@specific.dev/spectest 0.33.0 → 0.35.0

package/dist/components/aws.d.ts

@@ -0,0 +1,119 @@
+import type { ServiceSetupContext } from "../index.js";
+export interface AwsOptions {
+    /**
+     * Lambda functions to deploy from the project's own source, keyed by
+     * function name — the name the app (or a state machine) invokes.
+     *
+     * ```ts
+     * lambdas: {
+     *   add:      { source: "lambda/add" },
+     *   resize:   { source: "lambda/resize", runtime: "python3.12", timeoutSecs: 60 },
+     * }
+     * ```
+     *
+     * Each is packaged and deployed during environment bring-up, so it is part
+     * of the warm-template snapshot: a warm start restores the deployed
+     * function instead of deploying it again.
+     */
+    lambdas?: Record<string, LambdaOptions>;
+}
+export interface LambdaOptions {
+    /**
+     * The function's code, as a path in your repository — either a directory
+     * (packaged whole, recursively, with its contents at the root of the
+     * package) or a single file. Relative paths resolve against the project
+     * root, so `"lambda/add"` is the repo's own `lambda/add/`.
+     *
+     * The code is taken from the repository on purpose: the function you test
+     * is the function you ship. Anything the handler imports at runtime —
+     * including its dependencies — must be inside this path, exactly as a real
+     * deployment package requires.
+     */
+    source: string;
+    /** Entry point, as AWS spells it: `<file>.<exported function>`. Default
+     *  `"index.handler"`. */
+    handler?: string;
+    /** Lambda runtime identifier. Default `"nodejs20.x"`. */
+    runtime?: string;
+    /** Environment variables for the function. */
+    env?: Record<string, string>;
+    /** Function timeout in seconds. Default `30`. */
+    timeoutSecs?: number;
+    /** Execution-role ARN. Defaults to a fixed placeholder — the emulator does
+     *  not enforce IAM. Set it only when the code reads the ARN itself. */
+    role?: string;
+}
+/**
+ * The AWS cloud APIs, emulated in the environment and answering at their real
+ * endpoints. Drop into `environment.services`:
+ *
+ * ```ts
+ * import { aws } from "@specific.dev/spectest/components";
+ *
+ * services: {
+ *   aws: aws({
+ *     lambdas: {
+ *       add:      { source: "lambda/add" },
+ *       subtract: { source: "lambda/subtract" },
+ *     },
+ *   }),
+ *   app: {
+ *     image: { type: "dockerfile", content: appDockerfile },
+ *     // Whatever the app already reads in production. An AWS SDK needs a
+ *     // region and credentials; the emulator accepts any credential value.
+ *     env: {
+ *       AWS_REGION: "us-east-1",
+ *       AWS_ACCESS_KEY_ID: "test",
+ *       AWS_SECRET_ACCESS_KEY: "test",
+ *     },
+ *     dependsOn: ["aws"],
+ *   },
+ * }
+ * ```
+ *
+ * The app keeps its production configuration — `new SFNClient({})`, no
+ * endpoint — because the component owns DNS and TLS for the AWS domains. It
+ * answers for **every region**, so an app that talks to two of them, or that
+ * reads its region from configuration, needs nothing declared here.
+ *
+ * Tests reach the same cloud with the AWS CLI, which the emulator's image
+ * ships as `awslocal` (the CLI, already pointed at it):
+ *
+ * ```ts
+ * const listed = await ctx.exec("aws", "awslocal stepfunctions list-state-machines");
+ * expect(listed.exitCode).toBe(0);
+ * const machines = listed.stdout.transform("machines", (out) =>
+ *   (JSON.parse(out) as { stateMachines: unknown[] }).stateMachines,
+ * );
+ * expect(machines).toHaveLength(1);
+ * ```
+ *
+ * For S3, prefer the `s3()` component and give it the endpoint your app uses
+ * (`s3({ hosts: ["s3.us-east-1.amazonaws.com"] })`). An exact hostname always
+ * beats this component's wildcard, so the two compose without further
+ * configuration.
+ */
+export declare function aws(opts?: AwsOptions): {
+    setup?: (({ name, projectRoot }: ServiceSetupContext) => Promise<void>) | undefined;
+    image: {
+        type: "registry";
+        reference: string;
+    };
+    env: {
+        AWS_DEFAULT_REGION: string;
+        LAMBDA_EXECUTOR: string;
+        LAMBDA_STRICT: string;
+        LAMBDA_DOCKER_NETWORK: string;
+    };
+    volumes: {
+        source: string;
+        target: string;
+    }[];
+    ports: number[];
+    readyCheck: {
+        type: "http";
+        port: number;
+        path: string;
+        timeoutSecs: number;
+    };
+};

package/dist/components/aws.js

@@ -0,0 +1,444 @@
+// `aws()` — the AWS cloud APIs, emulated inside the environment, answering
+// at their **real** endpoints.
+//
+// The component runs one emulator container and claims the AWS domains for
+// it: DNS, a leaf certificate minted from the in-VM root CA, and a
+// TLS-terminating reverse proxy. An AWS SDK in the app under test therefore
+// resolves `https://states.us-east-1.amazonaws.com` the way it does in
+// production and reaches the emulator — the app needs no endpoint override,
+// no test-only branch, and no knowledge that it is under test.
+//
+// Lambda functions are declared next to the services and deployed from the
+// project's own source. Deployment happens in the service `setup` hook, which
+// runs before the warm-template snapshot, so a warm start restores functions
+// that are already deployed, already active, and already warm.
+//
+// ── Internal notes (deliberately not in the user-facing docs) ──────────────
+//
+// The backing image is MiniStack (MIT, github.com/ministackorg/ministack),
+// pinned rather than floated. It replaced LocalStack, which folded its
+// Apache-2.0 Community edition into one paid product in March 2026 (current
+// images demand a LOCALSTACK_AUTH_TOKEN). MiniStack also suits fork-per-test
+// far better: ~270 MB against ~1 GB and a ~2 s boot.
+//
+// Lambda runs in MiniStack's **docker** executor, never its default `local`
+// one, because `local` has no runtime fidelity at all: it maps `python*` to
+// its own `sys.executable` and `nodejs*` to its own `node`, so the declared
+// `Runtime` selects only the language. A function declared `python3.11` runs
+// on the emulator image's CPython 3.13/musl, and one declared `nodejs20.x`
+// runs on Node 24 — which is why a native wheel built for the real target
+// fails to import ("No module named 'pydantic_core._pydantic_core'"). The
+// docker executor runs the handler under AWS's own Runtime Interface
+// Emulator in `public.ecr.aws/lambda/<runtime>`, giving the real
+// interpreter, glibc, `/var/task` and `AWS_EXECUTION_ENV`. Measured on
+// aarch64: it is also ~7x FASTER per warm invoke (7 ms against 53 ms) at
+// ~25-40 MiB per function container.
+//
+// None of this is configurable, on purpose — a knob here is a knob between
+// "behaves like AWS" and "does not".
+//
+// The cost is a bind-mount of the VM's own docker socket, which the daemon
+// already supports (`ensureVolumes` treats an existing non-directory source
+// as a thing to mount as-is). The RIE containers are ordinary VM containers
+// on `spectest-net`, so they ride snapshots and forks like any service: a
+// per-test fork inherits its parent's already-warm function.
+//
+// Landmine: the runtime images are pulled from `public.ecr.aws`, which the
+// in-VM dockerd reaches DIRECTLY. Its `registry-mirrors` only ever applies
+// to Docker Hub, so the zot mirror (which does carry public.ecr.aws, on
+// :5004) is NOT consulted. MiniStack's own `MINISTACK_IMAGE_PREFIX` cannot
+// close that gap either: it prepends rather than replacing the registry
+// host. Routing these pulls through zot needs a pre-pull of
+// `spectest-host:5004/lambda/<rt>` retagged to the `public.ecr.aws` name.
+//
+// Like `email()`'s mail server, the product name stays out of every
+// user-facing surface (docs, examples, error messages). Users get "the AWS
+// emulator"; `image` swaps it.
+//
+// The emulator ignores SigV4 and does not check that a role exists, both
+// verified on 1.4.8. That is what lets this component deploy over plain
+// unsigned HTTP from the daemon and skip IAM entirely.
+import { readFile, readdir, stat } from "node:fs/promises";
+import path from "node:path";
+import { deflateRawSync } from "node:zlib";
+import { certificate, provides, proxy, SELF_SERVICE_TOKEN } from "../index.js";
+import { pauseRecording, resumeRecording } from "../recorder.js";
+/** Backing image, pinned internally (not part of the documented surface). */
+const AWS_IMAGE = "ministackorg/ministack:1.4.8";
+/** Port the emulator serves every AWS API on. Internal: callers reach the
+ *  emulator through the AWS hostnames, never through this port. */
+const AWS_PORT = 4566;
+// Every AWS region, so the component can answer for all of them and the user
+// never has to declare which ones the app uses. Enumeration is forced by TLS,
+// not by routing: a wildcard *route* matches any depth, but a wildcard
+// *certificate* covers exactly one label (RFC 6125, enforced by every
+// client), so `*.amazonaws.com` cannot serve `states.us-east-1.amazonaws.com`
+// — each region needs its own `*.<region>.amazonaws.com` name. They all ride
+// ONE certificate as SANs and one shared upstream, so the list costs a few
+// route-table entries, not a key generation each.
+//
+// Sourced from AWS's own published `ip-ranges.json` (2026-07-31). A region
+// added later is simply not claimed: its endpoints fail to resolve, which
+// says plainly what happened — add it here.
+const AWS_REGIONS = [
+    "af-south-1", "ap-east-1", "ap-east-2", "ap-northeast-1", "ap-northeast-2",
+    "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2",
+    "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6",
+    "ap-southeast-7", "ca-central-1", "ca-west-1", "eu-central-1", "eu-central-2",
+    "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3",
+    "eusc-de-east-1", "il-central-1", "me-central-1", "me-south-1", "me-west-1",
+    "mx-central-1", "sa-east-1", "sa-west-1", "us-east-1", "us-east-2",
+    "us-gov-east-1", "us-gov-west-1", "us-south-1", "us-west-1", "us-west-2",
+];
+/** China is a separate partition on its own domain suffix. */
+const AWS_CN_REGIONS = ["cn-north-1", "cn-northwest-1"];
+/** Every hostname pattern the emulator answers to: the two partitions' global
+ *  endpoints (`sts.amazonaws.com`, `iam.amazonaws.com`) plus one per region
+ *  for the regional ones (`states.us-east-1.amazonaws.com`). */
+const AWS_HOST_PATTERNS = [
+    "*.amazonaws.com",
+    ...AWS_REGIONS.map((r) => `*.${r}.amazonaws.com`),
+    "*.amazonaws.com.cn",
+    ...AWS_CN_REGIONS.map((r) => `*.${r}.amazonaws.com.cn`),
+];
+/** The VM's own docker socket, bind-mounted so the emulator can start the
+ *  official AWS runtime containers. This is the VM's dockerd, inside the
+ *  hermetic environment — the same daemon that runs the services. */
+const DOCKER_SOCKET = "/var/run/docker.sock";
+/** The network the function containers join, so a handler reaches the other
+ *  services and the AWS endpoints by the same names a test uses. */
+const SPECTEST_NETWORK = "spectest-net";
+/** Region the emulator's own tools default to — the AWS CLI refuses to run
+ *  without one. Only the *container's* default; it constrains nothing about
+ *  the app, and every region is served regardless. A `setup` hook that drives
+ *  the CLI against another region passes `--region`. */
+const CONTAINER_DEFAULT_REGION = "us-east-1";
+/** Role every declared function is created with. The emulator does not
+ *  enforce IAM, so this only has to be a well-formed ARN — which is why the
+ *  component creates no role and takes no IAM options. A project that wants a
+ *  real-looking role can create one itself and set `role` on the function. */
+const DEFAULT_ROLE_ARN = "arn:aws:iam::000000000000:role/spectest-lambda";
+/** Ready-check budget. The emulator boots in a couple of seconds; the slow
+ *  part is a cold image pull on a machine that has never run it. */
+const READY_TIMEOUT_SECS = 120;
+/** Memory every declared function is created with. Kept at what this
+ *  component has always used, rather than the emulator's own default, so the
+ *  removal of the `memoryMb` option changed no behaviour. */
+const MEMORY_MB = 512;
+/**
+ * The AWS cloud APIs, emulated in the environment and answering at their real
+ * endpoints. Drop into `environment.services`:
+ *
+ * ```ts
+ * import { aws } from "@specific.dev/spectest/components";
+ *
+ * services: {
+ *   aws: aws({
+ *     lambdas: {
+ *       add:      { source: "lambda/add" },
+ *       subtract: { source: "lambda/subtract" },
+ *     },
+ *   }),
+ *   app: {
+ *     image: { type: "dockerfile", content: appDockerfile },
+ *     // Whatever the app already reads in production. An AWS SDK needs a
+ *     // region and credentials; the emulator accepts any credential value.
+ *     env: {
+ *       AWS_REGION: "us-east-1",
+ *       AWS_ACCESS_KEY_ID: "test",
+ *       AWS_SECRET_ACCESS_KEY: "test",
+ *     },
+ *     dependsOn: ["aws"],
+ *   },
+ * }
+ * ```
+ *
+ * The app keeps its production configuration — `new SFNClient({})`, no
+ * endpoint — because the component owns DNS and TLS for the AWS domains. It
+ * answers for **every region**, so an app that talks to two of them, or that
+ * reads its region from configuration, needs nothing declared here.
+ *
+ * Tests reach the same cloud with the AWS CLI, which the emulator's image
+ * ships as `awslocal` (the CLI, already pointed at it):
+ *
+ * ```ts
+ * const listed = await ctx.exec("aws", "awslocal stepfunctions list-state-machines");
+ * expect(listed.exitCode).toBe(0);
+ * const machines = listed.stdout.transform("machines", (out) =>
+ *   (JSON.parse(out) as { stateMachines: unknown[] }).stateMachines,
+ * );
+ * expect(machines).toHaveLength(1);
+ * ```
+ *
+ * For S3, prefer the `s3()` component and give it the endpoint your app uses
+ * (`s3({ hosts: ["s3.us-east-1.amazonaws.com"] })`). An exact hostname always
+ * beats this component's wildcard, so the two compose without further
+ * configuration.
+ */
+export function aws(opts = {}) {
+    const lambdas = opts.lambdas ?? {};
+    const service = {
+        image: { type: "registry", reference: AWS_IMAGE },
+        env: {
+            AWS_DEFAULT_REGION: CONTAINER_DEFAULT_REGION,
+            // Run every function in the official AWS runtime image rather than in
+            // the emulator's own interpreter — see the note at the top of the file.
+            LAMBDA_EXECUTOR: "docker",
+            // No silent fall-back to the low-fidelity executor. If the runtime
+            // container cannot start, say so instead of running the handler on the
+            // wrong interpreter and failing later, somewhere else.
+            LAMBDA_STRICT: "1",
+            LAMBDA_DOCKER_NETWORK: SPECTEST_NETWORK,
+        },
+        volumes: [{ source: DOCKER_SOCKET, target: DOCKER_SOCKET }],
+        ports: [AWS_PORT],
+        readyCheck: {
+            type: "http",
+            port: AWS_PORT,
+            path: "/_ministack/health",
+            timeoutSecs: READY_TIMEOUT_SECS,
+        },
+        ...(Object.keys(lambdas).length > 0
+            ? {
+                setup: async ({ name, projectRoot }) => {
+                    for (const [fn, spec] of Object.entries(lambdas)) {
+                        await deployLambda(name, projectRoot, fn, spec);
+                    }
+                },
+            }
+            : {}),
+    };
+    // The low-level primitives rather than the `tls` field, for one reason:
+    // `tls` mints a separate leaf certificate per entry, and this component
+    // claims several dozen names. One `certificate(...)` decl carries them all
+    // as SANs of a single leaf — one key generation at bring-up instead of
+    // dozens — while the proxies are just route-table entries.
+    return provides(service, [
+        certificate(AWS_HOST_PATTERNS),
+        ...AWS_HOST_PATTERNS.map((hostname) => proxy(hostname, { service: SELF_SERVICE_TOKEN, port: AWS_PORT })),
+    ]);
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Talking to the emulator directly
+//
+// The emulator ignores request signatures, so the daemon reaches its APIs
+// over plain unsigned HTTP. That keeps deployment independent of what tools
+// the image happens to ship, and keeps a poll loop cheap.
+// ──────────────────────────────────────────────────────────────────────────
+/** One JSON-protocol AWS call (Step Functions, DynamoDB, …), by target. */
+async function request(service, method, urlPath, init = {}) {
+    // Never let the component's own traffic land on the timeline: these calls
+    // are bring-up and polling, not something a test asked for.
+    pauseRecording();
+    try {
+        const res = await fetch(`http://${service}:${AWS_PORT}${urlPath}`, {
+            method,
+            headers: { "content-type": "application/json", ...(init.headers ?? {}) },
+            ...(init.body !== undefined ? { body: init.body } : {}),
+        });
+        // Coerced rather than read directly: `fetch` is wrapped during a test, so
+        // `res.status` is a provenance carrier there and a plain number elsewhere.
+        const status = Number(res.status);
+        const text = String(await res.text());
+        if (status >= 400) {
+            const err = new Error(`aws: ${method} ${urlPath} failed: HTTP ${status} ${text.slice(0, 400)}`);
+            err.status = status;
+            throw err;
+        }
+        return text === "" ? undefined : JSON.parse(text);
+    }
+    finally {
+        resumeRecording();
+    }
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Lambda deployment
+// ──────────────────────────────────────────────────────────────────────────
+/** Refuse a package that no real deployment would accept either. */
+const MAX_PACKAGE_BYTES = 64 * 1024 * 1024;
+async function deployLambda(service, projectRoot, name, spec) {
+    if (typeof spec?.source !== "string" || spec.source.trim() === "") {
+        throw new Error(`aws: lambda "${name}" needs a \`source\` path to its code`);
+    }
+    const zipped = await packageSource(projectRoot, name, spec.source);
+    if (zipped.length > MAX_PACKAGE_BYTES) {
+        throw new Error(`aws: lambda "${name}" packages to ${Math.round(zipped.length / 1e6)} MB from ` +
+            `${spec.source} — over the ${MAX_PACKAGE_BYTES / 1e6} MB limit. Point \`source\` at ` +
+            `the function's own directory, not a whole repository.`);
+    }
+    const code = Buffer.from(zipped).toString("base64");
+    const config = {
+        Runtime: spec.runtime ?? "nodejs20.x",
+        Handler: spec.handler ?? "index.handler",
+        Role: spec.role ?? DEFAULT_ROLE_ARN,
+        Timeout: spec.timeoutSecs ?? 30,
+        // Fixed, and not an option: the emulated cloud reports this number back
+        // as `AWS_LAMBDA_FUNCTION_MEMORY_SIZE` but never caps the runtime
+        // container at it, so the number changes nothing about how a function
+        // behaves here.
+        MemorySize: MEMORY_MB,
+        ...(spec.env ? { Environment: { Variables: spec.env } } : {}),
+    };
+    try {
+        await request(service, "POST", "/2015-03-31/functions", {
+            body: JSON.stringify({ FunctionName: name, Code: { ZipFile: code }, ...config }),
+        });
+    }
+    catch (err) {
+        // Already there: a re-run of bring-up against an emulator that kept its
+        // state. Update instead, so the deployed code always matches the repo.
+        if (err.status !== 409)
+            throw err;
+        await request(service, "PUT", `/2015-03-31/functions/${encodeURIComponent(name)}/code`, {
+            body: JSON.stringify({ ZipFile: code }),
+        });
+        await request(service, "PUT", `/2015-03-31/functions/${encodeURIComponent(name)}/configuration`, {
+            body: JSON.stringify(config),
+        });
+    }
+    await waitActive(service, name);
+    // One invoke with an empty event, purely to leave a warm worker behind in
+    // the snapshot, so no test pays a cold start. The handler may well reject
+    // the event — that is fine, the worker is started either way.
+    try {
+        await request(service, "POST", `/2015-03-31/functions/${encodeURIComponent(name)}/invocations`, {
+            body: "{}",
+        });
+    }
+    catch {
+        // Ignored on purpose: warming is an optimisation, never a gate.
+    }
+}
+/** Wait for a newly created function to leave `Pending`, exactly as a real
+ *  deployment must. Tolerates an emulator that reports no state at all. */
+async function waitActive(service, name, timeoutMs = 60_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const cfg = (await request(service, "GET", `/2015-03-31/functions/${encodeURIComponent(name)}/configuration`));
+        const state = cfg?.State;
+        if (state === undefined || state === "Active")
+            return;
+        if (state === "Failed") {
+            throw new Error(`aws: lambda "${name}" failed to deploy: ${cfg?.StateReason ?? "no reason given"}`);
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`aws: lambda "${name}" was still ${state} after ${timeoutMs} ms`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+}
+async function packageSource(projectRoot, fnName, source) {
+    const root = path.isAbsolute(source) ? source : path.join(projectRoot, source);
+    let info;
+    try {
+        info = await stat(root);
+    }
+    catch {
+        throw new Error(`aws: lambda "${fnName}" has no code at ${source} (looked in ${root}). ` +
+            `\`source\` is a path in your repository, relative to its root.`);
+    }
+    const entries = [];
+    if (info.isDirectory()) {
+        await collect(root, "", entries);
+        if (entries.length === 0) {
+            throw new Error(`aws: lambda "${fnName}" has no files in ${source}`);
+        }
+    }
+    else {
+        entries.push({ name: path.basename(root), data: await readFile(root) });
+    }
+    // Sorted so the same source always packages to the same bytes.
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return buildZip(entries);
+}
+async function collect(dir, prefix, out) {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+        if (entry.isDirectory()) {
+            await collect(full, rel, out);
+        }
+        else if (entry.isFile()) {
+            out.push({ name: rel, data: await readFile(full) });
+        }
+        // Symlinks and everything else are skipped: a deployment package holds
+        // regular files.
+    }
+}
+function crc32(buf) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < buf.length; i++) {
+        let c = (crc ^ buf[i]) & 0xff;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? (c >>> 1) ^ 0xedb88320 : c >>> 1;
+        crc = (crc >>> 8) ^ c;
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+/**
+ * Build a zip archive. Entries are deflated (method 8), or stored (method 0)
+ * when deflating makes them no smaller. Timestamps are fixed, so identical
+ * sources always produce identical bytes.
+ */
+function buildZip(entries) {
+    const encoder = new TextEncoder();
+    const local = [];
+    const central = [];
+    let offset = 0;
+    for (const entry of entries) {
+        const nameBytes = encoder.encode(entry.name);
+        const crc = crc32(entry.data);
+        const deflated = new Uint8Array(deflateRawSync(entry.data));
+        const stored = deflated.length >= entry.data.length;
+        const payload = stored ? entry.data : deflated;
+        const method = stored ? 0 : 8;
+        const header = new DataView(new ArrayBuffer(30));
+        header.setUint32(0, 0x04034b50, true); // local file header
+        header.setUint16(4, 20, true); // version needed
+        header.setUint16(6, 0, true); // flags
+        header.setUint16(8, method, true);
+        header.setUint16(10, 0, true); // time — fixed
+        header.setUint16(12, 0x21, true); // date — fixed (1 Jan 1980)
+        header.setUint32(14, crc, true);
+        header.setUint32(18, payload.length, true);
+        header.setUint32(22, entry.data.length, true);
+        header.setUint16(26, nameBytes.length, true);
+        header.setUint16(28, 0, true); // extra length
+        const headerBytes = new Uint8Array(header.buffer);
+        local.push(headerBytes, nameBytes, payload);
+        const dirEntry = new DataView(new ArrayBuffer(46));
+        dirEntry.setUint32(0, 0x02014b50, true); // central directory header
+        dirEntry.setUint16(4, 20, true); // version made by
+        dirEntry.setUint16(6, 20, true); // version needed
+        dirEntry.setUint16(8, 0, true); // flags
+        dirEntry.setUint16(10, method, true);
+        dirEntry.setUint16(12, 0, true);
+        dirEntry.setUint16(14, 0x21, true);
+        dirEntry.setUint32(16, crc, true);
+        dirEntry.setUint32(20, payload.length, true);
+        dirEntry.setUint32(24, entry.data.length, true);
+        dirEntry.setUint16(28, nameBytes.length, true);
+        // Permissions in the high half of the external attributes: 0644 for a
+        // regular file, which is what a Lambda runtime expects to find.
+        dirEntry.setUint32(38, 0o100644 << 16, true);
+        dirEntry.setUint32(42, offset, true);
+        central.push(new Uint8Array(dirEntry.buffer), nameBytes);
+        offset += headerBytes.length + nameBytes.length + payload.length;
+    }
+    const centralSize = central.reduce((n, part) => n + part.length, 0);
+    const end = new DataView(new ArrayBuffer(22));
+    end.setUint32(0, 0x06054b50, true); // end of central directory
+    end.setUint16(8, entries.length, true);
+    end.setUint16(10, entries.length, true);
+    end.setUint32(12, centralSize, true);
+    end.setUint32(16, offset, true);
+    const parts = [...local, ...central, new Uint8Array(end.buffer)];
+    const total = parts.reduce((n, part) => n + part.length, 0);
+    const zipped = new Uint8Array(total);
+    let cursor = 0;
+    for (const part of parts) {
+        zipped.set(part, cursor);
+        cursor += part.length;
+    }
+    return zipped;
+}

package/dist/components/index.d.ts

@@ -5,4 +5,5 @@ export { k3s, type K3sOptions, type K3sHelpers, type K3sClient, type TaggedObjec
 export { expo, type ExpoOptions, type ExpoHelpers, } from "./expo.js";
 export { supabase, type SupabaseOptions, type SupabaseHelpers, type SupabaseStack, } from "./supabase.js";
 export { email, type EmailOptions, type EmailHelpers, type EmailMessage, type EmailSummary, type EmailMatch, type EmailAttachment, } from "./email.js";
+export { aws, type AwsOptions, type LambdaOptions, } from "./aws.js";
 export { replayFake, type ReplayFakeOptions, type ReplayMatch, type InjectRule, type InjectMatch, type StringMatch, type SignConfig, type AwsSigV4Sign, type ReplayHelpers, type ReplaySummary, type Cassette, type CassetteInteraction, type CassetteRequest, type CassetteResponse, type CassetteState, } from "./replayFake.js";

package/dist/components/index.js

@@ -15,4 +15,5 @@ export { k3s, } from "./k3s.js";
 export { expo, } from "./expo.js";
 export { supabase, } from "./supabase.js";
 export { email, } from "./email.js";
+export { aws, } from "./aws.js";
 export { replayFake, } from "./replayFake.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.33.0",
+  "version": "0.35.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",