@oxy.so/protocol 1.2.2 → 1.3.1

package/src/__tests__/nodeApp.test.ts

@@ -91,7 +91,11 @@ describe('createNodeApp', () => {
     const empty = await request(app).get('/oxy/head');
     expect(empty.body).toEqual({ seq: null, headRecordId: null, recordCount: 0 });
 
-    const envelope = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 0, prev: null });
+    const envelope = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 0,
+      prev: null,
+    });
     const recordId = await computeRecordId(envelope);
     const write = await request(app).post('/records').send(envelope);
     expect(write.status).toBe(201);
@@ -107,7 +111,12 @@ describe('createNodeApp', () => {
     const genesisId = await computeRecordId(genesis);
     await request(app).post('/records').send(genesis).expect(201);
 
-    const second = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 1, prev: genesisId, record: { step: 2 } });
+    const second = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 1,
+      prev: genesisId,
+      record: { step: 2 },
+    });
     const secondId = await computeRecordId(second);
     const res = await request(app).post('/records').send(second);
     expect(res.status).toBe(201);
@@ -117,7 +126,11 @@ describe('createNodeApp', () => {
   it('POST /records rejects a record signed by a NON-owner key (403 not_owner)', async () => {
     const { app } = buildApp(owner);
     const attacker = generateKeyPair();
-    const envelope = await buildSignedEnvelope({ privateKey: attacker.privateKey, seq: 0, prev: null });
+    const envelope = await buildSignedEnvelope({
+      privateKey: attacker.privateKey,
+      seq: 0,
+      prev: null,
+    });
     const res = await request(app).post('/records').send(envelope);
     expect(res.status).toBe(403);
     expect(res.body).toEqual({ error: 'not_owner' });
@@ -132,7 +145,11 @@ describe('createNodeApp', () => {
 
   it('POST /records rejects a chain gap (422 chain_gap)', async () => {
     const { app } = buildApp(owner);
-    const envelope = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 3, prev: null });
+    const envelope = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 3,
+      prev: null,
+    });
     const res = await request(app).post('/records').send(envelope);
     expect(res.status).toBe(422);
     expect(res.body).toEqual({ error: 'chain_gap' });
@@ -162,8 +179,14 @@ describe('createNodeApp', () => {
   it('POST /sync/push verifies + appends a batch in order', async () => {
     const { app } = buildApp(owner);
     const genesis = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 0, prev: null });
-    const second = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 1, prev: await computeRecordId(genesis) });
-    const res = await request(app).post('/sync/push').send({ records: [genesis, second] });
+    const second = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 1,
+      prev: await computeRecordId(genesis),
+    });
+    const res = await request(app)
+      .post('/sync/push')
+      .send({ records: [genesis, second] });
     expect(res.status).toBe(200);
     expect(res.body.accepted).toBe(2);
     expect(res.body.results.every((r: { ok: boolean }) => r.ok)).toBe(true);
@@ -174,7 +197,12 @@ describe('createNodeApp', () => {
     let prev: string | null = null;
     const ids: string[] = [];
     for (let seq = 0; seq < 4; seq += 1) {
-      const envelope = await buildSignedEnvelope({ privateKey: owner.privateKey, seq, prev, record: { seq } });
+      const envelope = await buildSignedEnvelope({
+        privateKey: owner.privateKey,
+        seq,
+        prev,
+        record: { seq },
+      });
       const id = await computeRecordId(envelope);
       await request(app).post('/records').send(envelope).expect(201);
       ids.push(id);
@@ -193,7 +221,9 @@ describe('createNodeApp', () => {
     const sinceCursor = await request(app).get('/oxy/log').query({ since: ids[1] });
     expect(sinceCursor.body.records.map((entry: { seq: number }) => entry.seq)).toEqual([2, 3]);
 
-    const unknownCursor = await request(app).get('/oxy/log').query({ since: 'f'.repeat(64) });
+    const unknownCursor = await request(app)
+      .get('/oxy/log')
+      .query({ since: 'f'.repeat(64) });
     expect(unknownCursor.body.records).toEqual([]);
   });
 
@@ -215,11 +245,14 @@ describe('createNodeApp', () => {
     expect(put.status).toBe(201);
     expect(put.body).toEqual({ hash, size: bytes.length });
 
-    const get = await request(app).get(`/blobs/${hash}`).buffer(true).parse((res, cb) => {
-      const chunks: Buffer[] = [];
-      res.on('data', (chunk: Buffer) => chunks.push(chunk));
-      res.on('end', () => cb(null, Buffer.concat(chunks)));
-    });
+    const get = await request(app)
+      .get(`/blobs/${hash}`)
+      .buffer(true)
+      .parse((res, cb) => {
+        const chunks: Buffer[] = [];
+        res.on('data', (chunk: Buffer) => chunks.push(chunk));
+        res.on('end', () => cb(null, Buffer.concat(chunks)));
+      });
     expect(get.status).toBe(200);
     expect(Buffer.isBuffer(get.body) ? get.body : Buffer.from(get.body)).toEqual(bytes);
   });
@@ -269,7 +302,9 @@ describe('createNodeApp', () => {
     const auth = await signBlobPin(hash, owner);
 
     const server = createServer(app);
-    await new Promise<void>((resolve) => { server.listen(0, '127.0.0.1', resolve); });
+    await new Promise<void>((resolve) => {
+      server.listen(0, '127.0.0.1', resolve);
+    });
     const { port } = server.address() as AddressInfo;
 
     const raw = await new Promise<string>((resolve, reject) => {
@@ -284,12 +319,14 @@ describe('createNodeApp', () => {
             'Connection: close',
             '',
             '',
-          ].join('\r\n')
+          ].join('\r\n'),
         );
       });
       let received = '';
       socket.setEncoding('utf8');
-      socket.on('data', (chunk: string) => { received += chunk; });
+      socket.on('data', (chunk: string) => {
+        received += chunk;
+      });
       socket.on('error', reject);
       socket.on('end', () => resolve(received));
     });
@@ -360,7 +397,11 @@ describe('createNodeApp', () => {
     // within the window is rejected 429 BEFORE the handler runs, regardless of
     // each request's chain outcome.
     const { app } = buildApp(owner, [], { windowMs: 60_000, max: 2 });
-    const envelope = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 0, prev: null });
+    const envelope = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 0,
+      prev: null,
+    });
 
     const first = await request(app).post('/records').send(envelope);
     expect(first.status).toBe(201);
@@ -379,7 +420,12 @@ describe('createNodeApp', () => {
     let prev: string | null = null;
     const ids: string[] = [];
     for (let seq = 0; seq < 3; seq += 1) {
-      const envelope = await buildSignedEnvelope({ privateKey: owner.privateKey, seq, prev, record: { seq } });
+      const envelope = await buildSignedEnvelope({
+        privateKey: owner.privateKey,
+        seq,
+        prev,
+        record: { seq },
+      });
       const id = await computeRecordId(envelope);
       await request(app).post('/records').send(envelope).expect(201);
       ids.push(id);
@@ -388,7 +434,9 @@ describe('createNodeApp', () => {
 
     // `?since[]=<id1>&since[]=<id2>` arrives as a string[] — the handler must
     // take the FIRST value (a tampered array can never cause type confusion).
-    const res = await request(app).get('/oxy/log').query({ 'since[]': [ids[0], ids[2]] });
+    const res = await request(app)
+      .get('/oxy/log')
+      .query({ 'since[]': [ids[0], ids[2]] });
     expect(res.status).toBe(200);
     // Cursor resolves off ids[0] → records strictly after seq 0 → [1, 2].
     expect(res.body.records.map((entry: { seq: number }) => entry.seq)).toEqual([1, 2]);
@@ -398,12 +446,19 @@ describe('createNodeApp', () => {
     const { app } = buildApp(owner);
     let prev: string | null = null;
     for (let seq = 0; seq < 4; seq += 1) {
-      const envelope = await buildSignedEnvelope({ privateKey: owner.privateKey, seq, prev, record: { seq } });
+      const envelope = await buildSignedEnvelope({
+        privateKey: owner.privateKey,
+        seq,
+        prev,
+        record: { seq },
+      });
       await request(app).post('/records').send(envelope).expect(201);
       prev = await computeRecordId(envelope);
     }
 
-    const res = await request(app).get('/oxy/log').query({ 'limit[]': ['2', '99'] });
+    const res = await request(app)
+      .get('/oxy/log')
+      .query({ 'limit[]': ['2', '99'] });
     expect(res.status).toBe(200);
     expect(res.body.records.map((entry: { seq: number }) => entry.seq)).toEqual([0, 1]);
   });

package/src/__tests__/nodeClient.test.ts

@@ -71,7 +71,9 @@ describe('trimTrailingSlashes', () => {
   });
 
   it('preserves interior slashes and the empty string', () => {
-    expect(trimTrailingSlashes('https://node.example/oxy/log')).toBe('https://node.example/oxy/log');
+    expect(trimTrailingSlashes('https://node.example/oxy/log')).toBe(
+      'https://node.example/oxy/log',
+    );
     expect(trimTrailingSlashes('')).toBe('');
     expect(trimTrailingSlashes('///')).toBe('');
   });
@@ -127,7 +129,11 @@ describe('NodeClient (end-to-end against createNodeApp)', () => {
     const genesisId = await computeRecordId(genesis);
     await client.writeRecord(genesis);
 
-    const second = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 1, prev: genesisId });
+    const second = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 1,
+      prev: genesisId,
+    });
     const secondId = await computeRecordId(second);
     expect(await client.writeRecord(second)).toEqual({ recordId: secondId, seq: 1 });
 
@@ -143,7 +149,10 @@ describe('NodeClient (end-to-end against createNodeApp)', () => {
 
   it('writeRecord surfaces a chain gap as a NodeClientError (422 chain_gap)', async () => {
     const gap = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 3, prev: null });
-    await expect(client.writeRecord(gap)).rejects.toMatchObject({ status: 422, reason: 'chain_gap' });
+    await expect(client.writeRecord(gap)).rejects.toMatchObject({
+      status: 422,
+      reason: 'chain_gap',
+    });
     await expect(client.writeRecord(gap)).rejects.toBeInstanceOf(NodeClientError);
   });
 
@@ -151,14 +160,28 @@ describe('NodeClient (end-to-end against createNodeApp)', () => {
     const genesis = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 0, prev: null });
     await client.writeRecord(genesis);
 
-    const fork = await buildSignedEnvelope({ privateKey: owner.privateKey, seq: 1, prev: 'f'.repeat(64) });
-    await expect(client.writeRecord(fork)).rejects.toMatchObject({ status: 422, reason: 'chain_fork' });
+    const fork = await buildSignedEnvelope({
+      privateKey: owner.privateKey,
+      seq: 1,
+      prev: 'f'.repeat(64),
+    });
+    await expect(client.writeRecord(fork)).rejects.toMatchObject({
+      status: 422,
+      reason: 'chain_fork',
+    });
   });
 
   it('writeRecord surfaces a non-owner write as a NodeClientError (403 not_owner)', async () => {
     const attacker = generateKeyPair();
-    const envelope = await buildSignedEnvelope({ privateKey: attacker.privateKey, seq: 0, prev: null });
-    await expect(client.writeRecord(envelope)).rejects.toMatchObject({ status: 403, reason: 'not_owner' });
+    const envelope = await buildSignedEnvelope({
+      privateKey: attacker.privateKey,
+      seq: 0,
+      prev: null,
+    });
+    await expect(client.writeRecord(envelope)).rejects.toMatchObject({
+      status: 403,
+      reason: 'not_owner',
+    });
   });
 
   it('putBlob then getBlob round-trips; getBlob returns null when absent', async () => {

package/src/__tests__/nodeHarness.ts

@@ -95,14 +95,18 @@ export function createInMemoryNodeStore(): RecordStore & BlobStore {
     },
     async resolveCursorSeq(_subject, recordId): Promise<number | null> {
       const found = records.find((r) => r.recordId === recordId);
-      return found ? found.env.seq ?? -1 : null;
+      return found ? (found.env.seq ?? -1) : null;
     },
     async materializeCurrent(_subject, collection, rkey): Promise<SignedRecordEnvelope | null> {
-      const matching = records.filter((r) => r.env.collection === collection && r.env.rkey === rkey);
+      const matching = records.filter(
+        (r) => r.env.collection === collection && r.env.rkey === rkey,
+      );
       return matching.length ? matching[matching.length - 1].env : null;
     },
     async latestIssuedAtForKey(_subject, env): Promise<number | null> {
-      const matching = records.filter((r) => r.env.collection === env.collection && r.env.rkey === env.rkey);
+      const matching = records.filter(
+        (r) => r.env.collection === env.collection && r.env.rkey === env.rkey,
+      );
       return matching.length ? matching[matching.length - 1].env.issuedAt : null;
     },
     async putBlob(hash, bytes): Promise<void> {

package/src/__tests__/optionalNativePeers.test.ts

@@ -26,9 +26,7 @@ import { dirname, join, resolve } from 'node:path';
 const SRC_DIR = resolve(__dirname, '..');
 const ROOT_ENTRY = join(SRC_DIR, 'index.ts');
 
-const packageJson = JSON.parse(
-  readFileSync(resolve(SRC_DIR, '..', 'package.json'), 'utf8'),
-) as {
+const packageJson = JSON.parse(readFileSync(resolve(SRC_DIR, '..', 'package.json'), 'utf8')) as {
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
 };
 
@@ -218,9 +216,13 @@ describe('crypto.native optional-peer degradation', () => {
       });
       jest.doMock('expo-crypto', () => fakeCrypto, { virtual: true });
       jest.doMock('expo-secure-store', () => fakeSecureStore, { virtual: true });
-      jest.doMock('@react-native-async-storage/async-storage', () => ({ default: fakeAsyncStorage }), {
-        virtual: true,
-      });
+      jest.doMock(
+        '@react-native-async-storage/async-storage',
+        () => ({ default: fakeAsyncStorage }),
+        {
+          virtual: true,
+        },
+      );
 
       const mod = require(MODULE_PATH) as typeof import('../platform/crypto.native');
 

package/src/__tests__/rateLimit.test.ts

@@ -209,7 +209,8 @@ describe('createRateLimiter', () => {
       await jest.isolateModulesAsync(async () => {
         const reloaded = await import('../node/rateLimit');
         afterRestart = reloaded.clientRateLimitKey({ ip: ADDRESS } as Request);
-        stableAfterRestart = reloaded.clientRateLimitKey({ ip: ADDRESS } as Request) === afterRestart;
+        stableAfterRestart =
+          reloaded.clientRateLimitKey({ ip: ADDRESS } as Request) === afterRestart;
       });
 
       expect(afterRestart).not.toBe(before);

package/src/__tests__/registrationPow.test.ts

@@ -3,70 +3,68 @@ import {
   meetsRegistrationPowDifficulty,
   registrationPowMessage,
   REGISTRATION_POW_DIFFICULTY_BITS,
-} from "../auth/registrationPow";
+} from '../auth/registrationPow';
 
-describe("registrationPowMessage", () => {
-  test("binds publicKey, timestamp and nonce, distinct from the registration signature message", () => {
-    expect(registrationPowMessage("pk", 1700000000000, "42")).toBe(
-      "oxy:register-pow:pk:1700000000000:42",
+describe('registrationPowMessage', () => {
+  test('binds publicKey, timestamp and nonce, distinct from the registration signature message', () => {
+    expect(registrationPowMessage('pk', 1700000000000, '42')).toBe(
+      'oxy:register-pow:pk:1700000000000:42',
     );
   });
 
-  test("a different nonce is a different message", () => {
-    expect(registrationPowMessage("pk", 1, "a")).not.toBe(
-      registrationPowMessage("pk", 1, "b"),
-    );
+  test('a different nonce is a different message', () => {
+    expect(registrationPowMessage('pk', 1, 'a')).not.toBe(registrationPowMessage('pk', 1, 'b'));
   });
 });
 
-describe("countLeadingZeroBits", () => {
+describe('countLeadingZeroBits', () => {
   test.each([
-    ["", 0],
-    ["f", 0],
-    ["8000", 0],
-    ["0", 4],
-    ["00", 8],
-    ["01", 7],
-    ["0f", 4],
-    ["1f", 3],
-    ["2f", 2],
-    ["4f", 1],
-    ["0000f", 16],
+    ['', 0],
+    ['f', 0],
+    ['8000', 0],
+    ['0', 4],
+    ['00', 8],
+    ['01', 7],
+    ['0f', 4],
+    ['1f', 3],
+    ['2f', 2],
+    ['4f', 1],
+    ['0000f', 16],
     // Case-insensitive: the digest producers this compares against are
     // lowercase, but the counter must not silently under-count an uppercase one.
-    ["00F", 8],
-  ])("counts %s as %i leading zero bits", (hex, expected) => {
+    ['00F', 8],
+  ])('counts %s as %i leading zero bits', (hex, expected) => {
     expect(countLeadingZeroBits(hex)).toBe(expected);
   });
 
-  test("stops at the first non-zero nibble rather than scanning the whole digest", () => {
-    expect(countLeadingZeroBits(`00f${"0".repeat(60)}`)).toBe(8);
+  test('stops at the first non-zero nibble rather than scanning the whole digest', () => {
+    expect(countLeadingZeroBits(`00f${'0'.repeat(60)}`)).toBe(8);
   });
 
-  test("a non-hex character ends the count instead of throwing", () => {
-    expect(countLeadingZeroBits("0z")).toBe(4);
-    expect(() => countLeadingZeroBits("not-hex-at-all")).not.toThrow();
+  test('a non-hex character ends the count instead of throwing', () => {
+    expect(countLeadingZeroBits('0z')).toBe(4);
+    expect(() => countLeadingZeroBits('not-hex-at-all')).not.toThrow();
   });
 });
 
-describe("meetsRegistrationPowDifficulty", () => {
-  test("passes a digest that clears the bound", () => {
-    expect(meetsRegistrationPowDifficulty("00f0", 8)).toBe(true);
-    expect(meetsRegistrationPowDifficulty("00f0", 9)).toBe(false);
+describe('meetsRegistrationPowDifficulty', () => {
+  test('passes a digest that clears the bound', () => {
+    expect(meetsRegistrationPowDifficulty('00f0', 8)).toBe(true);
+    expect(meetsRegistrationPowDifficulty('00f0', 9)).toBe(false);
   });
 
-  test("an exact match at the bound passes", () => {
-    expect(meetsRegistrationPowDifficulty("00f0", 8)).toBe(true);
+  test('an exact match at the bound passes', () => {
+    expect(meetsRegistrationPowDifficulty('00f0', 8)).toBe(true);
   });
 
-  test("the exported difficulty constant is a defensible, positive bound", () => {
+  test('the exported difficulty constant is a defensible, positive bound', () => {
     // Pinned as a regression check on the constant itself: a change here is a
     // deliberate retune, not an accidental one, and shows up in review.
     expect(REGISTRATION_POW_DIFFICULTY_BITS).toBe(16);
-    expect(meetsRegistrationPowDifficulty("0".repeat(64), REGISTRATION_POW_DIFFICULTY_BITS)).toBe(
+    expect(meetsRegistrationPowDifficulty('0'.repeat(64), REGISTRATION_POW_DIFFICULTY_BITS)).toBe(
       true,
     );
-    expect(meetsRegistrationPowDifficulty("f".repeat(64), REGISTRATION_POW_DIFFICULTY_BITS)).toBe(
+    expect(meetsRegistrationPowDifficulty('f'.repeat(64), REGISTRATION_POW_DIFFICULTY_BITS)).toBe(
       false,
     );
   });

package/src/__tests__/secp256k1.test.ts

@@ -8,111 +8,82 @@ import {
   normalizeSecp256k1PublicKey,
   signSecp256k1Digest,
   verifySecp256k1Digest,
-} from "../secp256k1";
+} from '../secp256k1';
 
-const PRIVATE_KEY_ONE = `${"0".repeat(63)}1`;
-const PRIVATE_KEY_TWO = `${"0".repeat(63)}2`;
-const DIGEST_ONE = `${"0".repeat(63)}1`;
+const PRIVATE_KEY_ONE = `${'0'.repeat(63)}1`;
+const PRIVATE_KEY_TWO = `${'0'.repeat(63)}2`;
+const DIGEST_ONE = `${'0'.repeat(63)}1`;
 
 const PUBLIC_KEY_ONE =
-  "0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798" +
-  "483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8";
+  '0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798' +
+  '483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8';
 const COMPRESSED_PUBLIC_KEY_ONE =
-  "0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798";
+  '0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798';
 const PUBLIC_KEY_TWO =
-  "04c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5" +
-  "1ae168fea63dc339a3c58419466ceaeef7f632653266d0e1236431a950cfe52a";
+  '04c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5' +
+  '1ae168fea63dc339a3c58419466ceaeef7f632653266d0e1236431a950cfe52a';
 
 // Exact DER output produced by elliptic 6.6.1 for this RFC 6979 vector.
 const HISTORICAL_HIGH_S_SIGNATURE =
-  "304502206673ffad2147741f04772b6f921f0ba6af0c1e77fc439e65c36dedf4092e8898" +
-  "022100b3e568e9ad1f52577fedf107fda18f5ebb8e5c220badf23532bf6fbcc67fb4b8";
+  '304502206673ffad2147741f04772b6f921f0ba6af0c1e77fc439e65c36dedf4092e8898' +
+  '022100b3e568e9ad1f52577fedf107fda18f5ebb8e5c220badf23532bf6fbcc67fb4b8';
 const LOW_S_SIGNATURE =
-  "304402206673ffad2147741f04772b6f921f0ba6af0c1e77fc439e65c36dedf4092e8898" +
-  "02204c1a971652e0ada880120ef8025e709fff2080c4a39aae068d12eed009b68c89";
+  '304402206673ffad2147741f04772b6f921f0ba6af0c1e77fc439e65c36dedf4092e8898' +
+  '02204c1a971652e0ada880120ef8025e709fff2080c4a39aae068d12eed009b68c89';
 
-describe("secp256k1 primitives", () => {
-  test("preserves the canonical private/public key formats", () => {
-    expect(normalizeSecp256k1PrivateKey("1")).toBe(PRIVATE_KEY_ONE);
+describe('secp256k1 primitives', () => {
+  test('preserves the canonical private/public key formats', () => {
+    expect(normalizeSecp256k1PrivateKey('1')).toBe(PRIVATE_KEY_ONE);
     expect(deriveSecp256k1PublicKey(PRIVATE_KEY_ONE)).toBe(PUBLIC_KEY_ONE);
-    expect(deriveSecp256k1PublicKey(PRIVATE_KEY_ONE, true)).toBe(
-      COMPRESSED_PUBLIC_KEY_ONE,
-    );
-    expect(normalizeSecp256k1PublicKey(COMPRESSED_PUBLIC_KEY_ONE)).toBe(
-      PUBLIC_KEY_ONE,
-    );
-    expect(normalizeSecp256k1PublicKey(PUBLIC_KEY_ONE, true)).toBe(
-      COMPRESSED_PUBLIC_KEY_ONE,
-    );
+    expect(deriveSecp256k1PublicKey(PRIVATE_KEY_ONE, true)).toBe(COMPRESSED_PUBLIC_KEY_ONE);
+    expect(normalizeSecp256k1PublicKey(COMPRESSED_PUBLIC_KEY_ONE)).toBe(PUBLIC_KEY_ONE);
+    expect(normalizeSecp256k1PublicKey(PUBLIC_KEY_ONE, true)).toBe(COMPRESSED_PUBLIC_KEY_ONE);
   });
 
-  test("matches the historical deterministic DER wire format", () => {
+  test('matches the historical deterministic DER wire format', () => {
     const signature = signSecp256k1Digest(PRIVATE_KEY_ONE, DIGEST_ONE);
     expect(signature).toBe(HISTORICAL_HIGH_S_SIGNATURE);
-    expect(verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, signature)).toBe(
-      true,
-    );
-    expect(
-      verifySecp256k1Digest(COMPRESSED_PUBLIC_KEY_ONE, DIGEST_ONE, signature),
-    ).toBe(true);
+    expect(verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, signature)).toBe(true);
+    expect(verifySecp256k1Digest(COMPRESSED_PUBLIC_KEY_ONE, DIGEST_ONE, signature)).toBe(true);
   });
 
-  test("supports explicit low-S signatures while accepting both historical forms", () => {
+  test('supports explicit low-S signatures while accepting both historical forms', () => {
     const signature = signSecp256k1Digest(PRIVATE_KEY_ONE, DIGEST_ONE, {
       lowS: true,
     });
     expect(signature).toBe(LOW_S_SIGNATURE);
-    expect(verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, signature)).toBe(
+    expect(verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, signature)).toBe(true);
+    expect(verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, HISTORICAL_HIGH_S_SIGNATURE)).toBe(
       true,
     );
-    expect(
-      verifySecp256k1Digest(
-        PUBLIC_KEY_ONE,
-        DIGEST_ONE,
-        HISTORICAL_HIGH_S_SIGNATURE,
-      ),
-    ).toBe(true);
   });
 
-  test("derives the fixed-width ECDH x-coordinate symmetrically", () => {
-    const expected =
-      "c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5";
-    const oneToTwo = deriveSecp256k1SharedSecret(
-      PRIVATE_KEY_ONE,
-      PUBLIC_KEY_TWO,
-    );
-    const twoToOne = deriveSecp256k1SharedSecret(
-      PRIVATE_KEY_TWO,
-      PUBLIC_KEY_ONE,
-    );
+  test('derives the fixed-width ECDH x-coordinate symmetrically', () => {
+    const expected = 'c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5';
+    const oneToTwo = deriveSecp256k1SharedSecret(PRIVATE_KEY_ONE, PUBLIC_KEY_TWO);
+    const twoToOne = deriveSecp256k1SharedSecret(PRIVATE_KEY_TWO, PUBLIC_KEY_ONE);
 
-    expect(Buffer.from(oneToTwo).toString("hex")).toBe(expected);
+    expect(Buffer.from(oneToTwo).toString('hex')).toBe(expected);
     expect(oneToTwo).toEqual(twoToOne);
     expect(oneToTwo).toHaveLength(32);
   });
 
-  test("generates canonical key pairs that round-trip", () => {
+  test('generates canonical key pairs that round-trip', () => {
     const keyPair = generateSecp256k1KeyPair();
     expect(keyPair.privateKey).toMatch(/^[0-9a-f]{64}$/);
     expect(keyPair.publicKey).toMatch(/^04[0-9a-f]{128}$/);
-    expect(deriveSecp256k1PublicKey(keyPair.privateKey)).toBe(
-      keyPair.publicKey,
-    );
+    expect(deriveSecp256k1PublicKey(keyPair.privateKey)).toBe(keyPair.publicKey);
   });
 
-  test("strictly rejects malformed scalars, points, digests, and DER", () => {
-    expect(isValidSecp256k1PrivateKey("0")).toBe(false);
-    expect(isValidSecp256k1PrivateKey("zz")).toBe(false);
-    expect(isValidSecp256k1PrivateKey("f".repeat(66))).toBe(false);
-    expect(isValidSecp256k1PublicKey(`04${"0".repeat(128)}`)).toBe(false);
-    expect(isValidSecp256k1PublicKey(`05${PUBLIC_KEY_ONE.slice(2)}`)).toBe(
-      false,
-    );
-    expect(() => signSecp256k1Digest(PRIVATE_KEY_ONE, "00")).toThrow(
-      "digest must be exactly 32 bytes",
+  test('strictly rejects malformed scalars, points, digests, and DER', () => {
+    expect(isValidSecp256k1PrivateKey('0')).toBe(false);
+    expect(isValidSecp256k1PrivateKey('zz')).toBe(false);
+    expect(isValidSecp256k1PrivateKey('f'.repeat(66))).toBe(false);
+    expect(isValidSecp256k1PublicKey(`04${'0'.repeat(128)}`)).toBe(false);
+    expect(isValidSecp256k1PublicKey(`05${PUBLIC_KEY_ONE.slice(2)}`)).toBe(false);
+    expect(() => signSecp256k1Digest(PRIVATE_KEY_ONE, '00')).toThrow(
+      'digest must be exactly 32 bytes',
     );
-    expect(() =>
-      verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, "00"),
-    ).toThrow();
+    expect(() => verifySecp256k1Digest(PUBLIC_KEY_ONE, DIGEST_ONE, '00')).toThrow();
   });
 });

package/src/__tests__/transparency.test.ts

@@ -216,7 +216,10 @@ describe('verifyInclusionProof', () => {
     const entries = heads(5);
     const tree = await buildTransparencyTreeFromHeads(entries);
     const proof = inclusionProof(tree, 2);
-    const tamperedLeaf = await transparencyLeafHash({ ...entries[2], headRecordId: 'f'.repeat(64) });
+    const tamperedLeaf = await transparencyLeafHash({
+      ...entries[2],
+      headRecordId: 'f'.repeat(64),
+    });
     await expect(
       verifyInclusionProof({ leaf: tamperedLeaf, index: 2, treeSize: 5, proof, root: tree.root }),
     ).resolves.toBe(false);

package/src/auth/registrationPow.ts

@@ -89,7 +89,11 @@ const NIBBLE_LEADING_ZERO_BITS: Readonly<Record<string, number>> = {
  * vice versa — the two are unrelated preimages even for the same
  * `publicKey`/`timestamp` pair.
  */
-export function registrationPowMessage(publicKey: string, timestamp: number, nonce: string): string {
+export function registrationPowMessage(
+  publicKey: string,
+  timestamp: number,
+  nonce: string,
+): string {
   return `oxy:register-pow:${publicKey}:${timestamp}:${nonce}`;
 }
 

package/src/chain/engine.ts

@@ -9,7 +9,7 @@
  * engine owns the verification + ordering policy.
  *
  * Storage and identity are both injected, so the engine has zero knowledge of
- * Mongo/SQLite, Oxy DIDs, or any app's lexicon — exactly what makes it reusable.
+ * the database, Oxy DIDs, or any app's lexicon — exactly what makes it reusable.
  */
 
 import type { SignedRecordEnvelope } from '@oxy.so/contracts';

package/src/chain/recordStore.ts

@@ -4,8 +4,8 @@
  * The engine ({@link ./verify}, {@link ./engine}) is storage-agnostic: it owns
  * the verification state machine and continuity logic, and delegates EVERY read
  * and write to an injected {@link RecordStore}. An app supplies a store over its
- * own backend (oxy-api over Mongo `SignedRecord`/`RepoHead`, a node over SQLite,
- * Mention over its own Mongo) without the engine knowing anything Oxy- or
+ * own backend (oxy-api over Postgres `signed_records`/`repo_heads`, a node over
+ * SQLite, Mention over its own database) without the engine knowing anything Oxy- or
  * app-specific.
  *
  * All methods are **subject-keyed**: `subject` is the chain's subject DID
@@ -17,7 +17,7 @@
  * `append` MUST be atomic (record insert + head advance in one unit) and MUST
  * translate a duplicate-key collision on the unique `(subject, seq)` /
  * `recordId` index — i.e. a concurrent writer that already took this `seq` — into
- * `{ ok: false, reason: 'chain_conflict' }` (Mongo E11000 / SQLite
+ * `{ ok: false, reason: 'chain_conflict' }` (Postgres `23505` / SQLite
  * `SQLITE_CONSTRAINT`). That is the real multi-writer race guard; the engine's
  * pre-append continuity check is only the fast-path rejection.
  */