@specific.dev/spectest 0.38.0 → 0.41.0

package/src/components/aws.ts

@@ -0,0 +1,554 @@
+// `aws()` — the AWS cloud APIs, emulated inside the environment, answering
+// at their **real** endpoints.
+//
+// The component runs one emulator container and claims the AWS domains for
+// it: DNS, a leaf certificate minted from the in-VM root CA, and a
+// TLS-terminating reverse proxy. An AWS SDK in the app under test therefore
+// resolves `https://states.us-east-1.amazonaws.com` the way it does in
+// production and reaches the emulator — the app needs no endpoint override,
+// no test-only branch, and no knowledge that it is under test.
+//
+// Lambda functions are declared next to the services and deployed from the
+// project's own source. Deployment happens in the service `setup` hook, which
+// runs before the warm-template snapshot, so a warm start restores functions
+// that are already deployed, already active, and already warm.
+//
+// ── Internal notes (deliberately not in the user-facing docs) ──────────────
+//
+// The backing image is MiniStack (MIT, github.com/ministackorg/ministack),
+// pinned rather than floated. It replaced LocalStack, which folded its
+// Apache-2.0 Community edition into one paid product in March 2026 (current
+// images demand a LOCALSTACK_AUTH_TOKEN). MiniStack also suits fork-per-test
+// far better: ~270 MB against ~1 GB and a ~2 s boot.
+//
+// Lambda runs in MiniStack's **docker** executor, never its default `local`
+// one, because `local` has no runtime fidelity at all: it maps `python*` to
+// its own `sys.executable` and `nodejs*` to its own `node`, so the declared
+// `Runtime` selects only the language. A function declared `python3.11` runs
+// on the emulator image's CPython 3.13/musl, and one declared `nodejs20.x`
+// runs on Node 24 — which is why a native wheel built for the real target
+// fails to import ("No module named 'pydantic_core._pydantic_core'"). The
+// docker executor runs the handler under AWS's own Runtime Interface
+// Emulator in `public.ecr.aws/lambda/<runtime>`, giving the real
+// interpreter, glibc, `/var/task` and `AWS_EXECUTION_ENV`. Measured on
+// aarch64: it is also ~7x FASTER per warm invoke (7 ms against 53 ms) at
+// ~25-40 MiB per function container.
+//
+// None of this is configurable, on purpose — a knob here is a knob between
+// "behaves like AWS" and "does not".
+//
+// The cost is a bind-mount of the VM's own docker socket, which the daemon
+// already supports (`ensureVolumes` treats an existing non-directory source
+// as a thing to mount as-is). The RIE containers are ordinary VM containers
+// on `spectest-net`, so they ride snapshots and forks like any service: a
+// per-test fork inherits its parent's already-warm function.
+//
+// Landmine: the runtime images are pulled from `public.ecr.aws`, which the
+// in-VM dockerd reaches DIRECTLY. Its `registry-mirrors` only ever applies
+// to Docker Hub, so the zot mirror (which does carry public.ecr.aws, on
+// :5004) is NOT consulted. MiniStack's own `MINISTACK_IMAGE_PREFIX` cannot
+// close that gap either: it prepends rather than replacing the registry
+// host. Routing these pulls through zot needs a pre-pull of
+// `spectest-host:5004/lambda/<rt>` retagged to the `public.ecr.aws` name.
+//
+// Like `email()`'s mail server, the product name stays out of every
+// user-facing surface (docs, examples, error messages). Users get "the AWS
+// emulator"; `image` swaps it.
+//
+// The emulator ignores SigV4 and does not check that a role exists, both
+// verified on 1.4.8. That is what lets this component deploy over plain
+// unsigned HTTP from the daemon and skip IAM entirely.
+
+import { readFile, readdir, stat } from "node:fs/promises";
+import path from "node:path";
+import { deflateRawSync } from "node:zlib";
+
+import type { ServiceDefinition, ServiceSetupContext } from "../index.js";
+import { certificate, provides, proxy, SELF_SERVICE_TOKEN } from "../index.js";
+import { pauseRecording, resumeRecording } from "../recorder.js";
+
+/** Backing image, pinned internally (not part of the documented surface). */
+const AWS_IMAGE = "ministackorg/ministack:1.4.8";
+/** Port the emulator serves every AWS API on. Internal: callers reach the
+ *  emulator through the AWS hostnames, never through this port. */
+const AWS_PORT = 4566;
+
+// Every AWS region, so the component can answer for all of them and the user
+// never has to declare which ones the app uses. Enumeration is forced by TLS,
+// not by routing: a wildcard *route* matches any depth, but a wildcard
+// *certificate* covers exactly one label (RFC 6125, enforced by every
+// client), so `*.amazonaws.com` cannot serve `states.us-east-1.amazonaws.com`
+// — each region needs its own `*.<region>.amazonaws.com` name. They all ride
+// ONE certificate as SANs and one shared upstream, so the list costs a few
+// route-table entries, not a key generation each.
+//
+// Sourced from AWS's own published `ip-ranges.json` (2026-07-31). A region
+// added later is simply not claimed: its endpoints fail to resolve, which
+// says plainly what happened — add it here.
+const AWS_REGIONS = [
+  "af-south-1", "ap-east-1", "ap-east-2", "ap-northeast-1", "ap-northeast-2",
+  "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2",
+  "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6",
+  "ap-southeast-7", "ca-central-1", "ca-west-1", "eu-central-1", "eu-central-2",
+  "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3",
+  "eusc-de-east-1", "il-central-1", "me-central-1", "me-south-1", "me-west-1",
+  "mx-central-1", "sa-east-1", "sa-west-1", "us-east-1", "us-east-2",
+  "us-gov-east-1", "us-gov-west-1", "us-south-1", "us-west-1", "us-west-2",
+];
+
+/** China is a separate partition on its own domain suffix. */
+const AWS_CN_REGIONS = ["cn-north-1", "cn-northwest-1"];
+
+/** Every hostname pattern the emulator answers to: the two partitions' global
+ *  endpoints (`sts.amazonaws.com`, `iam.amazonaws.com`) plus one per region
+ *  for the regional ones (`states.us-east-1.amazonaws.com`). */
+const AWS_HOST_PATTERNS = [
+  "*.amazonaws.com",
+  ...AWS_REGIONS.map((r) => `*.${r}.amazonaws.com`),
+  "*.amazonaws.com.cn",
+  ...AWS_CN_REGIONS.map((r) => `*.${r}.amazonaws.com.cn`),
+];
+
+/** The VM's own docker socket, bind-mounted so the emulator can start the
+ *  official AWS runtime containers. This is the VM's dockerd, inside the
+ *  hermetic environment — the same daemon that runs the services. */
+const DOCKER_SOCKET = "/var/run/docker.sock";
+/** The network the function containers join, so a handler reaches the other
+ *  services and the AWS endpoints by the same names a test uses. */
+const SPECTEST_NETWORK = "spectest-net";
+
+/** Region the emulator's own tools default to — the AWS CLI refuses to run
+ *  without one. Only the *container's* default; it constrains nothing about
+ *  the app, and every region is served regardless. A `setup` hook that drives
+ *  the CLI against another region passes `--region`. */
+const CONTAINER_DEFAULT_REGION = "us-east-1";
+/** Role every declared function is created with. The emulator does not
+ *  enforce IAM, so this only has to be a well-formed ARN — which is why the
+ *  component creates no role and takes no IAM options. A project that wants a
+ *  real-looking role can create one itself and set `role` on the function. */
+const DEFAULT_ROLE_ARN = "arn:aws:iam::000000000000:role/spectest-lambda";
+/** Ready-check budget. The emulator boots in a couple of seconds; the slow
+ *  part is a cold image pull on a machine that has never run it. */
+const READY_TIMEOUT_SECS = 120;
+/** Memory every declared function is created with. Kept at what this
+ *  component has always used, rather than the emulator's own default, so the
+ *  removal of the `memoryMb` option changed no behaviour. */
+const MEMORY_MB = 512;
+
+export interface AwsOptions {
+  /**
+   * Lambda functions to deploy from the project's own source, keyed by
+   * function name — the name the app (or a state machine) invokes.
+   *
+   * ```ts
+   * lambdas: {
+   *   add:      { source: "lambda/add" },
+   *   resize:   { source: "lambda/resize", runtime: "python3.12", timeoutSecs: 60 },
+   * }
+   * ```
+   *
+   * Each is packaged and deployed during environment bring-up, so it is part
+   * of the warm-template snapshot: a warm start restores the deployed
+   * function instead of deploying it again.
+   */
+  lambdas?: Record<string, LambdaOptions>;
+}
+
+export interface LambdaOptions {
+  /**
+   * The function's code, as a path in your repository — either a directory
+   * (packaged whole, recursively, with its contents at the root of the
+   * package) or a single file. Relative paths resolve against the project
+   * root, so `"lambda/add"` is the repo's own `lambda/add/`.
+   *
+   * The code is taken from the repository on purpose: the function you test
+   * is the function you ship. Anything the handler imports at runtime —
+   * including its dependencies — must be inside this path, exactly as a real
+   * deployment package requires.
+   */
+  source: string;
+  /** Entry point, as AWS spells it: `<file>.<exported function>`. Default
+   *  `"index.handler"`. */
+  handler?: string;
+  /** Lambda runtime identifier. Default `"nodejs20.x"`. */
+  runtime?: string;
+  /** Environment variables for the function. */
+  env?: Record<string, string>;
+  /** Function timeout in seconds. Default `30`. */
+  timeoutSecs?: number;
+  /** Execution-role ARN. Defaults to a fixed placeholder — the emulator does
+   *  not enforce IAM. Set it only when the code reads the ARN itself. */
+  role?: string;
+}
+
+
+/**
+ * The AWS cloud APIs, emulated in the environment and answering at their real
+ * endpoints. Drop into `environment.services`:
+ *
+ * ```ts
+ * import { aws } from "@specific.dev/spectest/components";
+ *
+ * services: {
+ *   aws: aws({
+ *     lambdas: {
+ *       add:      { source: "lambda/add" },
+ *       subtract: { source: "lambda/subtract" },
+ *     },
+ *   }),
+ *   app: {
+ *     image: { type: "dockerfile", content: appDockerfile },
+ *     // Whatever the app already reads in production. An AWS SDK needs a
+ *     // region and credentials; the emulator accepts any credential value.
+ *     env: {
+ *       AWS_REGION: "us-east-1",
+ *       AWS_ACCESS_KEY_ID: "test",
+ *       AWS_SECRET_ACCESS_KEY: "test",
+ *     },
+ *     dependsOn: ["aws"],
+ *   },
+ * }
+ * ```
+ *
+ * The app keeps its production configuration — `new SFNClient({})`, no
+ * endpoint — because the component owns DNS and TLS for the AWS domains. It
+ * answers for **every region**, so an app that talks to two of them, or that
+ * reads its region from configuration, needs nothing declared here.
+ *
+ * Tests reach the same cloud with the AWS CLI, which the emulator's image
+ * ships as `awslocal` (the CLI, already pointed at it):
+ *
+ * ```ts
+ * const listed = await ctx.exec("aws", "awslocal stepfunctions list-state-machines");
+ * expect(listed.exitCode).toBe(0);
+ * const machines = listed.stdout.transform("machines", (out) =>
+ *   (JSON.parse(out) as { stateMachines: unknown[] }).stateMachines,
+ * );
+ * expect(machines).toHaveLength(1);
+ * ```
+ *
+ * For S3, prefer the `s3()` component and give it the endpoint your app uses
+ * (`s3({ hosts: ["s3.us-east-1.amazonaws.com"] })`). An exact hostname always
+ * beats this component's wildcard, so the two compose without further
+ * configuration.
+ */
+export function aws(opts: AwsOptions = {}) {
+  const lambdas = opts.lambdas ?? {};
+
+  const service = {
+    image: { type: "registry" as const, reference: AWS_IMAGE },
+    env: {
+      AWS_DEFAULT_REGION: CONTAINER_DEFAULT_REGION,
+      // Run every function in the official AWS runtime image rather than in
+      // the emulator's own interpreter — see the note at the top of the file.
+      LAMBDA_EXECUTOR: "docker",
+      // No silent fall-back to the low-fidelity executor. If the runtime
+      // container cannot start, say so instead of running the handler on the
+      // wrong interpreter and failing later, somewhere else.
+      LAMBDA_STRICT: "1",
+      LAMBDA_DOCKER_NETWORK: SPECTEST_NETWORK,
+    },
+    volumes: [{ source: DOCKER_SOCKET, target: DOCKER_SOCKET }],
+    ports: [AWS_PORT],
+    readyCheck: {
+      type: "http" as const,
+      port: AWS_PORT,
+      path: "/_ministack/health",
+      timeoutSecs: READY_TIMEOUT_SECS,
+    },
+    ...(Object.keys(lambdas).length > 0
+      ? {
+          setup: async ({ name, projectRoot }: ServiceSetupContext) => {
+            for (const [fn, spec] of Object.entries(lambdas)) {
+              await deployLambda(name, projectRoot, fn, spec);
+            }
+          },
+        }
+      : {}),
+  } satisfies ServiceDefinition;
+
+  // The low-level primitives rather than the `tls` field, for one reason:
+  // `tls` mints a separate leaf certificate per entry, and this component
+  // claims several dozen names. One `certificate(...)` decl carries them all
+  // as SANs of a single leaf — one key generation at bring-up instead of
+  // dozens — while the proxies are just route-table entries.
+  return provides(service, [
+    certificate(AWS_HOST_PATTERNS),
+    ...AWS_HOST_PATTERNS.map((hostname) =>
+      proxy(hostname, { service: SELF_SERVICE_TOKEN, port: AWS_PORT }),
+    ),
+  ]);
+}
+
+
+// ──────────────────────────────────────────────────────────────────────────
+// Talking to the emulator directly
+//
+// The emulator ignores request signatures, so the daemon reaches its APIs
+// over plain unsigned HTTP. That keeps deployment independent of what tools
+// the image happens to ship, and keeps a poll loop cheap.
+// ──────────────────────────────────────────────────────────────────────────
+
+/** One JSON-protocol AWS call (Step Functions, DynamoDB, …), by target. */
+async function request(
+  service: string,
+  method: string,
+  urlPath: string,
+  init: { headers?: Record<string, string>; body?: string } = {},
+): Promise<unknown> {
+  // Never let the component's own traffic land on the timeline: these calls
+  // are bring-up and polling, not something a test asked for.
+  pauseRecording();
+  try {
+    const res = await fetch(`http://${service}:${AWS_PORT}${urlPath}`, {
+      method,
+      headers: { "content-type": "application/json", ...(init.headers ?? {}) },
+      ...(init.body !== undefined ? { body: init.body } : {}),
+    });
+    // Coerced rather than read directly: `fetch` is wrapped during a test, so
+    // `res.status` is a provenance carrier there and a plain number elsewhere.
+    const status = Number(res.status);
+    const text = String(await res.text());
+    if (status >= 400) {
+      const err = new Error(`aws: ${method} ${urlPath} failed: HTTP ${status} ${text.slice(0, 400)}`);
+      (err as Error & { status?: number }).status = status;
+      throw err;
+    }
+    return text === "" ? undefined : JSON.parse(text);
+  } finally {
+    resumeRecording();
+  }
+}
+
+// ──────────────────────────────────────────────────────────────────────────
+// Lambda deployment
+// ──────────────────────────────────────────────────────────────────────────
+
+/** Refuse a package that no real deployment would accept either. */
+const MAX_PACKAGE_BYTES = 64 * 1024 * 1024;
+
+async function deployLambda(
+  service: string,
+  projectRoot: string,
+  name: string,
+  spec: LambdaOptions,
+): Promise<void> {
+  if (typeof spec?.source !== "string" || spec.source.trim() === "") {
+    throw new Error(`aws: lambda "${name}" needs a \`source\` path to its code`);
+  }
+  const zipped = await packageSource(projectRoot, name, spec.source);
+  if (zipped.length > MAX_PACKAGE_BYTES) {
+    throw new Error(
+      `aws: lambda "${name}" packages to ${Math.round(zipped.length / 1e6)} MB from ` +
+        `${spec.source} — over the ${MAX_PACKAGE_BYTES / 1e6} MB limit. Point \`source\` at ` +
+        `the function's own directory, not a whole repository.`,
+    );
+  }
+
+  const code = Buffer.from(zipped).toString("base64");
+  const config = {
+    Runtime: spec.runtime ?? "nodejs20.x",
+    Handler: spec.handler ?? "index.handler",
+    Role: spec.role ?? DEFAULT_ROLE_ARN,
+    Timeout: spec.timeoutSecs ?? 30,
+    // Fixed, and not an option: the emulated cloud reports this number back
+    // as `AWS_LAMBDA_FUNCTION_MEMORY_SIZE` but never caps the runtime
+    // container at it, so the number changes nothing about how a function
+    // behaves here.
+    MemorySize: MEMORY_MB,
+    ...(spec.env ? { Environment: { Variables: spec.env } } : {}),
+  };
+
+  try {
+    await request(service, "POST", "/2015-03-31/functions", {
+      body: JSON.stringify({ FunctionName: name, Code: { ZipFile: code }, ...config }),
+    });
+  } catch (err) {
+    // Already there: a re-run of bring-up against an emulator that kept its
+    // state. Update instead, so the deployed code always matches the repo.
+    if ((err as { status?: number }).status !== 409) throw err;
+    await request(service, "PUT", `/2015-03-31/functions/${encodeURIComponent(name)}/code`, {
+      body: JSON.stringify({ ZipFile: code }),
+    });
+    await request(service, "PUT", `/2015-03-31/functions/${encodeURIComponent(name)}/configuration`, {
+      body: JSON.stringify(config),
+    });
+  }
+
+  await waitActive(service, name);
+
+  // One invoke with an empty event, purely to leave a warm worker behind in
+  // the snapshot, so no test pays a cold start. The handler may well reject
+  // the event — that is fine, the worker is started either way.
+  try {
+    await request(service, "POST", `/2015-03-31/functions/${encodeURIComponent(name)}/invocations`, {
+      body: "{}",
+    });
+  } catch {
+    // Ignored on purpose: warming is an optimisation, never a gate.
+  }
+}
+
+/** Wait for a newly created function to leave `Pending`, exactly as a real
+ *  deployment must. Tolerates an emulator that reports no state at all. */
+async function waitActive(service: string, name: string, timeoutMs = 60_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const cfg = (await request(
+      service,
+      "GET",
+      `/2015-03-31/functions/${encodeURIComponent(name)}/configuration`,
+    )) as { State?: string; StateReason?: string } | undefined;
+    const state = cfg?.State;
+    if (state === undefined || state === "Active") return;
+    if (state === "Failed") {
+      throw new Error(`aws: lambda "${name}" failed to deploy: ${cfg?.StateReason ?? "no reason given"}`);
+    }
+    if (Date.now() > deadline) {
+      throw new Error(`aws: lambda "${name}" was still ${state} after ${timeoutMs} ms`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+}
+
+// ──────────────────────────────────────────────────────────────────────────
+// Packaging
+//
+// A deployment package is a zip, and building one in the daemon keeps the
+// whole path tool-free: no zip binary in the image, no staging file, and no
+// dependence on what the emulator image ships.
+// ──────────────────────────────────────────────────────────────────────────
+
+interface PackageEntry {
+  /** Path inside the package, always forward-slashed. */
+  name: string;
+  data: Uint8Array;
+}
+
+async function packageSource(
+  projectRoot: string,
+  fnName: string,
+  source: string,
+): Promise<Uint8Array> {
+  const root = path.isAbsolute(source) ? source : path.join(projectRoot, source);
+  let info;
+  try {
+    info = await stat(root);
+  } catch {
+    throw new Error(
+      `aws: lambda "${fnName}" has no code at ${source} (looked in ${root}). ` +
+        `\`source\` is a path in your repository, relative to its root.`,
+    );
+  }
+
+  const entries: PackageEntry[] = [];
+  if (info.isDirectory()) {
+    await collect(root, "", entries);
+    if (entries.length === 0) {
+      throw new Error(`aws: lambda "${fnName}" has no files in ${source}`);
+    }
+  } else {
+    entries.push({ name: path.basename(root), data: await readFile(root) });
+  }
+  // Sorted so the same source always packages to the same bytes.
+  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+  return buildZip(entries);
+}
+
+async function collect(dir: string, prefix: string, out: PackageEntry[]): Promise<void> {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+    if (entry.isDirectory()) {
+      await collect(full, rel, out);
+    } else if (entry.isFile()) {
+      out.push({ name: rel, data: await readFile(full) });
+    }
+    // Symlinks and everything else are skipped: a deployment package holds
+    // regular files.
+  }
+}
+
+function crc32(buf: Uint8Array): number {
+  let crc = 0xffffffff;
+  for (let i = 0; i < buf.length; i++) {
+    let c = (crc ^ buf[i]) & 0xff;
+    for (let k = 0; k < 8; k++) c = c & 1 ? (c >>> 1) ^ 0xedb88320 : c >>> 1;
+    crc = (crc >>> 8) ^ c;
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+/**
+ * Build a zip archive. Entries are deflated (method 8), or stored (method 0)
+ * when deflating makes them no smaller. Timestamps are fixed, so identical
+ * sources always produce identical bytes.
+ */
+function buildZip(entries: PackageEntry[]): Uint8Array {
+  const encoder = new TextEncoder();
+  const local: Uint8Array[] = [];
+  const central: Uint8Array[] = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const nameBytes = encoder.encode(entry.name);
+    const crc = crc32(entry.data);
+    const deflated = new Uint8Array(deflateRawSync(entry.data));
+    const stored = deflated.length >= entry.data.length;
+    const payload = stored ? entry.data : deflated;
+    const method = stored ? 0 : 8;
+
+    const header = new DataView(new ArrayBuffer(30));
+    header.setUint32(0, 0x04034b50, true); // local file header
+    header.setUint16(4, 20, true); // version needed
+    header.setUint16(6, 0, true); // flags
+    header.setUint16(8, method, true);
+    header.setUint16(10, 0, true); // time — fixed
+    header.setUint16(12, 0x21, true); // date — fixed (1 Jan 1980)
+    header.setUint32(14, crc, true);
+    header.setUint32(18, payload.length, true);
+    header.setUint32(22, entry.data.length, true);
+    header.setUint16(26, nameBytes.length, true);
+    header.setUint16(28, 0, true); // extra length
+    const headerBytes = new Uint8Array(header.buffer);
+    local.push(headerBytes, nameBytes, payload);
+
+    const dirEntry = new DataView(new ArrayBuffer(46));
+    dirEntry.setUint32(0, 0x02014b50, true); // central directory header
+    dirEntry.setUint16(4, 20, true); // version made by
+    dirEntry.setUint16(6, 20, true); // version needed
+    dirEntry.setUint16(8, 0, true); // flags
+    dirEntry.setUint16(10, method, true);
+    dirEntry.setUint16(12, 0, true);
+    dirEntry.setUint16(14, 0x21, true);
+    dirEntry.setUint32(16, crc, true);
+    dirEntry.setUint32(20, payload.length, true);
+    dirEntry.setUint32(24, entry.data.length, true);
+    dirEntry.setUint16(28, nameBytes.length, true);
+    // Permissions in the high half of the external attributes: 0644 for a
+    // regular file, which is what a Lambda runtime expects to find.
+    dirEntry.setUint32(38, 0o100644 << 16, true);
+    dirEntry.setUint32(42, offset, true);
+    central.push(new Uint8Array(dirEntry.buffer), nameBytes);
+
+    offset += headerBytes.length + nameBytes.length + payload.length;
+  }
+
+  const centralSize = central.reduce((n, part) => n + part.length, 0);
+  const end = new DataView(new ArrayBuffer(22));
+  end.setUint32(0, 0x06054b50, true); // end of central directory
+  end.setUint16(8, entries.length, true);
+  end.setUint16(10, entries.length, true);
+  end.setUint32(12, centralSize, true);
+  end.setUint32(16, offset, true);
+
+  const parts = [...local, ...central, new Uint8Array(end.buffer)];
+  const total = parts.reduce((n, part) => n + part.length, 0);
+  const zipped = new Uint8Array(total);
+  let cursor = 0;
+  for (const part of parts) {
+    zipped.set(part, cursor);
+    cursor += part.length;
+  }
+  return zipped;
+}