slicetest 0.8.0 → 0.9.0

package/README.md

@@ -38,7 +38,7 @@ npx slicetest init   # detects your stack, writes slicetest.config.yaml and a fi
 npx slicetest        # starts Postgres, migrates, starts your app, runs scenarios/*.scenario.yaml
 ```
 
-`init` recognises Node (`npm start`, or Bun, pnpm or Yarn from the lockfile), Deno, Phoenix, Django, FastAPI, Flask, Rails, Laravel, Symfony, plain PHP, Spring Boot, ASP.NET Core, Go and Rust apps; Atlas, Prisma, Alembic, Django, Rails, Laravel, Doctrine, EF Core, Ecto, Drizzle, Knex and plain SQL migrations; and an `openapi.yaml`. If there's a `compose.yaml` / `docker-compose.yml`, its database service sets `db.image` (and `db.engine: mysql` for MySQL or MariaDB), and Redis, Valkey, Mongo, Elasticsearch, MinIO, RabbitMQ and other services with a port become [`containers`](#containers-redis-search-s3-and-other-dependencies), with a reset command where one is known and the usual variable (`REDIS_URL`, `S3_ENDPOINT`, …) passed to the app. A mail catcher there (Mailpit, MailHog, MailDev, smtp4dev, …) or a mail library in the dependencies turns on [`mail`](#mail-catch-what-the-app-sends). SQLite is picked up from Prisma's provider, Rails' `database.yml`, Django's settings or a SQLite driver, with `DATABASE_URL` in the form the framework reads (`file:…`, `sqlite3:…`). And third-party API URLs in `.env.example` (`STRIPE_API_BASE=https://api.stripe.com`) become stubs [recorded from that service](#recording-a-real-service), with the variable pointed at the stub, while local addresses, databases and your own URLs are left alone. Token issuer settings there (`OIDC_ISSUER`, `AUTH0_DOMAIN`, `JWKS_URL`, `JWT_AUDIENCE`, …) turn on [`auth`](#auth-a-real-openid-issuer-tokens-with-any-claims) and point at slicetest's issuer instead of becoming stubs. It lists every guess as a comment in the config so you know what to check.
+`init` recognises Node (`npm start`, or Bun, pnpm or Yarn from the lockfile), Deno, Phoenix, Django, FastAPI, Flask, Rails, Laravel, Symfony, plain PHP, Spring Boot, ASP.NET Core, Go (the main package at the root or in `cmd/<name>`) and Rust apps (both compiled once before the workers start); Atlas, Prisma, Alembic, Django, Rails, Laravel, Doctrine, EF Core, Ecto, Drizzle, Knex and plain SQL migrations (golang-migrate, goose, sqlx, Diesel and dbmate layouts in `migrations/`, `db/migrations/` or `sql/migrations/`); and an `openapi.yaml`. If there's a `compose.yaml` / `docker-compose.yml`, its database service sets `db.image` (and `db.engine: mysql` for MySQL or MariaDB), and Redis, Valkey, Mongo, Elasticsearch, MinIO, RabbitMQ and other services with a port become [`containers`](#containers-redis-search-s3-and-other-dependencies), with a reset command where one is known and the usual variable (`REDIS_URL`, `S3_ENDPOINT`, …) passed to the app. A mail catcher there (Mailpit, MailHog, MailDev, smtp4dev, …) or a mail library in the dependencies turns on [`mail`](#mail-catch-what-the-app-sends). SQLite is picked up from Prisma's provider, Rails' `database.yml`, Django's settings or a SQLite driver, with `DATABASE_URL` in the form the framework reads (`file:…`, `sqlite3:…`). And third-party API URLs in `.env.example` (`STRIPE_API_BASE=https://api.stripe.com`) become stubs [recorded from that service](#recording-a-real-service), with the variable pointed at the stub, while local addresses, databases and your own URLs are left alone. Token issuer settings there (`OIDC_ISSUER`, `AUTH0_DOMAIN`, `JWKS_URL`, `JWT_AUDIENCE`, …) turn on [`auth`](#auth-a-real-openid-issuer-tokens-with-any-claims) and point at slicetest's issuer instead of becoming stubs. It lists every guess as a comment in the config so you know what to check.
 
 ## What you get that's hard to find elsewhere
 
@@ -294,7 +294,7 @@ stub("slack").calls("POST", "/hook");                         // recorded calls:
 
 Form-encoded bodies (Stripe, Twilio, OAuth token requests) are parsed into `call.form`, with bracket keys nested the way those providers read them: `metadata[order]=7&items[0][price]=p_1` is `{ metadata: { order: "7" }, items: [{ price: "p_1" }] }`. `form` conditions match a subset of it, and numbers and booleans compare with the strings sent. `multipart/form-data` bodies are read the same way, with each file as `{ filename, type, size, text }` (`text` for text, JSON, XML and CSV files), so `form: { avatar: { filename: "a.png", type: "image/png" } }` checks an upload the app passed on.
 
-Later routes win. `path` may also be a RegExp, and `method` may be `*`. Unanswered calls get a `501` and fail the scenario, with the closest route and why it didn't match (`stub.explain(call)`).
+Later routes win. `path` may also be a RegExp, and `method` may be `*`. A query written into the path (`on("GET", "/search?q=tea")`, also in `calls()`, `toHaveReceived()` and YAML stubs) is a condition on those parameters, like `query: { q: "tea" }`; other parameters may come along. A list matches a repeated parameter's values in order: `query: { ids: ["1", "2"] }` for `?ids=1&ids=2`. Unanswered calls get a `501` and fail the scenario, with the closest route and why it didn't match (`stub.explain(call)`).
 
 ### OpenAPI contracts — for your app and for the services you stub
 
@@ -465,7 +465,7 @@ Record once, with real credentials in the app's environment:
 SLICETEST_RECORD=github npx vitest     # or SLICETEST_RECORD=1 for every stub with an upstream
 ```
 
-Calls no route matches are forwarded to `upstream` (under its path prefix, headers included) and the answers are written to `recordings/github.yaml` (`recordings:` changes the path). Later runs replay them without touching the network. A request is identified by method, path, query and body (JSON key order doesn't matter); identical requests replay their recordings in the order they were made. Only `content-type`, `location`, `retry-after`, `link` and `etag` response headers are kept, and request headers are never stored, so tokens stay out of the file; bodies are stored as sent, so review the file before committing it.
+Calls no route matches are forwarded to `upstream` (under its path prefix, headers included) and the answers are written to `recordings/github.yaml` (`recordings:` changes the path). Later runs replay them without touching the network. A request is identified by method, path, query and body (JSON key order doesn't matter); identical requests replay their recordings in the order they were made. Only `content-type`, `location`, `retry-after`, `link` and `etag` response headers are kept, and request headers are never stored, so tokens stay out of the file. Credentials sent in the query or the body (`api_key`, `key` in the query, `appid`, `access_token`, `client_secret`, `password`, signatures, …) are stored as `[redacted]` and match any value on replay, so the test environment's dummy key replays what the real key recorded. Other values are stored as sent, so review the file before committing it.
 
 #### From a HAR file: `npx slicetest import`
 
@@ -486,6 +486,10 @@ Registered automatically:
 
 ```ts
 expect(res).toHaveStatus(201);                                   // failure shows the response body
+expect(res).toHaveStatus("2xx");                                 // a class, or a list: [200, 204], ["2xx", 304]
+expect(res).toRespondWithin(300);                                // a response-time budget, in ms
+expect(res).toSetCookie("sid", { httpOnly: true, secure: true, sameSite: "Lax" }); // a cookie and its attributes
+expect(res.events).toContainEqual({ event: "message_stop", data: {} }); // text/event-stream responses are parsed into events
 expect(responses).toHaveStatuses({ 201: 1, 409: 9 });            // an array, e.g. from http.concurrently()
 expect(stub("slack")).toHaveReceived("POST", "/hook", { json: { text: "hi" } });
 expect(stub("slack")).toHaveReceivedTimes(1, "POST", "/hook");
@@ -725,7 +729,7 @@ Tags select scenarios across files: `npx slicetest --tag smoke` (repeat `--tag`
 | `app.readyTimeout` | `30000` | |
 | `app.scope` | `"file"` | `"worker"`: start the app (and stubs, services) once per Vitest worker and keep it for all of that worker's test files, for apps that start slowly. Sets Vitest's `isolate: false`. |
 | `db.engine` | `postgres`, or `mysql` for a `mysql://` URL | `postgres`, `mysql` (see [MySQL](#mysql)) or `sqlite` (see [SQLite](#sqlite)). |
-| `db.migrate` | none | `{ atlas: { dir } }`, `{ sql: "file-or-dir" }` or `{ command, inputs?, env? }`. The command gets `DATABASE_URL`, and both it and `env` may use the `{{db.*}}` placeholders, for tools that read other variables: `{ command: "php artisan migrate --force", env: { DB_HOST: "{{db.host}}", DB_DATABASE: "{{db.name}}" } }`, `{ command: "dotnet ef database update --connection \"{{db.adoNet}}\"" }`. |
+| `db.migrate` | none | `{ atlas: { dir } }`, `{ sql: "file-or-dir" }` or `{ command, inputs?, env? }`. A `sql` directory is applied in name order with version numbers compared as numbers (`V2__` before `V10__`), leaving out rollbacks: `*.down.sql` (golang-migrate, sqlx, Diesel), Flyway undo files (`U2__…`) and the down section of goose (`-- +goose Down`) and dbmate (`-- migrate:down`) files. The command gets `DATABASE_URL`, and both it and `env` may use the `{{db.*}}` placeholders, for tools that read other variables: `{ command: "php artisan migrate --force", env: { DB_HOST: "{{db.host}}", DB_DATABASE: "{{db.name}}" } }`, `{ command: "dotnet ef database update --connection \"{{db.adoNet}}\"" }`. |
 | `db.seed` | none | SQL file re-run after every reset. |
 | `db.schemas` | `["public"]` | Schemas whose tables are reset. |
 | `db.keep` | `[]` | Extra tables (`name` or `schema.name`) never truncated. |
@@ -795,7 +799,7 @@ scenarios:
 | Step | Keys |
 |---|---|
 | `stub: <name>` | `on: METHOD /path` (`:params` allowed) or `graphql: <operation>`, `when: { query, headers, json, form, body, variables }`, one of `reply: { status, headers, body }` (`{ file }` for a fixture file, `{ data, errors }` for GraphQL) / `sequence: [...]` / `networkError: true`, plus `times`, `delay`. Replies may echo the call: `{{call.params.id}}`, `{{call.json.name}}`, `{{call.form.amount}}`, `{{call.variables.id}}`. |
-| `submit: <button>` | `form`, `fields` (`{ file: path }` for a file input), `headers`, `follow`, `expect: { status, headers, json, text }`, `capture`. Submits a form of the page the last request returned, like `http.submit()`; `submit: true` presses the form's only button. |
+| `submit: <button>` | `form`, `fields` (`{ file: path }` for a file input), `headers`, `follow`, `expect: { status, headers, json, text }` (`status` may be a class, `2xx`, or a list, `[200, 204]`; `duration: 300` fails a response slower than 300 ms, `duration: { $lt: 300 }` takes matchers; `cookies: { sid: { httpOnly: true, sameSite: Lax }, tracking: null }` checks the cookies it sets and their attributes, `null` for one it must not set; `events: [{ event: message_start }, { data: "[DONE]" }]` checks a `text/event-stream` response's events in order, others allowed between), `capture` (also from `events.0.data.id`). Submits a form of the page the last request returned, like `http.submit()`; `submit: true` presses the form's only button. |
 | `request: METHOD /path` | `headers`, `query`, one of `json` / `form` / `multipart` / `body` / `graphql: { query, variables, operationName }`, `expect.schema` (a JSON Schema, or `../openapi.yaml#/components/schemas/Poll` relative to the file), `follow`, `expect: { status, headers, json, text }`, `capture`. `timeout: <ms>` fails it, by name, when the app doesn't answer in time. `concurrency: n` sends it `n` times at once; `expect` then applies to each response, and `expect.statuses: { 201: 1, 409: 9 }` counts them. |
 | `insert: <table>` | `rows`, `capture` (from `row` / `rows`) |
 | `request` with `auth` | `auth: true` or the claims: sends a bearer token from the `auth` issuer |
@@ -838,7 +842,8 @@ scenarios:
   | `{ $type: number }` | `string`, `number`, `integer`, `boolean`, `array`, `object`, `null` |
   | `{ $regex: "^ch_" }` | a string the pattern finds |
   | `{ $contains: "ok" }` | a string with that substring, or a list with a matching item (`{ $contains: { sku: a } }`) |
-  | `{ $gte: 1, $lt: 10 }` | numbers, or strings such as ISO dates (`{ $gte: "2026-01-01" }`); also `$gt`, `$lte` |
+  | `{ $gte: 1, $lt: 10 }` | numbers (also decimals that `numeric` / `DECIMAL` columns return as strings, `"12.50"`), or strings such as ISO dates (`{ $gte: "2026-01-01" }`); also `$gt`, `$lte` |
+  | `{ $closeTo: 9.99 }` | a number within ±0.005 (`[9.99, 0.1]` for another tolerance), for floats and computed totals; decimal strings too |
   | `{ $len: 3 }` | a string or list of that length; `{ $len: { $gte: 1 } }` |
   | `{ $oneOf: [paid, pending] }` | any of the values (or matchers) |
   | `{ $not: "" }` | anything the value or matcher doesn't match |
@@ -897,6 +902,9 @@ npx slicetest                 # every *.scenario.yaml under the config's directo
 npx slicetest polls -t voting # filter by file and scenario name
 npx slicetest --watch
 npx slicetest list --tag smoke # what would run: file, line, tags, steps (--json for tools)
+npx slicetest -u              # rewrite `snapshot: true` snapshots that no longer match
+npx slicetest --reporter junit --output-file reports/slicetest.xml   # GitLab, Jenkins, CircleCI test reports
+npx slicetest --shard 2/4     # the second of four parts, for parallel CI jobs
 ```
 
 ### Scenarios from your OpenAPI spec: `npx slicetest gen`

package/dist/cli-run.d.ts

@@ -0,0 +1,13 @@
+export interface RunFlags {
+    update?: boolean;
+    reporter?: string[];
+    "output-file"?: string;
+    shard?: string;
+}
+/** Vitest options for the run flags of `npx slicetest`; paths are taken from where the command runs, like `--diagrams`. */
+export declare function runOptions(flags: RunFlags, cwd?: string): {
+    update?: boolean | undefined;
+    reporters?: string[] | undefined;
+    outputFile?: string | undefined;
+    shard?: string | undefined;
+};

package/dist/cli-run.js

@@ -0,0 +1,15 @@
+import path from "node:path";
+/** Vitest options for the run flags of `npx slicetest`; paths are taken from where the command runs, like `--diagrams`. */
+export function runOptions(flags, cwd = process.cwd()) {
+    if (flags.shard !== undefined) {
+        const m = /^(\d+)\/(\d+)$/.exec(flags.shard);
+        if (!m || Number(m[1]) < 1 || Number(m[1]) > Number(m[2]))
+            throw new Error(`slicetest: --shard takes <index>/<count> with 1 ≤ index ≤ count, e.g. --shard 1/3, got "${flags.shard}"`);
+    }
+    return {
+        ...(flags.update ? { update: true } : {}),
+        ...(flags.reporter?.length ? { reporters: flags.reporter } : {}),
+        ...(flags["output-file"] ? { outputFile: path.resolve(cwd, flags["output-file"]) } : {}),
+        ...(flags.shard ? { shard: flags.shard } : {}),
+    };
+}

package/dist/cli.js

@@ -46,6 +46,11 @@ Options:
       --upstream <url> import: the real service's base URL for --stub
       --uncovered      gen: only responses the last run didn't cover
       --force          init, gen: overwrite existing files
+  -u, --update         Rewrite snapshots (\`snapshot: true\` steps) that no longer match
+      --reporter <name> Vitest reporter: default, verbose, dot, junit, json, tap,
+                       github-actions (repeat for several)
+      --output-file <file> Where junit / json / tap reporters write
+      --shard <i/n>    Run the i-th of n parts of the suite (split CI jobs)
       --diagrams <dir> Write a Mermaid sequence diagram of every scenario to <dir>,
                        one Markdown page per scenario file
   -h, --help           Show this help
@@ -83,6 +88,10 @@ export async function main(argv = process.argv.slice(2)) {
             stub: { type: "string" },
             upstream: { type: "string" },
             json: { type: "boolean" },
+            update: { type: "boolean", short: "u" },
+            reporter: { type: "string", multiple: true },
+            "output-file": { type: "string" },
+            shard: { type: "string" },
         },
     });
     if (values.help) {
@@ -190,6 +199,8 @@ export async function main(argv = process.argv.slice(2)) {
     const { slicetest, YAML_SCENARIOS } = await import("./vitest.js");
     // Vitest 4 takes the mode ("test") first; 5 dropped it.
     const start = (Number.parseInt(version, 10) === 4 ? startVitest.bind(null, "test") : startVitest);
+    const { runOptions } = await import("./cli-run.js");
+    const run = runOptions(values);
     const vitest = await start(positionals, {
         config: false,
         root: path.dirname(configPath),
@@ -197,6 +208,7 @@ export async function main(argv = process.argv.slice(2)) {
         watch: !!values.watch,
         run: !values.watch,
         testNamePattern: values.name,
+        ...run,
     }, { plugins: [slicetest(options)] });
     if (!values.watch)
         await vitest?.close();

package/dist/config.js

@@ -59,10 +59,55 @@ function resolveDb(db) {
         reuse: db.reuse ?? (!url && !process.env.CI),
     };
 }
+const TOP_LEVEL_KEYS = ["app", "db", "stubs", "openapi", "http", "services", "containers", "mail", "offline", "strictStubs", "workers", "auth", "include"];
+const APP_KEYS = ["command", "build", "cwd", "env", "ready", "readyTimeout", "scope", "baseEnv"];
+const STUB_KEYS = ["name", "openapi", "autoReply", "upstream", "recordings", "hosts"];
+const CONTAINER_KEYS = ["image", "port", "env", "command", "ready", "reset"];
+const DB_KEYS = ["engine", "image", "url", "migrate", "seed", "schemas", "keep", "ignoreChanges", "reuse", "queries", "neon"];
+function editDistance(a, b) {
+    const row = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        let prev = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const tmp = row[j];
+            row[j] = Math.min(row[j] + 1, row[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
+            prev = tmp;
+        }
+    }
+    return row[b.length];
+}
 function validate(opts) {
     const fail = (msg) => {
         throw new Error(`slicetest: invalid config: ${msg}`);
     };
+    // A misspelt key (`stub:`, `strictstubs:`) would otherwise be ignored without a word; YAML configs have no type checker.
+    const checkKeys = (value, allowed, where) => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return;
+        for (const key of Object.keys(value)) {
+            if (allowed.includes(key) || key === "$schema")
+                continue;
+            // Close in spelling, or sharing the first four letters (`servers` / `services`, `migrations` / `migrate`).
+            const near = allowed
+                .map((k) => ({ k, d: editDistance(k.toLowerCase(), key.toLowerCase()) }))
+                .filter(({ k, d }) => d <= Math.max(2, Math.floor(key.length / 3)) || (key.length >= 4 && k.toLowerCase().startsWith(key.slice(0, 4).toLowerCase())))
+                .sort((a, b) => a.d - b.d)[0];
+            const hint = near ? `; did you mean "${near.k}"?` : ` (expected ${allowed.join(", ")})`;
+            fail(`unknown key ${where}${key}${hint}`);
+        }
+    };
+    checkKeys(opts, TOP_LEVEL_KEYS, "");
+    checkKeys(opts?.app, APP_KEYS, "app.");
+    if (opts?.db)
+        checkKeys(opts.db, DB_KEYS, "db.");
+    for (const stub of opts?.stubs ?? [])
+        if (typeof stub === "object" && stub)
+            checkKeys(stub, STUB_KEYS, `stubs.${stub.name ?? "?"}.`);
+    for (const [name, service] of Object.entries(opts?.services ?? {}))
+        checkKeys(service, APP_KEYS, `services.${name}.`);
+    for (const [name, container] of Object.entries(opts?.containers ?? {}))
+        checkKeys(container, CONTAINER_KEYS, `containers.${name}.`);
     if (!opts?.app || typeof opts.app.command !== "string" || !opts.app.command.trim()) {
         fail("app.command is required, e.g. { app: { command: \"node server.js\" } }");
     }

package/dist/form.d.ts

@@ -34,6 +34,7 @@ interface Control {
     options: {
         value: string;
         selected: boolean;
+        disabled: boolean;
     }[];
 }
 interface ParsedForm {

package/dist/form.js

@@ -37,6 +37,7 @@ export function parseForms(html) {
     let open;
     let select;
     let option;
+    let groupDisabled = false;
     // Controls inside a disabled <fieldset> are disabled too (and not submitted).
     const fieldsets = [];
     const add = (control) => {
@@ -52,7 +53,7 @@ export function parseForms(html) {
         if (!option || !select)
             return;
         const value = option.attrs.value ?? textOf(html.slice(option.start, end));
-        select.options.push({ value, selected: "selected" in option.attrs });
+        select.options.push({ value, selected: "selected" in option.attrs, disabled: "disabled" in option.attrs || groupDisabled });
         option = undefined;
     };
     TAG.lastIndex = 0;
@@ -107,6 +108,7 @@ export function parseForms(html) {
             if (closing) {
                 closeOption(m.index);
                 select = undefined;
+                groupDisabled = false;
             }
             else {
                 select = { tag, attrs: parseAttrs(m[3] ?? ""), text: "", options: [] };
@@ -116,6 +118,8 @@ export function parseForms(html) {
         }
         if (tag === "option" || tag === "optgroup") {
             closeOption(m.index);
+            if (tag === "optgroup")
+                groupDisabled = !closing && "disabled" in parseAttrs(m[3] ?? "");
             if (tag === "option" && !closing && select)
                 option = { attrs: parseAttrs(m[3] ?? ""), start: TAG.lastIndex };
             continue;
@@ -238,10 +242,15 @@ export function formRequest(html, opts = {}) {
         else if (c.tag === "textarea")
             entries.push([name, c.text]);
         else if (c.tag === "select") {
-            const selected = c.options.filter((o) => o.selected);
-            const chosen = selected.length ? selected : "multiple" in c.attrs || c.options.length === 0 ? [] : [c.options[0]];
+            // With nothing selected, a single select shows its first option that isn't disabled; disabled options are never sent.
+            // A single select keeps only the last option marked selected.
+            const marked = c.options.filter((o) => o.selected);
+            const selected = "multiple" in c.attrs ? marked : marked.slice(-1);
+            const first = c.options.find((o) => !o.disabled);
+            const chosen = selected.length ? selected : "multiple" in c.attrs || !first ? [] : [first];
             for (const o of chosen)
-                entries.push([name, o.value]);
+                if (!o.disabled)
+                    entries.push([name, o.value]);
         }
         else
             entries.push([name, c.attrs.value ?? ""]);

package/dist/global-setup.js

@@ -12,6 +12,7 @@ import { engineFor } from "./drivers/index.js";
 import { coverageCacheFile } from "./gen.js";
 import { appSpecFile, formatCoverage, formatUsage, OpenApiSpec } from "./openapi.js";
 import { mergeRecordings } from "./recording.js";
+import { applySqlFiles, sqlMigrationFiles } from "./sql-migrations.js";
 import "./provided.js";
 const exec = promisify(execFile);
 /** Runs once per vitest run: start the database server, migrate a template database, hand its location to the workers. */
@@ -314,14 +315,10 @@ async function applyMigrations(opts, engine, url, m) {
         return run("atlas", ["migrate", "apply", "--url", engine.atlasUrl(url), "--dir", dir], opts.root);
     }
     else if ("sql" in m) {
-        const target = path.resolve(opts.root, m.sql);
-        const files = (await stat(target)).isDirectory()
-            ? (await readdir(target)).filter((f) => f.endsWith(".sql")).sort().map((f) => path.join(target, f))
-            : [target];
+        const files = await sqlMigrationFiles(path.resolve(opts.root, m.sql));
         const driver = await engine.driver(url);
         try {
-            for (const file of files)
-                await driver.exec(await readFile(file, "utf8"));
+            await applySqlFiles(files, (sql) => driver.exec(sql), opts.root);
         }
         finally {
             await driver.close();

package/dist/har.js

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { mergeRecordings } from "./recording.js";
+import { mergeRecordings, redactRequest } from "./recording.js";
 const KEPT_HEADERS = ["content-type", "location", "retry-after", "link", "etag"];
 const TEXTUAL = /json|text|xml|javascript|x-www-form-urlencoded|graphql/i;
 export function harEntries(har, file = "the HAR file") {
@@ -29,12 +29,12 @@ export function toRecording(entry, upstream) {
     const query = Object.fromEntries([...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)));
     const sent = entry.request.postData?.text;
     const json = parse(sent);
-    const request = {
+    const request = redactRequest({
         method,
         path: url.pathname.slice(prefix.length) || "/",
         ...(Object.keys(query).length ? { query } : {}),
         ...(json !== undefined ? { json } : sent ? { body: sent } : {}),
-    };
+    });
     const content = entry.response.content ?? {};
     let text = content.text ?? "";
     if (content.encoding === "base64" && text) {

package/dist/http.d.ts

@@ -10,7 +10,19 @@ export interface HttpResponse {
     json: any;
     /** Wall-clock time of the request in milliseconds. */
     durationMs: number;
+    /** The events of a `text/event-stream` response (data parsed as JSON when it is JSON); undefined for other responses. */
+    events?: ServerEvent[];
 }
+/** One server-sent event of a response. */
+export interface ServerEvent {
+    /** The `event:` field; undefined for unnamed (`message`) events. */
+    event?: string;
+    /** The `data:` lines joined by newlines, parsed as JSON when they are JSON (`[DONE]` stays a string). */
+    data: any;
+    id?: string;
+}
+/** Events of a `text/event-stream` body, as the HTML spec's parser dispatches them. */
+export declare function parseEvents(text: string): ServerEvent[];
 type QueryValue = string | number | boolean;
 export interface RequestOptions {
     headers?: Record<string, string>;
@@ -81,7 +93,7 @@ export declare class HttpClient {
      */
     concurrently(n: number, send: (i: number) => Promise<HttpResponse>): Promise<HttpResponse[]>;
     /**
-     * Strings, URLSearchParams, FormData, Blob and byte arrays are sent as-is; anything else is sent as JSON.
+     * Strings, URLSearchParams, FormData, Blob, ArrayBuffer and typed arrays are sent as-is; anything else is sent as JSON.
      * With `follow`, redirects are followed here rather than by fetch, so cookies set along the way are kept
      * (a login answering 302 + Set-Cookie) and nothing is sent outside the app: a redirect elsewhere is returned.
      */
@@ -98,6 +110,22 @@ export declare class HttpClient {
     /** Start a new scenario: forget cookies and history. */
     reset(): void;
 }
+/** A `Set-Cookie` header's cookie and attributes, as `toSetCookie()` and YAML `expect.cookies` compare them. */
+export interface SetCookie {
+    name: string;
+    value: string;
+    httpOnly: boolean;
+    secure: boolean;
+    /** As sent, e.g. `Lax`; undefined when the attribute is missing. */
+    sameSite?: string;
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    expires?: string;
+    partitioned: boolean;
+}
+/** The cookies a response sets, by name (the last one wins when a name repeats). */
+export declare function setCookies(res: Pick<HttpResponse, "headers">): Record<string, SetCookie>;
 /** One line per request, for failure output. */
 export declare function formatHistory(history: readonly HttpResponse[]): string;
 export {};

package/dist/http.js

@@ -2,6 +2,41 @@ import { encodeForm, formRequest } from "./form.js";
 import { lookupHost } from "./intercept.js";
 import { timeline } from "./timeline.js";
 import { signWebhook, webhookBody } from "./webhook.js";
+/** Events of a `text/event-stream` body, as the HTML spec's parser dispatches them. */
+export function parseEvents(text) {
+    const out = [];
+    let data = [];
+    let event;
+    let id;
+    for (const line of `${text}\n`.split(/\r\n|\r|\n/)) {
+        if (line === "") {
+            if (data.length) {
+                const raw = data.join("\n");
+                let parsed = raw;
+                try {
+                    parsed = JSON.parse(raw);
+                }
+                catch { }
+                out.push({ ...(event ? { event } : {}), data: parsed, ...(id !== undefined ? { id } : {}) });
+            }
+            data = [];
+            event = undefined;
+            continue;
+        }
+        if (line.startsWith(":"))
+            continue;
+        const colon = line.indexOf(":");
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const value = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+        if (field === "data")
+            data.push(value);
+        else if (field === "event")
+            event = value;
+        else if (field === "id" && !value.includes("\0"))
+            id = value;
+    }
+    return out;
+}
 /** Per-scenario state shared by a client and every client derived from it with `with()`. */
 class Session {
     /** Stub base URLs of intercepted hosts, which redirects may lead to (an OAuth provider's login page). */
@@ -90,7 +125,7 @@ export class HttpClient {
     webhook(path, payload, opts) {
         const { body, type } = webhookBody(payload, opts.provider);
         const url = opts.url ?? new URL(path, this.baseUrl).href;
-        return this.request("POST", path, body, { headers: { "content-type": type, ...signWebhook(body, { ...opts, url }), ...opts.headers } });
+        return this.request("POST", path, body, { headers: mergeHeaders({ "content-type": type, ...signWebhook(body, { ...opts, url }) }, opts.headers) });
     }
     /**
      * Send a GraphQL operation to the app: `http.graphql("query { poll(id: 1) { title } }")`,
@@ -117,7 +152,7 @@ export class HttpClient {
         return all;
     }
     /**
-     * Strings, URLSearchParams, FormData, Blob and byte arrays are sent as-is; anything else is sent as JSON.
+     * Strings, URLSearchParams, FormData, Blob, ArrayBuffer and typed arrays are sent as-is; anything else is sent as JSON.
      * With `follow`, redirects are followed here rather than by fetch, so cookies set along the way are kept
      * (a login answering 302 + Set-Cookie) and nothing is sent outside the app: a redirect elsewhere is returned.
      */
@@ -173,7 +208,8 @@ export class HttpClient {
             body instanceof URLSearchParams ||
             body instanceof FormData ||
             body instanceof Blob ||
-            body instanceof Uint8Array) {
+            body instanceof ArrayBuffer ||
+            ArrayBuffer.isView(body)) {
             payload = body;
         }
         else {
@@ -196,7 +232,21 @@ export class HttpClient {
         if (!stub)
             for (const cookie of res.headers.getSetCookie())
                 this.#storeCookie(cookie, url.pathname);
-        const text = await res.text();
+        let text;
+        try {
+            text = await res.text();
+        }
+        catch (e) {
+            // The timeout also covers the body: a stream that never ends, or an app that stalls halfway.
+            const type = res.headers.get("content-type");
+            const failed = { method, url: stub ? url.href : url.pathname + url.search, status: res.status, headers: res.headers, text: "", json: undefined, durationMs: Math.round(performance.now() - started) };
+            timeline.set(failed, { start: started, end: performance.now() });
+            this.#record(failed);
+            const why = e.name === "TimeoutError"
+                ? `answered ${res.status}${type ? ` (${type})` : ""} but the body didn't finish within ${opts.timeout}ms (http timeout)${/event-stream/i.test(type ?? "") ? "; the event stream has to end for its events to be checked" : ""}`
+                : `the connection broke while reading the ${res.status} response's body: ${e.message}`;
+            throw new Error(`slicetest: ${method} ${failed.url}: ${why}`, { cause: e });
+        }
         let json;
         try {
             json = text ? JSON.parse(text) : undefined;
@@ -210,6 +260,7 @@ export class HttpClient {
             text,
             json,
             durationMs: Math.round(performance.now() - started),
+            ...(/^text\/event-stream\b/i.test(res.headers.get("content-type") ?? "") ? { events: parseEvents(text) } : {}),
         };
         timeline.set(out, { start: started, end: performance.now() });
         this.#record(out);
@@ -292,6 +343,40 @@ export class HttpClient {
         }
     }
 }
+/** The cookies a response sets, by name (the last one wins when a name repeats). */
+export function setCookies(res) {
+    const out = {};
+    for (const header of res.headers.getSetCookie()) {
+        const [pair, ...attrs] = header.split(";");
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const cookie = { name: pair.slice(0, eq).trim(), value: pair.slice(eq + 1).trim(), httpOnly: false, secure: false, partitioned: false };
+        for (const a of attrs) {
+            const i = a.indexOf("=");
+            const k = (i < 0 ? a : a.slice(0, i)).trim().toLowerCase();
+            const v = i < 0 ? "" : a.slice(i + 1).trim();
+            if (k === "httponly")
+                cookie.httpOnly = true;
+            else if (k === "secure")
+                cookie.secure = true;
+            else if (k === "partitioned")
+                cookie.partitioned = true;
+            else if (k === "samesite")
+                cookie.sameSite = v;
+            else if (k === "path")
+                cookie.path = v;
+            else if (k === "domain")
+                cookie.domain = v;
+            else if (k === "max-age")
+                cookie.maxAge = Number(v);
+            else if (k === "expires")
+                cookie.expires = v;
+        }
+        Object.defineProperty(out, cookie.name, { value: cookie, enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
 /** RFC 6265 5.1.4: the request path's directory, e.g. "/auth" for "/auth/login". */
 function defaultCookiePath(requestPath) {
     const slash = requestPath.lastIndexOf("/");
@@ -319,10 +404,15 @@ function merge(a, b) {
     return {
         ...a,
         ...b,
-        headers: { ...a.headers, ...b.headers },
+        headers: mergeHeaders(a.headers, b.headers),
         query: { ...a.query, ...b.query },
     };
 }
+/** Header names are case-insensitive: a later `authorization` replaces an earlier `Authorization` rather than joining it. */
+function mergeHeaders(a = {}, b = {}) {
+    const names = new Set(Object.keys(b).map((k) => k.toLowerCase()));
+    return { ...Object.fromEntries(Object.entries(a).filter(([k]) => !names.has(k.toLowerCase()))), ...b };
+}
 /** One line per request, for failure output. */
 export function formatHistory(history) {
     return history

package/dist/init.js

@@ -74,6 +74,37 @@ function runnable(dir) {
         return false;
     }
 }
+/** Where plain SQL migrations usually live (golang-migrate, goose, sqlx, Diesel, dbmate). */
+const SQL_MIGRATION_DIRS = ["migrations", "db/migrations", "sql/migrations", "database/migrations"];
+/** `.sql` files, or Diesel's directories with an `up.sql`. */
+function hasSqlMigrations(dir) {
+    if (!existsSync(dir))
+        return false;
+    return readdirSync(dir, { withFileTypes: true }).some((e) => (e.isFile() && e.name.endsWith(".sql")) || (e.isDirectory() && existsSync(path.join(dir, e.name, "up.sql"))));
+}
+/**
+ * The Go package to run: `.` when the root is package main, else the one command in `cmd/*`
+ * (or the one named server, api, app, web or like the module). Undefined when there is none.
+ */
+function goMain(root, goMod) {
+    const isMain = (dir) => {
+        try {
+            return readdirSync(dir).some((f) => f.endsWith(".go") && !f.endsWith("_test.go") && /^\s*package\s+main\b/m.test(readFileSync(path.join(dir, f), "utf8")));
+        }
+        catch {
+            return false;
+        }
+    };
+    if (isMain(root))
+        return ".";
+    const cmd = path.join(root, "cmd");
+    if (!existsSync(cmd))
+        return undefined;
+    const mains = readdirSync(cmd, { withFileTypes: true }).filter((e) => e.isDirectory() && isMain(path.join(cmd, e.name))).map((e) => e.name).sort();
+    const module = /^module\s+(\S+)/m.exec(goMod)?.[1]?.split("/").pop();
+    const pick = mains.length === 1 ? mains[0] : ["server", "api", "app", "web", "http", module].find((n) => n && mains.includes(n));
+    return pick ? `./cmd/${pick}` : undefined;
+}
 export async function detect(root) {
     const notes = [];
     // The app may live in a subdirectory (backend/, server/, …); everything about the app is read there.
@@ -238,19 +269,33 @@ export async function detect(root) {
         }
     }
     else if (has("go.mod")) {
-        command = "go run .";
-        notes.push("app: Go (go.mod). It must listen on $PORT.");
+        const main = goMain(appRoot, await read("go.mod"));
+        // Built once up front, so the workers' `go run` find everything compiled instead of compiling at once.
+        build = "go build ./...";
+        command = `go run ${main ?? "."}`;
+        readyTimeout = 60_000;
+        notes.push(main && main !== "."
+            ? `app: Go (go.mod), the main package in ${main.slice(2)}/. It must listen on $PORT.`
+            : main
+                ? "app: Go (go.mod). It must listen on $PORT."
+                : "app: Go (go.mod), but no main package at the root or in cmd/*/: set the package in app.command (`go run ./cmd/server`). It must listen on $PORT.");
     }
     else if (has("Cargo.toml")) {
-        command = "cargo run";
-        notes.push("app: Rust (Cargo.toml). It must listen on $PORT.");
+        const cargo = await read("Cargo.toml");
+        // Compiled once before the workers start; `cargo run` then only checks that nothing changed.
+        build = "cargo build -q";
+        command = "cargo run -q";
+        readyTimeout = 120_000;
+        notes.push(/^\[workspace\]/m.test(cargo) && !/^\[package\]/m.test(cargo)
+            ? "app: Rust workspace (Cargo.toml): add `-p <crate>` to app.command for the server's crate. It must listen on $PORT."
+            : "app: Rust (Cargo.toml), built once with `cargo build`. It must listen on $PORT.");
     }
     else {
         notes.push("app: couldn't tell how to start the app. Set app.command.");
     }
     // --- migrations ---
     let migrate;
-    const migrationsSql = has("migrations") && (await readdir(path.join(appRoot, "migrations"))).some((f) => f.endsWith(".sql"));
+    const migrationsDir = SQL_MIGRATION_DIRS.find((d) => hasSqlMigrations(path.join(appRoot, d)));
     const atlas = await findAtlas(root, appDir);
     if (atlas) {
         migrate = { atlas: { dir: `file://${atlas}` } };
@@ -304,9 +349,9 @@ export async function detect(root) {
         migrate = { command: "npx knex migrate:latest", inputs: ["migrations"] };
         notes.push("db: Knex migrations");
     }
-    else if (migrationsSql) {
-        migrate = { sql: "migrations" };
-        notes.push("db: plain SQL files in migrations/, applied in name order");
+    else if (migrationsDir) {
+        migrate = { sql: migrationsDir };
+        notes.push(`db: SQL migrations in ${migrationsDir}/, applied in version order (down migrations left out)`);
     }
     else if (has("schema.sql")) {
         migrate = { sql: "schema.sql" };