@specific.dev/spectest 0.81.1 → 0.83.0

package/dist/coverage.js

@@ -13,11 +13,11 @@
 //                a report in the directory.
 //
 // After every adapter ran, the harness reads the directory the same way
-// it does for `coverage: true`: at least one well-formed report (lcov or
-// V8 JSON), shipped verbatim. Nothing is converted in the VM: `node()`
-// compacts its V8 dumps (the app's own scripts, each source map once per
-// branch) and ships them as they are. The control plane derives what it
-// needs from the stored bytes, off the test run.
+// it does for `coverage: true`: at least one well-formed report (lcov,
+// V8 JSON, or a node() script record), shipped verbatim. Nothing is
+// converted, parsed or looked up in the VM: `node()`'s hook collects
+// inside the process and writes what ships. The control plane derives
+// what it needs from the stored bytes, off the test run.
 //
 // Imported from `@specific.dev/spectest/coverage`. The three shipped
 // adapters: `node()` (V8 JSON through a hook spectest mounts), `browser()`
@@ -26,7 +26,6 @@
 //
 //   import * as coverage from "@specific.dev/spectest/coverage";
 //   coverage: { adapters: [coverage.node(), coverage.browser()] }
-import { createHash } from "node:crypto";
 import { harvestAllBrowserCoverage, takeBrowserCoverageReports } from "./browser-coverage.js";
 import { COVERAGE_CONTAINER_DIR } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR };
@@ -37,11 +36,6 @@ export const NODE_COVERAGE_EMPTY_REPORT = "coverage-spectest-empty.json";
 /** Prefix of the per-process sockets the node hook answers on, relative
  *  to the coverage dir: `.ctl-<pid>`. */
 export const NODE_COVERAGE_SOCKET_PREFIX = ".ctl-";
-/** Key of the content hash (`sha256:<hex>`) a shipped `source-map-cache`
- *  entry carries, and key of the stub that stands in for an entry that
- *  shipped earlier on the same branch. See {@link compactV8Document}. */
-export const SOURCE_MAP_HASH_KEY = "spectestHash";
-export const SOURCE_MAP_REF_KEY = "spectestRef";
 /** The `reports` mode of a `coverage` value, for the reports no adapter
  *  wrote (the program's own, a `command`'s). */
 export function coverageReportsMode(cov) {
@@ -119,89 +113,305 @@ export function appendEnvFlag(env, name, value) {
     return { ...env, [name]: prior ? `${prior} ${value}` : value };
 }
 // ── node ──────────────────────────────────────────────────────────
+/** Env var the hook reads: the coverage directory inside the container. */
+export const NODE_COVERAGE_DIR_ENV = "SPECTEST_COVERAGE_DIR";
+/** Subdirectory of the coverage dir where the hook writes one record per
+ *  script (`scripts/<id>.json`, {@link NODE_COVERAGE_HOOK}). Shipped
+ *  once, like a dump. */
+export const NODE_COVERAGE_SCRIPTS_SUBDIR = "scripts";
+/** Hidden subdirectory holding one empty marker per script record ever
+ *  written on this branch. The hook's "written already?" check, which
+ *  must survive the harness shipping and removing the record; hidden,
+ *  so the harness never reads it. */
+export const NODE_COVERAGE_MARKERS_SUBDIR = ".spectest/scripts";
+/** Name prefix of the dumps the hook writes: `node-<pid>-<thread>-<ms>-<n>.json`. */
+export const NODE_COVERAGE_DUMP_PREFIX = "node-";
 /**
- * The hook `node()` mounts and `--require`s into every node process of
- * the container. Node writes V8 coverage JSON into `NODE_V8_COVERAGE`
- * when a process exits; a long-lived server never exits, so the hook
- * binds a Unix socket in the coverage directory and calls
- * `v8.takeCoverage()` on request. **Every** process binds its own socket
- * (`.ctl-<pid>`) — there is no "first process owns it" rule, because the
- * first node process is often a wrapper (`pnpm exec`, the `tsx` binary,
- * `npm run`) whose child is the real server; a single socket on the
- * wrapper dumped the wrapper and silently never the server (reported by
- * a user 2026-08-27). At capture spectest asks every live socket and
- * unlinks the stale ones. Unref'd, so a short-lived process still exits.
- * Main thread only: a worker thread inherits `NODE_OPTIONS`, and tsx's
- * ESM loader thread bound the shared per-pid path last, so every
- * `--import tsx` server answered with the loader's coverage — the app's
- * main thread was never dumped (found in the same user's first full run).
- * No signal is used: signals are claimed by frameworks (SIGUSR2 stops a
- * Temporal worker, restarts nodemon), a socket is nobody's.
+ * The hook `node()` mounts at {@link NODE_COVERAGE_HOOK_PATH} and
+ * `--require`s into every node process of the service. **It is the
+ * collector**: nothing outside the process reads, converts or looks
+ * anything up. Runs in every thread (a worker thread inherits
+ * `NODE_OPTIONS`); reads one env var, {@link NODE_COVERAGE_DIR_ENV}; uses
+ * node built-ins only, so it runs in any image that runs node.
+ *
+ * What it does:
+ *
+ * - Starts V8 precise (block, counted) coverage through the in-process
+ *   inspector session. `NODE_V8_COVERAGE` is **not** set: Node would then
+ *   write everything the process loaded at every exit — `node:`
+ *   internals, every `node_modules` file, and the whole source map of
+ *   every script that carries a `sourceMappingURL` comment, with or
+ *   without `--enable-source-maps`. For a bundled CLI that was 12 MB per
+ *   invocation, inside the test's own time, parsed again at capture.
+ * - **Takes** on request — the main thread binds a Unix socket
+ *   `.ctl-<pid>` in the coverage directory and takes on `dump\n`; every
+ *   process binds its own (the first node process is often a wrapper,
+ *   `pnpm exec`, `tsx`, `npm run`) — and in every thread's `exit`
+ *   handler, which is how a short-lived CLI and a worker thread report.
+ *   The in-process session answers synchronously, so the exit handler
+ *   has the result before the process is gone. A take resets V8's
+ *   counters: every dump is the delta since the previous take. No
+ *   signal is used: signals are claimed by frameworks (SIGUSR2 stops a
+ *   Temporal worker, restarts nodemon), a socket is nobody's.
+ * - Writes a **dump** `node-<pid>-<thread>-<ms>-<n>.json`: the app's own
+ *   scripts (`file://`, outside `node_modules` and `.cache`, not the
+ *   hook) in which some range count is above zero, and of each only the
+ *   functions that ran, each one flat array: `[start, length, count]`
+ *   for its extent (V8's first range), then `[offset from start,
+ *   length, count]` per block range in V8's order. Name and block flag
+ *   are in the record, joined on the extent. Nothing when nothing ran.
+ *   `{ spectestVersion: 2, result: [{ url, spectestScript, functions:
+ *   [[s, l, c, o, l, c, …], …] }] }`.
+ * - Writes, **once per script per branch**, a **script record**
+ *   `scripts/<id>.json` (`id` = sha256 of the URL): the length of every
+ *   line of the source V8 compiled (`Debugger.getScriptSource`, so a
+ *   transpiled module — tsx, ts-node, a bundler's register hook — is
+ *   described by the text V8 ran, not the file on disk), every function
+ *   with its extent (the skeleton: what a dump's "ran" functions are a
+ *   subset of, so a never-run function is known to exist), and the
+ *   source map: the inline `data:` map in the text, the file the last
+ *   `sourceMappingURL` comment names, or `<script>.map` next to the
+ *   script; `sourcesContent` dropped (the sources are the repository).
+ *   "Once per branch" is a marker file under `.spectest/scripts/`: the
+ *   directory is shared by every process of the service and forks with
+ *   the environment, so a record written at bring-up or by an ancestor
+ *   is never written again, whichever process comes next.
+ *
+ * The harness ships new dumps and new records as they are. It parses
+ * nothing and touches no container; the control plane derives lines
+ * from the stored documents (`SUBSET_RUNS.md`).
  */
 export const NODE_COVERAGE_HOOK = `"use strict";
 // spectest coverage hook (coverage.node() adapter). See \`spectest docs /services/coverage\`.
-// Main thread only: worker threads inherit NODE_OPTIONS and would bind
-// the same per-pid socket last — tsx's ESM loader runs on one, and it
-// stole the socket from every \`--import tsx\` server, so a dump was the
-// loader's isolate and never the app's.
-if (process.env.NODE_V8_COVERAGE && require("node:worker_threads").isMainThread) {
-  const net = require("node:net");
-  const fs = require("node:fs");
-  const v8 = require("node:v8");
-  const SOCK = require("node:path").join(process.env.NODE_V8_COVERAGE, ${JSON.stringify(NODE_COVERAGE_SOCKET_PREFIX)} + process.pid);
-  const server = net.createServer((conn) => {
-    // A dump is taken only on an explicit "dump" request.
-    let buf = "";
-    conn.on("data", (chunk) => {
-      buf += chunk;
-      if (!buf.includes("\\n")) return;
-      let reply;
+(function () {
+  const dir = process.env[${JSON.stringify(NODE_COVERAGE_DIR_ENV)}];
+  if (!dir) return;
+  let inspector, fs, path, crypto, url, wt, net;
+  try {
+    inspector = require("node:inspector");
+    fs = require("node:fs");
+    path = require("node:path");
+    crypto = require("node:crypto");
+    url = require("node:url");
+    wt = require("node:worker_threads");
+    net = require("node:net");
+  } catch (e) {
+    return;
+  }
+  const session = new inspector.Session();
+  try {
+    session.connect();
+  } catch (e) {
+    return;
+  }
+  // An in-process session answers before post() returns.
+  function post(method, params) {
+    let out = null;
+    session.post(method, params || {}, function (err, res) {
+      out = err ? null : res;
+    });
+    return out;
+  }
+  if (post("Profiler.enable") === null) return;
+  post("Profiler.startPreciseCoverage", { callCount: true, detailed: true });
+
+  const SELF = url.pathToFileURL(__filename).href;
+  const SCRIPTS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SCRIPTS_SUBDIR)});
+  const MARKERS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_MARKERS_SUBDIR)});
+  const known = new Set();
+  let seq = 0;
+
+  function isApp(u) {
+    return typeof u === "string" && u.startsWith("file://") && u.indexOf("/node_modules/") < 0 && u.indexOf("/.cache/") < 0 && u !== SELF;
+  }
+  function ran(f) {
+    return f.ranges.some(function (r) { return r.count > 0; });
+  }
+  function idOf(u) {
+    return crypto.createHash("sha256").update(u).digest("hex").slice(0, 32);
+  }
+  function lineLengths(text) {
+    const out = [];
+    let len = 0;
+    for (let i = 0; i < text.length; i++, len++) {
+      const c = text.charCodeAt(i);
+      if (c === 0x0a || c === 0x2028 || c === 0x2029) {
+        out.push(len);
+        len = -1;
+      }
+    }
+    out.push(len);
+    return out;
+  }
+  function readMap(scriptPath, text) {
+    const re = /\\/\\/[#@]\\s*sourceMappingURL=(\\S+)/g;
+    let ref = null;
+    let m;
+    while ((m = re.exec(text)) !== null) ref = m[1];
+    let mapText = null;
+    let mapUrl = null;
+    try {
+      if (ref === null) {
+        const p = scriptPath + ".map";
+        mapText = fs.readFileSync(p, "utf8");
+        mapUrl = url.pathToFileURL(p).href;
+      } else if (ref.startsWith("data:")) {
+        const c = ref.indexOf(",");
+        if (c < 0) return null;
+        const head = ref.slice(5, c);
+        const body = ref.slice(c + 1);
+        mapText = /;base64$/i.test(head) ? Buffer.from(body, "base64").toString("utf8") : decodeURIComponent(body);
+      } else if (/^[a-z][a-z0-9+.-]*:/i.test(ref) && !ref.startsWith("file:")) {
+        return null;
+      } else {
+        const p = ref.startsWith("file:") ? url.fileURLToPath(ref) : path.resolve(path.dirname(scriptPath), decodeURIComponent(ref));
+        mapText = fs.readFileSync(p, "utf8");
+        mapUrl = url.pathToFileURL(p).href;
+      }
+    } catch (e) {
+      return null;
+    }
+    let data;
+    try {
+      data = JSON.parse(mapText);
+    } catch (e) {
+      return null;
+    }
+    if (!data || typeof data !== "object" || !("mappings" in data)) return null;
+    delete data.sourcesContent;
+    return { url: mapUrl, data: data };
+  }
+  function writeAtomic(file, text) {
+    const tmp = file + "." + process.pid + "-" + wt.threadId + ".tmp";
+    fs.writeFileSync(tmp, text);
+    fs.renameSync(tmp, file);
+  }
+  function describe(s, source) {
+    const id = idOf(s.url);
+    let scriptPath = null;
+    try {
+      scriptPath = url.fileURLToPath(s.url);
+    } catch (e) {}
+    const text = typeof source === "string" ? source : null;
+    const record = {
+      url: s.url,
+      lineLengths: text !== null ? lineLengths(text) : null,
+      functions: s.functions.map(function (f) {
+        return [f.functionName, f.ranges[0].startOffset, f.ranges[0].endOffset];
+      }),
+      sourceMap: text !== null && scriptPath !== null ? readMap(scriptPath, text) : null,
+    };
+    writeAtomic(path.join(SCRIPTS, id + ".json"), JSON.stringify({ spectestScript: record }));
+    try {
+      fs.writeFileSync(path.join(MARKERS, id), "");
+    } catch (e) {}
+  }
+  function take() {
+    const res = post("Profiler.takePreciseCoverage");
+    if (!res || !Array.isArray(res.result)) return;
+    const kept = [];
+    for (const s of res.result) {
+      if (isApp(s.url) && Array.isArray(s.functions) && s.functions.some(ran)) kept.push(s);
+    }
+    if (kept.length === 0) return;
+    const fresh = [];
+    for (const s of kept) {
+      if (known.has(s.url)) continue;
+      known.add(s.url);
+      if (!fs.existsSync(path.join(MARKERS, idOf(s.url)))) fresh.push(s);
+    }
+    if (fresh.length > 0) {
       try {
-        if (!buf.startsWith("dump")) throw new Error("unknown request");
-        v8.takeCoverage();
-        reply = "ok\\n";
-      } catch (err) {
-        reply = "error " + (err && err.message ? err.message : String(err)) + "\\n";
+        fs.mkdirSync(SCRIPTS, { recursive: true });
+        fs.mkdirSync(MARKERS, { recursive: true });
+      } catch (e) {}
+      post("Debugger.enable");
+      for (const s of fresh) {
+        const r = post("Debugger.getScriptSource", { scriptId: s.scriptId });
+        try {
+          describe(s, r && r.scriptSource);
+        } catch (e) {}
       }
-      conn.end(reply);
+      post("Debugger.disable");
+    }
+    // A ran function is one flat array: [start, length, count] for its
+    // extent (V8's first range), then [offset from start, length, count]
+    // per block range in V8's order. Small numbers, so the dump gzips to
+    // less than half of V8's own JSON; name and block flag live in the
+    // script record, joined on the extent.
+    const doc = {
+      spectestVersion: 2,
+      result: kept.map(function (s) {
+        return {
+          url: s.url,
+          spectestScript: idOf(s.url),
+          functions: s.functions.filter(ran).map(function (f) {
+            const first = f.ranges[0];
+            const out = [first.startOffset, first.endOffset - first.startOffset, first.count];
+            for (let i = 1; i < f.ranges.length; i++) {
+              const r = f.ranges[i];
+              out.push(r.startOffset - first.startOffset, r.endOffset - r.startOffset, r.count);
+            }
+            return out;
+          }),
+        };
+      }),
+    };
+    const name = ${JSON.stringify(NODE_COVERAGE_DUMP_PREFIX)} + process.pid + "-" + wt.threadId + "-" + Date.now() + "-" + seq++ + ".json";
+    writeAtomic(path.join(dir, name), JSON.stringify(doc));
+  }
+
+  if (wt.isMainThread) {
+    const SOCK = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SOCKET_PREFIX)} + process.pid);
+    const server = net.createServer(function (conn) {
+      let buf = "";
+      conn.on("data", function (chunk) {
+        buf += chunk;
+        if (buf.indexOf("\\n") < 0) return;
+        let reply;
+        try {
+          if (!buf.startsWith("dump")) throw new Error("unknown request");
+          take();
+          reply = "ok\\n";
+        } catch (err) {
+          reply = "error " + (err && err.message ? err.message : String(err)) + "\\n";
+        }
+        conn.end(reply);
+      });
+    });
+    server.unref();
+    server.on("error", function () {});
+    try {
+      fs.unlinkSync(SOCK);
+    } catch (e) {}
+    server.listen(SOCK);
+    process.on("exit", function () {
+      try {
+        fs.unlinkSync(SOCK);
+      } catch (e) {}
     });
+  }
+  process.on("exit", function () {
+    try {
+      take();
+    } catch (e) {}
   });
-  server.unref();
-  server.on("error", () => {});
-  try { fs.unlinkSync(SOCK); } catch {}
-  server.listen(SOCK);
-  process.on("exit", () => { try { fs.unlinkSync(SOCK); } catch {} });
-}
+})();
 `;
 /**
  * Coverage for a Node service — a long-lived server, or a container whose
  * node processes are short-lived CLIs run by `ctx.exec`. Sets
- * `NODE_V8_COVERAGE` to the coverage directory (every node process in the
- * container then writes V8 coverage JSON when it exits) and `--require`s
- * a hook that lets spectest ask every live node process for a dump at
- * capture time — the server, and any wrapper it sits behind (`pnpm exec`,
- * `tsx`). Nothing for the app to write.
- *
- * What ships is the V8 documents themselves, compacted
- * ({@link compactV8Document}): the app's own scripts that ran, and each
- * script's source map once per branch. A map comes from Node's own
- * `source-map-cache` when Node found one through the script's
- * `sourceMappingURL` (it caches maps under NODE_V8_COVERAGE with or
- * without `--enable-source-maps`), else from `<script>.map` next to the
- * script, read out of the container once
- * ({@link resolveSourceMapsFromContainer}). The second way is the one to
- * build a short-lived bundled process in: a map Node finds is serialized
- * whole into every exit dump — 12 MB per invocation for a bundled CLI,
- * inside the test's own time — and parsed again by the harness; a map
- * with no comment costs nothing there. Nothing is converted in the VM.
- * A dump is a **delta** by construction: V8 resets its counters at every
- * `takeCoverage()`, so a live server's dump after a test is that test's
- * own execution, and the boot dump (everything loaded) lands in the
- * bring-up capture and nowhere else. The control plane derives lines
- * from the stored documents, off the test run. Converting to lcov in
- * the container (`c8`, SDK 0.60 to 0.79) took seconds per capture per
- * service on a real project, inside the test run; a real project turned
- * coverage off because of it, and the conversion went.
+ * {@link NODE_COVERAGE_DIR_ENV} to the coverage directory and
+ * `--require`s {@link NODE_COVERAGE_HOOK}, which collects everything in
+ * the process. Nothing for the app to write, and nothing the harness
+ * reads out of the container: at capture it asks every live process for
+ * a take over its socket and lists what appeared in the directory —
+ * dumps and script records — for the harness to ship as they are. A
+ * dump is a delta by construction (V8 resets its counters at every
+ * take), so the report after a test is that test's own execution and
+ * the boot dump lands in the bring-up capture alone. Each capture ships
+ * only its own files: what an earlier capture on this branch shipped is
+ * removed first (module memory, forks with the environment).
  */
 export function node() {
     return {
@@ -209,7 +419,7 @@ export function node() {
         reports: "delta",
         configure(svc) {
             const env = appendEnvFlag(svc.env, "NODE_OPTIONS", `--require ${NODE_COVERAGE_HOOK_PATH}`);
-            env.NODE_V8_COVERAGE = COVERAGE_CONTAINER_DIR;
+            env[NODE_COVERAGE_DIR_ENV] = COVERAGE_CONTAINER_DIR;
             return {
                 ...svc,
                 env,
@@ -226,23 +436,17 @@ export function node() {
             // rather than failed: an empty report is a report. A server whose
             // hook never loaded (NODE_OPTIONS not reaching it) then shows as
             // empty reports after bring-up, which the boot log warns about.
-            //
-            // Each capture ships only its own dumps: what an earlier capture on
-            // this branch shipped is removed first (module memory, forks with
-            // the environment).
             const t0 = performance.now();
-            await removeShippedV8Reports(ctx.reportDir);
+            await removeShippedNodeReports(ctx.reportDir);
             const live = await dumpAllNodeProcesses(ctx.reportDir, ctx.signal);
             const t1 = performance.now();
-            const stats = await prepareV8Reports(ctx.reportDir, (urls) => resolveSourceMapsFromContainer(ctx, urls));
+            const stats = await collectNodeReports(ctx.reportDir);
             if (stats.dumps === 0) {
                 await ctx.writeReport(NODE_COVERAGE_EMPTY_REPORT, '{"result":[]}\n');
-                SHIPPED_V8_REPORTS.add((await import("node:path")).join(ctx.reportDir, NODE_COVERAGE_EMPTY_REPORT));
+                SHIPPED_NODE_REPORTS.add((await import("node:path")).join(ctx.reportDir, NODE_COVERAGE_EMPTY_REPORT));
             }
-            const t2 = performance.now();
             console.log(`[coverage] node/${ctx.service}: ${live} live process(es) dumped in ${Math.round(t1 - t0)} ms; ` +
-                `${stats.dumps} dump(s), ${stats.scripts} script(s), ${stats.bytesIn} → ${stats.bytesOut} bytes compacted in ${Math.round(t2 - t1)} ms; ` +
-                `${stats.mapsFromContainer} map(s) read from the container`);
+                `${stats.dumps} dump(s) (${stats.dumpBytes} B), ${stats.scripts} new script record(s) (${stats.scriptBytes} B)`);
         },
     };
 }
@@ -300,357 +504,73 @@ export async function dumpAllNodeProcesses(dir, signal) {
     }
     return live;
 }
-/** Report files shipped at an earlier capture on this branch, by host
- *  path. Module memory: forks with the environment, so a forked child
- *  removes its ancestors' reports at its first capture and ships only
- *  its own. */
-const SHIPPED_V8_REPORTS = new Set();
-/** Source-map entries shipped earlier on this branch: script URL → hash
- *  of the entry. Module memory, forks with the environment. A later dump
- *  of the same script carries a stub that refers to the hash instead of
- *  the map again. */
-const SHIPPED_SOURCE_MAPS = new Map();
-/** Scripts looked up in the container and found to have no source map
- *  (no `sourceMappingURL`, or a map file that is not there). Module
- *  memory, forks with the environment: one lookup per script per branch. */
-const NO_SOURCE_MAP = new Set();
+/** Files shipped at an earlier capture on this branch, by host path:
+ *  dumps, script records, the empty report. Module memory: forks with
+ *  the environment, so a forked child removes its ancestors' files at
+ *  its first capture and ships only its own. The hook's own "written
+ *  already" markers are elsewhere and stay. */
+const SHIPPED_NODE_REPORTS = new Set();
 /** Forget the branch memory (tests). */
 export function resetNodeCoverageMemory() {
-    SHIPPED_V8_REPORTS.clear();
-    SHIPPED_SOURCE_MAPS.clear();
-    NO_SOURCE_MAP.clear();
+    SHIPPED_NODE_REPORTS.clear();
 }
-/** Remove from `dir` the reports an earlier capture shipped. */
-export async function removeShippedV8Reports(dir) {
+/** Remove from `dir` the files an earlier capture shipped. */
+export async function removeShippedNodeReports(dir) {
     const fs = await import("node:fs/promises");
-    for (const file of [...SHIPPED_V8_REPORTS]) {
+    for (const file of [...SHIPPED_NODE_REPORTS]) {
         if (!file.startsWith(dir + "/"))
             continue;
         await fs.unlink(file).catch(() => { });
-        SHIPPED_V8_REPORTS.delete(file);
+        SHIPPED_NODE_REPORTS.delete(file);
     }
 }
-/** A script is the app's own when it is a file outside node_modules —
- *  and not our hook, which every dump would otherwise carry. */
-export function isAppScriptUrl(url) {
-    return (url.startsWith("file://") &&
-        !url.includes("/node_modules/") &&
-        // Package managers run from a cache, not node_modules: corepack's pnpm
-        // is `/root/.cache/node/corepack/…`, 2 MiB of dump per `pnpm run`.
-        !url.includes("/.cache/") &&
-        !url.endsWith("/" + NODE_COVERAGE_HOOK_PATH.split("/").pop()));
-}
-/** True when any range of any function of the script has a count above
- *  zero: something in it ran since the previous take. A script whose
- *  every count is zero is one V8 still lists after a reset; it says
- *  nothing and is dropped. */
-export function scriptExecuted(script) {
-    const fns = Array.isArray(script.functions) ? script.functions : [];
-    return fns.some((f) => Array.isArray(f.ranges) && f.ranges.some((r) => typeof r.count === "number" && r.count > 0));
+/** True for a dump the hook wrote (`node-*.json`). */
+export function isNodeDumpName(name) {
+    return name.startsWith(NODE_COVERAGE_DUMP_PREFIX) && name.endsWith(".json");
 }
 /**
- * Compact one V8 coverage document to what the derivation needs. What
- * Node writes is everything the process loaded: `node:` internals, every
- * `node_modules` file, and — under `--enable-source-maps` — a
- * `source-map-cache` with each file's full map **and its sources**,
- * repeated in every dump. Measured on a real project: a 12–20 MiB dump
- * per capture, of which the app's own coverage was under 0.5 MiB, and a
- * suite that hit the 64 MiB cap on its third test. Kept: `file://`
- * scripts outside `node_modules` in which something ran, and the map
- * entries of exactly those scripts, minus `sourcesContent` (the sources
- * are the repo). Each kept map entry carries its content hash under
- * {@link SOURCE_MAP_HASH_KEY}; when `shipped` holds the same hash for the
- * URL — the map went out with an earlier dump on this branch — a stub
- * `{ [SOURCE_MAP_REF_KEY]: hash }` stands in for it, and the reader finds
- * the map in an earlier capture of the branch. `shipped` is updated in
- * place. Still a V8 document — nothing is converted here.
- */
-export function compactV8Document(doc, shipped) {
-    const result = Array.isArray(doc.result) ? doc.result : [];
-    const kept = result.filter((s) => typeof s.url === "string" && isAppScriptUrl(s.url) && scriptExecuted(s));
-    const out = { ...doc, result: kept };
-    const cache = doc["source-map-cache"];
-    if (cache && typeof cache === "object") {
-        const urls = new Set(kept.map((s) => s.url));
-        const slim = {};
-        for (const [url, entry] of Object.entries(cache)) {
-            if (!urls.has(url) || !entry || typeof entry !== "object")
-                continue;
-            const e = { ...entry };
-            if (e.data && typeof e.data === "object") {
-                const { sourcesContent: _dropped, ...data } = e.data;
-                e.data = data;
-            }
-            const hash = sourceMapEntryHash(e);
-            if (shipped?.get(url) === hash) {
-                slim[url] = { [SOURCE_MAP_REF_KEY]: hash };
-            }
-            else {
-                slim[url] = { ...e, [SOURCE_MAP_HASH_KEY]: hash };
-                shipped?.set(url, hash);
-            }
-        }
-        if (Object.keys(slim).length > 0)
-            out["source-map-cache"] = slim;
-        else
-            delete out["source-map-cache"];
-    }
-    return out;
-}
-/** Shell-quote one argument for `sh -c`. */
-function shQuote(s) {
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
-/**
- * The probe {@link resolveSourceMapsFromContainer} runs in the container:
- * one `sh` loop over every script path, printing `<path>\t<ref>` — the
- * last `sourceMappingURL` value in the file, else `<path>.map` when that
- * file exists, else `-`; `!` for a script that is not there. One exec per
- * capture per service, whatever the number of scripts: a Next.js server
- * loads hundreds of chunk scripts with no map, and a `docker cp` per
- * script (the first cut) took a capture past its budget on a busy host.
- */
-export function sourceMapProbeCommand(scriptPaths) {
-    const script = 'for f in "$@"; do ' +
-        'if [ -f "$f" ]; then ' +
-        "ref=$(grep -o 'sourceMappingURL=[^[:space:]]*' -- \"$f\" 2>/dev/null | tail -n 1 | cut -c18-); " +
-        'if [ -n "$ref" ]; then printf \'%s\\t%s\\n\' "$f" "$ref"; ' +
-        'elif [ -f "$f.map" ]; then printf \'%s\\t%s.map\\n\' "$f" "$f"; ' +
-        'else printf \'%s\\t-\\n\' "$f"; fi; ' +
-        'else printf \'%s\\t!\\n\' "$f"; fi; ' +
-        "done";
-    return `sh -c ${shQuote(script)} sh ${scriptPaths.map(shQuote).join(" ")}`;
-}
-/** The length of every line of `text`, the way Node computes it for
- *  `source-map-cache`: split on `\n` (and U+2028/2029), `\r` kept, the
- *  last line included. Lengths in UTF-16 units, which is what V8's byte
- *  offsets count in. */
-export function lineLengthsOf(text) {
-    const out = [];
-    let len = 0;
-    for (let i = 0; i < text.length; i++, len++) {
-        const c = text.charCodeAt(i);
-        if (c === 0x0a || c === 0x2028 || c === 0x2029) {
-            out.push(len);
-            len = -1;
-        }
-    }
-    out.push(len);
-    return out;
-}
-/**
- * The source maps of `scriptUrls`, read out of the container. One probe
- * exec ({@link sourceMapProbeCommand}) finds, per script, the map a
- * `sourceMappingURL` comment names or `<script>.map` next to it; only a
- * script that has one is then read (`docker cp`, the script for its line
- * lengths and the map file, or the inline `data:` map decoded). A map's
- * `sourcesContent` is dropped. Scripts that are not `file://` URLs, have
- * no map, or whose map is not there or not JSON are absent from the
- * result. The caller remembers every outcome, so this runs once per
- * script per branch.
- *
- * With no comment the map next to the script is the shape to build a
- * short-lived bundled process in: Node caches a map it finds through a
- * comment into every dump it writes under NODE_V8_COVERAGE, flag or no
- * flag, and a bundled CLI's map is tens of MB per exit; a map it does not
- * find costs nothing there.
+ * Mark shipped every dump at the root of `dir` and every script record
+ * under `scripts/` that no earlier capture shipped, and count them.
+ * Nothing is read: the hook wrote each file whole (write + rename), and
+ * the harness ships them as they are.
  */
-export async function resolveSourceMapsFromContainer(ctx, scriptUrls) {
-    const out = new Map();
-    if (!ctx.readContainerFile)
-        return out;
-    const { fileURLToPath, pathToFileURL } = await import("node:url");
+export async function collectNodeReports(dir) {
+    const fs = await import("node:fs/promises");
     const path = await import("node:path");
-    const byPath = new Map();
-    for (const url of scriptUrls) {
-        if (!url.startsWith("file://"))
-            continue;
+    const stats = { dumps: 0, dumpBytes: 0, scripts: 0, scriptBytes: 0 };
+    const seen = async (d, keep, onNew) => {
+        let names;
         try {
-            byPath.set(fileURLToPath(url), url);
+            names = await fs.readdir(d);
         }
         catch {
-            // not a path
+            return;
         }
-    }
-    if (byPath.size === 0)
-        return out;
-    let probe;
-    try {
-        probe = (await ctx.exec(sourceMapProbeCommand([...byPath.keys()]))).stdout;
-    }
-    catch {
-        return out; // no shell, no grep: no maps from this container
-    }
-    for (const line of probe.split("\n")) {
-        const tab = line.indexOf("\t");
-        if (tab < 0)
-            continue;
-        const scriptPath = line.slice(0, tab);
-        const ref = line.slice(tab + 1).trim();
-        const url = byPath.get(scriptPath);
-        if (!url || ref === "-" || ref === "!" || ref === "")
-            continue;
-        let mapText;
-        let mapUrl;
-        if (ref.startsWith("data:")) {
-            const comma = ref.indexOf(",");
-            if (comma < 0)
+        for (const name of names.sort()) {
+            if (!keep(name))
+                continue;
+            const file = path.join(d, name);
+            if (SHIPPED_NODE_REPORTS.has(file))
                 continue;
-            const head = ref.slice(5, comma);
-            const body = ref.slice(comma + 1);
+            let size;
             try {
-                mapText = /;base64$/i.test(head) ? Buffer.from(body, "base64").toString("utf8") : decodeURIComponent(body);
+                size = (await fs.stat(file)).size;
             }
             catch {
                 continue;
             }
-            mapUrl = null;
-        }
-        else {
-            let mapPath;
-            if (ref.startsWith("file://")) {
-                try {
-                    mapPath = fileURLToPath(ref);
-                }
-                catch {
-                    continue;
-                }
-            }
-            else if (/^[a-z]+:/i.test(ref)) {
-                continue; // an http(s) map is not in the container
-            }
-            else {
-                let rel = ref;
-                try {
-                    rel = decodeURIComponent(ref);
-                }
-                catch {
-                    // keep as written
-                }
-                mapPath = path.resolve(path.dirname(scriptPath), rel);
-            }
-            const map = await ctx.readContainerFile(mapPath);
-            if (!map)
-                continue;
-            mapText = map.toString("utf8");
-            mapUrl = pathToFileURL(mapPath).href;
-        }
-        let data;
-        try {
-            data = JSON.parse(mapText);
-        }
-        catch {
-            continue;
-        }
-        if (!data || typeof data !== "object" || !("mappings" in data))
-            continue;
-        const script = await ctx.readContainerFile(scriptPath);
-        if (!script)
-            continue;
-        const { sourcesContent: _dropped, ...slim } = data;
-        out.set(url, { url: mapUrl, data: slim, lineLengths: lineLengthsOf(script.toString("utf8")) });
-    }
-    return out;
-}
-/** The content hash of a map entry, over its JSON with the spectest
- *  keys removed. */
-function sourceMapEntryHash(entry) {
-    const e = { ...entry };
-    delete e[SOURCE_MAP_HASH_KEY];
-    delete e[SOURCE_MAP_REF_KEY];
-    return "sha256:" + createHash("sha256").update(JSON.stringify(e)).digest("hex");
-}
-/**
- * Give every kept script of a compacted document a `source-map-cache`
- * entry it lacks: a stub when the map shipped earlier on this branch,
- * else the map `resolve` finds (asked once for all such scripts; shipped
- * whole, with its hash, and remembered), else nothing — and that outcome
- * is remembered too, so a script with no map is looked up once per
- * branch. Returns how many maps `resolve` supplied.
- */
-export async function attachSourceMaps(doc, resolve, shipped = SHIPPED_SOURCE_MAPS, missing = NO_SOURCE_MAP) {
-    const result = Array.isArray(doc.result) ? doc.result : [];
-    const cache = (doc["source-map-cache"] ?? {});
-    const unknown = [];
-    for (const s of result) {
-        const url = s.url;
-        if (typeof url !== "string" || url in cache)
-            continue;
-        const prior = shipped.get(url);
-        if (prior) {
-            cache[url] = { [SOURCE_MAP_REF_KEY]: prior };
-            continue;
-        }
-        if (missing.has(url) || unknown.includes(url))
-            continue;
-        unknown.push(url);
-    }
-    let found = 0;
-    if (unknown.length > 0) {
-        const entries = await resolve(unknown);
-        for (const url of unknown) {
-            const entry = entries.get(url);
-            if (!entry) {
-                missing.add(url);
-                continue;
-            }
-            const hash = sourceMapEntryHash(entry);
-            cache[url] = { ...entry, [SOURCE_MAP_HASH_KEY]: hash };
-            shipped.set(url, hash);
-            found++;
+            SHIPPED_NODE_REPORTS.add(file);
+            onNew(size);
         }
-    }
-    if (Object.keys(cache).length > 0)
-        doc["source-map-cache"] = cache;
-    return found;
-}
-/**
- * Compact, in place, every `coverage-*.json` in `dir` that no earlier
- * capture shipped, attach the maps the dump lacks through `resolve`
- * ({@link attachSourceMaps}), and mark it shipped. A dump mid-write (not
- * yet valid JSON) is left for the next capture.
- */
-export async function prepareV8Reports(dir, resolve) {
-    const fs = await import("node:fs/promises");
-    const path = await import("node:path");
-    const stats = { dumps: 0, scripts: 0, bytesIn: 0, bytesOut: 0, mapsFromContainer: 0 };
-    let names;
-    try {
-        names = await fs.readdir(dir);
-    }
-    catch {
-        return stats;
-    }
-    for (const name of names.sort()) {
-        if (!name.startsWith("coverage-") || !name.endsWith(".json") || name === NODE_COVERAGE_EMPTY_REPORT)
-            continue;
-        const file = path.join(dir, name);
-        if (SHIPPED_V8_REPORTS.has(file))
-            continue;
-        let text;
-        let doc;
-        try {
-            text = await fs.readFile(file, "utf8");
-            doc = JSON.parse(text);
-        }
-        catch {
-            continue; // a dump mid-write, or not ours; the read path judges it
-        }
-        if (!Array.isArray(doc.result))
-            continue;
-        const compact = compactV8Document(doc, SHIPPED_SOURCE_MAPS);
-        if (resolve)
-            stats.mapsFromContainer += await attachSourceMaps(compact, resolve);
-        const out = JSON.stringify(compact);
-        const tmp = path.join(dir, `.${name}.compact`);
-        await fs.writeFile(tmp, out);
-        await fs.rename(tmp, file);
-        SHIPPED_V8_REPORTS.add(file);
+    };
+    await seen(dir, isNodeDumpName, (b) => {
         stats.dumps++;
-        stats.scripts += doc.result.length;
-        stats.bytesIn += text.length;
-        stats.bytesOut += out.length;
-    }
+        stats.dumpBytes += b;
+    });
+    await seen(path.join(dir, NODE_COVERAGE_SCRIPTS_SUBDIR), (n) => n.endsWith(".json"), (b) => {
+        stats.scripts++;
+        stats.scriptBytes += b;
+    });
     return stats;
 }
 // ── browser ───────────────────────────────────────────────────────