monocart-coverage-reports 3.1.0 → 3.2.0

package/lib/packages/monocart-coverage-vendor.js.LICENSE

@@ -4,19 +4,79 @@ THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
 The following inlined npm packages have license or notice files included below.
 
+- @isaacs/nonrecursive-glob-match@1.0.2
 - balanced-match@4.0.4 (https://github.com/juliangruber/balanced-match)
-- brace-expansion@5.0.9 (https://github.com/juliangruber/brace-expansion)
+- brace-expansion@5.0.12 (https://github.com/juliangruber/brace-expansion)
 - diff-sequences@29.6.3 (https://github.com/jestjs/jest)
 - find-up@8.0.0 (https://github.com/sindresorhus/find-up)
 - locate-path@8.0.0 (https://github.com/sindresorhus/locate-path)
-- minimatch@10.2.6 (https://github.com/isaacs/minimatch)
+- minimatch@11.0.2 (https://github.com/isaacs/minimatch)
 - nanoid@3.3.20 (https://github.com/ai/nanoid)
 - picocolors@1.1.1 (https://github.com/alexeyraspopov/picocolors)
-- postcss@8.5.31 (https://github.com/postcss/postcss)
+- postcss@8.5.32 (https://github.com/postcss/postcss)
 - source-map-js@1.2.2 (https://github.com/7rulnik/source-map-js)
 - supports-color@11.0.0 (https://github.com/chalk/supports-color)
 - unicorn-magic@0.3.0 (https://github.com/sindresorhus/unicorn-magic)
 
+%% @isaacs/nonrecursive-glob-match@1.0.2 NOTICES AND INFORMATION BEGIN HERE
+=========================================
+# Blue Oak Model License
+
+Version 1.0.0
+
+## Purpose
+
+This license gives everyone as much permission to work with
+this software as possible, while protecting contributors
+from liability.
+
+## Acceptance
+
+In order to receive this license, you must agree to its
+rules.  The rules of this license are both obligations
+under that agreement and conditions to your license.
+You must not do anything with this software that triggers
+a rule that you cannot or will not follow.
+
+## Copyright
+
+Each contributor licenses you to do everything with this
+software that would otherwise infringe that contributor's
+copyright in it.
+
+## Notices
+
+You must ensure that everyone who gets a copy of
+any part of this software from you, with or without
+changes, also gets the text of this license or a link to
+<https://blueoakcouncil.org/license/1.0.0>.
+
+## Excuse
+
+If anyone notifies you in writing that you have not
+complied with [Notices](#notices), you can keep your
+license by taking all practical steps to comply within 30
+days after the notice.  If you do not do so, your license
+ends immediately.
+
+## Patent
+
+Each contributor licenses you to do everything with this
+software that would otherwise infringe any patent claims
+they can license or become able to license.
+
+## Reliability
+
+No contributor can revoke this license.
+
+## No Liability
+
+***As far as the law allows, this software comes as is,
+without any warranty or condition, and no contributor
+will be liable to anyone for any damages related to this
+software or this license, under any kind of legal claim.***
+=========================================
+END OF @isaacs/nonrecursive-glob-match@1.0.2 NOTICES AND INFORMATION
 %% balanced-match@4.0.4 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 (MIT)
@@ -44,7 +104,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 =========================================
 END OF balanced-match@4.0.4 NOTICES AND INFORMATION
-%% brace-expansion@5.0.9 NOTICES AND INFORMATION BEGIN HERE
+%% brace-expansion@5.0.12 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 MIT License
 
@@ -70,7 +130,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 =========================================
-END OF brace-expansion@5.0.9 NOTICES AND INFORMATION
+END OF brace-expansion@5.0.12 NOTICES AND INFORMATION
 %% diff-sequences@29.6.3 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 MIT License
@@ -122,7 +182,7 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 =========================================
 END OF locate-path@8.0.0 NOTICES AND INFORMATION
-%% minimatch@10.2.6 NOTICES AND INFORMATION BEGIN HERE
+%% minimatch@11.0.2 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 # Blue Oak Model License
 
@@ -180,7 +240,7 @@ without any warranty or condition, and no contributor
 will be liable to anyone for any damages related to this
 software or this license, under any kind of legal claim._**
 =========================================
-END OF minimatch@10.2.6 NOTICES AND INFORMATION
+END OF minimatch@11.0.2 NOTICES AND INFORMATION
 %% nanoid@3.3.20 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 The MIT License (MIT)
@@ -224,7 +284,7 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 =========================================
 END OF picocolors@1.1.1 NOTICES AND INFORMATION
-%% postcss@8.5.31 NOTICES AND INFORMATION BEGIN HERE
+%% postcss@8.5.32 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 The MIT License (MIT)
 
@@ -247,7 +307,7 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 =========================================
-END OF postcss@8.5.31 NOTICES AND INFORMATION
+END OF postcss@8.5.32 NOTICES AND INFORMATION
 %% source-map-js@1.2.2 NOTICES AND INFORMATION BEGIN HERE
 =========================================
 Copyright (c) 2009-2011, Mozilla Foundation and contributors

package/lib/test/test-reporter.js

@@ -0,0 +1,191 @@
+import fs from 'node:fs';
+import { Transform } from 'node:stream';
+
+const reporterOptions = new URL(import.meta.url).searchParams;
+
+const getStatus = (type, data) => {
+    // Node also accepts an empty string as a skip/todo reason.
+    if (data.skip === true || typeof data.skip === 'string') {
+        return 'skipped';
+    }
+    if (data.todo === true || typeof data.todo === 'string') {
+        return 'todo';
+    }
+    const failureType = data.details.error?.failureType;
+    if (['cancelledByParent', 'testTimeoutFailure', 'testAborted'].includes(failureType)) {
+        return 'cancelled';
+    }
+    return type === 'test:pass' ? 'passed' : 'failed';
+};
+
+const reservedErrorKeys = new Set(['name', 'message', '__proto__', 'constructor', 'prototype']);
+
+const getErrorString = (error, key, fallback) => {
+    // Standard Error names are usually inherited. Resolve only these fixed
+    // fields through descriptors, without invoking accessors or coercion hooks.
+    for (let current = error; current; current = Object.getPrototypeOf(current)) {
+        const descriptor = Object.getOwnPropertyDescriptor(current, key);
+        if (descriptor) {
+            return typeof descriptor.value === 'string' ? descriptor.value : fallback;
+        }
+    }
+    return fallback;
+};
+
+const getErrorPrimitive = (value) => {
+    if (value === null) {
+        return null;
+    }
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return value;
+        case 'number':
+            if (Number.isFinite(value)) {
+                return value;
+            }
+            return;
+        case 'bigint':
+            return String(value);
+        default:
+            break;
+    }
+};
+
+const getError = (error) => {
+    if (!error) {
+        return;
+    }
+    const result = {
+        name: getErrorString(error, 'name', 'Error'),
+        message: getErrorString(error, 'message', '')
+    };
+    // Copy only own enumerable data properties, never getters or object graphs.
+    // Primitive fields may still contain secrets or large strings; redact them
+    // in onTestEnd before raw/debug export when appropriate.
+    for (const key of Object.keys(error)) {
+        if (reservedErrorKeys.has(key)) {
+            continue;
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(error, key);
+        if (!descriptor?.enumerable || !Object.hasOwn(descriptor, 'value')) {
+            continue;
+        }
+        const value = getErrorPrimitive(descriptor.value);
+        if (typeof value !== 'undefined') {
+            result[key] = value;
+        }
+    }
+    return result;
+};
+
+const getTestResult = (type, data) => ({
+    name: data.name,
+    type: data.details.type || 'test',
+    nesting: data.nesting,
+    testNumber: data.testNumber,
+    file: data.file,
+    line: data.line,
+    column: data.column,
+    duration: data.details.duration_ms,
+    status: getStatus(type, data),
+    skip: data.skip,
+    todo: data.todo,
+    error: getError(data.details.error)
+});
+
+const getSummary = (data) => ({
+    tests: data.counts.tests,
+    suites: data.counts.suites,
+    passed: data.counts.passed,
+    failed: data.counts.failed,
+    cancelled: data.counts.cancelled,
+    skipped: data.counts.skipped,
+    todo: data.counts.todo,
+    duration: data.duration_ms,
+    success: data.success
+});
+
+// Node instantiates this stream without arguments. Per-collector options are
+// passed through its module URL, not process.env, so collectors stay isolated.
+export default class TestReporter extends Transform {
+    constructor(id = reporterOptions.get('id'), metadataPath = reporterOptions.get('meta')) {
+        super({
+            writableObjectMode: true
+        });
+        this.id = id;
+        this.metadataPath = metadataPath;
+        this.complete = false;
+        this.summary = null;
+        this.recordCount = 0;
+        this.pending = [];
+        this.pendingBytes = 0;
+        const header = `${JSON.stringify({
+            id, framework: 'node:test'
+        }).slice(0, -1)},"tests":[`;
+        this.byteLength = Buffer.byteLength(header);
+        this.push(header);
+    }
+
+    _transform(event, _encoding, callback) {
+        let chunk;
+        try {
+            const { type, data } = event;
+            if (type === 'test:summary' && !data.file) {
+                this.complete = true;
+                this.summary = getSummary(data);
+            } else if (type === 'test:pass' || type === 'test:fail') {
+                chunk = this.addRecord(getTestResult(type, data));
+            }
+        } catch (error) {
+            callback(error);
+            return;
+        }
+        callback(null, chunk);
+    }
+
+    addRecord(data) {
+        const record = `${this.recordCount ? ',' : ''}${JSON.stringify(data)}`;
+        const byteLength = Buffer.byteLength(record);
+        this.recordCount += 1;
+        this.byteLength += byteLength;
+        this.pending.push(record);
+        this.pendingBytes += byteLength;
+        // Bound memory while avoiding a separate filesystem write for every
+        // small record. Emit the first record without delay.
+        if (this.recordCount === 1 || this.pendingBytes >= 64 * 1024) {
+            return this.takePending();
+        }
+    }
+
+    takePending() {
+        const chunk = this.pending.join('');
+        this.pending = [];
+        this.pendingBytes = 0;
+        return chunk;
+    }
+
+    _flush(callback) {
+        let chunk;
+        try {
+            const { complete, summary } = this;
+            chunk = `],${JSON.stringify({
+                complete, summary
+            }).slice(1)}`;
+            this.byteLength += Buffer.byteLength(chunk);
+            chunk = this.takePending() + chunk;
+            if (this.metadataPath) {
+                // The parent checks this small completion record and the final
+                // byte count after child exit; no full JSON read is needed
+                // unless onTestEnd requests the complete result object.
+                fs.writeFileSync(this.metadataPath, JSON.stringify({
+                    id: this.id, complete, byteLength: this.byteLength
+                }));
+            }
+        } catch (error) {
+            callback(error);
+            return;
+        }
+        callback(null, chunk);
+    }
+}

package/lib/test/test-results.js

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import { Util } from '../utils/util.js';
+
+// Only tokenize NODE_OPTIONS to count option names, keeping quoted values
+// together. The original options and values are passed to Node untouched.
+const splitNodeOptions = (value) => {
+    const tokens = value.match(/(?:[^\s"]|"(?:\\.|[^"\\])*")+/g) || [];
+    return tokens.map((token) => token.replaceAll('"', ''));
+};
+
+const getRunnerOptions = (args) => {
+    const index = args.indexOf('--');
+    return index === -1 ? args : args.slice(0, index);
+};
+
+// Node treats underscores and hyphens as equivalent in option names. Inspect
+// only names here; the original arguments and their values remain untouched.
+const countOption = (args, name) => args.filter((arg) => arg.split('=', 1)[0].replaceAll('_', '-') === name).length;
+
+const getReporterArgs = (args) => {
+    const reporters = countOption(args, '--test-reporter');
+    const destinations = countOption(args, '--test-reporter-destination');
+    // Preserve Node's validation instead of accidentally fixing an invalid pair.
+    if ((reporters > 1 || destinations > 0) && reporters !== destinations) {
+        throw new Error('The number of --test-reporter options must match --test-reporter-destination options');
+    }
+    const extraArgs = [];
+    if (!reporters) {
+        // Node 22 defaults to TAP when stdout is not a TTY; Node 23+ uses spec.
+        const reporter = Number(process.versions.node.split('.')[0]) < 23 && !process.stdout.isTTY ? 'tap' : 'spec';
+        extraArgs.push(`--test-reporter=${reporter}`);
+    }
+    if (!destinations) {
+        extraArgs.push('--test-reporter-destination=stdout');
+    }
+    return extraArgs;
+};
+
+const readMetadata = (metadataPath, resultsPath, id) => {
+    // This is an internal completion record, not an external report input.
+    // Keep the no-hook path bounded even if an interrupted file is malformed.
+    if (fs.statSync(metadataPath).size > 1024) {
+        throw new Error('Invalid Node test report metadata');
+    }
+    const metadata = JSON.parse(fs.readFileSync(metadataPath, 'utf8'));
+    if (metadata?.id !== id || typeof metadata.complete !== 'boolean' || !Number.isSafeInteger(metadata.byteLength) || metadata.byteLength <= 0) {
+        throw new Error('Invalid Node test report metadata');
+    }
+    if (metadata.byteLength !== fs.statSync(resultsPath).size) {
+        throw new Error('Incomplete Node test report output');
+    }
+    return metadata;
+};
+
+const validateResults = (results, id) => {
+    if (results?.id !== id || results.framework !== 'node:test' || typeof results.complete !== 'boolean' || !Array.isArray(results.tests)) {
+        throw new Error('Invalid Node test report');
+    }
+};
+
+const createTestResultsCollector = (runnerArgs, cacheDir) => {
+    const args = [... splitNodeOptions(process.env.NODE_OPTIONS || ''), ... getRunnerOptions(runnerArgs)];
+    const extraArgs = getReporterArgs(args);
+    fs.mkdirSync(cacheDir, {
+        recursive: true
+    });
+    const id = Util.uid();
+    const { cachePath } = Util.getCacheFileInfo('test-results', id, cacheDir);
+    const resultsPath = `${cachePath}.tmp`;
+    const metadataPath = `${cachePath}.meta.tmp`;
+    const reporterURL = new URL('./test-reporter.js', import.meta.url);
+    reporterURL.searchParams.set('id', id);
+    reporterURL.searchParams.set('meta', metadataPath);
+    extraArgs.push(`--test-reporter=${reporterURL.href}`, `--test-reporter-destination=${resultsPath}`);
+    return {
+        args: extraArgs,
+        readMetadata: () => readMetadata(metadataPath, resultsPath, id),
+        read: () => {
+            const results = JSON.parse(fs.readFileSync(resultsPath, 'utf8'));
+            validateResults(results, id);
+            return results;
+        },
+        publish: (results) => {
+            readMetadata(metadataPath, resultsPath, id);
+            if (results) {
+                validateResults(results, id);
+                // onTestEnd can redact messages/names before raw/debug export.
+                // Only configured hooks require a full read and rewrite.
+                fs.writeFileSync(resultsPath, JSON.stringify(results));
+            }
+            fs.renameSync(resultsPath, cachePath);
+        },
+        dispose: () => {
+            fs.rmSync(resultsPath, {
+                force: true
+            });
+            fs.rmSync(metadataPath, {
+                force: true
+            });
+        }
+    };
+};
+
+export { createTestResultsCollector, getRunnerOptions };

package/lib/test/test-runner.js

@@ -0,0 +1,115 @@
+import path from 'node:path';
+import { Util } from '../utils/util.js';
+import { createTestResultsCollector, getRunnerOptions } from './test-results.js';
+
+// Also recognize `mcr -c config -- test targets -- runner-options` without
+// falling through to the shell's unrelated `test` command. Only MCR options
+// before the first separator are parsed in that form.
+const getTestCommand = (args, subArgs) => {
+    if (args[0] === 'test') {
+        return {
+            targets: args.slice(1), runnerArgs: subArgs.slice(1)
+        };
+    }
+    if (args.length || subArgs[1] !== 'test') {
+        return;
+    }
+    const remaining = subArgs.slice(2);
+    const index = remaining.indexOf('--');
+    if (index === -1) {
+        return {
+            targets: remaining, runnerArgs: []
+        };
+    }
+    return {
+        targets: remaining.slice(0, index), runnerArgs: remaining.slice(index + 1)
+    };
+};
+
+// Node owns target parsing, discovery and validation. Preserve each argument.
+const getTestTargets = (test) => {
+    if (!test || (Array.isArray(test) && !test.length)) {
+        Util.logInfo('No test targets configured; skipping tests.');
+        return;
+    }
+    return Array.isArray(test) ? test : [test];
+};
+
+const initTestResultsCollector = (coverageOptions, runnerArgs, childArgs) => {
+    // Read results before coverage generation, which may remove the cache.
+    const testResultsCollector = createTestResultsCollector(runnerArgs, coverageOptions.cacheDir);
+    // Internal options must stay before Node's end-of-options marker.
+    childArgs.splice(1 + getRunnerOptions(runnerArgs).length, 0, ... testResultsCollector.args);
+    return testResultsCollector;
+};
+
+const runTestEnd = async (testResultsCollector, onTestEnd) => {
+    if (!testResultsCollector) {
+        return 0;
+    }
+    try {
+        const metadata = testResultsCollector.readMetadata();
+        const failed = !metadata.complete;
+        if (failed) {
+            Util.logError('Node test report is incomplete');
+        }
+        let testResults;
+        if (typeof onTestEnd === 'function') {
+            testResults = testResultsCollector.read();
+            await onTestEnd(testResults);
+        }
+        // Publish only after a successful hook, so redaction reaches raw/debug
+        // artifacts. Never fall back to unredacted data if the hook throws.
+        testResultsCollector.publish(testResults);
+        return process.exitCode || (failed ? 1 : 0);
+    } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        Util.logError(`Node test report collection or onTestEnd failed: ${message}`);
+        return 1;
+    } finally {
+        // Do not export unfinished reporter output through coverage raw reports.
+        testResultsCollector.dispose();
+    }
+};
+
+const createTestRunner = (coverageOptions, runnerArgs = []) => {
+    const targets = getTestTargets(coverageOptions.test);
+    if (!targets) {
+        return;
+    }
+    const childArgs = ['--test', ... runnerArgs, ... targets];
+    let testResultsCollector;
+    let onTestEnd;
+    return {
+        initCoverageDir: (nodeV8CoverageDir) => {
+            // Tests may spawn children with a different working directory.
+            process.env.NODE_V8_COVERAGE = path.resolve(nodeV8CoverageDir);
+        },
+        onClose: async (generateCoverage) => {
+            const testExitCode = await runTestEnd(testResultsCollector, onTestEnd);
+            try {
+                const report = await generateCoverage();
+                if (!report) {
+                    throw new Error('No coverage report was generated');
+                }
+            } finally {
+                // A later coverage hook must not mask a test hook/collection failure.
+                if (testExitCode) {
+                    process.exitCode = process.exitCode || testExitCode;
+                }
+            }
+        },
+        execute: async (executeSubprocess, onClose) => {
+            // Always collect results; onStart may still configure the optional hook.
+            onTestEnd = coverageOptions.onTestEnd;
+            testResultsCollector = initTestResultsCollector(coverageOptions, runnerArgs, childArgs);
+            try {
+                return await executeSubprocess(process.execPath, childArgs, onClose);
+            } finally {
+                testResultsCollector?.dispose();
+            }
+        }
+    };
+};
+
+export { getTestCommand, createTestRunner };

package/migrate-to-3.md

@@ -158,6 +158,10 @@ Custom reporter interfaces are unchanged: Istanbul reporters implement `execute(
 - `mcr test` is a new **optional** command; you do not have to replace your existing test runner.
 - `outputFilter` is a new **optional** filter, disabled by default. You do not have to replace `entryFilter` / `sourceFilter` with it.
 
+### Review test-result artifacts when upgrading to 3.2.0+
+
+Starting in 3.2.0, `mcr test` always collects structured test results, even without `onTestEnd`. Raw exports (including ZIP) and debug caches can now include `test-results-<id>.json`, containing test names, paths and error strings that may be sensitive. Review existing automatic artifact uploads and retention policies. Use [`onTestEnd`](README.md#ontestend--mcr-test-only) to redact persisted results before publication; terminal output and temporary files already written are not redacted. Raw imports still merge coverage only, not test results. Other commands and API calls do not collect these test results.
+
 ## Migration checklist
 
 - [ ] Upgrade Node.js in local, CI, container and relevant child-process environments.