@specific.dev/spectest 0.92.1 → 0.93.1

package/README.md

@@ -106,3 +106,10 @@ renderer DOM from acquisition onward, not native OS surfaces.
 
 Run `spectest docs /components/electron` for the full configuration reference,
 backend setup, session behavior, and replay scope (CLI 0.2.124 or later).
+
+`k3s({ registry: { host: "registry.test" }, images: [...] })` exposes the
+component's writable registry over verified HTTPS through the VM proxy.
+Dockerfile builds in `images` targeting `registry.test/...` are published and
+preloaded from the same cached build, preserving digests without an export/push
+step. Other images keep direct preloading. Registry writes stay isolated across
+test forks; client and containerd CA trust are configured automatically.

package/dist/components/email.js

@@ -1,22 +1,5 @@
-// `email()` — a real SMTP server as a spectest service. The app under test
-// points its SMTP transport at `<key>:1025` and sends mail exactly as it
-// would in production; every message is captured instead of delivered.
-// Tests read the mailbox through typed helpers on `ctx.svc.<key>`
-// (`lastEmail`, `emails`, `clear`), each recorded as an `email` event on
-// the test timeline — single-message ops embed the full captured message
-// (HTML body included) so the dashboard renders the actual email the test
-// asserted against, and returns come back inspect-wrapped so
-// `expect(mail.subject)` links under the step. To wait for a message to
-// *arrive*, use the standard `ctx.poll` with `lastEmail` as the predicate
-// (it returns `undefined` while the mailbox is empty); the winning
-// iteration's `email` event survives poll truncation, so the message still
-// renders nested under the wait step.
-//
-// Captured mail lives in the server's process memory, so it snapshots and
-// forks with the rest of the environment: a `dependsOn` child inherits the
-// parent's mailbox, sibling forks never see each other's messages — the
-// same isolation contract as fake state.
-import { pauseRecording, recordEmail, reserveEvent, resumeRecording, truncateUtf8, } from "../recorder.js";
+import { rawFetch } from "../harness/raw-fetch.js";
+import { recordEmail, reserveEvent, truncateUtf8, } from "../recorder.js";
 import { wrap } from "../inspect.js";
 const DEFAULT_IMAGE = "axllent/mailpit:v1.30";
 const SMTP_PORT = 1025;
@@ -140,29 +123,21 @@ async function instrumented(service, op, query, body) {
         throw err;
     }
 }
-/** Query the mail server's HTTP API. Recording is paused around the fetch
- *  so these internal polls don't land as `http` events on the timeline —
- *  the helper records one consolidated `email` event instead. */
+/** Internal HTTP stays native; the public helper records one email event. */
 async function api(base, path, init) {
-    pauseRecording();
+    const res = await rawFetch(`${base}${path}`, init);
+    if (!res.ok) {
+        throw new Error(`email server API ${path} failed: HTTP ${res.status}`);
+    }
+    const text = await res.text();
+    if (text === "")
+        return undefined;
     try {
-        const res = await fetch(`${base}${path}`, init);
-        if (!res.ok) {
-            throw new Error(`email server API ${path} failed: HTTP ${res.status}`);
-        }
-        const text = await res.text();
-        if (text === "")
-            return undefined;
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            // Mutating endpoints reply with a plain-text acknowledgement.
-            return text;
-        }
+        return JSON.parse(text);
     }
-    finally {
-        resumeRecording();
+    catch {
+        // Mutating endpoints reply with a plain-text acknowledgement.
+        return text;
     }
 }
 function addresses(v) {

package/dist/components/index.d.ts

@@ -2,7 +2,7 @@ export { temporal, temporalClient, type TemporalOptions, type TemporalClient, ty
 export { postgres, type PostgresOptions, type PostgresHelpers, } from "./postgres.js";
 export { s3, type S3Options, type S3Helpers, } from "./s3.js";
 export { SQL, type SqlClient, type SqlOptions } from "../sql.js";
-export { k3s, type K3sOptions, type KubernetesImage, type K3sHelpers, type K3sClient, type TaggedObjectApi, type KubernetesObjectRef, type ApplyOptions, type RolloutTarget, type WaitOptions, type LogsOptions, type KubernetesObject, type KubernetesListObject, } from "./k3s.js";
+export { k3s, type K3sOptions, type K3sRegistryOptions, type KubernetesImage, type K3sHelpers, type K3sClient, type TaggedObjectApi, type KubernetesObjectRef, type ApplyOptions, type RolloutTarget, type WaitOptions, type LogsOptions, type KubernetesObject, type KubernetesListObject, } from "./k3s.js";
 export { expo, type ExpoOptions, type ExpoHelpers, type ExpoPackageManager, } from "./expo.js";
 export { supabase, type SupabaseOptions, type SupabaseHelpers, type SupabaseStack, } from "./supabase.js";
 export { email, type EmailOptions, type EmailHelpers, type EmailMessage, type EmailSummary, type EmailMatch, type EmailAttachment, } from "./email.js";

package/dist/components/k3s.d.ts

@@ -4,6 +4,14 @@ import { type KubernetesImage } from "../harness/component-images.js";
 export type { KubernetesImage } from "../harness/component-images.js";
 import type { Wrapped } from "../inspect.js";
 export type { KubernetesObject, KubernetesListObject, } from "@kubernetes/client-node";
+/** HTTPS exposure and publication for the component's writable registry. */
+export interface K3sRegistryOptions {
+    /** Exact DNS hostname exposed through Spectest's VM HTTPS proxy on port 443.
+     * Clients and Kubernetes's containerd trust the environment CA automatically.
+     * Builds in `images` whose reference starts with this host are also published
+     * here, using their original cached blobs and manifest digests. */
+    host: string;
+}
 /** Kubernetes pods receive read-only environment CA mounts during admission.
  * Image bytes and digests stay unchanged; explicit pod trust settings win. */
 export interface K3sOptions {
@@ -11,6 +19,9 @@ export interface K3sOptions {
      * or Dockerfile builds with a full `reference` matching your manifests. Builds
      * support path/content, context, exclude, target and buildArgs, and run in
      * parallel with service builds through the standard BuildKit pipeline.
+     * With `registry: { host }`, builds targeting that host are also published
+     * to the writable registry before setup completes. Other images remain
+     * direct preloads; no external registry receives pushes.
      * Setup waits for every pull and fails if a requested image cannot be pulled.
      * Sticky-enabled projects retain image content and unpacked layers between
      * fresh builds automatically. Digest references can reuse the cache offline;
@@ -85,10 +96,15 @@ export interface K3sOptions {
      * into your platform, e.g. `env: { REGISTRY_URL: "cluster.internal:5000" }`.
      * Plain HTTP, so configure your push client for an insecure registry.
      *
+     * Set `{ host: "registry.test" }` for verified HTTPS on port 443 through
+     * the built-in VM proxy, including containerd trust and relative upload URLs.
+     * This does not require Traefik. Builds targeting that host in `images` are
+     * published automatically; tags and test uploads remain isolated per fork.
+     *
      * On by default. Set `false` for clusters that only ever run public
      * images — that skips the extra pod.
      */
-    registry?: boolean;
+    registry?: boolean | K3sRegistryOptions;
     /**
      * Domains to route into this cluster's ingress via **wildcard DNS**. For
      * each `"example.com"`, spectest-resolver answers any `*.example.com`
@@ -336,6 +352,10 @@ export declare function k3s(opts?: K3sOptions): {
         reference: string;
     };
     imageBuilds: import("../index.js").ComponentImageBuild[];
+    tls: {
+        hostname: string;
+        port: number;
+    }[];
     command: string;
     privileged: true;
     tmpfs: string[];
@@ -348,10 +368,12 @@ export declare function k3s(opts?: K3sOptions): {
     } | {
         source: string;
         target: string;
-        readOnly: true;
-    })[] | {
+        readOnly: boolean;
+    } | {
         target: string;
-    }[];
+        source?: undefined;
+        readOnly?: undefined;
+    })[];
     files: {
         path: string;
         content: string;

package/dist/components/k3s.js

@@ -1,6 +1,7 @@
 import { isIP } from "node:net";
 import { installPodTrust } from "./k3s-trust.js";
 import { waitForAll } from "../harness/concurrency.js";
+import { CONTENT_BLOBS, REGISTRY_CONTENT, REGISTRY_DATA, REGISTRY_IMAGE, registryDirectory, seedRegistry } from "../harness/registry-seed.js";
 import { loadK3sBuildImages } from "../harness/k3s-image-loader.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn as nodeSpawn } from "node:child_process";
@@ -792,7 +793,7 @@ const HUB_MIRROR = { registry: "docker.io", mirror: "https://mirror.gcr.io", ups
  *      shares the node's netns, so this needs no in-container DNS and
  *      can't be broken by a clobbered `hostnames`.
  */
-function buildRegistriesYaml(registryEnabled) {
+function buildRegistriesYaml(registryEnabled, host) {
     const lines = [
         "mirrors:",
         `  "${HUB_MIRROR.registry}":`,
@@ -807,6 +808,11 @@ function buildRegistriesYaml(registryEnabled) {
         // makes that explicit and disables any TLS attempt against it.
         `  "127.0.0.1:${K3S_REGISTRY_PORT}":`, `    tls:`, `      insecure_skip_verify: true`);
     }
+    if (host) {
+        // This names the verified HTTPS endpoint itself; do not mirror it to HTTP.
+        // container-run mounts the environment CA before k3s/containerd starts.
+        lines.push(`  "${host}":`, "    tls:", `      ca_file: ${JSON.stringify(CA_PATH)}`);
+    }
     return lines.join("\n") + "\n";
 }
 /**
@@ -814,11 +820,13 @@ function buildRegistriesYaml(registryEnabled) {
  * binds the cluster container's `:5000` directly — the same trick
  * Traefik uses — so peer services reach it at `<cluster-key>.internal:5000`
  * (the cluster service's own alias) and the node's own containerd reaches
- * it at `127.0.0.1:5000`. Storage is an `emptyDir`, so pushed images live
- * in the cluster and are captured by snapshot / isolated per test fork
- * like all other in-VM state.
+ * it at `127.0.0.1:5000`. Storage is an `emptyDir` by default. Declared
+ * publications use a rootfs directory plus a read-only content mount; both
+ * variants keep writable registry state outside persistent image caches and
+ * capture it with the VM snapshot, isolated per test fork.
  */
-const REGISTRY_MANIFEST = `apiVersion: apps/v1
+function registryManifest(seeded) {
+    return `apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: spectest-registry
@@ -841,11 +849,13 @@ spec:
       - operator: Exists
       containers:
       - name: registry
-        image: registry:2
+        image: ${seeded ? REGISTRY_IMAGE : "registry:2"}
         imagePullPolicy: IfNotPresent
         env:
         - name: REGISTRY_HTTP_ADDR
           value: ":${K3S_REGISTRY_PORT}"
+        - name: REGISTRY_HTTP_RELATIVEURLS
+          value: "true"
         - name: REGISTRY_STORAGE_DELETE_ENABLED
           value: "true"
         ports:
@@ -854,10 +864,20 @@ spec:
         volumeMounts:
         - name: data
           mountPath: /var/lib/registry
-      volumes:
+${seeded ? `        - name: content
+          mountPath: ${REGISTRY_CONTENT}
+          readOnly: true
+` : ""}      volumes:
       - name: data
-        emptyDir: {}
+${seeded ? `        hostPath:
+          path: ${REGISTRY_DATA}
+          type: Directory
+      - name: content
+        hostPath:
+          path: ${REGISTRY_CONTENT}
+          type: Directory` : "        emptyDir: {}"}
 `;
+}
 // ────────────────────────────────────────────────────────────────────────
 // Apply — server-side, converging
 //
@@ -1310,7 +1330,8 @@ async function setupK3sCluster(name, helpers, opts) {
         (async () => {
             if (!opts.registry)
                 return;
-            await helpers.apply(REGISTRY_MANIFEST);
+            await opts.seed?.();
+            await helpers.apply(registryManifest(!!opts.seed));
             await wait("spectest-registry");
         })(),
     ]);
@@ -1438,6 +1459,16 @@ export function k3s(opts = {}) {
     const extra = opts.extraArgs ?? [];
     assertUsableExtraArgs(extra);
     const registryEnabled = opts.registry !== false;
+    let registryHost;
+    if (opts.registry !== undefined && typeof opts.registry !== "boolean") {
+        if (!opts.registry || typeof opts.registry.host !== "string" || opts.registry.host.startsWith("*.")) {
+            throw new Error("k3s(): registry must be a boolean or { host: an exact DNS hostname }");
+        }
+        // Reuse ingress validation (no scheme, port, path, or reserved .internal).
+        registryHost = dnsName(opts.registry.host, { ingress: true }).hostname;
+    }
+    const isPublished = (reference) => !!registryHost && reference.startsWith(`${registryHost}/`);
+    const publishBuilds = images.builds.filter(image => isPublished(image.reference));
     const traefikEnabled = opts.traefik !== false;
     const loadBalancerEnabled = opts.loadBalancer !== false;
     // Wildcard ingress domains. Drives both the `provides(... dnsName)`
@@ -1447,12 +1478,13 @@ export function k3s(opts = {}) {
     // `/etc/rancher/k3s/registries.yaml` (host-cache mirrors + trust for
     // the in-cluster registry). Seeded via `files` because k3s reads it
     // only at startup, before any setup hook could run.
-    const registriesYaml = buildRegistriesYaml(registryEnabled);
+    const registriesYaml = buildRegistriesYaml(registryEnabled, registryHost);
     // The environment's image cache, when this VM carries one: the
     // cluster's store goes on its root disk and its layers come off the
     // shared layers disk (see the store section above).
     const sticky = stickyDiskPathSync();
     const cache = sticky ? null : imageCachePathsSync();
+    const contentDirectory = `${sticky ? `${sticky}/containerd` : cache?.root ?? "/var/lib/containerd"}/${CONTENT_BLOBS}`;
     const serverArgs = [
         "k3s",
         "server",
@@ -1551,6 +1583,7 @@ export function k3s(opts = {}) {
     const def = {
         image: { type: "registry", reference: `rancher/k3s:${version}` },
         imageBuilds: images.builds,
+        tls: registryHost ? [{ hostname: registryHost, port: K3S_REGISTRY_PORT }] : [],
         command: cmd,
         privileged: true,
         tmpfs: ["/run", "/var/run"],
@@ -1572,15 +1605,20 @@ export function k3s(opts = {}) {
         // in one environment get separate roots either way (the service
         // token names the directory), because two containerd daemons cannot
         // share a store: bolt takes an exclusive lock.
-        volumes: sticky
-            ? [{ source: `${stickyKubernetesDirectory(SELF_SERVICE_TOKEN, version)}/containerd`, target: CLUSTER_STORE_TARGET }]
-            : cache ? [
-                { source: nestedStoreDir(cache, SELF_SERVICE_TOKEN), target: CLUSTER_STORE_TARGET },
-                { source: cache.layers, target: cache.layers, readOnly: true },
-                { source: MKFS_EROFS_PATH, target: MKFS_EROFS_PATH, readOnly: true },
-                { source: STORE_ADOPT_PATH, target: STORE_ADOPT_PATH, readOnly: true },
-            ]
-                : [{ target: CLUSTER_STORE_TARGET }],
+        volumes: [...(sticky
+                ? [{ source: `${stickyKubernetesDirectory(SELF_SERVICE_TOKEN, version)}/containerd`, target: CLUSTER_STORE_TARGET }]
+                : cache ? [
+                    { source: nestedStoreDir(cache, SELF_SERVICE_TOKEN), target: CLUSTER_STORE_TARGET },
+                    { source: cache.layers, target: cache.layers, readOnly: true },
+                    { source: MKFS_EROFS_PATH, target: MKFS_EROFS_PATH, readOnly: true },
+                    { source: STORE_ADOPT_PATH, target: STORE_ADOPT_PATH, readOnly: true },
+                ]
+                    : [{ target: CLUSTER_STORE_TARGET }]),
+            ...(publishBuilds.length ? [
+                { source: registryDirectory(SELF_SERVICE_TOKEN), target: REGISTRY_DATA },
+                { source: contentDirectory, target: REGISTRY_CONTENT, readOnly: true },
+            ] : []),
+        ],
         files: [
             ...(registriesYaml ? [{ path: "/etc/rancher/k3s/registries.yaml", content: registriesYaml }] : []),
             ...(cache
@@ -1600,55 +1638,61 @@ export function k3s(opts = {}) {
             const runtime = componentRuntime(ctx);
             if (images.builds.length && !runtime)
                 throw new Error(`k3s(${name}): prepared image inputs are missing`);
-            await waitForAll([
-                runtime ? loadK3sBuildImages(name, runtime.images, runtime.gateway, exec) : Promise.resolve(),
-                prePullK3sImages(name, images.pulls, exec),
-                (async () => {
-                    if (runtime?.caBundle && caPresent()) {
-                        const { cert, key } = await issueIngressCert([runtime.gateway]);
-                        await installPodTrust({ name, gateway: runtime.gateway, cert, key,
-                            ca: await readFile(CA_PATH, "utf8"), bundle: await readFile(runtime.caBundle, "utf8"),
-                        }, {
-                            apply: async (configuration) => { await helpers.apply(JSON.stringify(configuration)); },
-                            ensureBundle: async (namespace, configMap, bundle) => {
-                                try {
-                                    await helpers.client.core.createNamespacedConfigMap({ namespace, body: {
-                                            metadata: { name: configMap, namespace }, immutable: true, data: { "ca-bundle.crt": bundle },
-                                        } });
-                                }
-                                catch (err) {
-                                    // A simultaneous Pod may have created the same namespace's bundle.
-                                    const existing = (await helpers.client.core.readNamespacedConfigMap({ namespace, name: configMap })).unwrap();
-                                    if (existing.data?.["ca-bundle.crt"] !== bundle || existing.immutable !== true)
-                                        throw err;
-                                }
-                            },
-                        });
-                        // The API server observes webhook registration asynchronously. A dry-run
-                        // Pod proves TLS reachability and admission before any project workload.
-                        const deadline = Date.now() + 30_000;
-                        for (;;) {
+            const infrastructure = (async () => {
+                if (runtime?.caBundle && caPresent()) {
+                    const { cert, key } = await issueIngressCert([runtime.gateway]);
+                    await installPodTrust({ name, gateway: runtime.gateway, cert, key,
+                        ca: await readFile(CA_PATH, "utf8"), bundle: await readFile(runtime.caBundle, "utf8"),
+                    }, {
+                        apply: async (configuration) => { await helpers.apply(JSON.stringify(configuration)); },
+                        ensureBundle: async (namespace, configMap, bundle) => {
                             try {
-                                const pod = (await helpers.client.core.createNamespacedPod({ namespace: "default", dryRun: "All", body: {
-                                        metadata: { generateName: "spectest-trust-probe-" }, spec: { containers: [{ name: "probe", image: "registry.k8s.io/pause:3.10" }] },
-                                    } })).unwrap();
-                                if (pod.spec?.containers[0].env?.some(e => e.name === "SSL_CERT_FILE" && e.value === "/spectest/ca-bundle.crt"))
-                                    break;
-                                if (Date.now() >= deadline)
-                                    throw new Error(`k3s(${name}): Pod CA mounts did not become ready`);
+                                await helpers.client.core.createNamespacedConfigMap({ namespace, body: {
+                                        metadata: { name: configMap, namespace }, immutable: true, data: { "ca-bundle.crt": bundle },
+                                    } });
                             }
                             catch (err) {
-                                if (Date.now() >= deadline)
+                                // A simultaneous Pod may have created the same namespace's bundle.
+                                const existing = (await helpers.client.core.readNamespacedConfigMap({ namespace, name: configMap })).unwrap();
+                                if (existing.data?.["ca-bundle.crt"] !== bundle || existing.immutable !== true)
                                     throw err;
                             }
-                            await new Promise(resolve => setTimeout(resolve, 100));
+                        },
+                    });
+                    // The API server observes webhook registration asynchronously. A dry-run
+                    // Pod proves TLS reachability and admission before any project workload.
+                    const deadline = Date.now() + 30_000;
+                    for (;;) {
+                        try {
+                            const pod = (await helpers.client.core.createNamespacedPod({ namespace: "default", dryRun: "All", body: {
+                                    metadata: { generateName: "spectest-trust-probe-" }, spec: { containers: [{ name: "probe", image: "registry.k8s.io/pause:3.10" }] },
+                                } })).unwrap();
+                            if (pod.spec?.containers[0].env?.some(e => e.name === "SSL_CERT_FILE" && e.value === "/spectest/ca-bundle.crt"))
+                                break;
+                            if (Date.now() >= deadline)
+                                throw new Error(`k3s(${name}): Pod CA mounts did not become ready`);
+                        }
+                        catch (err) {
+                            if (Date.now() >= deadline)
+                                throw err;
                         }
+                        await new Promise(resolve => setTimeout(resolve, 100));
                     }
-                    await setupK3sCluster(name, helpers, {
-                        registry: registryEnabled,
-                        ingressDomains,
-                        traefik: traefikEnabled,
-                    });
+                }
+                await setupK3sCluster(name, helpers, {
+                    registry: registryEnabled,
+                    seed: publishBuilds.length ? () => seedRegistry(name, contentDirectory, runtime.images.filter(image => isPublished(image.reference))) : undefined,
+                    ingressDomains,
+                    traefik: traefikEnabled,
+                });
+            })();
+            await waitForAll([
+                runtime ? loadK3sBuildImages(name, runtime.images, runtime.gateway, exec) : Promise.resolve(),
+                prePullK3sImages(name, images.pulls.filter(ref => !isPublished(ref)), exec),
+                (async () => {
+                    // Registry-local references must not race registry startup/publication.
+                    await infrastructure;
+                    await prePullK3sImages(name, images.pulls.filter(isPublished), exec);
                 })(),
             ]);
             if (sticky)

package/dist/components/s3.js

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 import { S3Client } from "../s3.js";
 // Backing image, pinned internally (not user-configurable). adobe/s3mock 5.1.0
 // is the current release; avoid exactly 5.0.0, which crashed at startup on
@@ -75,7 +76,7 @@ export function s3(opts = {}) {
                         // CreateBucket is a plain `PUT` on the bucket root; the store
                         // returns 200 (or 409 if it already exists — idempotent enough to
                         // ignore).
-                        const res = await fetch(`http://${name}:${S3_PORT}/${bucket}`, {
+                        const res = await rawFetch(`http://${name}:${S3_PORT}/${bucket}`, {
                             method: "PUT",
                         });
                         if (!res.ok && res.status !== 409) {

package/dist/components/supabase.js

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 // A ready-to-use, self-hosted **Supabase** stack, expressed as a set of
 // spectest services (one container each) wired together on spectest-net.
 //
@@ -1807,7 +1808,7 @@ export function supabase(opts = {}) {
                     // snapshot and a test's diff is what its requests mutate.
                     setup: async () => {
                         const t0 = Date.now();
-                        const res = await fetch(`http://${g.key("functions")}:9000/_spectest/warm`);
+                        const res = await rawFetch(`http://${g.key("functions")}:9000/_spectest/warm`);
                         if (!res.ok) {
                             console.warn(`supabase(): edge functions warm-up answered ${res.status}; functions boot on first call instead.`);
                             return;

package/dist/daemon.js

@@ -1958,6 +1958,9 @@ serve = { proto: "http" }) {
         // {@link stopIngressServers} depends on: a half-alive listener shares
         // the port silently instead of colliding loudly.
         reusePort: true,
+        // OCI layer uploads can exceed Bun's default 128 MiB request limit.
+        // Large proxy bodies stream through; this limit does not allocate a buffer.
+        maxRequestBodySize: 1024 ** 4,
         // Bun.serve defaults to a 10s idleTimeout, which kills any proxied
         // request whose upstream takes >10s to produce bytes — under parallel
         // test load that surfaced as "fetch failed"/"other side closed" on

package/dist/harness/built-image.d.ts

@@ -0,0 +1,16 @@
+export interface Descriptor {
+    digest: string;
+    size: number;
+    mediaType: string;
+    platform?: {
+        os: string;
+        architecture: string;
+    };
+}
+/** Preserve the original index/manifest bytes and all application descriptors. */
+export declare function hostImage(source: string): Promise<{
+    target: Descriptor;
+    metadata: Map<string, Buffer<ArrayBufferLike>>;
+    allowed: Map<string, Descriptor>;
+    configDigest: string;
+}>;

package/dist/harness/built-image.js

@@ -0,0 +1,57 @@
+/** Read build results without reserializing manifests or exporting layers. */
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { promisify } from "node:util";
+import { canonicalImageReference } from "./component-images.js";
+const digest = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+const descriptor = (bytes, mediaType) => ({ digest: digest(bytes), size: bytes.length, mediaType });
+const run = promisify(execFile);
+const HOST_CTR = ["--address", "/run/containerd/containerd.sock", "--namespace", "moby"];
+async function hostContent(id) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(id))
+        throw new Error(`invalid content digest ${id}`);
+    const result = await run("ctr", [...HOST_CTR, "content", "get", id], { encoding: "buffer", maxBuffer: 16 * 1024 * 1024, timeout: 30_000 });
+    if (digest(result.stdout) !== id)
+        throw new Error(`corrupt image metadata ${id}`);
+    return result.stdout;
+}
+/** Preserve the original index/manifest bytes and all application descriptors. */
+export async function hostImage(source) {
+    const name = canonicalImageReference(source);
+    const { stdout } = await run("ctr", [...HOST_CTR, "images", "ls", `name==${name}`], { timeout: 30_000 });
+    const found = stdout.split("\n").map(line => line.trim().split(/\s+/)).find(row => row[0] === name)?.[2];
+    if (!found)
+        throw new Error(`built image ${name} is missing from the VM container store`);
+    const metadata = new Map();
+    const allowed = new Map();
+    let configDigest;
+    async function visit(id, selected, depth = 0) {
+        if (depth > 4)
+            throw new Error(`built image ${name} has a recursive manifest index`);
+        const bytes = await hostContent(id);
+        const obj = JSON.parse(bytes.toString());
+        const desc = descriptor(bytes, obj.mediaType);
+        metadata.set(id, bytes);
+        allowed.set(id, desc);
+        if (obj.config && Array.isArray(obj.layers)) {
+            const manifest = obj;
+            for (const blob of [manifest.config, ...manifest.layers])
+                allowed.set(blob.digest, blob);
+            if (selected)
+                configDigest = manifest.config.digest;
+        }
+        else if (Array.isArray(obj.manifests)) {
+            for (const entry of obj.manifests) {
+                const matches = !entry.platform || (entry.platform.os === "linux" && entry.platform.architecture === (process.arch === "arm64" ? "arm64" : "amd64"));
+                await visit(entry.digest, selected && matches, depth + 1);
+            }
+        }
+        else
+            throw new Error(`built image ${name} has invalid image metadata`);
+        return desc;
+    }
+    const target = await visit(found, true);
+    if (!configDigest)
+        throw new Error(`built image ${name} has no image for this VM's platform`);
+    return { target, metadata, allowed, configDigest };
+}

package/dist/harness/k3s-image-loader.js

@@ -1,65 +1,14 @@
 /** A short-lived, read-only OCI endpoint over the host containerd content store.
  * k3s fetches only missing blobs and unpacks only missing snapshots. No Docker
  * archive, staging registry, or second persistent copy of application blobs. */
-import { execFile, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createServer } from "node:http";
-import { promisify } from "node:util";
 import { canonicalImageReference } from "./component-images.js";
 import { waitForK3sRuntime } from "./k3s-prepull.js";
+import { hostImage } from "./built-image.js";
 import { waitForAll } from "./concurrency.js";
-const digest = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-const descriptor = (bytes, mediaType) => ({ digest: digest(bytes), size: bytes.length, mediaType });
-const run = promisify(execFile);
 const HOST_CTR = ["--address", "/run/containerd/containerd.sock", "--namespace", "moby"];
-async function hostContent(id) {
-    if (!/^sha256:[a-f0-9]{64}$/.test(id))
-        throw new Error(`invalid content digest ${id}`);
-    const result = await run("ctr", [...HOST_CTR, "content", "get", id], { encoding: "buffer", maxBuffer: 16 * 1024 * 1024, timeout: 30_000 });
-    if (digest(result.stdout) !== id)
-        throw new Error(`corrupt image metadata ${id}`);
-    return result.stdout;
-}
-/** Preserve the original index/manifest bytes and all application descriptors. */
-async function hostImage(source) {
-    const name = canonicalImageReference(source);
-    const { stdout } = await run("ctr", [...HOST_CTR, "images", "ls", `name==${name}`], { timeout: 30_000 });
-    const found = stdout.split("\n").map(line => line.trim().split(/\s+/)).find(row => row[0] === name)?.[2];
-    if (!found)
-        throw new Error(`built image ${name} is missing from the VM container store`);
-    const metadata = new Map();
-    const allowed = new Map();
-    let configDigest;
-    async function visit(id, selected, depth = 0) {
-        if (depth > 4)
-            throw new Error(`built image ${name} has a recursive manifest index`);
-        const bytes = await hostContent(id);
-        const obj = JSON.parse(bytes.toString());
-        const desc = descriptor(bytes, obj.mediaType);
-        metadata.set(id, bytes);
-        allowed.set(id, desc);
-        if (obj.config && Array.isArray(obj.layers)) {
-            const manifest = obj;
-            for (const blob of [manifest.config, ...manifest.layers])
-                allowed.set(blob.digest, blob);
-            if (selected)
-                configDigest = manifest.config.digest;
-        }
-        else if (Array.isArray(obj.manifests)) {
-            for (const entry of obj.manifests) {
-                const matches = !entry.platform || (entry.platform.os === "linux" && entry.platform.architecture === (process.arch === "arm64" ? "arm64" : "amd64"));
-                await visit(entry.digest, selected && matches, depth + 1);
-            }
-        }
-        else
-            throw new Error(`built image ${name} has invalid image metadata`);
-        return desc;
-    }
-    const target = await visit(found, true);
-    if (!configDigest)
-        throw new Error(`built image ${name} has no image for this VM's platform`);
-    return { target, metadata, allowed, configDigest };
-}
 export async function loadK3sBuildImages(service, images, gateway, exec) {
     if (!images.length)
         return;

package/dist/harness/registry-seed.d.ts

@@ -0,0 +1,12 @@
+import { hostImage } from "./built-image.js";
+import { type PreparedComponentImage } from "./component-images.js";
+export declare const REGISTRY_DATA = "/var/lib/spectest-registry";
+export declare const REGISTRY_CONTENT = "/spectest-registry-content";
+export declare const CONTENT_BLOBS = "io.containerd.content.v1.content/blobs/sha256";
+export declare const REGISTRY_IMAGE = "registry:2.8.3";
+export declare const registryDirectory: (service: string) => string;
+/** Distribution 2.8 registry/storage/paths.go defines this layout. Seed
+ * before starting the registry so it cannot cache partial publication.
+ * The prepared build's containerd image record retains the referenced blobs. */
+export declare function seedRegistryImage(directory: string, contentDirectory: string, reference: string, image: Awaited<ReturnType<typeof hostImage>>, mountedContent?: string): Promise<void>;
+export declare function seedRegistry(service: string, contentDirectory: string, images: readonly PreparedComponentImage[]): Promise<void>;