@specific.dev/spectest 0.131.20 → 0.132.0

package/dist/coverage.js

@@ -28,6 +28,8 @@
 //   coverage: { adapters: [coverage.node(), coverage.browser()] }
 import { createHash } from "node:crypto";
 import { JAVASCRIPT_GENERATED_SOURCES } from "./coverage-javascript.js";
+import { NODE_CHANGE_RULES, BROWSER_CHANGE_RULES, resolveChangePolicy, validateChangeRules, compileChangePolicy } from "./change-rules.js";
+export * from "./change-rules.js";
 import { harvestAllBrowserCoverage, takeBrowserCoverageReport } from "./browser-coverage.js";
 import { COVERAGE_CONTAINER_DIR } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR };
@@ -89,15 +91,25 @@ export function validateCoverage(service, cov) {
                 (a.explains === undefined ||
                     (Array.isArray(a.explains) &&
                         a.explains.every((e) => typeof e === "string"))) &&
-                ["configure", "load", "capture", "collect", "inventory", "ownsReport"].every((k) => a[k] === undefined ||
+                ["configure", "load", "capture", "collect", "inventory", "ownsReport", "resolveChangeRules"].every((k) => a[k] === undefined ||
                     typeof a[k] === "function");
             const sourceOptions = a?.sourceOptions;
+            const changeRules = a?.changeRules;
+            const groups = a?.changeRuleGroups;
+            if (changeRules !== undefined)
+                validateChangeRules(changeRules);
+            if (groups !== undefined) {
+                if (!Array.isArray(groups))
+                    throw new Error("invalid changeRuleGroups");
+                for (const group of groups)
+                    validateChangeRules(group);
+            }
             const defaults = a?.defaultExcludeSources;
             const defaultShape = defaults === undefined || typeof a.ownsReport === "function";
             const sourceShape = sourceOptions === undefined || (typeof a.ownsReport === "function" &&
                 (typeof sourceOptions === "function" || (typeof sourceOptions === "object" && sourceOptions !== null && !Array.isArray(sourceOptions))));
             if (!ok || !sourceShape || !defaultShape) {
-                throw new Error(`service "${service}" has an invalid coverage adapter — an adapter is \`{ name, reports?, explains?, configure?, load?, capture?, inventory? }\` (see \`defineAdapter\` in @specific.dev/spectest/coverage)`);
+                throw new Error(`service "${service}" has an invalid coverage adapter — an adapter is \`{ name, reports?, explains?, changeRules?, configure?, load?, capture?, inventory? }\` (see \`defineAdapter\` in @specific.dev/spectest/coverage)`);
             }
             if (sourceOptions !== undefined && typeof sourceOptions !== "function")
                 validateCoverageSourceOptions(service, sourceOptions);
@@ -122,6 +134,7 @@ export function coverageAdapters(cov) {
 export function applyCoverageAdapters(key, svc) {
     validateCoverage(key, svc.coverage);
     const adapters = coverageAdapters(svc.coverage);
+    serviceChangePolicy(svc); // Validate even uncovered services; never enables collection.
     if (adapters.length === 0)
         return svc;
     let out = svc;
@@ -144,6 +157,43 @@ export function applyCoverageAdapters(key, svc) {
     };
     return { ...out, coverage: wire };
 }
+/** Resolve service policy without requiring coverage to be enabled. */
+const RESOLVED_CHANGE_RULES = new Map();
+export async function resolveAdapterChangeRules(adapter, ctx) {
+    if (!adapter.resolveChangeRules)
+        return;
+    const rules = await adapter.resolveChangeRules(ctx);
+    validateChangeRules(rules);
+    const before = RESOLVED_CHANGE_RULES.get(adapter.resolveChangeRules);
+    if (before && JSON.stringify(before) !== JSON.stringify(rules))
+        throw new Error(`adapter ${adapter.name} resolved inconsistent change rules across runtimes`);
+    RESOLVED_CHANGE_RULES.set(adapter.resolveChangeRules, rules.map(rule => ({ ...rule })));
+}
+export function serviceChangePolicy(svc, options = {}) {
+    const adapters = coverageAdapters(svc.coverage).map(adapter => {
+        if (!adapter.resolveChangeRules || svc.changeRules === false)
+            return adapter;
+        const rules = RESOLVED_CHANGE_RULES.get(adapter.resolveChangeRules);
+        if (!rules && options.requireResolved) {
+            // An unused declared image has no runtime metadata. Archive a conservative
+            // fallback, so its source cannot gain ignore/coverage exceptions.
+            const fallbackRoot = typeof adapter.sourceOptions === "object" ? adapter.sourceOptions.sourceRoot : undefined;
+            const serviceRoot = typeof svc.coverage === "object" ? svc.coverage.sourceRoot : undefined;
+            const roots = new Set([...(adapter.changeRules ?? []), ...(adapter.changeRuleGroups ?? []).flat()].map(rule => rule.root ?? fallbackRoot ?? serviceRoot ?? "."));
+            if (!roots.size)
+                roots.add(fallbackRoot ?? serviceRoot ?? ".");
+            return { ...adapter, changeRuleGroups: [], changeRules: [...roots].map(root => ({ root, pattern: "**", action: "full" })) };
+        }
+        return rules ? { ...adapter, changeRules: rules } : adapter;
+    });
+    return resolveChangePolicy(svc, adapters);
+}
+/** Inventory fingerprints must not turn ignored fixture manifests into changes.
+ * Installed runtime dependency inventories remain independent of project files. */
+export function inventoryProjectFiles(svc, files) {
+    const action = compileChangePolicy(serviceChangePolicy(svc, { requireResolved: true }));
+    return files.filter(file => action(file) !== "ignore");
+}
 function validateCoverageSourceOptions(service, options) {
     if (!options || typeof options !== "object" || Array.isArray(options) ||
         !Object.keys(options).every(k => k === "sourceRoot" || k === "excludeSources")) {
@@ -154,6 +204,9 @@ function validateCoverageSourceOptions(service, options) {
 /** Resolve adapter policies once per capture. Invalid/overlapping ownership is
  * an error, so one adapter cannot silently reinterpret another's reports. */
 export async function resolveCoverageSourceOptions(adapters, ctx, fallback) {
+    await Promise.all(adapters.map(a => resolveAdapterChangeRules(a, {
+        ...ctx, sourceRoot: (typeof a.sourceOptions === "object" ? a.sourceOptions.sourceRoot : undefined) ?? fallback?.sourceRoot ?? ".",
+    })));
     return Promise.all(adapters.filter(a => a.sourceOptions !== undefined || a.defaultExcludeSources !== undefined || a.ownsReport).map(async (a) => {
         if (!a.ownsReport)
             throw new Error(`coverage adapter "${a.name}" needs ownsReport with sourceOptions`);
@@ -186,7 +239,7 @@ function withWireName(a) {
     if (Object.prototype.hasOwnProperty.call(a, "toJSON"))
         return a;
     return Object.assign(Object.create(Object.getPrototypeOf(a)), a, {
-        toJSON: () => ({ adapter: a.name, ...(a.defaultExcludeSources ? { defaultExcludeSources: a.defaultExcludeSources } : {}), ...(a.sourceOptions && typeof a.sourceOptions !== "function" ? { sourceOptions: a.sourceOptions } : {}) }),
+        toJSON: () => ({ adapter: a.name, ...(a.changeRules ? { changeRules: a.changeRules } : {}), ...(a.changeRuleGroups ? { changeRuleGroups: a.changeRuleGroups } : {}), ...(a.defaultExcludeSources ? { defaultExcludeSources: a.defaultExcludeSources } : {}), ...(a.sourceOptions && typeof a.sourceOptions !== "function" ? { sourceOptions: a.sourceOptions } : {}) }),
     });
 }
 /** `env` with `value` appended to `name` (space-separated), or set. */
@@ -792,6 +845,12 @@ for (;;) {
 process.stdout.write(Array.from(out).sort().join("\\n") + (out.size ? "\\n" : ""));
 `;
 export function node(options = {}) {
+    const policy = options.changeRules === undefined ? NODE_CHANGE_RULES : options.changeRules;
+    if (policy !== false)
+        validateChangeRules(policy);
+    if (options.sourceRoot !== undefined || options.excludeSources !== undefined) {
+        validateCoverageSourceOptions("node", { sourceRoot: options.sourceRoot, excludeSources: options.excludeSources });
+    }
     if (options.generated !== undefined && (!Array.isArray(options.generated) || options.generated.some(p => typeof p !== "string"))) {
         throw new Error("coverage.node generated must be a list of relative files");
     }
@@ -802,6 +861,7 @@ export function node(options = {}) {
     }
     return {
         name: "node",
+        changeRules: policy === false ? [] : policy.map(rule => ({ ...rule })),
         defaultExcludeSources: JAVASCRIPT_GENERATED_SOURCES,
         ...(options.sourceRoot !== undefined || options.excludeSources !== undefined ? { sourceOptions: { sourceRoot: options.sourceRoot, excludeSources: options.excludeSources } } : {}),
         ownsReport: name => isNodeDumpName(name) || name === NODE_COVERAGE_EMPTY_REPORT,
@@ -997,22 +1057,15 @@ export async function collectNodeReports(dir) {
     });
     return stats;
 }
-// ── browser ───────────────────────────────────────────────────────
-/**
- * Coverage for the frontend a service serves. The code runs in the guest
- * browser — spectest's own process — so no report can be written by the
- * container; spectest collects V8 coverage for every script the browser
- * loads from this service's origins, maps it back to source through the
- * served source map, and writes one lcov per capture (`browser.lcov`)
- * holding what ran since the previous capture: every live session is
- * harvested first, and only this service's totals are taken and cleared. Nothing ran ⇒
- * an lcov with no records, which is a report saying so.
- */
 export function browser(options = {}) {
+    const rules = options.changeRules === undefined ? BROWSER_CHANGE_RULES : options.changeRules;
+    if (rules !== false)
+        validateChangeRules(rules);
     return {
         name: "browser",
+        changeRules: rules === false ? [] : rules.map(rule => ({ ...rule })),
         defaultExcludeSources: JAVASCRIPT_GENERATED_SOURCES,
-        ...(options.sourceRoot !== undefined || options.excludeSources !== undefined ? { sourceOptions: options } : {}),
+        ...(options.sourceRoot !== undefined || options.excludeSources !== undefined ? { sourceOptions: { sourceRoot: options.sourceRoot, excludeSources: options.excludeSources } } : {}),
         ownsReport: name => name === "browser.lcov",
         reports: "delta",
         load(ctx) {

package/dist/daemon.js

@@ -37,7 +37,7 @@ import { ENVIRONMENT_CA_PATH as CA_PATH } from "./environment-ca.js";
 import { assert, expect, expectRaw, lowerIngress, dnsName as makeDnsDecl, isWildcard, validateServiceImage, normalizeServiceImage, proxy as makeProxyDecl, } from "./index.js";
 import { COVERAGE_CONTAINER_DIR, coverageBundleRef, coverageHostDir, encodeCoverageBundle, isEmptyReport, readCoverageDir, applyCoverageDelta, walkProjectFiles, ENVIRONMENT_SERVICE, REACH_REPORT, READS_REPORT, } from "./harness/coverage.js";
 import { configureBrowserCoverage } from "./browser-coverage.js";
-import { INVENTORY_REPORT, NODE_COVERAGE_MARKERS_SUBDIR, NODE_COVERAGE_SCRIPTS_SUBDIR, applyCoverageAdapters, coverageAdapters, resolveCoverageSourceOptions, attachCoverageSourceOptions, coverageReportsMode, validateCoverage, } from "./coverage.js";
+import { INVENTORY_REPORT, NODE_COVERAGE_MARKERS_SUBDIR, NODE_COVERAGE_SCRIPTS_SUBDIR, applyCoverageAdapters, coverageAdapters, serviceChangePolicy, inventoryProjectFiles, resolveCoverageSourceOptions, attachCoverageSourceOptions, coverageReportsMode, validateCoverage, } from "./coverage.js";
 import { serviceForHost as hostToService } from "./harness/browser-coverage.js";
 import { acquirePersistentBrowser, acquirePersistentDesktop, mobileKey } from "./browser.js";
 import { isMobileApp, openPersistentMobile } from "./mobile.js";
@@ -62,7 +62,7 @@ import { runTypecheck } from "./harness/typecheck.js";
 import { evaluateChecked } from "./harness/eval-typecheck.js";
 import { cpus } from "node:os";
 import { APP_DIR, WORKSPACE, resolveExistingProjectPath, resolveProjectPath, takeProjectReads } from "./project-files.js";
-import { compactReach, projectReach, renderReachRules, renderReadsLcov } from "./harness/reach.js";
+import { compactReach, environmentReachSource, projectReach, renderReachRules, renderReadsLcov } from "./harness/reach.js";
 import { installFetchWrapper, isTransportError } from "./harness/fetch.js";
 import { bindInstrumentationScope, createInstrumentationScope, runInstrumented, runUninstrumented, } from "./harness/instrumentation-scope.js";
 import { ServiceDns, ServiceOperations } from "./harness/service-dns.js";
@@ -1058,7 +1058,7 @@ async function runServiceBuild(name, image, tag) {
         if (remote) {
             buildArgs = ["buildx", "build", "--builder", remote.builder,
                 "--progress=plain", "--metadata-file", metadataPath,
-                "--output", shadowOutput(remoteReference), ...argFlags,
+                "--output", shadowOutput(remoteReference, remote), ...argFlags,
                 "-f", dfPath, contextDir];
         }
         else if (useLocal) {
@@ -1150,7 +1150,7 @@ async function runServiceBuild(name, image, tag) {
             const immutable = `${remoteReference.split(":result")[0]}@${digest}`;
             const pullStarted = Date.now();
             const pulled = await shxStream("docker", ["pull", immutable], undefined, undefined, () => { });
-            await shadowTiming(name, "pull-unpack", pullStarted, { digest, ok: pulled.code === 0, lazy: false });
+            await shadowTiming(name, "pull-unpack", pullStarted, { digest, ok: pulled.code === 0, lazy: remote.imageFormat === "nydus-v6", imageFormat: remote.imageFormat ?? "oci-zstd" });
             if (pulled.code !== 0)
                 return { ok: false, log: pulled.stderr };
             const tagged = await docker(["tag", immutable, tag]);
@@ -3196,7 +3196,7 @@ async function writeCoverageInventory(svc) {
             }
             return { stdout: r.stdout, stderr: r.stderr };
         },
-        projectFiles: () => walkProjectFiles(WORKSPACE),
+        projectFiles: async () => inventoryProjectFiles(svc, await walkProjectFiles(WORKSPACE)),
         async readProjectFile(p) {
             // Not recorded as a read: an inventory fingerprinting every
             // manifest is bookkeeping, not the suite depending on the files.
@@ -3253,11 +3253,13 @@ async function computeProjectReach(all) {
 }
 async function computeProjectReachInner(all) {
     const files = await walkProjectFiles(WORKSPACE, [".git"]);
-    const sources = [];
+    const sources = [environmentReachSource(ENVIRONMENT_SERVICE)];
     const owners = new Map(componentBuildTasks(all).map(t => [t.name, t.owner]));
     for (const svc of imageTasks(all)) {
+        const changePolicy = serviceChangePolicy(svc, { requireResolved: true });
         const src = {
             service: owners.get(svc.name) ?? svc.name,
+            changePolicy,
             volumeSources: (svc.volumes ?? []).flatMap((v) => (v.source && !v.reachExempt ? [v.source] : [])),
             ...(svc.inputs && svc.inputs.length > 0 ? { inputs: [...svc.inputs] } : {}),
         };
@@ -3279,7 +3281,7 @@ async function computeProjectReachInner(all) {
         sources.push(src);
     }
     const reach = projectReach(files, sources);
-    return { version: 1, sources, prefixes: compactReach(files, reach) };
+    return { version: 2, sources, prefixes: compactReach(files, reach) };
 }
 /**
  * The synthetic `__environment__` capture: what the environment itself
@@ -3324,7 +3326,6 @@ async function captureServiceCoverage(baseline = false) {
     });
     // The environment's own capture is unconditional (see above); the
     // services' come from the ones that opted in, none included.
-    const environment = captureEnvironmentCoverage(all, baseline);
     const captures = await Promise.all(services.map(async (svc) => {
         let policies;
         try {
@@ -3386,6 +3387,7 @@ async function captureServiceCoverage(baseline = false) {
         try {
             return await adapter.collect({
                 ...coverageCaptureContext(svc, signal, new Set()),
+                changeRules: svc.changeRules,
                 projectFiles: () => walkProjectFiles(WORKSPACE),
                 async readProjectFile(p) {
                     try {
@@ -3401,7 +3403,8 @@ async function captureServiceCoverage(baseline = false) {
             return [{ service: `${svc.name}/${adapter.name}`, reports: [], error: String(error) }];
         }
     })));
-    return [...captures, ...components.flat(), await environment];
+    // Freeze build-dependent policy only after all direct and nested adapters resolved it.
+    return [...captures, ...components.flat(), await captureEnvironmentCoverage(all, baseline)];
 }
 /**
  * Mint a session id. `idScope` (the running test's case id; `"eval"`
@@ -5109,7 +5112,7 @@ export function harnessMethods(state) {
     return {
         health: async () => ({
             ok: true,
-            capabilities: ["prepared-images-v1", "shadow-builder-v1"],
+            capabilities: ["prepared-images-v1", "shadow-builder-v1", "shadow-nydus-v1"],
             // Optional discovery: old SDKs omit this field and are never sent the
             // new method. Check the loaded project, including after warm restore.
             setupInteractive: typeof loaded?.project.interactive?.seed === "function",

package/dist/harness/component-images.d.ts

@@ -1,7 +1,10 @@
 import type { BuildImage, ComponentImageBuild, ServiceConfig } from "../index.js";
+import { type ChangeRule } from "../change-rules.js";
 export type KubernetesImage = string | (BuildImage & {
     reference: string;
     coverage?: import("../coverage.js").ServiceCoverage;
+    /** Override change-selection defaults for this image's own build context. */
+    changeRules?: readonly ChangeRule[] | false;
 });
 /** containerd/CRI use fully qualified names, including the default tag. */
 export declare function canonicalImageReference(reference: string): string;
@@ -20,6 +23,8 @@ export declare function isComponentImageTask(name: string): boolean;
 export declare function componentBuildTasks<T extends ServiceConfig & {
     name: string;
 }>(services: readonly T[]): {
+    changeRules?: false | readonly ChangeRule[] | undefined;
+    coverage?: import("../coverage.js").ServiceCoverage | undefined;
     name: string;
     owner: string;
     reference: string;

package/dist/harness/component-images.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { validateChangeRules } from "../change-rules.js";
 /** containerd/CRI use fully qualified names, including the default tag. */
 export function canonicalImageReference(reference) {
     if (typeof reference !== "string" || !reference || reference.startsWith("-") || /[\s\x00]/.test(reference)) {
@@ -52,8 +53,14 @@ export function kubernetesImages(images) {
         if (typeof image === "string")
             pulls.push(image);
         else {
-            const { coverage: _coverage, ...build } = image;
-            builds.push({ reference, image: image.coverage === undefined ? image : build });
+            const { coverage, changeRules, ...build } = image;
+            if (changeRules !== undefined && changeRules !== false)
+                validateChangeRules(changeRules);
+            builds.push({ reference,
+                image: coverage === undefined && changeRules === undefined ? image : build,
+                ...(coverage === undefined ? {} : { coverage }),
+                ...(changeRules === undefined ? {} : { changeRules }),
+            });
         }
     }
     return { pulls, builds };
@@ -72,6 +79,12 @@ export function componentBuildTasks(services) {
         owner: svc.name,
         reference: build.reference,
         image: build.image,
+        ...(build.coverage === undefined ? {} : { coverage: build.coverage }),
+        // An image may specialize the cluster's explicit overrides. Each task
+        // keeps its own context and adapter source root; policies never leak to
+        // another image merely because the same cluster runs both.
+        ...(build.changeRules !== undefined || svc.changeRules !== undefined
+            ? { changeRules: build.changeRules ?? svc.changeRules } : {}),
     })));
 }
 /** Private handoff to a component's setup hook. Builds stay generic; the

package/dist/harness/coverage-target.d.ts

@@ -1,8 +1,10 @@
 import { type CoverageCaptureContext, type CoverageInventoryContext, type ServiceCoverage } from "../coverage.js";
+import type { ChangeRule } from "../change-rules.js";
 import { type ServiceCoverageCapture } from "./coverage.js";
 export declare function captureCoverageTarget(options: {
     context: CoverageCaptureContext & CoverageInventoryContext;
     coverage: ServiceCoverage;
+    changeRules?: readonly ChangeRule[] | false;
     root: string;
     baseline: boolean;
     inventoryAvailable?: boolean;

package/dist/harness/coverage-target.js

@@ -2,7 +2,7 @@
 // Counter baselines belong to an instance; source identity belongs to its image.
 import { promises as fs } from "node:fs";
 import path from "node:path";
-import { attachCoverageSourceOptions, coverageAdapters, coverageReportsMode, resolveCoverageSourceOptions } from "../coverage.js";
+import { attachCoverageSourceOptions, coverageAdapters, coverageReportsMode, resolveCoverageSourceOptions, inventoryProjectFiles } from "../coverage.js";
 import { applyCoverageDelta, readCoverageDir } from "./coverage.js";
 export async function captureCoverageTarget(options) {
     const { context: ctx, coverage, root, baseline } = options;
@@ -34,8 +34,9 @@ export async function captureCoverageTarget(options) {
         }
         if (baseline && options.inventoryAvailable !== false) {
             const units = new Set();
+            const inventoryContext = { ...context, projectFiles: async () => inventoryProjectFiles({ coverage, changeRules: options.changeRules }, await context.projectFiles()) };
             for (const adapter of adapters)
-                for (const unit of await adapter.inventory?.(context) ?? [])
+                for (const unit of await adapter.inventory?.(inventoryContext) ?? [])
                     units.add(unit);
             await context.writeReport("inventory.units", [...units].sort().join("\n"));
         }

package/dist/harness/reach.d.ts

@@ -14,6 +14,8 @@ export declare function isExcluded(patterns: Pattern[], rel: string): boolean;
 export interface ReachSource {
     /** The service the source belongs to (for the shadow page's verdicts). */
     service?: string;
+    /** Frozen source-change policy, including adapter defaults and service overrides. */
+    changePolicy?: import("../change-rules.js").ChangePolicy;
     /** Build context directory, project-relative (`.` for the root); absent
      *  for a registry image. */
     context?: string;
@@ -30,6 +32,9 @@ export interface ReachSource {
      *  directory covers its subtree. */
     inputs?: string[];
 }
+/** Environment/test sources remain owned even when every container has a narrow
+ * build context. Their common policy ignores nearby documentation. */
+export declare function environmentReachSource(service: string): ReachSource;
 /**
  * The project's reach: every project file (`files`, project-relative)
  * some service's build context includes or some volume mounts, plus the
@@ -38,7 +43,7 @@ export interface ReachSource {
 export declare function projectReach(files: readonly string[], sources: readonly ReachSource[]): string[];
 /** The `reach.json` report. Mirrors `reach::ReachRules` on the server. */
 export interface ReachRules {
-    version: 1;
+    version: 2;
     /** Every service's contribution, as rules. */
     sources: ReachSource[];
     /** The current file reach, compacted: `dir/` for a directory every

package/dist/harness/reach.js

@@ -1,35 +1,4 @@
-// What a change to a project file can reach — the pure part.
-//
-// A project file affects a test only through one of three doors: it is in
-// a service's **build context** (so an image may carry it), it is the
-// **source of a volume** a service mounts, or a test **reads** it through
-// the SDK. The first two are known from the environment config before any
-// test runs; the harness ships them with the bring-up capture as
-// **rules** (`reach.json`, under the synthetic `__environment__`
-// service): per service its context directory, the composed
-// `.dockerignore` text, the Dockerfile it reads and the volume sources it
-// mounts. Rules, not a file list: the control plane evaluates any changed
-// path against them, a file that did not exist at the base included, and
-// a project of ten thousand files ships a few lines. Beside the rules
-// rides a **compacted** view of the current file reach — a directory
-// every file of which is in the reach as one `dir/` prefix, the odd file
-// alone — which the control plane uses as a fast path and the shadow page
-// as the summary. The subset selector then treats a changed file outside
-// the reach as one that cannot affect the suite: `site/**` behind a
-// `.dockerignore`, `.github/**` outside every context. The third door is
-// recorded as it happens (`project-files.ts`, `takeProjectReads`).
-//
-// The rules are shipped for every project, coverage adapters or not: the
-// reach is a property of the environment config alone.
-//
-// The context of a build is what `docker build` would send: every file
-// under the context directory minus what the composed `.dockerignore`
-// (the project's own rules plus the service's `exclude`) matches, with
-// Docker's semantics — a pattern is matched against the path relative to
-// the context root, `*` and `?` stay inside one segment, `**` spans
-// segments, `!` re-includes, and a pattern that matches a directory
-// excludes everything below it. When in doubt the answer is "reachable":
-// over-approximating the reach only costs a full run.
+import { resolveChangePolicy } from "../change-rules.js";
 /** Docker's `.dockerignore` pattern → a regex over a `/`-separated path,
  *  after moby's `patternmatcher`. */
 function compilePattern(raw) {
@@ -116,6 +85,11 @@ function normRel(p) {
     s = s.replace(/^\/+/, "").replace(/\/+$/, "");
     return s === "." ? "" : s;
 }
+/** Environment/test sources remain owned even when every container has a narrow
+ * build context. Their common policy ignores nearby documentation. */
+export function environmentReachSource(service) {
+    return { service, inputs: ["spectest"], changePolicy: resolveChangePolicy({}) };
+}
 /**
  * The project's reach: every project file (`files`, project-relative)
  * some service's build context includes or some volume mounts, plus the
@@ -147,7 +121,7 @@ export function projectReach(files, sources) {
                 continue;
             const src = normRel(v);
             for (const f of files) {
-                if (f === src || f.startsWith(`${src}/`))
+                if (src === "" || f === src || f.startsWith(`${src}/`))
                     out.add(f);
             }
         }
@@ -240,7 +214,7 @@ export function sourceOf(sources, path) {
             if (v.startsWith("/"))
                 continue;
             const src = normRel(v);
-            if (p === src || p.startsWith(`${src}/`))
+            if (src === "" || p === src || p.startsWith(`${src}/`))
                 return s;
         }
     }

package/dist/harness/shadow-builder.d.ts

@@ -3,10 +3,11 @@ export interface ShadowBuilder {
     builder: string;
     registry: string;
     experiment: string;
+    imageFormat?: "nydus-v6";
 }
 export declare function validateShadowBuilder(value: unknown): ShadowBuilder;
 export declare function shadowBuilder(): Promise<ShadowBuilder | undefined>;
 export declare function shadowImage(c: ShadowBuilder, service: string): string;
-export declare function shadowOutput(reference: string): string;
+export declare function shadowOutput(reference: string, config?: ShadowBuilder): string;
 export declare function imageDigest(metadata: unknown): string;
 export declare function shadowTiming(service: string, phase: string, started: number, extra?: {}): Promise<void>;

package/dist/harness/shadow-builder.js

@@ -5,7 +5,8 @@ export function validateShadowBuilder(value) {
     const c = value;
     if (!c || c.version !== 1 || !/^shadow-[a-z0-9-]+$/.test(c.builder)
         || !/^[a-z0-9.-]+(?::[0-9]+)?$/.test(c.registry)
-        || !/^[a-z0-9-]{1,80}$/.test(c.experiment))
+        || !/^[a-z0-9-]{1,80}$/.test(c.experiment)
+        || (c.imageFormat !== undefined && c.imageFormat !== "nydus-v6"))
         throw new Error("invalid shadow builder configuration");
     return c;
 }
@@ -19,8 +20,13 @@ export function shadowImage(c, service) {
     const id = createHash("sha256").update(service).digest("hex").slice(0, 32);
     return `${c.registry}/shadow/${c.experiment}/${id}:result`;
 }
-export function shadowOutput(reference) {
-    return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=zstd`;
+// Convert inherited gzip layers too; the persistent builder caches the conversion.
+// Level 1 favors export latency over a small additional size reduction.
+export function shadowOutput(reference, config) {
+    if (config?.imageFormat === "nydus-v6") {
+        return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=nydus,force-compression=true`;
+    }
+    return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=zstd,compression-level=1,force-compression=true`;
 }
 export function imageDigest(metadata) {
     const digest = metadata?.["containerimage.digest"];

package/dist/index.d.ts

@@ -38,6 +38,8 @@ export type { Terminal, TerminalOpts, TerminalResult, TerminalWaitOptions, Termi
 import type { Terminal, TerminalOpts, TerminalResult } from "./terminal.js";
 export { type CoverageAdapter, type CoverageCaptureContext, type CoverageConfigureInfo, type CoverageSourceOptions, type CoverageSourceContext, type CoverageLoadContext, type ServiceCoverage, } from "./coverage.js";
 import { type ServiceCoverage } from "./coverage.js";
+export { type ChangeRule, type ChangeAction, COMMON_CHANGE_RULES } from "./change-rules.js";
+import type { ChangeRule } from "./change-rules.js";
 export { ca } from "./environment-ca.js";
 export { certificate, dnsName, proxy, provides, lowerIngress, isWildcard, SELF_SERVICE_TOKEN, } from "./ingress.js";
 export type { CorsMode, CertificateDecl, DnsDecl, ProxyDecl, IngressDecl, DnsTarget, LoweredIngress, } from "./ingress.js";
@@ -197,6 +199,9 @@ export interface ServiceConfig {
      * `spectest docs /services/coverage`.
      */
     coverage?: ServiceCoverage;
+    /** Ordered source-change overrides, independent of coverage collection.
+     * Last matching rule wins. false disables inherited defaults. */
+    changeRules?: readonly ChangeRule[] | false;
     /**
      * Files seeded into the container's filesystem **before it starts**.
      * Each entry's `content` is written to a VM-host staging path and
@@ -880,6 +885,9 @@ export type ServiceImage = string | BuildImage | NormalizedServiceImage;
 export declare function normalizeServiceImage(image: ServiceImage): NormalizedServiceImage;
 /** @internal Serializes build-only work with the owning component. */
 export interface ComponentImageBuild {
+    /** Coverage and selection policy of the built application image. */
+    coverage?: ServiceCoverage;
+    changeRules?: readonly ChangeRule[] | false;
     reference: string;
     image: BuildImage;
 }

package/dist/index.js

@@ -42,6 +42,7 @@ import { isLocator, getLocatorProbe, isBrowserSession, getBrowserProbe, } from "
 import { escapeInvisible, textDifferenceNote, } from "./text-match.js";
 import { describeUrlPattern } from "./url-match.js";
 import { applyCoverageAdapters, coverageAdapters, validateCoverage } from "./coverage.js";
+export { COMMON_CHANGE_RULES } from "./change-rules.js";
 import { resolveExistingProjectPath } from "./project-files.js";
 export { ca } from "./environment-ca.js";
 // Low-level ingress primitives + the framework lowering that the friendly
@@ -185,6 +186,10 @@ function expandServiceGroups(input) {
             // Rewrite relative dependsOn to final keys; a spread keeps function
             // fields (helpers/setup) and the enumerable-symbol ingress decls.
             const final = { ...svc, ...(part === entry.primary ? primaryOverrides : {}) };
+            // A group-level selection override applies to every generated owner.
+            if (primaryOverrides.changeRules !== undefined)
+                final.changeRules = primaryOverrides.changeRules === false
+                    ? false : [...(svc.changeRules || []), ...primaryOverrides.changeRules];
             // Component-owned nested containers keep their collection when callers
             // add ordinary service coverage (for example browser coverage on k3s).
             const collectors = coverageAdapters(svc.coverage).filter(adapter => adapter.collect);

package/dist/vendor/rrweb-record.min.js

@@ -1163,8 +1163,6 @@ function serializeElementNode(n, options) {
       canvasCtx = canvasService.getContext("2d");
     }
     const image = n;
-    const imageSrc = image.currentSrc || image.getAttribute("src") || "<unknown-src>";
-    const priorCrossOrigin = image.crossOrigin;
     const recordInlineImage = () => {
       image.removeEventListener("load", recordInlineImage);
       try {
@@ -1175,21 +1173,8 @@ function serializeElementNode(n, options) {
           dataURLOptions.type,
           dataURLOptions.quality
         );
-      } catch (err) {
-        if (image.crossOrigin !== "anonymous") {
-          image.crossOrigin = "anonymous";
-          if (image.complete && image.naturalWidth !== 0)
-            recordInlineImage();
-          else image.addEventListener("load", recordInlineImage);
-          return;
-        } else {
-          console.warn(
-            `Cannot inline img src=${imageSrc}! Error: ${err}`
-          );
-        }
-      }
-      if (image.crossOrigin === "anonymous") {
-        priorCrossOrigin ? attributes.crossOrigin = priorCrossOrigin : image.removeAttribute("crossorigin");
+      } catch (e) {
+        return;
       }
     };
     if (image.complete && image.naturalWidth !== 0) recordInlineImage();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.131.20",
+  "version": "0.132.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/browser-coverage-navigation.test.ts

@@ -14,10 +14,13 @@ test.skipIf(!existsSync(executablePath))("cross-site script ID reuse cannot attr
   const map = Buffer.from(JSON.stringify({ version: 3, sources: ["src/customer.ts"], names: [], mappings: "AAAA" })).toString("base64");
   const server = Bun.serve({ hostname: "0.0.0.0", port: 0, fetch(request) {
     const url = new URL(request.url);
+    if (url.pathname === "/padding.js") return new Response("void 0;", { headers: { "content-type": "application/javascript" } });
     if (url.pathname === emptyScript) return new Response("", { headers: { "content-type": "application/javascript" } });
     if (url.pathname === "/app.js") return new Response(`globalThis.appRan = true;\n//# sourceMappingURL=data:application/json;base64,${map}`, { headers: { "content-type": "application/javascript" } });
     return new Response(url.hostname === "127.0.0.1"
-      ? `<script src="${emptyScript}"></script><script src="/app.js"></script><p>Application</p>`
+      // Advance the application's script IDs past browser-injected scripts.
+      // Padding is served outside the covered service and has no source map.
+      ? `${Array.from({ length: 32 }, (_, i) => `<script src="http://127.0.0.2:${url.port}/padding.js?${i}"></script>`).join("")}<script src="${emptyScript}"></script><script src="/app.js"></script><p>Application</p>`
       : "<p>External login</p>", { headers: { "content-type": "text/html", "cache-control": "no-store" } });
   } });
   const browser = await chromium.launch({ executablePath, headless: true, args: ["--no-sandbox", "--site-per-process"] });
@@ -36,7 +39,12 @@ test.skipIf(!existsSync(executablePath))("cross-site script ID reuse cannot attr
     // Keep collected application counts across navigation until service capture.
     for (const host of ["127.0.0.1", "127.0.0.2", "127.0.0.1", "127.0.0.2"]) {
       await page.goto(`http://${host}:${server.port}/`);
-      await page.evaluate("(() => { const value = 1; return value + 1; })()");
+      // V8's first evaluation ID varies across browser versions and runners.
+      // Generate distinct anonymous scripts until the old named ID is reused.
+      for (let i = 0; i < 128; i++) {
+        await cdp.send("Runtime.evaluate", { expression: `(() => { const value = ${i}; return value + 1; })()` });
+        if (host === "127.0.0.1" || anonymousReuse) break;
+      }
       await harvestBrowserCoverage(cdp);
     }
     expect(anonymousReuse).toBe(true); // Prove the regression's trigger happened.