@specific.dev/spectest 0.131.20 → 0.132.0

package/src/harness/component-images.ts

@@ -1,7 +1,13 @@
 import { createHash } from "node:crypto";
 import type { BuildImage, ComponentImageBuild, ServiceConfig } from "../index.js";
+import { validateChangeRules, type ChangeRule } from "../change-rules.js";
 
-export type KubernetesImage = string | (BuildImage & { reference: string; coverage?: import("../coverage.js").ServiceCoverage });
+export type KubernetesImage = string | (BuildImage & {
+  reference: string;
+  coverage?: import("../coverage.js").ServiceCoverage;
+  /** Override change-selection defaults for this image's own build context. */
+  changeRules?: readonly ChangeRule[] | false;
+});
 
 /** containerd/CRI use fully qualified names, including the default tag. */
 export function canonicalImageReference(reference: string): string {
@@ -51,8 +57,13 @@ export function kubernetesImages(images: readonly KubernetesImage[]): { pulls: s
     seen.set(reference, identity);
     if (typeof image === "string") pulls.push(image);
     else {
-      const { coverage: _coverage, ...build } = image;
-      builds.push({ reference, image: image.coverage === undefined ? image : build });
+      const { coverage, changeRules, ...build } = image;
+      if (changeRules !== undefined && changeRules !== false) validateChangeRules(changeRules);
+      builds.push({ reference,
+        image: coverage === undefined && changeRules === undefined ? image : build,
+        ...(coverage === undefined ? {} : { coverage }),
+        ...(changeRules === undefined ? {} : { changeRules }),
+      });
     }
   }
   return { pulls, builds };
@@ -74,6 +85,12 @@ export function componentBuildTasks<T extends ServiceConfig & { name: string }>(
     owner: svc.name,
     reference: build.reference,
     image: build.image,
+    ...(build.coverage === undefined ? {} : { coverage: build.coverage }),
+    // An image may specialize the cluster's explicit overrides. Each task
+    // keeps its own context and adapter source root; policies never leak to
+    // another image merely because the same cluster runs both.
+    ...(build.changeRules !== undefined || svc.changeRules !== undefined
+      ? { changeRules: build.changeRules ?? svc.changeRules } : {}),
   })));
 }
 

package/src/harness/coverage-target.ts

@@ -3,12 +3,14 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { attachCoverageSourceOptions, coverageAdapters, coverageReportsMode, resolveCoverageSourceOptions,
-  type CoverageCaptureContext, type CoverageInventoryContext, type ServiceCoverage } from "../coverage.js";
+  inventoryProjectFiles, type CoverageCaptureContext, type CoverageInventoryContext, type ServiceCoverage } from "../coverage.js";
+import type { ChangeRule } from "../change-rules.js";
 import { applyCoverageDelta, readCoverageDir, type ServiceCoverageCapture } from "./coverage.js";
 
 export async function captureCoverageTarget(options: {
   context: CoverageCaptureContext & CoverageInventoryContext;
   coverage: ServiceCoverage;
+  changeRules?: readonly ChangeRule[] | false;
   root: string;
   baseline: boolean;
   inventoryAvailable?: boolean;
@@ -39,7 +41,8 @@ export async function captureCoverageTarget(options: {
     }
     if (baseline && options.inventoryAvailable !== false) {
       const units = new Set<string>();
-      for (const adapter of adapters) for (const unit of await adapter.inventory?.(context) ?? []) units.add(unit);
+      const inventoryContext = {...context, projectFiles: async () => inventoryProjectFiles({coverage,changeRules:options.changeRules}, await context.projectFiles())};
+      for (const adapter of adapters) for (const unit of await adapter.inventory?.(inventoryContext) ?? []) units.add(unit);
       await context.writeReport("inventory.units", [...units].sort().join("\n"));
     }
     ctx.signal.throwIfAborted();

package/src/harness/reach.test.ts

@@ -1,5 +1,6 @@
+import { evaluateChangePolicy } from "../change-rules.js";
 import { describe, expect, test } from "bun:test";
-import { compactReach, compileDockerignore, isExcluded, projectReach, reachContains, renderReadsLcov, sourceOf } from "./reach.js";
+import { compactReach, environmentReachSource, compileDockerignore, isExcluded, projectReach, reachContains, renderReadsLcov, sourceOf } from "./reach.js";
 
 describe("dockerignore semantics", () => {
   const ex = (text: string, rel: string) => isExcluded(compileDockerignore(text), rel);
@@ -87,7 +88,7 @@ describe("reach rules", () => {
     { service: "db", volumeSources: ["data", "/var/run/docker.sock"] },
   ];
   const reach = projectReach(files, sources);
-  const rules = { version: 1 as const, sources, prefixes: compactReach(files, reach) };
+  const rules = { version: 2 as const, sources, prefixes: compactReach(files, reach) };
 
   test("compactReach folds a wholly reached directory into one prefix and keeps the odd file", () => {
     // packages/api holds README.md, which the ignore drops, so the
@@ -125,7 +126,7 @@ describe("reach rules", () => {
     expect(sourceOf([sources[1]!], "var/run/docker.sock")).toBeUndefined();
     // The Dockerfile named by path, and the one at the context root.
     expect(sourceOf(sources, "packages/api/Dockerfile")?.service).toBe("api");
-    expect(reachContains({ version: 1, sources: [{ context: "packages/x", ignore: "**" }], prefixes: [] }, "packages/x/Dockerfile")).toBe(true);
+    expect(reachContains({ version: 2, sources: [{ context: "packages/x", ignore: "**" }], prefixes: [] }, "packages/x/Dockerfile")).toBe(true);
   });
 
   test("a service's declared inputs count: a lambda's source directory, a config file", () => {
@@ -134,14 +135,47 @@ describe("reach rules", () => {
       "lambda/add/index.js",
       "supabase/config.toml",
     ]);
-    const rules = { version: 1 as const, sources: srcs, prefixes: [] };
+    const rules = { version: 2 as const, sources: srcs, prefixes: [] };
     expect(reachContains(rules, "lambda/add/new.js")).toBe(true);
     expect(sourceOf(srcs, "lambda/add/new.js")?.service).toBe("aws");
     expect(reachContains(rules, "lambda/other/index.js")).toBe(false);
   });
 
+  test("repository-root inputs and volumes reach existing and newly added files", () => {
+    for (const field of ["inputs", "volumeSources"] as const) {
+      for (const root of [".", "./"]) {
+        const source = { service: "root-consumer", [field]: [root] };
+        expect(projectReach(files, [source])).toEqual([...files].sort());
+        const rules = { version: 2 as const, sources: [source], prefixes: [] };
+        for (const path of ["new.ts", "new/directory/source.ts"]) {
+          expect(reachContains(rules, path)).toBe(true);
+          expect(sourceOf([source], path)?.service).toBe("root-consumer");
+        }
+      }
+      const absolute = { [field]: ["/", "/var/run/docker.sock"] };
+      expect(projectReach(files, [absolute])).toEqual([]);
+      expect(sourceOf([absolute], "var/run/docker.sock")).toBeUndefined();
+      expect(reachContains({ version: 2, sources: [absolute], prefixes: [] }, "new.ts")).toBe(false);
+    }
+  });
+
   test("the whole project as one prefix", () => {
-    expect(reachContains({ version: 1, sources: [], prefixes: ["."] }, "anything/at/all")).toBe(true);
-    expect(reachContains({ version: 1, sources: [], prefixes: [] }, "anything/at/all")).toBe(false);
+    expect(reachContains({ version: 2, sources: [], prefixes: ["."] }, "anything/at/all")).toBe(true);
+    expect(reachContains({ version: 2, sources: [], prefixes: [] }, "anything/at/all")).toBe(false);
   });
 });
+
+
+test("environment policy owns Spectest Markdown outside narrow container contexts", () => {
+  const environment = environmentReachSource("__environment__");
+  const sources = [environment, {service:"app",context:"src"}];
+  const rules = {version:2 as const,sources,prefixes:[]};
+  for (const file of ["spectest/README.md", "spectest/tests/notes.md"]) {
+    expect(reachContains(rules,file)).toBe(true);
+    expect(sourceOf(sources,file)?.service).toBe("__environment__");
+    expect(evaluateChangePolicy(environment.changePolicy!,file)).toBe("ignore");
+  }
+  expect(evaluateChangePolicy(environment.changePolicy!,"spectest/index.ts")).toBe("full");
+  expect(evaluateChangePolicy(environment.changePolicy!,"spectest/tests/helper.ts")).toBe("coverage");
+  expect(reachContains(rules,"unrelated/file.ts")).toBe(false);
+});

package/src/harness/reach.ts

@@ -1,3 +1,5 @@
+import { resolveChangePolicy } from "../change-rules.js";
+
 // What a change to a project file can reach — the pure part.
 //
 // A project file affects a test only through one of three doors: it is in
@@ -114,6 +116,8 @@ export function isExcluded(patterns: Pattern[], rel: string): boolean {
 export interface ReachSource {
   /** The service the source belongs to (for the shadow page's verdicts). */
   service?: string;
+  /** Frozen source-change policy, including adapter defaults and service overrides. */
+  changePolicy?: import("../change-rules.js").ChangePolicy;
   /** Build context directory, project-relative (`.` for the root); absent
    *  for a registry image. */
   context?: string;
@@ -138,6 +142,12 @@ function normRel(p: string): string {
   return s === "." ? "" : s;
 }
 
+/** Environment/test sources remain owned even when every container has a narrow
+ * build context. Their common policy ignores nearby documentation. */
+export function environmentReachSource(service: string): ReachSource {
+  return {service,inputs:["spectest"],changePolicy:resolveChangePolicy({})};
+}
+
 /**
  * The project's reach: every project file (`files`, project-relative)
  * some service's build context includes or some volume mounts, plus the
@@ -165,7 +175,7 @@ export function projectReach(files: readonly string[], sources: readonly ReachSo
       if (v.startsWith("/")) continue;
       const src = normRel(v);
       for (const f of files) {
-        if (f === src || f.startsWith(`${src}/`)) out.add(f);
+        if (src === "" || f === src || f.startsWith(`${src}/`)) out.add(f);
       }
     }
   }
@@ -174,7 +184,7 @@ export function projectReach(files: readonly string[], sources: readonly ReachSo
 
 /** The `reach.json` report. Mirrors `reach::ReachRules` on the server. */
 export interface ReachRules {
-  version: 1;
+  version: 2;
   /** Every service's contribution, as rules. */
   sources: ReachSource[];
   /** The current file reach, compacted: `dir/` for a directory every
@@ -259,7 +269,7 @@ export function sourceOf(sources: readonly ReachSource[], path: string): ReachSo
     for (const v of [...(s.volumeSources ?? []), ...(s.inputs ?? [])]) {
       if (v.startsWith("/")) continue;
       const src = normRel(v);
-      if (p === src || p.startsWith(`${src}/`)) return s;
+      if (src === "" || p === src || p.startsWith(`${src}/`)) return s;
     }
   }
   return undefined;

package/src/harness/shadow-builder.test.ts

@@ -5,7 +5,10 @@ test("shadow image namespaces isolate experiments and hash untrusted service nam
   const a = shadowImage(config, "../../other,compression=gzip");
   expect(a).toMatch(/^registry.example.com\/shadow\/experiment-1\/[a-f0-9]{32}:result$/);
   expect(shadowImage({ ...config, experiment: "experiment-2" }, "api")).not.toBe(shadowImage(config, "api"));
-  expect(shadowOutput(a)).toContain("compression=zstd");
+  expect(shadowOutput(a).split(",")).toEqual([
+    "type=image", `name=${a}`, "push=true", "oci-mediatypes=true",
+    "compression=zstd", "compression-level=1", "force-compression=true",
+  ]);
 });
 test("configuration rejects exporter and endpoint injection", () => {
   expect(validateShadowBuilder(config)).toEqual(config);
@@ -27,3 +30,11 @@ test("ordinary SDK execution never needs remote builder configuration", async ()
     else process.env.SPECTEST_SHADOW_BUILD = previous;
   }
 });
+
+// Switching formats must be an explicit controller-selected shadow artifact.
+test("Nydus export requires the explicit shadow format and rejects unknown modes", () => {
+  const nydus = validateShadowBuilder({ ...config, imageFormat: "nydus-v6" });
+  expect(shadowOutput(shadowImage(nydus, "api"), nydus)).toContain("compression=nydus,force-compression=true");
+  expect(() => validateShadowBuilder({ ...config, imageFormat: "unknown" })).toThrow();
+  expect(shadowOutput(shadowImage(config, "api"), config)).toContain("compression=zstd");
+});

package/src/harness/shadow-builder.ts

@@ -7,12 +7,14 @@ export interface ShadowBuilder {
   builder: string;
   registry: string;
   experiment: string;
+  imageFormat?: "nydus-v6";
 }
 export function validateShadowBuilder(value: unknown): ShadowBuilder {
   const c = value as ShadowBuilder;
   if (!c || c.version !== 1 || !/^shadow-[a-z0-9-]+$/.test(c.builder)
     || !/^[a-z0-9.-]+(?::[0-9]+)?$/.test(c.registry)
-    || !/^[a-z0-9-]{1,80}$/.test(c.experiment)) throw new Error("invalid shadow builder configuration");
+    || !/^[a-z0-9-]{1,80}$/.test(c.experiment)
+    || (c.imageFormat !== undefined && c.imageFormat !== "nydus-v6")) throw new Error("invalid shadow builder configuration");
   return c;
 }
 export async function shadowBuilder(): Promise<ShadowBuilder | undefined> {
@@ -24,8 +26,13 @@ export function shadowImage(c: ShadowBuilder, service: string): string {
   const id = createHash("sha256").update(service).digest("hex").slice(0, 32);
   return `${c.registry}/shadow/${c.experiment}/${id}:result`;
 }
-export function shadowOutput(reference: string): string {
-  return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=zstd`;
+// Convert inherited gzip layers too; the persistent builder caches the conversion.
+// Level 1 favors export latency over a small additional size reduction.
+export function shadowOutput(reference: string, config?: ShadowBuilder): string {
+  if (config?.imageFormat === "nydus-v6") {
+    return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=nydus,force-compression=true`;
+  }
+  return `type=image,name=${reference},push=true,oci-mediatypes=true,compression=zstd,compression-level=1,force-compression=true`;
 }
 export function imageDigest(metadata: unknown): string {
   const digest = (metadata as Record<string, unknown>)?.["containerimage.digest"];

package/src/index.ts

@@ -176,6 +176,8 @@ export {
   type ServiceCoverage,
 } from "./coverage.js";
 import { applyCoverageAdapters, coverageAdapters, validateCoverage, type ServiceCoverage } from "./coverage.js";
+export { type ChangeRule, type ChangeAction, COMMON_CHANGE_RULES } from "./change-rules.js";
+import type { ChangeRule } from "./change-rules.js";
 import { resolveExistingProjectPath } from "./project-files.js";
 export { ca } from "./environment-ca.js";
 
@@ -365,6 +367,9 @@ export interface ServiceConfig {
    * `spectest docs /services/coverage`.
    */
   coverage?: ServiceCoverage;
+  /** Ordered source-change overrides, independent of coverage collection.
+   * Last matching rule wins. false disables inherited defaults. */
+  changeRules?: readonly ChangeRule[] | false;
   /**
    * Files seeded into the container's filesystem **before it starts**.
    * Each entry's `content` is written to a VM-host staging path and
@@ -1138,6 +1143,9 @@ function expandServiceGroups(input: InputServicesMap): ServicesMap {
       // Rewrite relative dependsOn to final keys; a spread keeps function
       // fields (helpers/setup) and the enumerable-symbol ingress decls.
       const final: ServiceConfig = { ...svc, ...(part === entry.primary ? primaryOverrides : {}) };
+      // A group-level selection override applies to every generated owner.
+      if (primaryOverrides.changeRules !== undefined) final.changeRules = primaryOverrides.changeRules === false
+        ? false : [...(svc.changeRules || []), ...primaryOverrides.changeRules];
       // Component-owned nested containers keep their collection when callers
       // add ordinary service coverage (for example browser coverage on k3s).
       const collectors = coverageAdapters(svc.coverage).filter(adapter => adapter.collect);
@@ -1321,6 +1329,9 @@ export function normalizeServiceImage(image: ServiceImage): NormalizedServiceIma
 
 /** @internal Serializes build-only work with the owning component. */
 export interface ComponentImageBuild {
+  /** Coverage and selection policy of the built application image. */
+  coverage?: ServiceCoverage;
+  changeRules?: readonly ChangeRule[] | false;
   reference: string;
   image: BuildImage;
 }

package/src/vendor/rrweb-record.min.js

@@ -1163,8 +1163,6 @@ function serializeElementNode(n, options) {
       canvasCtx = canvasService.getContext("2d");
     }
     const image = n;
-    const imageSrc = image.currentSrc || image.getAttribute("src") || "<unknown-src>";
-    const priorCrossOrigin = image.crossOrigin;
     const recordInlineImage = () => {
       image.removeEventListener("load", recordInlineImage);
       try {
@@ -1175,21 +1173,8 @@ function serializeElementNode(n, options) {
           dataURLOptions.type,
           dataURLOptions.quality
         );
-      } catch (err) {
-        if (image.crossOrigin !== "anonymous") {
-          image.crossOrigin = "anonymous";
-          if (image.complete && image.naturalWidth !== 0)
-            recordInlineImage();
-          else image.addEventListener("load", recordInlineImage);
-          return;
-        } else {
-          console.warn(
-            `Cannot inline img src=${imageSrc}! Error: ${err}`
-          );
-        }
-      }
-      if (image.crossOrigin === "anonymous") {
-        priorCrossOrigin ? attributes.crossOrigin = priorCrossOrigin : image.removeAttribute("crossorigin");
+      } catch (e) {
+        return;
       }
     };
     if (image.complete && image.naturalWidth !== 0) recordInlineImage();