@specific.dev/spectest 0.90.3 → 0.91.1

package/dist/harness/sticky-kubernetes.js

@@ -0,0 +1,163 @@
+/** Kubernetes owns a separate containerd store; Docker/BuildKit GC cannot
+ * collect it. Maintenance runs only on the isolated publication clone. */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import { STICKY_ROOT } from "./sticky-paths.js";
+const STORE_TARGET = "/var/lib/rancher/k3s/agent/containerd";
+const SOCKET = "/run/spectest-cache.sock";
+const ROOT = `${STICKY_ROOT}/kubernetes`;
+const IMAGE_ID = /^sha256:[a-f0-9]{64}$/;
+const SERVICE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+export function stickyKubernetesDirectory(service, version) {
+    // Version changes must not open old metadata with a different containerd.
+    const layout = createHash("sha256").update(`overlayfs-v1:${version}`).digest("hex").slice(0, 16);
+    return `${ROOT}/${service}/${layout}`;
+}
+const runCommand = async (program, args, timeout = 30_000) => (await promisify(execFile)(program, args, { timeout })).stdout.trim();
+export async function registerStickyKubernetesStore(service, version, run = runCommand) {
+    if (!SERVICE_NAME.test(service))
+        throw new Error(`invalid Kubernetes cache service name: ${service}`);
+    // Respect custom Dockerfile overrides of the component's image.
+    const image = (await run("docker", ["inspect", "--format", "{{.Image}}", service])).trim();
+    if (!IMAGE_ID.test(image))
+        throw new Error(`cannot identify Kubernetes runtime image for ${service}`);
+    const directory = stickyKubernetesDirectory(service, version);
+    await mkdir(directory, { recursive: true });
+    const temporary = `${directory}/store.${randomUUID()}.tmp`;
+    await writeFile(temporary, JSON.stringify({ schema: 1, image, updatedAt: Date.now() }));
+    await rename(temporary, `${directory}/store.json`);
+}
+/** Standalone containerd never starts CRI/kubelet or any inherited workload.
+ * Native API deletion preserves content and committed image snapshots while
+ * releasing sandbox, container, lease and writable snapshot references. */
+export const KUBERNETES_CACHE_MAINTENANCE_SH = `set -eu
+exec 2>&1
+cat > /run/cache.toml <<'CONFIG'
+version = 2
+disabled_plugins = ["io.containerd.grpc.v1.cri", "io.containerd.cri.v1.runtime", "io.containerd.cri.v1.images"]
+CONFIG
+containerd --config /run/cache.toml --root ${STORE_TARGET} --state /run/cache-state --address ${SOCKET} > /run/cache.log 2>&1 &
+pid=$!
+stop() { kill "$pid"; wait "$pid"; }
+trap 'stop; exit 0' TERM INT
+trap 'kill "$pid" 2>/dev/null || true' EXIT
+c() { ctr --address ${SOCKET} --namespace k8s.io "$@"; }
+i=0
+until c version >/dev/null 2>&1; do
+  kill -0 "$pid" || { cat /run/cache.log; exit 1; }
+  i=$((i+1)); [ "$i" -lt 300 ] || { cat /run/cache.log; exit 1; }
+  sleep 0.1
+done
+ids=$(c containers ls -q)
+if [ -n "$ids" ]; then c containers rm $ids; fi
+# 1.7 has no sandbox store; 2.x does.
+case "$(containerd --version)" in
+  *v1.*) ;;
+  *) sandboxes=$(c sandboxes ls)
+     ids=$(printf '%s\\n' "$sandboxes" | awk 'NR > 1 {print $1}')
+     if [ -n "$ids" ]; then c sandboxes rm --force $ids; fi ;;
+esac
+ids=$(c leases ls -q)
+if [ -n "$ids" ]; then c leases rm $ids; fi
+# Remove children before parents, and tolerate asynchronous GC winning a race.
+previous=''
+while :; do
+  snapshots=$(c snapshots --snapshotter overlayfs ls)
+  ids=$(printf '%s\\n' "$snapshots" | awk 'NR > 1 && $NF != "Committed" {print $1}')
+  [ -n "$ids" ] || break
+  [ "$ids" != "$previous" ] || { echo 'cannot clean Kubernetes writable snapshots' >&2; exit 1; }
+  previous="$ids"
+  for id in $ids; do c snapshots --snapshotter overlayfs rm "$id" >/dev/null 2>&1 || true; done
+done
+touch /run/cache-ready
+while :; do sleep 1 & wait $!; done
+`;
+export async function openKubernetesCacheMaintenance(run, root = ROOT) {
+    const stores = [];
+    const protectedImages = new Set();
+    const closeStore = async (store) => {
+        if (!store.active)
+            return;
+        await run("docker", ["stop", "--time", "30", store.container], 45_000);
+        const status = JSON.parse(await run("docker", ["inspect", "--format", "{{json .State}}", store.container]));
+        if (status.ExitCode !== 0 || status.OOMKilled)
+            throw new Error(`unclean Kubernetes cache shutdown: ${store.container}`);
+        await run("docker", ["rm", store.container]);
+        store.active = false;
+        if (!stores.some(other => other.active && other.descriptor.image === store.descriptor.image))
+            protectedImages.delete(store.descriptor.image);
+        // These contain runtime state, not image content or unpacked layers.
+        await run("rm", ["-rf", ...["io.containerd.runtime.v2.task", "io.containerd.grpc.v1.cri", "io.containerd.cri.v1.runtime", "tmpmounts"]
+                .map(child => `${store.directory}/containerd/${child}`)]);
+    };
+    const close = async () => {
+        const failures = [];
+        for (const store of stores) {
+            try {
+                await closeStore(store);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (failures.length)
+            throw new AggregateError(failures, "Kubernetes cache shutdown failed");
+    };
+    const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    try {
+        for (const service of entries) {
+            if (!service.isDirectory() || !SERVICE_NAME.test(service.name))
+                continue;
+            for (const layout of await readdir(`${root}/${service.name}`, { withFileTypes: true })) {
+                if (!layout.isDirectory() || !/^[a-f0-9]{16}$/.test(layout.name))
+                    continue;
+                const directory = `${root}/${service.name}/${layout.name}`;
+                const descriptor = JSON.parse(await readFile(`${directory}/store.json`, "utf8"));
+                if (descriptor.schema !== 1 || !IMAGE_ID.test(descriptor.image) || !Number.isSafeInteger(descriptor.updatedAt)) {
+                    throw new Error(`invalid Kubernetes cache descriptor: ${directory}`);
+                }
+                const container = `spectest-k8s-cache-${randomUUID()}`;
+                await run("docker", ["run", "-d", "--name", container, "--network", "none", "--privileged", "--stop-signal", "SIGTERM", "--tmpfs", "/run", "--tmpfs", "/var/run",
+                    "--mount", `type=bind,source=${directory}/containerd,target=${STORE_TARGET}`,
+                    "--entrypoint", "/bin/sh", descriptor.image, "-c", KUBERNETES_CACHE_MAINTENANCE_SH]);
+                stores.push({ directory, descriptor, container, active: true });
+                protectedImages.add(descriptor.image);
+                try {
+                    await run("docker", ["exec", container, "sh", "-c", "i=0; until [ -f /run/cache-ready ]; do i=$((i+1)); [ $i -lt 900 ] || exit 1; sleep 0.1; done"], 100_000);
+                }
+                catch (error) {
+                    const logs = await run("docker", ["logs", "--tail", "40", container]).catch(() => "");
+                    throw new Error(`Kubernetes cache preparation failed for ${directory}: ${logs}`, { cause: error });
+                }
+            }
+        }
+        stores.sort((a, b) => a.descriptor.updatedAt - b.descriptor.updatedAt || a.directory.localeCompare(b.directory));
+        let next = 0;
+        const pruneOldest = async () => {
+            const store = stores[next++];
+            if (!store)
+                return false;
+            await run("docker", ["exec", store.container, "sh", "-ec",
+                `ids=$(ctr -a ${SOCKET} -n k8s.io images ls -q); if [ -n "$ids" ]; then ctr -a ${SOCKET} -n k8s.io images rm --sync $ids; fi`], 120_000);
+            await closeStore(store);
+            // No writer remains. Discard the now-empty cache and its descriptor so
+            // obsolete k3s binaries can also be collected by the outer Docker GC.
+            await run("rm", ["-rf", store.directory]);
+            return true;
+        };
+        // Abandoned services/versions should not occupy the disk indefinitely.
+        while (stores[next] && stores[next].descriptor.updatedAt < Date.now() - 7 * 24 * 60 * 60 * 1000)
+            await pruneOldest();
+        return { protectedImages, pruneOldest, close };
+    }
+    catch (error) {
+        await close().catch(() => { });
+        throw error;
+    }
+}

package/dist/harness/sticky-paths.d.ts

@@ -0,0 +1,5 @@
+export declare const STICKY_ROOT = "/var/lib/spectest-sticky";
+export declare const STICKY_RUNTIME = "/run/spectest-sticky";
+/** Written only after the supervisor mounts this project's private disk. */
+export declare function stickyDiskPathSync(manifest?: string): string | null;
+export declare function isOnStickyDisk(path: string, root?: string | null): boolean;

package/dist/harness/sticky-paths.js

@@ -0,0 +1,18 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+export const STICKY_ROOT = "/var/lib/spectest-sticky";
+export const STICKY_RUNTIME = "/run/spectest-sticky";
+/** Written only after the supervisor mounts this project's private disk. */
+export function stickyDiskPathSync(manifest = `${STICKY_RUNTIME}/consumer.json`) {
+    try {
+        const config = JSON.parse(readFileSync(manifest, "utf8"));
+        return config.path === STICKY_ROOT ? STICKY_ROOT : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function isOnStickyDisk(path, root = stickyDiskPathSync()) {
+    const absolute = resolve(path);
+    return root !== null && (absolute === root || absolute.startsWith(`${root}/`));
+}

package/dist/index.d.ts

@@ -74,6 +74,8 @@ export interface EnvironmentConfig<S extends ServicesMap = ServicesMap> {
 export interface ServiceConfig {
     /** Image definition: registry pull or inline build. */
     image: ServiceImage;
+    /** @internal Images built by the harness and loaded into this component. */
+    imageBuilds?: readonly ComponentImageBuild[];
     /**
      * Shell command to run (sh -c). Defaults to the image's CMD. NB: this
      * **replaces the image's entrypoint** with `/bin/sh -c` — an
@@ -741,11 +743,14 @@ export interface ServiceTls {
      * daemon forwards proxied requests here over `spectest-net`. */
     port: number;
 }
-export type ServiceImage = {
+/** @internal Normalized wire representation; legacy definitions remain accepted. */
+export type NormalizedServiceImage = {
     type: "registry";
     reference: string;
 } | {
     type: "dockerfile";
+    /** Optional full local image reference. */
+    reference?: string;
     /**
      * Path of a Dockerfile in your repo, relative to the project root
      * (where `spectest/` lives) — `"Dockerfile"`, `"apps/api/Dockerfile"`.
@@ -787,6 +792,8 @@ export type ServiceImage = {
     buildArgs?: Readonly<Record<string, string>>;
 } | {
     type: "dockerfile";
+    /** Optional full local image reference. */
+    reference?: string;
     /**
      * Dockerfile contents, built as if the file sat outside the build
      * context (it is never written into your repo). The context is the
@@ -815,6 +822,29 @@ export type ServiceImage = {
      */
     buildArgs?: Readonly<Record<string, string>>;
 };
+/** Dockerfile build options shared by services and Kubernetes images. */
+export type BuildImage = (Omit<Extract<NormalizedServiceImage, {
+    type: "dockerfile";
+    path: string;
+}>, "type"> | Omit<Extract<NormalizedServiceImage, {
+    type: "dockerfile";
+    content: string;
+}>, "type">) & {
+    /** Full image reference, e.g. "k8s.internal:5000/runtime:spectest".
+     * Optional for a service; required for a Kubernetes build. This names a
+     * local image and does not publish it to a registry. */
+    reference?: string;
+};
+/** A registry reference or Dockerfile build. Tagged objects from older SDKs
+ * remain accepted for compatibility; new definitions do not need `type`. */
+export type ServiceImage = string | BuildImage | NormalizedServiceImage;
+/** @internal Keep the wire format compatible with existing control planes. */
+export declare function normalizeServiceImage(image: ServiceImage): NormalizedServiceImage;
+/** @internal Serializes build-only work with the owning component. */
+export interface ComponentImageBuild {
+    reference: string;
+    image: BuildImage;
+}
 /**
  * Check a service's `image` at config time, so a mistake fails the
  * environment load with a message that names it, instead of a build
@@ -831,7 +861,7 @@ export type ServiceImage = {
  * checks go through the project-file resolver, so the same rules as
  * `ctx.readProjectFile` apply.
  */
-export declare function validateServiceImage(serviceName: string, image: ServiceImage): ServiceImage;
+export declare function validateServiceImage(serviceName: string, input: ServiceImage): NormalizedServiceImage;
 export interface VolumeMount {
     /**
      * Named shared volume. Two services mounting the same `name` share one

package/dist/index.js

@@ -220,6 +220,19 @@ function expandServiceGroups(input) {
     }
     return out;
 }
+/** @internal Keep the wire format compatible with existing control planes. */
+export function normalizeServiceImage(image) {
+    if (typeof image === "string")
+        return { type: "registry", reference: image };
+    if (!image || typeof image !== "object" || Array.isArray(image))
+        throw new Error("image must be a registry reference or Dockerfile build");
+    if ("type" in image) {
+        if (image.type !== "registry" && image.type !== "dockerfile")
+            throw new Error("unsupported image type");
+        return image;
+    }
+    return { ...image, type: "dockerfile" };
+}
 /** A Dockerfile `ARG` name: what `docker build --build-arg` accepts as a key. */
 const BUILD_ARG_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function validateBuildArgs(serviceName, buildArgs) {
@@ -255,9 +268,17 @@ const BUILD_TARGET_RE = /^[^\s]+$/;
  * checks go through the project-file resolver, so the same rules as
  * `ctx.readProjectFile` apply.
  */
-export function validateServiceImage(serviceName, image) {
+export function validateServiceImage(serviceName, input) {
+    const image = normalizeServiceImage(input);
+    const reference = typeof input === "string" ? input : "reference" in input ? input.reference : undefined;
+    if (reference !== undefined && (typeof reference !== "string" || !reference || reference.startsWith("-") || /[\s\x00]/.test(reference)))
+        throw new Error(`service "${serviceName}" image reference must be a non-empty image name without whitespace`);
     if (image.type !== "dockerfile")
         return image;
+    if (reference?.includes("@"))
+        throw new Error(`service "${serviceName}" build reference must be an image name/tag, not a digest`);
+    if (image.exclude !== undefined && (!Array.isArray(image.exclude) || image.exclude.some(e => typeof e !== "string")))
+        throw new Error(`service "${serviceName}" image exclude must be an array of glob patterns`);
     validateBuildArgs(serviceName, image.buildArgs);
     const hasPath = typeof image.path === "string";
     const hasContent = typeof image.content === "string";
@@ -265,7 +286,7 @@ export function validateServiceImage(serviceName, image) {
         throw new Error(`service "${serviceName}" image sets both \`path\` and \`content\` — point at the Dockerfile in your repo with \`path\`, or inline it with \`content\`, not both`);
     }
     if (!hasPath && !hasContent) {
-        throw new Error(`service "${serviceName}" image { type: "dockerfile" } needs \`path\` (a Dockerfile in your repo, relative to the project root) or \`content\``);
+        throw new Error(`service "${serviceName}" image build needs \`path\` (a Dockerfile in your repo, relative to the project root) or \`content\``);
     }
     if (hasPath) {
         const file = resolveExistingProjectPath(image.path, `service "${serviceName}" Dockerfile`);
@@ -403,6 +424,8 @@ export function defineEnvironment(input) {
     const { fakes, services: rawServices, ...rest } = input;
     const expanded = expandServiceGroups(rawServices);
     for (const [key, svc] of Object.entries(expanded)) {
+        for (const build of svc.imageBuilds ?? [])
+            validateServiceImage(`${key} image ${build.reference}`, build.image);
         expanded[key] = applyCoverageAdapters(key, {
             ...svc,
             image: validateServiceImage(key, svc.image),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.90.3",
+  "version": "0.91.1",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/android-step.test.ts

@@ -41,7 +41,7 @@ const cases: [Omit<AndroidStepDetails, "device">, string][] = [
       target: { kind: "accessibility", value: "Save" },
       state: "hidden",
     },
-    'wait for accessibility label "Save" to be hidden',
+    'wait for label "Save" to be hidden',
   ],
   [
     {
@@ -86,7 +86,7 @@ const cases: [Omit<AndroidStepDetails, "device">, string][] = [
 for (const [action, title] of cases) {
   test(title, () =>
     expect(androidStepTitle({ device: "phone", ...action })).toBe(
-      `phone: ${title}`,
+      title,
     ),
   );
 }
@@ -100,7 +100,7 @@ test("custom selector expressions remain opaque structured data", () => {
     value: expression,
   });
   expect(androidStepTitle({ device: "phone", action: "tap", target })).toBe(
-    "phone: tap custom selector",
+    "tap custom selector",
   );
   for (const [using, kind] of [
     ["id", "id"],

package/src/android-step.ts

@@ -43,7 +43,7 @@ export function androidTargetLabel(target: AndroidTarget): string {
     case "id":
       return `id ${quoted}`;
     case "accessibility":
-      return `accessibility label ${quoted}`;
+      return `label ${quoted}`;
     case "xpath":
       return `XPath ${quoted}`;
     case "custom":
@@ -103,5 +103,5 @@ export function androidStepTitle(step: AndroidStepDetails): string {
       label = `run command ${JSON.stringify(step.command)}`;
       break;
   }
-  return `${step.device}: ${label}`;
+  return label;
 }

package/src/android.test.ts

@@ -156,12 +156,12 @@ describe("Android case lifecycle", () => {
       const steps = events.filter((e) => e.kind === "android");
       expect(steps.length).toBe(7);
       expect(steps[0]).toMatchObject({
-        title: String.raw`phone: fill text "a \"quoted\" label"`,
+        title: String.raw`fill text "a \"quoted\" label"`,
         android: { device: "phone", action: "fill", target: { kind: "text", value: 'a "quoted" label' } },
       });
       expect(steps[1]).toMatchObject({ android: { device: "phone", action: "text", target: { kind: "id", value: "com.example.app:id/draft" } } });
-      expect(steps[2]).toMatchObject({ title: "phone: take screenshot", android: { device: "phone", action: "screenshot" } });
-      expect(steps[3]).toMatchObject({ title: 'phone: tap text "Save"', android: { device: "phone", action: "tap", target: { kind: "text", value: "Save" } } });
+      expect(steps[2]).toMatchObject({ title: "take screenshot", android: { device: "phone", action: "screenshot" } });
+      expect(steps[3]).toMatchObject({ title: 'tap text "Save"', android: { device: "phone", action: "tap", target: { kind: "text", value: "Save" } } });
       expect(steps[4]).toMatchObject({ android: { device: "phone", action: "tap", point: { x: 270, y: 1800 } } });
       expect(steps[5]).toMatchObject({ status: "failed", android: { device: "phone", action: "tap", target: { kind: "text", value: "Gone" } } });
       expect(JSON.stringify(steps)).not.toContain("private draft");

package/src/components/index.ts

@@ -26,6 +26,7 @@ export { SQL, type SqlClient, type SqlOptions } from "../sql.js";
 export {
   k3s,
   type K3sOptions,
+  type KubernetesImage,
   type K3sHelpers,
   type K3sClient,
   type TaggedObjectApi,

package/src/components/k3s-concurrency.test.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import { k3s } from "./k3s";
+
+function deferred() {
+  let resolve!: () => void;
+  const promise = new Promise<void>(r => { resolve = r; });
+  return { promise, resolve };
+}
+
+test("registry, Traefik, and every declared pull start without waiting for one another", async () => {
+  const started = new Set<string>();
+  const allStarted = deferred(), release = deferred();
+  const enter = async (name: string) => {
+    started.add(name);
+    if (started.size === 5) allStarted.resolve();
+    await release.promise;
+  };
+  const cluster = k3s({ images: ["app:1", "app:2", "app:3"] });
+  let finished = false;
+  const work = cluster.setup({ name: "cluster", helpers: {
+    apply: async (manifest: string) => { await enter(manifest.includes("spectest-registry") ? "registry" : "traefik"); },
+    waitForRollout: async () => {},
+  }, exec: async (_name: string, args: string[]) => {
+    if (args[3] === "pull") await enter(args.at(-1)!);
+    return { exitCode: 0, stdout: "", stderr: "" };
+  } } as never).then(() => { finished = true; });
+  try {
+    await Promise.race([allStarted.promise, Bun.sleep(1000).then(() => { throw new Error(`serialized setup: ${[...started]}`); })]);
+    expect(finished).toBe(false);
+    expect(started.size).toBe(5);
+  } finally { release.resolve(); await work; }
+});
+
+test("a failed infrastructure rollout waits for other rollouts and image pulls to stop", async () => {
+  const started = deferred(), release = deferred();
+  let active = 0, finished = false;
+  const hold = async () => {
+    if (++active === 2) started.resolve();
+    await release.promise;
+    --active;
+  };
+  const failure = new Error("Traefik failed");
+  const cluster = k3s({ images: ["app:1"] });
+  const work = cluster.setup({ name: "cluster", helpers: {
+    apply: async () => {},
+    waitForRollout: async (deployment: string) => {
+      if (deployment === "traefik") throw failure;
+      await hold();
+    },
+  }, exec: async (_name: string, args: string[]) => {
+    if (args[3] === "pull") await hold();
+    return { exitCode: 0, stdout: "", stderr: "" };
+  } } as never).then(() => { finished = true; }, error => { finished = true; return error; });
+  try {
+    await started.promise;
+    expect(finished).toBe(false);
+  } finally { release.resolve(); }
+  expect(await work).toBe(failure);
+  expect(active).toBe(0);
+});

package/src/components/k3s-trust.test.ts

@@ -0,0 +1,81 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { request } from "node:https";
+import { installPodTrust, podTrustPatch, stopPodTrust, TRUST_OPT_OUT } from "./k3s-trust";
+
+function patched<T>(value: T, patch: ReturnType<typeof podTrustPatch>): T {
+  const out = structuredClone(value);
+  for (const operation of patch) {
+    const keys = operation.path.slice(1).split("/");
+    const key = keys.pop()!;
+    const parent = keys.reduce((o, k) => o[k], out as any);
+    if (key === "-") parent.push(operation.value); else parent[key] = operation.value;
+  }
+  return out;
+}
+
+test("mounts trust into regular and init containers without changing images or security settings", () => {
+  const pod = { spec: { containers: [{ name: "app", image: "app@sha256:original", securityContext: { runAsUser: 1000, readOnlyRootFilesystem: true } }], initContainers: [{ name: "init", image: "init:1" }] } };
+  const patch = podTrustPatch(pod, "bundle");
+  const result: any = patched(pod, patch);
+  expect(result.spec.containers[0].image).toBe("app@sha256:original");
+  expect(result.spec.containers[0].securityContext).toEqual(pod.spec.containers[0].securityContext);
+  expect(result.spec.initContainers[0].env).toContainEqual({ name: "SSL_CERT_FILE", value: "/spectest/ca-bundle.crt" });
+  expect(result.spec.volumes[0].configMap.name).toBe("bundle");
+  expect(result.spec.containers[0].volumeMounts.every((m: any) => m.readOnly)).toBe(true);
+  expect(podTrustPatch(result, "bundle")).toEqual([]);
+  expect(pod).not.toHaveProperty("spec.volumes");
+});
+
+test("preserves explicit trust settings and mounts, including volume name collisions", () => {
+  const pod = { spec: {
+    volumes: [{ name: "spectest-ca", emptyDir: {} }],
+    containers: [{ env: [{ name: "SSL_CERT_FILE", value: "/custom.pem" }], volumeMounts: [{ name: "custom", mountPath: "/etc/ssl" }] }],
+  } };
+  const result: any = patched(pod, podTrustPatch(pod, "bundle"));
+  expect(result.spec.volumes[1].name).toBe("spectest-ca-1");
+  expect(result.spec.containers[0].env.filter((e: any) => e.name === "SSL_CERT_FILE")).toEqual([{ name: "SSL_CERT_FILE", value: "/custom.pem" }]);
+  expect(result.spec.containers[0].volumeMounts.some((m: any) => m.mountPath === "/etc/ssl/certs/ca-certificates.crt")).toBe(false);
+});
+
+test("opt-out, Windows and ephemeral container updates are handled without changing immutable Pod volumes", () => {
+  expect(podTrustPatch({ metadata: { annotations: { [TRUST_OPT_OUT]: "false" } }, spec: { containers: [{}] } }, "bundle")).toEqual([]);
+  expect(podTrustPatch({ spec: { os: { name: "windows" }, containers: [{}] } }, "bundle")).toEqual([]);
+  expect(podTrustPatch({ spec: { ephemeralContainers: [{}] } }, "bundle", true)).toEqual([]);
+  const result: any = patched({ spec: { containers: [{}], ephemeralContainers: [{}], volumes: [{ name: "existing", configMap: { name: "bundle" } }] } }, podTrustPatch({ spec: { ephemeralContainers: [{}], volumes: [{ name: "existing", configMap: { name: "bundle" } }] } }, "bundle", true));
+  expect(result.spec.volumes).toHaveLength(1);
+  expect(result.spec.containers[0]).toEqual({});
+  expect(result.spec.ephemeralContainers[0].volumeMounts[0].name).toBe("existing");
+});
+
+afterEach(() => stopPodTrust("fixture"));
+test("admission uses verified TLS, provisions bundles on real requests, and fails closed", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "k3s-trust-"));
+  try {
+    execFileSync("openssl", ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-keyout", join(dir, "key"), "-out", join(dir, "cert"), "-subj", "/CN=fixture", "-addext", "subjectAltName=IP:127.0.0.1", "-days", "1"], { stdio: "ignore" });
+    const cert = readFileSync(join(dir, "cert"), "utf8");
+    let config: any, calls = 0, fail = false;
+    await installPodTrust({ name: "fixture", gateway: "127.0.0.1", bundle: "bundle", cert, key: readFileSync(join(dir, "key"), "utf8"), ca: cert }, {
+      apply: async c => { config = c; },
+      ensureBundle: async namespace => { expect(namespace).toBe("app"); calls++; if (fail) throw new Error("API unavailable"); },
+    });
+    expect(config.webhooks[0].failurePolicy).toBe("Fail");
+    const send = (dryRun = false) => new Promise<{ status: number; body: any }>((resolve, reject) => {
+      const req = request(config.webhooks[0].clientConfig.url + "?timeout=10s", { method: "POST", ca: cert }, res => {
+        let body = ""; res.on("data", c => body += c); res.on("end", () => resolve({ status: res.statusCode!, body: res.statusCode === 200 ? JSON.parse(body) : body }));
+      });
+      req.on("error", reject);
+      req.end(JSON.stringify({ request: { uid: "request-1", resource: { resource: "pods" }, namespace: "app", dryRun, object: { spec: { containers: [{}] } } } }));
+    });
+    const dry = await send(true);
+    expect(dry.body.response.uid).toBe("request-1");
+    expect(calls).toBe(0);
+    expect((await send()).status).toBe(200);
+    expect(calls).toBe(1);
+    fail = true;
+    expect((await send()).status).toBe(500);
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});