen = selected.length ? selected : "multiple" in c.attrs || !first ? [] : [first];
             for (const o of chosen)
-                entries.push([name, o.value]);
+                if (!o.disabled)
+                    entries.push([name, o.value]);
         }
         else
             entries.push([name, c.attrs.value ?? ""]);
@@ -214,13 +258,43 @@ export function formRequest(html, opts = {}) {
     const pick = (attr) => (button && button.attrs[`form${attr}`] !== undefined ? button.attrs[`form${attr}`] : form.attrs[attr]);
     const method = (pick("method") ?? "get").toUpperCase() === "POST" ? "POST" : "GET";
     const action = pick("action") ?? "";
+    const multipart = method === "POST" && (pick("enctype") ?? "").toLowerCase() === "multipart/form-data";
+    if (files.size && !multipart) {
+        throw new Error(`slicetest: submit: the form sends ${method === "GET" ? "a GET" : "urlencoded"} data, which can't carry files; a browser would send only the file name. Upload forms need method="post" enctype="multipart/form-data"`);
+    }
+    // Outside multipart, a file field is sent as its file name (empty when none was chosen), as browsers do.
+    const plain = () => new URLSearchParams(entries.map(([k, v]) => [k, typeof v === "string" ? v : (v.name ?? "")]));
     if (method === "GET")
-        return { method, action: `${action.replace(/[?#].*$/, "")}?${new URLSearchParams(entries)}` };
-    const multipart = (pick("enctype") ?? "").toLowerCase() === "multipart/form-data";
+        return { method, action: `${action.replace(/[?#].*$/, "")}?${plain()}` };
     if (!multipart)
-        return { method, action, body: new URLSearchParams(entries) };
+        return { method, action, body: plain() };
     const body = new FormData();
-    for (const [k, v] of entries)
-        body.append(k, v);
+    for (const [k, v] of entries) {
+        if (typeof v === "string")
+            body.append(k, v);
+        else
+            body.append(k, v, v.name ?? "blob");
+    }
     return { method, action, body };
 }
+/** Fields as `application/x-www-form-urlencoded`: lists repeat the key, nested objects use bracket keys (`metadata[order]`). */
+export function encodeForm(fields) {
+    const out = new URLSearchParams();
+    const add = (key, v) => {
+        if (v === null || v === undefined)
+            return;
+        if (Array.isArray(v)) {
+            const nested = v.some((x) => x !== null && typeof x === "object");
+            v.forEach((x, i) => add(nested ? `${key}[${i}]` : key, x));
+        }
+        else if (typeof v === "object" && !(v instanceof Date)) {
+            for (const [k, x] of Object.entries(v))
+                add(`${key}[${k}]`, x);
+        }
+        else
+            out.append(key, v instanceof Date ? v.toISOString() : String(v));
+    };
+    for (const [k, v] of Object.entries(fields))
+        add(k, v);
+    return out;
+}

package/dist/global-setup.d.ts

@@ -3,6 +3,11 @@ import type { ResolvedOptions } from "./config.js";
 import "./provided.js";
 /** Runs once per vitest run: start the database server, migrate a template database, hand its location to the workers. */
 export default function setup(project: TestProject): Promise<() => Promise<void>>;
+/**
+ * Why this run covers only part of the suite (a file or name filter, tags, a shard), or undefined for a full run.
+ * Coverage then says little about the suite, so `minCoverage` isn't enforced and the cache for `gen --uncovered` is kept.
+ */
+export declare function partialRun(project: TestProject): Promise<string | undefined>;
 /**
  * A hash of everything that determines the migrated schema, or undefined when
  * that can't be known (a migration command without `inputs`).

package/dist/global-setup.js

@@ -12,6 +12,7 @@ import { engineFor } from "./drivers/index.js";
 import { coverageCacheFile } from "./gen.js";
 import { appSpecFile, formatCoverage, formatUsage, OpenApiSpec } from "./openapi.js";
 import { mergeRecordings } from "./recording.js";
+import { applySqlFiles, sqlMigrationFiles } from "./sql-migrations.js";
 import "./provided.js";
 const exec = promisify(execFile);
 /** Runs once per vitest run: start the database server, migrate a template database, hand its location to the workers. */
@@ -38,7 +39,7 @@ export default async function setup(project) {
         }
         finally {
             if (coverageDir)
-                await reportCoverage(opts, coverageDir);
+                await reportCoverage(opts, coverageDir, await partialRun(project));
             if (usageDir)
                 await reportUsage(opts, usageDir);
             if (recordDir)
@@ -102,7 +103,30 @@ async function startDatabase(opts, builds) {
         },
     };
 }
-async function reportCoverage(opts, dir) {
+/**
+ * Why this run covers only part of the suite (a file or name filter, tags, a shard), or undefined for a full run.
+ * Coverage then says little about the suite, so `minCoverage` isn't enforced and the cache for `gen --uncovered` is kept.
+ */
+export async function partialRun(project) {
+    try {
+        const config = project.vitest.config;
+        if (config.testNamePattern)
+            return `only scenarios matching ${config.testNamePattern}`;
+        if (process.env.SLICETEST_TAGS)
+            return `only tags ${process.env.SLICETEST_TAGS}`;
+        if (config.shard)
+            return "one shard";
+        const all = (await project.globTestFiles()).testFiles.length;
+        const ran = project.vitest.state.getFiles().filter((f) => f.projectName === project.name).length;
+        if (ran > 0 && ran < all)
+            return `${ran} of ${all} files`;
+    }
+    catch {
+        // An API this Vitest version lacks: treat the run as complete, as before.
+    }
+    return undefined;
+}
+async function reportCoverage(opts, dir, partial) {
     try {
         const hits = new Set();
         for (const file of await readdir(dir)) {
@@ -117,11 +141,12 @@ async function reportCoverage(opts, dir) {
         const report = formatCoverage(spec, hits);
         // For `slicetest gen --uncovered`.
         const cache = coverageCacheFile(opts.root);
-        await mkdir(path.dirname(cache), { recursive: true }).then(() => writeFile(cache, JSON.stringify([...hits]))).catch(() => { });
-        console.log(`\n${report.text}\n`);
+        if (!partial)
+            await mkdir(path.dirname(cache), { recursive: true }).then(() => writeFile(cache, JSON.stringify([...hits]))).catch(() => { });
+        console.log(`\n${report.text}${partial ? `\n(partial run: ${partial}; openapi.minCoverage is checked on full runs)` : ""}\n`);
         await appendSummary(report.markdown);
         const min = opts.openapi.minCoverage;
-        if (min !== undefined && report.percent < min) {
+        if (min !== undefined && report.percent < min && !partial) {
             // Not thrown: Vitest reports teardown errors as a crash. The failing exit code is what CI needs.
             const message = `OpenAPI coverage ${report.percent}% is below openapi.minCoverage (${min}%)`;
             console.error(`slicetest: ${message}\n`);
@@ -290,14 +315,10 @@ async function applyMigrations(opts, engine, url, m) {
         return run("atlas", ["migrate", "apply", "--url", engine.atlasUrl(url), "--dir", dir], opts.root);
     }
     else if ("sql" in m) {
-        const target = path.resolve(opts.root, m.sql);
-        const files = (await stat(target)).isDirectory()
-            ? (await readdir(target)).filter((f) => f.endsWith(".sql")).sort().map((f) => path.join(target, f))
-            : [target];
+        const files = await sqlMigrationFiles(path.resolve(opts.root, m.sql));
         const driver = await engine.driver(url);
         try {
-            for (const file of files)
-                await driver.exec(await readFile(file, "utf8"));
+            await applySqlFiles(files, (sql) => driver.exec(sql), opts.root);
         }
         finally {
             await driver.close();

package/dist/har.js

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { mergeRecordings } from "./recording.js";
+import { mergeRecordings, redactRequest } from "./recording.js";
 const KEPT_HEADERS = ["content-type", "location", "retry-after", "link", "etag"];
 const TEXTUAL = /json|text|xml|javascript|x-www-form-urlencoded|graphql/i;
 export function harEntries(har, file = "the HAR file") {
@@ -29,12 +29,12 @@ export function toRecording(entry, upstream) {
     const query = Object.fromEntries([...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)));
     const sent = entry.request.postData?.text;
     const json = parse(sent);
-    const request = {
+    const request = redactRequest({
         method,
         path: url.pathname.slice(prefix.length) || "/",
         ...(Object.keys(query).length ? { query } : {}),
         ...(json !== undefined ? { json } : sent ? { body: sent } : {}),
-    };
+    });
     const content = entry.response.content ?? {};
     let text = content.text ?? "";
     if (content.encoding === "base64" && text) {

package/dist/http.d.ts

@@ -10,12 +10,28 @@ export interface HttpResponse {
     json: any;
     /** Wall-clock time of the request in milliseconds. */
     durationMs: number;
+    /** The events of a `text/event-stream` response (data parsed as JSON when it is JSON); undefined for other responses. */
+    events?: ServerEvent[];
 }
+/** One server-sent event of a response. */
+export interface ServerEvent {
+    /** The `event:` field; undefined for unnamed (`message`) events. */
+    event?: string;
+    /** The `data:` lines joined by newlines, parsed as JSON when they are JSON (`[DONE]` stays a string). */
+    data: any;
+    id?: string;
+}
+/** Events of a `text/event-stream` body, as the HTML spec's parser dispatches them. */
+export declare function parseEvents(text: string): ServerEvent[];
+type QueryValue = string | number | boolean;
 export interface RequestOptions {
     headers?: Record<string, string>;
-    query?: Record<string, string | number | boolean | undefined>;
+    /** A list repeats the parameter: `{ tag: ["a", "b"] }` is `?tag=a&tag=b`. */
+    query?: Record<string, QueryValue | QueryValue[] | undefined>;
     /** Follow redirects instead of returning the 3xx response. Default false. */
     follow?: boolean;
+    /** Fail the request when the app hasn't answered within this many ms, naming it, instead of the whole test timing out. */
+    timeout?: number;
 }
 /** Per-scenario state shared by a client and every client derived from it with `with()`. */
 declare class Session {
@@ -35,8 +51,12 @@ export declare class HttpClient {
     constructor(baseUrl: string, defaults?: RequestOptions, session?: Session);
     /** A client that adds `opts` (e.g. an auth header) to every request, sharing this one's cookies. */
     with(opts: RequestOptions): HttpClient;
-    /** Wrap fields to be sent as `application/x-www-form-urlencoded`. */
-    form(fields: Record<string, string | number | boolean>): URLSearchParams;
+    /**
+     * Wrap fields to be sent as `application/x-www-form-urlencoded`. A list repeats the key (`to=a&to=b`,
+     * as an HTML form sends it), and nested objects use bracket keys (`metadata[order]=7`,
+     * `items[0][price]=p_1`), as Rails, PHP and Stripe read them. `null` / `undefined` are left out.
+     */
+    form(fields: Record<string, unknown>): URLSearchParams;
     get(path: string, opts?: RequestOptions): Promise<HttpResponse>;
     head(path: string, opts?: RequestOptions): Promise<HttpResponse>;
     delete(path: string, opts?: RequestOptions): Promise<HttpResponse>;
@@ -73,7 +93,7 @@ export declare class HttpClient {
      */
     concurrently(n: number, send: (i: number) => Promise<HttpResponse>): Promise<HttpResponse[]>;
     /**
-     * Strings, URLSearchParams, FormData, Blob and byte arrays are sent as-is; anything else is sent as JSON.
+     * Strings, URLSearchParams, FormData, Blob, ArrayBuffer and typed arrays are sent as-is; anything else is sent as JSON.
      * With `follow`, redirects are followed here rather than by fetch, so cookies set along the way are kept
      * (a login answering 302 + Set-Cookie) and nothing is sent outside the app: a redirect elsewhere is returned.
      */
@@ -90,6 +110,22 @@ export declare class HttpClient {
     /** Start a new scenario: forget cookies and history. */
     reset(): void;
 }
+/** A `Set-Cookie` header's cookie and attributes, as `toSetCookie()` and YAML `expect.cookies` compare them. */
+export interface SetCookie {
+    name: string;
+    value: string;
+    httpOnly: boolean;
+    secure: boolean;
+    /** As sent, e.g. `Lax`; undefined when the attribute is missing. */
+    sameSite?: string;
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    expires?: string;
+    partitioned: boolean;
+}
+/** The cookies a response sets, by name (the last one wins when a name repeats). */
+export declare function setCookies(res: Pick<HttpResponse, "headers">): Record<string, SetCookie>;
 /** One line per request, for failure output. */
 export declare function formatHistory(history: readonly HttpResponse[]): string;
 export {};

package/dist/http.js

@@ -1,7 +1,42 @@
-import { formRequest } from "./form.js";
+import { encodeForm, formRequest } from "./form.js";
 import { lookupHost } from "./intercept.js";
 import { timeline } from "./timeline.js";
 import { signWebhook, webhookBody } from "./webhook.js";
+/** Events of a `text/event-stream` body, as the HTML spec's parser dispatches them. */
+export function parseEvents(text) {
+    const out = [];
+    let data = [];
+    let event;
+    let id;
+    for (const line of `${text}\n`.split(/\r\n|\r|\n/)) {
+        if (line === "") {
+            if (data.length) {
+                const raw = data.join("\n");
+                let parsed = raw;
+                try {
+                    parsed = JSON.parse(raw);
+                }
+                catch { }
+                out.push({ ...(event ? { event } : {}), data: parsed, ...(id !== undefined ? { id } : {}) });
+            }
+            data = [];
+            event = undefined;
+            continue;
+        }
+        if (line.startsWith(":"))
+            continue;
+        const colon = line.indexOf(":");
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const value = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+        if (field === "data")
+            data.push(value);
+        else if (field === "event")
+            event = value;
+        else if (field === "id" && !value.includes("\0"))
+            id = value;
+    }
+    return out;
+}
 /** Per-scenario state shared by a client and every client derived from it with `with()`. */
 class Session {
     /** Stub base URLs of intercepted hosts, which redirects may lead to (an OAuth provider's login page). */
@@ -34,9 +69,13 @@ export class HttpClient {
     with(opts) {
         return new HttpClient(this.baseUrl, merge(this.defaults, opts), this.#session);
     }
-    /** Wrap fields to be sent as `application/x-www-form-urlencoded`. */
+    /**
+     * Wrap fields to be sent as `application/x-www-form-urlencoded`. A list repeats the key (`to=a&to=b`,
+     * as an HTML form sends it), and nested objects use bracket keys (`metadata[order]=7`,
+     * `items[0][price]=p_1`), as Rails, PHP and Stripe read them. `null` / `undefined` are left out.
+     */
     form(fields) {
-        return new URLSearchParams(Object.entries(fields).map(([k, v]) => [k, String(v)]));
+        return encodeForm(fields);
     }
     get(path, opts) {
         return this.request("GET", path, undefined, opts);
@@ -84,8 +123,9 @@ export class HttpClient {
      * `{ invalidSignature: true }` and `{ stale: true }` make deliveries the app must refuse.
      */
     webhook(path, payload, opts) {
-        const { body, type } = webhookBody(payload);
-        return this.request("POST", path, body, { headers: { "content-type": type, ...signWebhook(body, opts), ...opts.headers } });
+        const { body, type } = webhookBody(payload, opts.provider);
+        const url = opts.url ?? new URL(path, this.baseUrl).href;
+        return this.request("POST", path, body, { headers: mergeHeaders({ "content-type": type, ...signWebhook(body, { ...opts, url }) }, opts.headers) });
     }
     /**
      * Send a GraphQL operation to the app: `http.graphql("query { poll(id: 1) { title } }")`,
@@ -112,7 +152,7 @@ export class HttpClient {
         return all;
     }
     /**
-     * Strings, URLSearchParams, FormData, Blob and byte arrays are sent as-is; anything else is sent as JSON.
+     * Strings, URLSearchParams, FormData, Blob, ArrayBuffer and typed arrays are sent as-is; anything else is sent as JSON.
      * With `follow`, redirects are followed here rather than by fetch, so cookies set along the way are kept
      * (a login answering 302 + Set-Cookie) and nothing is sent outside the app: a redirect elsewhere is returned.
      */
@@ -122,9 +162,17 @@ export class HttpClient {
         if (url.origin !== new URL(this.baseUrl).origin) {
             throw new Error(`slicetest: http only talks to the app under test; "${path}" resolves to ${url.origin}`);
         }
-        for (const [k, v] of Object.entries(opts.query ?? {}))
-            if (v !== undefined)
+        for (const [k, v] of Object.entries(opts.query ?? {})) {
+            if (v === undefined)
+                continue;
+            if (Array.isArray(v)) {
+                url.searchParams.delete(k);
+                for (const item of v)
+                    url.searchParams.append(k, String(item));
+            }
+            else
                 url.searchParams.set(k, String(v));
+        }
         let res = await this.#send(method, url, body, opts);
         for (let hops = 0; opts.follow && REDIRECTS.has(res.status) && hops < 20; hops++) {
             const location = res.headers.get("location");
@@ -160,7 +208,8 @@ export class HttpClient {
             body instanceof URLSearchParams ||
             body instanceof FormData ||
             body instanceof Blob ||
-            body instanceof Uint8Array) {
+            body instanceof ArrayBuffer ||
+            ArrayBuffer.isView(body)) {
             payload = body;
         }
         else {
@@ -171,19 +220,33 @@ export class HttpClient {
         const started = performance.now();
         let res;
         try {
-            res = await fetch(target, { method, headers, body: payload, redirect: "manual" });
+            res = await fetch(target, { method, headers, body: payload, redirect: "manual", signal: opts.timeout ? AbortSignal.timeout(opts.timeout) : undefined });
         }
         catch (e) {
             const cause = e.cause?.code;
             const failed = { method, url: url.pathname + url.search, status: 0, headers: new Headers(), text: `${e}${cause ? ` (${cause})` : ""}`, json: undefined, durationMs: Math.round(performance.now() - started) };
             timeline.set(failed, { start: started, end: performance.now() });
             this.#record(failed);
-            throw e;
+            throw new Error(`slicetest: ${method} ${failed.url}: ${requestFailure(e, cause, opts.timeout)}`, { cause: e });
         }
         if (!stub)
             for (const cookie of res.headers.getSetCookie())
                 this.#storeCookie(cookie, url.pathname);
-        const text = await res.text();
+        let text;
+        try {
+            text = await res.text();
+        }
+        catch (e) {
+            // The timeout also covers the body: a stream that never ends, or an app that stalls halfway.
+            const type = res.headers.get("content-type");
+            const failed = { method, url: stub ? url.href : url.pathname + url.search, status: res.status, headers: res.headers, text: "", json: undefined, durationMs: Math.round(performance.now() - started) };
+            timeline.set(failed, { start: started, end: performance.now() });
+            this.#record(failed);
+            const why = e.name === "TimeoutError"
+                ? `answered ${res.status}${type ? ` (${type})` : ""} but the body didn't finish within ${opts.timeout}ms (http timeout)${/event-stream/i.test(type ?? "") ? "; the event stream has to end for its events to be checked" : ""}`
+                : `the connection broke while reading the ${res.status} response's body: ${e.message}`;
+            throw new Error(`slicetest: ${method} ${failed.url}: ${why}`, { cause: e });
+        }
         let json;
         try {
             json = text ? JSON.parse(text) : undefined;
@@ -197,6 +260,7 @@ export class HttpClient {
             text,
             json,
             durationMs: Math.round(performance.now() - started),
+            ...(/^text\/event-stream\b/i.test(res.headers.get("content-type") ?? "") ? { events: parseEvents(text) } : {}),
         };
         timeline.set(out, { start: started, end: performance.now() });
         this.#record(out);
@@ -279,6 +343,40 @@ export class HttpClient {
         }
     }
 }
+/** The cookies a response sets, by name (the last one wins when a name repeats). */
+export function setCookies(res) {
+    const out = {};
+    for (const header of res.headers.getSetCookie()) {
+        const [pair, ...attrs] = header.split(";");
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const cookie = { name: pair.slice(0, eq).trim(), value: pair.slice(eq + 1).trim(), httpOnly: false, secure: false, partitioned: false };
+        for (const a of attrs) {
+            const i = a.indexOf("=");
+            const k = (i < 0 ? a : a.slice(0, i)).trim().toLowerCase();
+            const v = i < 0 ? "" : a.slice(i + 1).trim();
+            if (k === "httponly")
+                cookie.httpOnly = true;
+            else if (k === "secure")
+                cookie.secure = true;
+            else if (k === "partitioned")
+                cookie.partitioned = true;
+            else if (k === "samesite")
+                cookie.sameSite = v;
+            else if (k === "path")
+                cookie.path = v;
+            else if (k === "domain")
+                cookie.domain = v;
+            else if (k === "max-age")
+                cookie.maxAge = Number(v);
+            else if (k === "expires")
+                cookie.expires = v;
+        }
+        Object.defineProperty(out, cookie.name, { value: cookie, enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
 /** RFC 6265 5.1.4: the request path's directory, e.g. "/auth" for "/auth/login". */
 function defaultCookiePath(requestPath) {
     const slash = requestPath.lastIndexOf("/");
@@ -292,14 +390,29 @@ function pathMatches(requestPath, cookiePath) {
         return false;
     return cookiePath.endsWith("/") || requestPath[cookiePath.length] === "/";
 }
+/** Why a request got no response, in terms of what to look at. */
+function requestFailure(e, code, timeout) {
+    if (e.name === "TimeoutError")
+        return `no response within ${timeout}ms (http timeout); the app may be waiting on a stub with a delay, a lock or a slow query`;
+    if (code === "ECONNREFUSED")
+        return "connection refused: the app isn't listening (it may have crashed; its output is below)";
+    if (code === "ECONNRESET" || code === "UND_ERR_SOCKET")
+        return "the app closed the connection without answering (did it crash or exit?)";
+    return `${e.message}${code ? ` (${code})` : ""}`;
+}
 function merge(a, b) {
     return {
         ...a,
         ...b,
-        headers: { ...a.headers, ...b.headers },
+        headers: mergeHeaders(a.headers, b.headers),
         query: { ...a.query, ...b.query },
     };
 }
+/** Header names are case-insensitive: a later `authorization` replaces an earlier `Authorization` rather than joining it. */
+function mergeHeaders(a = {}, b = {}) {
+    const names = new Set(Object.keys(b).map((k) => k.toLowerCase()));
+    return { ...Object.fromEntries(Object.entries(a).filter(([k]) => !names.has(k.toLowerCase()))), ...b };
+}
 /** One line per request, for failure output. */
 export function formatHistory(history) {
     return history

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export { scenario } from "./scenario.js";
+export type { ScenarioOptions } from "./scenario.js";
 export { mask } from "./trace.js";
 export type { Trace, MaskOptions } from "./trace.js";
 export type { ScenarioContext } from "./runtime.js";
-export type { Db, Row, Where, RowsOptions, Changes, TableChanges } from "./db.js";
-export type { Stub, RecordedCall, StubResponse, Responder, MatchOptions, RouteBuilder, GraphQLRouteBuilder, ChaosOptions, ServerSentEvent } from "./stub.js";
+export type { Db, Row, Where, RowsOptions, Changes, TableChanges, ChangesOptions } from "./db.js";
+export type { Stub, RecordedCall, StubResponse, Responder, MatchOptions, RouteBuilder, GraphQLRouteBuilder, ChaosOptions, ServerSentEvent, UploadedFile } from "./stub.js";
 export type { GraphQLCall } from "./graphql.js";
 export { sse } from "./stub.js";
 export type { HttpClient, HttpResponse, RequestOptions } from "./http.js";
@@ -15,4 +16,4 @@ export type { Issuer, TokenOptions, AuthOptions } from "./auth.js";
 export { normalizeSql, type Query, type QueryList } from "./query-log.js";
 export { signWebhook, type WebhookOptions, type WebhookProvider, type HmacScheme } from "./webhook.js";
 export type { SlicetestOptions, ContainerOptions } from "./config.js";
-export type {} from "./matchers.js";
+export type { OrderedCall } from "./matchers.js";