@oxy.so/protocol 1.2.2 → 1.3.1

package/dist/esm/secp256k1.js

@@ -6,14 +6,14 @@
  * RFC 6979 deterministic ECDSA signatures encoded as DER, and the 32-byte
  * ECDH x-coordinate. Callers never receive a library-specific key object.
  */
-import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { secp256k1 } from '@noble/curves/secp256k1.js';
 const HEX = /^[0-9a-fA-F]+$/;
 const COMPRESSED_PUBLIC_KEY = /^(02|03)[0-9a-fA-F]{64}$/;
 const UNCOMPRESSED_PUBLIC_KEY = /^04[0-9a-fA-F]{128}$/;
 function bytesToHex(bytes) {
-    let result = "";
+    let result = '';
     for (const byte of bytes) {
-        result += byte.toString(16).padStart(2, "0");
+        result += byte.toString(16).padStart(2, '0');
     }
     return result;
 }
@@ -32,16 +32,16 @@ function hexToBytes(value, label) {
  * The scalar must be within the secp256k1 order; zero and overflow are rejected.
  */
 export function normalizeSecp256k1PrivateKey(privateKeyHex) {
-    if (typeof privateKeyHex !== "string" ||
+    if (typeof privateKeyHex !== 'string' ||
         privateKeyHex.length === 0 ||
         privateKeyHex.length > 64 ||
         !HEX.test(privateKeyHex)) {
-        throw new Error("secp256k1 private key must contain 1 to 64 hexadecimal characters");
+        throw new Error('secp256k1 private key must contain 1 to 64 hexadecimal characters');
     }
-    const normalized = privateKeyHex.toLowerCase().padStart(64, "0");
-    const privateKey = hexToBytes(normalized, "secp256k1 private key");
+    const normalized = privateKeyHex.toLowerCase().padStart(64, '0');
+    const privateKey = hexToBytes(normalized, 'secp256k1 private key');
     if (!secp256k1.utils.isValidSecretKey(privateKey)) {
-        throw new Error("secp256k1 private key is outside the valid scalar range");
+        throw new Error('secp256k1 private key is outside the valid scalar range');
     }
     return normalized;
 }
@@ -56,24 +56,23 @@ export function isValidSecp256k1PrivateKey(privateKeyHex) {
     }
 }
 function parsePrivateKey(privateKeyHex) {
-    return hexToBytes(normalizeSecp256k1PrivateKey(privateKeyHex), "secp256k1 private key");
+    return hexToBytes(normalizeSecp256k1PrivateKey(privateKeyHex), 'secp256k1 private key');
 }
 function parsePublicKey(publicKeyHex) {
-    if (typeof publicKeyHex !== "string" ||
-        (!COMPRESSED_PUBLIC_KEY.test(publicKeyHex) &&
-            !UNCOMPRESSED_PUBLIC_KEY.test(publicKeyHex))) {
-        throw new Error("secp256k1 public key must be a compressed or uncompressed SEC1 hex key");
+    if (typeof publicKeyHex !== 'string' ||
+        (!COMPRESSED_PUBLIC_KEY.test(publicKeyHex) && !UNCOMPRESSED_PUBLIC_KEY.test(publicKeyHex))) {
+        throw new Error('secp256k1 public key must be a compressed or uncompressed SEC1 hex key');
     }
-    const publicKey = hexToBytes(publicKeyHex, "secp256k1 public key");
+    const publicKey = hexToBytes(publicKeyHex, 'secp256k1 public key');
     // Parsing validates the SEC1 prefix, coordinate range, and curve equation.
     secp256k1.Point.fromBytes(publicKey);
     return publicKey;
 }
 function parseDigest(digestHex) {
-    if (typeof digestHex !== "string" || digestHex.length !== 64) {
-        throw new Error("secp256k1 digest must be exactly 32 bytes of hexadecimal data");
+    if (typeof digestHex !== 'string' || digestHex.length !== 64) {
+        throw new Error('secp256k1 digest must be exactly 32 bytes of hexadecimal data');
     }
-    return hexToBytes(digestHex, "secp256k1 digest");
+    return hexToBytes(digestHex, 'secp256k1 digest');
 }
 /** True for a valid compressed or uncompressed SEC1 secp256k1 public key. */
 export function isValidSecp256k1PublicKey(publicKeyHex) {
@@ -113,17 +112,17 @@ export function signSecp256k1Digest(privateKeyHex, digestHex, options = {}) {
     const signature = secp256k1.sign(parseDigest(digestHex), parsePrivateKey(privateKeyHex), {
         lowS: options.lowS ?? false,
     });
-    return signature.toHex("der");
+    return signature.toHex('der');
 }
 /** Verify a DER-encoded ECDSA signature, accepting historical high-S signatures. */
 export function verifySecp256k1Digest(publicKeyHex, digestHex, signatureDerHex) {
     const publicKey = parsePublicKey(publicKeyHex);
     const digest = parseDigest(digestHex);
-    const signature = hexToBytes(signatureDerHex, "secp256k1 DER signature");
+    const signature = hexToBytes(signatureDerHex, 'secp256k1 DER signature');
     // Parse once up front so malformed or non-DER input is rejected explicitly.
-    secp256k1.Signature.fromBytes(signature, "der");
+    secp256k1.Signature.fromBytes(signature, 'der');
     return secp256k1.verify(signature, digest, publicKey, {
-        format: "der",
+        format: 'der',
         lowS: false,
     });
 }
@@ -137,24 +136,24 @@ export function verifySecp256k1Digest(publicKeyHex, digestHex, signatureDerHex)
 export function tweakAddSecp256k1PrivateKey(privateKeyHex, tweakHex) {
     const n = secp256k1.Point.Fn.ORDER;
     const key = BigInt(`0x${normalizeSecp256k1PrivateKey(privateKeyHex)}`);
-    if (typeof tweakHex !== "string" || tweakHex.length !== 64 || !HEX.test(tweakHex)) {
-        throw new Error("secp256k1 tweak must be exactly 32 bytes of hexadecimal data");
+    if (typeof tweakHex !== 'string' || tweakHex.length !== 64 || !HEX.test(tweakHex)) {
+        throw new Error('secp256k1 tweak must be exactly 32 bytes of hexadecimal data');
     }
     const tweak = BigInt(`0x${tweakHex}`);
     if (tweak >= n) {
-        throw new Error("secp256k1 tweak is not below the curve order");
+        throw new Error('secp256k1 tweak is not below the curve order');
     }
     const child = (key + tweak) % n;
     if (child === 0n) {
-        throw new Error("secp256k1 tweaked private key is zero");
+        throw new Error('secp256k1 tweaked private key is zero');
     }
-    return child.toString(16).padStart(64, "0");
+    return child.toString(16).padStart(64, '0');
 }
 /** Derive the fixed-width 32-byte ECDH x-coordinate shared secret. */
 export function deriveSecp256k1SharedSecret(privateKeyHex, publicKeyHex) {
     const encodedPoint = secp256k1.getSharedSecret(parsePrivateKey(privateKeyHex), parsePublicKey(publicKeyHex), true);
     if (encodedPoint.length !== 33) {
-        throw new Error("secp256k1 ECDH returned an unexpected point encoding");
+        throw new Error('secp256k1 ECDH returned an unexpected point encoding');
     }
     return encodedPoint.slice(1);
 }

package/dist/esm/sign.js

@@ -0,0 +1,10 @@
+/**
+ * `@oxy.so/protocol/sign` — message and envelope signatures (secp256k1).
+ *
+ * The same functions the root entry exports, on their own entry so a client
+ * can load the signer (and `@noble/curves` under it) where it signs — inside
+ * `@oxy.so/core/crypto`, which apps load on first use — while the root entry
+ * it imports at startup for hashing and platform loaders stays free of the
+ * curve library once a bundler drops the root's unused re-exports.
+ */
+export { signEnvelope, signMessage, verifyEnvelopeSignature, verifySignature, } from './envelope/sign.js';

package/dist/types/chain/engine.d.ts

@@ -9,7 +9,7 @@
  * engine owns the verification + ordering policy.
  *
  * Storage and identity are both injected, so the engine has zero knowledge of
- * Mongo/SQLite, Oxy DIDs, or any app's lexicon — exactly what makes it reusable.
+ * the database, Oxy DIDs, or any app's lexicon — exactly what makes it reusable.
  */
 import type { SignedRecordEnvelope } from '@oxy.so/contracts';
 import type { VerificationMethodResolver } from '../identity/resolver';

package/dist/types/chain/recordStore.d.ts

@@ -4,8 +4,8 @@
  * The engine ({@link ./verify}, {@link ./engine}) is storage-agnostic: it owns
  * the verification state machine and continuity logic, and delegates EVERY read
  * and write to an injected {@link RecordStore}. An app supplies a store over its
- * own backend (oxy-api over Mongo `SignedRecord`/`RepoHead`, a node over SQLite,
- * Mention over its own Mongo) without the engine knowing anything Oxy- or
+ * own backend (oxy-api over Postgres `signed_records`/`repo_heads`, a node over
+ * SQLite, Mention over its own database) without the engine knowing anything Oxy- or
  * app-specific.
  *
  * All methods are **subject-keyed**: `subject` is the chain's subject DID
@@ -17,7 +17,7 @@
  * `append` MUST be atomic (record insert + head advance in one unit) and MUST
  * translate a duplicate-key collision on the unique `(subject, seq)` /
  * `recordId` index — i.e. a concurrent writer that already took this `seq` — into
- * `{ ok: false, reason: 'chain_conflict' }` (Mongo E11000 / SQLite
+ * `{ ok: false, reason: 'chain_conflict' }` (Postgres `23505` / SQLite
  * `SQLITE_CONSTRAINT`). That is the real multi-writer race guard; the engine's
  * pre-append continuity check is only the fast-path rejection.
  */

package/dist/types/chain/verify.d.ts

@@ -10,7 +10,8 @@
  *  - the {@link RecordStore} owns the monotonicity frontier + the chain head.
  *
  * The ordered checks (first failure wins):
- *  1. **shape** — the base `signedRecordEnvelopeSchema` (open `type`, opaque
+ *  1. **shape** — the base `signedRecordEnvelopeCheck`, the Zod-free twin of
+ *     `signedRecordEnvelopeSchema` (open `type`, opaque
  *     `record`). An app re-narrows `type` to its own set in its adapter.
  *  2. **signature** — `verifyEnvelopeSignature` recomputes the canonical signing
  *     input and checks the secp256k1 signature against the embedded `publicKey`.
@@ -24,7 +25,7 @@
  * subject?") is intentionally NOT here — it is an adapter-policy decision the
  * caller makes before invoking the engine, not a property of the envelope.
  */
-import { type SignedRecordEnvelope } from '@oxy.so/contracts';
+import type { SignedRecordEnvelope } from '@oxy.so/contracts';
 import { type VerificationMethodResolver } from '../identity/resolver';
 import type { RecordStore } from './recordStore';
 import type { VerifyOutcome } from './types';

package/dist/types/sign.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `@oxy.so/protocol/sign` — message and envelope signatures (secp256k1).
+ *
+ * The same functions the root entry exports, on their own entry so a client
+ * can load the signer (and `@noble/curves` under it) where it signs — inside
+ * `@oxy.so/core/crypto`, which apps load on first use — while the root entry
+ * it imports at startup for hashing and platform loaders stays free of the
+ * curve library once a bundler drops the root's unused re-exports.
+ */
+export { signEnvelope, signMessage, verifyEnvelopeSignature, verifySignature, } from './envelope/sign';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/protocol",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "description": "Oxy Protocol — the app-agnostic base substrate: signed-record envelope, canonical JSON, signature/verification, and platform crypto. Reused by any Oxy app to decentralize its own content.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -15,6 +15,9 @@
       ],
       "random": [
         "dist/types/random.d.ts"
+      ],
+      "sign": [
+        "dist/types/sign.d.ts"
       ]
     }
   },
@@ -71,6 +74,18 @@
       },
       "default": "./dist/esm/random.js"
     },
+    "./sign": {
+      "react-native": "./dist/esm/sign.js",
+      "import": {
+        "types": "./dist/types/sign.d.ts",
+        "default": "./dist/esm/sign.js"
+      },
+      "require": {
+        "types": "./dist/types/sign.d.ts",
+        "default": "./dist/cjs/sign.js"
+      },
+      "default": "./dist/esm/sign.js"
+    },
     "./package.json": "./package.json"
   },
   "react-native": {
@@ -82,6 +97,7 @@
   "files": [
     "NOTICE",
     "dist",
+    "!dist/**/*.tsbuildinfo",
     "src"
   ],
   "keywords": [
@@ -94,7 +110,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/oxyhq/sdk",
+    "url": "git+https://github.com/OxyHQ/oxy.git",
     "directory": "packages/protocol"
   },
   "author": "OxyHQ",
@@ -112,26 +128,11 @@
     "typescript": "tsc --noEmit",
     "test": "jest --passWithNoTests",
     "lint": "biome lint --error-on-warnings ./src",
-    "prepublishOnly": "node ../../scripts/assert-bun-publish.mjs && bun run clean && bun run build",
-    "release": "rm -rf dist && bun run build && release-it"
-  },
-  "release-it": {
-    "git": {
-      "tagName": "@oxy.so/protocol@${version}",
-      "tagAnnotation": "Release @oxy.so/protocol@${version}",
-      "commitMessage": "chore(protocol): release @oxy.so/protocol@${version}"
-    },
-    "github": {
-      "release": true,
-      "releaseName": "@oxy.so/protocol@${version}"
-    },
-    "npm": {
-      "publish": true
-    }
+    "prepublishOnly": "node ../../scripts/assert-bun-publish.mjs && bun run clean && bun run build"
   },
   "dependencies": {
     "@noble/curves": "^1.9.7",
-    "@oxy.so/contracts": "^4.9.0",
+    "@oxy.so/contracts": "^4.24.0",
     "zod": "^3.25.64"
   },
   "peerDependencies": {
@@ -156,17 +157,15 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^1.9.4",
     "@react-native-async-storage/async-storage": "^2.2.0",
     "@types/express": "^4.17.25",
     "@types/node": "^22.20.1",
     "@types/supertest": "^6.0.2",
     "expo-crypto": "~56.0.3",
     "expo-modules-core": "~57.0.17",
-    "expo-secure-store": "~56.0.4",
+    "expo-secure-store": "~57.0.4",
     "express": "^4.22.2",
     "jest": "^30.5.1",
-    "release-it": "^19.0.6",
     "supertest": "^7.0.0",
     "ts-jest": "^29.4.12",
     "typescript": "^5.9.2"

package/src/__tests__/canonicalJson.test.ts

@@ -26,9 +26,7 @@ describe('canonicalize', () => {
         z: { y: 1, x: 2 },
         a: { c: 3, b: { e: 5, d: 4 } },
       };
-      expect(canonicalize(value)).toBe(
-        '{"a":{"b":{"d":4,"e":5},"c":3},"z":{"x":2,"y":1}}',
-      );
+      expect(canonicalize(value)).toBe('{"a":{"b":{"d":4,"e":5},"c":3},"z":{"x":2,"y":1}}');
     });
 
     it('is order-insensitive across deep nesting', () => {
@@ -91,9 +89,7 @@ describe('canonicalize', () => {
     it('respects toJSON (Date and its ISO string canonicalize identically)', () => {
       const date = new Date('2026-06-26T00:00:00.000Z');
       expect(canonicalize(date)).toBe(JSON.stringify(date.toISOString()));
-      expect(canonicalize({ at: date })).toBe(
-        canonicalize({ at: '2026-06-26T00:00:00.000Z' }),
-      );
+      expect(canonicalize({ at: date })).toBe(canonicalize({ at: '2026-06-26T00:00:00.000Z' }));
     });
   });
 

package/src/__tests__/chain.test.ts

@@ -80,11 +80,22 @@ function stubStore(overrides: Partial<RecordStore> = {}): RecordStore {
 const FAR_FUTURE_NOW = 1_700_000_000_000 + 1_000;
 
 describe('checkContinuity', () => {
-  const head = (headRecordId: string, seq: number): ChainHead => ({ headRecordId, seq, recordCount: seq + 1 });
+  const head = (headRecordId: string, seq: number): ChainHead => ({
+    headRecordId,
+    seq,
+    recordCount: seq + 1,
+  });
 
   it('accepts a v1 record (unchained) regardless of head', async () => {
     const env = await signEnvelope(
-      { version: 1, type: 'identity', subject: SUBJECT, issuer: SUBJECT, record: { a: 1 }, issuedAt: 1 },
+      {
+        version: 1,
+        type: 'identity',
+        subject: SUBJECT,
+        issuer: SUBJECT,
+        record: { a: 1 },
+        issuedAt: 1,
+      },
       PRIVATE_KEY,
     );
     expect(checkContinuity(head('a'.repeat(64), 3), env)).toEqual({ ok: true });
@@ -102,7 +113,10 @@ describe('checkContinuity', () => {
 
   it('rejects a wrong prev as chain_fork', async () => {
     const env = await signEnvelope(v2Fields({ seq: 1, prev: 'b'.repeat(64) }), PRIVATE_KEY);
-    expect(checkContinuity(head('a'.repeat(64), 0), env)).toEqual({ ok: false, reason: 'chain_fork' });
+    expect(checkContinuity(head('a'.repeat(64), 0), env)).toEqual({
+      ok: false,
+      reason: 'chain_fork',
+    });
   });
 
   it('rejects a seq gap (correct prev) as bad_seq', async () => {
@@ -157,7 +171,9 @@ describe('isAuthorizedKey', () => {
 describe('verifyEnvelope', () => {
   it('accepts a fresh, well-signed genesis record', async () => {
     const env = await signEnvelope(v2Fields(), PRIVATE_KEY);
-    await expect(verifyEnvelope(stubStore(), resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW })).resolves.toEqual({
+    await expect(
+      verifyEnvelope(stubStore(), resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW }),
+    ).resolves.toEqual({
       ok: true,
     });
   });
@@ -186,7 +202,9 @@ describe('verifyEnvelope', () => {
       const stripped = { ...env };
       delete (stripped as Record<string, unknown>)[field];
       await expect(
-        verifyEnvelope(stubStore(), resolver(SELF_RESOLVED), stripped as SignedRecordEnvelope, { now: FAR_FUTURE_NOW }),
+        verifyEnvelope(stubStore(), resolver(SELF_RESOLVED), stripped as SignedRecordEnvelope, {
+          now: FAR_FUTURE_NOW,
+        }),
       ).resolves.toEqual({ ok: false, reason: 'invalid_envelope' });
     },
   );
@@ -203,7 +221,9 @@ describe('verifyEnvelope', () => {
   it('rejects an unauthorized key as public_key_not_a_current_verification_method', async () => {
     const env = await signEnvelope(v2Fields(), PRIVATE_KEY);
     await expect(
-      verifyEnvelope(stubStore(), resolver({ currentPublicKeys: ['cafe'] }), env, { now: FAR_FUTURE_NOW }),
+      verifyEnvelope(stubStore(), resolver({ currentPublicKeys: ['cafe'] }), env, {
+        now: FAR_FUTURE_NOW,
+      }),
     ).resolves.toEqual({ ok: false, reason: 'public_key_not_a_current_verification_method' });
   });
 
@@ -224,7 +244,9 @@ describe('verifyEnvelope', () => {
   it('rejects an issuedAt not newer than the latest stored record as stale_issued_at', async () => {
     const env = await signEnvelope(v2Fields({ issuedAt: 1_700_000_000_000 }), PRIVATE_KEY);
     const store = stubStore({ latestIssuedAtForKey: async () => 1_700_000_000_000 });
-    await expect(verifyEnvelope(store, resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW })).resolves.toEqual({
+    await expect(
+      verifyEnvelope(store, resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW }),
+    ).resolves.toEqual({
       ok: false,
       reason: 'stale_issued_at',
     });
@@ -249,7 +271,9 @@ describe('verifyAndAppend', () => {
       }),
     );
     const store = stubStore({ append });
-    const result = await verifyAndAppend(store, resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW });
+    const result = await verifyAndAppend(store, resolver(SELF_RESOLVED), env, {
+      now: FAR_FUTURE_NOW,
+    });
     expect(result.ok).toBe(true);
     expect(append).toHaveBeenCalledTimes(1);
     const [subject, passedEnv, recordId] = append.mock.calls[0];
@@ -260,10 +284,15 @@ describe('verifyAndAppend', () => {
   });
 
   it('does NOT append when verification fails', async () => {
-    const tampered = { ...(await signEnvelope(v2Fields(), PRIVATE_KEY)), record: { x: 'tampered' } };
+    const tampered = {
+      ...(await signEnvelope(v2Fields(), PRIVATE_KEY)),
+      record: { x: 'tampered' },
+    };
     const append = jest.fn();
     const store = stubStore({ append });
-    const result = await verifyAndAppend(store, resolver(SELF_RESOLVED), tampered, { now: FAR_FUTURE_NOW });
+    const result = await verifyAndAppend(store, resolver(SELF_RESOLVED), tampered, {
+      now: FAR_FUTURE_NOW,
+    });
     expect(result).toEqual({ ok: false, reason: 'bad_signature' });
     expect(append).not.toHaveBeenCalled();
   });
@@ -271,7 +300,9 @@ describe('verifyAndAppend', () => {
   it('surfaces the store chain_conflict backstop', async () => {
     const env = await signEnvelope(v2Fields(), PRIVATE_KEY);
     const store = stubStore({ append: async () => ({ ok: false, reason: 'chain_conflict' }) });
-    await expect(verifyAndAppend(store, resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW })).resolves.toEqual({
+    await expect(
+      verifyAndAppend(store, resolver(SELF_RESOLVED), env, { now: FAR_FUTURE_NOW }),
+    ).resolves.toEqual({
       ok: false,
       reason: 'chain_conflict',
     });

package/src/__tests__/commonsIdentityBridge.test.ts

@@ -9,7 +9,9 @@
 const PUBLIC_KEY = `04${'ab'.repeat(64)}`;
 
 function mockNative(native: unknown): void {
-  jest.doMock('expo-modules-core', () => ({ requireOptionalNativeModule: () => native }), { virtual: true });
+  jest.doMock('expo-modules-core', () => ({ requireOptionalNativeModule: () => native }), {
+    virtual: true,
+  });
 }
 
 async function loadBridge() {
@@ -102,7 +104,10 @@ describe('tweakAddSecp256k1PrivateKey', () => {
     expect(() => tweakAddSecp256k1PrivateKey(nMinusOne, `${'0'.repeat(63)}1`)).toThrow('zero');
     // A tweak at or above n is invalid.
     expect(() =>
-      tweakAddSecp256k1PrivateKey('01', 'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),
+      tweakAddSecp256k1PrivateKey(
+        '01',
+        'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141',
+      ),
     ).toThrow('curve order');
     expect(() => tweakAddSecp256k1PrivateKey('01', 'zz')).toThrow();
   });

package/src/__tests__/didWebResolver.test.ts

@@ -19,7 +19,12 @@ function didDoc(overrides: Partial<DidDocument> = {}): DidDocument {
     id: SUBJECT,
     controller: [SUBJECT],
     verificationMethod: [
-      { id: `${SUBJECT}#key-1`, type: 'EcdsaSecp256k1VerificationKey2019', controller: SUBJECT, publicKeyHex: KEY_A },
+      {
+        id: `${SUBJECT}#key-1`,
+        type: 'EcdsaSecp256k1VerificationKey2019',
+        controller: SUBJECT,
+        publicKeyHex: KEY_A,
+      },
     ],
     authentication: [`${SUBJECT}#key-1`],
     assertionMethod: [`${SUBJECT}#key-1`],
@@ -50,7 +55,9 @@ describe('didWebToUrl', () => {
   });
 
   it('decodes a %3A port in the host segment', () => {
-    expect(didWebToUrl('did:web:localhost%3A3000')).toBe('https://localhost:3000/.well-known/did.json');
+    expect(didWebToUrl('did:web:localhost%3A3000')).toBe(
+      'https://localhost:3000/.well-known/did.json',
+    );
   });
 
   it('returns null for a non-did:web identifier', () => {
@@ -75,8 +82,18 @@ describe('createDidWebResolver', () => {
   it('collects every assertionMethod key (deduped)', async () => {
     const doc = didDoc({
       verificationMethod: [
-        { id: `${SUBJECT}#key-1`, type: 'EcdsaSecp256k1VerificationKey2019', controller: SUBJECT, publicKeyHex: KEY_A },
-        { id: `${SUBJECT}#key-2`, type: 'EcdsaSecp256k1VerificationKey2019', controller: SUBJECT, publicKeyHex: KEY_B },
+        {
+          id: `${SUBJECT}#key-1`,
+          type: 'EcdsaSecp256k1VerificationKey2019',
+          controller: SUBJECT,
+          publicKeyHex: KEY_A,
+        },
+        {
+          id: `${SUBJECT}#key-2`,
+          type: 'EcdsaSecp256k1VerificationKey2019',
+          controller: SUBJECT,
+          publicKeyHex: KEY_B,
+        },
       ],
       assertionMethod: [`${SUBJECT}#key-1`, `${SUBJECT}#key-2`],
     });
@@ -90,8 +107,18 @@ describe('createDidWebResolver', () => {
     // the hex signing key only.
     const doc = didDoc({
       verificationMethod: [
-        { id: `${SUBJECT}#key-1`, type: 'EcdsaSecp256k1VerificationKey2019', controller: SUBJECT, publicKeyHex: KEY_A },
-        { id: `${SUBJECT}#atproto`, type: 'Multikey', controller: SUBJECT, publicKeyMultibase: 'zQ3shFakeMultibaseKey' },
+        {
+          id: `${SUBJECT}#key-1`,
+          type: 'EcdsaSecp256k1VerificationKey2019',
+          controller: SUBJECT,
+          publicKeyHex: KEY_A,
+        },
+        {
+          id: `${SUBJECT}#atproto`,
+          type: 'Multikey',
+          controller: SUBJECT,
+          publicKeyMultibase: 'zQ3shFakeMultibaseKey',
+        },
       ],
       authentication: [`${SUBJECT}#key-1`, `${SUBJECT}#atproto`],
       assertionMethod: [`${SUBJECT}#key-1`, `${SUBJECT}#atproto`],
@@ -113,7 +140,9 @@ describe('createDidWebResolver', () => {
   });
 
   it('returns null when the document id does not match the subject', async () => {
-    const resolver = createDidWebResolver(async () => jsonResponse(didDoc({ id: 'did:web:other.example' })));
+    const resolver = createDidWebResolver(async () =>
+      jsonResponse(didDoc({ id: 'did:web:other.example' })),
+    );
     expect(await resolver.resolve(SUBJECT)).toBeNull();
   });