slicetest 0.8.0 → 0.9.0

package/dist/matchers.d.ts

@@ -1,5 +1,5 @@
 import { type Where } from "./db.js";
-import type { HttpResponse } from "./http.js";
+import { type HttpResponse } from "./http.js";
 import { type MatchOptions } from "./stub.js";
 /** One expected call for `toHaveReceivedInOrder`: `[stub, method, path, match?]`. */
 export type OrderedCall = [stub: string, method: string, path: string | RegExp, match?: MatchOptions];
@@ -22,8 +22,16 @@ interface SlicetestMatchers<R = unknown> {
      * relative to the working directory with an optional pointer, `openapi.yaml#/components/schemas/Poll`.
      */
     toMatchSchema(schema: object | string): R;
-    /** The response has this status; the failure message shows the response body. */
-    toHaveStatus(status: number): R;
+    /** The response has this status, a status of this class (`"2xx"`) or one of a list (`[200, 204]`); the failure message shows the response body. */
+    toHaveStatus(status: number | `${1 | 2 | 3 | 4 | 5}xx` | (number | `${1 | 2 | 3 | 4 | 5}xx`)[]): R;
+    /**
+     * The response sets cookie `name`, with these attributes as a subset (`value`, `httpOnly`,
+     * `secure`, `sameSite`, `path`, `domain`, `maxAge`, `expires`, `partitioned`):
+     * `expect(res).toSetCookie("sid", { httpOnly: true, secure: true, sameSite: "Lax" })`.
+     */
+    toSetCookie(name: string, attributes?: Record<string, unknown>): R;
+    /** The response arrived within `ms` milliseconds (measured from sending the request to reading the whole body). */
+    toRespondWithin(ms: number): R;
     /** An array of responses has exactly these status counts, e.g. `{ 201: 1, 409: 9 }`. */
     toHaveStatuses(counts: Record<number, number>): R;
     /** Async: the table has at least one row matching `where` (`count` for an exact number). */
@@ -33,5 +41,8 @@ declare module "vitest" {
     interface Matchers<R extends void | Promise<void> = void | Promise<void>, T = unknown> extends SlicetestMatchers<R> {
     }
 }
+/** A status code, a class (`"2xx"`), or a list of either: `[200, 204]`, `["2xx", 304]`. */
+export type ExpectedStatus = number | string | (number | string)[];
+export declare function statusMatches(expected: ExpectedStatus, actual: number): boolean;
 export declare function statusCounts(responses: HttpResponse[]): Record<number, number>;
 export {};

package/dist/matchers.js

@@ -1,5 +1,6 @@
 import { expect } from "vitest";
 import { Db } from "./db.js";
+import { setCookies } from "./http.js";
 import { describeGraphQL } from "./graphql.js";
 import { schemaProblems } from "./schema.js";
 import { Stub, subset } from "./stub.js";
@@ -22,6 +23,24 @@ function assertStub(received) {
     if (!(received instanceof Stub))
         throw new TypeError("slicetest: expected a stub, e.g. expect(stub(\"slack\"))");
 }
+export function statusMatches(expected, actual) {
+    if (Array.isArray(expected)) {
+        if (expected.length === 0)
+            throw new TypeError("slicetest: toHaveStatus needs at least one status in the list");
+        return expected.some((e) => statusMatches(e, actual));
+    }
+    if (typeof expected === "number")
+        return expected === actual;
+    const s = String(expected).trim().toLowerCase();
+    if (/^\d{3}$/.test(s))
+        return Number(s) === actual;
+    if (/^[1-5]xx$/.test(s))
+        return Math.floor(actual / 100) === Number(s[0]);
+    throw new TypeError(`slicetest: a status is a code (201), a class ("2xx") or a list of them, got ${JSON.stringify(expected)}`);
+}
+function describeStatus(expected) {
+    return Array.isArray(expected) ? `one of ${expected.join(", ")}` : String(expected);
+}
 export function statusCounts(responses) {
     const out = {};
     for (const r of responses)
@@ -140,18 +159,54 @@ expect.extend({
         };
     },
     toHaveStatus(received, status) {
-        const pass = received?.status === status;
+        if (!received || typeof received !== "object" || typeof received.status !== "number") {
+            throw new TypeError(`slicetest: toHaveStatus expects a response from http, got ${this.utils.stringify(received)}`);
+        }
+        const pass = statusMatches(status, received.status);
         return {
             pass,
             message: () => {
                 const body = received.text.length > 1000 ? `${received.text.slice(0, 1000)}…` : received.text;
-                return (`expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to respond ${status}, got ${received.status}\n` +
+                return (`expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to respond ${describeStatus(status)}, got ${received.status}\n` +
                     `Response body:\n  ${body || "(empty)"}`);
             },
             actual: received?.status,
             expected: status,
         };
     },
+    toSetCookie(received, name, attributes = {}) {
+        if (!received || typeof received !== "object" || !(received.headers instanceof Headers)) {
+            throw new TypeError(`slicetest: toSetCookie expects a response from http, got ${this.utils.stringify(received)}`);
+        }
+        const cookies = setCookies(received);
+        const cookie = Object.hasOwn(cookies, name) ? cookies[name] : undefined;
+        // SameSite values are case-insensitive: "Lax" and "lax" are the same attribute. A matcher sees the value as sent.
+        const plain = typeof attributes.sameSite === "string";
+        const want = plain ? { ...attributes, sameSite: attributes.sameSite.toLowerCase() } : attributes;
+        const pass = !!cookie && subset(want, plain ? { ...cookie, sameSite: cookie.sameSite?.toLowerCase() } : cookie);
+        const describe = (c) => `${c.name}=${c.value.length > 40 ? `${c.value.slice(0, 40)}…` : c.value} ${JSON.stringify(Object.fromEntries(Object.entries(c).filter(([k, v]) => k !== "name" && k !== "value" && v !== undefined && v !== false)))}`;
+        return {
+            pass,
+            message: () => {
+                const head = `expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to set cookie ${name}${Object.keys(attributes).length ? ` with ${this.utils.stringify(attributes, 10, { min: true })}` : ""}`;
+                const all = Object.values(cookies);
+                return `${head}\n${all.length ? `Cookies it set:\n${all.map((c) => `  ${describe(c)}`).join("\n")}` : "It set no cookies."}`;
+            },
+        };
+    },
+    toRespondWithin(received, ms) {
+        if (!received || typeof received !== "object" || typeof received.durationMs !== "number") {
+            throw new TypeError(`slicetest: toRespondWithin expects a response from http, got ${this.utils.stringify(received)}`);
+        }
+        if (!(typeof ms === "number" && ms > 0))
+            throw new TypeError(`slicetest: toRespondWithin needs a positive number of milliseconds, got ${this.utils.stringify(ms)}`);
+        return {
+            pass: received.durationMs <= ms,
+            message: () => `expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to respond within ${ms}ms, it took ${received.durationMs}ms`,
+            actual: received.durationMs,
+            expected: ms,
+        };
+    },
     toHaveStatuses(received, counts) {
         if (!Array.isArray(received))
             throw new TypeError("slicetest: toHaveStatuses expects an array of responses, e.g. from http.concurrently()");

package/dist/openapi.d.ts

@@ -31,11 +31,6 @@ export interface Message {
     body: unknown;
     query?: URLSearchParams;
 }
-/**
- * An OpenAPI 3.0 / 3.1 document, used to check that real traffic matches it:
- * the app's responses against the app's own spec, and the app's calls to a
- * stubbed service (and the stub's canned replies) against that service's spec.
- */
 export declare class OpenApiSpec {
     #private;
     readonly file: string;

package/dist/openapi.js

@@ -5,11 +5,17 @@ import addFormatsModule from "ajv-formats";
 import { parse } from "yaml";
 const addFormats = (addFormatsModule.default ?? addFormatsModule);
 const METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
-/**
- * An OpenAPI 3.0 / 3.1 document, used to check that real traffic matches it:
- * the app's responses against the app's own spec, and the app's calls to a
- * stubbed service (and the stub's canned replies) against that service's spec.
- */
+/** A server's URL with its `{variables}` filled in: every `enum` value, else the default. */
+function serverUrls(server) {
+    let urls = [server.url ?? "/"];
+    for (const [name, v] of Object.entries(server.variables ?? {})) {
+        const values = [...new Set([...(v.default === undefined ? [] : [v.default]), ...(v.enum ?? [])].map(String))];
+        if (values.length === 0 || !urls[0].includes(`{${name}}`))
+            continue;
+        urls = urls.flatMap((u) => values.map((value) => u.replaceAll(`{${name}}`, value))).slice(0, 50);
+    }
+    return urls;
+}
 export class OpenApiSpec {
     file;
     doc;
@@ -45,7 +51,8 @@ export class OpenApiSpec {
         // Paths in the spec are relative to the server URL, e.g. /v1 for https://api.example.com/v1.
         this.#basePaths = [
             ...new Set((doc.servers ?? [])
-                .map((s) => new URL(s.url ?? "/", "http://x").pathname.replace(/\/$/, ""))
+                .flatMap((s) => serverUrls(s))
+                .map((url) => new URL(url, "http://x").pathname.replace(/\/$/, ""))
                 .filter(Boolean)),
         ];
     }

package/dist/recording.d.ts

@@ -38,6 +38,13 @@ export declare class Recorder {
     /** Recordings made by this worker, to be merged into the file when the run ends. */
     added(): Recording[];
 }
+export declare const REDACTED = "[redacted]";
+/**
+ * A request with credential values replaced by `[redacted]`, so recordings can be committed and
+ * replay whatever key the test environment uses. Applied to recordings and to calls alike before
+ * they are compared.
+ */
+export declare function redactRequest(r: Recording["request"]): Recording["request"];
 export declare function readRecordings(file: string): Promise<Recording[]>;
 /** Append new recordings to `file`, skipping exact duplicates, keeping the order they were made in. */
 export declare function mergeRecordings(file: string, upstream: string, added: Recording[], source?: string): Promise<void>;

package/dist/recording.js

@@ -90,14 +90,48 @@ export class Recorder {
 }
 function requestOf(call) {
     const query = Object.fromEntries([...call.query.entries()].sort(([a], [b]) => a.localeCompare(b)));
-    return {
+    return redactRequest({
         method: call.method,
         path: call.path,
         ...(Object.keys(query).length ? { query } : {}),
         ...(call.json !== undefined ? { json: call.json } : call.body ? { body: call.body } : {}),
-    };
+    });
 }
-function keyOf(r) {
+/** Credentials sent in a query, a form or JSON body: `api_key`, `key`, `access_token`, `client_secret`, `password`, `appid`, signatures. */
+const SECRET = /^(api[-_]?key|apikey|key|(access|refresh|id|auth)[-_]?token|token|client[-_]?secret|app[-_]?secret|secret|password|passwd|appid|signature|sig|x-amz-(signature|credential|security-token))$/i;
+/** In bodies, a bare `key` is usually data (a KV store's key, a record's key) that tells requests apart, not a credential. */
+const bodySecret = (k) => SECRET.test(k) && k.toLowerCase() !== "key";
+export const REDACTED = "[redacted]";
+const FORM_BODY = /^[^\s=&]+=[^\s&]*(&[^\s=&]+=[^\s&]*)*$/;
+/**
+ * A request with credential values replaced by `[redacted]`, so recordings can be committed and
+ * replay whatever key the test environment uses. Applied to recordings and to calls alike before
+ * they are compared.
+ */
+export function redactRequest(r) {
+    const out = { ...r };
+    if (r.query)
+        out.query = Object.fromEntries(Object.entries(r.query).map(([k, v]) => [k, SECRET.test(k) ? REDACTED : v]));
+    if (r.json !== undefined)
+        out.json = redactJson(r.json);
+    if (r.body && FORM_BODY.test(r.body)) {
+        const form = new URLSearchParams(r.body);
+        if ([...form.keys()].some(bodySecret)) {
+            out.body = [...form].map(([k, v]) => `${encodeURIComponent(k)}=${bodySecret(k) ? REDACTED : encodeURIComponent(v)}`).join("&");
+        }
+    }
+    return out;
+}
+function redactJson(v) {
+    if (Array.isArray(v))
+        return v.map(redactJson);
+    if (v && typeof v === "object")
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, typeof x === "string" && bodySecret(k) ? REDACTED : redactJson(x)]));
+    return v;
+}
+function keyOf(request) {
+    // Recordings made before redaction still match: both sides are compared redacted.
+    const r = redactRequest(request);
     return JSON.stringify([r.method.toUpperCase(), r.path, sortKeys(r.query ?? {}), sortKeys(r.json ?? null), r.body ?? ""]);
 }
 function sortKeys(v) {
@@ -143,6 +177,6 @@ export async function mergeRecordings(file, upstream, added, source = `Recorded
         if (!entries.some((x) => isDeepStrictEqual(x, e)))
             entries.push(e);
     await mkdir(path.dirname(file), { recursive: true });
-    const header = `# ${source}. Review before committing: request bodies are stored as sent.\n`;
+    const header = `# ${source}. Review before committing: credentials in queries and bodies (api_key, access_token, client_secret, password, …) are replaced by ${REDACTED}, but other values are stored as sent.\n`;
     await writeFile(file, header + YAML.stringify(entries, { lineWidth: 0 }));
 }

package/dist/runtime.js

@@ -302,6 +302,9 @@ export class Runtime {
         this.#assertAlive();
         if (this.interceptor?.blocked.size)
             throw new Error(blockedHint([...this.interceptor.blocked]));
+        const thrown = this.#handlerErrors();
+        if (thrown.length > 0)
+            throw new Error(`slicetest: a stub's reply threw, so the app got an error response instead of the reply:\n${thrown.join("\n")}`);
         const unmatched = this.#unmatched();
         if (unmatched.length > 0) {
             throw new Error(`slicetest: the app called stubbed services with no matching route:\n${unmatched.join("\n")}`);
@@ -347,6 +350,12 @@ export class Runtime {
         }
         return out;
     }
+    #handlerErrors() {
+        return [...this.stubs.values()].flatMap((s) => s.handlerErrors().map(({ call, error }) => {
+            const where = error?.stack?.split("\n").find((l) => /^\s+at /.test(l) && !l.includes("node_modules") && !l.includes("node:"))?.trim();
+            return `  ${s.name}: ${call.method} ${call.path}: ${error instanceof Error ? error.message : String(error)}${where ? `\n    ${where}` : ""}`;
+        }));
+    }
     #unmatched() {
         return [...this.stubs.values()].flatMap((s) => {
             const calls = s.unmatched();
@@ -401,6 +410,9 @@ export class Runtime {
             if (exit)
                 sections.push(`the ${p.label} exited (code ${exit.code}, signal ${exit.signal}); it will be restarted for the next scenario`);
         }
+        const thrown = this.#handlerErrors();
+        if (thrown.length > 0)
+            sections.push(`stub replies that threw:\n${thrown.join("\n")}`);
         const unmatched = this.#unmatched();
         if (unmatched.length > 0)
             sections.push(`stub calls with no matching route:\n${unmatched.join("\n")}`);

package/dist/sql-migrations.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Files `migrate: { sql }` applies, in order: the file itself, or a directory's `.sql` files (and
+ * Diesel's `<version>_<name>/up.sql`) sorted by name with numbers compared as numbers. Rollback
+ * files are left out: golang-migrate / sqlx `*.down.sql`, Diesel's `down.sql` and Flyway undo
+ * migrations (`U2__…`).
+ */
+export declare function sqlMigrationFiles(target: string): Promise<string[]>;
+/** The statements of a migration file that migrate up: without a goose or dbmate down section. */
+export declare function upSection(sql: string): string;
+/** Apply `files` in order with `exec`, naming the file that fails. */
+export declare function applySqlFiles(files: string[], exec: (sql: string) => Promise<unknown>, root: string): Promise<void>;

package/dist/sql-migrations.js

@@ -0,0 +1,38 @@
+import { existsSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+/** Version numbers compare as numbers: Flyway's `V2__` comes before `V10__`. */
+const byVersion = new Intl.Collator("en", { numeric: true }).compare;
+/**
+ * Files `migrate: { sql }` applies, in order: the file itself, or a directory's `.sql` files (and
+ * Diesel's `<version>_<name>/up.sql`) sorted by name with numbers compared as numbers. Rollback
+ * files are left out: golang-migrate / sqlx `*.down.sql`, Diesel's `down.sql` and Flyway undo
+ * migrations (`U2__…`).
+ */
+export async function sqlMigrationFiles(target) {
+    if (!(await stat(target)).isDirectory())
+        return [target];
+    const entries = await readdir(target, { withFileTypes: true });
+    const files = entries.filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".sql") && !/\.down\.sql$/i.test(e.name) && !/^U\d+(\.\d+)*__/.test(e.name)).map((e) => e.name);
+    // Diesel: one directory per migration, holding up.sql and down.sql.
+    const dirs = entries.filter((e) => e.isDirectory() && existsSync(path.join(target, e.name, "up.sql"))).map((e) => path.join(e.name, "up.sql"));
+    return [...files, ...dirs].sort(byVersion).map((f) => path.join(target, f));
+}
+/** Where a migration's rollback section starts in goose (`-- +goose Down`) and dbmate (`-- migrate:down`) files. */
+const DOWN = /^--\s*(\+goose\s+down|migrate:down)\b/im;
+/** The statements of a migration file that migrate up: without a goose or dbmate down section. */
+export function upSection(sql) {
+    const m = DOWN.exec(sql);
+    return m ? sql.slice(0, m.index) : sql;
+}
+/** Apply `files` in order with `exec`, naming the file that fails. */
+export async function applySqlFiles(files, exec, root) {
+    for (const file of files) {
+        try {
+            await exec(upSection(await readFile(file, "utf8")));
+        }
+        catch (e) {
+            throw new Error(`slicetest: db.migrate.sql: ${path.relative(root, file) || file}: ${e.message}`, { cause: e });
+        }
+    }
+}

package/dist/stub.d.ts

@@ -54,7 +54,7 @@ export interface ChaosOptions {
 export interface StubResponse {
     status?: number;
     headers?: Record<string, string>;
-    /** Objects are sent as JSON. */
+    /** Strings and bytes (`Uint8Array`, `ArrayBuffer`) are sent as they are; anything else as JSON. */
     body?: unknown;
 }
 /** One server-sent event: `[event, data]`, or `{ event, data, id }`. Data that isn't a string is sent as JSON. */
@@ -75,7 +75,8 @@ export type Responder = StubResponse | ((call: RecordedCall) => StubResponse | P
  * `expect.*` asymmetric matchers receive the actual value.
  */
 export interface MatchOptions {
-    query?: Record<string, Matcher>;
+    /** A list matches a repeated parameter's values in order: `{ ids: ["1", "2"] }` for `?ids=1&ids=2`. */
+    query?: Record<string, Matcher | Matcher[]>;
     headers?: Record<string, Matcher>;
     json?: unknown;
     /** Subset of a form-encoded body's fields (`call.form`). Numbers and booleans compare as the strings sent. */
@@ -137,6 +138,7 @@ export declare class Stub {
     /**
      * Answer `method path`. `path` may contain `:name` segments (captured into
      * `call.params`) or be a RegExp; `method` may be `*`. Later routes win.
+     * A query in `path` (`/search?q=tea`) is a condition on those parameters; others may come along.
      */
     on(method: string, path: string | RegExp, match?: MatchOptions): RouteBuilder;
     /**
@@ -160,7 +162,12 @@ export declare class Stub {
     /** The active `chaos()` settings and what they did, for failure output; undefined when off. */
     describeChaos(): string | undefined;
     /** Calls received so far, optionally filtered by method, path and conditions (same syntax as `on()`). */
-    calls(method?: string, path?: string | RegExp, match?: MatchOptions): RecordedCall[];
+    calls(method?: string, fullPath?: string | RegExp, fullMatch?: MatchOptions): RecordedCall[];
+    /** Calls whose reply function or fallback threw, with the error; the app got a 500 (502 for a fallback). */
+    handlerErrors(): {
+        call: RecordedCall;
+        error: unknown;
+    }[];
     unmatched(): RecordedCall[];
     /** Routes registered in this scenario that no call reached, except `optional()` ones. */
     unusedRoutes(): string[];

package/dist/stub.js

@@ -30,6 +30,8 @@ export class Stub {
     /** Appended to the 501 answer for a call nothing could answer. */
     #hint;
     #chaos;
+    /** Reply functions (and fallbacks) that threw: the app got a 500 / 502, the scenario must fail with the error. */
+    #errors = [];
     url = "";
     constructor(name) {
         this.name = name;
@@ -54,6 +56,7 @@ export class Stub {
     /**
      * Answer `method path`. `path` may contain `:name` segments (captured into
      * `call.params`) or be a RegExp; `method` may be `*`. Later routes win.
+     * A query in `path` (`/search?q=tea`) is a condition on those parameters; others may come along.
      */
     on(method, path, match = {}) {
         return this.#on(method, path, match);
@@ -77,7 +80,8 @@ export class Stub {
         };
         return gql;
     }
-    #on(method, path, match, label) {
+    #on(method, fullPath, fullMatch, label) {
+        const { path, match } = splitQuery(fullPath, fullMatch);
         const { pattern, paramNames } = compilePath(path);
         const route = {
             method: method.toUpperCase(),
@@ -179,12 +183,17 @@ export class Stub {
         this.#send(call, res, { status: fault.status, headers: retry, body: { error: "slicetest chaos", status: fault.status } });
     }
     /** Calls received so far, optionally filtered by method, path and conditions (same syntax as `on()`). */
-    calls(method, path, match = {}) {
+    calls(method, fullPath, fullMatch = {}) {
+        const { path, match } = fullPath === undefined ? { path: undefined, match: fullMatch } : splitQuery(fullPath, fullMatch);
         const compiled = path === undefined ? undefined : compilePath(path);
         return this.#calls.filter((c) => (!method || method === "*" || c.method === method.toUpperCase()) &&
             (!compiled || matchPath(path, compiled.pattern, c.path) !== undefined) &&
             matchConditions(match, c));
     }
+    /** Calls whose reply function or fallback threw, with the error; the app got a 500 (502 for a fallback). */
+    handlerErrors() {
+        return this.#errors;
+    }
     unmatched() {
         return this.#calls.filter((c) => !c.matched);
     }
@@ -239,6 +248,7 @@ export class Stub {
         this.#routes = [];
         this.#calls = [];
         this.#chaos = undefined;
+        this.#errors = [];
     }
     /**
      * Answer calls that no registered route matches, instead of failing with 501.
@@ -303,6 +313,7 @@ export class Stub {
                 out = await this.#fallback?.(call);
             }
             catch (e) {
+                this.#errors.push({ call, error: e });
                 res.writeHead(502, { "content-type": "text/plain" }).end(e.message);
                 return;
             }
@@ -330,10 +341,15 @@ export class Stub {
             this.#send(call, res, typeof route.respond === "function" ? await route.respond(call) : route.respond);
         }
         catch (e) {
+            this.#errors.push({ call, error: e });
             res.writeHead(500).end(`slicetest: stub handler threw: ${e}`);
         }
     }
     #send(call, res, out) {
+        if (out.body instanceof ArrayBuffer || (ArrayBuffer.isView(out.body) && !(out.body instanceof Uint8Array))) {
+            const view = out.body;
+            out = { ...out, body: view instanceof ArrayBuffer ? new Uint8Array(view) : new Uint8Array(view.buffer, view.byteOffset, view.byteLength) };
+        }
         const raw = out.body === undefined || typeof out.body === "string" || out.body instanceof Uint8Array;
         const headers = { ...out.headers };
         if (!raw && !Object.keys(headers).some((h) => h.toLowerCase() === "content-type")) {
@@ -349,6 +365,15 @@ export class Stub {
         res.end(payload);
     }
 }
+/** `/search?q=tea` is the path `/search` with the query condition `q: "tea"`; `match.query` wins over the path's. */
+function splitQuery(path, match) {
+    if (typeof path !== "string" || !path.includes("?"))
+        return { path, match };
+    const [bare, search] = [path.slice(0, path.indexOf("?")), path.slice(path.indexOf("?") + 1)];
+    const params = new URLSearchParams(search);
+    const query = Object.fromEntries([...new Set(params.keys())].map((k) => [k, params.getAll(k).length > 1 ? params.getAll(k) : params.get(k)]));
+    return { path: bare || "/", match: { ...match, query: { ...query, ...match.query } } };
+}
 function compilePath(path) {
     if (typeof path !== "string" || !path.includes("/:"))
         return { pattern: undefined, paramNames: [] };
@@ -388,7 +413,7 @@ function decodeSegment(segment) {
 }
 function matchConditions(match, call) {
     for (const [k, m] of Object.entries(match.query ?? {})) {
-        if (!test(m, call.query.get(k) ?? undefined))
+        if (!testQuery(m, call.query, k))
             return false;
     }
     for (const [k, m] of Object.entries(match.headers ?? {})) {
@@ -417,9 +442,11 @@ function matchConditions(match, call) {
 /** The first condition of `match` that `call` fails, described; undefined when it meets them all. */
 function conditionMismatch(match, call) {
     for (const [k, m] of Object.entries(match.query ?? {})) {
-        const v = call.query.get(k) ?? undefined;
-        if (!test(m, v))
-            return `query ${k}: expected ${show(m)}, got ${v === undefined ? "nothing" : JSON.stringify(v)}`;
+        if (testQuery(m, call.query, k))
+            continue;
+        const all = call.query.getAll(k);
+        const got = all.length === 0 ? "nothing" : Array.isArray(m) || all.length > 1 ? JSON.stringify(all) : JSON.stringify(all[0]);
+        return `query ${k}: expected ${Array.isArray(m) ? `[${m.map(show).join(", ")}]` : show(m)}, got ${got}`;
     }
     for (const [k, m] of Object.entries(match.headers ?? {})) {
         const raw = call.headers[k.toLowerCase()];
@@ -525,6 +552,13 @@ function distance(a, b) {
     }
     return row[b.length];
 }
+/** A query condition: one matcher for the first value, or a list for every value of a repeated parameter, in order. */
+function testQuery(m, query, key) {
+    if (!Array.isArray(m))
+        return test(m, query.get(key) ?? undefined);
+    const values = query.getAll(key);
+    return values.length === m.length && m.every((x, i) => test(x, values[i]));
+}
 function test(m, value) {
     if (isAsymmetric(m))
         return m.asymmetricMatch(value);
@@ -558,6 +592,8 @@ function isAsymmetric(m) {
 function isForm(contentType) {
     return !!contentType && contentType.split(";")[0].trim().toLowerCase() === "application/x-www-form-urlencoded";
 }
+/** Keys kept as plain fields rather than nested into, so a body can't reach `Object.prototype`. */
+const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 /**
  * A form body as nested fields, the way Rack, PHP and Stripe read bracket keys: `a[b]=1` is
  * `{ a: { b: "1" } }`, `a[]=1&a[]=2` and `a[0]=1&a[1]=2` are arrays, and a plain key sent
@@ -567,12 +603,13 @@ export function parseForm(body) {
     const out = {};
     for (const [key, value] of new URLSearchParams(body)) {
         const m = /^([^[\]]+)((?:\[[^\]]*\])*)$/.exec(key);
-        if (!m || !m[2]) {
-            const prev = out[key];
-            out[key] = prev === undefined ? value : Array.isArray(prev) ? [...prev, value] : [prev, value];
+        const path = m?.[2] ? [m[1], ...[...m[2].matchAll(/\[([^\]]*)\]/g)].map((x) => x[1])] : undefined;
+        // `__proto__[x]=1` is sent by whatever the app forwards; it must not reach Object.prototype.
+        if (!path || path.some((seg) => UNSAFE_KEYS.has(seg))) {
+            const prev = Object.hasOwn(out, key) ? out[key] : undefined;
+            Object.defineProperty(out, key, { value: prev === undefined ? value : Array.isArray(prev) ? [...prev, value] : [prev, value], enumerable: true, writable: true, configurable: true });
             continue;
         }
-        const path = [m[1], ...[...m[2].matchAll(/\[([^\]]*)\]/g)].map((x) => x[1])];
         let node = out;
         for (let i = 0; i < path.length; i++) {
             const seg = path[i];

package/dist/yaml-runtime.js

@@ -235,7 +235,7 @@ async function runStep(step, ctx, vars, base) {
             follow: step.follow,
         });
         verifyResponse(res, step.expect, vars, base);
-        capture(step.capture, { status: res.status, json: res.json, text: res.text, headers: Object.fromEntries(res.headers) }, vars);
+        capture(step.capture, { status: res.status, json: res.json, text: res.text, headers: Object.fromEntries(res.headers), events: res.events }, vars);
         return;
     }
     if ("request" in step) {
@@ -296,7 +296,7 @@ async function runStep(step, ctx, vars, base) {
             }
         }
         verify(res);
-        capture(step.capture, { status: res.status, json: res.json, text: res.text, headers: Object.fromEntries(res.headers) }, vars);
+        capture(step.capture, { status: res.status, json: res.json, text: res.text, headers: Object.fromEntries(res.headers), events: res.events }, vars);
         return;
     }
     if ("insert" in step) {
@@ -551,18 +551,23 @@ const FORMATS = {
     uri: /^[a-z][a-z0-9+.-]*:\/\/\S+$/i,
     integer: /^-?\d+$/,
 };
-const MATCHERS = ["$type", "$regex", "$contains", "$any", "$gt", "$gte", "$lt", "$lte", "$len", "$not", "$oneOf", "$format"];
+const MATCHERS = ["$type", "$regex", "$contains", "$any", "$gt", "$gte", "$lt", "$lte", "$closeTo", "$len", "$not", "$oneOf", "$format"];
 /** An asymmetric matcher Vitest's `toEqual` / `toMatchObject` call, with a readable name in diffs. */
 function matcher(name, test) {
     return { asymmetricMatch: test, toAsymmetricMatcher: () => name, toString: () => name };
 }
-/** Numbers compare as numbers; strings (ISO dates, versions) compare as strings; anything else never matches. */
+/** A decimal as Postgres `numeric` and MySQL `DECIMAL` columns come back, to keep their precision: `"12.50"`. */
+const DECIMAL = /^-?\d+(\.\d+)?$/;
+/**
+ * Numbers compare as numbers, also with decimal strings from `numeric` / `DECIMAL` columns; strings
+ * (ISO dates, versions) compare as strings; anything else never matches.
+ */
 function compare(op, arg, holds) {
     if (typeof arg !== "number" && typeof arg !== "string")
         throw new Error(`${op} takes a number or a string, got ${JSON.stringify(arg)}`);
     return matcher(`${op} ${JSON.stringify(arg)}`, (v) => {
         if (typeof arg === "number")
-            return typeof v === "number" && holds(v - arg);
+            return (typeof v === "number" || (typeof v === "string" && DECIMAL.test(v))) && holds(Number(v) - arg);
         return typeof v === "string" && holds(v < arg ? -1 : v > arg ? 1 : 0);
     });
 }
@@ -604,6 +609,13 @@ function single(key, arg) {
             return compare(key, arg, (c) => c < 0);
         case "$lte":
             return compare(key, arg, (c) => c <= 0);
+        case "$closeTo": {
+            // `$closeTo: 9.99` allows ±0.005 (two decimals, like toBeCloseTo); `$closeTo: [9.99, 0.1]` sets the tolerance.
+            const [target, tolerance = 0.005] = Array.isArray(arg) ? arg : [arg];
+            if (typeof target !== "number" || typeof tolerance !== "number" || !(tolerance >= 0))
+                throw new Error(`$closeTo takes a number or [number, tolerance], got ${JSON.stringify(arg)}`);
+            return matcher(`$closeTo ${JSON.stringify(arg)}`, (v) => (typeof v === "number" || (typeof v === "string" && DECIMAL.test(v))) && Math.abs(Number(v) - target) <= tolerance + Number.EPSILON);
+        }
         case "$len": {
             const want = toMatchers(arg);
             return matcher(`$len ${JSON.stringify(arg)}`, (v) => (typeof v === "string" || Array.isArray(v)) && equalsMatcher(want, v.length));
@@ -669,6 +681,35 @@ function verifyResponse(res, e, vars, base) {
         check(res.json, e.json, vars, "response JSON");
     if (e?.text !== undefined)
         check(res.text, e.text, vars, "response text");
+    if (e?.events !== undefined) {
+        if (!res.events)
+            throw new Error(`${res.method} ${res.url}: expected server-sent events, but the response is ${res.headers.get("content-type") ?? "without a content type"}, not text/event-stream`);
+        const wanted = toMatchers(interpolate(e.events, vars));
+        let at = 0;
+        for (const [i, want] of wanted.entries()) {
+            const found = res.events.findIndex((ev, j) => j >= at && subsetEquals(want, ev));
+            if (found < 0) {
+                const shown = res.events.slice(0, 20).map((ev, j) => `  ${j}: ${JSON.stringify(ev).slice(0, 200)}`).join("\n");
+                throw new Error(`${res.method} ${res.url}: expected event ${i + 1} of ${wanted.length}, ${JSON.stringify(e.events[i])}, ${at > 0 ? `after event ${at - 1}` : "in the stream"}; ${res.events.length} event(s) arrived:\n${shown || "  (none)"}${res.events.length > 20 ? "\n  …" : ""}`);
+            }
+            at = found + 1;
+        }
+    }
+    if (e?.cookies !== undefined) {
+        for (const [name, attrs] of Object.entries(e.cookies)) {
+            if (attrs === null)
+                expect(res).not.toSetCookie(name);
+            else
+                expect(res).toSetCookie(name, toMatchers(interpolate(attrs, vars)));
+        }
+    }
+    if (e?.duration !== undefined) {
+        const want = interpolate(e.duration, vars);
+        if (typeof want === "number")
+            expect(res).toRespondWithin(want);
+        else
+            check(res.durationMs, want, vars, `${res.method} ${res.url} response time (${res.durationMs}ms)`);
+    }
     if (e?.schema !== undefined) {
         const problems = schemaProblems(e.schema, res.json, base);
         if (problems.length)

package/dist/yaml.d.ts

@@ -132,7 +132,10 @@ export interface RequestStep {
     /** `queries`: at most this many SQL statements (not counting BEGIN/COMMIT), with `db.queries` on. */
     /** `schema`: a JSON Schema for the response JSON, inline or `file#/pointer` relative to the scenario file. */
     expect?: {
-        status?: number;
+        events?: Record<string, unknown>[];
+        cookies?: Record<string, Record<string, unknown> | null>;
+        duration?: number | Record<string, unknown>;
+        status?: number | string | (number | string)[];
         statuses?: Record<string, number>;
         headers?: Record<string, unknown>;
         json?: unknown;
@@ -156,7 +159,10 @@ export interface SubmitStep {
     headers?: Record<string, string>;
     follow?: boolean;
     expect?: {
-        status?: number;
+        events?: Record<string, unknown>[];
+        cookies?: Record<string, Record<string, unknown> | null>;
+        duration?: number | Record<string, unknown>;
+        status?: number | string | (number | string)[];
         headers?: Record<string, unknown>;
         json?: unknown;
         text?: unknown;