@specific.dev/spectest 0.131.20 → 0.132.0

package/dist/browser.js

@@ -289,7 +289,8 @@ async function applySafeAreaInsets(cdp, d) {
 // ────────────────────────────────────────────────────────────────────────
 // Vendored `@rrweb/record` UMD bundle (rrweb 2.x), BUILT FROM OUR FORK by
 // `scripts/rrweb-record/build.sh` (specific-dev/rrweb, branch `spectest` =
-// the `rrweb@2.1.0` tag + upstream PR 1802). Never copy the npm dist over
+// the `rrweb@2.1.0` tag + upstream PR 1802 + non-mutating image capture).
+// Never copy the npm dist over
 // it: upstream's `@rrweb/utils` lists `querySelector` as an accessor, so its
 // pristine-prototype test always fails and `record()` appends an <iframe>
 // to every document — measured at ~1 s per navigation (see the top-frame
@@ -380,7 +381,8 @@ const RRWEB_BOOTSTRAP = `
       // CSS (what next/font emits), so it's a no-op for most apps; the
       // url()-based fonts are handled by the inliner below instead. All
       // degrade gracefully — an asset that can't be read is skipped,
-      // never fatal to recording.
+      // never fatal to recording. Our fork never changes a live image's
+      // crossorigin attribute to retry a failed canvas read.
       inlineStylesheet: true,
       collectFonts: true,
       inlineImages: true,

package/dist/change-rules.d.ts

@@ -0,0 +1,45 @@
+/** Portable source-change policy, evaluated identically by the SDK and controller.
+ * Globs match whole root-relative paths: *, ?, [], [!], ** and backslash escapes.
+ * Braces/extglobs have no special meaning. Directory rules explicitly use /**. */
+export type ChangeAction = "coverage" | "full" | "ignore";
+export interface ChangeRule {
+    root?: string;
+    pattern: string;
+    action: ChangeAction;
+}
+export interface ResolvedChangeRule extends ChangeRule {
+    root: string;
+}
+export interface ChangePolicy {
+    defaults: readonly (readonly ResolvedChangeRule[])[];
+    overrides: readonly ResolvedChangeRule[];
+}
+export interface ChangeRuleAdapter {
+    changeRules?: readonly ChangeRule[];
+    /** Wrappers preserve independent nested adapter policies, including roots. */
+    changeRuleGroups?: readonly (readonly ChangeRule[])[];
+    sourceOptions?: {
+        sourceRoot?: string;
+    } | ((...args: any[]) => unknown);
+}
+export interface ChangeRuleService {
+    /** Explicit rules override all defaults. false disables defaults. */
+    changeRules?: readonly ChangeRule[] | false;
+    coverage?: boolean | {
+        sourceRoot?: string;
+    };
+}
+export declare function compileChangeGlob(pattern: string): RegExp;
+export declare function matchesChangeGlob(pattern: string, path: string): boolean;
+export declare function validateChangeRules(value: unknown): asserts value is readonly ChangeRule[];
+export declare const COMMON_CHANGE_RULES: readonly ChangeRule[];
+export declare const JAVASCRIPT_CHANGE_RULES: readonly ChangeRule[];
+export declare const NODE_CHANGE_RULES: readonly ChangeRule[];
+export declare const BROWSER_CHANGE_RULES: readonly ChangeRule[];
+export declare const BUN_CHANGE_RULES: readonly ChangeRule[];
+export declare const NEXT_CHANGE_RULES: readonly ChangeRule[];
+export declare const RUST_CHANGE_RULES: readonly ChangeRule[];
+export declare function resolveChangePolicy(service: ChangeRuleService, adapters?: readonly ChangeRuleAdapter[]): ChangePolicy;
+/** Compile once for scans over a source tree; regexes carry no mutable flags. */
+export declare function compileChangePolicy(policy: ChangePolicy): (path: string) => ChangeAction | undefined;
+export declare function evaluateChangePolicy(policy: ChangePolicy, path: string): ChangeAction | undefined;

package/dist/change-rules.js

@@ -0,0 +1,179 @@
+const literal = (c) => /[\\^$.*+?()[\]{}|/]/u.test(c) ? `\\${c}` : c;
+const classLiteral = (c) => ["\\", "[", "]", "^", "-"].includes(c) ? `\\${c}` : c;
+export function compileChangeGlob(pattern) {
+    if (!pattern || pattern.includes("\0") || pattern.startsWith("/") || pattern.split("/").some(p => p === "" || p === "." || p === ".."))
+        throw new Error("change-rule pattern must be a nonempty relative glob without traversal");
+    const chars = [...pattern];
+    let out = "";
+    for (let i = 0; i < chars.length; i++) {
+        const c = chars[i];
+        if (c === "\\") {
+            const next = chars[++i];
+            if (next === undefined || next === "/")
+                throw new Error("invalid glob escape");
+            out += literal(next);
+        }
+        else if (c === "*") {
+            if (chars[i + 1] === "*") {
+                i++;
+                if ((i > 1 && chars[i - 2] !== "/") || (i + 1 < chars.length && chars[i + 1] !== "/"))
+                    throw new Error("** must occupy a whole path segment");
+                if (chars[i + 1] === "/") {
+                    i++;
+                    out += "(?:[\\s\\S]*/)?";
+                }
+                else
+                    out += "[\\s\\S]*";
+            }
+            else
+                out += "[^/]*";
+        }
+        else if (c === "?")
+            out += "[^/]";
+        else if (c === "[") {
+            let negate = false;
+            if (chars[i + 1] === "!") {
+                negate = true;
+                i++;
+            }
+            const members = [];
+            let closed = false;
+            while (++i < chars.length) {
+                let ch = chars[i];
+                if (ch === "]") {
+                    closed = true;
+                    break;
+                }
+                let escaped = false;
+                if (ch === "\\") {
+                    ch = chars[++i];
+                    escaped = true;
+                    if (ch === undefined)
+                        throw new Error("invalid class escape");
+                }
+                if (ch === "/")
+                    throw new Error("glob classes cannot match separators");
+                members.push({ c: ch, escaped });
+            }
+            if (!closed || !members.length)
+                throw new Error("unterminated or empty glob class");
+            let body = "";
+            for (let j = 0; j < members.length; j++) {
+                const m = members[j];
+                if (members[j + 1]?.c === "-" && !members[j + 1].escaped && members[j + 2]) {
+                    const end = members[j + 2];
+                    if (m.c.codePointAt(0) > end.c.codePointAt(0) || (m.c.codePointAt(0) <= 47 && end.c.codePointAt(0) >= 47))
+                        throw new Error("invalid glob range");
+                    body += `${classLiteral(m.c)}-${classLiteral(end.c)}`;
+                    j += 2;
+                }
+                else
+                    body += classLiteral(m.c);
+            }
+            // Prefix slash in a negated class so it remains segment-scoped.
+            out += `[${negate ? "^/" : ""}${body}]`;
+        }
+        else
+            out += literal(c);
+    }
+    return new RegExp(`^(?:${out})$(?![\\s\\S])`, "u");
+}
+export function matchesChangeGlob(pattern, path) { return compileChangeGlob(pattern).test(path); }
+export function validateChangeRules(value) {
+    if (!Array.isArray(value))
+        throw new Error("changeRules must be an array or false");
+    for (const rule of value) {
+        if (!rule || typeof rule !== "object" || Array.isArray(rule) || !Object.keys(rule).every(k => ["root", "pattern", "action"].includes(k)) || typeof rule.pattern !== "string" || !["coverage", "full", "ignore"].includes(rule.action))
+            throw new Error("invalid change rule");
+        if (rule.root !== undefined && (typeof rule.root !== "string" || (rule.root !== "." && (!rule.root || rule.root.includes("\\") || rule.root.includes("\0") || rule.root.split("/").some((p) => !p || p === "." || p === "..")))))
+            throw new Error("change-rule root must be repository-relative");
+        compileChangeGlob(rule.pattern);
+    }
+}
+const freeze = (rules) => Object.freeze(rules.map(r => Object.freeze(r)));
+export const COMMON_CHANGE_RULES = freeze(["**/*.md", "**/*.markdown", "**/*.MD", "**/*.MARKDOWN"].map(pattern => ({ pattern, action: "ignore" })));
+const extensions = ["js", "jsx", "mjs", "cjs", "ts", "tsx", "mts", "cts"];
+const full = (pattern) => ({ pattern, action: "full" });
+const ignore = (pattern) => ({ pattern, action: "ignore" });
+const coverage = (pattern) => ({ pattern, action: "coverage" });
+export const JAVASCRIPT_CHANGE_RULES = freeze([
+    ...extensions.map(ext => coverage(`**/*.${ext}`)),
+    full("**/migrations/**"),
+    ...extensions.flatMap(ext => [full(`**/*.config.${ext}`), full(`**/.babelrc.${ext}`), full(`**/.pnp.${ext}`), full(`**/.pnp.loader.${ext}`)]),
+    ...["**/tsconfig*.json", "**/jsconfig*.json", "**/.babelrc", "**/.babelrc.json", "**/.swcrc", "**/.env", "**/.env.*"].map(full),
+    ...extensions.flatMap(ext => [ignore(`**/test.${ext}`), ignore(`**/spec.${ext}`)]),
+    ...extensions.flatMap(ext => [".test", ".spec", "_test", "_spec", ".test-d", ".spec-d", ".cy"].map(suffix => ignore(`**/*${suffix}.${ext}`))),
+    ...["**/__tests__/**", "**/__mocks__/**", "**/__snapshots__/**", "test/**", "tests/**", "e2e/**", "cypress/**", "playwright/**"].map(ignore),
+    ...[...extensions, "json"].flatMap(ext => ["jest", "vitest", "playwright", "cypress"].map(tool => ignore(`**/${tool}.config.${ext}`))),
+    ...COMMON_CHANGE_RULES,
+]);
+export const NODE_CHANGE_RULES = JAVASCRIPT_CHANGE_RULES;
+export const BROWSER_CHANGE_RULES = JAVASCRIPT_CHANGE_RULES;
+export const BUN_CHANGE_RULES = freeze([...NODE_CHANGE_RULES, full("**/bunfig.toml")]);
+const sharedNext = ["layout", "template", "error", "global-error", "loading", "not-found", "default", "forbidden", "unauthorized", "middleware", "proxy", "instrumentation", "instrumentation-client", "mdx-components", "_app", "_document", "_error"];
+export const NEXT_CHANGE_RULES = freeze([
+    ...JAVASCRIPT_CHANGE_RULES,
+    // Pages-router files are routes even if their names resemble unit tests.
+    ...["pages", "src/pages"].flatMap(root => extensions.map(ext => coverage(`${root}/**/*.${ext}`))),
+    ...["app", "src/app"].flatMap(root => extensions.flatMap(ext => [coverage(`${root}/**/page.${ext}`), coverage(`${root}/**/route.${ext}`)])),
+    full("**/*.mdx"), full("**/*.MDX"),
+    ...extensions.flatMap(ext => sharedNext.map(name => full(`**/${name}.${ext}`))),
+]);
+export const RUST_CHANGE_RULES = freeze([
+    coverage("**/*.rs"), ignore("tests/**"), ignore("benches/**"),
+    ...["**/Cargo.toml", "**/Cargo.lock", "**/.cargo/config", "**/.cargo/config.toml", "**/rust-toolchain", "**/rust-toolchain.toml", "**/build.rs", "src/bin/**"].map(full),
+    ...COMMON_CHANGE_RULES,
+]);
+export function resolveChangePolicy(service, adapters = []) {
+    if (service.changeRules !== undefined && service.changeRules !== false)
+        validateChangeRules(service.changeRules);
+    const serviceRoot = typeof service.coverage === "object" ? service.coverage.sourceRoot ?? "." : ".";
+    const resolve = (rules, root) => {
+        validateChangeRules(rules);
+        const out = rules.map(r => ({ ...r, root: r.root ?? root }));
+        validateChangeRules(out);
+        return out;
+    };
+    const defaults = service.changeRules === false ? [] : [resolve([{ pattern: "spectest/**", action: "full" }, { pattern: "spectest/tests/**", action: "coverage" }, ...COMMON_CHANGE_RULES], ".")];
+    if (service.changeRules !== false)
+        for (const adapter of adapters) {
+            const groups = [...(adapter.changeRules ? [adapter.changeRules] : []), ...(adapter.changeRuleGroups ?? [])];
+            const root = typeof adapter.sourceOptions === "object" ? adapter.sourceOptions.sourceRoot ?? serviceRoot : serviceRoot;
+            for (const group of groups) {
+                if (typeof adapter.sourceOptions === "function" && group.some(r => r.root === undefined))
+                    throw new Error("dynamic sourceOptions requires explicit change-rule roots");
+                defaults.push(resolve(group, root));
+            }
+        }
+    return { defaults, overrides: resolve(service.changeRules || [], serviceRoot) };
+}
+/** Compile once for scans over a source tree; regexes carry no mutable flags. */
+export function compileChangePolicy(policy) {
+    const compile = (rules) => rules.map(r => ({ ...r, regex: compileChangeGlob(r.pattern) }));
+    const defaults = policy.defaults.map(compile), overrides = compile(policy.overrides);
+    const groupAction = (rules, path) => {
+        let result;
+        for (const r of rules) {
+            const rel = r.root === "." ? path : path === r.root ? "" : path.startsWith(r.root + "/") ? path.slice(r.root.length + 1) : undefined;
+            if (rel !== undefined && r.regex.test(rel))
+                result = r.action;
+        }
+        return result;
+    };
+    const rank = { ignore: 1, coverage: 2, full: 3 };
+    return path => {
+        const override = groupAction(overrides, path);
+        if (override)
+            return override;
+        let result;
+        for (const rules of defaults) {
+            const action = groupAction(rules, path);
+            if (action && (!result || rank[action] > rank[result]))
+                result = action;
+        }
+        return result;
+    };
+}
+export function evaluateChangePolicy(policy, path) {
+    return compileChangePolicy(policy)(path);
+}

package/dist/components/k3s-coverage.js

@@ -13,13 +13,13 @@ const quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'";
 /** One component-owned bridge; runtime adapters remain unaware of Kubernetes. */
 export function k3sCoverage(images) {
     const declarations = images.flatMap(image => typeof image === "string" || image.coverage === undefined ? [] : [{
-            reference: canonicalImageReference(image.reference), coverage: image.coverage,
+            reference: canonicalImageReference(image.reference), coverage: image.coverage, changeRules: image.changeRules,
         }]);
     for (const image of declarations) {
         const adapters = coverageAdapters(image.coverage);
         if (adapters.some(adapter => adapter.load || adapter.collect))
             throw new Error("k3s image coverage accepts container adapters; put browser coverage on the cluster service");
-        applyCoverageAdapters(image.reference, { image: { type: "registry", reference: image.reference }, coverage: image.coverage });
+        applyCoverageAdapters(image.reference, { image: { type: "registry", reference: image.reference }, coverage: image.coverage, changeRules: image.changeRules });
     }
     const metadata = new Map();
     const service = (cluster, reference) => `${cluster}/image-${hash(reference)}`;
@@ -136,7 +136,7 @@ export function k3sCoverage(images) {
                 toJSON() {
                     return { adapter: "k3s-containers", images: declarations.map(image => ({
                             reference: image.reference,
-                            config: applyCoverageAdapters(image.reference, { image: { type: "registry", reference: image.reference }, coverage: image.coverage }),
+                            config: applyCoverageAdapters(image.reference, { image: { type: "registry", reference: image.reference }, coverage: image.coverage, changeRules: image.changeRules }),
                         })) };
                 },
                 async collect(ctx, baseline) {
@@ -191,7 +191,7 @@ export function k3sCoverage(images) {
                             }
                         }
                         const captured = await captureCoverageTarget({
-                            coverage: declaration.coverage, root: instance.root, baseline,
+                            coverage: declaration.coverage, changeRules: declaration.changeRules ?? ctx.changeRules, root: instance.root, baseline,
                             inventoryAvailable: baseline && adapters.some(a => a.inventory) ? !!await livePod() : false,
                             counterKey: `${service(ctx.service, instance.image)}/${id}`,
                             context: { ...ctx, service: service(ctx.service, instance.image), reportDir: dir,

package/dist/components/supabase-coverage.js

@@ -1,6 +1,7 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
+import { COMMON_CHANGE_RULES, NODE_CHANGE_RULES } from "../change-rules.js";
 import { rawFetch } from "../harness/raw-fetch.js";
 // Drain all work even on failure: no writes may outlive the capture boundary.
 async function finishAll(pending) {
@@ -19,6 +20,17 @@ export function supabaseFunctionsCoverage(functionRoot) {
         name: "supabase-functions",
         reports: "delta",
         sourceOptions: { sourceRoot: "." },
+        // Ordinary modules follow callers, including shared modules outside the
+        // functions directory. Concrete reach still limits which paths this
+        // service owns. Directory-discovered entrypoints remain in the inventory.
+        changeRules: [
+            ...["**/deno.json", "**/deno.jsonc", "**/deno.lock", "**/import_map.json"].map(pattern => ({ pattern, action: "full" })),
+            ...NODE_CHANGE_RULES,
+            ...["config.toml", "config.json"].map(pattern => ({ root: path.posix.dirname(functionRoot), pattern, action: "full" })),
+            // Migration directory conventions in the JS preset must not make
+            // incidental Markdown defeat the shared documentation default.
+            ...COMMON_CHANGE_RULES,
+        ],
         ownsReport: name => name.startsWith("edge-") || name.startsWith("edge-scripts/"),
         async inventory(ctx) {
             // Functions are discovered by directory, not by an import in user code.

package/dist/components/supabase.js

@@ -67,6 +67,7 @@ import { SUPABASE_WEBHOOKS_SQL } from "./supabase-webhooks.js";
 import { postgresTls } from "./postgres-tls.js";
 import { supabasePoolerService } from "./supabase-pooler.js";
 import { SUPABASE_COVERAGE_COLLECTOR, supabaseFunctionsCoverage } from "./supabase-coverage.js";
+import { COMMON_CHANGE_RULES } from "../change-rules.js";
 import { mapSupabaseConfig, parseSupabaseConfigFile, } from "./supabase-config.js";
 // ──────────────────────────────────────────────────────────────────────────
 // Digest-pinned upstream images. Update BUILTIN_IMAGES together for compatible
@@ -1449,20 +1450,32 @@ export function supabase(opts = {}) {
             const realtimeHost = `realtime-dev.${g.key("realtime")}`;
             const parts = {};
             // ── db ──────────────────────────────────────────────────────────
-            // What the stack reads from the project: the Supabase folder
-            // (config.toml, migrations, seed, functions) and the mail templates,
-            // which may sit anywhere in the repo. Declared as inputs so a change
-            // to any of them is never taken as one that can affect no test; the
-            // migrations volume carries the folder too, but only when there is
-            // a migrations directory, and a config-only project must count as
-            // well.
-            const inputs = [
-                ...(opts.dir !== undefined && !opts.dir.startsWith("/") ? [opts.dir] : []),
-                ...templateBodies.map(([, spec]) => spec.path).filter((t) => !t.startsWith("/")),
-            ];
+            // Track actual setup inputs, including currently absent conventional
+            // paths so newly added config/migrations still select the full suite.
+            // Functions own their module graph separately; giving the database the
+            // entire folder would veto every function's source-selection policy.
+            const projectRelative = (absolute) => absolute === root ? "." : absolute.startsWith(root + "/") ? absolute.slice(root.length + 1) : undefined;
+            const inputs = [...new Set([
+                    ...(dirPath === null ? [] : ["config.toml", "config.json", "migrations", "seed.sql"].map(p => projectRelative(join(dirPath, p)))),
+                    ...templateBodies.map(([, spec]) => projectRelative(absProjectPath(spec.path))),
+                ].filter((p) => p !== undefined))];
+            const literalGlob = (p) => p.replace(/[\\*?\[\]]/g, "\\$&");
             const dbDef = {
                 image: { type: "registry", reference: opts.db?.image ?? IMAGES.db },
                 ...(inputs.length > 0 ? { inputs } : {}),
+                changeRules: [
+                    ...inputs.flatMap(p => [
+                        { pattern: literalGlob(p), action: "full" },
+                        { pattern: `${literalGlob(p)}/**`, action: "full" },
+                    ]),
+                    ...COMMON_CHANGE_RULES,
+                    // A configured template is runtime content even if its extension
+                    // is Markdown. Its exact declaration overrides the common ignore.
+                    ...templateBodies.flatMap(([, spec]) => {
+                        const p = projectRelative(absProjectPath(spec.path));
+                        return p === undefined ? [] : [{ pattern: literalGlob(p), action: "full" }];
+                    }),
+                ],
                 // `args` (not `command`): keep the image's docker-entrypoint.sh so it
                 // runs initdb + its baked init-scripts before starting.
                 args: [
@@ -1488,7 +1501,7 @@ export function supabase(opts = {}) {
                 // Read SQL directly, including large seeds, without copying it through
                 // the harness and docker exec stdin. Keep this out of PGDATA.
                 ...(migrationsPath === null ? {} : {
-                    volumes: [{ source: dirname(migrationsPath), target: SQL_MOUNT, readOnly: true }],
+                    volumes: [{ source: dirname(migrationsPath), target: SQL_MOUNT, readOnly: true, reachExempt: true }],
                 }),
                 ports: [5432],
                 // `pg_isready` succeeds only once the image finishes initdb + its

package/dist/coverage-bun.js

@@ -1,8 +1,9 @@
+import { BUN_CHANGE_RULES } from "./change-rules.js";
 import { appendEnvFlag, node, NODE_COVERAGE_HOOK, NODE_COVERAGE_HOOK_PATH } from "./coverage.js";
 import { access } from "node:fs/promises";
 import path from "node:path";
 export function bun(options = {}) {
-    const adapter = node(options);
+    const adapter = node({ ...options, changeRules: options.changeRules === undefined ? BUN_CHANGE_RULES : options.changeRules });
     return {
         ...adapter,
         name: "bun",

package/dist/coverage-next.d.ts

@@ -1,5 +1,8 @@
+import { type ChangeRule } from "./change-rules.js";
 import { type CoverageAdapter, type CoverageSourceOptions } from "./coverage.js";
 export interface NextCoverageOptions extends CoverageSourceOptions {
+    /** Replace this adapter's defaults, or false to disable them. */
+    changeRules?: readonly ChangeRule[] | false;
     /** Repository-relative directory represented by the build's source-map root.
      * Defaults to "." (repository root). Set explicitly for a nested build root. */
     sourceRoot?: string;
@@ -14,6 +17,8 @@ export interface NextBuildMetadata {
     generated: string | null;
     serverMaps: number;
     browserMaps: number;
+    pageExtensions?: string[];
+    appRoot?: string;
 }
 /** Server + browser coverage for a built Next app. Build-time maps are required;
  * enable native Next source maps and retain them in the runtime image.

package/dist/coverage-next.js

@@ -1,6 +1,7 @@
 // Next policy lives in the SDK. The collector/indexer only see ordinary
 // Node/browser reports and generic, report-scoped source metadata.
 import path from "node:path";
+import { NEXT_CHANGE_RULES } from "./change-rules.js";
 import { JAVASCRIPT_GENERATED_SOURCES } from "./coverage-javascript.js";
 import { node, browser } from "./coverage.js";
 export const NEXT_COVERAGE_HELPER_PATH = "/spectest/next-coverage.cjs";
@@ -96,7 +97,10 @@ if (require.main === module) {
     walk(path.join(dist, "server"), true);
     walk(path.join(dist, "static"), false);
     if (!serverMaps || !browserMaps) throw new Error("Next coverage needs server and browser .js.map files in the runtime image. Enable productionBrowserSourceMaps and experimental.serverSourceMaps in Next config, and copy .next/server and .next/static maps into the runtime image, including Edge maps.");
-    process.stdout.write(JSON.stringify({generated:launcher(m), serverMaps, browserMaps}));
+    const appRoot = typeof m.relativeAppDir === "string" ? m.relativeAppDir :
+      (typeof m.appDir === "string" && typeof m.config.turbopack?.root === "string" ? path.relative(m.config.turbopack.root, m.appDir) : "");
+    process.stdout.write(JSON.stringify({generated:launcher(m), serverMaps, browserMaps,
+      pageExtensions:m.config.pageExtensions || ["tsx","ts","jsx","js"], appRoot}));
   } catch (e) { console.error("Next coverage: " + e.message); process.exitCode = 1; }
 }
 `;
@@ -120,7 +124,7 @@ export function next(options = {}) {
         if (value !== undefined && (!value || path.posix.isAbsolute(value) || value.split("/").some(p => p === "..") || /[\\\0\r\n]/.test(value)))
             throw new Error(`coverage.next ${key} must be a relative runtime directory`);
     }
-    const server = node(), client = browser();
+    const server = node({ sourceRoot, changeRules: options.changeRules === undefined ? NEXT_CHANGE_RULES : options.changeRules }), client = browser();
     const cache = new Map();
     const metadata = (ctx) => {
         let value = cache.get(ctx.service);
@@ -133,7 +137,27 @@ export function next(options = {}) {
     };
     return {
         defaultExcludeSources: JAVASCRIPT_GENERATED_SOURCES,
-        name: "next", reports: "delta", explains: server.explains,
+        name: "next", reports: "delta", explains: server.explains, changeRules: server.changeRules?.map(rule => ({ ...rule, root: rule.root ?? sourceRoot })),
+        ...(options.changeRules === undefined ? { async resolveChangeRules(ctx) {
+                const m = await metadata(ctx);
+                const extensions = m.pageExtensions ?? ["tsx", "ts", "jsx", "js"];
+                if (!Array.isArray(extensions) || extensions.some(ext => typeof ext !== "string" || !ext || /[^a-zA-Z0-9._-]/.test(ext)))
+                    throw new Error("invalid Next pageExtensions metadata");
+                const appRoot = m.appRoot || ".";
+                if (appRoot !== "." && (appRoot.includes("\\") || appRoot.split("/").some(part => !part || part === "." || part === "..")))
+                    throw new Error("invalid Next app root metadata");
+                const root = path.posix.join(sourceRoot, appRoot);
+                // Remove the static conventional route allowance; the build's extensions
+                // determine which files are actually routes (including custom test-like names).
+                const rules = NEXT_CHANGE_RULES.filter(rule => !/^(pages|src\/pages|app|src\/app)\//.test(rule.pattern));
+                const routes = extensions.flatMap(ext => [
+                    ...["pages", "src/pages"].map(dir => ({ root, pattern: `${dir}/**/*.${ext}`, action: "coverage" })),
+                    ...["app", "src/app"].flatMap(dir => ["page", "route"].map(name => ({ root, pattern: `${dir}/**/${name}.${ext}`, action: "coverage" }))),
+                ]);
+                // Shared entries still require full runs, even when they are also routes.
+                const full = rules.filter(rule => rule.action === "full" && rule.pattern !== "**/migrations/**");
+                return [...rules.map(rule => ({ ...rule, root: rule.root ?? sourceRoot })), ...routes, ...full.map(rule => ({ ...rule, root: rule.root ?? sourceRoot }))];
+            } } : {}),
         ownsReport: name => server.ownsReport(name) || client.ownsReport(name),
         configure(svc, info) {
             const configured = server.configure(svc, info);

package/dist/coverage-rust.d.ts

@@ -1,5 +1,7 @@
+import { type ChangeRule } from "./change-rules.js";
 import type { CoverageAdapter, CoverageSourceOptions } from "./coverage.js";
 export interface RustCoverageOptions extends CoverageSourceOptions {
+    changeRules?: readonly ChangeRule[] | false;
     /** Only for idle command containers where no Rust process has run yet. */
     allowEmpty?: boolean;
     /** Compiler workspace directory, when different from the runtime workdir.

package/dist/coverage-rust.js

@@ -1,3 +1,4 @@
+import { RUST_CHANGE_RULES, COMMON_CHANGE_RULES, validateChangeRules } from "./change-rules.js";
 import { promises as fs, readFileSync } from "node:fs";
 import path from "node:path";
 import { connect } from "node:net";
@@ -36,6 +37,9 @@ export async function flushCoverageSockets(dir, prefix, signal) {
  * The helper exports cumulative per-process LCOV before exit and on request;
  * no compiler tools or binaries need to be copied out of terminated pods. */
 export function rust(options = {}) {
+    const rules = options.changeRules === undefined ? RUST_CHANGE_RULES : options.changeRules;
+    if (rules !== false)
+        validateChangeRules(rules);
     const { sourceRoot, excludeSources, llvmCov, llvmProfdata, ignoreFilenameRegex, buildRoot } = options;
     if (buildRoot !== undefined && (!buildRoot.startsWith("/") || buildRoot === "/" || /[\0\r\n]/.test(buildRoot) || buildRoot.split("/").includes("..")))
         throw new Error("Rust buildRoot must be an absolute compiler workspace directory");
@@ -45,6 +49,22 @@ export function rust(options = {}) {
     }
     return {
         name: "rust", reports: "cumulative",
+        changeRules: rules === false ? [] : rules.map(rule => ({ ...rule })),
+        ...(options.changeRules === undefined ? { async resolveChangeRules(ctx) {
+                const root = sourceRoot ?? ctx.sourceRoot ?? ".";
+                const prefix = root === "." ? "" : root + "/";
+                const files = await ctx.projectFiles();
+                const crates = [...new Set(files.filter(file => file.startsWith(prefix) && (file === "Cargo.toml" || file.endsWith("/Cargo.toml"))).map(file => path.posix.dirname(file)))].sort();
+                // A workspace can contain many packages; their canonical test directories
+                // are relative to each Cargo.toml, not just the adapter's source root.
+                // Test fixture packages stay ignored even when they contain binary targets.
+                return [
+                    ...RUST_CHANGE_RULES.map(rule => ({ ...rule, root: rule.root ?? root })),
+                    ...crates.map(root => ({ root, pattern: "src/bin/**", action: "full" })),
+                    ...crates.flatMap(root => ["tests/**", "benches/**"].map(pattern => ({ root, pattern, action: "ignore" }))),
+                    ...COMMON_CHANGE_RULES.map(rule => ({ ...rule, root })),
+                ];
+            } } : {}),
         sourceOptions: { ...(sourceRoot !== undefined ? { sourceRoot } : {}), ...(excludeSources ? { excludeSources } : {}) },
         ownsReport: name => /^rust-.*\.lcov$/.test(name),
         configure: service => ({ ...service, env: { ...service.env,

package/dist/coverage.d.ts

@@ -1,3 +1,5 @@
+import { type ChangeRule, type ChangePolicy } from "./change-rules.js";
+export * from "./change-rules.js";
 import type { ServiceConfig } from "./index.js";
 import { COVERAGE_CONTAINER_DIR, type CoverageReportsMode } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR, type CoverageReportsMode };
@@ -39,6 +41,10 @@ export interface CoverageLoadContext {
  * of the manifests that declare them (see {@link CoverageAdapter.inventory}).
  */
 export interface CoverageInventoryContext {
+    /** Effective repository-relative source root for build-specific policy resolution. */
+    sourceRoot?: string;
+    /** Selection overrides of the owning service, forwarded by container wrappers. */
+    changeRules?: readonly ChangeRule[] | false;
     /** The services-map key. */
     service: string;
     /** Run a shell command (`sh -c`) inside the container. Rejects on a
@@ -47,8 +53,8 @@ export interface CoverageInventoryContext {
         stdout: string;
         stderr: string;
     }>;
-    /** Every file of the uploaded project, project-relative, `/`-separated,
-     *  `node_modules`, `.git` and the like skipped. */
+    /** Project-relative files; inventory calls omit paths ignored by effective
+     * change policy, as well as node_modules, .git and other upload exclusions. */
     projectFiles(): Promise<string[]>;
     /** One project file's text (project-relative path); `null` when absent. */
     readProjectFile(path: string): Promise<string | null>;
@@ -88,6 +94,12 @@ export type CoverageSourceContext = CoverageInventoryContext;
 export interface CoverageAdapter {
     /** Names the adapter in errors (`coverage adapter "node" on service …`). */
     name: string;
+    /** Ordered default rules; service rules are explicit overrides. */
+    changeRules?: readonly ChangeRule[];
+    /** Resolve build-specific rules once evidence is available; replaces static defaults. */
+    resolveChangeRules?(ctx: CoverageSourceContext): Promise<readonly ChangeRule[]>;
+    /** Wrappers retain separate policy groups for each nested adapter. */
+    changeRuleGroups?: readonly (readonly ChangeRule[])[];
     /** Archived on this adapter's reports; other adapters retain their own policy. */
     sourceOptions?: CoverageSourceOptions | ((ctx: CoverageSourceContext) => Promise<CoverageSourceOptions>);
     /** Generated scaffolding excluded in addition to explicit or legacy source policy. */
@@ -178,6 +190,13 @@ export declare function coverageAdapters(cov: ServiceCoverage | undefined): read
  * adapter names (`toJSON`), never as functions.
  */
 export declare function applyCoverageAdapters<S extends ServiceConfig>(key: string, svc: S): S;
+export declare function resolveAdapterChangeRules(adapter: CoverageAdapter, ctx: CoverageSourceContext): Promise<void>;
+export declare function serviceChangePolicy(svc: Pick<ServiceConfig, "coverage" | "changeRules">, options?: {
+    requireResolved?: boolean;
+}): ChangePolicy;
+/** Inventory fingerprints must not turn ignored fixture manifests into changes.
+ * Installed runtime dependency inventories remain independent of project files. */
+export declare function inventoryProjectFiles(svc: Pick<ServiceConfig, "coverage" | "changeRules">, files: readonly string[]): string[];
 /** Resolve adapter policies once per capture. Invalid/overlapping ownership is
  * an error, so one adapter cannot silently reinterpret another's reports. */
 export declare function resolveCoverageSourceOptions(adapters: readonly CoverageAdapter[], ctx: CoverageSourceContext, fallback?: CoverageSourceOptions): Promise<{
@@ -305,6 +324,8 @@ export declare function npmManifestUnit(projectPath: string, text: string): stri
  */
 export declare const NODE_INVENTORY_SCRIPT = "\"use strict\";\nconst fs = require(\"node:fs\"), path = require(\"node:path\");\nconst out = new Set();\nfunction isRealDir(p) { try { return fs.lstatSync(p).isDirectory(); } catch (e) { return false; } }\nfunction readPkg(d) {\n  try {\n    const j = JSON.parse(fs.readFileSync(path.join(d, \"package.json\"), \"utf8\"));\n    if (j && typeof j.name === \"string\" && j.name) out.add(\"npm:\" + j.name + (typeof j.version === \"string\" && j.version ? \"@\" + j.version : \"\"));\n  } catch (e) {}\n}\nfunction visit(d, depth) {\n  readPkg(d);\n  if (depth < 3) { const nested = path.join(d, \"node_modules\"); if (isRealDir(nested)) walkNm(nested, depth + 1); }\n}\nfunction walkNm(nm, depth) {\n  let names; try { names = fs.readdirSync(nm); } catch (e) { return; }\n  for (const n of names) {\n    if (n === \".bin\" || n === \".cache\" || n === \".modules.yaml\") continue;\n    if (n === \".pnpm\") {\n      let ps; try { ps = fs.readdirSync(path.join(nm, \".pnpm\")); } catch (e) { continue; }\n      for (const p of ps) { const inner = path.join(nm, \".pnpm\", p, \"node_modules\"); if (isRealDir(inner)) walkNm(inner, depth + 1); }\n      continue;\n    }\n    if (n.startsWith(\"@\")) {\n      let ss; try { ss = fs.readdirSync(path.join(nm, n)); } catch (e) { continue; }\n      for (const s of ss) { const d = path.join(nm, n, s); if (isRealDir(d)) visit(d, depth); }\n    } else { const d = path.join(nm, n); if (isRealDir(d)) visit(d, depth); }\n  }\n}\nlet d = process.cwd();\nfor (;;) {\n  const nm = path.join(d, \"node_modules\");\n  if (isRealDir(nm)) walkNm(nm, 0);\n  const up = path.dirname(d);\n  if (up === d) break;\n  d = up;\n}\nprocess.stdout.write(Array.from(out).sort().join(\"\\n\") + (out.size ? \"\\n\" : \"\"));\n";
 export interface NodeCoverageOptions extends CoverageSourceOptions {
+    /** Replace this adapter's defaults, or false to disable them. */
+    changeRules?: readonly ChangeRule[] | false;
     /** Generated runtime entrypoints, relative to the service working directory.
      * Track their exact contents as units rather than inventing repository lines.
      * A content change changes the inventory and invalidates dependent tests. */
@@ -348,7 +369,10 @@ export declare function collectNodeReports(dir: string): Promise<NodeReportStats
  * harvested first, and only this service's totals are taken and cleared. Nothing ran ⇒
  * an lcov with no records, which is a report saying so.
  */
-export declare function browser(options?: CoverageSourceOptions): CoverageAdapter;
+export interface BrowserCoverageOptions extends CoverageSourceOptions {
+    changeRules?: readonly ChangeRule[] | false;
+}
+export declare function browser(options?: BrowserCoverageOptions): CoverageAdapter;
 /**
  * Run `command` (via `sh -c`) in the container at every capture, so the
  * service writes a fresh report into `/spectest/coverage/`. The escape