@specific.dev/spectest 0.81.1 → 0.83.0

package/src/coverage.ts

@@ -13,11 +13,11 @@
 //                a report in the directory.
 //
 // After every adapter ran, the harness reads the directory the same way
-// it does for `coverage: true`: at least one well-formed report (lcov or
-// V8 JSON), shipped verbatim. Nothing is converted in the VM: `node()`
-// compacts its V8 dumps (the app's own scripts, each source map once per
-// branch) and ships them as they are. The control plane derives what it
-// needs from the stored bytes, off the test run.
+// it does for `coverage: true`: at least one well-formed report (lcov,
+// V8 JSON, or a node() script record), shipped verbatim. Nothing is
+// converted, parsed or looked up in the VM: `node()`'s hook collects
+// inside the process and writes what ships. The control plane derives
+// what it needs from the stored bytes, off the test run.
 //
 // Imported from `@specific.dev/spectest/coverage`. The three shipped
 // adapters: `node()` (V8 JSON through a hook spectest mounts), `browser()`
@@ -27,8 +27,6 @@
 //   import * as coverage from "@specific.dev/spectest/coverage";
 //   coverage: { adapters: [coverage.node(), coverage.browser()] }
 
-import { createHash } from "node:crypto";
-
 import type { ServiceConfig } from "./index.js";
 import { harvestAllBrowserCoverage, takeBrowserCoverageReports } from "./browser-coverage.js";
 
@@ -45,11 +43,6 @@ export const NODE_COVERAGE_EMPTY_REPORT = "coverage-spectest-empty.json";
  *  to the coverage dir: `.ctl-<pid>`. */
 export const NODE_COVERAGE_SOCKET_PREFIX = ".ctl-";
 
-/** Key of the content hash (`sha256:<hex>`) a shipped `source-map-cache`
- *  entry carries, and key of the stub that stands in for an entry that
- *  shipped earlier on the same branch. See {@link compactV8Document}. */
-export const SOURCE_MAP_HASH_KEY = "spectestHash";
-export const SOURCE_MAP_REF_KEY = "spectestRef";
 
 /** What `configure` learns about the service it rewrites. */
 export interface CoverageConfigureInfo {
@@ -90,9 +83,6 @@ export interface CoverageCaptureContext {
   exec(command: string): Promise<{ stdout: string; stderr: string }>;
   /** Write one report file (name relative to the directory). */
   writeReport(name: string, content: string): Promise<void>;
-  /** Read one file out of the container (`docker cp`). `null` when it
-   *  does not exist. Absent on a context that has no container. */
-  readContainerFile?(containerPath: string): Promise<Buffer | null>;
   /** Aborts when the per-service capture budget runs out. */
   signal: AbortSignal;
 }
@@ -221,90 +211,310 @@ export function appendEnvFlag(
 
 // ── node ──────────────────────────────────────────────────────────
 
+/** Env var the hook reads: the coverage directory inside the container. */
+export const NODE_COVERAGE_DIR_ENV = "SPECTEST_COVERAGE_DIR";
+
+/** Subdirectory of the coverage dir where the hook writes one record per
+ *  script (`scripts/<id>.json`, {@link NODE_COVERAGE_HOOK}). Shipped
+ *  once, like a dump. */
+export const NODE_COVERAGE_SCRIPTS_SUBDIR = "scripts";
+
+/** Hidden subdirectory holding one empty marker per script record ever
+ *  written on this branch. The hook's "written already?" check, which
+ *  must survive the harness shipping and removing the record; hidden,
+ *  so the harness never reads it. */
+export const NODE_COVERAGE_MARKERS_SUBDIR = ".spectest/scripts";
+
+/** Name prefix of the dumps the hook writes: `node-<pid>-<thread>-<ms>-<n>.json`. */
+export const NODE_COVERAGE_DUMP_PREFIX = "node-";
+
 /**
- * The hook `node()` mounts and `--require`s into every node process of
- * the container. Node writes V8 coverage JSON into `NODE_V8_COVERAGE`
- * when a process exits; a long-lived server never exits, so the hook
- * binds a Unix socket in the coverage directory and calls
- * `v8.takeCoverage()` on request. **Every** process binds its own socket
- * (`.ctl-<pid>`) — there is no "first process owns it" rule, because the
- * first node process is often a wrapper (`pnpm exec`, the `tsx` binary,
- * `npm run`) whose child is the real server; a single socket on the
- * wrapper dumped the wrapper and silently never the server (reported by
- * a user 2026-08-27). At capture spectest asks every live socket and
- * unlinks the stale ones. Unref'd, so a short-lived process still exits.
- * Main thread only: a worker thread inherits `NODE_OPTIONS`, and tsx's
- * ESM loader thread bound the shared per-pid path last, so every
- * `--import tsx` server answered with the loader's coverage — the app's
- * main thread was never dumped (found in the same user's first full run).
- * No signal is used: signals are claimed by frameworks (SIGUSR2 stops a
- * Temporal worker, restarts nodemon), a socket is nobody's.
+ * The hook `node()` mounts at {@link NODE_COVERAGE_HOOK_PATH} and
+ * `--require`s into every node process of the service. **It is the
+ * collector**: nothing outside the process reads, converts or looks
+ * anything up. Runs in every thread (a worker thread inherits
+ * `NODE_OPTIONS`); reads one env var, {@link NODE_COVERAGE_DIR_ENV}; uses
+ * node built-ins only, so it runs in any image that runs node.
+ *
+ * What it does:
+ *
+ * - Starts V8 precise (block, counted) coverage through the in-process
+ *   inspector session. `NODE_V8_COVERAGE` is **not** set: Node would then
+ *   write everything the process loaded at every exit — `node:`
+ *   internals, every `node_modules` file, and the whole source map of
+ *   every script that carries a `sourceMappingURL` comment, with or
+ *   without `--enable-source-maps`. For a bundled CLI that was 12 MB per
+ *   invocation, inside the test's own time, parsed again at capture.
+ * - **Takes** on request — the main thread binds a Unix socket
+ *   `.ctl-<pid>` in the coverage directory and takes on `dump\n`; every
+ *   process binds its own (the first node process is often a wrapper,
+ *   `pnpm exec`, `tsx`, `npm run`) — and in every thread's `exit`
+ *   handler, which is how a short-lived CLI and a worker thread report.
+ *   The in-process session answers synchronously, so the exit handler
+ *   has the result before the process is gone. A take resets V8's
+ *   counters: every dump is the delta since the previous take. No
+ *   signal is used: signals are claimed by frameworks (SIGUSR2 stops a
+ *   Temporal worker, restarts nodemon), a socket is nobody's.
+ * - Writes a **dump** `node-<pid>-<thread>-<ms>-<n>.json`: the app's own
+ *   scripts (`file://`, outside `node_modules` and `.cache`, not the
+ *   hook) in which some range count is above zero, and of each only the
+ *   functions that ran, each one flat array: `[start, length, count]`
+ *   for its extent (V8's first range), then `[offset from start,
+ *   length, count]` per block range in V8's order. Name and block flag
+ *   are in the record, joined on the extent. Nothing when nothing ran.
+ *   `{ spectestVersion: 2, result: [{ url, spectestScript, functions:
+ *   [[s, l, c, o, l, c, …], …] }] }`.
+ * - Writes, **once per script per branch**, a **script record**
+ *   `scripts/<id>.json` (`id` = sha256 of the URL): the length of every
+ *   line of the source V8 compiled (`Debugger.getScriptSource`, so a
+ *   transpiled module — tsx, ts-node, a bundler's register hook — is
+ *   described by the text V8 ran, not the file on disk), every function
+ *   with its extent (the skeleton: what a dump's "ran" functions are a
+ *   subset of, so a never-run function is known to exist), and the
+ *   source map: the inline `data:` map in the text, the file the last
+ *   `sourceMappingURL` comment names, or `<script>.map` next to the
+ *   script; `sourcesContent` dropped (the sources are the repository).
+ *   "Once per branch" is a marker file under `.spectest/scripts/`: the
+ *   directory is shared by every process of the service and forks with
+ *   the environment, so a record written at bring-up or by an ancestor
+ *   is never written again, whichever process comes next.
+ *
+ * The harness ships new dumps and new records as they are. It parses
+ * nothing and touches no container; the control plane derives lines
+ * from the stored documents (`SUBSET_RUNS.md`).
  */
 export const NODE_COVERAGE_HOOK = `"use strict";
 // spectest coverage hook (coverage.node() adapter). See \`spectest docs /services/coverage\`.
-// Main thread only: worker threads inherit NODE_OPTIONS and would bind
-// the same per-pid socket last — tsx's ESM loader runs on one, and it
-// stole the socket from every \`--import tsx\` server, so a dump was the
-// loader's isolate and never the app's.
-if (process.env.NODE_V8_COVERAGE && require("node:worker_threads").isMainThread) {
-  const net = require("node:net");
-  const fs = require("node:fs");
-  const v8 = require("node:v8");
-  const SOCK = require("node:path").join(process.env.NODE_V8_COVERAGE, ${JSON.stringify(NODE_COVERAGE_SOCKET_PREFIX)} + process.pid);
-  const server = net.createServer((conn) => {
-    // A dump is taken only on an explicit "dump" request.
-    let buf = "";
-    conn.on("data", (chunk) => {
-      buf += chunk;
-      if (!buf.includes("\\n")) return;
-      let reply;
+(function () {
+  const dir = process.env[${JSON.stringify(NODE_COVERAGE_DIR_ENV)}];
+  if (!dir) return;
+  let inspector, fs, path, crypto, url, wt, net;
+  try {
+    inspector = require("node:inspector");
+    fs = require("node:fs");
+    path = require("node:path");
+    crypto = require("node:crypto");
+    url = require("node:url");
+    wt = require("node:worker_threads");
+    net = require("node:net");
+  } catch (e) {
+    return;
+  }
+  const session = new inspector.Session();
+  try {
+    session.connect();
+  } catch (e) {
+    return;
+  }
+  // An in-process session answers before post() returns.
+  function post(method, params) {
+    let out = null;
+    session.post(method, params || {}, function (err, res) {
+      out = err ? null : res;
+    });
+    return out;
+  }
+  if (post("Profiler.enable") === null) return;
+  post("Profiler.startPreciseCoverage", { callCount: true, detailed: true });
+
+  const SELF = url.pathToFileURL(__filename).href;
+  const SCRIPTS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SCRIPTS_SUBDIR)});
+  const MARKERS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_MARKERS_SUBDIR)});
+  const known = new Set();
+  let seq = 0;
+
+  function isApp(u) {
+    return typeof u === "string" && u.startsWith("file://") && u.indexOf("/node_modules/") < 0 && u.indexOf("/.cache/") < 0 && u !== SELF;
+  }
+  function ran(f) {
+    return f.ranges.some(function (r) { return r.count > 0; });
+  }
+  function idOf(u) {
+    return crypto.createHash("sha256").update(u).digest("hex").slice(0, 32);
+  }
+  function lineLengths(text) {
+    const out = [];
+    let len = 0;
+    for (let i = 0; i < text.length; i++, len++) {
+      const c = text.charCodeAt(i);
+      if (c === 0x0a || c === 0x2028 || c === 0x2029) {
+        out.push(len);
+        len = -1;
+      }
+    }
+    out.push(len);
+    return out;
+  }
+  function readMap(scriptPath, text) {
+    const re = /\\/\\/[#@]\\s*sourceMappingURL=(\\S+)/g;
+    let ref = null;
+    let m;
+    while ((m = re.exec(text)) !== null) ref = m[1];
+    let mapText = null;
+    let mapUrl = null;
+    try {
+      if (ref === null) {
+        const p = scriptPath + ".map";
+        mapText = fs.readFileSync(p, "utf8");
+        mapUrl = url.pathToFileURL(p).href;
+      } else if (ref.startsWith("data:")) {
+        const c = ref.indexOf(",");
+        if (c < 0) return null;
+        const head = ref.slice(5, c);
+        const body = ref.slice(c + 1);
+        mapText = /;base64$/i.test(head) ? Buffer.from(body, "base64").toString("utf8") : decodeURIComponent(body);
+      } else if (/^[a-z][a-z0-9+.-]*:/i.test(ref) && !ref.startsWith("file:")) {
+        return null;
+      } else {
+        const p = ref.startsWith("file:") ? url.fileURLToPath(ref) : path.resolve(path.dirname(scriptPath), decodeURIComponent(ref));
+        mapText = fs.readFileSync(p, "utf8");
+        mapUrl = url.pathToFileURL(p).href;
+      }
+    } catch (e) {
+      return null;
+    }
+    let data;
+    try {
+      data = JSON.parse(mapText);
+    } catch (e) {
+      return null;
+    }
+    if (!data || typeof data !== "object" || !("mappings" in data)) return null;
+    delete data.sourcesContent;
+    return { url: mapUrl, data: data };
+  }
+  function writeAtomic(file, text) {
+    const tmp = file + "." + process.pid + "-" + wt.threadId + ".tmp";
+    fs.writeFileSync(tmp, text);
+    fs.renameSync(tmp, file);
+  }
+  function describe(s, source) {
+    const id = idOf(s.url);
+    let scriptPath = null;
+    try {
+      scriptPath = url.fileURLToPath(s.url);
+    } catch (e) {}
+    const text = typeof source === "string" ? source : null;
+    const record = {
+      url: s.url,
+      lineLengths: text !== null ? lineLengths(text) : null,
+      functions: s.functions.map(function (f) {
+        return [f.functionName, f.ranges[0].startOffset, f.ranges[0].endOffset];
+      }),
+      sourceMap: text !== null && scriptPath !== null ? readMap(scriptPath, text) : null,
+    };
+    writeAtomic(path.join(SCRIPTS, id + ".json"), JSON.stringify({ spectestScript: record }));
+    try {
+      fs.writeFileSync(path.join(MARKERS, id), "");
+    } catch (e) {}
+  }
+  function take() {
+    const res = post("Profiler.takePreciseCoverage");
+    if (!res || !Array.isArray(res.result)) return;
+    const kept = [];
+    for (const s of res.result) {
+      if (isApp(s.url) && Array.isArray(s.functions) && s.functions.some(ran)) kept.push(s);
+    }
+    if (kept.length === 0) return;
+    const fresh = [];
+    for (const s of kept) {
+      if (known.has(s.url)) continue;
+      known.add(s.url);
+      if (!fs.existsSync(path.join(MARKERS, idOf(s.url)))) fresh.push(s);
+    }
+    if (fresh.length > 0) {
       try {
-        if (!buf.startsWith("dump")) throw new Error("unknown request");
-        v8.takeCoverage();
-        reply = "ok\\n";
-      } catch (err) {
-        reply = "error " + (err && err.message ? err.message : String(err)) + "\\n";
+        fs.mkdirSync(SCRIPTS, { recursive: true });
+        fs.mkdirSync(MARKERS, { recursive: true });
+      } catch (e) {}
+      post("Debugger.enable");
+      for (const s of fresh) {
+        const r = post("Debugger.getScriptSource", { scriptId: s.scriptId });
+        try {
+          describe(s, r && r.scriptSource);
+        } catch (e) {}
       }
-      conn.end(reply);
+      post("Debugger.disable");
+    }
+    // A ran function is one flat array: [start, length, count] for its
+    // extent (V8's first range), then [offset from start, length, count]
+    // per block range in V8's order. Small numbers, so the dump gzips to
+    // less than half of V8's own JSON; name and block flag live in the
+    // script record, joined on the extent.
+    const doc = {
+      spectestVersion: 2,
+      result: kept.map(function (s) {
+        return {
+          url: s.url,
+          spectestScript: idOf(s.url),
+          functions: s.functions.filter(ran).map(function (f) {
+            const first = f.ranges[0];
+            const out = [first.startOffset, first.endOffset - first.startOffset, first.count];
+            for (let i = 1; i < f.ranges.length; i++) {
+              const r = f.ranges[i];
+              out.push(r.startOffset - first.startOffset, r.endOffset - r.startOffset, r.count);
+            }
+            return out;
+          }),
+        };
+      }),
+    };
+    const name = ${JSON.stringify(NODE_COVERAGE_DUMP_PREFIX)} + process.pid + "-" + wt.threadId + "-" + Date.now() + "-" + seq++ + ".json";
+    writeAtomic(path.join(dir, name), JSON.stringify(doc));
+  }
+
+  if (wt.isMainThread) {
+    const SOCK = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SOCKET_PREFIX)} + process.pid);
+    const server = net.createServer(function (conn) {
+      let buf = "";
+      conn.on("data", function (chunk) {
+        buf += chunk;
+        if (buf.indexOf("\\n") < 0) return;
+        let reply;
+        try {
+          if (!buf.startsWith("dump")) throw new Error("unknown request");
+          take();
+          reply = "ok\\n";
+        } catch (err) {
+          reply = "error " + (err && err.message ? err.message : String(err)) + "\\n";
+        }
+        conn.end(reply);
+      });
+    });
+    server.unref();
+    server.on("error", function () {});
+    try {
+      fs.unlinkSync(SOCK);
+    } catch (e) {}
+    server.listen(SOCK);
+    process.on("exit", function () {
+      try {
+        fs.unlinkSync(SOCK);
+      } catch (e) {}
     });
+  }
+  process.on("exit", function () {
+    try {
+      take();
+    } catch (e) {}
   });
-  server.unref();
-  server.on("error", () => {});
-  try { fs.unlinkSync(SOCK); } catch {}
-  server.listen(SOCK);
-  process.on("exit", () => { try { fs.unlinkSync(SOCK); } catch {} });
-}
+})();
 `;
 
 /**
  * Coverage for a Node service — a long-lived server, or a container whose
  * node processes are short-lived CLIs run by `ctx.exec`. Sets
- * `NODE_V8_COVERAGE` to the coverage directory (every node process in the
- * container then writes V8 coverage JSON when it exits) and `--require`s
- * a hook that lets spectest ask every live node process for a dump at
- * capture time — the server, and any wrapper it sits behind (`pnpm exec`,
- * `tsx`). Nothing for the app to write.
- *
- * What ships is the V8 documents themselves, compacted
- * ({@link compactV8Document}): the app's own scripts that ran, and each
- * script's source map once per branch. A map comes from Node's own
- * `source-map-cache` when Node found one through the script's
- * `sourceMappingURL` (it caches maps under NODE_V8_COVERAGE with or
- * without `--enable-source-maps`), else from `<script>.map` next to the
- * script, read out of the container once
- * ({@link resolveSourceMapsFromContainer}). The second way is the one to
- * build a short-lived bundled process in: a map Node finds is serialized
- * whole into every exit dump — 12 MB per invocation for a bundled CLI,
- * inside the test's own time — and parsed again by the harness; a map
- * with no comment costs nothing there. Nothing is converted in the VM.
- * A dump is a **delta** by construction: V8 resets its counters at every
- * `takeCoverage()`, so a live server's dump after a test is that test's
- * own execution, and the boot dump (everything loaded) lands in the
- * bring-up capture and nowhere else. The control plane derives lines
- * from the stored documents, off the test run. Converting to lcov in
- * the container (`c8`, SDK 0.60 to 0.79) took seconds per capture per
- * service on a real project, inside the test run; a real project turned
- * coverage off because of it, and the conversion went.
+ * {@link NODE_COVERAGE_DIR_ENV} to the coverage directory and
+ * `--require`s {@link NODE_COVERAGE_HOOK}, which collects everything in
+ * the process. Nothing for the app to write, and nothing the harness
+ * reads out of the container: at capture it asks every live process for
+ * a take over its socket and lists what appeared in the directory —
+ * dumps and script records — for the harness to ship as they are. A
+ * dump is a delta by construction (V8 resets its counters at every
+ * take), so the report after a test is that test's own execution and
+ * the boot dump lands in the bring-up capture alone. Each capture ships
+ * only its own files: what an earlier capture on this branch shipped is
+ * removed first (module memory, forks with the environment).
  */
 export function node(): CoverageAdapter {
   return {
@@ -312,7 +522,7 @@ export function node(): CoverageAdapter {
     reports: "delta",
     configure(svc) {
       const env = appendEnvFlag(svc.env, "NODE_OPTIONS", `--require ${NODE_COVERAGE_HOOK_PATH}`);
-      env.NODE_V8_COVERAGE = COVERAGE_CONTAINER_DIR;
+      env[NODE_COVERAGE_DIR_ENV] = COVERAGE_CONTAINER_DIR;
       return {
         ...svc,
         env,
@@ -329,24 +539,18 @@ export function node(): CoverageAdapter {
       // rather than failed: an empty report is a report. A server whose
       // hook never loaded (NODE_OPTIONS not reaching it) then shows as
       // empty reports after bring-up, which the boot log warns about.
-      //
-      // Each capture ships only its own dumps: what an earlier capture on
-      // this branch shipped is removed first (module memory, forks with
-      // the environment).
       const t0 = performance.now();
-      await removeShippedV8Reports(ctx.reportDir);
+      await removeShippedNodeReports(ctx.reportDir);
       const live = await dumpAllNodeProcesses(ctx.reportDir, ctx.signal);
       const t1 = performance.now();
-      const stats = await prepareV8Reports(ctx.reportDir, (urls) => resolveSourceMapsFromContainer(ctx, urls));
+      const stats = await collectNodeReports(ctx.reportDir);
       if (stats.dumps === 0) {
         await ctx.writeReport(NODE_COVERAGE_EMPTY_REPORT, '{"result":[]}\n');
-        SHIPPED_V8_REPORTS.add((await import("node:path")).join(ctx.reportDir, NODE_COVERAGE_EMPTY_REPORT));
+        SHIPPED_NODE_REPORTS.add((await import("node:path")).join(ctx.reportDir, NODE_COVERAGE_EMPTY_REPORT));
       }
-      const t2 = performance.now();
       console.log(
         `[coverage] node/${ctx.service}: ${live} live process(es) dumped in ${Math.round(t1 - t0)} ms; ` +
-          `${stats.dumps} dump(s), ${stats.scripts} script(s), ${stats.bytesIn} → ${stats.bytesOut} bytes compacted in ${Math.round(t2 - t1)} ms; ` +
-          `${stats.mapsFromContainer} map(s) read from the container`,
+          `${stats.dumps} dump(s) (${stats.dumpBytes} B), ${stats.scripts} new script record(s) (${stats.scriptBytes} B)`,
       );
     },
   };
@@ -402,387 +606,84 @@ export async function dumpAllNodeProcesses(dir: string, signal: AbortSignal): Pr
   return live;
 }
 
-/** Report files shipped at an earlier capture on this branch, by host
- *  path. Module memory: forks with the environment, so a forked child
- *  removes its ancestors' reports at its first capture and ships only
- *  its own. */
-const SHIPPED_V8_REPORTS = new Set<string>();
-
-/** Source-map entries shipped earlier on this branch: script URL → hash
- *  of the entry. Module memory, forks with the environment. A later dump
- *  of the same script carries a stub that refers to the hash instead of
- *  the map again. */
-const SHIPPED_SOURCE_MAPS = new Map<string, string>();
-
-/** Scripts looked up in the container and found to have no source map
- *  (no `sourceMappingURL`, or a map file that is not there). Module
- *  memory, forks with the environment: one lookup per script per branch. */
-const NO_SOURCE_MAP = new Set<string>();
+/** Files shipped at an earlier capture on this branch, by host path:
+ *  dumps, script records, the empty report. Module memory: forks with
+ *  the environment, so a forked child removes its ancestors' files at
+ *  its first capture and ships only its own. The hook's own "written
+ *  already" markers are elsewhere and stay. */
+const SHIPPED_NODE_REPORTS = new Set<string>();
 
 /** Forget the branch memory (tests). */
 export function resetNodeCoverageMemory(): void {
-  SHIPPED_V8_REPORTS.clear();
-  SHIPPED_SOURCE_MAPS.clear();
-  NO_SOURCE_MAP.clear();
+  SHIPPED_NODE_REPORTS.clear();
 }
 
-/** Remove from `dir` the reports an earlier capture shipped. */
-export async function removeShippedV8Reports(dir: string): Promise<void> {
+/** Remove from `dir` the files an earlier capture shipped. */
+export async function removeShippedNodeReports(dir: string): Promise<void> {
   const fs = await import("node:fs/promises");
-  for (const file of [...SHIPPED_V8_REPORTS]) {
+  for (const file of [...SHIPPED_NODE_REPORTS]) {
     if (!file.startsWith(dir + "/")) continue;
     await fs.unlink(file).catch(() => {});
-    SHIPPED_V8_REPORTS.delete(file);
-  }
-}
-
-/** A script is the app's own when it is a file outside node_modules —
- *  and not our hook, which every dump would otherwise carry. */
-export function isAppScriptUrl(url: string): boolean {
-  return (
-    url.startsWith("file://") &&
-    !url.includes("/node_modules/") &&
-    // Package managers run from a cache, not node_modules: corepack's pnpm
-    // is `/root/.cache/node/corepack/…`, 2 MiB of dump per `pnpm run`.
-    !url.includes("/.cache/") &&
-    !url.endsWith("/" + NODE_COVERAGE_HOOK_PATH.split("/").pop())
-  );
-}
-
-interface V8Range {
-  count?: unknown;
-}
-interface V8Function {
-  ranges?: V8Range[];
-}
-interface V8Script {
-  url?: unknown;
-  functions?: V8Function[];
-}
-
-/** True when any range of any function of the script has a count above
- *  zero: something in it ran since the previous take. A script whose
- *  every count is zero is one V8 still lists after a reset; it says
- *  nothing and is dropped. */
-export function scriptExecuted(script: V8Script): boolean {
-  const fns = Array.isArray(script.functions) ? script.functions : [];
-  return fns.some((f) => Array.isArray(f.ranges) && f.ranges.some((r) => typeof r.count === "number" && r.count > 0));
-}
-
-/**
- * Compact one V8 coverage document to what the derivation needs. What
- * Node writes is everything the process loaded: `node:` internals, every
- * `node_modules` file, and — under `--enable-source-maps` — a
- * `source-map-cache` with each file's full map **and its sources**,
- * repeated in every dump. Measured on a real project: a 12–20 MiB dump
- * per capture, of which the app's own coverage was under 0.5 MiB, and a
- * suite that hit the 64 MiB cap on its third test. Kept: `file://`
- * scripts outside `node_modules` in which something ran, and the map
- * entries of exactly those scripts, minus `sourcesContent` (the sources
- * are the repo). Each kept map entry carries its content hash under
- * {@link SOURCE_MAP_HASH_KEY}; when `shipped` holds the same hash for the
- * URL — the map went out with an earlier dump on this branch — a stub
- * `{ [SOURCE_MAP_REF_KEY]: hash }` stands in for it, and the reader finds
- * the map in an earlier capture of the branch. `shipped` is updated in
- * place. Still a V8 document — nothing is converted here.
- */
-export function compactV8Document(
-  doc: Record<string, unknown>,
-  shipped?: Map<string, string>,
-): Record<string, unknown> {
-  const result = Array.isArray(doc.result) ? (doc.result as V8Script[]) : [];
-  const kept = result.filter((s) => typeof s.url === "string" && isAppScriptUrl(s.url) && scriptExecuted(s));
-  const out: Record<string, unknown> = { ...doc, result: kept };
-  const cache = doc["source-map-cache"];
-  if (cache && typeof cache === "object") {
-    const urls = new Set(kept.map((s) => s.url as string));
-    const slim: Record<string, unknown> = {};
-    for (const [url, entry] of Object.entries(cache as Record<string, unknown>)) {
-      if (!urls.has(url) || !entry || typeof entry !== "object") continue;
-      const e = { ...(entry as Record<string, unknown>) };
-      if (e.data && typeof e.data === "object") {
-        const { sourcesContent: _dropped, ...data } = e.data as Record<string, unknown>;
-        e.data = data;
-      }
-      const hash = sourceMapEntryHash(e);
-      if (shipped?.get(url) === hash) {
-        slim[url] = { [SOURCE_MAP_REF_KEY]: hash };
-      } else {
-        slim[url] = { ...e, [SOURCE_MAP_HASH_KEY]: hash };
-        shipped?.set(url, hash);
-      }
-    }
-    if (Object.keys(slim).length > 0) out["source-map-cache"] = slim;
-    else delete out["source-map-cache"];
+    SHIPPED_NODE_REPORTS.delete(file);
   }
-  return out;
 }
 
-/** What {@link prepareV8Reports} did, for the capture's log line. */
-export interface PrepareV8Stats {
+/** What {@link collectNodeReports} found, for the capture's log line. */
+export interface NodeReportStats {
   dumps: number;
+  dumpBytes: number;
   scripts: number;
-  bytesIn: number;
-  bytesOut: number;
-  /** Source maps read out of the container this capture. */
-  mapsFromContainer: number;
-}
-
-/** One `source-map-cache` entry in the shape Node writes: the map (its
- *  `sourcesContent` dropped), the generated script's line lengths, and
- *  the map's own URL. */
-export interface SourceMapEntry {
-  url: string | null;
-  data: Record<string, unknown>;
-  lineLengths: number[];
+  scriptBytes: number;
 }
 
-/** Finds the source maps of the scripts a dump carries no map for, in
- *  one go. A script absent from the result has none. */
-export type SourceMapResolver = (scriptUrls: string[]) => Promise<Map<string, SourceMapEntry>>;
-
-/** Shell-quote one argument for `sh -c`. */
-function shQuote(s: string): string {
-  return `'${s.replace(/'/g, `'\\''`)}'`;
+/** True for a dump the hook wrote (`node-*.json`). */
+export function isNodeDumpName(name: string): boolean {
+  return name.startsWith(NODE_COVERAGE_DUMP_PREFIX) && name.endsWith(".json");
 }
 
 /**
- * The probe {@link resolveSourceMapsFromContainer} runs in the container:
- * one `sh` loop over every script path, printing `<path>\t<ref>` — the
- * last `sourceMappingURL` value in the file, else `<path>.map` when that
- * file exists, else `-`; `!` for a script that is not there. One exec per
- * capture per service, whatever the number of scripts: a Next.js server
- * loads hundreds of chunk scripts with no map, and a `docker cp` per
- * script (the first cut) took a capture past its budget on a busy host.
+ * Mark shipped every dump at the root of `dir` and every script record
+ * under `scripts/` that no earlier capture shipped, and count them.
+ * Nothing is read: the hook wrote each file whole (write + rename), and
+ * the harness ships them as they are.
  */
-export function sourceMapProbeCommand(scriptPaths: string[]): string {
-  const script =
-    'for f in "$@"; do ' +
-    'if [ -f "$f" ]; then ' +
-    "ref=$(grep -o 'sourceMappingURL=[^[:space:]]*' -- \"$f\" 2>/dev/null | tail -n 1 | cut -c18-); " +
-    'if [ -n "$ref" ]; then printf \'%s\\t%s\\n\' "$f" "$ref"; ' +
-    'elif [ -f "$f.map" ]; then printf \'%s\\t%s.map\\n\' "$f" "$f"; ' +
-    'else printf \'%s\\t-\\n\' "$f"; fi; ' +
-    'else printf \'%s\\t!\\n\' "$f"; fi; ' +
-    "done";
-  return `sh -c ${shQuote(script)} sh ${scriptPaths.map(shQuote).join(" ")}`;
-}
-
-/** The length of every line of `text`, the way Node computes it for
- *  `source-map-cache`: split on `\n` (and U+2028/2029), `\r` kept, the
- *  last line included. Lengths in UTF-16 units, which is what V8's byte
- *  offsets count in. */
-export function lineLengthsOf(text: string): number[] {
-  const out: number[] = [];
-  let len = 0;
-  for (let i = 0; i < text.length; i++, len++) {
-    const c = text.charCodeAt(i);
-    if (c === 0x0a || c === 0x2028 || c === 0x2029) {
-      out.push(len);
-      len = -1;
-    }
-  }
-  out.push(len);
-  return out;
-}
-
-/**
- * The source maps of `scriptUrls`, read out of the container. One probe
- * exec ({@link sourceMapProbeCommand}) finds, per script, the map a
- * `sourceMappingURL` comment names or `<script>.map` next to it; only a
- * script that has one is then read (`docker cp`, the script for its line
- * lengths and the map file, or the inline `data:` map decoded). A map's
- * `sourcesContent` is dropped. Scripts that are not `file://` URLs, have
- * no map, or whose map is not there or not JSON are absent from the
- * result. The caller remembers every outcome, so this runs once per
- * script per branch.
- *
- * With no comment the map next to the script is the shape to build a
- * short-lived bundled process in: Node caches a map it finds through a
- * comment into every dump it writes under NODE_V8_COVERAGE, flag or no
- * flag, and a bundled CLI's map is tens of MB per exit; a map it does not
- * find costs nothing there.
- */
-export async function resolveSourceMapsFromContainer(
-  ctx: CoverageCaptureContext,
-  scriptUrls: string[],
-): Promise<Map<string, SourceMapEntry>> {
-  const out = new Map<string, SourceMapEntry>();
-  if (!ctx.readContainerFile) return out;
-  const { fileURLToPath, pathToFileURL } = await import("node:url");
+export async function collectNodeReports(dir: string): Promise<NodeReportStats> {
+  const fs = await import("node:fs/promises");
   const path = await import("node:path");
-  const byPath = new Map<string, string>();
-  for (const url of scriptUrls) {
-    if (!url.startsWith("file://")) continue;
+  const stats: NodeReportStats = { dumps: 0, dumpBytes: 0, scripts: 0, scriptBytes: 0 };
+  const seen = async (d: string, keep: (name: string) => boolean, onNew: (bytes: number) => void): Promise<void> => {
+    let names: string[];
     try {
-      byPath.set(fileURLToPath(url), url);
+      names = await fs.readdir(d);
     } catch {
-      // not a path
+      return;
     }
-  }
-  if (byPath.size === 0) return out;
-  let probe: string;
-  try {
-    probe = (await ctx.exec(sourceMapProbeCommand([...byPath.keys()]))).stdout;
-  } catch {
-    return out; // no shell, no grep: no maps from this container
-  }
-  for (const line of probe.split("\n")) {
-    const tab = line.indexOf("\t");
-    if (tab < 0) continue;
-    const scriptPath = line.slice(0, tab);
-    const ref = line.slice(tab + 1).trim();
-    const url = byPath.get(scriptPath);
-    if (!url || ref === "-" || ref === "!" || ref === "") continue;
-    let mapText: string;
-    let mapUrl: string | null;
-    if (ref.startsWith("data:")) {
-      const comma = ref.indexOf(",");
-      if (comma < 0) continue;
-      const head = ref.slice(5, comma);
-      const body = ref.slice(comma + 1);
+    for (const name of names.sort()) {
+      if (!keep(name)) continue;
+      const file = path.join(d, name);
+      if (SHIPPED_NODE_REPORTS.has(file)) continue;
+      let size: number;
       try {
-        mapText = /;base64$/i.test(head) ? Buffer.from(body, "base64").toString("utf8") : decodeURIComponent(body);
+        size = (await fs.stat(file)).size;
       } catch {
         continue;
       }
-      mapUrl = null;
-    } else {
-      let mapPath: string;
-      if (ref.startsWith("file://")) {
-        try {
-          mapPath = fileURLToPath(ref);
-        } catch {
-          continue;
-        }
-      } else if (/^[a-z]+:/i.test(ref)) {
-        continue; // an http(s) map is not in the container
-      } else {
-        let rel = ref;
-        try {
-          rel = decodeURIComponent(ref);
-        } catch {
-          // keep as written
-        }
-        mapPath = path.resolve(path.dirname(scriptPath), rel);
-      }
-      const map = await ctx.readContainerFile(mapPath);
-      if (!map) continue;
-      mapText = map.toString("utf8");
-      mapUrl = pathToFileURL(mapPath).href;
-    }
-    let data: Record<string, unknown>;
-    try {
-      data = JSON.parse(mapText) as Record<string, unknown>;
-    } catch {
-      continue;
-    }
-    if (!data || typeof data !== "object" || !("mappings" in data)) continue;
-    const script = await ctx.readContainerFile(scriptPath);
-    if (!script) continue;
-    const { sourcesContent: _dropped, ...slim } = data;
-    out.set(url, { url: mapUrl, data: slim, lineLengths: lineLengthsOf(script.toString("utf8")) });
-  }
-  return out;
-}
-
-/** The content hash of a map entry, over its JSON with the spectest
- *  keys removed. */
-function sourceMapEntryHash(entry: Record<string, unknown>): string {
-  const e = { ...entry };
-  delete e[SOURCE_MAP_HASH_KEY];
-  delete e[SOURCE_MAP_REF_KEY];
-  return "sha256:" + createHash("sha256").update(JSON.stringify(e)).digest("hex");
-}
-
-/**
- * Give every kept script of a compacted document a `source-map-cache`
- * entry it lacks: a stub when the map shipped earlier on this branch,
- * else the map `resolve` finds (asked once for all such scripts; shipped
- * whole, with its hash, and remembered), else nothing — and that outcome
- * is remembered too, so a script with no map is looked up once per
- * branch. Returns how many maps `resolve` supplied.
- */
-export async function attachSourceMaps(
-  doc: Record<string, unknown>,
-  resolve: SourceMapResolver,
-  shipped: Map<string, string> = SHIPPED_SOURCE_MAPS,
-  missing: Set<string> = NO_SOURCE_MAP,
-): Promise<number> {
-  const result = Array.isArray(doc.result) ? (doc.result as V8Script[]) : [];
-  const cache = ((doc["source-map-cache"] as Record<string, unknown> | undefined) ?? {}) as Record<string, unknown>;
-  const unknown: string[] = [];
-  for (const s of result) {
-    const url = s.url;
-    if (typeof url !== "string" || url in cache) continue;
-    const prior = shipped.get(url);
-    if (prior) {
-      cache[url] = { [SOURCE_MAP_REF_KEY]: prior };
-      continue;
-    }
-    if (missing.has(url) || unknown.includes(url)) continue;
-    unknown.push(url);
-  }
-  let found = 0;
-  if (unknown.length > 0) {
-    const entries = await resolve(unknown);
-    for (const url of unknown) {
-      const entry = entries.get(url);
-      if (!entry) {
-        missing.add(url);
-        continue;
-      }
-      const hash = sourceMapEntryHash(entry as unknown as Record<string, unknown>);
-      cache[url] = { ...entry, [SOURCE_MAP_HASH_KEY]: hash };
-      shipped.set(url, hash);
-      found++;
+      SHIPPED_NODE_REPORTS.add(file);
+      onNew(size);
     }
-  }
-  if (Object.keys(cache).length > 0) doc["source-map-cache"] = cache;
-  return found;
-}
-
-/**
- * Compact, in place, every `coverage-*.json` in `dir` that no earlier
- * capture shipped, attach the maps the dump lacks through `resolve`
- * ({@link attachSourceMaps}), and mark it shipped. A dump mid-write (not
- * yet valid JSON) is left for the next capture.
- */
-export async function prepareV8Reports(dir: string, resolve?: SourceMapResolver): Promise<PrepareV8Stats> {
-  const fs = await import("node:fs/promises");
-  const path = await import("node:path");
-  const stats: PrepareV8Stats = { dumps: 0, scripts: 0, bytesIn: 0, bytesOut: 0, mapsFromContainer: 0 };
-  let names: string[];
-  try {
-    names = await fs.readdir(dir);
-  } catch {
-    return stats;
-  }
-  for (const name of names.sort()) {
-    if (!name.startsWith("coverage-") || !name.endsWith(".json") || name === NODE_COVERAGE_EMPTY_REPORT) continue;
-    const file = path.join(dir, name);
-    if (SHIPPED_V8_REPORTS.has(file)) continue;
-    let text: string;
-    let doc: Record<string, unknown>;
-    try {
-      text = await fs.readFile(file, "utf8");
-      doc = JSON.parse(text) as Record<string, unknown>;
-    } catch {
-      continue; // a dump mid-write, or not ours; the read path judges it
-    }
-    if (!Array.isArray(doc.result)) continue;
-    const compact = compactV8Document(doc, SHIPPED_SOURCE_MAPS);
-    if (resolve) stats.mapsFromContainer += await attachSourceMaps(compact, resolve);
-    const out = JSON.stringify(compact);
-    const tmp = path.join(dir, `.${name}.compact`);
-    await fs.writeFile(tmp, out);
-    await fs.rename(tmp, file);
-    SHIPPED_V8_REPORTS.add(file);
+  };
+  await seen(dir, isNodeDumpName, (b) => {
     stats.dumps++;
-    stats.scripts += (doc.result as unknown[]).length;
-    stats.bytesIn += text.length;
-    stats.bytesOut += out.length;
-  }
+    stats.dumpBytes += b;
+  });
+  await seen(
+    path.join(dir, NODE_COVERAGE_SCRIPTS_SUBDIR),
+    (n) => n.endsWith(".json"),
+    (b) => {
+      stats.scripts++;
+      stats.scriptBytes += b;
+    },
+  );
   return stats;
 }