@atproto/space 0.0.0-spaces-alpha-20260818022935

package/tests/repo-commit.test.ts

@@ -0,0 +1,281 @@
+import { beforeAll, describe, expect, it } from 'vitest'
+import { type Keypair, Secp256k1Keypair } from '@atproto/crypto'
+import { parseCid } from '@atproto/lex-data'
+import {
+  type CommitCtx,
+  LTHASH_STATE_BYTES,
+  RepoCommit,
+  type SignedCommit,
+  encodeCommitCtx,
+  formatSetHashElement,
+  verifyCommit,
+} from '../src/index.js'
+
+// cids of `{ text: 'hello' }` and `{ text: 'world' }`
+const CID_A = parseCid(
+  'bafyreidefdycgbfy3oglcb6ism3eqhyp5llsrpzxjsuac2gsy4mtrtx244',
+)
+const CID_B = parseCid(
+  'bafyreidpw4cbv6gr4ukh33z23pvvrpr3wi4gnpmi4doamlsl3sa4rgri2a',
+)
+
+const ctx: CommitCtx = {
+  space: 'at://did:example:space/space/app.bsky.group/test',
+  author: 'did:example:alice',
+  rev: '3kbcq3p7ad400',
+}
+
+describe('RepoCommit', () => {
+  let keypair: Keypair
+
+  beforeAll(async () => {
+    keypair = await Secp256k1Keypair.create()
+  })
+
+  const sameContents = (a: RepoCommit, b: RepoCommit) =>
+    a.setHash.equals(b.setHash)
+
+  describe('contents', () => {
+    it('starts empty', () => {
+      expect(new RepoCommit().setHash.isEmpty()).toBe(true)
+      expect(new RepoCommit().setHash.state()).toHaveLength(LTHASH_STATE_BYTES)
+    })
+
+    it('add then remove returns to empty', () => {
+      const repo = new RepoCommit().add('c.a', '1', CID_A)
+      expect(repo.setHash.isEmpty()).toBe(false)
+      repo.remove('c.a', '1', CID_A)
+      expect(repo.setHash.isEmpty()).toBe(true)
+    })
+
+    it('is order-independent', () => {
+      const a = new RepoCommit().add('c.a', '1', CID_A).add('c.b', '2', CID_B)
+      const b = new RepoCommit().add('c.b', '2', CID_B).add('c.a', '1', CID_A)
+      expect(sameContents(a, b)).toBe(true)
+    })
+
+    it('distinguishes the same cid at different paths', () => {
+      const a = new RepoCommit().add('c.a', '1', CID_A)
+      const b = new RepoCommit().add('c.a', '2', CID_A)
+      expect(sameContents(a, b)).toBe(false)
+    })
+
+    it('distinguishes different cids at the same path', () => {
+      const a = new RepoCommit().add('c.a', '1', CID_A)
+      const b = new RepoCommit().add('c.a', '1', CID_B)
+      expect(sameContents(a, b)).toBe(false)
+    })
+
+    it('round-trips through persisted state', () => {
+      const repo = new RepoCommit().add('c.a', '1', CID_A)
+      const resumed = RepoCommit.fromState(repo.setHash.state())
+      expect(sameContents(resumed, repo)).toBe(true)
+      expect(RepoCommit.fromState(null).setHash.isEmpty()).toBe(true)
+    })
+
+    it('fromRecords matches incremental adds', () => {
+      const records = [
+        { collection: 'c.a', rkey: '1', cid: CID_A },
+        { collection: 'c.b', rkey: '2', cid: CID_B },
+      ]
+      const incremental = new RepoCommit()
+      for (const r of records) incremental.add(r.collection, r.rkey, r.cid)
+      expect(sameContents(RepoCommit.fromRecords(records), incremental)).toBe(
+        true,
+      )
+    })
+  })
+
+  describe('applyOp', () => {
+    it('treats a null prev as a create', () => {
+      const viaOp = new RepoCommit().applyOp({
+        collection: 'c.a',
+        rkey: '1',
+        cid: CID_A,
+        prev: null,
+      })
+      expect(sameContents(viaOp, new RepoCommit().add('c.a', '1', CID_A))).toBe(
+        true,
+      )
+    })
+
+    it('treats a null cid as a delete', () => {
+      const repo = new RepoCommit().add('c.a', '1', CID_A)
+      repo.applyOp({ collection: 'c.a', rkey: '1', cid: null, prev: CID_A })
+      expect(repo.setHash.isEmpty()).toBe(true)
+    })
+
+    it('swaps both cids on an update', () => {
+      const repo = new RepoCommit().add('c.a', '1', CID_A)
+      repo.applyOp({ collection: 'c.a', rkey: '1', cid: CID_B, prev: CID_A })
+      expect(sameContents(repo, new RepoCommit().add('c.a', '1', CID_B))).toBe(
+        true,
+      )
+    })
+
+    it('applyOps replays a batch', () => {
+      const repo = new RepoCommit().applyOps([
+        { collection: 'c.a', rkey: '1', cid: CID_A, prev: null },
+        { collection: 'c.a', rkey: '1', cid: CID_B, prev: CID_A },
+        { collection: 'c.a', rkey: '1', cid: null, prev: CID_B },
+      ])
+      expect(repo.setHash.isEmpty()).toBe(true)
+    })
+
+    it('converges regardless of the order ops are applied', () => {
+      const ops = [
+        { collection: 'c.a', rkey: '1', cid: CID_A, prev: null },
+        { collection: 'c.b', rkey: '2', cid: CID_B, prev: null },
+      ]
+      const forward = new RepoCommit().applyOps(ops)
+      const backward = new RepoCommit().applyOps([...ops].reverse())
+      expect(sameContents(forward, backward)).toBe(true)
+    })
+  })
+
+  describe('signing', () => {
+    let repo: RepoCommit
+
+    beforeAll(() => {
+      repo = new RepoCommit().add('app.bsky.feed.post', '1', CID_A)
+    })
+
+    it('produces a well-formed commit', async () => {
+      const commit = await repo.sign(ctx, keypair)
+      expect(commit.ver).toBe(1)
+      expect(commit.rev).toBe(ctx.rev)
+      expect(commit.hash).toEqual(repo.setHash.digest())
+      expect(commit.hash).toHaveLength(32)
+      expect(commit.ikm).toHaveLength(32)
+      expect(commit.mac).toHaveLength(32)
+      expect(commit.sig.length).toBeGreaterThan(0)
+    })
+
+    it('verifies its own commit', async () => {
+      const commit = await repo.sign(ctx, keypair)
+      expect(await verifyCommit(commit, ctx, keypair.did())).toBe(true)
+      expect(repo.matches(commit)).toBe(true)
+    })
+
+    it('uses a fresh ikm per commit, for deniability', async () => {
+      const a = await repo.sign(ctx, keypair)
+      const b = await repo.sign(ctx, keypair)
+      expect(a.ikm).not.toEqual(b.ikm)
+      expect(a.mac).not.toEqual(b.mac)
+      expect(a.sig).not.toEqual(b.sig)
+      expect(a.hash).toEqual(b.hash)
+    })
+
+    it('rejects a signature from a different key', async () => {
+      const other = await Secp256k1Keypair.create()
+      const commit = await repo.sign(ctx, keypair)
+      expect(await verifyCommit(commit, ctx, other.did())).toBe(false)
+    })
+
+    it.each([
+      ['space', { space: 'at://did:example:space/space/app.bsky.group/other' }],
+      ['author', { author: 'did:example:bob' }],
+      ['rev', { rev: '3kbcq3p7ad999' }],
+    ])('does not verify under a different %s', async (_field, override) => {
+      const commit = await repo.sign(ctx, keypair)
+      const otherCtx = { ...ctx, ...override }
+      expect(await verifyCommit(commit, otherCtx, keypair.did())).toBe(false)
+    })
+
+    it('does not verify a tampered hash', async () => {
+      const commit = await repo.sign(ctx, keypair)
+      const tampered = { ...commit, hash: new RepoCommit().setHash.digest() }
+      // The signature over the ctx is still valid — it never covered the hash.
+      // The MAC is what catches this, and what a leaked commit can't prove.
+      expect(await verifyCommit(tampered, ctx, keypair.did())).toBe(false)
+    })
+
+    it('rejects a commit whose rev disagrees with the ctx', async () => {
+      const commit = await repo.sign(ctx, keypair)
+      expect(
+        await verifyCommit(
+          { ...commit, rev: '3kbcq3p7ad999' },
+          ctx,
+          keypair.did(),
+        ),
+      ).toBe(false)
+    })
+
+    it('rejects an unknown commit version', async () => {
+      const commit = await repo.sign(ctx, keypair)
+      const future = { ...commit, ver: 2 } as unknown as SignedCommit
+      expect(await verifyCommit(future, ctx, keypair.did())).toBe(false)
+    })
+
+    it('matches() is false once the repo changes', async () => {
+      const commit = await repo.sign(ctx, keypair)
+      const advanced = RepoCommit.fromState(repo.setHash.state()).add(
+        'app.bsky.feed.post',
+        '2',
+        CID_B,
+      )
+      expect(advanced.matches(commit)).toBe(false)
+    })
+  })
+
+  /**
+   * The set hash element is a bare `collection/rkey/cid` concat. Two records
+   * hashing to one element would let one's addition cancel the other's — silently
+   * and permanently — so what keeps the encoding injective is worth stating.
+   *
+   * It is *not* the length prefixing that {@link encodeCommitCtx} uses. It rests
+   * entirely on the outer two fields being slash-free: a collection is an NSID and
+   * a cid is base32, so the first slash always ends the collection and the last
+   * always begins the cid. That leaves the rkey unambiguous no matter what it
+   * contains. This package validates none of that itself — the invariant is
+   * inherited from the lexicon's `nsid` and `record-key` string formats.
+   */
+  describe('formatSetHashElement', () => {
+    it('separates the three fields', () => {
+      expect(formatSetHashElement('c.a', '1', CID_A)).toBe(
+        `c.a/1/${CID_A.toString()}`,
+      )
+    })
+
+    it('stays unambiguous for an rkey containing a slash', () => {
+      // Not reachable through a validated write, but it shows the boundaries are
+      // fixed by the outer fields rather than by the rkey's shape.
+      const element = formatSetHashElement('c.a', 'b/1', CID_A)
+      expect(element.slice(0, element.indexOf('/'))).toBe('c.a')
+      expect(element.slice(element.lastIndexOf('/') + 1)).toBe(CID_A.toString())
+    })
+
+    it('distinguishes records that differ only in where the rkey starts', () => {
+      expect(formatSetHashElement('c.a', 'b/1', CID_A)).not.toBe(
+        formatSetHashElement('c.a', 'b/2', CID_A),
+      )
+      expect(new RepoCommit().add('c.a', 'b/1', CID_A).setHash).not.toEqual(
+        new RepoCommit().add('c.a', 'b/2', CID_A).setHash,
+      )
+    })
+  })
+
+  describe('encodeCommitCtx', () => {
+    const ikm = new Uint8Array(32).fill(7)
+
+    it('is length-prefixed and domain-separated', () => {
+      const encoded = encodeCommitCtx(ctx, ikm)
+      expect(Buffer.from(encoded.subarray(0, 16)).toString()).toBe(
+        'atproto-space-v1',
+      )
+      const spaceLen = (encoded[16] << 8) | encoded[17]
+      expect(spaceLen).toBe(ctx.space.length)
+    })
+
+    it('is unambiguous across field boundaries', () => {
+      // Without length prefixes these two would encode identically.
+      const a = encodeCommitCtx({ space: 'ab', author: 'c', rev: 'd' }, ikm)
+      const b = encodeCommitCtx({ space: 'a', author: 'bc', rev: 'd' }, ikm)
+      expect(a).not.toEqual(b)
+    })
+
+    it('is deterministic', () => {
+      expect(encodeCommitCtx(ctx, ikm)).toEqual(encodeCommitCtx(ctx, ikm))
+    })
+  })
+})

package/tests/sync.test.ts

@@ -0,0 +1,385 @@
+import { beforeAll, describe, expect, it } from 'vitest'
+import { encodeCarBlock, encodeCarHeader, readCarStream } from '@atproto/common'
+import { type Keypair, Secp256k1Keypair } from '@atproto/crypto'
+import { encode } from '@atproto/lex-cbor'
+import { type Cid, cidForCbor } from '@atproto/lex-data'
+import {
+  type CommitCtx,
+  RepoCommit,
+  RepoVerificationError,
+  type SerializedRecord,
+  type SignedCommit,
+  serializeRecord,
+  serializeRepo,
+  verifyCommit,
+  verifyRepoCar,
+  verifyRepoCarFull,
+} from '../src/index.js'
+
+const SPACE = 'at://did:example:space/space/app.bsky.group/test'
+const AUTHOR = 'did:example:alice'
+const REV = '3kbcq3p7ad400'
+
+const ctx: CommitCtx = { space: SPACE, author: AUTHOR, rev: REV }
+
+const collect = async (
+  stream: AsyncIterable<Uint8Array>,
+): Promise<Uint8Array> => {
+  const chunks: Uint8Array[] = []
+  for await (const chunk of stream) chunks.push(chunk)
+  return Buffer.concat(chunks)
+}
+
+describe('space sync', () => {
+  let keypair: Keypair
+  let records: SerializedRecord[]
+
+  beforeAll(async () => {
+    keypair = await Secp256k1Keypair.create()
+    records = await Promise.all([
+      serializeRecord('app.bsky.feed.post', '3kbcq3p7ad401', {
+        text: 'hello',
+      }),
+      serializeRecord('app.bsky.feed.post', '3kbcq3p7ad402', {
+        text: 'world',
+      }),
+      serializeRecord('app.bsky.feed.like', '3kbcq3p7ad403', {
+        subject: 'at://x',
+      }),
+    ])
+  })
+
+  const commitFor = (recs: SerializedRecord[]): Promise<SignedCommit> =>
+    RepoCommit.fromRecords(recs).sign(ctx, keypair)
+
+  const carFor = async (recs: SerializedRecord[]): Promise<Uint8Array> =>
+    collect(serializeRepo(await commitFor(recs), recs))
+
+  it('declares the commit and index as roots, in order', async () => {
+    const car = await carFor(records)
+    const { roots, blocks } = await readCarStream([car])
+    expect(roots).toHaveLength(2)
+
+    const seen: Cid[] = []
+    for await (const block of blocks) seen.push(block.cid)
+    // Two roots, then one block per record.
+    expect(seen).toHaveLength(2 + records.length)
+    expect(seen[0].equals(roots[0])).toBe(true)
+    expect(seen[1].equals(roots[1])).toBe(true)
+  })
+
+  it('round-trips through verification', async () => {
+    const car = await carFor(records)
+    const recovered = await verifyRepoCarFull([car], {
+      space: SPACE,
+      author: AUTHOR,
+      didKey: keypair.did(),
+    })
+
+    expect(recovered.commit.rev).toBe(REV)
+    expect(Object.keys(recovered.index)).toHaveLength(records.length)
+    expect(recovered.records).toHaveLength(records.length)
+    expect(recovered.repo.matches(recovered.commit)).toBe(true)
+
+    for (const original of records) {
+      const found = recovered.records.find(
+        (r) => r.collection === original.collection && r.rkey === original.rkey,
+      )
+      expect(found).toBeDefined()
+      expect(found!.cid.equals(original.cid)).toBe(true)
+    }
+  })
+
+  it('recovers record values intact', async () => {
+    const car = await carFor(records)
+    const { records: recovered } = await verifyRepoCarFull([car], {
+      space: SPACE,
+      author: AUTHOR,
+      didKey: keypair.did(),
+    })
+    const post = recovered.find((r) => r.rkey === '3kbcq3p7ad401')
+    expect(post?.record).toEqual({ text: 'hello' })
+  })
+
+  it('serializes an empty repo', async () => {
+    const car = await carFor([])
+    const recovered = await verifyRepoCarFull([car], {
+      space: SPACE,
+      author: AUTHOR,
+      didKey: keypair.did(),
+    })
+    expect(Object.keys(recovered.index)).toHaveLength(0)
+    expect(recovered.records).toHaveLength(0)
+    expect(recovered.repo.setHash.isEmpty()).toBe(true)
+  })
+
+  it('emits record blocks in the index order', async () => {
+    const car = await carFor(records)
+    const { index } = await verifyRepoCarFull([car], {
+      space: SPACE,
+      author: AUTHOR,
+      didKey: keypair.did(),
+    })
+    // Re-read the raw blocks and check they follow the index's declared order.
+    const { blocks } = await readCarStream([car])
+    const cids: Cid[] = []
+    for await (const block of blocks) cids.push(block.cid)
+    const recordCids = cids.slice(2).map((c) => c.toString())
+    const indexCids = Object.values(index).map((c) => c.toString())
+    expect(recordCids).toEqual(indexCids)
+  })
+
+  it('authenticates the index without reading records', async () => {
+    const car = await carFor(records)
+    // verifyRepoCar validates commit + index eagerly; records stay lazy.
+    const { index, repo, commit } = await verifyRepoCar([car], {
+      space: SPACE,
+      author: AUTHOR,
+      didKey: keypair.did(),
+    })
+    expect(repo.matches(commit)).toBe(true)
+    expect(Object.keys(index)).toHaveLength(records.length)
+  })
+
+  describe('rejects tampering', () => {
+    it('rejects a commit signed by another key', async () => {
+      const other = await Secp256k1Keypair.create()
+      const car = await carFor(records)
+      await expect(
+        verifyRepoCarFull([car], {
+          space: SPACE,
+          author: AUTHOR,
+          didKey: other.did(),
+        }),
+      ).rejects.toThrow(RepoVerificationError)
+    })
+
+    it('rejects a repo verified against the wrong space', async () => {
+      const car = await carFor(records)
+      await expect(
+        verifyRepoCarFull([car], {
+          space: 'at://did:example:space/space/app.bsky.group/other',
+          author: AUTHOR,
+          didKey: keypair.did(),
+        }),
+      ).rejects.toThrow(/commit failed verification/)
+    })
+
+    it('rejects a repo verified against the wrong author', async () => {
+      const car = await carFor(records)
+      await expect(
+        verifyRepoCarFull([car], {
+          space: SPACE,
+          author: 'did:example:bob',
+          didKey: keypair.did(),
+        }),
+      ).rejects.toThrow(/commit failed verification/)
+    })
+
+    it('rejects an index that disagrees with the commit hash', async () => {
+      // A commit over two records, but an index listing all three.
+      const commit = await commitFor(records.slice(0, 2))
+      const car = await collect(serializeRepo(commit, records))
+      await expect(
+        verifyRepoCarFull([car], {
+          space: SPACE,
+          author: AUTHOR,
+          didKey: keypair.did(),
+        }),
+      ).rejects.toThrow(/index does not match the commit hash/)
+    })
+
+    it('rejects a record block whose bytes do not match its cid', async () => {
+      const commit = await commitFor(records)
+      const index: Record<string, Cid> = {}
+      for (const r of records) {
+        index[`${r.collection}/${r.rkey}`] = r.cid
+      }
+      const commitBytes = encode(commit)
+      const indexBytes = encode(index)
+      const [commitCid, indexCid] = await Promise.all([
+        cidForCbor(commitBytes),
+        cidForCbor(indexBytes),
+      ])
+
+      const byPath = new Map(
+        records.map((r) => [`${r.collection}/${r.rkey}`, r]),
+      )
+      const parts = [
+        encodeCarHeader([commitCid, indexCid]),
+        encodeCarBlock({ cid: commitCid, bytes: commitBytes }),
+        encodeCarBlock({ cid: indexCid, bytes: indexBytes }),
+        ...Object.keys(index).map((path, i) => {
+          const record = byPath.get(path)!
+          // Swap in bytes that don't hash to the advertised cid.
+          const bytes = i === 0 ? encode({ text: 'tampered' }) : record.bytes
+          return encodeCarBlock({ cid: record.cid, bytes })
+        }),
+      ]
+
+      const { records: stream } = await verifyRepoCar([Buffer.concat(parts)], {
+        space: SPACE,
+        author: AUTHOR,
+        didKey: keypair.did(),
+      })
+      await expect(async () => {
+        for await (const _ of stream) {
+          // drain
+        }
+      }).rejects.toThrow(/not a valid cid for bytes/i)
+    })
+
+    it('rejects a CAR missing a record named in the index', async () => {
+      const commit = await commitFor(records)
+      // Serialize the full index but drop the last block.
+      const full = await collect(serializeRepo(commit, records))
+      const { blocks } = await readCarStream([full])
+      const kept: Uint8Array[] = []
+      const all = []
+      for await (const block of blocks) all.push(block)
+      for (const block of all.slice(0, -1)) kept.push(encodeCarBlock(block))
+
+      const { roots } = await readCarStream([full])
+      const truncated = Buffer.concat([encodeCarHeader(roots), ...kept])
+
+      const { records: stream } = await verifyRepoCar([truncated], {
+        space: SPACE,
+        author: AUTHOR,
+        didKey: keypair.did(),
+      })
+      await expect(async () => {
+        for await (const _ of stream) {
+          // drain
+        }
+      }).rejects.toThrow(/missing 1 record\(s\) named in the index/)
+    })
+  })
+
+  describe('repo index', () => {
+    it('folds into the same set hash as the records it describes', async () => {
+      const car = await carFor(records)
+      const { index, repo } = await verifyRepoCarFull([car], {
+        space: SPACE,
+        author: AUTHOR,
+        didKey: keypair.did(),
+      })
+      expect(
+        RepoCommit.fromIndex(index).setHash.equals(
+          RepoCommit.fromRecords(records).setHash,
+        ),
+      ).toBe(true)
+      expect(repo.setHash.equals(RepoCommit.fromRecords(records).setHash)).toBe(
+        true,
+      )
+    })
+
+    it('rejects an index whose values are not cids', async () => {
+      const commit = await commitFor(records)
+      const commitBytes = encode(commit)
+      const indexBytes = encode({ 'app.bsky.feed.post/1': 'not-a-cid' })
+      const [commitRoot, indexRoot] = await Promise.all([
+        cidForCbor(commitBytes),
+        cidForCbor(indexBytes),
+      ])
+      const car = Buffer.concat([
+        encodeCarHeader([commitRoot, indexRoot]),
+        encodeCarBlock({ cid: commitRoot, bytes: commitBytes }),
+        encodeCarBlock({ cid: indexRoot, bytes: indexBytes }),
+      ])
+
+      await expect(
+        verifyRepoCarFull([car], {
+          space: SPACE,
+          author: AUTHOR,
+          didKey: keypair.did(),
+        }),
+      ).rejects.toThrow(/invalid repo index/)
+    })
+  })
+
+  // A syncer advances its own copy over the oplog, then checks it against the
+  // repo's signed commit. A mismatch means it must fall back to full recovery.
+  describe('incremental sync', () => {
+    const createOps = (recs: SerializedRecord[]) =>
+      recs.map((r) => ({
+        collection: r.collection,
+        rkey: r.rkey,
+        cid: r.cid,
+        prev: null,
+      }))
+
+    it('catches up to a commit by replaying the oplog', async () => {
+      const commit = await commitFor(records)
+      const local = new RepoCommit().applyOps(createOps(records))
+
+      expect(await verifyCommit(commit, ctx, keypair.did())).toBe(true)
+      expect(local.matches(commit)).toBe(true)
+    })
+
+    it('detects divergence when an op was missed', async () => {
+      const commit = await commitFor(records)
+      const local = new RepoCommit().applyOps(createOps(records.slice(0, 2)))
+      expect(local.matches(commit)).toBe(false)
+    })
+
+    it('replays deletes and updates', () => {
+      const [a, b] = records
+      const local = RepoCommit.fromRecords([a]).applyOps([
+        { collection: a.collection, rkey: a.rkey, cid: b.cid, prev: a.cid },
+        { collection: a.collection, rkey: a.rkey, cid: null, prev: b.cid },
+      ])
+      expect(local.setHash.isEmpty()).toBe(true)
+    })
+  })
+
+  describe('CAR framing', () => {
+    // Bad framing surfaces from the CAR reader as a plain Error, as it does for
+    // public repos.
+    it('rejects a truncated CAR', async () => {
+      const car = await carFor(records)
+      await expect(
+        verifyRepoCar([car.subarray(0, 3)], {
+          space: SPACE,
+          author: AUTHOR,
+          didKey: keypair.did(),
+        }),
+      ).rejects.toThrow(/not enough data/)
+    })
+
+    it('rejects a CAR with the wrong root count', async () => {
+      const commit = await commitFor(records)
+      const commitBytes = encode({
+        ver: commit.ver,
+        hash: commit.hash,
+        ikm: commit.ikm,
+        sig: commit.sig,
+        mac: commit.mac,
+        rev: commit.rev,
+      })
+      const commitCid = await cidForCbor(commitBytes)
+      const car = Buffer.concat([
+        encodeCarHeader([commitCid]),
+        encodeCarBlock({ cid: commitCid, bytes: commitBytes }),
+      ])
+      await expect(
+        verifyRepoCar([car], {
+          space: SPACE,
+          author: AUTHOR,
+          didKey: keypair.did(),
+        }),
+      ).rejects.toThrow(/expected 2 car roots/)
+    })
+
+    it('reads a CAR delivered in arbitrary chunk boundaries', async () => {
+      const car = await carFor(records)
+      // One byte at a time — exercises the reader's buffering.
+      const chunks = Array.from(car, (byte) => new Uint8Array([byte]))
+      const recovered = await verifyRepoCarFull(chunks, {
+        space: SPACE,
+        author: AUTHOR,
+        didKey: keypair.did(),
+      })
+      expect(recovered.records).toHaveLength(records.length)
+    })
+  })
+})

package/tsconfig.build.json

@@ -0,0 +1,16 @@
+{
+  "extends": ["../../tsconfig/node.tsconfig.json"],
+  "include": ["./src"],
+  "exclude": ["**/*.test.ts"],
+  "references": [
+    { "path": "../common/tsconfig.build.json" },
+    { "path": "../crypto/tsconfig.build.json" },
+    { "path": "../lex/lex-cbor/tsconfig.build.json" },
+    { "path": "../lex/lex-data/tsconfig.build.json" },
+    { "path": "../oauth/jwk/tsconfig.build.json" },
+  ],
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist",
+  },
+}