slicetest 0.8.0 → 0.10.0

package/dist/drivers/postgres.d.ts

@@ -1,5 +1,6 @@
 import type { Driver, Engine, Row, Table, TableShape } from "./driver.js";
 export declare class PostgresDriver implements Driver {
+    #private;
     private readonly client;
     private constructor();
     static connect(url: string): Promise<PostgresDriver>;
@@ -14,6 +15,7 @@ export declare class PostgresDriver implements Driver {
     listTables(schemas: string[], keep: string[]): Promise<Table[]>;
     truncate(tables: Table[]): Promise<void>;
     insert(table: string, row: Row): Promise<Row[]>;
+    syncSequences(table: string, columns?: string[]): Promise<void>;
     describe(table: string): Promise<TableShape>;
     close(): Promise<void>;
 }

package/dist/drivers/postgres.js

@@ -1,4 +1,5 @@
 import pg from "pg";
+import { loadContainers } from "../container-runtime.js";
 const INT8 = 20;
 /** int8 columns (bigserial ids, count(*)) come back as numbers when they fit, instead of strings. */
 const types = {
@@ -88,6 +89,24 @@ export class PostgresDriver {
             : `INSERT INTO ${this.ident(table)} (${cols.map((c) => this.ident(c)).join(", ")}) VALUES (${cols.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING *`;
         return this.query(sql, Object.values(row));
     }
+    /** Columns backed by a sequence, per table: looked up once, since most inserts don't give their ids. */
+    #sequenced = new Map();
+    async syncSequences(table, columns) {
+        const name = this.ident(table);
+        let owned = this.#sequenced.get(name);
+        if (!owned) {
+            owned = await this.query(`SELECT a.attname AS col, pg_get_serial_sequence($1, a.attname) AS seq
+           FROM pg_attribute a
+          WHERE a.attrelid = to_regclass($1) AND a.attnum > 0 AND NOT a.attisdropped AND pg_get_serial_sequence($1, a.attname) IS NOT NULL`, [name]);
+            this.#sequenced.set(name, owned);
+        }
+        // An empty table restarts at 1; otherwise the next value follows the largest id.
+        for (const { col, seq } of owned) {
+            if (columns && !columns.includes(col))
+                continue;
+            await this.query(`SELECT setval($1, COALESCE(MAX(${this.column(col)}), 1), MAX(${this.column(col)}) IS NOT NULL) FROM ${name}`, [seq]);
+        }
+    }
     async describe(table) {
         const [{ oid } = { oid: null }] = await this.query("SELECT to_regclass($1)::oid AS oid", [this.ident(table)]);
         if (oid === null)
@@ -168,7 +187,7 @@ export const postgres = {
     name: "postgres",
     defaultImage: "postgres:17-alpine",
     async startContainer(image, reuse) {
-        const { PostgreSqlContainer } = await import("@testcontainers/postgresql");
+        const { PostgreSqlContainer } = await loadContainers(() => import("@testcontainers/postgresql"));
         const definition = new PostgreSqlContainer(image);
         // A reused container is left running and found again by its configuration on the next run.
         if (reuse)

package/dist/exit.d.ts

@@ -0,0 +1 @@
+export declare function onProcessExit(hook: () => void): void;

package/dist/exit.js

@@ -0,0 +1,28 @@
+// One listener per process, not per copy of the package (many Vitest projects ended in Node's "11 exit
+// listeners" warning). Vitest ends a worker with SIGTERM, which skips `exit` and left worker-scope apps running.
+const KEY = Symbol.for("slicetest.exitHooks");
+export function onProcessExit(hook) {
+    const g = globalThis;
+    if (!g[KEY]) {
+        const hooks = (g[KEY] = new Set());
+        const run = () => {
+            for (const h of hooks) {
+                try {
+                    h();
+                }
+                catch { }
+            }
+            hooks.clear();
+        };
+        process.once("exit", run);
+        // Sent again only when nobody else listens: its default action then ends the process as before.
+        for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+            process.once(signal, () => {
+                run();
+                if (process.listenerCount(signal) === 0)
+                    process.kill(process.pid, signal);
+            });
+        }
+    }
+    g[KEY].add(hook);
+}

package/dist/form.d.ts

@@ -33,7 +33,9 @@ interface Control {
     /** For select: its options. */
     options: {
         value: string;
+        label: string;
         selected: boolean;
+        disabled: boolean;
     }[];
 }
 interface ParsedForm {

package/dist/form.js

@@ -8,7 +8,11 @@
 const TAG = /<!--[\s\S]*?-->|<(\/?)([a-zA-Z][\w-]*)((?:\s+[^\s=>/]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+))?)*)\s*\/?>/g;
 const ATTR = /([^\s=>/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g;
 const RAW_TEXT = new Set(["script", "style", "template"]);
-const ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'" };
+const ENTITIES = {
+    amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'",
+    copy: "©", reg: "®", trade: "™", hellip: "…", mdash: "—", ndash: "–", laquo: "«", raquo: "»",
+    lsquo: "‘", rsquo: "’", ldquo: "“", rdquo: "”", yen: "¥", euro: "€", middot: "·", times: "×",
+};
 export function decodeEntities(s) {
     return s.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+\d*);/gi, (m, e) => {
         if (e[0] === "#") {
@@ -37,6 +41,7 @@ export function parseForms(html) {
     let open;
     let select;
     let option;
+    let groupDisabled = false;
     // Controls inside a disabled <fieldset> are disabled too (and not submitted).
     const fieldsets = [];
     const add = (control) => {
@@ -51,8 +56,8 @@ export function parseForms(html) {
     const closeOption = (end) => {
         if (!option || !select)
             return;
-        const value = option.attrs.value ?? textOf(html.slice(option.start, end));
-        select.options.push({ value, selected: "selected" in option.attrs });
+        const label = textOf(html.slice(option.start, end));
+        select.options.push({ value: option.attrs.value ?? label, label, selected: "selected" in option.attrs, disabled: "disabled" in option.attrs || groupDisabled });
         option = undefined;
     };
     TAG.lastIndex = 0;
@@ -107,6 +112,7 @@ export function parseForms(html) {
             if (closing) {
                 closeOption(m.index);
                 select = undefined;
+                groupDisabled = false;
             }
             else {
                 select = { tag, attrs: parseAttrs(m[3] ?? ""), text: "", options: [] };
@@ -116,6 +122,8 @@ export function parseForms(html) {
         }
         if (tag === "option" || tag === "optgroup") {
             closeOption(m.index);
+            if (tag === "optgroup")
+                groupDisabled = !closing && "disabled" in parseAttrs(m[3] ?? "");
             if (tag === "option" && !closing && select)
                 option = { attrs: parseAttrs(m[3] ?? ""), start: TAG.lastIndex };
             continue;
@@ -188,13 +196,15 @@ export function formRequest(html, opts = {}) {
         if (value instanceof Blob)
             files.set(name, value);
         else
-            typed.set(name, typeof value === "boolean" ? value : (Array.isArray(value) ? value : [value]).map(String));
+            typed.set(name, typeof value === "boolean" ? value : offered(form, name, (Array.isArray(value) ? value : [value]).map(String)));
     }
     // The successful controls, in document order (HTML's "constructing the entry list").
     // A typed value replaces what the page had: text for a field, the checked state for
     // checkboxes and radios (true / false, or the values to check), the options of a select.
     const entries = [];
     const done = new Set();
+    // A name shared by checkboxes and a hidden field (Rails' check_box sends `0` unless the box is checked): typing checks the boxes.
+    const boxed = new Set(form.controls.filter((c) => c.tag === "input" && ["checkbox", "radio"].includes(c.attrs.type?.toLowerCase() ?? "")).map((c) => c.attrs.name));
     for (const c of form.controls) {
         const name = c.attrs.name;
         if (c === button && c.attrs.type?.toLowerCase() === "image") {
@@ -221,7 +231,7 @@ export function formRequest(html, opts = {}) {
             done.add(name);
             continue;
         }
-        const want = typed.get(name);
+        const want = type === "checkbox" || type === "radio" || !boxed.has(name) ? typed.get(name) : undefined;
         if (type === "checkbox" || type === "radio") {
             const value = c.attrs.value ?? "on";
             const checked = want === undefined ? "checked" in c.attrs : typeof want === "boolean" ? want : want.includes(value);
@@ -238,13 +248,21 @@ export function formRequest(html, opts = {}) {
         else if (c.tag === "textarea")
             entries.push([name, c.text]);
         else if (c.tag === "select") {
-            const selected = c.options.filter((o) => o.selected);
-            const chosen = selected.length ? selected : "multiple" in c.attrs || c.options.length === 0 ? [] : [c.options[0]];
+            // With nothing selected, a single select shows its first option that isn't disabled; disabled options are never sent.
+            // A single select keeps only the last option marked selected.
+            const marked = c.options.filter((o) => o.selected);
+            const selected = "multiple" in c.attrs ? marked : marked.slice(-1);
+            const first = c.options.find((o) => !o.disabled);
+            const chosen = selected.length ? selected : "multiple" in c.attrs || !first ? [] : [first];
             for (const o of chosen)
-                entries.push([name, o.value]);
+                if (!o.disabled)
+                    entries.push([name, o.value]);
         }
         else
-            entries.push([name, c.attrs.value ?? ""]);
+            entries.push([name, type === "hidden" && name === "_charset_" ? "UTF-8" : (c.attrs.value ?? "")]);
+        // Text controls with a `dirname` also send their direction; left-to-right is what a test page has.
+        if (c.attrs.dirname && (c.tag === "textarea" || ["text", "search", "tel", "url", "email"].includes(type)))
+            entries.push([c.attrs.dirname, "ltr"]);
     }
     const pick = (attr) => (button && button.attrs[`form${attr}`] !== undefined ? button.attrs[`form${attr}`] : form.attrs[attr]);
     const method = (pick("method") ?? "get").toUpperCase() === "POST" ? "POST" : "GET";
@@ -254,6 +272,12 @@ export function formRequest(html, opts = {}) {
         throw new Error(`slicetest: submit: the form sends ${method === "GET" ? "a GET" : "urlencoded"} data, which can't carry files; a browser would send only the file name. Upload forms need method="post" enctype="multipart/form-data"`);
     }
     // Outside multipart, a file field is sent as its file name (empty when none was chosen), as browsers do.
+    // Browsers send line breaks as CRLF; URLSearchParams would keep a bare "\n".
+    for (const e of entries) {
+        e[0] = crlf(e[0]);
+        if (typeof e[1] === "string")
+            e[1] = crlf(e[1]);
+    }
     const plain = () => new URLSearchParams(entries.map(([k, v]) => [k, typeof v === "string" ? v : (v.name ?? "")]));
     if (method === "GET")
         return { method, action: `${action.replace(/[?#].*$/, "")}?${plain()}` };
@@ -268,6 +292,35 @@ export function formRequest(html, opts = {}) {
     }
     return { method, action, body };
 }
+const crlf = (s) => s.replace(/\r\n|\r|\n/g, "\r\n");
+/**
+ * Typed values for a select, radios or checkboxes, checked against what the page offers: a browser can't pick
+ * anything else. A select option may be named by its label too; it is sent as its value.
+ */
+function offered(form, name, values) {
+    const controls = form.controls.filter((c) => c.attrs.name === name && !("disabled" in c.attrs));
+    const select = controls.find((c) => c.tag === "select");
+    if (select) {
+        const usable = select.options.filter((o) => !o.disabled);
+        return values.map((v) => {
+            const o = usable.find((x) => x.value === v) ?? usable.find((x) => x.label === v);
+            if (o)
+                return o.value;
+            const off = select.options.filter((x) => x.disabled).map((x) => x.value);
+            throw new Error(`slicetest: submit: the select "${name}" has no option ${JSON.stringify(v)} (options: ${usable.map((x) => `${x.value} ${JSON.stringify(x.label)}`).join(", ") || "none"}${off.length ? `; disabled: ${off.join(", ")}` : ""})`);
+        });
+    }
+    for (const type of ["radio", "checkbox"]) {
+        const boxes = controls.filter((c) => c.tag === "input" && c.attrs.type?.toLowerCase() === type);
+        if (!boxes.length)
+            continue;
+        const have = boxes.map((c) => c.attrs.value ?? "on");
+        const bad = values.find((v) => !have.includes(v));
+        if (bad !== undefined)
+            throw new Error(`slicetest: submit: no ${type === "radio" ? "radio button" : "checkbox"} "${name}" has the value ${JSON.stringify(bad)} (values: ${have.join(", ")})`);
+    }
+    return values;
+}
 /** Fields as `application/x-www-form-urlencoded`: lists repeat the key, nested objects use bracket keys (`metadata[order]`). */
 export function encodeForm(fields) {
     const out = new URLSearchParams();

package/dist/global-setup.js

@@ -12,6 +12,7 @@ import { engineFor } from "./drivers/index.js";
 import { coverageCacheFile } from "./gen.js";
 import { appSpecFile, formatCoverage, formatUsage, OpenApiSpec } from "./openapi.js";
 import { mergeRecordings } from "./recording.js";
+import { applySqlFiles, sqlMigrationFiles } from "./sql-migrations.js";
 import "./provided.js";
 const exec = promisify(execFile);
 /** Runs once per vitest run: start the database server, migrate a template database, hand its location to the workers. */
@@ -314,14 +315,10 @@ async function applyMigrations(opts, engine, url, m) {
         return run("atlas", ["migrate", "apply", "--url", engine.atlasUrl(url), "--dir", dir], opts.root);
     }
     else if ("sql" in m) {
-        const target = path.resolve(opts.root, m.sql);
-        const files = (await stat(target)).isDirectory()
-            ? (await readdir(target)).filter((f) => f.endsWith(".sql")).sort().map((f) => path.join(target, f))
-            : [target];
+        const files = await sqlMigrationFiles(path.resolve(opts.root, m.sql));
         const driver = await engine.driver(url);
         try {
-            for (const file of files)
-                await driver.exec(await readFile(file, "utf8"));
+            await applySqlFiles(files, (sql) => driver.exec(sql), opts.root);
         }
         finally {
             await driver.close();

package/dist/har.js

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { mergeRecordings } from "./recording.js";
+import { mergeRecordings, queryOf, redactRequest } from "./recording.js";
 const KEPT_HEADERS = ["content-type", "location", "retry-after", "link", "etag"];
 const TEXTUAL = /json|text|xml|javascript|x-www-form-urlencoded|graphql/i;
 export function harEntries(har, file = "the HAR file") {
@@ -26,15 +26,15 @@ export function toRecording(entry, upstream) {
     // Preflights are the browser's; aborted and blocked requests (status 0) have no answer to replay.
     if (method === "OPTIONS" || !entry.response || !entry.response.status)
         return "skipped";
-    const query = Object.fromEntries([...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)));
+    const query = queryOf(url.searchParams);
     const sent = entry.request.postData?.text;
     const json = parse(sent);
-    const request = {
+    const request = redactRequest({
         method,
         path: url.pathname.slice(prefix.length) || "/",
         ...(Object.keys(query).length ? { query } : {}),
         ...(json !== undefined ? { json } : sent ? { body: sent } : {}),
-    };
+    });
     const content = entry.response.content ?? {};
     let text = content.text ?? "";
     if (content.encoding === "base64" && text) {

package/dist/http.d.ts

@@ -10,12 +10,24 @@ export interface HttpResponse {
     json: any;
     /** Wall-clock time of the request in milliseconds. */
     durationMs: number;
+    /** The events of a `text/event-stream` response (data parsed as JSON when it is JSON); undefined for other responses. */
+    events?: ServerEvent[];
 }
+/** One server-sent event of a response. */
+export interface ServerEvent {
+    /** The `event:` field; undefined for unnamed (`message`) events. */
+    event?: string;
+    /** The `data:` lines joined by newlines, parsed as JSON when they are JSON (`[DONE]` stays a string). */
+    data: any;
+    id?: string;
+}
+/** Events of a `text/event-stream` body, as the HTML spec's parser dispatches them. */
+export declare function parseEvents(text: string): ServerEvent[];
 type QueryValue = string | number | boolean;
 export interface RequestOptions {
     headers?: Record<string, string>;
-    /** A list repeats the parameter: `{ tag: ["a", "b"] }` is `?tag=a&tag=b`. */
-    query?: Record<string, QueryValue | QueryValue[] | undefined>;
+    /** A list repeats the parameter: `{ tag: ["a", "b"] }` is `?tag=a&tag=b`. `null` and `undefined` are left out. */
+    query?: Record<string, QueryValue | null | (QueryValue | null)[] | undefined>;
     /** Follow redirects instead of returning the 3xx response. Default false. */
     follow?: boolean;
     /** Fail the request when the app hasn't answered within this many ms, naming it, instead of the whole test timing out. */
@@ -28,7 +40,11 @@ declare class Session {
     cookies: Map<string, string>;
     /** The Path each cookie was set for; a cookie without one (added by hand) goes everywhere. */
     cookiePaths: Map<string, string>;
+    /** When a cookie set with Max-Age or Expires stops being sent (epoch ms). */
+    cookieExpiry: Map<string, number>;
     history: HttpResponse[];
+    /** Every request of the scenario, for trace() and diagrams; `history` keeps only the last few for failure output. */
+    requests: HttpResponse[];
     listeners: ((res: HttpResponse) => void)[];
 }
 /** HTTP client bound to the app under test. Keeps cookies for the duration of a scenario. */
@@ -81,7 +97,7 @@ export declare class HttpClient {
      */
     concurrently(n: number, send: (i: number) => Promise<HttpResponse>): Promise<HttpResponse[]>;
     /**
-     * Strings, URLSearchParams, FormData, Blob and byte arrays are sent as-is; anything else is sent as JSON.
+     * Strings, URLSearchParams, FormData, Blob, ArrayBuffer and typed arrays are sent as-is; anything else is sent as JSON.
      * With `follow`, redirects are followed here rather than by fetch, so cookies set along the way are kept
      * (a login answering 302 + Set-Cookie) and nothing is sent outside the app: a redirect elsewhere is returned.
      */
@@ -90,14 +106,32 @@ export declare class HttpClient {
     onResponse(fn: (res: HttpResponse) => void): void;
     /** Let redirects to `host` continue to the stub at `stubUrl`, as they would to the real host in a browser. */
     intercept(host: string, stubUrl: string): void;
-    /** Cookies the app has set during this scenario. Mutations are sent with later requests. */
+    /** Cookies the app has set during this scenario (minus expired ones). Mutations are sent with later requests. */
     get cookies(): Map<string, string>;
     clearCookies(): void;
     /** Requests made during the current scenario, oldest first (last 20). */
     get history(): readonly HttpResponse[];
+    /** Every request made during the current scenario, oldest first. */
+    get requests(): readonly HttpResponse[];
     /** Start a new scenario: forget cookies and history. */
     reset(): void;
 }
+/** A `Set-Cookie` header's cookie and attributes, as `toSetCookie()` and YAML `expect.cookies` compare them. */
+export interface SetCookie {
+    name: string;
+    value: string;
+    httpOnly: boolean;
+    secure: boolean;
+    /** As sent, e.g. `Lax`; undefined when the attribute is missing. */
+    sameSite?: string;
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    expires?: string;
+    partitioned: boolean;
+}
+/** The cookies a response sets, by name (the last one wins when a name repeats). */
+export declare function setCookies(res: Pick<HttpResponse, "headers">): Record<string, SetCookie>;
 /** One line per request, for failure output. */
 export declare function formatHistory(history: readonly HttpResponse[]): string;
 export {};

package/dist/http.js

@@ -2,6 +2,41 @@ import { encodeForm, formRequest } from "./form.js";
 import { lookupHost } from "./intercept.js";
 import { timeline } from "./timeline.js";
 import { signWebhook, webhookBody } from "./webhook.js";
+/** Events of a `text/event-stream` body, as the HTML spec's parser dispatches them. */
+export function parseEvents(text) {
+    const out = [];
+    let data = [];
+    let event;
+    let id;
+    for (const line of `${text}\n`.split(/\r\n|\r|\n/)) {
+        if (line === "") {
+            if (data.length) {
+                const raw = data.join("\n");
+                let parsed = raw;
+                try {
+                    parsed = JSON.parse(raw);
+                }
+                catch { }
+                out.push({ ...(event ? { event } : {}), data: parsed, ...(id !== undefined ? { id } : {}) });
+            }
+            data = [];
+            event = undefined;
+            continue;
+        }
+        if (line.startsWith(":"))
+            continue;
+        const colon = line.indexOf(":");
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const value = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+        if (field === "data")
+            data.push(value);
+        else if (field === "event")
+            event = value;
+        else if (field === "id" && !value.includes("\0"))
+            id = value;
+    }
+    return out;
+}
 /** Per-scenario state shared by a client and every client derived from it with `with()`. */
 class Session {
     /** Stub base URLs of intercepted hosts, which redirects may lead to (an OAuth provider's login page). */
@@ -9,7 +44,11 @@ class Session {
     cookies = new Map();
     /** The Path each cookie was set for; a cookie without one (added by hand) goes everywhere. */
     cookiePaths = new Map();
+    /** When a cookie set with Max-Age or Expires stops being sent (epoch ms). */
+    cookieExpiry = new Map();
     history = [];
+    /** Every request of the scenario, for trace() and diagrams; `history` keeps only the last few for failure output. */
+    requests = [];
     listeners = [];
 }
 const HISTORY = 20;
@@ -90,7 +129,7 @@ export class HttpClient {
     webhook(path, payload, opts) {
         const { body, type } = webhookBody(payload, opts.provider);
         const url = opts.url ?? new URL(path, this.baseUrl).href;
-        return this.request("POST", path, body, { headers: { "content-type": type, ...signWebhook(body, { ...opts, url }), ...opts.headers } });
+        return this.request("POST", path, body, { headers: mergeHeaders({ "content-type": type, ...signWebhook(body, { ...opts, url }) }, opts.headers) });
     }
     /**
      * Send a GraphQL operation to the app: `http.graphql("query { poll(id: 1) { title } }")`,
@@ -117,23 +156,27 @@ export class HttpClient {
         return all;
     }
     /**
-     * Strings, URLSearchParams, FormData, Blob and byte arrays are sent as-is; anything else is sent as JSON.
+     * Strings, URLSearchParams, FormData, Blob, ArrayBuffer and typed arrays are sent as-is; anything else is sent as JSON.
      * With `follow`, redirects are followed here rather than by fetch, so cookies set along the way are kept
      * (a login answering 302 + Set-Cookie) and nothing is sent outside the app: a redirect elsewhere is returned.
      */
     async request(method, path, body, options = {}) {
         const opts = merge(this.defaults, options);
+        // Fetch upper-cases get and put but not patch, so `request("patch", …)` went out as "patch".
+        method = method.toUpperCase();
         let url = new URL(path, this.baseUrl);
         if (url.origin !== new URL(this.baseUrl).origin) {
             throw new Error(`slicetest: http only talks to the app under test; "${path}" resolves to ${url.origin}`);
         }
         for (const [k, v] of Object.entries(opts.query ?? {})) {
-            if (v === undefined)
+            // `null` too: a value captured from JSON (`next_cursor: null`) would otherwise go out as the text "null".
+            if (v === undefined || v === null)
                 continue;
             if (Array.isArray(v)) {
                 url.searchParams.delete(k);
                 for (const item of v)
-                    url.searchParams.append(k, String(item));
+                    if (item !== null && item !== undefined)
+                        url.searchParams.append(k, String(item));
             }
             else
                 url.searchParams.set(k, String(v));
@@ -147,8 +190,9 @@ export class HttpClient {
             // Like a browser: on to the app, or to a host a stub stands in for; anywhere else is returned.
             if (next.origin !== new URL(this.baseUrl).origin && lookupHost(this.#session.external, next.hostname) === undefined)
                 break;
-            // 307/308 repeat the request as it was; the others turn it into a GET without a body, like browsers do.
-            if (res.status !== 307 && res.status !== 308 && method !== "HEAD") {
+            // Fetch's rules: 303 makes anything but HEAD a GET, 301/302 only a POST; the rest repeat the request as it was.
+            const toGet = res.status === 303 ? method !== "HEAD" : (res.status === 301 || res.status === 302) && method === "POST";
+            if (toGet) {
                 method = "GET";
                 body = undefined;
             }
@@ -173,7 +217,8 @@ export class HttpClient {
             body instanceof URLSearchParams ||
             body instanceof FormData ||
             body instanceof Blob ||
-            body instanceof Uint8Array) {
+            body instanceof ArrayBuffer ||
+            ArrayBuffer.isView(body)) {
             payload = body;
         }
         else {
@@ -196,7 +241,21 @@ export class HttpClient {
         if (!stub)
             for (const cookie of res.headers.getSetCookie())
                 this.#storeCookie(cookie, url.pathname);
-        const text = await res.text();
+        let text;
+        try {
+            text = await res.text();
+        }
+        catch (e) {
+            // The timeout also covers the body: a stream that never ends, or an app that stalls halfway.
+            const type = res.headers.get("content-type");
+            const failed = { method, url: stub ? url.href : url.pathname + url.search, status: res.status, headers: res.headers, text: "", json: undefined, durationMs: Math.round(performance.now() - started) };
+            timeline.set(failed, { start: started, end: performance.now() });
+            this.#record(failed);
+            const why = e.name === "TimeoutError"
+                ? `answered ${res.status}${type ? ` (${type})` : ""} but the body didn't finish within ${opts.timeout}ms (http timeout)${/event-stream/i.test(type ?? "") ? "; the event stream has to end for its events to be checked" : ""}`
+                : `the connection broke while reading the ${res.status} response's body: ${e.message}`;
+            throw new Error(`slicetest: ${method} ${failed.url}: ${why}`, { cause: e });
+        }
         let json;
         try {
             json = text ? JSON.parse(text) : undefined;
@@ -210,6 +269,7 @@ export class HttpClient {
             text,
             json,
             durationMs: Math.round(performance.now() - started),
+            ...(/^text\/event-stream\b/i.test(res.headers.get("content-type") ?? "") ? { events: parseEvents(text) } : {}),
         };
         timeline.set(out, { start: started, end: performance.now() });
         this.#record(out);
@@ -224,6 +284,7 @@ export class HttpClient {
         this.#session.listeners.push(fn);
     }
     #record(res) {
+        this.#session.requests.push(res);
         this.#session.history.push(res);
         if (this.#session.history.length > HISTORY)
             this.#session.history.shift();
@@ -232,25 +293,44 @@ export class HttpClient {
     intercept(host, stubUrl) {
         this.#session.external.set(host.toLowerCase(), stubUrl);
     }
-    /** Cookies the app has set during this scenario. Mutations are sent with later requests. */
+    /** Cookies the app has set during this scenario (minus expired ones). Mutations are sent with later requests. */
     get cookies() {
+        this.#dropExpired();
         return this.#session.cookies;
     }
     clearCookies() {
         this.#session.cookies.clear();
         this.#session.cookiePaths.clear();
+        this.#session.cookieExpiry.clear();
+    }
+    #dropExpired() {
+        const { cookies, cookiePaths, cookieExpiry } = this.#session;
+        const now = Date.now();
+        for (const [name, at] of cookieExpiry) {
+            if (at > now)
+                continue;
+            cookies.delete(name);
+            cookiePaths.delete(name);
+            cookieExpiry.delete(name);
+        }
     }
     /** Requests made during the current scenario, oldest first (last 20). */
     get history() {
         return this.#session.history;
     }
+    /** Every request made during the current scenario, oldest first. */
+    get requests() {
+        return this.#session.requests;
+    }
     /** Start a new scenario: forget cookies and history. */
     reset() {
         this.clearCookies();
         this.#session.history = [];
+        this.#session.requests = [];
     }
     /** Cookies whose Path covers `requestPath`, longest Path first as browsers send them (RFC 6265 5.4). */
     #cookieHeader(requestPath) {
+        this.#dropExpired();
         const { cookies, cookiePaths } = this.#session;
         return [...cookies]
             .map(([name, value]) => ({ name, value, path: cookiePaths.get(name) ?? "/" }))
@@ -285,13 +365,53 @@ export class HttpClient {
         if (expired) {
             this.#session.cookies.delete(name);
             this.#session.cookiePaths.delete(name);
+            this.#session.cookieExpiry.delete(name);
         }
         else {
             this.#session.cookies.set(name, pair.slice(eq + 1).trim());
             this.#session.cookiePaths.set(name, cookiePath ?? defaultCookiePath(requestPath));
+            const until = maxAge !== undefined && !Number.isNaN(maxAge) ? Date.now() + maxAge * 1000 : expires !== undefined && !Number.isNaN(expires) ? expires : undefined;
+            if (until === undefined)
+                this.#session.cookieExpiry.delete(name);
+            else
+                this.#session.cookieExpiry.set(name, until);
         }
     }
 }
+/** The cookies a response sets, by name (the last one wins when a name repeats). */
+export function setCookies(res) {
+    const out = {};
+    for (const header of res.headers.getSetCookie()) {
+        const [pair, ...attrs] = header.split(";");
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const cookie = { name: pair.slice(0, eq).trim(), value: pair.slice(eq + 1).trim(), httpOnly: false, secure: false, partitioned: false };
+        for (const a of attrs) {
+            const i = a.indexOf("=");
+            const k = (i < 0 ? a : a.slice(0, i)).trim().toLowerCase();
+            const v = i < 0 ? "" : a.slice(i + 1).trim();
+            if (k === "httponly")
+                cookie.httpOnly = true;
+            else if (k === "secure")
+                cookie.secure = true;
+            else if (k === "partitioned")
+                cookie.partitioned = true;
+            else if (k === "samesite")
+                cookie.sameSite = v;
+            else if (k === "path")
+                cookie.path = v;
+            else if (k === "domain")
+                cookie.domain = v;
+            else if (k === "max-age")
+                cookie.maxAge = Number(v);
+            else if (k === "expires")
+                cookie.expires = v;
+        }
+        Object.defineProperty(out, cookie.name, { value: cookie, enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
 /** RFC 6265 5.1.4: the request path's directory, e.g. "/auth" for "/auth/login". */
 function defaultCookiePath(requestPath) {
     const slash = requestPath.lastIndexOf("/");
@@ -319,10 +439,15 @@ function merge(a, b) {
     return {
         ...a,
         ...b,
-        headers: { ...a.headers, ...b.headers },
+        headers: mergeHeaders(a.headers, b.headers),
         query: { ...a.query, ...b.query },
     };
 }
+/** Header names are case-insensitive: a later `authorization` replaces an earlier `Authorization` rather than joining it. */
+function mergeHeaders(a = {}, b = {}) {
+    const names = new Set(Object.keys(b).map((k) => k.toLowerCase()));
+    return { ...Object.fromEntries(Object.entries(a).filter(([k]) => !names.has(k.toLowerCase()))), ...b };
+}
 /** One line per request, for failure output. */
 export function formatHistory(history) {
     return history