@specific.dev/spectest 0.83.0 → 0.85.0

package/src/environment-ca.ts

@@ -0,0 +1,20 @@
+import { readFileSync } from "node:fs";
+
+/** @internal Shared by certificate issuance, trust mounts and the public reader. */
+export const ENVIRONMENT_CA_PATH = process.env.SPECTEST_CA_PATH ?? "/etc/spectest/ca.crt";
+
+/** Read the environment's public CA certificate as a PEM string.
+ * The base VM creates it before importing the environment definition, so it
+ * can be used directly in service env, file contents or runtime client options.
+ * Normal TLS trust is automatic; use this only when explicit CA data is needed.
+ */
+export function ca(): string {
+  try {
+    return readFileSync(ENVIRONMENT_CA_PATH, "utf8");
+  } catch (cause) {
+    throw new Error(
+      `ca(): cannot read the environment CA at ${ENVIRONMENT_CA_PATH}; run this code inside a Spectest environment`,
+      { cause },
+    );
+  }
+}

package/src/harness/container-run.test.ts

@@ -91,13 +91,13 @@ describe("certificate trust", () => {
     expect(envOf(args, "NODE_EXTRA_CA_CERTS")).toBe("/etc/spectest/ca.crt");
   });
 
-  /** The load-bearing one. These three variables REPLACE the trust store,
+  /** The load-bearing one. These variables REPLACE the trust store,
    *  so handing them the bare CA leaves the container trusting spectest and
    *  no public root — Python requests and every AWS SDK then fail to verify
    *  real HTTPS, in any image. They must get the combined bundle. */
   test("the replacing variables get the bundle, never the bare CA", () => {
     const args = runContainerArgs(base({ caBundle: "/etc/spectest/ca-bundle.crt" }));
-    for (const name of ["SSL_CERT_FILE", "REQUESTS_CA_BUNDLE", "AWS_CA_BUNDLE"]) {
+    for (const name of ["SSL_CERT_FILE", "REQUESTS_CA_BUNDLE", "AWS_CA_BUNDLE", "PGSSLROOTCERT"]) {
       expect(envOf(args, name)).toBe("/etc/spectest/ca-bundle.crt");
       expect(envOf(args, name)).not.toBe("/etc/spectest/ca.crt");
     }
@@ -118,10 +118,22 @@ describe("certificate trust", () => {
     const args = runContainerArgs(base({ caBundle: null }));
     expect(envOf(args, "SSL_CERT_FILE")).toBeUndefined();
     expect(envOf(args, "AWS_CA_BUNDLE")).toBeUndefined();
+    expect(envOf(args, "PGSSLROOTCERT")).toBeUndefined();
     // The appending one is still safe to set on its own.
     expect(envOf(args, "NODE_EXTRA_CA_CERTS")).toBe("/etc/spectest/ca.crt");
   });
 
+  test("libpq gets trusted roots without forcing TLS, and may override them", () => {
+    const args = runContainerArgs(base({
+      caBundle: "/etc/spectest/ca-bundle.crt",
+      svc: { name: "web", env: { PGSSLROOTCERT: "/custom.pem" } },
+    }));
+    expect(envOf(args, "PGSSLMODE")).toBeUndefined();
+    expect(args.indexOf("PGSSLROOTCERT=/custom.pem")).toBeGreaterThan(
+      args.indexOf("PGSSLROOTCERT=/etc/spectest/ca-bundle.crt"),
+    );
+  });
+
   test("a bundle equal to the CA path is not mounted twice", () => {
     const args = runContainerArgs(base({ caBundle: "/etc/spectest/ca.crt" }));
     const mounts = args.filter((a) => a === "--volume=/etc/spectest/ca.crt:/etc/spectest/ca.crt:ro");

package/src/harness/container-run.ts

@@ -181,6 +181,9 @@ export function runContainerArgs(input: ContainerRunInput): string[] {
     args.push("-e", `SSL_CERT_FILE=${bundle}`);
     args.push("-e", `REQUESTS_CA_BUNDLE=${bundle}`);
     args.push("-e", `AWS_CA_BUNDLE=${bundle}`);
+    // libpq does not use the system trust store by default. Supply the
+    // same combined roots to psql/psycopg without changing their SSL mode.
+    args.push("-e", `PGSSLROOTCERT=${bundle}`);
     // The system store itself, for clients that read no variable at all.
     // Only a real bundle: the caller falls back to the bare CA when the
     // guest's roots are unreadable, and the bare CA over the system store

package/src/harness/coverage.test.ts

@@ -101,7 +101,7 @@ describe("readCoverageDir", () => {
     await fs.writeFile(path.join(dir, "coverage.json"), "{}");
     const r = await readCoverageDir("web", dir);
     expect(r.reports.length).toBe(1);
-    expect(r.error).toContain("none is an lcov report or a V8 coverage JSON document");
+    expect(r.error).toContain("none is an lcov report, a V8 coverage JSON document, or a `.units` list");
   });
 
   test("listReportFiles skips dotfiles", async () => {
@@ -138,6 +138,8 @@ import {
   renderLcovCounts,
   resetCoverageDeltaMemory,
   subtractLcovCounts,
+  isUnitsReport,
+  walkProjectFiles,
 } from "./coverage.js";
 
 describe("coverage delta", () => {
@@ -216,3 +218,32 @@ describe("coverage delta", () => {
     expect(err.error).toBe("x");
   });
 });
+
+describe("units reports", () => {
+  test("isUnitsReport: one scheme-prefixed id per line, blanks allowed, an empty file is a report", () => {
+    expect(isUnitsReport("npm:picocolors@1.1.1\nmanifest:packages/cli/package.json#3f9a1b2c\n")).toBe(true);
+    expect(isUnitsReport("")).toBe(true);
+    expect(isUnitsReport("\n\n")).toBe(true);
+    expect(isUnitsReport("picocolors\n")).toBe(false);
+    expect(isUnitsReport("npm:a b\n")).toBe(false);
+  });
+  test("readCoverageDir accepts a .units file beside lcov and rejects a malformed one", async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "spectest-units-"));
+    await fs.writeFile(path.join(dir, "node.lcov"), "TN:\nSF:/app/a.js\nDA:1,1\nend_of_record\n");
+    await fs.writeFile(path.join(dir, "inventory.units"), "npm:a@1.0.0\n");
+    const ok = await readCoverageDir("api", dir);
+    expect(ok.error).toBeUndefined();
+    expect(ok.reports.map((r) => r.name)).toEqual(["inventory.units", "node.lcov"]);
+    await fs.writeFile(path.join(dir, "bad.units"), "no scheme here\n");
+    const bad = await readCoverageDir("api", dir);
+    expect(bad.error).toContain("bad.units");
+  });
+  test("walkProjectFiles lists project files and skips node_modules, .git and build output", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "spectest-walk-"));
+    for (const f of ["package.json", "packages/cli/package.json", "packages/cli/src/a.ts", "node_modules/x/package.json", ".git/HEAD", "packages/cli/dist/cli.js"]) {
+      await fs.mkdir(path.join(root, path.dirname(f)), { recursive: true });
+      await fs.writeFile(path.join(root, f), "x");
+    }
+    expect(await walkProjectFiles(root)).toEqual(["package.json", "packages/cli/package.json", "packages/cli/src/a.ts"]);
+  });
+});

package/src/harness/coverage.ts

@@ -124,19 +124,56 @@ export function isSpectestScriptRecord(text: string): boolean {
   return /^\s*\{\s*"spectestScript"\s*:/.test(text);
 }
 
-/** True when `text` is a report spectest stores: lcov, V8 JSON, or a
- *  node() script record. */
-export function isWellFormedReport(text: string): boolean {
+/** True when `text` is a `.units` report: one unit id per non-blank
+ *  line, `<scheme>:<rest>` (`npm:picocolors@1.1.1`,
+ *  `manifest:packages/cli/package.json#3f9a…`). An empty file is a
+ *  report that names no unit. What a unit means is the adapter's; here
+ *  and on the control plane an id is an opaque string. */
+export function isUnitsReport(text: string): boolean {
+  return text.split(/\r?\n/).every((l) => l.trim().length === 0 || /^[a-z][a-z0-9+.-]*:\S+$/.test(l.trim()));
+}
+
+/** True when `text` is a report spectest stores: lcov, V8 JSON, a node()
+ *  script record, or (by name) a `.units` list. */
+export function isWellFormedReport(text: string, name = ""): boolean {
+  if (name.endsWith(".units")) return isUnitsReport(text);
   return isLcovShaped(text) || isV8CoverageJson(text) || isSpectestScriptRecord(text);
 }
 
 /** True when a well-formed report names no source file at all (an lcov
- *  with no `SF:`, a V8 document with an empty `result`). */
+ *  with no `SF:`, a V8 document with an empty `result`, a units list
+ *  with no unit). */
 export function isEmptyReport(text: string): boolean {
   if (isV8CoverageJson(text)) return /"result"\s*:\s*\[\s*\]/.test(text);
+  if (isSpectestScriptRecord(text)) return false;
+  if (isUnitsReport(text) && !isLcovShaped(text)) return text.trim().length === 0;
   return !hasLcovSourceFile(text);
 }
 
+/** Every regular file under `root`, recursively, as `/`-separated paths
+ *  relative to it, with the directories no project file lives in
+ *  skipped. The harness's project file list for an adapter's inventory. */
+export async function walkProjectFiles(root: string): Promise<string[]> {
+  const skip = new Set(["node_modules", ".git", ".spectest", "target", "__pycache__", ".venv", "dist", "build", ".next"]);
+  const out: string[] = [];
+  async function walk(d: string, rel: string): Promise<void> {
+    let entries;
+    try {
+      entries = await fs.readdir(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (skip.has(e.name)) continue;
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) await walk(path.join(d, e.name), r);
+      else if (e.isFile()) out.push(r);
+    }
+  }
+  await walk(root, "");
+  return out.sort();
+}
+
 /** Every regular file under `dir`, recursively, as paths relative to it.
  *  Hidden files are skipped (a tool's own bookkeeping — `.seq`, `.lock`,
  *  a tmp file mid-write — is not a report). */
@@ -198,7 +235,7 @@ export async function readCoverageDir(
         error: `service "${service}" has more than ${COVERAGE_MAX_BYTES_PER_SERVICE >> 20} MiB of reports in ${COVERAGE_CONTAINER_DIR}/ — that is a runaway, not coverage`,
       };
     }
-    if (isWellFormedReport(content)) anyReport = true;
+    if (isWellFormedReport(content, name)) anyReport = true;
     else malformed.push(name);
     reports.push({ name, content });
   }
@@ -208,7 +245,7 @@ export async function readCoverageDir(
       reports,
       error: `service "${service}" wrote ${reports.length} file(s) to ${COVERAGE_CONTAINER_DIR}/ but ${
         anyReport ? `${malformed.slice(0, 5).join(", ")} ${malformed.length === 1 ? "is" : "are"} neither` : "none is"
-      } an lcov report or a V8 coverage JSON document — only those two formats are read`,
+      } an lcov report, a V8 coverage JSON document, or a \`.units\` list — only those are read`,
     };
   }
   return { service, reports };

package/src/index.ts

@@ -159,6 +159,7 @@ export {
 } from "./coverage.js";
 import { applyCoverageAdapters, validateCoverage, type ServiceCoverage } from "./coverage.js";
 import { resolveExistingProjectPath } from "./project-files.js";
+export { ca } from "./environment-ca.js";
 
 // Low-level ingress primitives + the framework lowering that the friendly
 // `tls` / `hostnames` fields and `defineFake(...)` are built on. See