@specific.dev/spectest 0.49.0 → 0.50.0

package/dist/annotate.d.ts

@@ -1,4 +1,4 @@
-import { type EmailEventMessage, type EmailEventSummary } from "./recorder.js";
+import { type EmailEventMessage, type EmailEventSummary, type StepBlock } from "./recorder.js";
 /** Phantom brand — `Annotated<T>` is nominally distinct from `T`, so the
  *  box can't be read as the value by accident inside the fake, and the
  *  helper types can recognise it and hand the *test* back a plain `T`. */
@@ -25,6 +25,9 @@ export interface AnnotationOptions {
     /** Draw the value as an email — one message, or a list of them for a
      *  mailbox listing. See {@link EmailAnnotation}. */
     email: EmailAnnotation | readonly EmailAnnotation[];
+    /** Draw the value as a chat transcript — bubbles by role, with the
+     *  messages that arrived in this call marked. See {@link ChatAnnotation}. */
+    chat: ChatAnnotation | readonly ChatMessageAnnotation[];
 }
 /** The kinds {@link annotate} accepts. */
 export type AnnotationKind = keyof AnnotationOptions;
@@ -34,7 +37,8 @@ export type AnnotationKind = keyof AnnotationOptions;
  * which needn't be the annotation kind's name, since an annotation names
  * what the value *is* and the event names how it's drawn.
  */
-export type RenderAnnotation = {
+export type RenderAnnotation = EmailRenderAnnotation | ChatRenderAnnotation;
+type EmailRenderAnnotation = {
     kind: "email";
     /** Single-message ops. */
     message?: EmailEventMessage;
@@ -43,6 +47,14 @@ export type RenderAnnotation = {
     /** Total matches (a listing is capped on the event, never in the value). */
     count?: number;
 };
+/** A chat lowers to a step that describes itself in presentation terms — a
+ *  title plus blocks — rather than to a kind of its own: `blocks.rs` owns
+ *  the drawing vocabulary, and a transcript is one of its block types. */
+type ChatRenderAnnotation = {
+    kind: "chat";
+    title?: string;
+    blocks: StepBlock[];
+};
 /**
  * The email fields to render. Every one is optional — pass what the fake
  * has. Addresses take a single string or a list.
@@ -64,6 +76,44 @@ export interface EmailAnnotation {
      *  "Plain-text version" disclosure when there is. */
     text?: string;
 }
+/**
+ * A conversation to draw as chat bubbles.
+ *
+ * Two sides and their text, which is all a transcript needs to read as one.
+ * It is drawn from the end user's point of view — their own messages on the
+ * right, the other party's on the left.
+ * Pass the messages alone (`annotate(v, "chat", messages)`), or this object
+ * when the thread has an identity worth showing. With no options at all the
+ * value itself is read as the message list.
+ */
+export interface ChatAnnotation {
+    messages: readonly ChatMessageAnnotation[];
+    /**
+     * The thread's identity — a phone number, a channel, whoever is on the
+     * other end — shown as a header over the bubbles. Optional: a fake with
+     * one conversation has nothing useful to put here, and the transcript
+     * reads fine without it.
+     */
+    title?: string;
+}
+/** One turn of a {@link ChatAnnotation}. */
+export interface ChatMessageAnnotation {
+    /**
+     * Who sent it. A transcript is drawn the way the **end user** would see
+     * it on their own screen, so `self` is the end user's own messages — the
+     * person using the app under test — and sits on the right; `other` is
+     * whoever they are talking to and sits on the left.
+     */
+    side: "self" | "other";
+    text: string;
+    /**
+     * This message arrived in *this* call: it slides in when the step opens,
+     * and again whenever it is reopened. Only the fake knows which turns are new —
+     * the dashboard sees one call, not the conversation's history — so it is
+     * the fake that marks them.
+     */
+    new?: boolean;
+}
 /**
  * Say what a fake helper's return value *is*, so the timeline can draw it
  * as that on top of the JSON it always shows. The call stays an ordinary

package/dist/annotate.js

@@ -82,6 +82,8 @@ function lower(kind, options, value) {
     switch (kind) {
         case "email":
             return lowerEmail(options, value);
+        case "chat":
+            return lowerChat(options, value);
         default:
             // Unreachable while `kind` is a key of AnnotationOptions; a kind added
             // to that interface without a case here lands on this line.
@@ -129,6 +131,50 @@ function fields(v) {
         ? v
         : {};
 }
+const NO_MESSAGES = 'annotate(value, "chat"): nothing to render — no messages found on the ' +
+    "value. Pass them explicitly, e.g. " +
+    'annotate(value, "chat", value.turns.map((t) => ({ side: t.fromCustomer ? "self" : "other", text: t.body }))).';
+function lowerChat(options, value) {
+    const source = deepUnwrap(options ?? value);
+    let list;
+    let title;
+    if (Array.isArray(source)) {
+        list = source;
+    }
+    else {
+        const bag = fields(source);
+        list = bag.messages;
+        title = text(bag.title) || undefined;
+    }
+    // An empty conversation is a real state (nothing said yet) and renders as
+    // one; a value with no `messages` at all is the author's mistake.
+    if (!Array.isArray(list))
+        throw new Error(NO_MESSAGES);
+    const messages = list.map((m) => chatMessageOf(fields(m)));
+    // The title travels twice on purpose: as the step's own summary, and as
+    // the transcript's header — the annotated view renders the blocks alone,
+    // so a title carried only on the step would never be seen.
+    return {
+        kind: "chat",
+        title,
+        blocks: [{ type: "chat", messages, ...(title ? { label: title } : {}) }],
+    };
+}
+function chatMessageOf(src) {
+    const msg = {};
+    // Anything that isn't the end user's own message is drawn as the other
+    // party's, rather than a turn being dropped for a typo.
+    if (text(src.side) === "self")
+        msg.side = "self";
+    else
+        msg.side = "other";
+    const body = text(src.text);
+    if (body)
+        msg.text = truncateUtf8(body).value;
+    if (src.new === true)
+        msg.new = true;
+    return msg;
+}
 function messageOf(src) {
     const msg = {};
     const from = text(src.from);

package/dist/daemon.js

@@ -45,7 +45,7 @@ import { assertAbsolute, certificateHostnames, defaultKeyMode, expandServiceToke
 import { conflict, notFound, requireString, } from "./harness/methods.js";
 import { openTerminal } from "./terminal.js";
 import { readAnnotation } from "./annotate.js";
-import { recordEmail, recordEnv, recordExec, recordFake, recordHttp, recordTerminal, recordWait, reserveEvent, recorderEventCount, recorderMarkChildren, recorderTruncate, startRecording, stopRecording, truncateUtf8, } from "./recorder.js";
+import { pauseRecording, recordEmail, recordEnv, recordExec, recordFake, recordHttp, recordStep, recordTerminal, recordWait, reserveEvent, recorderEventCount, recorderMarkChildren, recorderTruncate, resumeRecording, startRecording, stopRecording, truncateUtf8, } from "./recorder.js";
 import { deepUnwrap, wrap, wrapResponse } from "./inspect.js";
 import { clearRecordSecrets, setRecordSecrets } from "./record-secrets.js";
 import { encodeReplayBundle, replayChunk } from "./replay-bundle.js";
@@ -829,13 +829,126 @@ async function prepareServiceImage(svc, opts) {
     }
     return buildServiceImage(svc.name, image, tag);
 }
+/**
+ * What the folded CA step prints when it could not write the trust store
+ * at all — the one outcome that still needs {@link ensureCaTrustedImage},
+ * which can take root for the write.
+ *
+ * The step assembles this prefix from a shell variable so that the marker
+ * appears ONLY in the step's output. BuildKit echoes each instruction into
+ * the same log verbatim, so a marker written literally in the RUN would
+ * match on every build whether or not the step ever printed it.
+ */
+const CA_FOLD_UNWRITABLE = "[spectest-ca] trust store not writable";
+/**
+ * The CA-trust steps as a suffix appended to a dockerfile service's OWN
+ * Dockerfile, so one build produces the finished image instead of a build
+ * plus a derivative rebuild ({@link ensureCaTrustedImage}) per service.
+ * Returns null when there is no CA to layer, or when the PEM can't be
+ * quoted — the caller then falls back to the derivative build.
+ *
+ * The PEM is written INLINE rather than `COPY`d: the build context is
+ * `/workspace` under a per-service ignore file that the project itself
+ * contributes to (a `**` line with re-includes is the common idiom), and
+ * a context path we don't control is a context path that can be excluded.
+ * printf needs nothing but a shell.
+ *
+ * Two rules make this safe to bolt onto user code. It must never fail the
+ * build — every branch ends in an echo, so the RUN exits 0 whatever the
+ * image lacks — and it must never change the image, beyond the trust
+ * store: notably no `USER root`, since we cannot know statically what
+ * user to hand back. An image that declares a non-root user therefore
+ * fails to write and is finished by the derivative build, which inspects
+ * the built image and can escalate properly.
+ */
+async function caTrustSuffix() {
+    if (!existsSync(CA_PATH))
+        return null;
+    const pem = (await fs.readFile(CA_PATH, "utf8")).trim();
+    // A quote in the PEM would break out of the shell quoting below. PEM is
+    // base64 and dashes, so this is a guard, not a case we expect.
+    if (!pem || pem.includes("'"))
+        return null;
+    const args = pem
+        .split("\n")
+        .map((l) => `'${l.trimEnd()}'`)
+        .join(" ");
+    const dst = "/usr/local/share/ca-certificates/spectest-ca.crt";
+    return `
+# spectest: trust the environment's root CA. Appended by the harness —
+# not part of the project's Dockerfile.
+RUN P='[spectest-ca]'; \\
+    mkdir -p /usr/local/share/ca-certificates 2>/dev/null; \\
+    if printf '%s\\n' ${args} > ${dst} 2>/dev/null; then \\
+      if command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates >/dev/null 2>&1; then \\
+        echo "$P trusted via update-ca-certificates"; \\
+      elif command -v update-ca-trust >/dev/null 2>&1 && cp ${dst} /etc/pki/ca-trust/source/anchors/spectest-ca.crt && update-ca-trust extract >/dev/null 2>&1; then \\
+        echo "$P trusted via update-ca-trust"; \\
+      else \\
+        echo "$P no system CA trust tool in image; env-var trust only"; \\
+      fi; \\
+    else \\
+      echo "$P trust store not writable by this image's user"; \\
+    fi
+`;
+}
+/**
+ * Build a dockerfile service's image.
+ *
+ * The CA-trust layer is folded into THIS build when it can be (see
+ * {@link caTrustSuffix}), so a service costs one image build and one
+ * export rather than two. The derivative build stays as the fallback for
+ * everything the folded form can't serve: an image with no shell to run
+ * the step (distroless, scratch — the appended RUN can't execute, so the
+ * build fails and we rebuild the project's Dockerfile untouched), and an
+ * image that declares a non-root user (the step runs as that user and
+ * can't write the trust store).
+ */
 async function buildServiceImage(name, image, tag) {
+    const suffix = await caTrustSuffix();
+    let attempt = await runServiceBuild(name, image, tag, suffix);
+    if (!attempt.ok && suffix) {
+        // Our step must not be able to break a project's build.
+        // eslint-disable-next-line no-console
+        console.warn(`[ca-trust] folded CA step could not run in ${name}'s image; rebuilding without it`);
+        attempt = await runServiceBuild(name, image, tag, null);
+    }
+    if (!attempt.ok) {
+        progressService(name, { status: "failed" });
+        throw new Error(`docker build for ${name} failed:\n${attempt.log}`);
+    }
+    // The derivative build is still needed for the one thing the folded step
+    // cannot do: write the trust store of an image that does not run as
+    // root. That is decided on the IMAGE, not on the build log — a CACHED
+    // layer prints nothing, so a log-only check would quietly stop
+    // re-applying the moment BuildKit had the layer. The log covers the
+    // rarer case of a root image whose /etc is read-only.
+    //
+    // An image with no trust tool at all needs nothing further: the
+    // derivative build would reach the same dead end, and `runContainer`'s
+    // env vars are the fallback either way.
+    const needsDerivative = !attempt.folded ||
+        attempt.log.includes(CA_FOLD_UNWRITABLE) ||
+        !(await imageRunsAsRoot(tag));
+    if (needsDerivative)
+        await ensureCaTrustedImage(name, tag);
+    return { tag, buildSteps: attempt.buildSteps };
+}
+/** Whether `tag`'s declared `USER` is root (or unset, which means root). */
+async function imageRunsAsRoot(tag) {
+    const user = (await docker(["image", "inspect", "--format", "{{.Config.User}}", tag], 60_000)).stdout.trim();
+    return user === "" || user === "root" || user === "0";
+}
+async function runServiceBuild(name, image, tag, caSuffix) {
     let buildSteps;
     {
+        const content = caSuffix
+            ? `${image.content.replace(/\n*$/, "\n")}${caSuffix}`
+            : image.content;
         const dfDir = path.join(WORKSPACE, ".spectest", "services", name);
         await fs.mkdir(dfDir, { recursive: true });
         const dfPath = path.join(dfDir, "Dockerfile");
-        await fs.writeFile(dfPath, image.content);
+        await fs.writeFile(dfPath, content);
         // Per-service ignore: BuildKit resolves `<Dockerfile>.dockerignore`
         // (next to the Dockerfile) in preference to the context root's
         // `.dockerignore`, so this build sees the defaults, the project's own
@@ -897,9 +1010,11 @@ async function buildServiceImage(name, image, tag) {
                 });
             }
         });
+        const log = `${build.stderr.trim()}\n${build.stdout.trim()}`;
         if (build.code !== 0) {
-            progressService(name, { status: "failed" });
-            throw new Error(`docker build for ${name} failed:\n${build.stderr.trim()}\n${build.stdout.trim()}`);
+            // The caller decides whether this is fatal: a failure with the CA
+            // step appended is retried without it before anyone hears about it.
+            return { ok: false, folded: caSuffix !== null, log };
         }
         if (useBuildKit) {
             // Keep only the slowest dozen steps ≥1s — enough to profile, small
@@ -908,14 +1023,8 @@ async function buildServiceImage(name, image, tag) {
                 .filter((s) => s.secs >= 1)
                 .slice(0, 12);
         }
+        return { ok: true, folded: caSuffix !== null, log, buildSteps };
     }
-    // Layer the spectest CA into the image's system trust store so apps
-    // that read the system bundle (Go, Java, CLIs that don't honour the
-    // SSL_CERT_FILE env vars) accept HTTPS to fakes. Best-effort: images
-    // without `update-ca-certificates` / `update-ca-trust` (distroless,
-    // scratch) fall through to the env-var path that `runContainer` sets.
-    await ensureCaTrustedImage(name, tag);
-    return { tag, buildSteps };
 }
 /**
  * Build a derivative image on top of `tag` that copies the spectest
@@ -2294,20 +2403,39 @@ function invokeFakeHelper(fakeName, member, fn, thisArg, callArgs) {
             error: errMessage(err),
         }, resv);
     };
+    // A helper call is ONE step. Whatever the fake does inside it — a fetch to
+    // deliver a webhook, a call to its own API — is the fake's plumbing, not
+    // something the test did, and it would otherwise land on the timeline as
+    // an `http` step the test never made. The built-in `email()` helpers
+    // already pause around their internal polls by hand for exactly this
+    // reason (`components/email.ts`); doing it here gives every user-authored
+    // fake the same contract without having to know about it.
+    //
+    // The pause spans the helper's `await`s, so genuinely concurrent test work
+    // (`Promise.all([helper(), ctx.fetch(…)])`) loses its events too. That is
+    // the same trade `email()` has always made, and sequential test code — all
+    // of it, in practice — is unaffected.
+    pauseRecording();
     let result;
     try {
         result = fn.apply(thisArg, args);
     }
     catch (err) {
+        resumeRecording();
         recordError(err);
         throw err;
     }
     if (result instanceof Promise) {
-        return result.then(recordResult, (err) => {
+        return result.then((value) => {
+            resumeRecording();
+            return recordResult(value);
+        }, (err) => {
+            resumeRecording();
             recordError(err);
             throw err;
         });
     }
+    resumeRecording();
     return recordResult(result);
 }
 /** Record a fake-helper call's render annotation as a child of the call's
@@ -2337,6 +2465,19 @@ function recordAnnotationChild(fakeName, member, annotation, durationMs, parentS
                 durationMs,
             });
             break;
+        case "chat":
+            // A chat has no event kind of its own: it describes itself in
+            // presentation terms (title + blocks), which is the seam a new step
+            // type is supposed to use. `kind` stays an opaque grouping label.
+            recordStep({
+                kind: "chat",
+                parentSeq,
+                annotation: true,
+                title: annotation.title ?? `${fakeName}.${member}`,
+                blocks: annotation.blocks,
+                durationMs,
+            });
+            break;
     }
 }
 function errMessage(err) {

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { Carrier, Wrapped, WrappedObject, WrappedArray, WrappedResponse, Pr
 import type { Provenanced, SpectestFetch, Wrapped } from "./inspect.js";
 export { field } from "./inspect.js";
 export { annotate } from "./annotate.js";
-export type { Annotated, AnnotationKind, AnnotationOptions, EmailAnnotation, } from "./annotate.js";
+export type { Annotated, AnnotationKind, AnnotationOptions, ChatAnnotation, ChatMessageAnnotation, EmailAnnotation, } from "./annotate.js";
 import type { Annotated } from "./annotate.js";
 export { SQL, type SqlClient, type SqlOptions } from "./sql.js";
 export { RedisClient, type RedisClientLike, type RedisOptions } from "./redis.js";

package/dist/index.js

@@ -17,11 +17,12 @@ import { adoptNullishTag, readRaw, readTag } from "./inspect.js";
 // `unwrap(x)` free function. See the `.unwrap()` discipline section of `spectest docs`.
 export { field } from "./inspect.js";
 // Render annotations for fake helpers: a helper returns
-// `annotate(value, "email", { … })` when its value is an email, and the
-// fake step it records gains a nested `email` event — the same one the
-// built-in `email()` component records — so the step's panel can draw the
-// mail, tabbing to the raw JSON value. The kind picks the options' type, and the test still gets
-// the raw value, with the raw value's type — see `annotate.ts`.
+// `annotate(value, "email", { … })` or `annotate(value, "chat", { … })`
+// when its value is one of those, and the fake step it records gains a
+// nested event drawing it — an email mail-client style, a conversation as
+// bubbles — which the step's panel leads with, tabbing to the raw JSON
+// value. The kind picks the options' type, and the test still gets the raw
+// value, with the raw value's type — see `annotate.ts`.
 export { annotate } from "./annotate.js";
 // Instrumented client primitives — drop-in replacements for Bun's native
 // clients that record each operation on the test event log and return their

package/dist/recorder.d.ts

@@ -1,4 +1,4 @@
-export type TestEvent = ExecEvent | AssertionEvent | HttpEvent | KubeEvent | BrowserEvent | DbEvent | RedisEvent | S3Event | TerminalEvent | TerminalStepEvent | WaitEvent | FakeEvent | EnvEvent | EmailEvent;
+export type TestEvent = ExecEvent | AssertionEvent | HttpEvent | KubeEvent | BrowserEvent | DbEvent | RedisEvent | S3Event | TerminalEvent | TerminalStepEvent | WaitEvent | FakeEvent | EnvEvent | EmailEvent | StepEvent;
 interface BaseEvent {
     /** Order of *start* within the test. Reserved when an op begins (see
      *  `reserveEvent`), so an op whose nested children finish — and record —
@@ -557,6 +557,74 @@ export declare function recordTerminal(ev: Omit<TerminalEvent, "seq" | "tOffsetM
 export declare function recordTerminalStep(ev: Omit<TerminalStepEvent, "seq" | "tOffsetMs" | "kind">, reservation?: EventReservation): number | undefined;
 export declare function recordFake(ev: Omit<FakeEvent, "seq" | "tOffsetMs" | "kind">, reservation?: EventReservation): number | undefined;
 export declare function recordEnv(ev: Omit<EnvEvent, "seq" | "tOffsetMs" | "kind">, reservation?: EventReservation): number | undefined;
+/**
+ * One block of step detail, in the dashboard's presentation vocabulary
+ * (`crates/control-plane/src/web/blocks.rs`, which owns the closed set).
+ * A server that predates a block type skips it rather than failing, so a
+ * newer SDK's step degrades to the blocks the server knows.
+ */
+export type StepBlock = {
+    type: "text";
+    text: string;
+} | {
+    type: "code";
+    code: string;
+    lang?: string;
+    label?: string;
+} | {
+    type: "json";
+    value: unknown;
+    label?: string;
+} | {
+    type: "kv";
+    rows: {
+        label: string;
+        value?: string;
+        error?: boolean;
+    }[];
+} | {
+    type: "table";
+    columns: string[];
+    rows: unknown[][];
+} | {
+    type: "htmlSandbox";
+    html: string;
+    label?: string;
+} | {
+    type: "chat";
+    messages: ChatBlockMessage[];
+    label?: string;
+};
+/** One message of a `chat` block. */
+export interface ChatBlockMessage {
+    /** Who sent it. The transcript is drawn as the end user would see it, so
+     *  `self` (the end user's own messages) sits on the right and `other` on
+     *  the left. */
+    side?: "self" | "other";
+    text?: string;
+    /** Arrived in *this* step: drawn with an entrance animation. Only the
+     *  producer knows this, so only the producer sets it. */
+    new?: boolean;
+}
+/**
+ * A step that describes itself in presentation terms — a title plus an
+ * ordered list of blocks — instead of as one of the recorder's hard-coded
+ * kinds. This is the seam that lets a component ship a new kind of step
+ * with no server change: `kind` stays an opaque grouping/diff-alignment
+ * label and never decides how the step draws.
+ */
+export interface StepEvent extends BaseEvent {
+    /** Opaque. Groups the step and aligns it across runs; never matched on
+     *  to pick a renderer. */
+    kind: string;
+    /** The step's one-line summary in the timeline. */
+    title: string;
+    blocks?: StepBlock[];
+    status?: "passed" | "failed" | "error";
+    durationMs?: number;
+    error?: string;
+}
+export declare function recordStep(ev: Omit<StepEvent, "seq" | "tOffsetMs">, reservation?: EventReservation): number | undefined;
 export declare function recordEmail(ev: Omit<EmailEvent, "seq" | "tOffsetMs" | "kind">, reservation?: EventReservation): number | undefined;
 /**
  * Recorded once per `ctx.poll(...)` call. Stands in for the suppressed

package/dist/recorder.js

@@ -49,14 +49,24 @@ class Recorder {
             this.events.length = toLen;
         }
     }
-    /** Stamp `parentSeq` onto every event at index >= `startIdx`. Used
-     *  by `ctx.poll` to group the kept iteration's events under the
-     *  resulting wait event. */
+    /** Stamp `parentSeq` onto every event at index >= `startIdx` that isn't
+     *  already grouped under something else. Used by `ctx.poll` to group the
+     *  kept iteration's events under the resulting wait event.
+     *
+     *  An event that already carries a `parentSeq` keeps it: it belongs to a
+     *  step *inside* this one, and re-parenting it here would flatten the
+     *  nesting the UI renders from. The case that made this matter is a fake
+     *  helper called in a poll predicate — its `annotate(...)` child is the
+     *  fake call's value, and stamping the wait's seq over it made the WAIT
+     *  render as an email/chat while the fake call showed raw JSON. Its
+     *  ancestor is still the wait, one level up through the fake event. */
     markChildren(startIdx, parentSeq) {
         for (let i = startIdx; i < this.events.length; i++) {
             const ev = this.events[i];
             if (ev.seq === parentSeq)
                 continue;
+            if (ev.parentSeq !== undefined)
+                continue;
             ev.parentSeq = parentSeq;
         }
     }
@@ -178,6 +188,9 @@ export function recordFake(ev, reservation) {
 export function recordEnv(ev, reservation) {
     return active() ? current.push({ kind: "env", ...ev }, reservation) : undefined;
 }
+export function recordStep(ev, reservation) {
+    return active() ? current.push(ev, reservation) : undefined;
+}
 export function recordEmail(ev, reservation) {
     return active() ? current.push({ kind: "email", ...ev }, reservation) : undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/annotate.ts

@@ -33,8 +33,10 @@
 import { deepUnwrap } from "./inspect.js";
 import {
   truncateUtf8,
+  type ChatBlockMessage,
   type EmailEventMessage,
   type EmailEventSummary,
+  type StepBlock,
 } from "./recorder.js";
 
 /**
@@ -74,6 +76,9 @@ export interface AnnotationOptions {
   /** Draw the value as an email — one message, or a list of them for a
    *  mailbox listing. See {@link EmailAnnotation}. */
   email: EmailAnnotation | readonly EmailAnnotation[];
+  /** Draw the value as a chat transcript — bubbles by role, with the
+   *  messages that arrived in this call marked. See {@link ChatAnnotation}. */
+  chat: ChatAnnotation | readonly ChatMessageAnnotation[];
 }
 
 /** The kinds {@link annotate} accepts. */
@@ -85,7 +90,9 @@ export type AnnotationKind = keyof AnnotationOptions;
  * which needn't be the annotation kind's name, since an annotation names
  * what the value *is* and the event names how it's drawn.
  */
-export type RenderAnnotation = {
+export type RenderAnnotation = EmailRenderAnnotation | ChatRenderAnnotation;
+
+type EmailRenderAnnotation = {
   kind: "email";
   /** Single-message ops. */
   message?: EmailEventMessage;
@@ -95,6 +102,15 @@ export type RenderAnnotation = {
   count?: number;
 };
 
+/** A chat lowers to a step that describes itself in presentation terms — a
+ *  title plus blocks — rather than to a kind of its own: `blocks.rs` owns
+ *  the drawing vocabulary, and a transcript is one of its block types. */
+type ChatRenderAnnotation = {
+  kind: "chat";
+  title?: string;
+  blocks: StepBlock[];
+};
+
 /**
  * The email fields to render. Every one is optional — pass what the fake
  * has. Addresses take a single string or a list.
@@ -117,6 +133,46 @@ export interface EmailAnnotation {
   text?: string;
 }
 
+/**
+ * A conversation to draw as chat bubbles.
+ *
+ * Two sides and their text, which is all a transcript needs to read as one.
+ * It is drawn from the end user's point of view — their own messages on the
+ * right, the other party's on the left.
+ * Pass the messages alone (`annotate(v, "chat", messages)`), or this object
+ * when the thread has an identity worth showing. With no options at all the
+ * value itself is read as the message list.
+ */
+export interface ChatAnnotation {
+  messages: readonly ChatMessageAnnotation[];
+  /**
+   * The thread's identity — a phone number, a channel, whoever is on the
+   * other end — shown as a header over the bubbles. Optional: a fake with
+   * one conversation has nothing useful to put here, and the transcript
+   * reads fine without it.
+   */
+  title?: string;
+}
+
+/** One turn of a {@link ChatAnnotation}. */
+export interface ChatMessageAnnotation {
+  /**
+   * Who sent it. A transcript is drawn the way the **end user** would see
+   * it on their own screen, so `self` is the end user's own messages — the
+   * person using the app under test — and sits on the right; `other` is
+   * whoever they are talking to and sits on the left.
+   */
+  side: "self" | "other";
+  text: string;
+  /**
+   * This message arrived in *this* call: it slides in when the step opens,
+   * and again whenever it is reopened. Only the fake knows which turns are new —
+   * the dashboard sees one call, not the conversation's history — so it is
+   * the fake that marks them.
+   */
+  new?: boolean;
+}
+
 /** Listing rows carried on the event. The returned value is never capped. */
 const LIST_CAP = 50;
 
@@ -173,6 +229,8 @@ function lower<K extends AnnotationKind>(
   switch (kind) {
     case "email":
       return lowerEmail(options as AnnotationOptions["email"] | undefined, value);
+    case "chat":
+      return lowerChat(options as AnnotationOptions["chat"] | undefined, value);
     default:
       // Unreachable while `kind` is a key of AnnotationOptions; a kind added
       // to that interface without a case here lands on this line.
@@ -230,6 +288,51 @@ function fields(v: unknown): Record<string, unknown> {
     : {};
 }
 
+const NO_MESSAGES =
+  'annotate(value, "chat"): nothing to render — no messages found on the ' +
+  "value. Pass them explicitly, e.g. " +
+  'annotate(value, "chat", value.turns.map((t) => ({ side: t.fromCustomer ? "self" : "other", text: t.body }))).';
+
+function lowerChat(
+  options: AnnotationOptions["chat"] | undefined,
+  value: unknown,
+): RenderAnnotation {
+  const source: unknown = deepUnwrap(options ?? value);
+  let list: unknown;
+  let title: string | undefined;
+  if (Array.isArray(source)) {
+    list = source;
+  } else {
+    const bag = fields(source);
+    list = bag.messages;
+    title = text(bag.title) || undefined;
+  }
+  // An empty conversation is a real state (nothing said yet) and renders as
+  // one; a value with no `messages` at all is the author's mistake.
+  if (!Array.isArray(list)) throw new Error(NO_MESSAGES);
+  const messages = list.map((m) => chatMessageOf(fields(m)));
+  // The title travels twice on purpose: as the step's own summary, and as
+  // the transcript's header — the annotated view renders the blocks alone,
+  // so a title carried only on the step would never be seen.
+  return {
+    kind: "chat",
+    title,
+    blocks: [{ type: "chat", messages, ...(title ? { label: title } : {}) }],
+  };
+}
+
+function chatMessageOf(src: Record<string, unknown>): ChatBlockMessage {
+  const msg: ChatBlockMessage = {};
+  // Anything that isn't the end user's own message is drawn as the other
+  // party's, rather than a turn being dropped for a typo.
+  if (text(src.side) === "self") msg.side = "self";
+  else msg.side = "other";
+  const body = text(src.text);
+  if (body) msg.text = truncateUtf8(body).value;
+  if (src.new === true) msg.new = true;
+  return msg;
+}
+
 function messageOf(src: Record<string, unknown>): EmailEventMessage {
   const msg: EmailEventMessage = {};
   const from = text(src.from);

package/src/daemon.ts

@@ -114,17 +114,20 @@ import type { Mobile, MobileApp } from "./mobile.js";
 import { openTerminal } from "./terminal.js";
 import { readAnnotation, type RenderAnnotation } from "./annotate.js";
 import {
+  pauseRecording,
   recordEmail,
   recordEnv,
   recordExec,
   recordFake,
   recordHttp,
+  recordStep,
   recordTerminal,
   recordWait,
   reserveEvent,
   recorderEventCount,
   recorderMarkChildren,
   recorderTruncate,
+  resumeRecording,
   startRecording,
   stopRecording,
   truncateUtf8,
@@ -1113,17 +1116,141 @@ async function prepareServiceImage(
   return buildServiceImage(svc.name, image, tag);
 }
 
+/**
+ * What the folded CA step prints when it could not write the trust store
+ * at all — the one outcome that still needs {@link ensureCaTrustedImage},
+ * which can take root for the write.
+ *
+ * The step assembles this prefix from a shell variable so that the marker
+ * appears ONLY in the step's output. BuildKit echoes each instruction into
+ * the same log verbatim, so a marker written literally in the RUN would
+ * match on every build whether or not the step ever printed it.
+ */
+const CA_FOLD_UNWRITABLE = "[spectest-ca] trust store not writable";
+
+/**
+ * The CA-trust steps as a suffix appended to a dockerfile service's OWN
+ * Dockerfile, so one build produces the finished image instead of a build
+ * plus a derivative rebuild ({@link ensureCaTrustedImage}) per service.
+ * Returns null when there is no CA to layer, or when the PEM can't be
+ * quoted — the caller then falls back to the derivative build.
+ *
+ * The PEM is written INLINE rather than `COPY`d: the build context is
+ * `/workspace` under a per-service ignore file that the project itself
+ * contributes to (a `**` line with re-includes is the common idiom), and
+ * a context path we don't control is a context path that can be excluded.
+ * printf needs nothing but a shell.
+ *
+ * Two rules make this safe to bolt onto user code. It must never fail the
+ * build — every branch ends in an echo, so the RUN exits 0 whatever the
+ * image lacks — and it must never change the image, beyond the trust
+ * store: notably no `USER root`, since we cannot know statically what
+ * user to hand back. An image that declares a non-root user therefore
+ * fails to write and is finished by the derivative build, which inspects
+ * the built image and can escalate properly.
+ */
+async function caTrustSuffix(): Promise<string | null> {
+  if (!existsSync(CA_PATH)) return null;
+  const pem = (await fs.readFile(CA_PATH, "utf8")).trim();
+  // A quote in the PEM would break out of the shell quoting below. PEM is
+  // base64 and dashes, so this is a guard, not a case we expect.
+  if (!pem || pem.includes("'")) return null;
+  const args = pem
+    .split("\n")
+    .map((l) => `'${l.trimEnd()}'`)
+    .join(" ");
+  const dst = "/usr/local/share/ca-certificates/spectest-ca.crt";
+  return `
+# spectest: trust the environment's root CA. Appended by the harness —
+# not part of the project's Dockerfile.
+RUN P='[spectest-ca]'; \\
+    mkdir -p /usr/local/share/ca-certificates 2>/dev/null; \\
+    if printf '%s\\n' ${args} > ${dst} 2>/dev/null; then \\
+      if command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates >/dev/null 2>&1; then \\
+        echo "$P trusted via update-ca-certificates"; \\
+      elif command -v update-ca-trust >/dev/null 2>&1 && cp ${dst} /etc/pki/ca-trust/source/anchors/spectest-ca.crt && update-ca-trust extract >/dev/null 2>&1; then \\
+        echo "$P trusted via update-ca-trust"; \\
+      else \\
+        echo "$P no system CA trust tool in image; env-var trust only"; \\
+      fi; \\
+    else \\
+      echo "$P trust store not writable by this image's user"; \\
+    fi
+`;
+}
+
+/**
+ * Build a dockerfile service's image.
+ *
+ * The CA-trust layer is folded into THIS build when it can be (see
+ * {@link caTrustSuffix}), so a service costs one image build and one
+ * export rather than two. The derivative build stays as the fallback for
+ * everything the folded form can't serve: an image with no shell to run
+ * the step (distroless, scratch — the appended RUN can't execute, so the
+ * build fails and we rebuild the project's Dockerfile untouched), and an
+ * image that declares a non-root user (the step runs as that user and
+ * can't write the trust store).
+ */
 async function buildServiceImage(
   name: string,
   image: { content: string; exclude?: readonly string[] },
   tag: string,
 ): Promise<{ tag: string; buildSteps?: BuildStep[] }> {
+  const suffix = await caTrustSuffix();
+  let attempt = await runServiceBuild(name, image, tag, suffix);
+  if (!attempt.ok && suffix) {
+    // Our step must not be able to break a project's build.
+    // eslint-disable-next-line no-console
+    console.warn(
+      `[ca-trust] folded CA step could not run in ${name}'s image; rebuilding without it`,
+    );
+    attempt = await runServiceBuild(name, image, tag, null);
+  }
+  if (!attempt.ok) {
+    progressService(name, { status: "failed" });
+    throw new Error(`docker build for ${name} failed:\n${attempt.log}`);
+  }
+  // The derivative build is still needed for the one thing the folded step
+  // cannot do: write the trust store of an image that does not run as
+  // root. That is decided on the IMAGE, not on the build log — a CACHED
+  // layer prints nothing, so a log-only check would quietly stop
+  // re-applying the moment BuildKit had the layer. The log covers the
+  // rarer case of a root image whose /etc is read-only.
+  //
+  // An image with no trust tool at all needs nothing further: the
+  // derivative build would reach the same dead end, and `runContainer`'s
+  // env vars are the fallback either way.
+  const needsDerivative =
+    !attempt.folded ||
+    attempt.log.includes(CA_FOLD_UNWRITABLE) ||
+    !(await imageRunsAsRoot(tag));
+  if (needsDerivative) await ensureCaTrustedImage(name, tag);
+  return { tag, buildSteps: attempt.buildSteps };
+}
+
+/** Whether `tag`'s declared `USER` is root (or unset, which means root). */
+async function imageRunsAsRoot(tag: string): Promise<boolean> {
+  const user = (
+    await docker(["image", "inspect", "--format", "{{.Config.User}}", tag], 60_000)
+  ).stdout.trim();
+  return user === "" || user === "root" || user === "0";
+}
+
+async function runServiceBuild(
+  name: string,
+  image: { content: string; exclude?: readonly string[] },
+  tag: string,
+  caSuffix: string | null,
+): Promise<{ ok: boolean; folded: boolean; log: string; buildSteps?: BuildStep[] }> {
   let buildSteps: BuildStep[] | undefined;
   {
+    const content = caSuffix
+      ? `${image.content.replace(/\n*$/, "\n")}${caSuffix}`
+      : image.content;
     const dfDir = path.join(WORKSPACE, ".spectest", "services", name);
     await fs.mkdir(dfDir, { recursive: true });
     const dfPath = path.join(dfDir, "Dockerfile");
-    await fs.writeFile(dfPath, image.content);
+    await fs.writeFile(dfPath, content);
     // Per-service ignore: BuildKit resolves `<Dockerfile>.dockerignore`
     // (next to the Dockerfile) in preference to the context root's
     // `.dockerignore`, so this build sees the defaults, the project's own
@@ -1183,11 +1310,11 @@ async function buildServiceImage(
         });
       }
     });
+    const log = `${build.stderr.trim()}\n${build.stdout.trim()}`;
     if (build.code !== 0) {
-      progressService(name, { status: "failed" });
-      throw new Error(
-        `docker build for ${name} failed:\n${build.stderr.trim()}\n${build.stdout.trim()}`,
-      );
+      // The caller decides whether this is fatal: a failure with the CA
+      // step appended is retried without it before anyone hears about it.
+      return { ok: false, folded: caSuffix !== null, log };
     }
     if (useBuildKit) {
       // Keep only the slowest dozen steps ≥1s — enough to profile, small
@@ -1196,14 +1323,8 @@ async function buildServiceImage(
         .filter((s) => s.secs >= 1)
         .slice(0, 12);
     }
+    return { ok: true, folded: caSuffix !== null, log, buildSteps };
   }
-  // Layer the spectest CA into the image's system trust store so apps
-  // that read the system bundle (Go, Java, CLIs that don't honour the
-  // SSL_CERT_FILE env vars) accept HTTPS to fakes. Best-effort: images
-  // without `update-ca-certificates` / `update-ca-trust` (distroless,
-  // scratch) fall through to the env-var path that `runContainer` sets.
-  await ensureCaTrustedImage(name, tag);
-  return { tag, buildSteps };
 }
 
 /**
@@ -2762,19 +2883,41 @@ function invokeFakeHelper(
     }, resv);
   };
 
+  // A helper call is ONE step. Whatever the fake does inside it — a fetch to
+  // deliver a webhook, a call to its own API — is the fake's plumbing, not
+  // something the test did, and it would otherwise land on the timeline as
+  // an `http` step the test never made. The built-in `email()` helpers
+  // already pause around their internal polls by hand for exactly this
+  // reason (`components/email.ts`); doing it here gives every user-authored
+  // fake the same contract without having to know about it.
+  //
+  // The pause spans the helper's `await`s, so genuinely concurrent test work
+  // (`Promise.all([helper(), ctx.fetch(…)])`) loses its events too. That is
+  // the same trade `email()` has always made, and sequential test code — all
+  // of it, in practice — is unaffected.
+  pauseRecording();
   let result: unknown;
   try {
     result = fn.apply(thisArg, args);
   } catch (err) {
+    resumeRecording();
     recordError(err);
     throw err;
   }
   if (result instanceof Promise) {
-    return result.then(recordResult, (err) => {
-      recordError(err);
-      throw err;
-    });
+    return result.then(
+      (value) => {
+        resumeRecording();
+        return recordResult(value);
+      },
+      (err) => {
+        resumeRecording();
+        recordError(err);
+        throw err;
+      },
+    );
   }
+  resumeRecording();
   return recordResult(result);
 }
 
@@ -2811,6 +2954,19 @@ function recordAnnotationChild(
         durationMs,
       });
       break;
+    case "chat":
+      // A chat has no event kind of its own: it describes itself in
+      // presentation terms (title + blocks), which is the seam a new step
+      // type is supposed to use. `kind` stays an opaque grouping label.
+      recordStep({
+        kind: "chat",
+        parentSeq,
+        annotation: true,
+        title: annotation.title ?? `${fakeName}.${member}`,
+        blocks: annotation.blocks,
+        durationMs,
+      });
+      break;
   }
 }
 

package/src/index.ts

@@ -35,16 +35,19 @@ import type { OpTag, Provenanced, SpectestFetch, Wrapped } from "./inspect.js";
 export { field } from "./inspect.js";
 
 // Render annotations for fake helpers: a helper returns
-// `annotate(value, "email", { … })` when its value is an email, and the
-// fake step it records gains a nested `email` event — the same one the
-// built-in `email()` component records — so the step's panel can draw the
-// mail, tabbing to the raw JSON value. The kind picks the options' type, and the test still gets
-// the raw value, with the raw value's type — see `annotate.ts`.
+// `annotate(value, "email", { … })` or `annotate(value, "chat", { … })`
+// when its value is one of those, and the fake step it records gains a
+// nested event drawing it — an email mail-client style, a conversation as
+// bubbles — which the step's panel leads with, tabbing to the raw JSON
+// value. The kind picks the options' type, and the test still gets the raw
+// value, with the raw value's type — see `annotate.ts`.
 export { annotate } from "./annotate.js";
 export type {
   Annotated,
   AnnotationKind,
   AnnotationOptions,
+  ChatAnnotation,
+  ChatMessageAnnotation,
   EmailAnnotation,
 } from "./annotate.js";
 import type { Annotated } from "./annotate.js";

package/src/recorder.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  recordEmail,
+  recordFake,
+  recordWait,
+  recorderEventCount,
+  recorderMarkChildren,
+  reserveEvent,
+  startRecording,
+  stopRecording,
+} from "./recorder.js";
+
+describe("markChildren", () => {
+  test("groups a poll's kept iteration under the wait", () => {
+    startRecording();
+    const from = recorderEventCount();
+    recordFake({ fake: "resend", member: "lastEmailTo", args: [], durationMs: 1 });
+    const wait = recordWait({ description: "the mail arrives", attempts: 1, durationMs: 2, passed: true })!;
+    recorderMarkChildren(from, wait);
+    const events = stopRecording();
+
+    const fake = events.find((e) => e.kind === "fake")!;
+    expect(fake.parentSeq).toBe(wait);
+    // The wait never becomes its own child.
+    expect(events.find((e) => e.kind === "wait")!.parentSeq).toBeUndefined();
+  });
+
+  // A fake helper's `annotate(...)` child is that call's value, so it stays a
+  // child of the FAKE event even when the call happened inside a poll
+  // predicate. Overwriting it with the wait's seq made the wait itself render
+  // as the email, with the fake call showing raw JSON below it.
+  test("keeps an already-grouped event under its own parent", () => {
+    startRecording();
+    const from = recorderEventCount();
+    // The call's own slot is reserved first, exactly as invokeFakeHelper does.
+    const resv = reserveEvent();
+    const fakeSeq = recordFake(
+      { fake: "resend", member: "lastEmailTo", args: [], durationMs: 1 },
+      resv,
+    )!;
+    recordEmail({
+      parentSeq: fakeSeq,
+      annotation: true,
+      service: "resend",
+      op: "lastEmailTo",
+      message: { subject: "Ditt formulär" },
+      durationMs: 1,
+    });
+    const wait = recordWait({ description: "the mail arrives", attempts: 1, durationMs: 2, passed: true })!;
+    recorderMarkChildren(from, wait);
+    const events = stopRecording();
+
+    expect(events.find((e) => e.kind === "fake")!.parentSeq).toBe(wait);
+    expect(events.find((e) => e.kind === "email")!.parentSeq).toBe(fakeSeq);
+  });
+});

package/src/recorder.ts

@@ -26,7 +26,11 @@ export type TestEvent =
   | WaitEvent
   | FakeEvent
   | EnvEvent
-  | EmailEvent;
+  | EmailEvent
+  // Open `kind`, so it goes last: narrowing the union by a literal kind
+  // still reaches the specific member above, and this one carries anything
+  // a component describes in presentation terms.
+  | StepEvent;
 
 interface BaseEvent {
   /** Order of *start* within the test. Reserved when an op begins (see
@@ -637,13 +641,22 @@ class Recorder {
     }
   }
 
-  /** Stamp `parentSeq` onto every event at index >= `startIdx`. Used
-   *  by `ctx.poll` to group the kept iteration's events under the
-   *  resulting wait event. */
+  /** Stamp `parentSeq` onto every event at index >= `startIdx` that isn't
+   *  already grouped under something else. Used by `ctx.poll` to group the
+   *  kept iteration's events under the resulting wait event.
+   *
+   *  An event that already carries a `parentSeq` keeps it: it belongs to a
+   *  step *inside* this one, and re-parenting it here would flatten the
+   *  nesting the UI renders from. The case that made this matter is a fake
+   *  helper called in a poll predicate — its `annotate(...)` child is the
+   *  fake call's value, and stamping the wait's seq over it made the WAIT
+   *  render as an email/chat while the fake call showed raw JSON. Its
+   *  ancestor is still the wait, one level up through the fake event. */
   markChildren(startIdx: number, parentSeq: number): void {
     for (let i = startIdx; i < this.events.length; i++) {
       const ev = this.events[i]!;
       if (ev.seq === parentSeq) continue;
+      if (ev.parentSeq !== undefined) continue;
       ev.parentSeq = parentSeq;
     }
   }
@@ -819,6 +832,59 @@ export function recordEnv(
   return active() ? current!.push({ kind: "env", ...ev }, reservation) : undefined;
 }
 
+/**
+ * One block of step detail, in the dashboard's presentation vocabulary
+ * (`crates/control-plane/src/web/blocks.rs`, which owns the closed set).
+ * A server that predates a block type skips it rather than failing, so a
+ * newer SDK's step degrades to the blocks the server knows.
+ */
+export type StepBlock =
+  | { type: "text"; text: string }
+  | { type: "code"; code: string; lang?: string; label?: string }
+  | { type: "json"; value: unknown; label?: string }
+  | { type: "kv"; rows: { label: string; value?: string; error?: boolean }[] }
+  | { type: "table"; columns: string[]; rows: unknown[][] }
+  | { type: "htmlSandbox"; html: string; label?: string }
+  | { type: "chat"; messages: ChatBlockMessage[]; label?: string };
+
+/** One message of a `chat` block. */
+export interface ChatBlockMessage {
+  /** Who sent it. The transcript is drawn as the end user would see it, so
+   *  `self` (the end user's own messages) sits on the right and `other` on
+   *  the left. */
+  side?: "self" | "other";
+  text?: string;
+  /** Arrived in *this* step: drawn with an entrance animation. Only the
+   *  producer knows this, so only the producer sets it. */
+  new?: boolean;
+}
+
+/**
+ * A step that describes itself in presentation terms — a title plus an
+ * ordered list of blocks — instead of as one of the recorder's hard-coded
+ * kinds. This is the seam that lets a component ship a new kind of step
+ * with no server change: `kind` stays an opaque grouping/diff-alignment
+ * label and never decides how the step draws.
+ */
+export interface StepEvent extends BaseEvent {
+  /** Opaque. Groups the step and aligns it across runs; never matched on
+   *  to pick a renderer. */
+  kind: string;
+  /** The step's one-line summary in the timeline. */
+  title: string;
+  blocks?: StepBlock[];
+  status?: "passed" | "failed" | "error";
+  durationMs?: number;
+  error?: string;
+}
+
+export function recordStep(
+  ev: Omit<StepEvent, "seq" | "tOffsetMs">,
+  reservation?: EventReservation,
+): number | undefined {
+  return active() ? current!.push(ev, reservation) : undefined;
+}
+
 export function recordEmail(
   ev: Omit<EmailEvent, "seq" | "tOffsetMs" | "kind">,
   reservation?: EventReservation,