fix review feedback on signing example and CI node version

Author: Copilot

.agents/skills/building-with-hypercerts-lexicons/SKILL.md

@@ -556,12 +556,14 @@ const cidBytes = cid.bytes; // 36 bytes: 0x01 0x71 0x12 0x20 + 32-byte hash
 // 4. ECDSA-sign the CID bytes. Keypair.sign() applies the standard
 //    ECDSA hash-then-sign convention and enforces low-S per BIP-0062.
 const keypair = await Secp256k1Keypair.create({ exportable: false });
+const signerDid = keypair.did();
+const signerKey = `${signerDid}#${signerDid.slice("did:key:".length)}`;
 const signatureBytes = await keypair.sign(cidBytes);
 
 const inlineSignature = {
   $type: "app.certified.signature.defs#inline" as const,
   signature: signatureBytes,
-  key: `${platformDid}#signing`, // DID verification method reference
+  key: signerKey, // DID verification method reference for the keypair above
 };
 ```
 

.github/workflows/lint.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install dependencies

.github/workflows/pr-check.yml

@@ -13,7 +13,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
           cache: "npm"
       - run: npm ci
       - name: Check for changeset

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
           cache: "npm"
           # registry-url is required for npm Trusted Publishers
           registry-url: "https://registry.npmjs.org"

.github/workflows/style.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install dependencies

.github/workflows/test.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install dependencies

README.md

@@ -640,12 +640,14 @@ const cidBytes = cid.bytes; // 36 bytes: 0x01 0x71 0x12 0x20 + 32-byte hash
 // 4. ECDSA-sign the CID bytes. Keypair.sign() applies the standard
 //    ECDSA hash-then-sign convention and enforces low-S per BIP-0062.
 const keypair = await Secp256k1Keypair.create({ exportable: false });
+const signerDid = keypair.did();
+const signerKey = `${signerDid}#${signerDid.slice("did:key:".length)}`;
 const signatureBytes = await keypair.sign(cidBytes);
 
 const inlineSignature = {
   $type: "app.certified.signature.defs#inline" as const,
   signature: signatureBytes,
-  key: `${platformDid}#signing`, // DID verification method reference
+  key: signerKey, // DID verification method reference for the keypair above
 };
 ```
 

tests/validate-signing-example.test.ts

@@ -26,7 +26,7 @@ import { verifySignature } from "@atproto/crypto";
 import * as Activity from "../generated/types/org/hypercerts/claim/activity.js";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const EXTRACT_DIR = resolve(ROOT, "tests/extracted");
+const EXTRACT_DIR = resolve(ROOT, "tmp/extracted-signing-examples");
 
 interface ExtractedExample {
   signedActivity: { signatures: unknown[] };
@@ -206,7 +206,7 @@ for (const [label, relPath, basename] of SOURCES) {
       expect(example.inlineSignature.$type).toBe(
         "app.certified.signature.defs#inline",
       );
-      expect(example.inlineSignature.signature).toBe(example.signatureBytes);
+      expect(example.inlineSignature.signature).toEqual(example.signatureBytes);
       expect(example.inlineSignature.key).toMatch(/^did:[^:]+:.+#.+$/);
     });
 
@@ -219,10 +219,10 @@ for (const [label, relPath, basename] of SOURCES) {
 
     it("attaches both signatures to the final record", () => {
       expect(example.signedActivity.signatures).toHaveLength(2);
-      expect(example.signedActivity.signatures[0]).toBe(
+      expect(example.signedActivity.signatures[0]).toEqual(
         example.inlineSignature,
       );
-      expect(example.signedActivity.signatures[1]).toBe(
+      expect(example.signedActivity.signatures[1]).toEqual(
         example.remoteAttestation,
       );
     });