agenticreplay 0.1.0 → 0.1.2

package/packages/core/src/writer.ts

@@ -1,467 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto';
-import type { FileHandle } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import { mkdir, open, writeFile } from 'node:fs/promises';
-import { arch, platform } from 'node:os';
-import { isAbsolute, join } from 'node:path';
-import type {
-  Actor,
-  AdapterInfo,
-  EventType,
-  Manifest,
-  Payload,
-  TraceEvent,
-  CaptureSummary,
-  CaptureTransformation,
-} from '@agenticreplay/schema';
-import {
-  INLINE_PAYLOAD_LIMIT,
-  RUN_ID_PATTERN,
-  SCHEMA_VERSION,
-  assertEvent,
-  assertManifest,
-} from '@agenticreplay/schema';
-import { BlobStore, sha256File } from './blobs.js';
-import { REDACTION_POLICY_VERSION, Redactor } from './redaction.js';
-
-const FILE_MODE = 0o600;
-const DIR_MODE = 0o700;
-
-/** Remove credential URL components while preserving the other serialized query bytes. */
-function scrubTransportUrl(value: string): { value: string; count: number } {
-  let count = 0;
-  const safe = value
-    .replace(/^(https?:\/\/)[^/?#]*@/i, (_match, scheme: string) => {
-      count += 1;
-      return scheme;
-    })
-    .replace(/([?&])([^=&#]+)=([^&#]*)/g, (match, separator: string, key: string) => {
-      let decoded: string;
-      try {
-        decoded = decodeURIComponent(key.replace(/\+/g, ' '));
-      } catch {
-        return match;
-      }
-      if (
-        !/^(?:api[-_]?key|key|access[-_]?token|token|authorization|password|secret|signature)$/i.test(
-          decoded,
-        )
-      )
-        return match;
-      count += 1;
-      return `${separator}${key}=%3Credacted%3E`;
-    });
-  return { value: safe, count };
-}
-
-/** Paths are operational metadata, not opaque credentials. Named secret rules still apply. */
-export function redactManifest(redactor: Redactor, manifest: Manifest): Manifest {
-  // `run_id` is a schema-controlled identifier, not user content. Preserve it
-  // outside the whole-manifest entropy pass: random valid IDs otherwise look
-  // like credentials and can make the manifest invalid before it is written.
-  const { cwd, argv, env_allowlisted, run_id, ...metadata } = manifest;
-  const scrubbed = JSON.parse(
-    redactor.redactString(JSON.stringify(metadata), 'manifest').value,
-  ) as Manifest;
-  scrubbed.run_id = run_id;
-  scrubbed.cwd = redactor.redactString(cwd, 'manifest.cwd', { entropy: false }).value;
-  scrubbed.argv = argv.map(
-    (arg, index) =>
-      redactor.redactString(arg, `manifest.argv.${index}`, {
-        entropy: !(isAbsolute(arg) && existsSync(arg)),
-      }).value,
-  );
-  if (env_allowlisted)
-    scrubbed.env_allowlisted = JSON.parse(
-      redactor.redactString(JSON.stringify(env_allowlisted), 'manifest.env').value,
-    ) as Record<string, string>;
-  return scrubbed;
-}
-
-export interface TraceWriterInit {
-  /** Defaults to a fresh `run_<12 hex>`. */
-  runId?: string;
-  adapter: AdapterInfo;
-  argv: string[];
-  cwd: string;
-  agenticreplayVersion: string;
-  envAllowlist?: string[];
-  /**
-   * Fork provenance (spec §1). Set on a run produced by forking another. The manifest is what
-   * every out-of-process reader sees first — `agenticreplay gc` deciding whether a run may be deleted, a
-   * third-party tool, the Python SDK — so recording this only as an event leaves those readers
-   * looking at an orphan.
-   */
-  parentRun?: string;
-  forkPoint?: number;
-  forkModel?: string;
-}
-
-/** The parts of an event a caller supplies; the writer stamps the rest. */
-export interface EventInit {
-  type: EventType;
-  actor: Actor;
-  turn?: number;
-  causes?: number[];
-  attrs?: Record<string, unknown>;
-  /** Trusted operational path fields in attrs. Named secret rules still apply. Never use for API bodies. */
-  operationalPathAttrs?: string[];
-  payload?: Payload;
-  /**
-   * When the event actually happened, for anything captured out of band.
-   *
-   * Shell and MCP frames are drained from disk after the agent exits, so stamping them at write
-   * time puts every one of them at the end of the run — `ts` and `mono_us` describing the drain
-   * rather than the event, which spec §2.1 makes authoritative for duration. Supplying the real
-   * moment is what lets them interleave with the model turns they happened between.
-   */
-  occurredAt?: Date;
-  transformations?: CaptureTransformation[];
-}
-
-/**
- * Append-only writer for one run (spec §2).
- *
- * Every event takes the same path to disk — spill, redact, validate, append — because a redactor
- * that can be bypassed by one caller is not a redactor. Serialized bytes are scrubbed rather than
- * individual fields, so a secret hiding in a key, a nested string, or an attrs value is caught
- * regardless of shape.
- */
-export class TraceWriter {
-  readonly #runDir: string;
-  readonly #runId: string;
-  readonly #eventsPath: string;
-  readonly #blobs: BlobStore;
-  readonly #redactor: Redactor;
-  readonly #handle: FileHandle;
-  readonly #base: Manifest;
-  readonly #started = process.hrtime.bigint();
-  readonly #startedAtMs = Date.now();
-  #seq = 0;
-  /** Whether run.start reached disk, so run.end can tell an open run from an unopened one. */
-  #opened = false;
-  #closedEvent = false;
-  #turn = 0;
-  #git: Manifest['git'];
-  #tail: Promise<unknown> = Promise.resolve();
-  #sealed: Manifest | undefined;
-  #capture: CaptureSummary | undefined;
-  readonly #captureIssues = new Set<string>();
-
-  private constructor(
-    runId: string,
-    runDir: string,
-    base: Manifest,
-    redactor: Redactor,
-    handle: FileHandle,
-  ) {
-    this.#runId = runId;
-    this.#runDir = runDir;
-    this.#eventsPath = join(runDir, 'events.jsonl');
-    this.#blobs = new BlobStore(join(runDir, 'blobs'));
-    this.#redactor = redactor;
-    this.#handle = handle;
-    this.#base = base;
-  }
-
-  static async create(runsDir: string, init: TraceWriterInit): Promise<TraceWriter> {
-    const runId = init.runId ?? `run_${randomBytes(6).toString('hex')}`;
-    if (!RUN_ID_PATTERN.test(runId))
-      throw new Error(`not a valid run id: ${JSON.stringify(runId)}`);
-    const runDir = join(runsDir, runId);
-    await mkdir(runDir, { recursive: true, mode: DIR_MODE });
-
-    // One redactor for the whole run: the salt stays constant, so a secret seen in the environment
-    // and again in a payload gets the same placeholder, and every removal lands in redactions.json.
-    const redactor = new Redactor(
-      init.envAllowlist === undefined ? {} : { envAllowlist: init.envAllowlist },
-    );
-    const unredactedBase: Manifest = {
-      schema_version: SCHEMA_VERSION,
-      run_id: runId,
-      created_at: new Date().toISOString(),
-      agenticreplay_version: init.agenticreplayVersion,
-      adapter: init.adapter,
-      argv: init.argv,
-      cwd: init.cwd,
-      env_allowlisted: redactor.redactEnv(process.env),
-      platform: { os: platform(), arch: arch(), node: process.version },
-      // Spread conditionally: the schema forbids unknown keys and a plain recording must carry no
-      // provenance at all, rather than three nulls that readers would have to special-case.
-      ...(init.parentRun === undefined ? {} : { parent_run: init.parentRun }),
-      ...(init.forkPoint === undefined ? {} : { fork_point: init.forkPoint }),
-      ...(init.forkModel === undefined ? {} : { fork_model: init.forkModel }),
-      capture: { status: 'unverified', issues: [] },
-    };
-    const base = redactManifest(redactor, unredactedBase);
-    assertManifest(base);
-    await writeFile(join(runDir, 'manifest.json'), `${JSON.stringify(base, null, 2)}\n`, {
-      mode: FILE_MODE,
-    });
-
-    const handle = await open(join(runDir, 'events.jsonl'), 'a', FILE_MODE);
-    return new TraceWriter(runId, runDir, base, redactor, handle);
-  }
-
-  /**
-   * Record the repository state the run started from (spec §1).
-   *
-   * A setter rather than a constructor argument because the honest answer needs the run directory
-   * to exist: the dirty check has to exclude agenticreplay's own files, or every run in a clean checkout
-   * reports dirty. So the caller reads it once the capture layer is up and hands it back, and it
-   * lands in the manifest at close alongside the counts.
-   */
-  setGit(info: Manifest['git']): void {
-    this.#git = info;
-  }
-
-  get runDir(): string {
-    return this.#runDir;
-  }
-
-  get runId(): string {
-    return this.#runId;
-  }
-
-  /** The seq the next event will be given, which is also the number written so far. */
-  get seq(): number {
-    return this.#seq;
-  }
-
-  /** Capture state is independent of the recorded child's exit status. Failures are sticky. */
-  setCaptureSummary(summary: CaptureSummary): void {
-    for (const issue of summary.issues) this.#captureIssues.add(issue);
-    this.#capture = { ...summary, issues: [...this.#captureIssues] };
-  }
-
-  markCaptureIncomplete(reason: string): void {
-    this.#captureIssues.add(reason);
-    this.#capture = { ...this.#capture, status: 'incomplete', issues: [...this.#captureIssues] };
-  }
-
-  async append(init: EventInit): Promise<TraceEvent> {
-    if (this.#sealed) throw new Error(`run ${this.#runId} is closed`);
-    // SPEC §2.3: `run.start` AND `run.end` BRACKET THE RUN, EXACTLY ONE OF EACH.
-    //
-    // Nothing enforced that here, and three commands got it wrong in three different ways —
-    // `record --mcp-config` put a note at seq 0, `attach` wrote neither event, and a fork opened
-    // on `fork`. All three produced traces that look fine to `agenticreplay show`, `agenticreplay replay` and the
-    // viewer, and that no gateway will take:
-    //
-    //   invalid trace: run.start at seq 1, must be seq 0
-    //   invalid trace: 0 run.start and 1 run.end events (exactly one of each)
-    //
-    // The cost of finding out late is the whole recording: the user learns at `agenticreplay push`, after
-    // the agent session is over, that there is nothing to push. Refusing the write is the only
-    // point where the mistake is still cheap — it fails in the developer's own test run, at the
-    // line that wrote the wrong event, rather than in someone else's terminal a week later.
-    // Only the three a fragment cannot reach innocently. "seq 0 must BE run.start" would be the
-    // stronger rule and is wrong here: this writer is also how fixtures and conformance vectors
-    // are built, and a deliberate fragment is allowed to hold a few events and no bracket at all.
-    // These three are violations however the trace is meant to be used.
-    if (init.type === 'run.start' && this.#seq !== 0) {
-      throw new Error(
-        `run.start belongs at seq 0 (spec §2.3); run ${this.#runId} tried to write it at seq ` +
-          `${this.#seq}, behind ${this.#opened ? 'a run.start that is already there' : 'events that were written first'}. ` +
-          'Append it before any capture layer can write.',
-      );
-    }
-    if (init.type === 'run.end' && !this.#opened) {
-      throw new Error(
-        `run ${this.#runId} has no run.start to close: the spec brackets a run with exactly one ` +
-          'of each (spec §2.3), and a gateway refuses the push — "0 run.start and 1 run.end ' +
-          'events". Append run.start as the run opens.',
-      );
-    }
-    if (init.type === 'run.end' && this.#closedEvent) {
-      throw new Error(`run ${this.#runId} already has a run.end; the spec allows exactly one`);
-    }
-    // Clocks are read at call time so they describe the event, not the queue drain; seq is
-    // assigned inside the queue so a rejected event leaves no hole in the dense order.
-    const when = init.occurredAt ?? new Date();
-    const ts = when.toISOString();
-    // Monotonic for events stamped now; derived from the wall clock for one that happened earlier,
-    // since there is no hrtime reading to recover. Clamped at zero rather than going negative for a
-    // frame whose clock ran slightly behind the run's start.
-    const mono_us = init.occurredAt
-      ? Math.max(0, (when.getTime() - this.#startedAtMs) * 1000)
-      : Number((process.hrtime.bigint() - this.#started) / 1000n);
-    const turn = init.turn ?? this.#turn;
-    this.#turn = turn;
-    const written = this.#tail.then(() => this.#write(ts, mono_us, turn, init));
-    this.#tail = written.catch(() => {
-      this.markCaptureIncomplete('event_write_failed');
-    });
-    return written;
-  }
-
-  async close(exitCode?: number): Promise<Manifest> {
-    if (this.#sealed) return this.#sealed;
-    await this.#tail;
-    await this.#handle.sync();
-    await this.#handle.close();
-
-    const blobs = await this.#blobs.count();
-    const rawManifest: Manifest = {
-      ...this.#base,
-      ended_at: new Date().toISOString(),
-      counts: { events: this.#seq, blobs },
-      redaction: {
-        policy_version: REDACTION_POLICY_VERSION,
-        rules_fired: this.#redactor.rulesFired(),
-      },
-      integrity: { events_sha256: await sha256File(this.#eventsPath), blob_count: blobs },
-      // Conditional for the same reason the fork keys are: the schema forbids unknown keys, and a
-      // run outside a repository should carry no git block rather than three empty fields.
-      ...(this.#git === undefined || Object.keys(this.#git).length === 0 ? {} : { git: this.#git }),
-      ...(this.#capture === undefined
-        ? {}
-        : {
-            capture: {
-              ...this.#capture,
-              ...(this.#captureIssues.size > 0 ? { status: 'incomplete' as const } : {}),
-              issues: [...this.#captureIssues],
-            },
-          }),
-    };
-    if (exitCode !== undefined) rawManifest.exit_code = exitCode;
-    const manifest = redactManifest(this.#redactor, rawManifest);
-    assertManifest(manifest);
-
-    const redactions = {
-      policy_version: REDACTION_POLICY_VERSION,
-      records: this.#redactor.records(),
-    };
-    await writeFile(
-      join(this.#runDir, 'redactions.json'),
-      `${JSON.stringify(redactions, null, 2)}\n`,
-      {
-        mode: FILE_MODE,
-      },
-    );
-    await writeFile(join(this.#runDir, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`, {
-      mode: FILE_MODE,
-    });
-    this.#sealed = manifest;
-    return manifest;
-  }
-
-  async #write(ts: string, mono_us: number, turn: number, init: EventInit): Promise<TraceEvent> {
-    const seq = this.#seq;
-    const removed: string[] = [];
-    const transformations: CaptureTransformation[] = [...(init.transformations ?? [])];
-    let payload = init.payload;
-    let bodyEvidence: { body_bytes: number; body_sha256: string } | undefined;
-    if (payload !== undefined) {
-      const json = JSON.stringify(payload);
-      const scrubbed = this.#redactor.redactString(json, `event:${seq}:payload`);
-      removed.push(...scrubbed.hits.map((h) => h.identifier));
-      transformations.push(
-        ...scrubbed.hits.map((h) => ({
-          kind: 'redaction' as const,
-          location: 'payload',
-          rule: h.rule,
-          count: h.count,
-          reason: 'secret redaction policy',
-        })),
-      );
-      if (
-        (init.type === 'net.request' || init.type === 'net.response') &&
-        typeof payload === 'string'
-      ) {
-        const body = JSON.parse(scrubbed.value) as string;
-        bodyEvidence = {
-          body_bytes: Buffer.byteLength(body),
-          body_sha256: createHash('sha256').update(body).digest('hex'),
-        };
-        transformations.push({
-          kind: 'encoding',
-          location: 'storage',
-          rule: 'json_string',
-          count: 1,
-          reason:
-            'UTF-8 body stored as a JSON string; decode the JSON wrapper to download body bytes',
-        });
-      }
-      if (Buffer.byteLength(scrubbed.value) > INLINE_PAYLOAD_LIMIT) {
-        payload = await this.#blobs.put(scrubbed.value, 'application/json');
-      } else payload = JSON.parse(scrubbed.value) as Payload;
-    }
-
-    const event: TraceEvent = { seq, ts, mono_us, turn, type: init.type, actor: init.actor };
-    if (init.causes !== undefined) event.causes = init.causes;
-    if (init.attrs !== undefined) event.attrs = { ...init.attrs };
-    if (event.type === 'net.request' || event.type === 'net.response') {
-      for (const key of ['url', 'path', 'upstream', 'destination']) {
-        const value = event.attrs?.[key];
-        if (typeof value !== 'string') continue;
-        const scrubbed = scrubTransportUrl(value);
-        if (scrubbed.count === 0) continue;
-        event.attrs![key] = scrubbed.value;
-        transformations.push({
-          kind: 'url_scrubbed',
-          location: `attrs.${key}`,
-          rule: 'url_credentials',
-          count: scrubbed.count,
-          reason: 'URL userinfo and sensitive query values excluded',
-        });
-      }
-    }
-    const operationalPaths: Record<string, string> = {};
-    for (const key of init.operationalPathAttrs ?? []) {
-      const value = event.attrs?.[key];
-      if (typeof value !== 'string' || !isAbsolute(value)) continue;
-      const path = this.#redactor.redactString(value, `event:${seq}:attrs.${key}`, {
-        entropy: false,
-      });
-      operationalPaths[key] = path.value;
-      delete event.attrs![key];
-      removed.push(...path.hits.map((h) => h.identifier));
-      transformations.push(
-        ...path.hits.map((h) => ({
-          kind: 'redaction' as const,
-          location: `attrs.${key}`,
-          rule: h.rule,
-          count: h.count,
-          reason: 'secret redaction policy for operational paths',
-        })),
-      );
-    }
-
-    // Placeholders contain no quote or backslash, so scrubbing the serialized line cannot make it
-    // unparseable — and if it ever did, the parse throws and the event is never written.
-    const scrubbed = this.#redactor.redactString(JSON.stringify(event), `event:${seq}`);
-    removed.push(...scrubbed.hits.map((h) => h.identifier));
-    transformations.push(
-      ...scrubbed.hits.map((h) => ({
-        kind: 'redaction' as const,
-        location: 'envelope',
-        rule: h.rule,
-        count: h.count,
-        reason: 'secret redaction policy',
-      })),
-    );
-    const out = JSON.parse(scrubbed.value) as TraceEvent;
-    if (Object.keys(operationalPaths).length) out.attrs = { ...out.attrs, ...operationalPaths };
-    // The complete payload was already scanned above. Scanning it again as part of the envelope
-    // doubles work and can apply a different policy to inline and spilled bodies.
-    if (payload !== undefined) out.payload = payload;
-    if (bodyEvidence) out.attrs = { ...out.attrs, ...bodyEvidence };
-    if (removed.length > 0) out.redacted = [...new Set(removed)];
-    if (transformations.length > 0) {
-      // A caller may supply transport annotations; scrub those too before persistence.
-      out.transformations = JSON.parse(
-        this.#redactor.redactString(JSON.stringify(transformations), `event:${seq}:transformations`)
-          .value,
-      ) as CaptureTransformation[];
-    }
-
-    assertEvent(out);
-    await this.#handle.write(`${JSON.stringify(out)}\n`);
-    // Set after the write, not before it: a bracket that failed to reach disk is not one.
-    if (out.type === 'run.start') this.#opened = true;
-    if (out.type === 'run.end') this.#closedEvent = true;
-    this.#seq = seq + 1;
-    return out;
-  }
-}

package/packages/core/test/blobs.test.ts

@@ -1,170 +0,0 @@
-import { mkdtemp, readdir, rm, stat } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { validateEvent } from '@agenticreplay/schema';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { BlobStore } from '../src/blobs.js';
-
-let dir: string;
-let store: BlobStore;
-
-beforeEach(async () => {
-  dir = await mkdtemp(join(tmpdir(), 'agenticreplay-blobs-'));
-  store = new BlobStore(join(dir, 'blobs'));
-});
-
-afterEach(async () => {
-  await rm(dir, { recursive: true, force: true });
-});
-
-/** Every file under the blob root, relative to it. */
-async function allFiles(root: string): Promise<string[]> {
-  const out: string[] = [];
-  const shards = await readdir(root, { withFileTypes: true }).catch(() => []);
-  for (const shard of shards) {
-    if (!shard.isDirectory()) continue;
-    for (const f of await readdir(join(root, shard.name))) out.push(`${shard.name}/${f}`);
-  }
-  return out.sort();
-}
-
-describe('BlobStore.put', () => {
-  it('returns a spec-shaped ref with the sha256 of the content', async () => {
-    const ref = await store.put('hello');
-    // sha256('hello')
-    expect(ref.$blob).toBe(
-      'sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
-    );
-    expect(ref.bytes).toBe(5);
-    expect(ref.media_type).toBeUndefined();
-  });
-
-  it('produces a ref the event schema accepts as a payload', async () => {
-    const ref = await store.put('hello', 'text/plain');
-    const r = validateEvent({
-      seq: 0,
-      ts: '2026-08-29T10:00:00.000Z',
-      mono_us: 0,
-      turn: 0,
-      type: 'note',
-      actor: 'agenticreplay',
-      payload: ref,
-    });
-    expect(r.valid, r.errors.join(',')).toBe(true);
-  });
-
-  it('shards by the first two hex chars of the digest (spec §2.2)', async () => {
-    const ref = await store.put('hello');
-    const hex = ref.$blob.slice('sha256:'.length);
-    const files = await allFiles(join(dir, 'blobs'));
-    expect(files).toEqual([`${hex.slice(0, 2)}/${hex}`]);
-  });
-
-  it('stores identical content once — this is what keeps a trace O(n), not O(n²)', async () => {
-    const a = await store.put('the whole conversation, resent every turn');
-    const b = await store.put('the whole conversation, resent every turn');
-    expect(b.$blob).toBe(a.$blob);
-    expect(await store.count()).toBe(1);
-    expect(await allFiles(join(dir, 'blobs'))).toHaveLength(1);
-  });
-
-  it('does not rewrite a blob that already exists', async () => {
-    const ref = await store.put('immutable');
-    const hex = ref.$blob.slice('sha256:'.length);
-    const path = join(dir, 'blobs', hex.slice(0, 2), hex);
-    const before = await stat(path);
-    await new Promise((r) => setTimeout(r, 12));
-    await store.put('immutable');
-    expect((await stat(path)).mtimeMs).toBe(before.mtimeMs);
-  });
-
-  it('keeps distinct content in distinct files', async () => {
-    const a = await store.put('one');
-    const b = await store.put('two');
-    expect(a.$blob).not.toBe(b.$blob);
-    expect(await store.count()).toBe(2);
-  });
-
-  it('counts bytes, not characters, for multi-byte strings', async () => {
-    const ref = await store.put('héllo 🐳');
-    expect(ref.bytes).toBe(Buffer.byteLength('héllo 🐳', 'utf8'));
-  });
-
-  it('records the media type when given', async () => {
-    const ref = await store.put(new Uint8Array([1, 2, 3]), 'application/octet-stream');
-    expect(ref.media_type).toBe('application/octet-stream');
-    expect(ref.bytes).toBe(3);
-  });
-
-  // POSIX only. Windows has no mode bits: `chmod 0o600` is a no-op on NTFS and `stat` answers
-  // 0o666 whatever was asked for, so this asserts something the platform cannot provide. Skipped
-  // rather than loosened — the guarantee is real where it can be made, and a test that accepted
-  // 0o666 would stop noticing if it were lost on Linux too.
-  it.skipIf(process.platform === 'win32')(
-    'writes blobs unreadable by other users — a trace is sensitive material',
-    async () => {
-      const ref = await store.put('secret-ish');
-      const hex = ref.$blob.slice('sha256:'.length);
-      const s = await stat(join(dir, 'blobs', hex.slice(0, 2), hex));
-      expect(s.mode & 0o777).toBe(0o600);
-    },
-  );
-
-  it('stores an empty blob', async () => {
-    const ref = await store.put('');
-    expect(ref.bytes).toBe(0);
-    expect(await store.count()).toBe(1);
-    expect(await store.get(ref)).toEqual(new Uint8Array());
-  });
-});
-
-describe('BlobStore.get', () => {
-  it('round-trips binary content exactly', async () => {
-    const data = new Uint8Array([0, 1, 254, 255, 10, 13]);
-    const ref = await store.put(data);
-    expect(await store.get(ref)).toEqual(data);
-  });
-
-  it('round-trips utf-8 text', async () => {
-    const ref = await store.put('héllo 🐳');
-    expect(Buffer.from(await store.get(ref)).toString('utf8')).toBe('héllo 🐳');
-  });
-
-  it('accepts a prefixed digest string as well as a ref', async () => {
-    const ref = await store.put('by digest');
-    expect(await store.get(ref.$blob)).toEqual(await store.get(ref));
-  });
-
-  it('accepts a bare hex digest', async () => {
-    const ref = await store.put('bare hex');
-    expect(await store.get(ref.$blob.slice('sha256:'.length))).toEqual(await store.get(ref));
-  });
-
-  it('throws an error naming the digest when the blob is missing', async () => {
-    const missing = `sha256:${'a'.repeat(64)}`;
-    await expect(store.get(missing)).rejects.toThrow(/a{64}/);
-  });
-
-  it('rejects a malformed digest rather than reading an arbitrary path', async () => {
-    await expect(store.get('sha256:../../etc/passwd')).rejects.toThrow(/digest/i);
-  });
-});
-
-describe('BlobStore.has / count', () => {
-  it('reports presence by digest, with or without the prefix', async () => {
-    const ref = await store.put('present');
-    expect(await store.has(ref.$blob)).toBe(true);
-    expect(await store.has(ref.$blob.slice('sha256:'.length))).toBe(true);
-    expect(await store.has(`sha256:${'b'.repeat(64)}`)).toBe(false);
-  });
-
-  it('counts zero for a store that has never been written to', async () => {
-    expect(await store.count()).toBe(0);
-    expect(await store.has(`sha256:${'c'.repeat(64)}`)).toBe(false);
-  });
-
-  it('counts blobs across shards', async () => {
-    for (let i = 0; i < 25; i++) await store.put(`content ${i}`);
-    expect(await store.count()).toBe(25);
-  });
-});