From 773487cf1eea3d26802ca41482c390a1d8a1c76d Mon Sep 17 00:00:00 2001
From: Buffrr <contact@buffrr.dev>
Date: Mon, 20 Apr 2026 16:02:16 +0200
Subject: [PATCH 1/3] feat: add release-plz, CI, and publish fabric-rs to
 crates.io

- Rename crate to fabric-rs ([lib] name = "fabric" for use statements)
- Switch all workspace deps from git to crates.io versions
- Add release-plz.toml and workflow for automated releases
- Add test/lint CI (cargo fmt, clippy -D warnings)
- Add commitlint for conventional commits
- Trigger binding publish workflows on fabric-v* tags
- Add cache-control headers to /addrs endpoint
- Fix all clippy warnings across fabric and relay
- Auto-initialize WASM in fabric-web (no manual init() needed)
---
 .commitlintrc.yml                    |  19 ++
 .github/workflows/commitlint.yml     |  16 ++
 .github/workflows/publish-go.yml     |   2 +-
 .github/workflows/publish-js.yml     |   4 +-
 .github/workflows/publish-kotlin.yml |   4 +-
 .github/workflows/publish-python.yml |   4 +-
 .github/workflows/publish-swift.yml  |   2 +-
 .github/workflows/release-plz.yml    |  48 +++++
 .github/workflows/test.yml           |  40 +++++
 Cargo.lock                           | 123 +++++++------
 Cargo.toml                           |  24 ++-
 fabric/examples/rust/Cargo.lock      |  29 +--
 fabric/go/go.mod                     |   2 +-
 fabric/go/go.sum                     |   4 +-
 fabric/js/fabric-web/package.json    |   2 +-
 fabric/js/fabric-web/src/index.ts    |  35 +++-
 fabric/kotlin/build.gradle.kts       |   4 +-
 fabric/python/pyproject.toml         |   2 +-
 fabric/rust/Cargo.toml               |  17 +-
 fabric/rust/src/anchor.rs            |  12 +-
 fabric/rust/src/client.rs            | 256 ++++++++++++++++-----------
 fabric/rust/src/lib.rs               |   9 +-
 fabric/rust/src/main.rs              |   8 +-
 fabric/rust/src/seeds.rs             |   3 +-
 fabric/rust/src/signing.rs           |   5 +-
 fabric/swift/Package.swift           |   2 +-
 relay/Cargo.toml                     |   9 +-
 relay/src/app.rs                     |  52 +++---
 relay/src/handler.rs                 | 165 +++++++++--------
 relay/src/http.rs                    | 118 ++++++++----
 relay/src/lib.rs                     |  18 +-
 relay/src/peer.rs                    |  39 ++--
 relay/src/relay.rs                   |  84 +++++----
 relay/src/spaced.rs                  |  18 +-
 relay/src/store.rs                   |  91 ++++++----
 relay/tests/integration_tests.rs     |  93 ++++++----
 release-plz.toml                     |  61 +++++++
 tests/Cargo.toml                     |   2 +-
 tests/src/lib.rs                     |  33 ++--
 tests/tests/fabric_client.rs         |  76 ++++++--
 40 files changed, 1003 insertions(+), 532 deletions(-)
 create mode 100644 .commitlintrc.yml
 create mode 100644 .github/workflows/commitlint.yml
 create mode 100644 .github/workflows/release-plz.yml
 create mode 100644 .github/workflows/test.yml
 create mode 100644 release-plz.toml

diff --git a/.commitlintrc.yml b/.commitlintrc.yml
new file mode 100644
index 0000000..8d3697a
--- /dev/null
+++ b/.commitlintrc.yml
@@ -0,0 +1,19 @@
+extends:
+  - '@commitlint/config-conventional'
+
+rules:
+  header-max-length: [2, always, 100]
+  type-enum:
+    - 2
+    - always
+    - - build
+      - chore
+      - ci
+      - docs
+      - feat
+      - fix
+      - perf
+      - refactor
+      - revert
+      - style
+      - test
\ No newline at end of file
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
new file mode 100644
index 0000000..57918ab
--- /dev/null
+++ b/.github/workflows/commitlint.yml
@@ -0,0 +1,16 @@
+name: Commitlint
+
+on:
+  pull_request:
+    types: [opened, reopened, edited, synchronize]
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@v6
+        with:
+          configFile: .commitlintrc.yml
\ No newline at end of file
diff --git a/.github/workflows/publish-go.yml b/.github/workflows/publish-go.yml
index 24251a3..9f7ca55 100644
--- a/.github/workflows/publish-go.yml
+++ b/.github/workflows/publish-go.yml
@@ -3,7 +3,7 @@ name: Publish Go
 on:
   push:
     tags:
-      - "v*"
+      - "fabric-v*"
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/publish-js.yml b/.github/workflows/publish-js.yml
index 2392a7d..f0aa499 100644
--- a/.github/workflows/publish-js.yml
+++ b/.github/workflows/publish-js.yml
@@ -3,7 +3,7 @@ name: Publish JS packages
 on:
   push:
     tags:
-      - "v*"
+      - "fabric-v*"
   workflow_dispatch:
 
 jobs:
@@ -26,7 +26,7 @@ jobs:
       - name: Determine version
         id: version
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
+          VERSION="${GITHUB_REF_NAME#fabric-v}"
           if [[ ! "$GITHUB_REF" == refs/tags/* ]]; then
             VERSION="0.0.0-dev.$(date +%Y%m%d%H%M%S)"
           fi
diff --git a/.github/workflows/publish-kotlin.yml b/.github/workflows/publish-kotlin.yml
index 232bb91..2f595a3 100644
--- a/.github/workflows/publish-kotlin.yml
+++ b/.github/workflows/publish-kotlin.yml
@@ -3,7 +3,7 @@ name: Publish Kotlin
 on:
   push:
     tags:
-      - "v*"
+      - "fabric-v*"
   workflow_dispatch:
 
 permissions:
@@ -21,7 +21,7 @@ jobs:
       - name: Determine version
         id: version
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
+          VERSION="${GITHUB_REF_NAME#fabric-v}"
           if [[ ! "$GITHUB_REF" == refs/tags/* ]]; then
             VERSION="0.0.0-dev.$(date +%Y%m%d%H%M%S)"
           fi
diff --git a/.github/workflows/publish-python.yml b/.github/workflows/publish-python.yml
index 00ac3ae..9c25ec2 100644
--- a/.github/workflows/publish-python.yml
+++ b/.github/workflows/publish-python.yml
@@ -3,7 +3,7 @@ name: Publish Python
 on:
   push:
     tags:
-      - "v*"
+      - "fabric-v*"
   workflow_dispatch:
 
 permissions:
@@ -25,7 +25,7 @@ jobs:
       - name: Determine version
         id: version
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
+          VERSION="${GITHUB_REF_NAME#fabric-v}"
           if [[ ! "$GITHUB_REF" == refs/tags/* ]]; then
             VERSION="0.0.0-dev.$(date +%Y%m%d%H%M%S)"
           fi
diff --git a/.github/workflows/publish-swift.yml b/.github/workflows/publish-swift.yml
index 133875a..634eab4 100644
--- a/.github/workflows/publish-swift.yml
+++ b/.github/workflows/publish-swift.yml
@@ -3,7 +3,7 @@ name: Publish Swift
 on:
   push:
     tags:
-      - "v*"
+      - "fabric-v*"
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
new file mode 100644
index 0000000..11d4eea
--- /dev/null
+++ b/.github/workflows/release-plz.yml
@@ -0,0 +1,48 @@
+name: Release-plz
+
+permissions:
+  pull-requests: write
+  contents: write
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release-plz-pr:
+    name: Release-plz PR
+    runs-on: ubuntu-latest
+    if: ${{ github.repository_owner == 'spacesprotocol' }}
+    concurrency:
+      group: release-plz-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Run release-plz
+        uses: release-plz/action@v0.5
+        with:
+          command: release-pr
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  release-plz-release:
+    name: Release-plz publish
+    runs-on: ubuntu-latest
+    if: ${{ github.repository_owner == 'spacesprotocol' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_PLZ_TOKEN }}
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Run release-plz
+        uses: release-plz/action@v0.5
+        with:
+          command: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..0e0c780
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,40 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Build
+        run: cargo build -p fabric-rs -p relay
+
+      - name: Run tests
+        run: cargo test -p fabric-rs
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy -p fabric-rs -p relay --all-features -- -D warnings
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 4abf780..39b0bfb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -440,9 +440,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
-name = "bdk_chain"
+name = "bdk_chain_backport"
 version = "0.21.0"
-source = "git+https://github.com/buffrr/bdk.git?rev=43bca8643dec6fdda99e4a29bf88709729af349e#43bca8643dec6fdda99e4a29bf88709729af349e"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d580eb55991b7a2415d71d195935f4f88b138257a5e7756724d77974c2f15153"
 dependencies = [
  "bdk_core",
  "bitcoin",
@@ -453,8 +454,9 @@ dependencies = [
 
 [[package]]
 name = "bdk_core"
-version = "0.4.0"
-source = "git+https://github.com/buffrr/bdk.git?rev=43bca8643dec6fdda99e4a29bf88709729af349e#43bca8643dec6fdda99e4a29bf88709729af349e"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b545aea1efc090e4f71f1dd5468090d9f54c3de48002064c04895ef811fbe0b2"
 dependencies = [
  "bitcoin",
  "hashbrown 0.14.5",
@@ -462,11 +464,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "bdk_wallet"
+name = "bdk_wallet_backport"
 version = "1.0.0-beta.6"
-source = "git+https://github.com/buffrr/bdk.git?rev=43bca8643dec6fdda99e4a29bf88709729af349e#43bca8643dec6fdda99e4a29bf88709729af349e"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbf2fadfbc496ddc97a19bc99196abafe6d393eb0f6e51f36aa6cf93b9aeb8db"
 dependencies = [
- "bdk_chain",
+ "bdk_chain_backport",
  "bip39",
  "bitcoin",
  "miniscript",
@@ -620,6 +623,31 @@ dependencies = [
  "hex-conservative 0.3.2",
 ]
 
+[[package]]
+name = "bitcoin_yuki"
+version = "0.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "745c612d5df594e30f526bcd62af6e13909e26c109a6d9600197010f2f944a57"
+dependencies = [
+ "anyhow",
+ "bincode",
+ "bip324",
+ "bitcoin",
+ "clap",
+ "env_logger",
+ "futures-util",
+ "hex",
+ "jsonrpsee",
+ "reqwest",
+ "rusqlite",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "tracing-subscriber 0.3.23",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -692,7 +720,8 @@ dependencies = [
 [[package]]
 name = "borsh_utils"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c0cd2efcc60ce44ca958baa626593a23006b5418b1fa8f038c23aa85f7a97f"
 dependencies = [
  "bitcoin",
  "borsh",
@@ -1103,7 +1132,7 @@ dependencies = [
 ]
 
 [[package]]
-name = "fabric"
+name = "fabric-rs"
 version = "0.1.0"
 dependencies = [
  "dashmap",
@@ -1759,7 +1788,7 @@ version = "0.1.0"
 dependencies = [
  "axum",
  "borsh",
- "fabric",
+ "fabric-rs",
  "hex",
  "libveritas",
  "libveritas_testutil",
@@ -2006,8 +2035,9 @@ dependencies = [
 
 [[package]]
 name = "libveritas"
-version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/libveritas.git#b9163abd6361ccdd0a61ea35859ae1244fd6d823"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75cf115fd0ad4269e52e6887481c216735a72b8e6c606317bbe9b97a3b7f19e3"
 dependencies = [
  "base64 0.22.1",
  "borsh",
@@ -2024,8 +2054,9 @@ dependencies = [
 
 [[package]]
 name = "libveritas_testutil"
-version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/libveritas.git#b9163abd6361ccdd0a61ea35859ae1244fd6d823"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69a2e9b822fcdb97d696d8b354148dc283f0119b0589dc67a309a71e911b525"
 dependencies = [
  "bitcoin",
  "borsh",
@@ -2042,8 +2073,9 @@ dependencies = [
 
 [[package]]
 name = "libveritas_zk"
-version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/libveritas.git#b9163abd6361ccdd0a61ea35859ae1244fd6d823"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c67914770647dd88766cd7da471776bebd28751dd561d7782e978b12d9524cf"
 dependencies = [
  "borsh",
  "serde",
@@ -2723,10 +2755,11 @@ dependencies = [
  "anyhow",
  "axum",
  "base64 0.22.1",
+ "bitcoin_yuki",
  "borsh",
  "clap",
  "env_logger",
- "fabric",
+ "fabric-rs",
  "governor",
  "hex",
  "libveritas",
@@ -2745,7 +2778,6 @@ dependencies = [
  "tower-http",
  "tracing",
  "url",
- "yuki",
 ]
 
 [[package]]
@@ -3372,7 +3404,8 @@ checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 [[package]]
 name = "sip7"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b684197991554bec0801fb44663974608d59ac6df4f95d2d84a3955e82499a85"
 dependencies = [
  "base64 0.22.1",
  "hex",
@@ -3430,8 +3463,9 @@ dependencies = [
 
 [[package]]
 name = "spacedb"
-version = "0.0.12"
-source = "git+https://github.com/spacesprotocol/spacedb.git#43f23e78e4e5fffb8d89661a4b7f39ab43a5a644"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a48cda82e951391df9d0a54c96f8b04e117ff39abad5359b181cb71c80798d77"
 dependencies = [
  "bincode",
  "borsh",
@@ -3444,7 +3478,8 @@ dependencies = [
 [[package]]
 name = "spaces_checkpoint"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "044392ea966b553c792fcf85b72e4da08ea2c8ea37ded4eeb43cb491be528de4"
 dependencies = [
  "anyhow",
  "clap",
@@ -3462,8 +3497,9 @@ dependencies = [
 
 [[package]]
 name = "spaces_client"
-version = "0.0.7"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d817eddfabcd6d3115f1c5c9b19a0f64ead6542d216a79dac1afe9d7c19ffb4"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -3497,7 +3533,8 @@ dependencies = [
 [[package]]
 name = "spaces_nums"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2015555e35781fc95ac0eb8e50bef6e70929248ea61d4101b195b4d0abb13e1d"
 dependencies = [
  "bech32",
  "bitcoin",
@@ -3511,8 +3548,9 @@ dependencies = [
 
 [[package]]
 name = "spaces_protocol"
-version = "0.0.7"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f46b7eb14311193304301a394a30e5f7bdfd7fd9f70a5c8113610bf2b5cc2c"
 dependencies = [
  "bitcoin",
  "borsh",
@@ -3522,11 +3560,12 @@ dependencies = [
 
 [[package]]
 name = "spaces_wallet"
-version = "0.0.7"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#b2e982ce231928e637973df4cc1d5933579d2bd6"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703c9b4b9d4fa4c7097bf46a471699604f1bc3102559609ab66e97c8965258b0"
 dependencies = [
  "anyhow",
- "bdk_wallet",
+ "bdk_wallet_backport",
  "bech32",
  "bitcoin",
  "borsh",
@@ -4542,30 +4581,6 @@ dependencies = [
  "synstructure",
 ]
 
-[[package]]
-name = "yuki"
-version = "0.0.1"
-source = "git+https://github.com/imperviousinc/yuki.git#f638494a20f13ff87bfa1d962ee1d5586957483a"
-dependencies = [
- "anyhow",
- "bincode",
- "bip324",
- "bitcoin",
- "clap",
- "env_logger",
- "futures-util",
- "hex",
- "jsonrpsee",
- "reqwest",
- "rusqlite",
- "serde",
- "serde_json",
- "tokio",
- "tokio-util",
- "tracing",
- "tracing-subscriber 0.3.23",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.8.48"
diff --git a/Cargo.toml b/Cargo.toml
index 0037337..2800acc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,12 +2,22 @@
 resolver = "2"
 members = ["fabric/rust", "relay", "tests"]
 
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.85"
+license = "MIT"
+repository = "https://github.com/spacesprotocol/certrelay"
+homepage = "https://spacesprotocol.org"
+authors = ["Buffrr <contact@buffrr.dev>"]
+
 [workspace.dependencies]
-libveritas = { git = "https://github.com/spacesprotocol/libveritas.git" }
-libveritas_testutil = { git = "https://github.com/spacesprotocol/libveritas.git" }
+fabric-rs = { path = "fabric/rust", version = "0.1.0" }
+libveritas = { version = "0.1" }
+libveritas_testutil = { version = "0.1" }
 
-spaces_client = {git = "https://github.com/spacesprotocol/spaces.git", branch = "subspaces"}
-spaces_protocol = {git = "https://github.com/spacesprotocol/spaces.git", branch = "subspaces"}
-spaces_nums = {git = "https://github.com/spacesprotocol/spaces.git", branch = "subspaces"}
-spaces_checkpoint = {git = "https://github.com/spacesprotocol/spaces.git", branch = "subspaces"}
-spacedb = { git = "https://github.com/spacesprotocol/spacedb.git", features = ["hash-idx"] }
+spaces_client = { version = "0.1" }
+spaces_protocol = { version = "0.1" }
+spaces_nums = { version = "0.1" }
+spaces_checkpoint = { version = "0.1" }
+spacedb = { version = "0.1", features = ["hash-idx"] }
diff --git a/fabric/examples/rust/Cargo.lock b/fabric/examples/rust/Cargo.lock
index fe7525c..7d5f091 100644
--- a/fabric/examples/rust/Cargo.lock
+++ b/fabric/examples/rust/Cargo.lock
@@ -410,7 +410,8 @@ dependencies = [
 [[package]]
 name = "borsh_utils"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#8bfdffc02d7a49c07f7bf7da77d63a606a502515"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c0cd2efcc60ce44ca958baa626593a23006b5418b1fa8f038c23aa85f7a97f"
 dependencies = [
  "bitcoin",
  "borsh",
@@ -1157,8 +1158,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libveritas"
-version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/libveritas.git#a7d86225bac32cf26383cd8b9d2fcff6d8ce7829"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75cf115fd0ad4269e52e6887481c216735a72b8e6c606317bbe9b97a3b7f19e3"
 dependencies = [
  "base64 0.22.1",
  "borsh",
@@ -1175,8 +1177,9 @@ dependencies = [
 
 [[package]]
 name = "libveritas_zk"
-version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/libveritas.git#a7d86225bac32cf26383cd8b9d2fcff6d8ce7829"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c67914770647dd88766cd7da471776bebd28751dd561d7782e978b12d9524cf"
 dependencies = [
  "borsh",
  "serde",
@@ -2019,7 +2022,8 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 [[package]]
 name = "sip7"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#8bfdffc02d7a49c07f7bf7da77d63a606a502515"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b684197991554bec0801fb44663974608d59ac6df4f95d2d84a3955e82499a85"
 dependencies = [
  "base64 0.22.1",
  "hex",
@@ -2051,8 +2055,9 @@ dependencies = [
 
 [[package]]
 name = "spacedb"
-version = "0.0.12"
-source = "git+https://github.com/spacesprotocol/spacedb.git#43f23e78e4e5fffb8d89661a4b7f39ab43a5a644"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a48cda82e951391df9d0a54c96f8b04e117ff39abad5359b181cb71c80798d77"
 dependencies = [
  "borsh",
  "sha2",
@@ -2061,7 +2066,8 @@ dependencies = [
 [[package]]
 name = "spaces_nums"
 version = "0.1.0"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#8bfdffc02d7a49c07f7bf7da77d63a606a502515"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2015555e35781fc95ac0eb8e50bef6e70929248ea61d4101b195b4d0abb13e1d"
 dependencies = [
  "bech32",
  "bitcoin",
@@ -2075,8 +2081,9 @@ dependencies = [
 
 [[package]]
 name = "spaces_protocol"
-version = "0.0.7"
-source = "git+https://github.com/spacesprotocol/spaces.git?branch=subspaces#8bfdffc02d7a49c07f7bf7da77d63a606a502515"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f46b7eb14311193304301a394a30e5f7bdfd7fd9f70a5c8113610bf2b5cc2c"
 dependencies = [
  "bitcoin",
  "borsh",
diff --git a/fabric/go/go.mod b/fabric/go/go.mod
index 25a4b87..1cc1bf7 100644
--- a/fabric/go/go.mod
+++ b/fabric/go/go.mod
@@ -4,7 +4,7 @@ go 1.22
 
 require (
 	github.com/btcsuite/btcd/btcec/v2 v2.3.6
-	github.com/spacesprotocol/libveritas-go v0.0.0-dev.20260407170108
+	github.com/spacesprotocol/libveritas-go v0.1.2
 )
 
 require (
diff --git a/fabric/go/go.sum b/fabric/go/go.sum
index 6c01b1f..173fd97 100644
--- a/fabric/go/go.sum
+++ b/fabric/go/go.sum
@@ -8,5 +8,5 @@ github.com/decred/dcrd/crypto/blake256 v1.0.0 h1:/8DMNYp9SGi5f0w7uCm6d6M4OU2rGFK
 github.com/decred/dcrd/crypto/blake256 v1.0.0/go.mod h1:sQl2p6Y26YV+ZOcSTP6thNdn47hh8kt6rqSlvmrXFAc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 h1:YLtO71vCjJRCBcrPMtQ9nqBsqpA1m5sE92cU+pd5Mcc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeCxkaw7y45JueMRL4DIyJDKs=
-github.com/spacesprotocol/libveritas-go v0.0.0-dev.20260407170108 h1:tpFQOIBRJpM0dYYc4VpAh/OayA8ZPvqr1taTuSZdQ98=
-github.com/spacesprotocol/libveritas-go v0.0.0-dev.20260407170108/go.mod h1:HXnX2FNL43ueJuedsQwX9GF5jRHYZLqXYfFLWz900H8=
+github.com/spacesprotocol/libveritas-go v0.1.2 h1:uMhRnQaPWgDIJtYGXo9wO10aav36G8lmgWXK3gw73gc=
+github.com/spacesprotocol/libveritas-go v0.1.2/go.mod h1:HXnX2FNL43ueJuedsQwX9GF5jRHYZLqXYfFLWz900H8=
diff --git a/fabric/js/fabric-web/package.json b/fabric/js/fabric-web/package.json
index 4b40008..afc69b2 100644
--- a/fabric/js/fabric-web/package.json
+++ b/fabric/js/fabric-web/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "@noble/curves": "^1.8.0",
     "@spacesprotocol/fabric-core": "*",
-    "@spacesprotocol/libveritas": "^0.0.0-dev.20260407165333"
+    "@spacesprotocol/libveritas": "^0.1.2"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
diff --git a/fabric/js/fabric-web/src/index.ts b/fabric/js/fabric-web/src/index.ts
index d1fa2ac..bd6a4f0 100644
--- a/fabric/js/fabric-web/src/index.ts
+++ b/fabric/js/fabric-web/src/index.ts
@@ -7,20 +7,41 @@ import * as libveritas from "@spacesprotocol/libveritas";
 
 export type FabricOptions = Omit<CoreOptions, "provider">;
 
+const wasmInit: (() => Promise<any>) | undefined =
+  (libveritas as any).default ?? (libveritas as any).init ?? (libveritas as any).__wbg_init;
+
+let wasmReady: Promise<void> | null = null;
+
+async function ensureInit(): Promise<void> {
+  if (!wasmInit) return;
+  if (!wasmReady) {
+    wasmReady = wasmInit().catch(() => {
+      // Already initialized (bundler environments) — safe to ignore
+      wasmReady = Promise.resolve();
+    });
+  }
+  await wasmReady;
+}
+
 /**
- * Initialize the WASM module. Must be called before using Fabric
- * when loading via `<script type="module">`, esm.sh, Deno, or
- * any non-bundler environment. Safe to call multiple times.
- *
- * Not needed when using a bundler (webpack, vite, etc.).
+ * Initialize the WASM module manually. Usually not needed —
+ * Fabric auto-initializes on first use. Call this if you need
+ * to control when the WASM binary is loaded (e.g. during app startup).
  */
-export const init: (() => Promise<any>) | undefined =
-  (libveritas as any).default ?? (libveritas as any).init ?? (libveritas as any).__wbg_init;
+export async function init(): Promise<void> {
+  await ensureInit();
+}
 
 export class Fabric extends FabricCore {
   constructor(options?: FabricOptions) {
     super({ ...options, provider: wasmProvider(libveritas) });
   }
+
+  /** @internal Auto-initialize WASM before any network call. */
+  override async bootstrap(): Promise<void> {
+    await ensureInit();
+    return super.bootstrap();
+  }
 }
 
 // Re-export useful types from core
diff --git a/fabric/kotlin/build.gradle.kts b/fabric/kotlin/build.gradle.kts
index dab75f6..3363314 100644
--- a/fabric/kotlin/build.gradle.kts
+++ b/fabric/kotlin/build.gradle.kts
@@ -19,9 +19,9 @@ dependencies {
     // compileOnly — consumers provide the right variant at runtime:
     //   Android: org.spacesprotocol:libveritas (AAR)
     //   JVM:     org.spacesprotocol:libveritas-jvm (JAR)
-    compileOnly("org.spacesprotocol:libveritas-jvm:0.0.0-dev.20260407170200")
+    compileOnly("org.spacesprotocol:libveritas-jvm:0.1.2")
     // CLI needs it at runtime
-    runtimeOnly("org.spacesprotocol:libveritas-jvm:0.0.0-dev.20260407170200")
+    runtimeOnly("org.spacesprotocol:libveritas-jvm:0.1.2")
 
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.3")
     compileOnly("fr.acinq.secp256k1:secp256k1-kmp:0.17.3")
diff --git a/fabric/python/pyproject.toml b/fabric/python/pyproject.toml
index 85274f1..8693f64 100644
--- a/fabric/python/pyproject.toml
+++ b/fabric/python/pyproject.toml
@@ -3,7 +3,7 @@ name = "fabric-resolver"
 version = "0.1.0"
 description = "Python client for the certrelay fabric network"
 requires-python = ">=3.10"
-dependencies = ["libveritas==0.0.0.dev20260407165216"]
+dependencies = ["libveritas>=0.1.2"]
 
 [project.optional-dependencies]
 signing = ["coincurve"]
diff --git a/fabric/rust/Cargo.toml b/fabric/rust/Cargo.toml
index c403ab7..f23989f 100644
--- a/fabric/rust/Cargo.toml
+++ b/fabric/rust/Cargo.toml
@@ -1,10 +1,23 @@
 [package]
+name = "fabric-rs"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+authors.workspace = true
+description = "Client library for the Spaces protocol certificate relay network."
+documentation = "https://docs.rs/fabric-rs"
+keywords = ["spaces", "fabric", "dns", "certificates"]
+categories = ["network-programming"]
+
+[lib]
 name = "fabric"
-version = "0.1.0"
-edition = "2024"
 
 [[bin]]
 name = "fabric"
+path = "src/main.rs"
 required-features = ["client"]
 
 [features]
diff --git a/fabric/rust/src/anchor.rs b/fabric/rust/src/anchor.rs
index 824ab4a..15d03d4 100644
--- a/fabric/rust/src/anchor.rs
+++ b/fabric/rust/src/anchor.rs
@@ -1,7 +1,7 @@
-use std::collections::HashMap;
+use crate::{AnchorSet, TrustId};
 use libveritas::compute_trust_set;
 use spaces_nums::RootAnchor;
-use crate::{AnchorSet, TrustId};
+use std::collections::HashMap;
 
 const ANCHOR_SET_SIZE: usize = 60;
 
@@ -25,8 +25,8 @@ impl AnchorSets {
     }
 
     pub fn latest(&self) -> Option<&AnchorSet> {
-        self.sets.values().max_by_key(|s| {
-            s.entries.last().map(|a| a.block.height).unwrap_or(0)
-        })
+        self.sets
+            .values()
+            .max_by_key(|s| s.entries.last().map(|a| a.block.height).unwrap_or(0))
     }
-}
\ No newline at end of file
+}
diff --git a/fabric/rust/src/client.rs b/fabric/rust/src/client.rs
index 82cf66a..1540fae 100644
--- a/fabric/rust/src/client.rs
+++ b/fabric/rust/src/client.rs
@@ -1,22 +1,27 @@
+use crate::seeds::SEEDS;
+pub use crate::{
+    AnchorSet, EpochHint, HintsResponse, Message, PeerInfo, Query, QueryRequest, TrustId,
+};
 use libveritas::cert::CertificateChain;
-use libveritas::msg::{QueryContext};
+use libveritas::msg::QueryContext;
 use libveritas::spaces_protocol::sname::{NameLike, SName};
-use libveritas::{compute_trust_set, MessageError, ProvableOption, SovereigntyState, TrustSet, VerifiedMessage, Veritas, Zone};
+use libveritas::{
+    MessageError, ProvableOption, SovereigntyState, TrustSet, VerifiedMessage, Veritas, Zone,
+    compute_trust_set,
+};
 use rand::seq::SliceRandom;
+use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet};
 use std::fmt;
 use std::str::FromStr;
 use std::sync::Mutex;
 use std::sync::atomic::{AtomicBool, Ordering};
-use serde::{Deserialize, Serialize};
-pub use crate::{AnchorSet, EpochHint, HintsResponse, Message, PeerInfo, Query, QueryRequest, TrustId};
-use crate::seeds::SEEDS;
 
 #[cfg(feature = "signing")]
 use libveritas::{
     builder::MessageBuilder,
     msg::ChainProof,
-    sip7::{SIG_PRIMARY_ZONE, RecordSet}
+    sip7::{RecordSet, SIG_PRIMARY_ZONE},
 };
 
 pub type Result<T> = std::result::Result<T, Error>;
@@ -35,11 +40,12 @@ impl ScanParams {
     /// Parse a `veritas://scan?id={hex}` URI.
     pub fn parse(uri: &str) -> Result<Self> {
         let uri = uri.trim();
-        let query = uri.strip_prefix("veritas://scan?")
-            .ok_or_else(|| std::io::Error::new(
+        let query = uri.strip_prefix("veritas://scan?").ok_or_else(|| {
+            std::io::Error::new(
                 std::io::ErrorKind::InvalidData,
                 "expected veritas://scan?... URI",
-            ))?;
+            )
+        })?;
 
         let mut id = None;
         for pair in query.split('&') {
@@ -51,10 +57,9 @@ impl ScanParams {
         }
 
         Ok(Self {
-            id: id.ok_or_else(|| std::io::Error::new(
-                std::io::ErrorKind::InvalidData,
-                "missing id parameter",
-            ))?,
+            id: id.ok_or_else(|| {
+                std::io::Error::new(std::io::ErrorKind::InvalidData, "missing id parameter")
+            })?,
         })
     }
 }
@@ -93,7 +98,7 @@ impl AnchorPool {
         all.extend_from_slice(&self.trusted);
         all.extend_from_slice(&self.semi_trusted);
         all.extend_from_slice(&self.observed);
-        all.sort_by(|a, b| b.block.height.cmp(&a.block.height));
+        all.sort_by_key(|a| std::cmp::Reverse(a.block.height));
         all.dedup_by_key(|a| a.block.height);
         all
     }
@@ -152,6 +157,12 @@ pub struct Resolved {
     pub relays: Vec<String>,
 }
 
+impl Default for Fabric {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl Fabric {
     /// Create a new client with the default seeds.
     pub fn new() -> Self {
@@ -190,7 +201,7 @@ impl Fabric {
                 return false;
             }
         }
-       true
+        true
     }
 
     fn are_roots_observed(&self, roots: &[TrustId]) -> bool {
@@ -263,17 +274,29 @@ impl Fabric {
 
     /// The trusted trust id, pinned explicitly with trust()
     pub fn trusted(&self) -> Option<TrustId> {
-        self.trusted.lock().unwrap().as_ref().map(|t| TrustId::from(t.id))
+        self.trusted
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(|t| TrustId::from(t.id))
     }
 
     /// The latest trust id observed from peers, if any.
     pub fn observed(&self) -> Option<TrustId> {
-        self.observed.lock().unwrap().as_ref().map(|t| TrustId::from(t.id))
+        self.observed
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(|t| TrustId::from(t.id))
     }
 
     /// The semi-trusted trust id, if any.
     pub fn semi_trusted(&self) -> Option<TrustId> {
-        self.semi_trusted.lock().unwrap().as_ref().map(|t| TrustId::from(t.id))
+        self.semi_trusted
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(|t| TrustId::from(t.id))
     }
 
     /// Pin trust directly from an AnchorSet. No network requests.
@@ -283,7 +306,8 @@ impl Fabric {
         let id = TrustId::from(trust_set.id);
         let mut pool = self.anchor_pool.lock().unwrap();
         pool.trusted = set.entries.clone();
-        let v = Veritas::new().with_anchors(pool.merged())
+        let v = Veritas::new()
+            .with_anchors(pool.merged())
             .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{e:?}")))?;
         *self.veritas.lock().unwrap() = v;
         *self.trusted.lock().unwrap() = Some(trust_set);
@@ -323,9 +347,7 @@ impl Fabric {
                 let peers = self.pool.shuffled_urls_n(4);
                 (*id, peers)
             }
-            TrustKind::Observed => {
-                fetch_latest_trust_id(&self.http, &self.seeds).await?
-            }
+            TrustKind::Observed => fetch_latest_trust_id(&self.http, &self.seeds).await?,
         };
 
         let ab = fetch_anchor_set(&self.http, id, &peers).await?;
@@ -400,12 +422,13 @@ impl Fabric {
         Ok(())
     }
 
-
     /// Resolve a single handle and return its verified Zone.
     /// Supports dotted names like `hello.alice@bitcoin`.
     pub async fn resolve(&self, handle: &str) -> Result<Option<Resolved>> {
         let rb = self.resolve_all(&[handle]).await?;
-        let zone = rb.zones.into_iter()
+        let zone = rb
+            .zones
+            .into_iter()
             .find(|z| z.handle.to_string() == handle);
         Ok(zone.map(|z| Resolved {
             zone: z,
@@ -427,17 +450,12 @@ impl Fabric {
         for url in &relays {
             // 1. Fetch reverse mapping
             let reverse_url = format!("{url}/reverse?ids={num_id}");
-            let records: Vec<crate::ReverseRecord> = match self.http
-                .get(&reverse_url)
-                .send()
-                .await
+            let records: Vec<crate::ReverseRecord> = match self.http.get(&reverse_url).send().await
             {
-                Ok(resp) if resp.status().is_success() => {
-                    match resp.json().await {
-                        Ok(r) => r,
-                        Err(_) => continue,
-                    }
-                }
+                Ok(resp) if resp.status().is_success() => match resp.json().await {
+                    Ok(r) => r,
+                    Err(_) => continue,
+                },
                 _ => continue,
             };
 
@@ -458,9 +476,7 @@ impl Fabric {
             };
 
             // 3. Verify num_id matches
-            let zone_num_id = resolved.zone.num_id
-                .as_ref()
-                .map(|id| id.to_string());
+            let zone_num_id = resolved.zone.num_id.as_ref().map(|id| id.to_string());
             if zone_num_id.as_deref() != Some(num_id) {
                 last_err = Some(Error::Decode(std::io::Error::new(
                     std::io::ErrorKind::InvalidData,
@@ -492,17 +508,11 @@ impl Fabric {
         for url in &relays {
             // 1. Fetch addr index
             let addr_url = format!("{url}/addrs?name={name}&addr={addr}");
-            let addr_match: crate::AddrMatch = match self.http
-                .get(&addr_url)
-                .send()
-                .await
-            {
-                Ok(resp) if resp.status().is_success() => {
-                    match resp.json().await {
-                        Ok(r) => r,
-                        Err(_) => continue,
-                    }
-                }
+            let addr_match: crate::AddrMatch = match self.http.get(&addr_url).send().await {
+                Ok(resp) if resp.status().is_success() => match resp.json().await {
+                    Ok(r) => r,
+                    Err(_) => continue,
+                },
                 _ => continue,
             };
 
@@ -511,9 +521,7 @@ impl Fabric {
             }
 
             // 2. Resolve forward using the rev names
-            let rev_names: Vec<String> = addr_match.handles.iter()
-                .map(|e| e.rev.clone())
-                .collect();
+            let rev_names: Vec<String> = addr_match.handles.iter().map(|e| e.rev.clone()).collect();
             let refs: Vec<&str> = rev_names.iter().map(|s| s.as_str()).collect();
             let batch = match self.resolve_all(&refs).await {
                 Ok(b) => b,
@@ -524,13 +532,18 @@ impl Fabric {
             };
 
             // 3. Filter to zones that actually have the matching addr record
-            let matching_zones: Vec<Zone> = batch.zones.into_iter()
+            let matching_zones: Vec<Zone> = batch
+                .zones
+                .into_iter()
                 .filter(|zone| {
-                    zone.records.iter()
-                        .map(|mut rrs| rrs.any(|r| {
-                            matches!(r, libveritas::sip7::ParsedRecord::Addr { key, value }
+                    zone.records
+                        .iter()
+                        .map(|mut rrs| {
+                            rrs.any(|r| {
+                                matches!(r, libveritas::sip7::ParsedRecord::Addr { key, value }
                                 if key == name && value.iter().next() == Some(addr))
-                        }))
+                            })
+                        })
                         .unwrap_or(false)
                 })
                 .collect();
@@ -555,7 +568,8 @@ impl Fabric {
 
     /// Resolve multiple handles, including nested names like `hello.alice@bitcoin`.
     pub async fn resolve_all(&self, handles: &[&str]) -> Result<ResolvedBatch> {
-        let snames: Vec<SName> = handles.iter()
+        let snames: Vec<SName> = handles
+            .iter()
             .filter_map(|h| SName::try_from(*h).ok())
             .collect();
 
@@ -627,14 +641,16 @@ impl Fabric {
     async fn resolve_flat(&self, handles: &[&str]) -> Result<(VerifiedMessage, String)> {
         let mut by_space: HashMap<String, Vec<String>> = HashMap::new();
         for &h in handles {
-            let sname = SName::try_from(h)
-                .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidInput, e.to_string()))?;
-            let space = sname.space()
-                .ok_or_else(|| std::io::Error::new(std::io::ErrorKind::InvalidInput, format!("{h}: no space")))?
+            let sname = SName::try_from(h).map_err(|e| {
+                std::io::Error::new(std::io::ErrorKind::InvalidInput, e.to_string())
+            })?;
+            let space = sname
+                .space()
+                .ok_or_else(|| {
+                    std::io::Error::new(std::io::ErrorKind::InvalidInput, format!("{h}: no space"))
+                })?
                 .to_string();
-            let subspace = sname.subspace()
-                .map(|l| l.to_string())
-                .unwrap_or_default();
+            let subspace = sname.subspace().map(|l| l.to_string()).unwrap_or_default();
             by_space.entry(space).or_default().push(subspace);
         }
 
@@ -709,7 +725,10 @@ impl Fabric {
 
         let mut last_err = Error::NoPeers;
         for url in relays {
-            let mut req = self.http.get(&format!("{url}/query")).query(&[("q", &q_param)]);
+            let mut req = self
+                .http
+                .get(format!("{url}/query"))
+                .query(&[("q", &q_param)]);
             if !hints_param.is_empty() {
                 req = req.query(&[("hints", &hints_param)]);
             }
@@ -742,11 +761,23 @@ impl Fabric {
                     continue;
                 }
             };
-            let msg = Message::from_slice(&bytes).map_err(|e| Error::Decode(
-                std::io::Error::new(e.kind(), format!("{url}/query: decoding message: {e}"))
-            ))?;
-            let options = if self.dev_mode { libveritas::VERIFY_DEV_MODE } else { 0 };
-            match self.veritas.lock().unwrap().verify_with_options(ctx, msg, options) {
+            let msg = Message::from_slice(&bytes).map_err(|e| {
+                Error::Decode(std::io::Error::new(
+                    e.kind(),
+                    format!("{url}/query: decoding message: {e}"),
+                ))
+            })?;
+            let options = if self.dev_mode {
+                libveritas::VERIFY_DEV_MODE
+            } else {
+                0
+            };
+            match self
+                .veritas
+                .lock()
+                .unwrap()
+                .verify_with_options(ctx, msg, options)
+            {
                 Ok(res) => {
                     self.pool.mark_alive(url);
                     return Ok((res, url.clone()));
@@ -778,13 +809,16 @@ impl Fabric {
                 let http = self.http.clone();
                 let hints_url = format!("{url}/hints");
                 let q = hints_query.clone();
-                tasks.push((url.clone(), tokio::spawn(async move {
-                    let resp = http.get(&hints_url).query(&[("q", &q)]).send().await.ok()?;
-                    if !resp.status().is_success() {
-                        return None;
-                    }
-                    resp.json::<HintsResponse>().await.ok()
-                })));
+                tasks.push((
+                    url.clone(),
+                    tokio::spawn(async move {
+                        let resp = http.get(&hints_url).query(&[("q", &q)]).send().await.ok()?;
+                        if !resp.status().is_success() {
+                            return None;
+                        }
+                        resp.json::<HintsResponse>().await.ok()
+                    }),
+                ));
             }
 
             for (url, task) in tasks {
@@ -878,10 +912,12 @@ impl Fabric {
                     let body = resp.text().await.unwrap_or_default();
                     last_err = Some(Error::Relay { status, body });
                 }
-                Err(e) => last_err = Some(Error::Decode(std::io::Error::new(
-                    std::io::ErrorKind::ConnectionRefused,
-                    format!("POST {msg_url}: {e}"),
-                ))),
+                Err(e) => {
+                    last_err = Some(Error::Decode(std::io::Error::new(
+                        std::io::ErrorKind::ConnectionRefused,
+                        format!("POST {msg_url}: {e}"),
+                    )))
+                }
             }
         }
 
@@ -1005,31 +1041,30 @@ fn epoch_hint_from_zone(zone: &Zone) -> Option<EpochHint> {
 
 async fn fetch_peers(http: &reqwest::Client, relay_url: &str) -> Result<Vec<PeerInfo>> {
     let url = format!("{relay_url}/peers");
-    let resp = http.get(&url).send().await
-        .map_err(|e| Error::Decode(std::io::Error::new(
+    let resp = http.get(&url).send().await.map_err(|e| {
+        Error::Decode(std::io::Error::new(
             std::io::ErrorKind::ConnectionRefused,
             format!("GET {url}: {e}"),
-        )))?;
+        ))
+    })?;
     if !resp.status().is_success() {
         let status = resp.status().as_u16();
         let body = resp.text().await.unwrap_or_default();
         return Err(Error::Relay { status, body });
     }
-    resp.json().await.map_err(|e| Error::Decode(std::io::Error::new(
-        std::io::ErrorKind::InvalidData,
-        format!("GET {url}: {e}"),
-    )))
+    resp.json().await.map_err(|e| {
+        Error::Decode(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            format!("GET {url}: {e}"),
+        ))
+    })
 }
 
-
 impl RelayPool {
     fn new(urls: impl IntoIterator<Item = String>) -> Self {
         let entries = urls
             .into_iter()
-            .map(|url| RelayEntry {
-                url,
-                failures: 0,
-            })
+            .map(|url| RelayEntry { url, failures: 0 })
             .collect();
         Self {
             inner: Mutex::new(entries),
@@ -1069,10 +1104,7 @@ impl RelayPool {
         let existing: HashSet<String> = entries.iter().map(|e| e.url.clone()).collect();
         for url in new_urls {
             if !existing.contains(url.as_str()) {
-                entries.push(RelayEntry {
-                    url,
-                    failures: 0,
-                });
+                entries.push(RelayEntry { url, failures: 0 });
             }
         }
     }
@@ -1082,7 +1114,12 @@ impl RelayPool {
     }
 
     pub fn urls(&self) -> Vec<String> {
-        self.inner.lock().unwrap().iter().map(|e| e.url.clone()).collect()
+        self.inner
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|e| e.url.clone())
+            .collect()
     }
 }
 
@@ -1121,14 +1158,20 @@ impl From<MessageError> for Error {
 
 impl From<hex::FromHexError> for Error {
     fn from(e: hex::FromHexError) -> Self {
-        Error::Decode(std::io::Error::new(std::io::ErrorKind::InvalidData, e.to_string()))
+        Error::Decode(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            e.to_string(),
+        ))
     }
 }
 
 /// Fetch latest anchor set hash from the specified set of peers
 ///
 /// Returns: (<root-hash>, <peers...>)
-async fn fetch_latest_trust_id(http: &reqwest::Client, peers: &[String]) -> Result<(TrustId, Vec<String>)> {
+async fn fetch_latest_trust_id(
+    http: &reqwest::Client,
+    peers: &[String],
+) -> Result<(TrustId, Vec<String>)> {
     let mut votes: HashMap<(String, u32), Vec<String>> = HashMap::new();
     let mut last_err: Option<Error> = None;
 
@@ -1167,7 +1210,10 @@ async fn fetch_latest_trust_id(http: &reqwest::Client, peers: &[String]) -> Resu
             .unwrap_or(0);
 
         if let Some(root) = root {
-            votes.entry((root, height)).or_default().push(url.to_string());
+            votes
+                .entry((root, height))
+                .or_default()
+                .push(url.to_string());
         }
     }
 
@@ -1180,8 +1226,6 @@ async fn fetch_latest_trust_id(http: &reqwest::Client, peers: &[String]) -> Resu
     Ok((TrustId::from_str(&hash)?, peers))
 }
 
-
-
 async fn fetch_anchor_set(
     http: &reqwest::Client,
     trust_id: TrustId,
@@ -1190,10 +1234,7 @@ async fn fetch_anchor_set(
     let mut last_err: Option<Error> = None;
     for url in peers {
         let anchor_url = format!("{url}/anchors?root={trust_id}");
-        let resp = match http
-            .get(&anchor_url)
-            .send()
-            .await {
+        let resp = match http.get(&anchor_url).send().await {
             Ok(r) => r,
             Err(e) => {
                 last_err = Some(Error::Decode(std::io::Error::new(
@@ -1240,4 +1281,3 @@ async fn fetch_anchor_set(
 
     Err(last_err.unwrap_or(Error::NoPeers))
 }
-
diff --git a/fabric/rust/src/lib.rs b/fabric/rust/src/lib.rs
index 5dffca6..25e7178 100644
--- a/fabric/rust/src/lib.rs
+++ b/fabric/rust/src/lib.rs
@@ -3,8 +3,6 @@
 //! All protocol types use JSON serialization for cross-language compatibility.
 //! Only the `Message` type from libveritas remains binary (borsh).
 
-
-
 pub mod anchor;
 #[cfg(feature = "client")]
 pub mod client;
@@ -301,9 +299,7 @@ pub struct AddrEntry {
 
 impl AnchorSet {
     pub fn from_anchors(anchors: Vec<RootAnchor>) -> Self {
-        Self {
-            entries: anchors,
-        }
+        Self { entries: anchors }
     }
 }
 
@@ -355,6 +351,3 @@ mod tests {
         assert!(!json.contains("epoch_hint"));
     }
 }
-
-
-
diff --git a/fabric/rust/src/main.rs b/fabric/rust/src/main.rs
index d6340cc..fa2f778 100644
--- a/fabric/rust/src/main.rs
+++ b/fabric/rust/src/main.rs
@@ -14,11 +14,15 @@ async fn main() {
     while let Some(arg) = it.next() {
         match arg.as_str() {
             "--seeds" => {
-                let val = it.next().unwrap_or_else(|| exit_usage("--seeds requires a value"));
+                let val = it
+                    .next()
+                    .unwrap_or_else(|| exit_usage("--seeds requires a value"));
                 seeds = val.split(',').map(|s| s.to_string()).collect();
             }
             "--trust-id" => {
-                let val = it.next().unwrap_or_else(|| exit_usage("--trust-id requires a value"));
+                let val = it
+                    .next()
+                    .unwrap_or_else(|| exit_usage("--trust-id requires a value"));
                 trust_id = Some(TrustId::from_str(val).unwrap_or_else(|e| {
                     eprintln!("error: invalid trust id: {e}");
                     std::process::exit(1);
diff --git a/fabric/rust/src/seeds.rs b/fabric/rust/src/seeds.rs
index 37b7c92..61c96a5 100644
--- a/fabric/rust/src/seeds.rs
+++ b/fabric/rust/src/seeds.rs
@@ -1,6 +1,5 @@
-
 /// Initial set of seeds to discover the relay network.
-pub const SEEDS : &'static [&'static str] = &[
+pub const SEEDS: &[&str] = &[
     "https://relay-cosmos.spacesprotocol.org",
     "https://relay-atlas.spacesprotocol.org",
 ];
diff --git a/fabric/rust/src/signing.rs b/fabric/rust/src/signing.rs
index 57fc854..49df244 100644
--- a/fabric/rust/src/signing.rs
+++ b/fabric/rust/src/signing.rs
@@ -4,7 +4,10 @@ use secp256k1::{Keypair, Message, Secp256k1, XOnlyPublicKey};
 ///
 /// Takes a 32-byte signing ID (e.g. from `unsigned.signing_id`) and a 32-byte secret key.
 /// Returns a 64-byte signature.
-pub fn sign_schnorr(digest: &[u8; 32], secret_key: &[u8; 32]) -> Result<[u8; 64], secp256k1::Error> {
+pub fn sign_schnorr(
+    digest: &[u8; 32],
+    secret_key: &[u8; 32],
+) -> Result<[u8; 64], secp256k1::Error> {
     let secp = Secp256k1::new();
     let keypair = Keypair::from_seckey_slice(&secp, secret_key)?;
     let message = Message::from_digest(*digest);
diff --git a/fabric/swift/Package.swift b/fabric/swift/Package.swift
index 8026cc8..0437329 100644
--- a/fabric/swift/Package.swift
+++ b/fabric/swift/Package.swift
@@ -9,7 +9,7 @@ let package = Package(
         .executable(name: "fabric", targets: ["FabricCLI"]),
     ],
     dependencies: [
-        .package(url: "https://github.com/spacesprotocol/libveritas-swift.git", exact: "0.0.0-dev.20260407170713"),
+        .package(url: "https://github.com/spacesprotocol/libveritas-swift.git", exact: "0.1.2"),
         .package(url: "https://github.com/21-DOT-DEV/swift-secp256k1.git", exact: "0.17.0"),
     ],
     targets: [
diff --git a/relay/Cargo.toml b/relay/Cargo.toml
index 7d0e28f..fb7978e 100644
--- a/relay/Cargo.toml
+++ b/relay/Cargo.toml
@@ -1,7 +1,8 @@
 [package]
 name = "relay"
-version = "0.1.0"
-edition = "2024"
+version.workspace = true
+edition.workspace = true
+publish = false
 
 [[bin]]
 name = "certrelay"
@@ -10,7 +11,7 @@ path = "src/main.rs"
 [dependencies]
 clap = { version = "4", features = ["derive", "env"] }
 libveritas = { workspace = true }
-resolver = { path = "../fabric/rust", package = "fabric", default-features = false }
+resolver = { path = "../fabric/rust", package = "fabric-rs", default-features = false }
 spaces_protocol = { workspace = true }
 spaces_client = { workspace = true }
 spaces_nums = { workspace = true }
@@ -27,7 +28,7 @@ tokio = { version = "1.37", features = ["sync", "rt-multi-thread", "macros"] }
 rand = "0.9"
 sha2 = "0.10"
 tracing = "0.1"
-yuki = {git = "https://github.com/imperviousinc/yuki.git" }
+yuki = { version = "0.0.1", package = "bitcoin_yuki" }
 env_logger = "0.11.9"
 hex = "0.4.3"
 tower-http = { version = "0.6", features = ["cors"] }
diff --git a/relay/src/app.rs b/relay/src/app.rs
index 397606e..4e2708c 100644
--- a/relay/src/app.rs
+++ b/relay/src/app.rs
@@ -1,14 +1,23 @@
 use std::path::PathBuf;
 
+use crate::anchor::AnchorSets;
+use crate::{
+    AppState, BOOTSTRAP_RELAYS, Config, ExtendedNetwork, Relay, ServiceRunner, bootstrap,
+    bootstrap_from, create_relay_veritas,
+};
 use clap::Parser;
 use spacedb::Configuration;
+use spaces_checkpoint::{
+    CHECKPOINT_BASE_URL, CHECKPOINT_FILES, ensure_checkpoint, fetch_latest, integrity,
+    needs_checkpoint,
+};
 use spaces_client::store::chain::ROOT_ANCHORS_COUNT;
-use spaces_checkpoint::{needs_checkpoint, fetch_latest, ensure_checkpoint, integrity, CHECKPOINT_BASE_URL, CHECKPOINT_FILES};
-use crate::{bootstrap, bootstrap_from, create_relay_veritas, AppState, Config, ExtendedNetwork, Relay, ServiceRunner, BOOTSTRAP_RELAYS};
-use crate::anchor::AnchorSets;
 
 #[derive(Parser)]
-#[command(name = "certrelay", about = "Certificate relay for the Spaces protocol")]
+#[command(
+    name = "certrelay",
+    about = "Certificate relay for the Spaces protocol"
+)]
 struct Args {
     /// Network to use
     #[arg(long, default_value = "mainnet", env = "CERTRELAY_CHAIN")]
@@ -67,8 +76,6 @@ pub async fn run(
     let data_dir = args.data_dir.unwrap_or_else(default_data_dir);
     std::fs::create_dir_all(&data_dir)?;
 
-
-
     // Start embedded yuki + spaced if no external spaced URL was provided
     let mut spaced_url = args.spaced_rpc_url;
     if spaced_url.is_none() {
@@ -106,7 +113,8 @@ pub async fn run(
 
                 yuki_checkpoint = Some(checkpoint.block_id());
 
-                let digest = checkpoint.digest_bytes()
+                let digest = checkpoint
+                    .digest_bytes()
                     .map_err(|e| anyhow::anyhow!("invalid checkpoint digest: {e}"))?;
                 let url = checkpoint.url(CHECKPOINT_BASE_URL);
 
@@ -136,23 +144,26 @@ pub async fn run(
             let _ = std::fs::write(&yuki_checkpoint_file, cp);
         }
 
-        let runner = ServiceRunner::new(data_dir.clone(), args.chain, yuki_checkpoint, shutdown.clone());
+        let runner = ServiceRunner::new(
+            data_dir.clone(),
+            args.chain,
+            yuki_checkpoint,
+            shutdown.clone(),
+        );
         let spaced_auth_url = runner.spaced_url_with_auth();
         tracing::info!(
             "starting embedded services (yuki + spaced) for {}",
             args.chain
         );
-        std::thread::Builder::new()
-            .name("services".into())
-            .spawn({
-                let shutdown = shutdown.clone();
-                move || {
-                    if let Err(e) = runner.run() {
-                        tracing::error!("embedded services failed: {e}");
-                        let _ = shutdown.send(());
-                    }
+        std::thread::Builder::new().name("services".into()).spawn({
+            let shutdown = shutdown.clone();
+            move || {
+                if let Err(e) = runner.run() {
+                    tracing::error!("embedded services failed: {e}");
+                    let _ = shutdown.send(());
                 }
-            })?;
+            }
+        })?;
 
         // Use the authenticated URL for the embedded spaced
         spaced_url = Some(spaced_auth_url);
@@ -291,7 +302,7 @@ pub fn build_hash_indexes_for_checkpoint(spaces_dir: PathBuf) -> anyhow::Result<
         }
         let path = spaces_dir.join(file);
         let Some(db_path) = path.to_str() else {
-            continue
+            continue;
         };
         build_hash_indexes_for_snapshots(db_path)?;
     }
@@ -303,8 +314,7 @@ pub fn build_hash_indexes_for_snapshots(db_path: &str) -> anyhow::Result<()> {
     tracing::info!("building hash indexes for snapshots ....");
     let db = spacedb::db::Database::open_with_config(
         db_path,
-        Configuration::standard()
-            .with_cache_size(500_000_000 /* 500 MB */)
+        Configuration::standard().with_cache_size(500_000_000 /* 500 MB */),
     )?;
 
     for (num, snapshot) in db.iter().enumerate() {
diff --git a/relay/src/handler.rs b/relay/src/handler.rs
index 2895873..682e8c3 100644
--- a/relay/src/handler.rs
+++ b/relay/src/handler.rs
@@ -1,21 +1,21 @@
-use std::num::NonZeroU32;
+use crate::anchor::AnchorSets;
+use crate::spaced::SpacedClient;
+use crate::store::{HandleRecord, SqliteStore};
 use governor::DefaultKeyedRateLimiter;
 use governor::Quota;
-use libveritas::cert::{Witness};
+use libveritas::builder::{DataUpdateRequest, MessageBuilder};
+use libveritas::cert::Witness;
 use libveritas::msg::{self, QueryContext};
-use libveritas::spaces_protocol::sname::{Subname, NameLike, SName};
+use libveritas::sip7::{ParsedRecord, SIG_PRIMARY_ZONE};
+use libveritas::spaces_protocol::sname::{NameLike, SName, Subname};
 use libveritas::{ProvableOption, Veritas, Zone};
+use resolver::{EpochResult, HandleHint, SpaceHint};
 use spaces_protocol::slabel::SLabel;
 use std::collections::{HashMap, HashSet};
+use std::num::NonZeroU32;
 use std::str::FromStr;
 use std::sync::Mutex;
 use std::sync::atomic::{AtomicU64, Ordering};
-use libveritas::builder::{DataUpdateRequest, MessageBuilder};
-use libveritas::sip7::{ParsedRecord, SIG_PRIMARY_ZONE};
-use resolver::{EpochResult, HandleHint, SpaceHint};
-use crate::anchor::AnchorSets;
-use crate::spaced::SpacedClient;
-use crate::store::{HandleRecord, SqliteStore};
 
 /// Certificate handler that verifies messages and stores zones/handles.
 pub struct Handler {
@@ -38,9 +38,9 @@ impl Handler {
             anchor_store: Mutex::new(anchor_store),
             store,
             dev_mode: false,
-            space_rate: governor::RateLimiter::keyed(
-                Quota::per_minute(NonZeroU32::new(100).unwrap()),
-            ),
+            space_rate: governor::RateLimiter::keyed(Quota::per_minute(
+                NonZeroU32::new(100).unwrap(),
+            )),
             handle_rate: governor::RateLimiter::keyed(
                 Quota::with_period(std::time::Duration::from_secs(300))
                     .unwrap()
@@ -72,13 +72,11 @@ impl Handler {
                 None => {
                     builder.add_cert(libveritas::cert::Certificate {
                         version: 0,
-                        subject:  SName::from_space(&space),
-                        witness: Witness::Root {
-                            receipt: None,
-                        },
+                        subject: SName::from_space(&space),
+                        witness: Witness::Root { receipt: None },
                     });
                     continue;
-                },
+                }
             };
             let mut parent_cert = parent.cert;
             // Skip receipt if client can verify from their cached epoch
@@ -86,16 +84,15 @@ impl Handler {
                 .epoch_hint
                 .as_ref()
                 .is_some_and(|h| epoch_hint_verifiable_by(h, &parent.zone))
+                && let Witness::Root { receipt } = &mut parent_cert.witness
             {
-                if let Witness::Root { receipt } = &mut parent_cert.witness {
-                    std::mem::take(receipt);
-                }
+                std::mem::take(receipt);
             }
 
             builder.add_update(DataUpdateRequest {
                 handle: parent_cert.subject.clone(),
                 records: Some(parent.zone.records.clone()),
-                delegate_records: if let ProvableOption::Exists {value } = parent.zone.delegate {
+                delegate_records: if let ProvableOption::Exists { value } = parent.zone.delegate {
                     Some(value.records)
                 } else {
                     None
@@ -121,7 +118,8 @@ impl Handler {
                 builder.add_update(DataUpdateRequest {
                     handle: handle.cert.subject.clone(),
                     records: Some(handle.zone.records),
-                    delegate_records: if let ProvableOption::Exists {value } = handle.zone.delegate {
+                    delegate_records: if let ProvableOption::Exists { value } = handle.zone.delegate
+                    {
                         Some(value.records)
                     } else {
                         None
@@ -133,14 +131,18 @@ impl Handler {
         let chain = chain.prove(&builder.chain_proof_request()).await?;
         let (msg, unsigned) = builder.build(chain)?;
         if !unsigned.is_empty() && unsigned.iter().all(|u| !u.records.is_empty()) {
-            let missing_sigs = unsigned.iter().map(|u| u.canonical.to_string())
-                .collect::<Vec<_>>().join(", ");
-
-            return Err(anyhow::anyhow!("Could not build response: missing signatures for {}",
-                missing_sigs)
-            );
+            let missing_sigs = unsigned
+                .iter()
+                .map(|u| u.canonical.to_string())
+                .collect::<Vec<_>>()
+                .join(", ");
+
+            return Err(anyhow::anyhow!(
+                "Could not build response: missing signatures for {}",
+                missing_sigs
+            ));
         }
-        
+
         Ok(msg)
     }
 
@@ -156,10 +158,11 @@ impl Handler {
         };
 
         let all_rows = self.store.get_handle_hints(handles)?;
-        for space in handles.iter().filter(|h| h.starts_with("@") || h.starts_with("#")) {
-            let Some(space_row) = all_rows
-                .iter()
-                .find(|r| &r.handle == space) else {
+        for space in handles
+            .iter()
+            .filter(|h| h.starts_with("@") || h.starts_with("#"))
+        {
+            let Some(space_row) = all_rows.iter().find(|r| &r.handle == space) else {
                 continue;
             };
 
@@ -171,9 +174,13 @@ impl Handler {
                 epochs: vec![],
             };
             for row in all_rows
-                .iter().filter(|r| r.handle.ends_with(space) && r.handle != *space)
-                .collect::<Vec<_>>() {
-                let idx = hint.epochs.iter()
+                .iter()
+                .filter(|r| r.handle.ends_with(space) && r.handle != *space)
+                .collect::<Vec<_>>()
+            {
+                let idx = hint
+                    .epochs
+                    .iter()
                     .position(|x| x.epoch == row.epoch_height)
                     .unwrap_or_else(|| {
                         hint.epochs.push(EpochResult {
@@ -200,7 +207,11 @@ impl Handler {
     /// and stores any new handle records.
     pub fn handle_message(&self, msg: msg::Message) -> anyhow::Result<()> {
         // Periodically clean up expired rate limiter entries
-        if self.msg_count.fetch_add(1, Ordering::Relaxed) % 10_000 == 0 {
+        if self
+            .msg_count
+            .fetch_add(1, Ordering::Relaxed)
+            .is_multiple_of(10_000)
+        {
             self.space_rate.retain_recent();
             self.handle_rate.retain_recent();
             self.space_rate.shrink_to_fit();
@@ -216,8 +227,15 @@ impl Handler {
         }
 
         // Verify the message
-        let options = if self.dev_mode { libveritas::VERIFY_DEV_MODE } else { 0 };
-        let res = self.veritas.lock().unwrap()
+        let options = if self.dev_mode {
+            libveritas::VERIFY_DEV_MODE
+        } else {
+            0
+        };
+        let res = self
+            .veritas
+            .lock()
+            .unwrap()
             .verify_with_options(&ctx, msg, options)?;
 
         // Build zone lookup by canonical name and epoch height by space
@@ -248,37 +266,40 @@ impl Handler {
                 let handle_str = cert.subject.to_string();
                 let zone = zone_map.get(&handle_str)?;
 
-
-                    if zone.records.as_slice().len() > MAX_RECORDS_SIZE {
-                        tracing::warn!("{}: records exceed {} bytes, skipping", handle_str, MAX_RECORDS_SIZE);
-                        return None;
+                if zone.records.as_slice().len() > MAX_RECORDS_SIZE {
+                    tracing::warn!(
+                        "{}: records exceed {} bytes, skipping",
+                        handle_str,
+                        MAX_RECORDS_SIZE
+                    );
+                    return None;
+                }
+                if let Some(sig) = zone.records.sig() {
+                    let rev_name = sig.handle.to_string();
+                    if sig.flags & SIG_PRIMARY_ZONE == SIG_PRIMARY_ZONE
+                        && let Some(num_id) = &zone.num_id
+                    {
+                        revs.push((num_id.to_string(), rev_name.clone()));
                     }
-                    if let Some(sig) = zone.records.sig() {
-                        let rev_name = sig.handle.to_string();
-                        if sig.flags & SIG_PRIMARY_ZONE == SIG_PRIMARY_ZONE {
-                            if let Some(num_id) = &zone.num_id {
-                                revs.push((num_id.to_string(), rev_name.clone()));
-                            }
-                        }
-                        // Collect addr records for the index
-                        let addrs: Vec<(String, String)> = zone
-                            .records
-                            .iter()
-                            .map(|rrs| {
-                                rrs.filter_map(|r| match r {
-                                        ParsedRecord::Addr { key, value } => {
-                                            value.iter().next().map(|v| (key.to_string(), v.to_string()))
-                                        }
-                                        _ => None,
-                                    })
-                                    .collect::<Vec<_>>()
+                    // Collect addr records for the index
+                    let addrs: Vec<(String, String)> = zone
+                        .records
+                        .iter()
+                        .map(|rrs| {
+                            rrs.filter_map(|r| match r {
+                                ParsedRecord::Addr { key, value } => value
+                                    .iter()
+                                    .next()
+                                    .map(|v| (key.to_string(), v.to_string())),
+                                _ => None,
                             })
-                            .unwrap_or_default();
-                        if !addrs.is_empty() {
-                            addr_index.insert(handle_str.clone(), (rev_name, addrs));
-                        }
+                            .collect::<Vec<_>>()
+                        })
+                        .unwrap_or_default();
+                    if !addrs.is_empty() {
+                        addr_index.insert(handle_str.clone(), (rev_name, addrs));
                     }
-
+                }
 
                 let space = cert.subject.space()?.to_string();
 
@@ -294,9 +315,7 @@ impl Handler {
                 let epoch_height = epoch_map.get(&space).copied().unwrap_or(0);
                 let offchain_seq = zone.records.seq().unwrap_or(0);
                 let delegate_offchain_seq = match &zone.delegate {
-                    ProvableOption::Exists { value: d } => {
-                        d.records.seq().unwrap_or(0)
-                    }
+                    ProvableOption::Exists { value: d } => d.records.seq().unwrap_or(0),
                     _ => 0,
                 };
                 Some(HandleRecord {
@@ -317,7 +336,8 @@ impl Handler {
         );
 
         if !revs.is_empty() {
-            let rev_refs: Vec<(&str, &str)> = revs.iter()
+            let rev_refs: Vec<(&str, &str)> = revs
+                .iter()
                 .map(|(id, name)| (id.as_str(), name.as_str()))
                 .collect();
             self.store.set_revs(&rev_refs)?;
@@ -326,7 +346,8 @@ impl Handler {
         // Update address index for stored handles
         for handle in &result.stored_handles {
             if let Some((rev, addrs)) = addr_index.get(handle) {
-                let refs: Vec<(&str, &str)> = addrs.iter()
+                let refs: Vec<(&str, &str)> = addrs
+                    .iter()
                     .map(|(n, a)| (n.as_str(), a.as_str()))
                     .collect();
                 self.store.set_addrs(handle, rev, &refs)?;
diff --git a/relay/src/http.rs b/relay/src/http.rs
index 25fcc55..15ab24c 100644
--- a/relay/src/http.rs
+++ b/relay/src/http.rs
@@ -6,16 +6,16 @@ use std::num::NonZeroU32;
 use std::sync::Arc;
 
 use axum::{
+    Router,
     body::Bytes,
     extract::{ConnectInfo, State},
     http::{HeaderMap, StatusCode},
     response::IntoResponse,
     routing::{get, post},
-    Router,
 };
+use governor::RateLimiter;
 use governor::clock::DefaultClock;
 use governor::state::keyed::DashMapStateStore;
-use governor::RateLimiter;
 use libveritas::msg::Message;
 use tokio::sync::Mutex;
 
@@ -156,14 +156,14 @@ pub fn router(state: Arc<AppState>) -> Router {
 /// If `remote_ip_header` is set, reads that header and parses the first IP
 /// (handles comma-separated lists like X-Forwarded-For).
 fn client_ip(addr: &SocketAddr, headers: &HeaderMap, header_name: &Option<String>) -> IpAddr {
-    if let Some(name) = header_name {
-        if let Some(value) = headers.get(name.as_str()).and_then(|v| v.to_str().ok()) {
-            // Take the first entry (leftmost = original client for XFF-style headers,
-            // and the only value for single-value headers like CF-Connecting-IP)
-            let first = value.split(',').next().unwrap_or("").trim();
-            if let Ok(ip) = first.parse::<IpAddr>() {
-                return ip;
-            }
+    if let Some(name) = header_name
+        && let Some(value) = headers.get(name.as_str()).and_then(|v| v.to_str().ok())
+    {
+        // Take the first entry (leftmost = original client for XFF-style headers,
+        // and the only value for single-value headers like CF-Connecting-IP)
+        let first = value.split(',').next().unwrap_or("").trim();
+        if let Ok(ip) = first.parse::<IpAddr>() {
+            return ip;
         }
     }
     addr.ip()
@@ -185,7 +185,10 @@ async fn handle_message(
     }
 
     if body.len() > state.max_message_size {
-        return (StatusCode::PAYLOAD_TOO_LARGE, "message too large".to_string());
+        return (
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "message too large".to_string(),
+        );
     }
 
     // Deserialize the message
@@ -193,14 +196,17 @@ async fn handle_message(
         Ok(m) => m,
         Err(e) => {
             tracing::warn!("failed to deserialize message: {}", e);
-            return (StatusCode::BAD_REQUEST, "invalid message format".to_string());
+            return (
+                StatusCode::BAD_REQUEST,
+                "invalid message format".to_string(),
+            );
         }
     };
 
     // Verify and store
     if let Err(e) = state.handler.handle_message(msg) {
         tracing::warn!("failed to handle message: {}", e);
-        return (StatusCode::BAD_REQUEST,  format!("rejected: {}", e));
+        return (StatusCode::BAD_REQUEST, format!("rejected: {}", e));
     }
 
     gossip_message(state, body).await;
@@ -291,14 +297,28 @@ async fn handle_query(
 
     let q = match params.get("q") {
         Some(q) if !q.is_empty() => q,
-        _ => return (StatusCode::BAD_REQUEST, "missing q parameter".as_bytes().to_vec()).into_response(),
+        _ => {
+            return (
+                StatusCode::BAD_REQUEST,
+                "missing q parameter".as_bytes().to_vec(),
+            )
+                .into_response();
+        }
     };
 
-    let handles: Vec<&str> = q.split(',').map(|s| s.trim()).filter(|s| !s.is_empty()).collect();
+    let handles: Vec<&str> = q
+        .split(',')
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .collect();
 
     const MAX_HANDLES: usize = 6;
     if handles.len() > MAX_HANDLES {
-        return (StatusCode::BAD_REQUEST, "too many handles (max 6)".as_bytes().to_vec()).into_response();
+        return (
+            StatusCode::BAD_REQUEST,
+            "too many handles (max 6)".as_bytes().to_vec(),
+        )
+            .into_response();
     }
 
     // Parse epoch hints: "space:root_hex:height,space:root_hex:height"
@@ -306,13 +326,16 @@ async fn handle_query(
     if let Some(hints_str) = params.get("hints") {
         for part in hints_str.split(',') {
             let segments: Vec<&str> = part.splitn(3, ':').collect();
-            if segments.len() == 3 {
-                if let Ok(height) = segments[2].parse::<u32>() {
-                    hint_map.insert(segments[0].to_string(), EpochHint {
+            if segments.len() == 3
+                && let Ok(height) = segments[2].parse::<u32>()
+            {
+                hint_map.insert(
+                    segments[0].to_string(),
+                    EpochHint {
                         root: segments[1].to_string(),
                         height,
-                    });
-                }
+                    },
+                );
             }
         }
     }
@@ -320,7 +343,7 @@ async fn handle_query(
     // Group handles by space
     let mut by_space: HashMap<String, Vec<String>> = HashMap::new();
     for handle in &handles {
-        let sep = handle.find(|c: char| c == '@' || c == '#');
+        let sep = handle.find(['@', '#']);
         let (space, label) = match sep {
             Some(0) => (handle.to_string(), String::new()),
             Some(i) => (handle[i..].to_string(), handle[..i].to_string()),
@@ -393,7 +416,10 @@ async fn handle_anchors(
             };
             let root: [u8; 32] = match bytes.try_into() {
                 Ok(r) => r,
-                Err(_) => return (StatusCode::BAD_REQUEST, headers, "root must be 32 bytes").into_response(),
+                Err(_) => {
+                    return (StatusCode::BAD_REQUEST, headers, "root must be 32 bytes")
+                        .into_response();
+                }
             };
             store.get(resolver::TrustId::from(root)).cloned()
         }
@@ -428,7 +454,11 @@ async fn handle_hints(
         _ => return (StatusCode::BAD_REQUEST, "missing q parameter").into_response(),
     };
 
-    let mut handles: Vec<&str> = q.split(',').map(|s| s.trim()).filter(|s| !s.is_empty()).collect();
+    let mut handles: Vec<&str> = q
+        .split(',')
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .collect();
 
     if handles.len() > 6 {
         return (StatusCode::BAD_REQUEST, "too many handles (max 6)").into_response();
@@ -447,7 +477,6 @@ async fn handle_hints(
     }
 }
 
-
 /// GET /reverse?ids=num1,num2,... - Look up reverse records for numeric identities.
 ///
 /// Returns: JSON array of { id, name } objects.
@@ -467,7 +496,11 @@ async fn handle_reverse(
         _ => return (StatusCode::BAD_REQUEST, "missing ids parameter").into_response(),
     };
 
-    let id_list: Vec<&str> = ids.split(',').map(|s| s.trim()).filter(|s| !s.is_empty()).collect();
+    let id_list: Vec<&str> = ids
+        .split(',')
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .collect();
     if id_list.len() > 20 {
         return (StatusCode::BAD_REQUEST, "too many ids (max 20)").into_response();
     }
@@ -510,15 +543,20 @@ async fn handle_addrs(
 
     match state.handler.store.get_addrs(name, address) {
         Ok(pairs) => {
-            let handles = pairs.into_iter()
+            let handles = pairs
+                .into_iter()
                 .map(|(handle, rev)| resolver::AddrEntry { handle, rev })
                 .collect();
             let mut headers = HeaderMap::new();
             headers.insert("cache-control", "public, max-age=300".parse().unwrap());
-            (headers, axum::Json(resolver::AddrMatch {
-                address: address.clone(),
-                handles,
-            })).into_response()
+            (
+                headers,
+                axum::Json(resolver::AddrMatch {
+                    address: address.clone(),
+                    handles,
+                }),
+            )
+                .into_response()
         }
         Err(e) => {
             tracing::warn!("addr lookup failed: {}", e);
@@ -551,10 +589,18 @@ async fn handle_chain_proof(
     };
 
     if request.spaces.len() > 6 {
-        return (StatusCode::BAD_REQUEST, "too many spaces (max 6)".as_bytes().to_vec()).into_response();
+        return (
+            StatusCode::BAD_REQUEST,
+            "too many spaces (max 6)".as_bytes().to_vec(),
+        )
+            .into_response();
     }
     if request.nums.len() > 20 {
-        return (StatusCode::BAD_REQUEST, "too many nums (max 20)".as_bytes().to_vec()).into_response();
+        return (
+            StatusCode::BAD_REQUEST,
+            "too many nums (max 20)".as_bytes().to_vec(),
+        )
+            .into_response();
     }
 
     match state.chain.prove(&request).await {
@@ -567,10 +613,7 @@ async fn handle_chain_proof(
 }
 
 /// Gossip a message to up to 4 random verified peers.
-async fn gossip_message(
-    state: Arc<AppState>,
-    msg_bytes: Bytes,
-) {
+async fn gossip_message(state: Arc<AppState>, msg_bytes: Bytes) {
     use rand::seq::IndexedRandom;
 
     let peer_list: Vec<PeerInfo> = {
@@ -672,4 +715,3 @@ pub async fn bootstrap_from(
 
     Ok(peers)
 }
-
diff --git a/relay/src/lib.rs b/relay/src/lib.rs
index 03a8fbd..f62264d 100644
--- a/relay/src/lib.rs
+++ b/relay/src/lib.rs
@@ -5,30 +5,28 @@ pub mod handler;
 pub mod http;
 pub mod peer;
 pub mod relay;
-pub mod store;
 pub mod spaced;
+pub mod store;
 
 pub use resolver::anchor;
 
-use libveritas::{AnchorError, Veritas};
 pub use http::{
-    bootstrap, bootstrap_from, router, AppState, Quota, RateLimitConfig, RateLimiters,
-    BOOTSTRAP_RELAYS, DEFAULT_MAX_MESSAGE_SIZE,
+    AppState, BOOTSTRAP_RELAYS, DEFAULT_MAX_MESSAGE_SIZE, Quota, RateLimitConfig, RateLimiters,
+    bootstrap, bootstrap_from, router,
 };
+use libveritas::{AnchorError, Veritas};
 pub use peer::{AnnounceResult, PeerConfig, PeerTable};
 
 // Re-export wire format types from relay-client
-pub use resolver::{capabilities, Announcement, EpochHint, PeerInfo, Query, QueryRequest};
-pub use handler::{Handler};
+pub use handler::Handler;
 pub use relay::{Config, Relay, ServiceRunner};
+pub use resolver::{Announcement, EpochHint, PeerInfo, Query, QueryRequest, capabilities};
+pub use spaced::SpacedClient;
 pub use spaces_client::config::ExtendedNetwork;
 use spaces_nums::RootAnchor;
-pub use spaced::SpacedClient;
 pub use store::SqliteStore;
 
-
 // Create veritas with disabled name expansion
 fn create_relay_veritas(anchors: Vec<RootAnchor>) -> Result<Veritas, AnchorError> {
-    Veritas::new()
-        .with_anchors(anchors)
+    Veritas::new().with_anchors(anchors)
 }
diff --git a/relay/src/peer.rs b/relay/src/peer.rs
index 2e31fcb..6bf956b 100644
--- a/relay/src/peer.rs
+++ b/relay/src/peer.rs
@@ -4,7 +4,7 @@ use std::{
     time::{Duration, Instant},
 };
 
-pub use resolver::{capabilities, PeerInfo};
+pub use resolver::{PeerInfo, capabilities};
 
 pub struct PeerTable {
     /// IP -> announced URL (one slot per IP)
@@ -83,26 +83,26 @@ impl PeerTable {
         let now = Instant::now();
 
         // Already verified and fresh? Just refresh.
-        if let Some(peer) = self.verified.get_mut(&url) {
-            if now.duration_since(peer.last_seen) < self.config.verified_ttl {
-                peer.last_seen = now;
-                peer.capabilities = capabilities;
-                return AnnounceResult::AlreadyVerified;
-            }
+        if let Some(peer) = self.verified.get_mut(&url)
+            && now.duration_since(peer.last_seen) < self.config.verified_ttl
+        {
+            peer.last_seen = now;
+            peer.capabilities = capabilities;
+            return AnnounceResult::AlreadyVerified;
         }
 
         // Remove this IP's previous announcement if it was a different URL
-        if let Some(old_url) = self.ip_slots.get(&source_ip) {
-            if *old_url != url {
-                let old_url = old_url.clone();
-                // Remove old URL from unverified if no other IP points to it
-                let other_refs = self
-                    .ip_slots
-                    .iter()
-                    .any(|(ip, u)| *ip != source_ip && *u == old_url);
-                if !other_refs {
-                    self.unverified.remove(&old_url);
-                }
+        if let Some(old_url) = self.ip_slots.get(&source_ip)
+            && *old_url != url
+        {
+            let old_url = old_url.clone();
+            // Remove old URL from unverified if no other IP points to it
+            let other_refs = self
+                .ip_slots
+                .iter()
+                .any(|(ip, u)| *ip != source_ip && *u == old_url);
+            if !other_refs {
+                self.unverified.remove(&old_url);
             }
         }
 
@@ -242,7 +242,8 @@ impl PeerTable {
     /// Move expired verified peers back to unverified so they can be re-checked.
     pub fn demote_expired(&mut self) {
         let now = Instant::now();
-        let expired: Vec<(String, PeerEntry)> = self.verified
+        let expired: Vec<(String, PeerEntry)> = self
+            .verified
             .extract_if(|_, e| now.duration_since(e.last_seen) >= self.config.verified_ttl)
             .collect();
         for (url, entry) in expired {
diff --git a/relay/src/relay.rs b/relay/src/relay.rs
index b667084..ee8dcb9 100644
--- a/relay/src/relay.rs
+++ b/relay/src/relay.rs
@@ -2,13 +2,6 @@ use std::net::SocketAddr;
 use std::path::PathBuf;
 use std::sync::Arc;
 
-use spaces_client::config::ExtendedNetwork;
-use spaces_client::jsonrpsee::http_client::{HeaderMap, HeaderValue, HttpClientBuilder};
-use spaces_client::store::chain::ROOT_ANCHORS_COUNT;
-use spaces_protocol::bitcoin::BlockHash;
-use spaces_protocol::bitcoin::hashes::Hash as HashUtil;
-use spaces_protocol::constants::ChainAnchor;
-use spaces_nums::RootAnchor;
 use crate::anchor::AnchorSets;
 use crate::create_relay_veritas;
 use crate::handler::Handler;
@@ -16,6 +9,13 @@ use crate::http::{self, AppState, DEFAULT_MAX_MESSAGE_SIZE};
 use crate::peer::PeerConfig;
 use crate::spaced::SpacedClient;
 use crate::store::SqliteStore;
+use spaces_client::config::ExtendedNetwork;
+use spaces_client::jsonrpsee::http_client::{HeaderMap, HeaderValue, HttpClientBuilder};
+use spaces_client::store::chain::ROOT_ANCHORS_COUNT;
+use spaces_nums::RootAnchor;
+use spaces_protocol::bitcoin::BlockHash;
+use spaces_protocol::bitcoin::hashes::Hash as HashUtil;
+use spaces_protocol::constants::ChainAnchor;
 
 fn zero_anchor() -> RootAnchor {
     RootAnchor {
@@ -74,21 +74,18 @@ pub struct Relay {
 
 impl Relay {
     pub fn new(config: Config) -> anyhow::Result<Self> {
-        let spaced_url = config.spaced_url.clone()
+        let spaced_url = config
+            .spaced_url
+            .clone()
             .unwrap_or_else(|| ServiceRunner::default_spaced_url(config.network));
 
         let mut builder = HttpClientBuilder::default();
         let url = if let Ok(parsed) = url::Url::parse(&spaced_url) {
             if !parsed.username().is_empty() {
-                let credentials = format!(
-                    "{}:{}",
-                    parsed.username(),
-                    parsed.password().unwrap_or("")
-                );
-                let encoded = base64::Engine::encode(
-                    &base64::engine::general_purpose::STANDARD,
-                    credentials,
-                );
+                let credentials =
+                    format!("{}:{}", parsed.username(), parsed.password().unwrap_or(""));
+                let encoded =
+                    base64::Engine::encode(&base64::engine::general_purpose::STANDARD, credentials);
                 let mut headers = HeaderMap::new();
                 headers.insert(
                     "authorization",
@@ -115,11 +112,7 @@ impl Relay {
         let mut handler = Handler::new(veritas, store, anchor_store);
         handler.dev_mode = config.dev_mode;
 
-        let mut state = AppState::new(
-            handler,
-            chain,
-            config.peer_config,
-        );
+        let mut state = AppState::new(handler, chain, config.peer_config);
         state.max_message_size = config.max_message_size;
         state.capabilities = config.capabilities;
         state.is_bootstrap = config.is_bootstrap;
@@ -172,7 +165,13 @@ impl ServiceRunner {
             .take(64)
             .map(char::from)
             .collect();
-        Self { data_dir, network, yuki_checkpoint, rpc_password, shutdown }
+        Self {
+            data_dir,
+            network,
+            yuki_checkpoint,
+            rpc_password,
+            shutdown,
+        }
     }
 
     /// Start yuki and spaced in dedicated threads with their own tokio runtimes.
@@ -210,7 +209,8 @@ impl ServiceRunner {
             })?;
 
         // Wait for the first service to exit
-        let (name, result) = done_rx.recv()
+        let (name, result) = done_rx
+            .recv()
             .map_err(|_| anyhow::anyhow!("service threads exited without reporting"))?;
 
         // Signal the remaining service to shut down
@@ -240,7 +240,11 @@ impl ServiceRunner {
 
     /// Spaced URL with embedded auth credentials.
     pub fn spaced_url_with_auth(&self) -> String {
-        format!("http://__cookie__:{}@127.0.0.1:{}", self.rpc_password, Self::spaced_port(self.network))
+        format!(
+            "http://__cookie__:{}@127.0.0.1:{}",
+            self.rpc_password,
+            Self::spaced_port(self.network)
+        )
     }
 
     /// Path to the cookie file spaced will write for RPC auth.
@@ -277,9 +281,12 @@ impl ServiceRunner {
     fn yuki_args(&self) -> Vec<String> {
         let mut args = vec![
             "yuki".into(),
-            "--chain".into(), self.network.to_string(),
-            "--rpc-port".into(), Self::yuki_port(self.network).to_string(),
-            "--data-dir".into(), self.data_dir.join("yuki").to_str().unwrap().to_string(),
+            "--chain".into(),
+            self.network.to_string(),
+            "--rpc-port".into(),
+            Self::yuki_port(self.network).to_string(),
+            "--data-dir".into(),
+            self.data_dir.join("yuki").to_str().unwrap().to_string(),
         ];
         if let Some(cp) = &self.yuki_checkpoint {
             args.push("--checkpoint".into());
@@ -291,16 +298,23 @@ impl ServiceRunner {
     fn spaced_args(&self) -> Vec<String> {
         vec![
             "spaced".into(),
-            "--chain".into(), self.network.to_string(),
-            "--rpc-port".into(), Self::spaced_port(self.network).to_string(),
-            "--data-dir".into(), self.spaced_data_dir().to_str().unwrap().to_string(),
-            "--bitcoin-rpc-url".into(), self.yuki_url(),
+            "--chain".into(),
+            self.network.to_string(),
+            "--rpc-port".into(),
+            Self::spaced_port(self.network).to_string(),
+            "--data-dir".into(),
+            self.spaced_data_dir().to_str().unwrap().to_string(),
+            "--bitcoin-rpc-url".into(),
+            self.yuki_url(),
             "--bitcoin-rpc-light".into(),
-            "--num-anchors".into(), (ROOT_ANCHORS_COUNT * 2).to_string(),
+            "--num-anchors".into(),
+            (ROOT_ANCHORS_COUNT * 2).to_string(),
             "--index-node-hashes".into(),
             "--enable-pruning".into(),
-            "--rpc-user".into(), "__cookie__".into(),
-            "--rpc-password".into(), self.rpc_password.clone(),
+            "--rpc-user".into(),
+            "__cookie__".into(),
+            "--rpc-password".into(),
+            self.rpc_password.clone(),
         ]
     }
 
diff --git a/relay/src/spaced.rs b/relay/src/spaced.rs
index c159fdc..c64c5d2 100644
--- a/relay/src/spaced.rs
+++ b/relay/src/spaced.rs
@@ -1,13 +1,13 @@
-#[cfg(any(test, feature = "testutil"))]
-use std::ops::Deref;
-#[cfg(any(test, feature = "testutil"))]
-use std::sync::Mutex;
 use libveritas::cert::{NumsSubtree, SpacesSubtree};
 use libveritas::msg::ChainProof;
 use spacedb::subtree::SubTree;
 use spaces_client::jsonrpsee::http_client::HttpClient;
 use spaces_client::rpc::RpcClient;
 use spaces_nums::{ChainProofRequest, RootAnchor};
+#[cfg(any(test, feature = "testutil"))]
+use std::ops::Deref;
+#[cfg(any(test, feature = "testutil"))]
+use std::sync::Mutex;
 
 pub struct SpacedClient {
     client: HttpClient,
@@ -28,15 +28,17 @@ impl SpacedClient {
     pub fn mock((proof, anchors): (ChainProof, Vec<RootAnchor>)) -> Self {
         use spaces_client::jsonrpsee::http_client::HttpClientBuilder;
         Self {
-            client: HttpClientBuilder::default().build("http://nothanks.invalid").unwrap(),
-            mock_chain_proof:  Mutex::new(Some((proof, anchors))),
+            client: HttpClientBuilder::default()
+                .build("http://nothanks.invalid")
+                .unwrap(),
+            mock_chain_proof: Mutex::new(Some((proof, anchors))),
         }
     }
 
     pub async fn get_root_anchors(&self) -> anyhow::Result<Vec<RootAnchor>> {
         #[cfg(any(test, feature = "testutil"))]
         if let Some((_, anchors)) = &self.mock_chain_proof.lock().unwrap().deref() {
-            return Ok(anchors.clone())
+            return Ok(anchors.clone());
         }
         Ok(self.client.get_root_anchors().await?)
     }
@@ -44,7 +46,7 @@ impl SpacedClient {
     pub async fn prove(&self, req: &ChainProofRequest) -> anyhow::Result<ChainProof> {
         #[cfg(any(test, feature = "testutil"))]
         if let Some((p, _)) = &self.mock_chain_proof.lock().unwrap().deref() {
-            return Ok(p.clone())
+            return Ok(p.clone());
         }
 
         let res = self.client.build_chain_proof(req.clone(), None).await?;
diff --git a/relay/src/store.rs b/relay/src/store.rs
index e25303b..1e29dfb 100644
--- a/relay/src/store.rs
+++ b/relay/src/store.rs
@@ -5,10 +5,10 @@ use std::path::Path;
 use std::sync::Mutex;
 
 use anyhow::anyhow;
+use libveritas::Zone;
 use libveritas::cert::Certificate;
 use resolver::ReverseRecord;
-use libveritas::Zone;
-use rusqlite::{params, Connection, OptionalExtension};
+use rusqlite::{Connection, OptionalExtension, params};
 use spaces_protocol::slabel::SLabel;
 
 const SCHEMA: &str = r#"
@@ -148,7 +148,10 @@ impl SqliteStore {
             let zone_data = borsh::to_vec(&update.zone)
                 .map_err(|e| anyhow!("failed to serialize zone: {}", e))?;
             entries.push(Prepared {
-                handle, space, cert_data, zone_data,
+                handle,
+                space,
+                cert_data,
+                zone_data,
                 epoch_height: update.epoch_height,
                 offchain_seq: update.offchain_seq,
                 delegate_offchain_seq: update.delegate_offchain_seq,
@@ -166,11 +169,9 @@ impl SqliteStore {
         let to_store: Vec<_> = entries
             .into_iter()
             .zip(updates.iter())
-            .filter(|(e, update)| {
-                match existing_zones.get(e.handle.as_str()) {
-                    Some(existing) => update.zone.is_better_than(existing).unwrap_or(false),
-                    None => true,
-                }
+            .filter(|(e, update)| match existing_zones.get(e.handle.as_str()) {
+                Some(existing) => update.zone.is_better_than(existing).unwrap_or(false),
+                None => true,
             })
             .map(|(e, _)| e)
             .collect();
@@ -178,19 +179,24 @@ impl SqliteStore {
         let skipped = updates.len() - to_store.len();
 
         if to_store.is_empty() {
-            return Ok(BulkStoreResult { stored: 0, skipped, stored_handles: vec![] });
+            return Ok(BulkStoreResult {
+                stored: 0,
+                skipped,
+                stored_handles: vec![],
+            });
         }
 
         // Bulk INSERT
-        let placeholders: Vec<String> =
-            to_store.iter().map(|_| "(?, ?, ?, ?, ?, ?, ?, ?)".to_string()).collect();
+        let placeholders: Vec<String> = to_store
+            .iter()
+            .map(|_| "(?, ?, ?, ?, ?, ?, ?, ?)".to_string())
+            .collect();
         let query = format!(
             "INSERT OR REPLACE INTO handles (handle, space, cert_data, zone_data, epoch_height, offchain_seq, delegate_offchain_seq, updated_at) VALUES {}",
             placeholders.join(", ")
         );
 
-        let mut params: Vec<Box<dyn rusqlite::ToSql>> =
-            Vec::with_capacity(to_store.len() * 8);
+        let mut params: Vec<Box<dyn rusqlite::ToSql>> = Vec::with_capacity(to_store.len() * 8);
         for e in &to_store {
             params.push(Box::new(e.handle.clone()));
             params.push(Box::new(e.space.clone()));
@@ -202,19 +208,23 @@ impl SqliteStore {
             params.push(Box::new(now));
         }
 
-        let param_refs: Vec<&dyn rusqlite::ToSql> =
-            params.iter().map(|p| p.as_ref()).collect();
+        let param_refs: Vec<&dyn rusqlite::ToSql> = params.iter().map(|p| p.as_ref()).collect();
         conn.execute(&query, param_refs.as_slice())?;
 
         let stored_handles = to_store.iter().map(|e| e.handle.clone()).collect();
-        Ok(BulkStoreResult { stored: to_store.len(), skipped, stored_handles })
+        Ok(BulkStoreResult {
+            stored: to_store.len(),
+            skipped,
+            stored_handles,
+        })
     }
 
     /// Get a single handle record.
     pub fn get_handle(&self, handle: &str) -> anyhow::Result<Option<HandleRecord>> {
         let conn = self.conn.lock().unwrap();
 
-        let row: Option<(Vec<u8>, Vec<u8>, u32, i64, i64)> = conn
+        type HandleRow = (Vec<u8>, Vec<u8>, u32, i64, i64);
+        let row: Option<HandleRow> = conn
             .query_row(
                 "SELECT cert_data, zone_data, epoch_height, offchain_seq, delegate_offchain_seq FROM handles WHERE handle = ?",
                 params![handle],
@@ -229,7 +239,9 @@ impl SqliteStore {
                 let zone: Zone = borsh::from_slice(&zone_bytes)
                     .map_err(|e| anyhow!("failed to deserialize zone: {}", e))?;
                 Ok(Some(HandleRecord {
-                    cert, zone, epoch_height,
+                    cert,
+                    zone,
+                    epoch_height,
                     offchain_seq: offchain_seq as u64,
                     delegate_offchain_seq: delegate_offchain_seq as u64,
                 }))
@@ -253,13 +265,17 @@ impl SqliteStore {
         );
 
         let mut stmt = conn.prepare(&query)?;
-        let params: Vec<&dyn rusqlite::ToSql> = handles
-            .iter()
-            .map(|h| h as &dyn rusqlite::ToSql)
-            .collect();
+        let params: Vec<&dyn rusqlite::ToSql> =
+            handles.iter().map(|h| h as &dyn rusqlite::ToSql).collect();
 
         let rows = stmt.query_map(params.as_slice(), |row| {
-            Ok((row.get::<_, Vec<u8>>(0)?, row.get::<_, Vec<u8>>(1)?, row.get::<_, u32>(2)?, row.get::<_, i64>(3)?, row.get::<_, i64>(4)?))
+            Ok((
+                row.get::<_, Vec<u8>>(0)?,
+                row.get::<_, Vec<u8>>(1)?,
+                row.get::<_, u32>(2)?,
+                row.get::<_, i64>(3)?,
+                row.get::<_, i64>(4)?,
+            ))
         })?;
 
         let mut results = Vec::new();
@@ -270,7 +286,9 @@ impl SqliteStore {
             let zone: Zone = borsh::from_slice(&zone_bytes)
                 .map_err(|e| anyhow!("failed to deserialize zone: {}", e))?;
             results.push(HandleRecord {
-                cert, zone, epoch_height,
+                cert,
+                zone,
+                epoch_height,
                 offchain_seq: offchain_seq as u64,
                 delegate_offchain_seq: delegate_offchain_seq as u64,
             });
@@ -321,10 +339,8 @@ impl SqliteStore {
         );
 
         let mut stmt = conn.prepare(&query)?;
-        let params: Vec<&dyn rusqlite::ToSql> = handles
-            .iter()
-            .map(|h| h as &dyn rusqlite::ToSql)
-            .collect();
+        let params: Vec<&dyn rusqlite::ToSql> =
+            handles.iter().map(|h| h as &dyn rusqlite::ToSql).collect();
 
         let rows = stmt.query_map(params.as_slice(), |row| {
             Ok(HandleHintRow {
@@ -355,10 +371,8 @@ impl SqliteStore {
         );
 
         let mut stmt = conn.prepare(&query)?;
-        let params: Vec<&dyn rusqlite::ToSql> = handles
-            .iter()
-            .map(|h| h as &dyn rusqlite::ToSql)
-            .collect();
+        let params: Vec<&dyn rusqlite::ToSql> =
+            handles.iter().map(|h| h as &dyn rusqlite::ToSql).collect();
 
         let rows = stmt.query_map(params.as_slice(), |row| {
             Ok((row.get::<_, String>(0)?, row.get::<_, Vec<u8>>(1)?))
@@ -426,7 +440,12 @@ impl SqliteStore {
     /// Update address index for a handle. Deletes old entries by canonical handle and inserts new ones.
     /// `handle` is the canonical name (used for delete), `rev` is the human-readable name.
     /// `entries` is a list of `(addr_name, addr_value)` pairs, e.g. `("btc", "bc1q...")`.
-    pub fn set_addrs(&self, handle: &str, rev: &str, entries: &[(&str, &str)]) -> anyhow::Result<()> {
+    pub fn set_addrs(
+        &self,
+        handle: &str,
+        rev: &str,
+        entries: &[(&str, &str)],
+    ) -> anyhow::Result<()> {
         let conn = self.conn.lock().unwrap();
         conn.execute("DELETE FROM addrs WHERE handle = ?", params![handle])?;
         if entries.is_empty() {
@@ -445,9 +464,7 @@ impl SqliteStore {
     /// Look up handles by address. Returns (canonical_handle, rev_name) pairs.
     pub fn get_addrs(&self, name: &str, addr: &str) -> anyhow::Result<Vec<(String, String)>> {
         let conn = self.conn.lock().unwrap();
-        let mut stmt = conn.prepare(
-            "SELECT handle, rev FROM addrs WHERE name = ? AND addr = ?"
-        )?;
+        let mut stmt = conn.prepare("SELECT handle, rev FROM addrs WHERE name = ? AND addr = ?")?;
         let rows = stmt.query_map(params![name, addr], |row| {
             Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
         })?;
@@ -464,4 +481,4 @@ mod tests {
         let store = SqliteStore::in_memory().expect("create in-memory store");
         assert!(store.get_zones(&[]).unwrap().is_empty());
     }
-}
\ No newline at end of file
+}
diff --git a/relay/tests/integration_tests.rs b/relay/tests/integration_tests.rs
index 39701cd..ce98eae 100644
--- a/relay/tests/integration_tests.rs
+++ b/relay/tests/integration_tests.rs
@@ -3,13 +3,11 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use std::time::Duration;
 
-use libveritas::msg::QueryContext;
 use libveritas::Veritas;
+use libveritas::msg::QueryContext;
 use libveritas_testutil::fixture::*;
-use relay::{
-    AppState, Config, ExtendedNetwork, Handler, PeerInfo, Relay, SqliteStore,
-};
 use relay::anchor::AnchorSets;
+use relay::{AppState, Config, ExtendedNetwork, Handler, PeerInfo, Relay, SqliteStore};
 use resolver::{AnchorSet, HintsResponse};
 use spaces_protocol::slabel::SLabel;
 
@@ -24,8 +22,7 @@ fn build_veritas(state: &ChainState) -> Veritas {
     anchors.push(state.chain.current_root_anchor());
     anchors.sort_by(|a, b| b.block.height.cmp(&a.block.height));
     anchors.dedup_by_key(|a| a.block.height);
-    Veritas::new()
-        .with_anchors(anchors).unwrap()
+    Veritas::new().with_anchors(anchors).unwrap()
 }
 
 /// Create a Handler wired to the test chain state with an in-memory store.
@@ -160,8 +157,8 @@ fn test_kitchen_sink() {
 /// replacing Pending) is correctly rejected.  We mirror that logic here.
 #[test]
 fn test_incremental_zone_replacement() {
-    use std::collections::HashMap;
     use libveritas::Zone;
+    use std::collections::HashMap;
 
     let mut chain_state = ChainState::new();
     let mut runner = FixtureRunner::new(&mut chain_state, kitchen_sink());
@@ -183,7 +180,8 @@ fn test_incremental_zone_replacement() {
         // Verify manually to get expected zones
         let veritas = build_veritas(&chain_state);
         let verified = veritas
-            .verify_with_options(&ctx, msg.clone(), libveritas::VERIFY_DEV_MODE).unwrap();
+            .verify_with_options(&ctx, msg.clone(), libveritas::VERIFY_DEV_MODE)
+            .unwrap();
 
         // Update best_zones: only replace when the new zone is strictly better
         for zone in &verified.zones {
@@ -224,7 +222,11 @@ fn test_all_fixtures() {
     let fixtures: Vec<(&str, Fixture, Vec<&str>)> = vec![
         ("@staged", staged_only(), vec!["alice", "bob"]),
         ("@pending", single_commit_pending(), vec!["alice", "bob"]),
-        ("@sovereign", single_commit_finalized(), vec!["alice", "bob"]),
+        (
+            "@sovereign",
+            single_commit_finalized(),
+            vec!["alice", "bob"],
+        ),
         (
             "@two-pending",
             two_commits_second_pending(),
@@ -299,8 +301,15 @@ async fn test_relay_accepts_message() {
     let body = resp.text().await.unwrap();
     assert_eq!(body, "ok");
 
-    let record = app_state.handler.store.get_handle("alice@sovereign").unwrap();
-    assert!(record.is_some(), "alice should be stored after HTTP submission");
+    let record = app_state
+        .handler
+        .store
+        .get_handle("alice@sovereign")
+        .unwrap();
+    assert!(
+        record.is_some(),
+        "alice should be stored after HTTP submission"
+    );
 }
 
 #[tokio::test]
@@ -364,7 +373,10 @@ async fn test_broadcast_response_readable() {
     assert!(status.is_success(), "expected 2xx, got {}", status);
 
     // This is the path that would produce "error decoding response body"
-    let body_text = resp.text().await.expect("should be able to read response body as text");
+    let body_text = resp
+        .text()
+        .await
+        .expect("should be able to read response body as text");
     assert_eq!(body_text, "ok");
 }
 
@@ -388,16 +400,14 @@ async fn test_peers_endpoint() {
     }
 
     let client = reqwest::Client::new();
-    let resp = client
-        .get(format!("{}/peers", url))
-        .send()
-        .await
-        .unwrap();
+    let resp = client.get(format!("{}/peers", url)).send().await.unwrap();
 
     assert_eq!(resp.status().as_u16(), 200);
 
     // Should parse as valid JSON array of PeerInfo
-    let peers: Vec<PeerInfo> = resp.json().await
+    let peers: Vec<PeerInfo> = resp
+        .json()
+        .await
         .expect("peers response should be valid JSON");
     assert!(!peers.is_empty(), "should have at least one peer");
 }
@@ -420,25 +430,29 @@ async fn test_anchors_endpoint() {
         .unwrap();
     assert_eq!(resp.status().as_u16(), 200);
 
-    let root = resp.headers().get("x-anchor-root")
+    let root = resp
+        .headers()
+        .get("x-anchor-root")
         .expect("should have x-anchor-root header")
-        .to_str().unwrap();
+        .to_str()
+        .unwrap();
     assert!(!root.is_empty(), "anchor root should not be empty");
 
-    let height = resp.headers().get("x-anchor-height")
+    let height = resp
+        .headers()
+        .get("x-anchor-height")
         .expect("should have x-anchor-height header")
-        .to_str().unwrap();
+        .to_str()
+        .unwrap();
     assert!(!height.is_empty(), "anchor height should not be empty");
 
     // GET /anchors should return valid JSON
-    let resp = client
-        .get(format!("{}/anchors", url))
-        .send()
-        .await
-        .unwrap();
+    let resp = client.get(format!("{}/anchors", url)).send().await.unwrap();
     assert_eq!(resp.status().as_u16(), 200);
 
-    let anchor_set: AnchorSet = resp.json().await
+    let anchor_set: AnchorSet = resp
+        .json()
+        .await
         .expect("anchors response should be valid JSON AnchorSet");
     assert!(!anchor_set.entries.is_empty(), "should have anchor entries");
     assert!(anchor_set.root_matches(), "anchor root hash should match");
@@ -452,9 +466,14 @@ async fn test_anchors_endpoint() {
         .unwrap();
     assert_eq!(resp.status().as_u16(), 200);
 
-    let fetched: AnchorSet = resp.json().await
+    let fetched: AnchorSet = resp
+        .json()
+        .await
         .expect("anchors response with root param should be valid JSON");
-    assert_eq!(fetched.trust_id, anchor_set.trust_id, "fetched anchor root should match");
+    assert_eq!(
+        fetched.trust_id, anchor_set.trust_id,
+        "fetched anchor root should match"
+    );
 
     // GET /anchors?root=<nonexistent> should return 404
     let fake_root = "cd00e292c5970d3c5e2f0ffa5171e555bc46bfc4faddfb4a418b6840b86e79a3";
@@ -491,13 +510,18 @@ async fn test_hints_endpoint() {
 
     // Query hints
     let resp = client
-        .get(format!("{}/hints?q=alice@sovereign,bob@sovereign,@sovereign", url))
+        .get(format!(
+            "{}/hints?q=alice@sovereign,bob@sovereign,@sovereign",
+            url
+        ))
         .send()
         .await
         .unwrap();
     assert_eq!(resp.status().as_u16(), 200);
 
-    let hints: HintsResponse = resp.json().await
+    let hints: HintsResponse = resp
+        .json()
+        .await
         .expect("hints response should be valid JSON");
     assert!(!hints.hints.is_empty(), "should have space hints");
     assert!(hints.anchor_tip > 0, "anchor_tip should be > 0");
@@ -544,5 +568,8 @@ async fn test_gossip_propagation() {
     assert!(root.is_some(), "relay B should have @sovereign from gossip");
 
     let alice = state_b.handler.store.get_handle("alice@sovereign").unwrap();
-    assert!(alice.is_some(), "relay B should have alice@sovereign from gossip");
+    assert!(
+        alice.is_some(),
+        "relay B should have alice@sovereign from gossip"
+    );
 }
diff --git a/release-plz.toml b/release-plz.toml
new file mode 100644
index 0000000..f0afb8e
--- /dev/null
+++ b/release-plz.toml
@@ -0,0 +1,61 @@
+[workspace]
+changelog_path = "CHANGELOG.md"
+changelog_update = true
+pr_draft = false
+
+[changelog]
+header = """# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+"""
+
+body = """
+## [{{ version | trim_start_matches(pat="v") }}]\
+  {%- if release_link -%}
+    ({{ release_link }})
+  {% endif %} - {{ timestamp | date(format="%Y-%m-%d") }}
+{% for group, commits in commits | group_by(attribute="group") %}
+### {{ group | upper_first }}
+{% for commit in commits %}
+- {% if commit.scope %}*({{ commit.scope }})* {% endif %}\
+    {% if commit.breaking %}[**breaking**] {% endif %}\
+    {{ commit.message | upper_first }}\
+{% endfor %}
+{% endfor %}
+"""
+
+commit_parsers = [
+  { message = "^feat", group = "Features" },
+  { message = "^fix", group = "Bug Fixes" },
+  { message = "^perf", group = "Performance" },
+  { message = "^refactor", group = "Refactor" },
+  { message = "^docs", group = "Documentation" },
+  { message = "^test", group = "Tests" },
+  { message = "^build", group = "Build" },
+  { message = "^ci", group = "CI" },
+  { message = "^chore\\(release\\)", skip = true },
+  { message = "^chore", group = "Chore" },
+  { message = "^revert", group = "Revert" },
+]
+
+# Published to crates.io
+[[package]]
+name = "fabric-rs"
+publish = true
+git_release_enable = true
+git_release_latest = false
+git_tag_name = "fabric-v{{ version }}"
+
+# Binary — not published to crates.io
+[[package]]
+name = "relay"
+release = false
+publish = false
+
+[[package]]
+name = "integration-tests"
+release = false
+publish = false
\ No newline at end of file
diff --git a/tests/Cargo.toml b/tests/Cargo.toml
index 76ea8da..ea7e2ed 100644
--- a/tests/Cargo.toml
+++ b/tests/Cargo.toml
@@ -7,7 +7,7 @@ publish = false
 [dependencies]
 relay = { path = "../relay", features = ["testutil"] }
 axum = "0.8"
-fabric = { path = "../fabric/rust" }
+fabric = { path = "../fabric/rust", package = "fabric-rs" }
 libveritas = { workspace = true }
 libveritas_testutil = { workspace = true }
 spaces_protocol = { workspace = true }
diff --git a/tests/src/lib.rs b/tests/src/lib.rs
index 15ccd2c..488e1f3 100644
--- a/tests/src/lib.rs
+++ b/tests/src/lib.rs
@@ -2,17 +2,15 @@ use std::net::SocketAddr;
 use std::num::NonZeroU32;
 use std::sync::Arc;
 
+use fabric::anchor::AnchorSets;
+use libveritas::Veritas;
 use libveritas::cert::{NumsSubtree, SpacesSubtree};
 use libveritas::msg::{ChainProof, QueryContext};
-use libveritas::Veritas;
 use libveritas_testutil::fixture::ChainState;
-use relay::{
-    AppState, Handler, PeerConfig, SqliteStore, SpacedClient, router,
-};
-use fabric::anchor::AnchorSets;
 use relay::http::{Quota, RateLimitConfig};
-use spaces_protocol::slabel::SLabel;
+use relay::{AppState, Handler, PeerConfig, SpacedClient, SqliteStore, router};
 use spaces_nums::RootAnchor;
+use spaces_protocol::slabel::SLabel;
 
 /// Build a Veritas that includes the current root anchor so the tip
 /// matches the current chain height (important after Finalize steps).
@@ -21,8 +19,7 @@ pub fn build_veritas(state: &ChainState) -> Veritas {
     anchors.push(state.chain.current_root_anchor());
     anchors.sort_by(|a, b| b.block.height.cmp(&a.block.height));
     anchors.dedup_by_key(|a| a.block.height);
-    Veritas::new()
-        .with_anchors(anchors).unwrap()
+    Veritas::new().with_anchors(anchors).unwrap()
 }
 
 /// Collect the test anchors from a ChainState.
@@ -37,11 +34,14 @@ pub fn test_anchors(state: &ChainState) -> Vec<spaces_nums::RootAnchor> {
 /// Build a mock chain proof from the test chain state.
 /// Returns the full spaces and ptrs subtrees so any query can be served.
 pub fn mock_chain_proof(state: &ChainState) -> (ChainProof, Vec<RootAnchor>) {
-    (ChainProof {
-        anchor: state.chain.current_root_anchor().block,
-        spaces: SpacesSubtree(state.chain.spaces_tree.clone()),
-        nums: NumsSubtree(state.chain.nums_tree.clone()),
-    }, test_anchors(state))
+    (
+        ChainProof {
+            anchor: state.chain.current_root_anchor().block,
+            spaces: SpacesSubtree(state.chain.spaces_tree.clone()),
+            nums: NumsSubtree(state.chain.nums_tree.clone()),
+        },
+        test_anchors(state),
+    )
 }
 
 /// Create a Handler wired to the test chain state with an in-memory store.
@@ -85,7 +85,12 @@ pub async fn start_relay(chain_state: &ChainState) -> (String, Arc<AppState>) {
         announce: Quota::per_second(NonZeroU32::new(100).unwrap()),
         peers: Quota::per_second(NonZeroU32::new(100).unwrap()),
     };
-    let state = Arc::new(AppState::with_rate_limits(handler, chain, PeerConfig::default(), rate_config));
+    let state = Arc::new(AppState::with_rate_limits(
+        handler,
+        chain,
+        PeerConfig::default(),
+        rate_config,
+    ));
 
     let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
     let addr = listener.local_addr().unwrap();
diff --git a/tests/tests/fabric_client.rs b/tests/tests/fabric_client.rs
index 6a7f947..2dc4bf5 100644
--- a/tests/tests/fabric_client.rs
+++ b/tests/tests/fabric_client.rs
@@ -1,6 +1,6 @@
 use fabric::client::{Fabric, TrustId};
+use integration_tests::start_relay;
 use libveritas_testutil::fixture::*;
-use integration_tests::{start_relay};
 use std::str::FromStr;
 
 #[tokio::test(flavor = "multi_thread")]
@@ -14,7 +14,10 @@ async fn test_bootstrap() {
     let fabric = Fabric::with_seeds(&[url.as_str()]);
 
     fabric.bootstrap().await.expect("bootstrap should succeed");
-    assert!(fabric.observed().is_some(), "should have observed trust set after bootstrap");
+    assert!(
+        fabric.observed().is_some(),
+        "should have observed trust set after bootstrap"
+    );
 }
 
 #[tokio::test(flavor = "multi_thread")]
@@ -25,7 +28,9 @@ async fn test_bootstrap_bad_trust_id() {
 
     let (url, _) = start_relay(&state).await;
 
-    let fake_id = TrustId::from_str("cd00e292c5970d3c5e2f0ffa5171e555bc46bfc4faddfb4a418b6840b86e79a3").unwrap();
+    let fake_id =
+        TrustId::from_str("cd00e292c5970d3c5e2f0ffa5171e555bc46bfc4faddfb4a418b6840b86e79a3")
+            .unwrap();
     let fabric = Fabric::with_seeds(&[url.as_str()]);
 
     let result = fabric.trust(fake_id).await;
@@ -53,14 +58,23 @@ async fn test_broadcast() {
 
     let fabric = Fabric::with_seeds(&[url.as_str()]);
 
-    fabric.broadcast(&msg_bytes).await
+    fabric
+        .broadcast(&msg_bytes)
+        .await
         .expect("broadcast should succeed");
 
-    let record = app_state.handler.store.get_handle("alice@sovereign").unwrap();
+    let record = app_state
+        .handler
+        .store
+        .get_handle("alice@sovereign")
+        .unwrap();
     assert!(record.is_some(), "alice should be stored after broadcast");
 
     let root = app_state.handler.store.get_handle("@sovereign").unwrap();
-    assert!(root.is_some(), "@sovereign should be stored after broadcast");
+    assert!(
+        root.is_some(),
+        "@sovereign should be stored after broadcast"
+    );
 }
 
 #[tokio::test(flavor = "multi_thread")]
@@ -111,7 +125,9 @@ async fn test_resolve() {
     // Resolve via Fabric client
     let fabric = Fabric::with_seeds(&[url.as_str()]);
 
-    fabric.resolve("alice@sovereign").await
+    fabric
+        .resolve("alice@sovereign")
+        .await
         .expect("should resolve alice@sovereign");
 }
 
@@ -139,11 +155,22 @@ async fn test_resolve_all() {
     // Resolve multiple handles
     let fabric = Fabric::with_seeds(&[url.as_str()]);
 
-    let batch = fabric.resolve_all(&["alice@sovereign", "bob@sovereign"]).await
+    let batch = fabric
+        .resolve_all(&["alice@sovereign", "bob@sovereign"])
+        .await
         .expect("should resolve multiple handles");
 
-    assert!(batch.zones.iter().any(|z| z.handle.to_string() == "alice@sovereign") || batch.zones.iter().any(|z| z.handle.to_string() == "@sovereign"),
-        "should contain alice or root zone");
+    assert!(
+        batch
+            .zones
+            .iter()
+            .any(|z| z.handle.to_string() == "alice@sovereign")
+            || batch
+                .zones
+                .iter()
+                .any(|z| z.handle.to_string() == "@sovereign"),
+        "should contain alice or root zone"
+    );
 }
 
 #[tokio::test(flavor = "multi_thread")]
@@ -185,12 +212,23 @@ async fn test_resolve_all_partial() {
     // Resolve one existing and one nonexistent handle
     let fabric = Fabric::with_seeds(&[url.as_str()]);
     fabric.set_prefer_latest(false);
-    let batch = fabric.resolve_all(&["alice@sovereign", "nobody@sovereign"]).await
+    let batch = fabric
+        .resolve_all(&["alice@sovereign", "nobody@sovereign"])
+        .await
         .expect("resolve_all should succeed with partial results");
 
     // Should return the existing handle, not the missing one
-    assert!(!batch.zones.iter().any(|z| z.handle.to_string() == "nobody@sovereign"), "nonexistent handle should not be in results");
-    assert!(batch.zones.len() >= 1, "should have at least the existing handle");
+    assert!(
+        !batch
+            .zones
+            .iter()
+            .any(|z| z.handle.to_string() == "nobody@sovereign"),
+        "nonexistent handle should not be in results"
+    );
+    assert!(
+        batch.zones.len() >= 1,
+        "should have at least the existing handle"
+    );
 }
 
 #[tokio::test(flavor = "multi_thread")]
@@ -208,14 +246,20 @@ async fn test_broadcast_then_resolve() {
     let fabric = Fabric::with_seeds(&[url.as_str()]);
 
     // Broadcast
-    fabric.broadcast(&msg_bytes).await
+    fabric
+        .broadcast(&msg_bytes)
+        .await
         .expect("broadcast should succeed");
 
     // Resolve the same handles we just broadcast
-    fabric.resolve("alice@sovereign").await
+    fabric
+        .resolve("alice@sovereign")
+        .await
         .expect("should resolve alice after broadcast");
 
-    let batch = fabric.resolve_all(&["alice@sovereign", "bob@sovereign"]).await
+    let batch = fabric
+        .resolve_all(&["alice@sovereign", "bob@sovereign"])
+        .await
         .expect("should resolve all after broadcast");
     assert!(batch.zones.len() >= 2, "should have at least 2 zones");
 }

From 173477c8abb1272971f12a68787acfc21b93aea5 Mon Sep 17 00:00:00 2001
From: Buffrr <contact@buffrr.dev>
Date: Mon, 20 Apr 2026 16:27:58 +0200
Subject: [PATCH 2/3] docs: add install snippets with auto-versioning

Add <doc:install> tags to all example files. The snippets CI
replaces {{VERSION}} and {{LV_VERSION}} placeholders on
fabric-v* tags so docs always show current versions.

Also rewrite README to focus on certrelay with docs link.
---
 .github/workflows/snippets.yml      |  23 +++
 README.md                           | 294 +++-------------------------
 fabric/examples/go/main.go          |   4 +
 fabric/examples/js/index.mjs        |   4 +
 fabric/examples/kotlin/Example.kt   |  10 +
 fabric/examples/python/example.py   |   4 +
 fabric/examples/rust/src/main.rs    |   4 +
 fabric/examples/swift/Example.swift |   4 +
 8 files changed, 83 insertions(+), 264 deletions(-)

diff --git a/.github/workflows/snippets.yml b/.github/workflows/snippets.yml
index f76b2b7..dd0fda6 100644
--- a/.github/workflows/snippets.yml
+++ b/.github/workflows/snippets.yml
@@ -2,6 +2,8 @@ name: Extract code snippets
 
 on:
   push:
+    tags:
+      - "fabric-v*"
     paths:
       - "fabric/examples/**"
   workflow_dispatch:
@@ -17,8 +19,29 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Determine versions
+        id: version
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/fabric-v* ]]; then
+            echo "version=${GITHUB_REF_NAME#fabric-v}" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=latest" >> "$GITHUB_OUTPUT"
+          fi
+          # Pull libveritas version from what we actually depend on
+          LV_VERSION=$(grep 'libveritas-jvm' fabric/kotlin/build.gradle.kts | head -1 | sed 's/.*:\([0-9][^"]*\).*/\1/')
+          echo "lv_version=$LV_VERSION" >> "$GITHUB_OUTPUT"
+
       - name: Extract snippets
         run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          LV_VERSION="${{ steps.version.outputs.lv_version }}"
+
+          # Replace version placeholders in example files
+          find fabric/examples -type f \( -name "*.rs" -o -name "*.mjs" -o -name "*.go" -o -name "*.py" -o -name "*.kt" -o -name "*.swift" \) \
+            -exec sed -i "s/{{VERSION}}/$VERSION/g" {} + && \
+          find fabric/examples -type f \( -name "*.rs" -o -name "*.mjs" -o -name "*.go" -o -name "*.py" -o -name "*.kt" -o -name "*.swift" \) \
+            -exec sed -i "s/{{LV_VERSION}}/$LV_VERSION/g" {} +
+
           cd fabric/examples
           mkdir -p /tmp/snippets
 
diff --git a/README.md b/README.md
index 80d82ba..b38740a 100644
--- a/README.md
+++ b/README.md
@@ -1,296 +1,61 @@
 # Certrelay
 
-Certrelay is a certificate relay network for the [Spaces protocol](https://spacesprotocol.org). It stores and serves cryptographic proofs that bind human-readable names (handles) to owner keys anchored to Bitcoin.
+Certificate relay network for the [Spaces protocol](https://spacesprotocol.org). Stores and serves cryptographic proofs that bind human-readable names to owner keys anchored to Bitcoin.
 
-The entire protocol is plain HTTP, so relays are directly queryable from browsers, mobile apps, and any language with an HTTP client.
+## Overview
 
-A client can query any relay to resolve a handle like `alice@bitcoin` into its current owner key, sovereignty state, and optional owner-signed data. All verifiable against Bitcoin's chain state.
+Certrelay consists of two components:
 
+- **relay** — HTTP server that verifies certificates, stores them in SQLite, and gossips with peers
+- **fabric** — Client library available in Rust, JavaScript, Go, Python, Kotlin, and Swift
 
-## Fabric client
+The protocol is plain HTTP — relays are queryable from browsers, mobile apps, and any language with an HTTP client. All verification is done client-side against Bitcoin's chain state.
 
-Fabric is the high-level client for certrelay. It handles peer discovery, anchor verification, relay selection so you just call `resolve`.
+## Fabric Client
 
+For documentation on using Fabric to resolve handles, publish records, and verify identities, see:
 
-### JavaScript / TypeScript
+**[spacesprotocol.org/docs](https://spacesprotocol.org/docs)**
 
-Install the package for your platform:
+### Quick Start
 
 ```bash
-# Browser or Node.js
-npm install @spacesprotocol/fabric-web
-
-# React Native
-npm install @spacesprotocol/fabric-react-native
-```
-
-Resolve a handle:
-
-```ts
-import { Fabric } from '@spacesprotocol/fabric-web';
-// or: import { Fabric } from '@spacesprotocol/fabric-react-native';
-
-const fabric = new Fabric();
-const zone = await fabric.resolve("alice@bitcoin");
-
-console.log(zone.handle());       // "alice@bitcoin"
-console.log(zone.toJson());       // full zone data as JSON
-```
-
-Resolve multiple handles:
-
-```ts
-const zones = await fabric.resolveAll(["alice@bitcoin", "bob@bitcoin"]);
-for (const zone of zones) {
-  console.log(zone.handle, zone.toJson());
-}
-```
-
-Export a `.spacecert` certificate chain:
-
-```ts
-const certBytes = await fabric.export("alice@bitcoin");
-```
-
-Broadcast a signed message:
-
-```ts
-await fabric.broadcast(messageBytes);
-```
-
-By default, Fabric discovers anchors from seed relays. If you have a trusted anchor set hash (e.g. from your own Bitcoin node), pass it for **trustless** verification:
-
-```ts
-const fabric = new Fabric({ anchorSetHash: "ab3f...c7d2" });
-```
-
-### Rust
-
-```rust
-use fabric::client::Fabric;
-
-let fabric = Fabric::new();
-let zone = fabric.resolve("alice@bitcoin").await?;
-
-println!("{}: {:?}", zone.handle, zone.sovereignty);
-
-// With a trusted anchor set hash
-let fabric = Fabric::new().with_anchor_set("ab3f...c7d2");
-```
-
-### Packages
-
-| Package | Description |
-|---------|-------------|
-| `@spacesprotocol/fabric-core` | Provider-agnostic core (advanced use) |
-| `@spacesprotocol/fabric-web` | Browser & Node.js (WASM backend) |
-| `@spacesprotocol/fabric-react-native` | React Native (native backend) |
-| `fabric` (Rust crate) | Rust client |
-
-The web and React Native packages re-export everything from core, so most consumers only need one dependency. If you need custom provider wiring, use `fabric-core` directly.
-
-## Protocol
-
-### Endpoints
-
-| Method | Path | Description |
-|--------|------|-------------|
-| POST | `/query` | Resolve handles (JSON request, binary response) |
-| POST | `/message` | Submit a certificate message (binary) |
-| POST | `/announce` | Announce a peer relay (JSON) |
-| GET | `/peers` | List known peers (JSON) |
-| GET | `/hints` | Lightweight freshness check (JSON) |
-| POST | `/chain-proof` | Build a chain proof (JSON request, binary response) |
-| GET | `/anchors` | Get trust anchor set (JSON) |
-
-### Resolving handles
-
-Send a `POST /query` with a JSON body:
-
-```json
-{
-  "queries": [
-    {
-      "space": "@bitcoin",
-      "handles": ["alice", "bob"]
-    }
-  ]
-}
-```
-
-Each query targets a **space** (e.g. `@bitcoin`) and lists the **handles** within it to resolve. You can query multiple spaces in a single request.
-
-The response is a binary-encoded `Message` containing the chain proofs and certificates needed to verify each handle.
-
-### Epoch hints
-
-If the client has previously resolved a space and cached its epoch root, it can include an epoch hint to skip redundant proofs:
+# Rust
+cargo add fabric-rs
 
-```json
-{
-  "queries": [
-    {
-      "space": "@bitcoin",
-      "handles": ["alice"],
-      "epoch_hint": {
-        "root": "abcdef...",
-        "height": 870000
-      }
-    }
-  ]
-}
-```
-
-The relay will omit the receipt proof if the client's cached epoch is still current, reducing response size.
-
-### Freshness hints
-
-`GET /hints?q=alice@bitcoin,bob@bitcoin,@bitcoin` returns lightweight freshness data without fetching full certificates:
-
-```json
-{
-  "anchor_tip": 870100,
-  "hints": [
-    {
-      "epoch_tip": 870000,
-      "name": "@bitcoin",
-      "seq": 5,
-      "delegate_seq": 3,
-      "epochs": [
-        {
-          "epoch": 870000,
-          "res": [
-            { "seq": 2, "name": "alice@bitcoin" }
-          ]
-        }
-      ]
-    }
-  ]
-}
-```
-
-Fabric uses this to compare freshness across multiple relays and pick the most up-to-date one before querying.
-
-### Trust anchors
-
-`GET /anchors` returns the relay's current anchor set. An optional `?root=<hex>` parameter fetches a specific set by hash.
-
-Response headers include `X-Anchor-Root` and `X-Anchor-Height`, which allows cheap freshness comparison via `HEAD /anchors` without downloading the full set.
-
-## Verification
-
-Clients verify relay responses locally using [libveritas](https://github.com/spacesprotocol/libveritas). No trust is placed in the relay itself. All data is proven against Bitcoin's chain state via merkle proofs and ZK receipts.
-
-### Trust anchor bootstrapping
-
-A client needs one or more **root anchors** to verify messages. A root anchor is a snapshot of Bitcoin's chain state at a specific block height, containing:
-
-- Block hash and height
-- Spaces tree merkle root
-- Ptrs tree merkle root (commitments, delegations, key rotations)
-
-Anchors can be obtained from a trusted source (hardcoded in the client, fetched from a known relay, or derived from a Bitcoin node). Fabric handles this automatically by fetching from seed relays and verifying the anchor set hash.
-
-### Verification flow
-
-```
-Client                          Relay
-  |                               |
-  |  POST /query (JSON)           |
-  |------------------------------>|
-  |                               |
-  |  binary Message               |
-  |<------------------------------|
-  |                               |
-  |  verify_message(msg)          |
-  |  -> Vec<Zone>                 |
-```
-
-1. Client sends a query
-2. Relay responds with a `Message` containing proofs
-3. Client calls `verify_message` which checks all merkle proofs, ZK receipts, and signatures
-4. If verification succeeds, the client gets a list of `Zone` objects, one per handle
-
-### What a Zone contains
-
-Each verified `Zone` represents the current state of a handle:
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `handle` | SName | The resolved handle (e.g. `alice@bitcoin`) |
-| `sovereignty` | SovereigntyState | Commitment finality status |
-| `script_pubkey` | ScriptBuf | Current Bitcoin script controlling the handle |
-| `offchain_data` | Option\<OffchainData\> | Owner-signed arbitrary data |
-| `commitment` | ProvableOption\<CommitmentInfo\> | On-chain state commitment |
-| `delegate` | ProvableOption\<Delegate\> | Delegation info |
-| `anchor` | u32 | Block height of the proof snapshot |
-
-### Sovereignty states
-
-| State | Meaning |
-|-------|---------|
-| **Sovereign** | Commitment is finalized, the handle is fully self-governing |
-| **Pending** | Commitment exists but hasn't reached finality yet |
-| **Dependent** | No commitment, handle operates under parent space authority |
-
-### Offchain data
-
-Handle owners can attach arbitrary signed data without making on-chain transactions. The `OffchainData` contains:
-
-- `seq` - sequence number for versioning (higher = newer)
-- `data` - arbitrary byte payload
-- `signature` - Schnorr signature from the handle's current owner
-
-The signature is verified during `verify_message`. Applications can use this to store TLS certificates, service endpoints, payment addresses, or any other metadata.
-
-## Client implementation
-
-Fabric is the recommended way to interact with the relay network. Under the hood it:
-
-1. **Discovers peers** by fetching `GET /peers` from seed relays and collecting URLs
-2. **Fetches trust anchors** by polling `HEAD /anchors` across seeds, voting on the freshest anchor set hash, then downloading and verifying the full set via `GET /anchors?root=<hash>`
-3. **Selects relays** by querying `GET /hints` on multiple relays in parallel and ranking them by freshness
-4. **Resolves handles** by posting to `POST /query` on the freshest relay, verifying the binary response with libveritas, and falling through to the next relay on failure
-5. **Caches root zones** so subsequent queries for handles in the same space can include epoch hints and skip redundant proofs
-
-For broadcasting, Fabric submits the message to multiple relays via `POST /message` for gossip propagation.
+# JavaScript / TypeScript
+npm install @spacesprotocol/fabric-web
 
+# Go
+go get github.com/spacesprotocol/fabric-go
 
-## Peer discovery
+# Python
+pip install fabric-resolver
 
-Relays form a gossip network. New relays announce themselves via `POST /announce` and can be discovered by any client via `GET /peers`:
+# Kotlin
+implementation("org.spacesprotocol:fabric:0.1.0")
 
-```json
-[
-  {
-    "source_ip": "203.0.113.1",
-    "url": "https://relay2.example.com",
-    "capabilities": 0
-  }
-]
+# Swift
+.package(url: "https://github.com/spacesprotocol/fabric-swift.git", from: "0.1.0")
 ```
 
-This allows clients to fall back to alternative relays if one is unavailable.
-
-## Running a relay
+## Running a Relay
 
 ```bash
 cargo install --git https://github.com/spacesprotocol/certrelay.git --bin certrelay
 certrelay
 ```
 
-That's it. On first run, certrelay will:
-1. Download a checkpoint so it can sync quickly (~8MB)
+On first run, certrelay will:
+1. Download a checkpoint (~8MB)
 2. Build hash indexes (~2 min)
 3. Start an embedded Bitcoin light client ([yuki](https://github.com/imperviousinc/yuki)) and [spaced](https://github.com/spacesprotocol/spaces) node
 4. Sync to the chain tip and start serving
 
-No external Bitcoin node or Spaces node required. Data is stored in `~/.certrelay` by default.
+No external Bitcoin node required. Data is stored in `~/.certrelay` by default.
 
 ### Configuration
 
-All options can be set via CLI flags or environment variables:
-
 | Flag | Env | Default | Description |
 |------|-----|---------|-------------|
 | `--chain` | `CERTRELAY_CHAIN` | `mainnet` | Network (`mainnet`, `testnet4`) |
@@ -302,7 +67,6 @@ All options can be set via CLI flags or environment variables:
 | `--remote-ip-header` | `CERTRELAY_REMOTE_IP_HEADER` | - | Header for client IP behind reverse proxy |
 | `--is-bootstrap` | `CERTRELAY_BOOTSTRAP` | `false` | Run as a bootstrap node |
 | `--skip-checkpoint-sync` | - | `false` | Skip checkpoint download, sync from scratch |
-| `--anchor-refresh` | `CERTRELAY_ANCHOR_REFRESH` | `300` | Anchor refresh interval in seconds |
 
 ### Public relay behind a reverse proxy
 
@@ -315,8 +79,10 @@ certrelay \
 
 ### Using an external spaced node
 
-If you already run a spaced node, point certrelay at it to skip the embedded light client:
-
 ```bash
 certrelay --spaced-rpc-url http://user:password@127.0.0.1:12888
 ```
+
+## License
+
+MIT
\ No newline at end of file
diff --git a/fabric/examples/go/main.go b/fabric/examples/go/main.go
index 86f6a00..57f7b87 100644
--- a/fabric/examples/go/main.go
+++ b/fabric/examples/go/main.go
@@ -1,5 +1,9 @@
 package main
 
+// <doc:install>
+// go get github.com/spacesprotocol/fabric-go
+// </doc:install>
+
 import (
 	"encoding/hex"
 	"fmt"
diff --git a/fabric/examples/js/index.mjs b/fabric/examples/js/index.mjs
index e788783..aac89ba 100644
--- a/fabric/examples/js/index.mjs
+++ b/fabric/examples/js/index.mjs
@@ -1,3 +1,7 @@
+// <doc:install>
+// npm install @spacesprotocol/fabric-web
+// </doc:install>
+
 import { Fabric, RecordSet, Record, MessageBuilder } from "@spacesprotocol/fabric-web";
 import { signSchnorr } from "@spacesprotocol/fabric-web/signing";
 
diff --git a/fabric/examples/kotlin/Example.kt b/fabric/examples/kotlin/Example.kt
index 035ff02..b0dd707 100644
--- a/fabric/examples/kotlin/Example.kt
+++ b/fabric/examples/kotlin/Example.kt
@@ -1,3 +1,13 @@
+// <doc:install-kotlin-jvm>
+// implementation("org.spacesprotocol:fabric:{{VERSION}}")
+// implementation("org.spacesprotocol:libveritas-jvm:{{LV_VERSION}}")
+// </doc:install-kotlin-jvm>
+
+// <doc:install-kotlin-android>
+// implementation("org.spacesprotocol:fabric:{{VERSION}}")
+// implementation("org.spacesprotocol:libveritas:{{LV_VERSION}}")
+// </doc:install-kotlin-android>
+
 import org.spacesprotocol.fabric.Fabric
 import org.spacesprotocol.fabric.RecordSet
 import org.spacesprotocol.fabric.Record
diff --git a/fabric/examples/python/example.py b/fabric/examples/python/example.py
index 3b0c731..3e08f97 100644
--- a/fabric/examples/python/example.py
+++ b/fabric/examples/python/example.py
@@ -1,3 +1,7 @@
+# <doc:install>
+# pip install fabric-resolver
+# </doc:install>
+
 import asyncio
 
 from fabric import Fabric, RecordSet, Record, sign_schnorr
diff --git a/fabric/examples/rust/src/main.rs b/fabric/examples/rust/src/main.rs
index a271ea6..2b791d6 100644
--- a/fabric/examples/rust/src/main.rs
+++ b/fabric/examples/rust/src/main.rs
@@ -1,3 +1,7 @@
+// <doc:install>
+// cargo add fabric-rs
+// </doc:install>
+
 use fabric::client::{Fabric};
 use fabric::libveritas::builder::MessageBuilder;
 use fabric::libveritas::cert::CertificateChain;
diff --git a/fabric/examples/swift/Example.swift b/fabric/examples/swift/Example.swift
index 86dd213..6eedc55 100644
--- a/fabric/examples/swift/Example.swift
+++ b/fabric/examples/swift/Example.swift
@@ -1,3 +1,7 @@
+// <doc:install>
+// .package(url: "https://github.com/spacesprotocol/fabric-swift.git", from: "{{VERSION}}")
+// </doc:install>
+
 import Fabric
 
 func exampleResolveIntro() async throws {

From 63967253f99b02d676d4364f72703683d4232b1a Mon Sep 17 00:00:00 2001
From: Buffrr <contact@buffrr.dev>
Date: Mon, 20 Apr 2026 16:29:57 +0200
Subject: [PATCH 3/3] ci: only deploy snippets on fabric-v* tags

---
 .github/workflows/snippets.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/snippets.yml b/.github/workflows/snippets.yml
index dd0fda6..db91e3d 100644
--- a/.github/workflows/snippets.yml
+++ b/.github/workflows/snippets.yml
@@ -4,8 +4,6 @@ on:
   push:
     tags:
       - "fabric-v*"
-    paths:
-      - "fabric/examples/**"
   workflow_dispatch:
 
 permissions: