@specific.dev/spectest 0.131.19 → 0.131.21

package/src/harness/service-dns.ts

@@ -0,0 +1,95 @@
+import { randomUUID } from "node:crypto";
+import { type DnsRegistry, publishDnsRegistry, parseDnsRegistry } from "./dns-registry.js";
+
+export type NameTarget = { service: string } | { ip: string | null };
+interface Binding { target: NameTarget; owner: string }
+interface Service { ip: string | null; aliases: string[] }
+
+/** SDK-owned desired state. Updates are serialized and publish the whole view.
+ * Service bindings retain their target, so replacement IPs and stops also
+ * update ctx.dnsName aliases. State and the publication queue fork with the VM. */
+export class ServiceDns {
+  private services = new Map<string, Service>();
+  private bindings = new Map<string, Binding>();
+  private pending: Promise<void> = Promise.resolve();
+  constructor(private publish: (doc: DnsRegistry) => Promise<void> = publishDnsRegistry) {}
+
+  private update(change: () => void): Promise<void> {
+    const next = this.pending.then(async () => {
+      const services = this.services;
+      const bindings = this.bindings;
+      this.services = new Map(services);
+      this.bindings = new Map(bindings);
+      let doc: DnsRegistry;
+      try {
+        change();
+        doc = parseDnsRegistry(JSON.stringify(this.document()));
+      } catch (error) {
+        this.services = services;
+        this.bindings = bindings;
+        throw error;
+      }
+      await this.publish(doc);
+    });
+    // Preserve desired state after failure; the caller gets an error and the
+    // next full publication repairs an uncertain/lost acknowledgement.
+    this.pending = next.catch(() => {});
+    return next;
+  }
+  private document(): DnsRegistry {
+    const hosts: DnsRegistry["hosts"] = Object.create(null);
+    const suffixes = new Map<string, string | null>();
+    const put = (name: string, ip: string | null) => {
+      if (name.startsWith("*.")) suffixes.set(name.slice(1), ip);
+      else hosts[name] = ip;
+    };
+    for (const [name, svc] of this.services)
+      for (const alias of [name, `${name}.internal`, ...svc.aliases]) put(alias.toLowerCase(), svc.ip);
+    for (const [name, { target }] of this.bindings)
+      put(name, "service" in target ? this.services.get(target.service)?.ip ?? null : target.ip);
+    return { version: 1, generation: randomUUID(), hosts, wildcards: [...suffixes].map(([suffix, ip]) => ({ suffix, ip })) };
+  }
+  address(name: string): string | null { return this.services.get(name)?.ip ?? null; }
+
+  reset(services: Array<{ name: string; aliases: string[] }>, bindings: Array<{ name: string; target: NameTarget }>): Promise<void> {
+    return this.update(() => {
+      this.services = new Map(services.map(svc => [svc.name, { aliases: svc.aliases, ip: null }]));
+      this.bindings = new Map(bindings.map(b => [b.name.toLowerCase(), { target: b.target, owner: "static" }]));
+    });
+  }
+  service(name: string, ip: string | null, aliases?: string[]): Promise<void> {
+    return this.update(() => {
+      const previous = this.services.get(name);
+      // Retire removed aliases as owned/unavailable as well.
+      for (const old of previous?.aliases ?? []) {
+        if (aliases && !aliases.includes(old) && !this.bindings.has(old))
+          this.bindings.set(old, { target: { ip: null }, owner: `retired:${name}` });
+      }
+      for (const alias of aliases ?? []) {
+        if (this.bindings.get(alias)?.owner === `retired:${name}`) this.bindings.delete(alias);
+      }
+      this.services.set(name, { ip, aliases: aliases ?? previous?.aliases ?? [] });
+    });
+  }
+  bind(name: string, target: NameTarget, owner = "explicit"): Promise<void> {
+    return this.update(() => { this.bindings.set(name.toLowerCase(), { target, owner }); });
+  }
+  retire(name: string, owner: string): Promise<void> {
+    return this.update(() => {
+      const binding = this.bindings.get(name.toLowerCase());
+      if (binding?.owner === owner) this.bindings.set(name.toLowerCase(), { target: { ip: null }, owner });
+    });
+  }
+}
+
+/** Serialize same-name start/stop operations, while different services can
+ * start concurrently. Prevents stale teardown deleting a replacement. */
+export class ServiceOperations {
+  private pending = new Map<string, Promise<unknown>>();
+  run<T>(name: string, fn: () => Promise<T>): Promise<T> {
+    const next = (this.pending.get(name) ?? Promise.resolve()).catch(() => {}).then(fn);
+    this.pending.set(name, next);
+    void next.finally(() => { if (this.pending.get(name) === next) this.pending.delete(name); }).catch(() => {});
+    return next;
+  }
+}

package/src/harness/shadow-builder.test.ts

@@ -5,7 +5,10 @@ test("shadow image namespaces isolate experiments and hash untrusted service nam
   const a = shadowImage(config, "../../other,compression=gzip");
   expect(a).toMatch(/^registry.example.com\/shadow\/experiment-1\/[a-f0-9]{32}:result$/);
   expect(shadowImage({ ...config, experiment: "experiment-2" }, "api")).not.toBe(shadowImage(config, "api"));
-  expect(shadowOutput(a)).toContain("compression=zstd");
+  expect(shadowOutput(a).split(",")).toEqual([
+    "type=image", `name=${a}`, "push=true", "oci-mediatypes=true",
+    "compression=zstd", "compression-level=1", "force-compression=true",
+  ]);
 });
 test("configuration rejects exporter and endpoint injection", () => {
   expect(validateShadowBuilder(config)).toEqual(config);

package/src/harness/shadow-builder.ts

@@ -24,8 +24,10 @@ export function shadowImage(c: ShadowBuilder, service: string): string {
   const id = createHash("sha256").update(service).digest("hex").slice(0, 32);
   return `${c.registry}/shadow/${c.experiment}/${id}:result`;
 }
+// Convert inherited gzip layers too; the persistent builder caches the conversion.
+// Level 1 favors export latency over a small additional size reduction.
 export function shadowOutput(reference: string): string {
-  return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=zstd`;
+  return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=zstd,compression-level=1,force-compression=true`;
 }
 export function imageDigest(metadata: unknown): string {
   const digest = (metadata as Record<string, unknown>)?.["containerimage.digest"];

package/src/resolver.test.ts

@@ -0,0 +1,267 @@
+import { afterEach, expect, test } from "bun:test";
+import { createServer } from "node:http";
+import { createConnection, createServer as createTcpServer } from "node:net";
+import { request } from "node:http";
+import { createSocket } from "node:dgram";
+import { mkdtemp, rm, writeFile, readFile, mkdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { publishDnsRegistry } from "./harness/dns-registry";
+import { ServiceDns } from "./harness/service-dns";
+import * as packet from "dns-packet";
+
+const cleanup: Array<() => Promise<void>> = [];
+afterEach(async () => { for (const fn of cleanup.splice(0).reverse()) await fn(); });
+
+async function fixture(initialRegistry?: unknown) {
+  const dir = await mkdtemp(join(tmpdir(), "spectest-dns-"));
+  if (initialRegistry) await writeFile(join(dir, "dns.json"), JSON.stringify(initialRegistry));
+  const paths: string[] = [];
+  let ip = "172.20.0.9";
+  let fail = false;
+  let failContainer = false;
+  const server = createServer((req, res) => {
+    paths.push(req.url!);
+    res.setHeader("Content-Type", "application/json");
+    if (fail) { res.writeHead(503).end("{}"); return; }
+    if (req.url === "/networks/spectest-net") {
+      res.end(JSON.stringify({ Containers: Object.fromEntries(Array.from({ length: 20 }, (_, i) => [`c${i}`, {}])) }));
+    } else if (req.url?.startsWith("/containers/") && req.url !== "/containers/json") {
+      const id = req.url.split("/")[2];
+      if (id === "c2" && failContainer) { res.writeHead(503).end("{}"); return; }
+      res.end(JSON.stringify({ State: { Running: id !== "c0" }, NetworkSettings: { Networks: {
+        "spectest-net": { IPAddress: ip, Aliases: [id === "c0" ? "stopped.test" : `${id}.test`] },
+      } } }));
+    } else { res.writeHead(404).end("{}"); }
+  });
+  const socket = join(dir, "docker.sock");
+  await new Promise<void>(resolve => server.listen(socket, resolve));
+  await writeFile(join(dir, "registry.json"), JSON.stringify({ hosts: { "explicit.test": "172.20.0.7" }, wildcards: [{ suffix: ".wild.test", ip: "172.20.0.8" }] }));
+  let upstreamQueries = 0;
+  let upstreamDelay = 0;
+  const upstream = createSocket("udp4");
+  upstream.on("message", (msg, remote) => {
+    upstreamQueries++;
+    const q = packet.decode(msg);
+    setTimeout(() => upstream.send(packet.encode({ type: "response", id: q.id, questions: q.questions, answers: [{ name: q.questions![0].name, type: "A", ttl: 1, data: "192.0.2.1" }] }), remote.port, remote.address), upstreamDelay);
+  });
+  await new Promise<void>(resolve => upstream.bind(0, "127.0.0.1", resolve));
+  const tcpUpstream = createTcpServer(socket => {
+    let data = Buffer.alloc(0);
+    socket.on("error", () => socket.destroy());
+    socket.on("data", chunk => {
+      data = Buffer.concat([data, Buffer.from(chunk)]);
+      if (data.length < 2 || data.length < 2 + data.readUInt16BE(0)) return;
+      const q = packet.decode(data.subarray(2));
+      const answer = packet.encode({ type: "response", id: q.id, questions: q.questions,
+        answers: [{ name: q.questions![0].name, type: "A", ttl: 1, data: "192.0.2.2" }] });
+      const prefix = Buffer.alloc(2); prefix.writeUInt16BE(answer.length);
+      socket.end(Buffer.concat([prefix, answer]));
+    });
+  });
+  await new Promise<void>(resolve => tcpUpstream.listen(upstream.address().port, "127.0.0.1", resolve));
+  const reservation = createSocket("udp4");
+  await new Promise<void>(resolve => reservation.bind(0, "127.0.0.1", resolve));
+  const port = reservation.address().port;
+  await new Promise<void>(resolve => reservation.close(resolve));
+  const spawn = () => Bun.spawn([process.execPath, join(import.meta.dir, "resolver.ts")], {
+    env: { ...process.env, SPECTEST_DNS_SOCKET: join(dir, "dns.sock"), SPECTEST_DNS_REGISTRY: join(dir, "dns.json"), DOCKER_SOCKET: socket, SPECTEST_RESOLVER_ADDR: "127.0.0.1", SPECTEST_RESOLVER_PORT: `${port}`, SPECTEST_RESOLVER_NO_BRIDGE: "1", SPECTEST_FAKES_REGISTRY: join(dir, "registry.json"), SPECTEST_UPSTREAM_DNS: "127.0.0.1", SPECTEST_UPSTREAM_PORT: `${upstream.address().port}` },
+    stdout: "pipe", stderr: "pipe",
+  });
+  let child = spawn();
+  cleanup.push(async () => {
+    child.kill(); await child.exited;
+    upstream.close(); await new Promise<void>(resolve => tcpUpstream.close(() => resolve())); server.closeAllConnections(); await new Promise<void>(resolve => server.close(() => resolve()));
+    await rm(dir, { recursive: true, force: true });
+  });
+  const reader = child.stdout.getReader();
+  await reader.read(); reader.releaseLock();
+  async function query(name: string, type: packet.RecordType = "A") {
+    const sock = createSocket("udp4");
+    try {
+      return await new Promise<packet.Packet>((resolve, reject) => {
+        const timeout = setTimeout(() => reject(new Error(`DNS timeout: ${name}`)), 3000);
+        sock.once("message", msg => { clearTimeout(timeout); resolve(packet.decode(msg)); });
+        sock.once("error", err => { clearTimeout(timeout); reject(err); });
+        sock.send(packet.encode({ type: "query", id: 42, questions: [{ name, type }] }), port, "127.0.0.1");
+      });
+    } finally { sock.close(); }
+  }
+  async function publish(doc: unknown) {
+    return new Promise<{ status: number; body: string }>((resolve, reject) => {
+      const req = request({ socketPath: join(dir, "dns.sock"), method: "PUT", path: "/v1/registry", agent: false }, res => {
+        let body = ""; res.setEncoding("utf8"); res.on("data", chunk => { body += chunk; });
+        res.on("end", () => resolve({ status: res.statusCode!, body }));
+      });
+      req.on("error", reject); req.end(JSON.stringify(doc));
+    });
+  }
+  async function restart() {
+    child.kill(); await child.exited; child = spawn();
+    const reader = child.stdout.getReader(); await reader.read(); reader.releaseLock();
+  }
+  async function tcpQuery(name: string) {
+    const q = packet.encode({ type: "query", id: 81, questions: [{ name, type: "A" }] });
+    const size = Buffer.alloc(2); size.writeUInt16BE(q.length);
+    return new Promise<packet.Packet>((resolve, reject) => {
+      const socket = createConnection({ host: "127.0.0.1", port });
+      let data = Buffer.alloc(0);
+      socket.setTimeout(3000, () => socket.destroy(new Error("TCP DNS timeout")));
+      socket.on("error", reject);
+      socket.on("connect", () => { socket.write(size); socket.write(q.subarray(0, 4)); socket.write(q.subarray(4)); });
+      socket.on("data", chunk => {
+        data = Buffer.concat([data, Buffer.from(chunk)]);
+        if (data.length >= 2 && data.length >= data.readUInt16BE(0) + 2) {
+          socket.destroy(); resolve(packet.decode(data.subarray(2)));
+        }
+      });
+    });
+  }
+  return { query, tcpQuery, publish, restart, dir, upstreamDelay: (ms: number) => { upstreamDelay = ms; }, upstreamQueries: () => upstreamQueries, paths, change: (next: string) => { ip = next; }, fail: (next: boolean) => { fail = next; }, failContainer: (next: boolean) => { failContainer = next; } };
+}
+
+test("DNS bursts share network discovery, preserve alias/AAAA/registry/upstream behavior", async () => {
+  const f = await fixture();
+  const answers = await Promise.all(Array.from({ length: 80 }, (_, i) => f.query(`c${i % 19 + 1}.test`, i % 2 ? "AAAA" : "A")));
+  for (let i = 0; i < answers.length; i++) expect(answers[i].answers).toHaveLength(i % 2 ? 0 : 1);
+  expect(f.paths.filter(p => p === "/networks/spectest-net")).toHaveLength(1);
+  expect(f.paths.filter(p => p.startsWith("/containers/"))).toHaveLength(20);
+  expect(f.paths.some(p => p.startsWith("/containers/json"))).toBe(false);
+  expect((await f.query("explicit.test")).answers?.[0]).toMatchObject({ data: "172.20.0.7" });
+  expect((await f.query("child.wild.test")).answers?.[0]).toMatchObject({ data: "172.20.0.8" });
+  expect((await f.query("external.test")).answers?.[0]).toMatchObject({ data: "192.0.2.1" });
+  expect((await f.query("stopped.test")).answers?.[0]).toMatchObject({ data: "192.0.2.1" });
+});
+
+test("runtime alias changes expire and transient Docker failures are not cached", async () => {
+  const f = await fixture();
+  f.fail(true);
+  expect((await f.query("c1.test")).answers?.[0]).toMatchObject({ data: "192.0.2.1" });
+  f.fail(false);
+  expect((await f.query("c1.test")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  f.change("172.20.0.10");
+  const deadline = performance.now() + 2500;
+  for (;;) {
+    const answer = await f.query("c1.test");
+    if ((answer.answers?.[0] as packet.AAnswer)?.data === "172.20.0.10") break;
+    if (performance.now() > deadline) throw new Error("Changed container IP remained stale");
+    await Bun.sleep(25);
+  }
+  expect(f.paths.filter(p => p === "/networks/spectest-net").length).toBe(3);
+});
+
+
+test("one unavailable container does not hide healthy aliases or poison the next refresh", async () => {
+  const f = await fixture();
+  f.failContainer(true);
+  expect((await f.query("c1.test")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  f.failContainer(false);
+  expect((await f.query("c2.test")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  expect(f.paths.filter(p => p === "/networks/spectest-net")).toHaveLength(2);
+});
+
+const fullRegistry = (generation = "one") => ({ version: 1, generation, hosts: {
+  api: "172.20.0.2", "api.internal": "172.20.0.2", "api.example.com": "172.20.0.3", "stopped.example.com": null,
+}, wildcards: [{ suffix: ".example.com", ip: "172.20.0.4" }, { suffix: ".deep.example.com", ip: "172.20.0.5" }] });
+
+test("acknowledged complete registry is memory-only, authoritative for every type, and serves TCP", async () => {
+  const f = await fixture();
+  const doc = fullRegistry();
+  expect(await f.publish(doc)).toEqual({ status: 200, body: JSON.stringify({ version: 1, generation: "one" }) });
+  expect(JSON.parse(await readFile(join(f.dir, "dns.json"), "utf8"))).toEqual(doc);
+  // Neither a changed legacy file nor a corrupt persisted file affects live DNS.
+  await writeFile(join(f.dir, "registry.json"), "invalid");
+  await writeFile(join(f.dir, "dns.json"), "invalid");
+  f.fail(true);
+  const replies = await Promise.all(Array.from({ length: 100 }, (_, i) => f.query(i % 2 ? "api" : "api.internal")));
+  for (const reply of replies) expect(reply.answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+  expect((await f.query("API.EXAMPLE.COM.")).answers?.[0]).toMatchObject({ data: "172.20.0.3" });
+  expect((await f.query("x.deep.example.com")).answers?.[0]).toMatchObject({ data: "172.20.0.5" });
+  expect((await f.tcpQuery("api")).answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+  for (const type of ["AAAA", "TXT", "MX", "HTTPS"] as packet.RecordType[])
+    expect((await f.query("api.example.com", type)).answers).toHaveLength(0);
+  for (const name of ["stopped.example.com", "unknown.internal", "unknown"])
+    expect((await f.query(name)).answers).toHaveLength(0);
+  expect(f.upstreamQueries()).toBe(0);
+  expect(f.paths).toHaveLength(0);
+  expect((await f.query("external.test")).answers?.[0]).toMatchObject({ data: "192.0.2.1" });
+  expect(f.paths).toHaveLength(0);
+  expect((await f.tcpQuery("external.test")).answers?.[0]).toMatchObject({ data: "192.0.2.2" });
+});
+
+test("bad updates preserve last state; replacement and restart never need Docker", async () => {
+  const f = await fixture();
+  await f.publish(fullRegistry());
+  for (const bad of [null, { ...fullRegistry(), version: 2 }, { ...fullRegistry(), hosts: { api: "garbage" } }, { ...fullRegistry(), wildcards: [{ suffix: "example.com", ip: "1.1.1.1" }] }])
+    expect((await f.publish(bad)).status).toBe(400);
+  expect((await f.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+  const next = { ...fullRegistry("two"), hosts: { api: "172.20.0.9", "api.example.com": null } };
+  expect((await f.publish(next)).status).toBe(200);
+  expect((await f.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  expect((await f.query("api.example.com")).answers).toHaveLength(0);
+  await f.restart();
+  expect((await f.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  expect((await f.query("api.example.com")).answers).toHaveLength(0);
+  expect(f.paths).toHaveLength(0);
+});
+
+test("simultaneous external clients sharing transaction IDs receive their own questions", async () => {
+  const f = await fixture();
+  await f.publish(fullRegistry());
+  const names = Array.from({ length: 60 }, (_, i) => `external${i}.test`);
+  const replies = await Promise.all(names.map(name => f.query(name)));
+  for (let i = 0; i < names.length; i++) {
+    expect(replies[i].id).toBe(42);
+    expect(replies[i].questions?.[0].name).toBe(names[i]);
+  }
+  expect(f.paths).toHaveLength(0);
+});
+
+
+test("SDK writer waits for platform activation and persists concurrent lifecycle changes", async () => {
+  const f = await fixture();
+  const dns = new ServiceDns(doc => publishDnsRegistry(doc, join(f.dir, "dns.sock")));
+  await dns.reset([{ name: "api", aliases: ["api.test"] }], []);
+  expect((await f.query("api.test")).answers).toHaveLength(0);
+  await Promise.all([dns.service("api", "172.20.0.2"), dns.service("db", "172.20.0.3"), dns.bind("setup.test", { service: "api" })]);
+  expect((await f.query("setup.test")).answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+  expect((await f.query("db")).answers?.[0]).toMatchObject({ data: "172.20.0.3" });
+  await dns.service("api", null);
+  expect((await f.query("setup.test")).answers).toHaveLength(0);
+  await dns.service("api", "172.20.0.4");
+  await f.restart();
+  expect((await f.query("setup.test")).answers?.[0]).toMatchObject({ data: "172.20.0.4" });
+  expect(f.paths).toHaveLength(0);
+});
+
+
+test("identical external queries coalesce while outstanding", async () => {
+  const f = await fixture(fullRegistry());
+  f.upstreamDelay(50);
+  const replies = await Promise.all(Array.from({ length: 40 }, () => f.query("same.external.test")));
+  for (const reply of replies) expect(reply.answers?.[0]).toMatchObject({ data: "192.0.2.1" });
+  expect(f.upstreamQueries()).toBe(1);
+});
+
+test("persistence failure rejects the update without replacing the active or saved view", async () => {
+  const f = await fixture(fullRegistry());
+  await mkdir(join(f.dir, "dns.json.tmp"));
+  const dns = new ServiceDns(doc => publishDnsRegistry(doc, join(f.dir, "dns.sock")));
+  await expect(dns.service("api", "172.20.0.9")).rejects.toThrow("DNS update rejected");
+  expect((await f.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+  expect(JSON.parse(await readFile(join(f.dir, "dns.json"), "utf8"))).toEqual(fullRegistry());
+  await rm(join(f.dir, "dns.json.tmp"), { recursive: true });
+  await dns.service("api", "172.20.0.9");
+  expect((await f.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+});
+
+test("copies of persisted registry evolve independently", async () => {
+  const a = await fixture(fullRegistry());
+  const b = await fixture(fullRegistry());
+  await a.publish({ ...fullRegistry("child"), hosts: { api: "172.20.0.9" } });
+  expect((await a.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  expect((await b.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+  await a.restart(); await b.restart();
+  expect((await a.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.9" });
+  expect((await b.query("api")).answers?.[0]).toMatchObject({ data: "172.20.0.2" });
+});