refactor: atproto-attestation dx and ergonomics

Cargo.lock

···
  "atproto-identity",
  "atproto-record",
  "base64",
+ "chrono",
  "cid",
  "clap",
  "elliptic-curve",
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
+ "indexmap",
  "itoa",
  "memchr",
  "ryu",

README.md

···
 
 ```rust
 use atproto_identity::key::{identify_key, to_public};
-use atproto_attestation::{create_inline_attestation, verify_all_signatures, VerificationStatus};
+use atproto_attestation::{
+    create_inline_attestation, verify_all_signatures, VerificationStatus,
+    input::{AnyInput, PhantomSignature}
+};
 use serde_json::json;
 
 #[tokio::main]
···
     let private_key = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
     let public_key = to_public(&private_key)?;
     let key_reference = format!("{}", &public_key);
+    let repository_did = "did:plc:repo123";
 
     let record = json!({
         "$type": "app.bsky.feed.post",
···
         "issuedAt": "2024-01-01T00:00:00.000Z"
     });
 
-    let signed_record =
-        create_inline_attestation(&record, &sig_metadata, &private_key)?;
+    let signed_record = create_inline_attestation::<PhantomSignature, PhantomSignature>(
+        AnyInput::Json(record),
+        AnyInput::Json(sig_metadata),
+        repository_did,
+        &private_key
+    )?;
 
-    let reports = verify_all_signatures(&signed_record, None).await?;
+    let reports = verify_all_signatures(&signed_record, repository_did, None).await?;
     assert!(reports.iter().all(|report| matches!(report.status, VerificationStatus::Valid { .. })));
 
     Ok(())

crates/atproto-attestation/Cargo.toml

···
 anyhow.workspace = true
 base64.workspace = true
 serde.workspace = true
-serde_json.workspace = true
+serde_json = {workspace = true, features = ["preserve_order"]}
 serde_ipld_dagcbor.workspace = true
 sha2.workspace = true
 thiserror.workspace = true
···
 
 [dev-dependencies]
 async-trait = "0.1"
+chrono = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt"] }
 
 [features]

crates/atproto-attestation/README.md

···
 # atproto-attestation
 
-Utilities for preparing, signing, and verifying AT Protocol record attestations using the CID-first workflow.
+Utilities for creating and verifying AT Protocol record attestations using the CID-first workflow.
 
 ## Overview
 
 A Rust library implementing the CID-first attestation specification for AT Protocol records. This crate provides cryptographic signature creation and verification for records, supporting both inline attestations (signatures embedded directly in records) and remote attestations (separate proof records with strongRef references).
 
 The attestation workflow ensures deterministic signing payloads and prevents replay attacks by:
-1. Preparing records with `$sig` metadata containing `$type` and `repository` fields
+1. Automatically preparing records with `$sig` metadata containing `$type` and `repository` fields
 2. Generating content identifiers (CIDs) using DAG-CBOR serialization
 3. Signing CID bytes with elliptic curve cryptography (for inline attestations)
-4. Embedding signatures or storing CIDs in proof records
-5. Verifying signatures against resolved public keys with repository validation
+4. Normalizing signatures to low-S form to prevent malleability attacks
+5. Embedding signatures or creating proof records with strongRef references
 
-**Critical Security Feature**: The `repository` field in `$sig` metadata binds attestations to specific repositories, preventing replay attacks where an attacker might attempt to clone records from one repository into their own
+**Critical Security Feature**: The `repository` field in `$sig` metadata binds attestations to specific repositories, preventing replay attacks where an attacker might attempt to clone records from one repository into their own.
 
 ## Features
 
···
 - **Remote attestations**: Create separate proof records with CID-based strongRef references
 - **CID-first workflow**: Deterministic signing based on content identifiers
 - **Multi-curve support**: Full support for P-256, P-384, and K-256 elliptic curves
-- **Signature normalization**: Automatic low-S normalization for ECDSA signatures
-- **Key resolution**: Resolve verification keys from DID documents or did:key identifiers
-- **Flexible verification**: Verify individual signatures or all signatures in a record
-- **Structured reporting**: Detailed verification reports with success/failure status
+- **Signature normalization**: Automatic low-S normalization for ECDSA signatures to prevent malleability
+- **Flexible input types**: Accept records as JSON strings, JSON values, or typed lexicons
+- **Repository binding**: Automatic prevention of replay attacks
 
 ## CLI Tools
 
···
 Inline attestations embed the signature bytes directly in the record:
 
 ```rust
-use atproto_identity::key::{identify_key, to_public};
-use atproto_attestation::create_inline_attestation;
+use atproto_identity::key::{generate_key, to_public, KeyType};
+use atproto_attestation::{create_inline_attestation, input::{AnyInput, PhantomSignature}};
 use serde_json::json;
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    // Parse the signing key from a did:key
-    let private_key = identify_key("did:key:zQ3sh...")?;
+fn main() -> anyhow::Result<()> {
+    // Generate a signing key
+    let private_key = generate_key(KeyType::K256Private)?;
     let public_key = to_public(&private_key)?;
     let key_reference = format!("{}", &public_key);
 
···
     let repository_did = "did:plc:repo123";
 
     // Attestation metadata (required: $type and key for inline attestations)
-    // Note: repository field is automatically added during CID generation but not stored in final signature
+    // Note: repository field is automatically added during CID generation
     let sig_metadata = json!({
         "$type": "com.example.inlineSignature",
         "key": &key_reference,
···
     });
 
     // Create inline attestation (repository_did is bound into the CID)
-    let signed_record = create_inline_attestation(
-        &record,
-        &sig_metadata,
+    // Signature is automatically normalized to low-S form
+    let signed_record = create_inline_attestation::<PhantomSignature, PhantomSignature>(
+        AnyInput::Json(record),
+        AnyInput::Json(sig_metadata),
         repository_did,
         &private_key
     )?;
···
       "key": "did:key:zQ3sh...",
       "issuer": "did:plc:issuer123",
       "issuedAt": "2024-01-01T00:00:00.000Z",
+      "cid": "bafyrei...",
       "signature": {
-        "$bytes": "base64-encoded-signature-bytes"
+        "$bytes": "base64-encoded-normalized-signature-bytes"
       }
     }
   ]
···
 Remote attestations create a separate proof record that must be stored in a repository:
 
 ```rust
-use atproto_attestation::{create_remote_attestation, create_remote_attestation_reference};
+use atproto_attestation::{create_remote_attestation, input::{AnyInput, PhantomSignature}};
 use serde_json::json;
 
-let record = json!({
-    "$type": "app.bsky.feed.post",
-    "text": "Hello world!"
-});
+fn main() -> anyhow::Result<()> {
+    let record = json!({
+        "$type": "app.bsky.feed.post",
+        "text": "Hello world!"
+    });
 
-// Repository housing the original record (for replay attack prevention)
-let repository_did = "did:plc:repo123";
+    // Repository housing the original record (for replay attack prevention)
+    let repository_did = "did:plc:repo123";
 
-// DID of the entity creating the attestation (will store the proof record)
-let attestor_did = "did:plc:attestor456";
+    // DID of the entity creating the attestation (will store the proof record)
+    let attestor_did = "did:plc:attestor456";
 
-let metadata = json!({
-    "$type": "com.example.attestation",
-    "issuer": "did:plc:issuer123",
-    "purpose": "verification"
-});
+    let metadata = json!({
+        "$type": "com.example.attestation",
+        "issuer": "did:plc:issuer123",
+        "purpose": "verification"
+    });
 
-// Create the proof record (contains the CID with repository binding)
-// Note: repository field is used during CID generation but not stored in proof
-let proof_record = create_remote_attestation(&record, &metadata, repository_did)?;
+    // Create both the attested record and proof record in one call
+    // Returns: (attested_record_with_strongRef, proof_record)
+    let (attested_record, proof_record) = create_remote_attestation::<PhantomSignature, PhantomSignature>(
+        AnyInput::Json(record),
+        AnyInput::Json(metadata),
+        repository_did,  // Repository housing the original record
+        attestor_did     // Repository that will store the proof record
+    )?;
 
-// Create the source record with strongRef pointing to the proof
-let attested_record = create_remote_attestation_reference(
-    &record,
-    &proof_record,
-    attestor_did  // DID where proof record will be stored
-)?;
+    // The proof_record should be stored in the attestor's repository
+    // The attested_record contains the strongRef reference
+    println!("Proof record:\n{}", serde_json::to_string_pretty(&proof_record)?);
+    println!("Attested record:\n{}", serde_json::to_string_pretty(&attested_record)?);
 
-// The proof_record should be stored in the attestor's repository
-// The attested_record contains the strongRef reference
+    Ok(())
+}
 ```
 
 ### Verifying Signatures
 
-Verify signatures embedded in records with repository validation:
+Verify all signatures in a record:
 
 ```rust
-use atproto_attestation::{verify_all_signatures, VerificationStatus};
+use atproto_attestation::{verify_record, input::AnyInput};
+use atproto_identity::key::IdentityDocumentKeyResolver;
+use atproto_client::record_resolver::HttpRecordResolver;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
···
     // CRITICAL: This must match the repository used during signing to prevent replay attacks
     let repository_did = "did:plc:repo123";
 
-    // Verify all signatures with repository validation
-    // Remote attestations will be unverified without a record resolver
-    let reports = verify_all_signatures(&signed_record, repository_did, None).await?;
-
-    for report in reports {
-        match report.status {
-            VerificationStatus::Valid { cid } => {
-                println!("✓ Signature {} is valid (CID: {})", report.index, cid);
-            }
-            VerificationStatus::Invalid { error } => {
-                println!("✗ Signature {} is invalid: {}", report.index, error);
-            }
-            VerificationStatus::Unverified { reason } => {
-                println!("? Signature {} unverified: {}", report.index, reason);
-            }
-        }
-    }
-
-    Ok(())
-}
-```
-
-### Verifying with Custom Key Resolver
-
-For signatures that reference DID document keys (not did:key), provide a key resolver:
-
-```rust
-use atproto_attestation::verify_all_signatures;
-use atproto_identity::key::IdentityDocumentKeyResolver;
-use atproto_identity::resolve::{HickoryDnsResolver, InnerIdentityResolver};
-use std::sync::Arc;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = reqwest::Client::new();
-    let dns_resolver = HickoryDnsResolver::create_resolver(&[]);
-
-    // Create identity and key resolvers
-    let identity_resolver = Arc::new(InnerIdentityResolver {
-        http_client: http_client.clone(),
-        dns_resolver: Arc::new(dns_resolver),
-        plc_hostname: "plc.directory".to_string(),
-    });
-    let key_resolver = IdentityDocumentKeyResolver::new(identity_resolver);
+    // Create resolvers for key and record fetching
+    let key_resolver = /* ... */;  // IdentityDocumentKeyResolver
+    let record_resolver = HttpRecordResolver::new(/* ... */);
 
-    let signed_record = /* ... */;
-    let repository_did = "did:plc:repo123";
-
-    // Verify with key resolver for DID document keys and repository validation
-    let reports = verify_all_signatures(
-        &signed_record,
+    // Verify all signatures with repository validation
+    verify_record(
+        AnyInput::Json(signed_record),
         repository_did,
-        Some(&key_resolver)
+        key_resolver,
+        record_resolver
     ).await?;
 
-    Ok(())
-}
-```
-
-### Verifying Remote Attestations
-
-To verify remote attestations (strongRef), use `verify_all_signatures_with_resolver` and provide a `RecordResolver` that can fetch proof records:
-
-```rust
-use atproto_attestation::verify_all_signatures_with_resolver;
-use atproto_client::record_resolver::RecordResolver;
-use atproto_identity::resolve::{HickoryDnsResolver, InnerIdentityResolver};
-use atproto_identity::traits::IdentityResolver;
-use std::sync::Arc;
-
-// Custom record resolver that resolves DIDs to find PDS endpoints
-struct MyRecordResolver {
-    http_client: reqwest::Client,
-    identity_resolver: InnerIdentityResolver,
-}
-
-#[async_trait::async_trait]
-impl RecordResolver for MyRecordResolver {
-    async fn resolve<T>(&self, aturi: &str) -> anyhow::Result<T>
-    where
-        T: serde::de::DeserializeOwned + Send,
-    {
-        // Parse AT-URI, resolve DID to PDS, fetch record
-        // See atproto-attestation-verify.rs for full implementation
-        todo!()
-    }
-}
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let http_client = reqwest::Client::new();
-    let dns_resolver = HickoryDnsResolver::create_resolver(&[]);
-
-    let identity_resolver = InnerIdentityResolver {
-        http_client: http_client.clone(),
-        dns_resolver: Arc::new(dns_resolver),
-        plc_hostname: "plc.directory".to_string(),
-    };
-
-    let record_resolver = MyRecordResolver {
-        http_client,
-        identity_resolver,
-    };
-
-    let signed_record = /* ... */;
-    let repository_did = "did:plc:repo123";
-
-    // Verify all signatures including remote attestations with repository validation
-    let reports = verify_all_signatures_with_resolver(
-        &signed_record,
-        repository_did,
-        None,
-        Some(&record_resolver)
-    ).await?;
+    println!("✓ All signatures verified successfully");
 
     Ok(())
 }
 ```
 
-### Manual CID Generation
-
-For advanced use cases, manually generate CIDs:
-
-```rust
-use atproto_attestation::{prepare_signing_record, create_cid};
-use serde_json::json;
-
-let record = json!({
-    "$type": "app.bsky.feed.post",
-    "text": "Manual CID generation"
-});
-
-let metadata = json!({
-    "$type": "com.example.signature",
-    "key": "did:key:z..."
-});
-
-let repository_did = "did:plc:repo123";
-
-// Prepare the signing record (adds $sig with repository field, removes signatures)
-// The repository field is automatically added to prevent replay attacks
-let signing_record = prepare_signing_record(&record, &metadata, repository_did)?;
-
-// Generate the CID (incorporates the repository binding)
-let cid = create_cid(&signing_record)?;
-println!("CID: {}", cid);
-```
-
 ## Command Line Usage
 
 ### Signing Records
···
   metadata.json
 
 # This outputs TWO JSON objects:
-# 1. Proof record (store this in the repository)
+# 1. Proof record (store this in the attestor's repository)
 # 2. Source record with strongRef attestation
 ```
 
 ### Verifying Signatures
 
-#### Verify All Signatures in a Record
-
 ```bash
 # Verify all signatures in a record from file
 cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
-  ./signed_record.json
-
-# Verify all signatures from AT-URI (fetches from PDS)
-cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
-  at://did:plc:abc123/app.bsky.feed.post/3k2k4j5h6g
+  ./signed_record.json \
+  did:plc:repo123
 
 # Verify from stdin
-cat signed_record.json | cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- -
+cat signed_record.json | cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
+  - \
+  did:plc:repo123
 
 # Verify from inline JSON
 cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
-  '{"$type":"app.bsky.feed.post","text":"Hello","signatures":[...]}'
+  '{"$type":"app.bsky.feed.post","text":"Hello","signatures":[...]}' \
+  did:plc:repo123
 
-# Output shows each signature status:
-# ✓ Signature 0 valid (key: did:key:zQ3sh...pb3) [CID: bafyrei...]
-# ? Signature 1 unverified: Remote attestations require fetching the proof record via strongRef.
-#
-# Summary: 2 total, 1 valid
+# Verify specific attestation against record
+cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
+  ./record.json \
+  did:plc:repo123 \
+  ./attestation.json
 ```
 
-#### Verify Specific Attestation Against Record
+## Public API
+
+The crate exposes the following public functions:
 
-```bash
-# Verify a specific attestation record (both from files)
-cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
-  ./record.json \
-  ./attestation.json
+### Attestation Creation
 
-# Verify attestation from AT-URI against local record
-cargo run --package atproto-attestation --features clap,tokio --bin atproto-attestation-verify -- \
-  ./record.json \
-  at://did:plc:xyz/com.example.attestation/abc123
+- **`create_inline_attestation`**: Create a signed record with embedded signature
+  - Automatically normalizes signatures to low-S form
+  - Binds attestation to repository DID
+  - Returns signed record with `signatures` array
 
-# On success, outputs:
-# OK
-# CID: bafyrei...
-```
+- **`create_remote_attestation`**: Create separate proof record and strongRef
+  - Returns tuple of (attested_record, proof_record)
+  - Proof record must be stored in attestor's repository
+
+### CID Generation
+
+- **`create_cid`**: Generate CID for a record with `$sig` metadata
+- **`create_dagbor_cid`**: Generate CID for any serializable data
+- **`create_attestation_cid`**: High-level CID generation with automatic `$sig` preparation
+
+### Signature Operations
+
+- **`normalize_signature`**: Normalize raw signature bytes to low-S form
+  - Prevents signature malleability attacks
+  - Supports P-256, P-384, and K-256 curves
+
+### Verification
+
+- **`verify_record`**: Verify all signatures in a record
+  - Validates repository binding
+  - Supports both inline and remote attestations
+  - Requires key and record resolvers
+
+### Input Types
+
+- **`AnyInput`**: Flexible input enum supporting:
+  - `String`: JSON string to parse
+  - `Json`: serde_json::Value
+  - `TypedLexicon`: Strongly-typed lexicon records
 
 ## Attestation Specification
 
···
 
 1. **Deterministic signing**: Records are serialized to DAG-CBOR with `$sig` metadata, producing consistent CIDs
 2. **Content addressing**: Signatures are over CID bytes, not the full record
-3. **Flexible metadata**: Custom fields in `$sig` are preserved and included in the CID calculation
-4. **Signature normalization**: ECDSA signatures are normalized to low-S form
-5. **Multiple attestations**: Records can have multiple signatures in the `signatures` array
+3. **Repository binding**: Every attestation is bound to a specific repository DID to prevent replay attacks
+4. **Signature normalization**: ECDSA signatures are normalized to low-S form to prevent malleability
+5. **Flexible metadata**: Custom fields in `$sig` are preserved and included in the CID calculation
+6. **Multiple attestations**: Records can have multiple signatures in the `signatures` array
 
 ### Signature Structure
 
···
   "$type": "com.example.signature",
   "key": "did:key:z...",
   "issuer": "did:plc:...",
+  "cid": "bafyrei...",
   "signature": {
-    "$bytes": "base64-signature"
+    "$bytes": "base64-normalized-signature"
   }
 }
 ```
···
 - `SignatureCreationFailed`: Key signing operation failed
 - `SignatureValidationFailed`: Signature verification failed
 - `SignatureNotNormalized`: ECDSA signature not in low-S form
+- `SignatureLengthInvalid`: Signature bytes have incorrect length
 - `KeyResolutionFailed`: Could not resolve verification key
 - `UnsupportedKeyType`: Key type not supported for signing/verification
+- `RemoteAttestationFetchFailed`: Failed to fetch remote proof record
 
 ## Security Considerations
 
···
 All ECDSA signatures are automatically normalized to low-S form to prevent signature malleability attacks:
 
 - The library enforces low-S normalization during signature creation
-- Verification rejects non-normalized signatures
+- Verification accepts only normalized signatures
 - This prevents attackers from creating alternate valid signatures for the same content
 
 ### Key Management Best Practices
···
 
 When creating attestations:
 
-- The `$type` field is always required in `$sig` metadata to scope the attestation
+- The `$type` field is always required in metadata to scope the attestation
 - The `repository` field is automatically added and must not be manually set
 - Custom metadata fields are preserved and included in CID calculation
+- The `cid` field is automatically added to inline attestation metadata
 
 ### Remote Attestation Considerations
 

crates/atproto-attestation/src/attestation.rs

···
 //! Core attestation creation functions.
 //!
-//! This module provides functions for creating inline and remote attestations,
-//! preparing records for signing, and attaching attestation references.
+//! This module provides functions for creating inline and remote attestations
+//! and attaching attestation references.
 
-use crate::cid::{create_cid, create_plain_cid};
+use crate::cid::{create_attestation_cid, create_dagbor_cid};
 use crate::errors::AttestationError;
+pub use crate::input::AnyInput;
 use crate::signature::normalize_signature;
-use crate::utils::{extract_signatures_vec, BASE64, STRONG_REF_TYPE};
-use atproto_identity::key::{KeyData, sign};
+use crate::utils::BASE64;
+use atproto_identity::key::{KeyData, KeyResolver, sign, validate};
+use atproto_record::lexicon::com::atproto::repo::STRONG_REF_NSID;
 use atproto_record::tid::Tid;
 use base64::Engine;
-use serde_json::{json, Value};
+use serde::Serialize;
+use serde_json::{Value, json, Map};
+use std::convert::TryInto;
 
-/// Prepare a record for signing by removing attestation artifacts and adding `$sig`.
+/// Helper function to extract and validate signatures array from a record
+fn extract_signatures(record_obj: &Map<String, Value>) -> Result<Vec<Value>, AttestationError> {
+    match record_obj.get("signatures") {
+        Some(value) => value
+            .as_array()
+            .ok_or(AttestationError::SignaturesFieldInvalid)
+            .cloned(),
+        None => Ok(vec![]),
+    }
+}
+
+/// Helper function to append a signature to a record and return the modified record
+fn append_signature_to_record(
+    mut record_obj: Map<String, Value>,
+    signature: Value,
+) -> Result<Value, AttestationError> {
+    let mut signatures = extract_signatures(&record_obj)?;
+    signatures.push(signature);
+
+    record_obj.insert(
+        "signatures".to_string(),
+        Value::Array(signatures),
+    );
+
+    Ok(Value::Object(record_obj))
+}
+
+/// Creates a remote attestation with both the attested record and proof record.
+///
+/// This is the recommended way to create remote attestations. It generates both:
+/// 1. The attested record with a strongRef in the signatures array
+/// 2. The proof record containing the CID to be stored in the attestation repository
 ///
-/// - Removes any existing `signatures`, `sigs`, and `$sig` fields.
-/// - Inserts the provided `attestation` metadata as the new `$sig` object.
-/// - Ensures the metadata contains a string `$type` discriminator.
-/// - Ensures the metadata contains a `repository` field with the repository DID to prevent replay attacks.
+/// The CID is generated with the repository DID included in the `$sig` metadata
+/// to bind the attestation to a specific repository and prevent replay attacks.
 ///
 /// # Arguments
 ///
-/// * `record` - The record to prepare for signing
-/// * `attestation` - The attestation metadata to include as `$sig`
-/// * `repository_did` - The DID of the repository housing this record
+/// * `record_input` - The record to attest (as AnyInput: String, Json, or TypedLexicon)
+/// * `metadata_input` - The attestation metadata (must include `$type`)
+/// * `repository` - The DID of the repository housing the original record
+/// * `attestation_repository` - The DID of the repository that will store the proof record
 ///
 /// # Returns
 ///
-/// The prepared record with `$sig` metadata
+/// A tuple containing:
+/// * `(attested_record, proof_record)` - Both records needed for remote attestation
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - The record or attestation are not JSON objects
-/// - The attestation metadata is missing the required `$type` field
-pub fn prepare_signing_record(
-    record: &Value,
-    attestation: &Value,
-    repository_did: &str,
-) -> Result<Value, AttestationError> {
-    let mut prepared = record
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::RecordMustBeObject)?;
+/// - The record or metadata are not valid JSON objects
+/// - The metadata is missing the required `$type` field
+/// - CID generation fails
+///
+/// # Example
+///
+/// ```rust
+/// use atproto_attestation::{create_remote_attestation, input::AnyInput};
+/// use serde_json::json;
+///
+/// # fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// let record = json!({"$type": "app.bsky.feed.post", "text": "Hello!"});
+/// let metadata = json!({"$type": "com.example.attestation"});
+///
+/// let (attested_record, proof_record) = create_remote_attestation(
+///     AnyInput::Serialize(record),
+///     AnyInput::Serialize(metadata),
+///     "did:plc:repo123",      // Source repository
+///     "did:plc:attestor456"   // Attestation repository
+/// )?;
+/// # Ok(())
+/// # }
+/// ```
+pub fn create_remote_attestation<
+    R: Serialize + Clone,
+    M: Serialize + Clone,
+>(
+    record_input: AnyInput<R>,
+    metadata_input: AnyInput<M>,
+    repository: &str,
+    attestation_repository: &str,
+) -> Result<(Value, Value), AttestationError> {
+    // Step 1: Create a content CID
+    let content_cid =
+        create_attestation_cid(record_input.clone(), metadata_input.clone(), repository)?;
 
-    let mut sig_metadata = attestation
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::MetadataMustBeObject)?;
+    let record_obj: Map<String, Value> = record_input
+        .try_into()
+        .map_err(|_| AttestationError::RecordMustBeObject)?;
+
+    // Step 2: Create the remote attestation record
+    let (remote_attestation_record, remote_attestation_type) = {
+        let mut metadata_obj: Map<String, Value> = metadata_input
+            .try_into()
+            .map_err(|_| AttestationError::MetadataMustBeObject)?;
+
+        // Extract the type from metadata before modifying it
+        let remote_type = metadata_obj
+            .get("$type")
+            .and_then(Value::as_str)
+            .ok_or(AttestationError::MetadataMissingType)?
+            .to_string();
 
-    if sig_metadata
-        .get("$type")
-        .and_then(Value::as_str)
-        .filter(|value| !value.is_empty()).is_none()
-    {
-        return Err(AttestationError::MetadataMissingSigType);
-    }
+        metadata_obj.insert("cid".to_string(), Value::String(content_cid.to_string()));
+        (serde_json::Value::Object(metadata_obj), remote_type)
+    };
 
-    // CRITICAL: Always set repository field for attestations to prevent replay attacks
-    sig_metadata.insert("repository".to_string(), Value::String(repository_did.to_string()));
+    // Step 3: Create the remote attestation reference (type, AT-URI, and CID)
+    let remote_attestation_record_key = Tid::new();
+    let remote_attestation_cid = create_dagbor_cid(&remote_attestation_record)?;
 
-    sig_metadata.remove("signature");
-    sig_metadata.remove("cid");
+    let attestation_reference = json!({
+        "$type": STRONG_REF_NSID,
+        "uri": format!("at://{attestation_repository}/{remote_attestation_type}/{remote_attestation_record_key}"),
+        "cid": remote_attestation_cid.to_string()
+    });
 
-    prepared.remove("signatures");
-    prepared.remove("sigs");
-    prepared.remove("$sig");
-    prepared.insert("$sig".to_string(), Value::Object(sig_metadata));
+    // Step 4: Append the attestation reference to the record "signatures" array
+    let attested_record = append_signature_to_record(record_obj, attestation_reference)?;
 
-    Ok(Value::Object(prepared))
+    Ok((attested_record, remote_attestation_record))
 }
 
-/// Creates an inline attestation by signing the prepared record with the provided key.
+/// Creates an inline attestation with signature embedded in the record.
+///
+/// This is the v2 API that supports flexible input types (String, Json, TypedLexicon)
+/// and provides a more streamlined interface for creating inline attestations.
 ///
-/// Signs the prepared record with the provided key and includes the repository DID
-/// in the `$sig` metadata during CID generation to bind the attestation to a specific repository.
+/// The CID is generated with the repository DID included in the `$sig` metadata
+/// to bind the attestation to a specific repository and prevent replay attacks.
 ///
 /// # Arguments
 ///
-/// * `record` - The record to sign
-/// * `attestation_metadata` - The attestation metadata (must include `$type` and `key`)
-/// * `repository_did` - The DID of the repository housing this record
-/// * `signing_key` - The private key to use for signing
+/// * `record_input` - The record to sign (as AnyInput: String, Json, or TypedLexicon)
+/// * `metadata_input` - The attestation metadata (must include `$type` and `key`)
+/// * `repository` - The DID of the repository that will house this record
+/// * `private_key_data` - The private key to use for signing
 ///
 /// # Returns
 ///
-/// The signed record with an inline attestation in the `signatures` array
+/// The record with an inline attestation embedded in the signatures array
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - Record preparation fails
+/// - The record or metadata are not valid JSON objects
+/// - The metadata is missing required fields
+/// - Signature creation fails
 /// - CID generation fails
-/// - Signature creation fails
-pub fn create_inline_attestation(
-    record: &Value,
-    attestation_metadata: &Value,
-    repository_did: &str,
-    signing_key: &KeyData,
+///
+/// # Example
+///
+/// ```rust
+/// use atproto_attestation::{create_inline_attestation, input::AnyInput};
+/// use atproto_identity::key::{KeyType, generate_key, to_public};
+/// use serde_json::json;
+///
+/// # fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// let private_key = generate_key(KeyType::K256Private)?;
+/// let public_key = to_public(&private_key)?;
+///
+/// let record = json!({"$type": "app.bsky.feed.post", "text": "Hello!"});
+/// let metadata = json!({
+///     "$type": "com.example.signature",
+///     "key": format!("{}", public_key)
+/// });
+///
+/// let signed_record = create_inline_attestation(
+///     AnyInput::Serialize(record),
+///     AnyInput::Serialize(metadata),
+///     "did:plc:repo123",
+///     &private_key
+/// )?;
+/// # Ok(())
+/// # }
+/// ```
+pub fn create_inline_attestation<
+    R: Serialize + Clone,
+    M: Serialize + Clone,
+>(
+    record_input: AnyInput<R>,
+    metadata_input: AnyInput<M>,
+    repository: &str,
+    private_key_data: &KeyData,
 ) -> Result<Value, AttestationError> {
-    let signing_record = prepare_signing_record(record, attestation_metadata, repository_did)?;
-    let cid = create_cid(&signing_record)?;
+    // Step 1: Create a content CID
+    let content_cid =
+        create_attestation_cid(record_input.clone(), metadata_input.clone(), repository)?;
+
+    let record_obj: Map<String, Value> = record_input
+        .try_into()
+        .map_err(|_| AttestationError::RecordMustBeObject)?;
+
+    // Step 2: Create the inline attestation record
+    let inline_attestation_record = {
+        let mut metadata_obj: Map<String, Value> = metadata_input
+            .try_into()
+            .map_err(|_| AttestationError::MetadataMustBeObject)?;
+
+        metadata_obj.insert("cid".to_string(), Value::String(content_cid.to_string()));
 
-    let raw_signature = sign(signing_key, &cid.to_bytes())
-        .map_err(|error| AttestationError::SignatureCreationFailed { error })?;
-    let signature_bytes = normalize_signature(raw_signature, signing_key.key_type())?;
+        let raw_signature = sign(private_key_data, &content_cid.to_bytes())
+            .map_err(|error| AttestationError::SignatureCreationFailed { error })?;
+        let signature_bytes = normalize_signature(raw_signature, private_key_data.key_type())?;
 
-    let mut inline_object = attestation_metadata
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::MetadataMustBeObject)?;
+        metadata_obj.insert(
+            "signature".to_string(),
+            json!({"$bytes": BASE64.encode(signature_bytes)}),
+        );
 
-    inline_object.remove("signature");
-    inline_object.remove("cid");
-    inline_object.remove("repository");  // Don't include repository in final attestation object
-    inline_object.insert(
-        "signature".to_string(),
-        json!({"$bytes": BASE64.encode(signature_bytes)}),
-    );
+        serde_json::Value::Object(metadata_obj)
+    };
 
-    create_inline_attestation_reference(record, &Value::Object(inline_object))
+    // Step 4: Append the attestation reference to the record "signatures" array
+    append_signature_to_record(record_obj, inline_attestation_record)
 }
 
-/// Creates a remote attestation by generating a proof record and strongRef entry.
+/// Validates an existing proof record and appends a strongRef to it in the record's signatures array.
+///
+/// This function validates that an existing proof record (attestation metadata with CID)
+/// is valid for the given record and repository, then creates and appends a strongRef to it.
+///
+/// Unlike `create_remote_attestation` which creates a new proof record, this function validates
+/// an existing proof record that was already created and stored in an attestor's repository.
 ///
-/// Generates a proof record containing the CID with the repository DID included
-/// in the `$sig` metadata during CID generation to bind the attestation to a specific repository.
+/// # Security
+///
+/// - **Repository binding validation**: Ensures the attestation was created for the specified repository DID
+/// - **CID verification**: Validates the proof record's CID matches the computed CID
+/// - **Content validation**: Ensures the proof record content matches what should be attested
+///
+/// # Workflow
+///
+/// 1. Compute the content CID from record + metadata + repository (same as attestation creation)
+/// 2. Extract the claimed CID from the proof record metadata
+/// 3. Verify the claimed CID matches the computed CID
+/// 4. Extract the proof record's storage CID (DAG-CBOR CID of the full proof record)
+/// 5. Create a strongRef with the AT-URI and proof record CID
+/// 6. Append the strongRef to the record's signatures array
 ///
 /// # Arguments
 ///
-/// * `record` - The record to attest
-/// * `attestation_metadata` - The attestation metadata (must include `$type`)
-/// * `repository_did` - The DID of the repository housing the original record
+/// * `record_input` - The record to append the attestation to (as AnyInput)
+/// * `metadata_input` - The proof record metadata (must include `$type`, `cid`, and attestation fields)
+/// * `repository` - The repository DID where the source record is stored (for replay attack prevention)
+/// * `attestation_uri` - The AT-URI where the proof record is stored (e.g., "at://did:plc:attestor/com.example.attestation/abc123")
 ///
 /// # Returns
 ///
-/// The remote proof record for storage in a repository
+/// The modified record with the strongRef appended to its `signatures` array
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - The attestation metadata is not a JSON object
-/// - Record preparation fails
-/// - CID generation fails
-pub fn create_remote_attestation(
-    record: &Value,
-    attestation_metadata: &Value,
-    repository_did: &str,
-) -> Result<Value, AttestationError> {
-    let metadata = attestation_metadata
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::MetadataMustBeObject)?;
-
-    let metadata_value = Value::Object(metadata.clone());
-    let signing_record = prepare_signing_record(record, &metadata_value, repository_did)?;
-    let cid = create_cid(&signing_record)?;
-
-    let mut remote_attestation = metadata.clone();
-    remote_attestation.remove("repository");  // Don't include repository in final proof record
-    remote_attestation.insert("cid".to_string(), Value::String(cid.to_string()));
-
-    Ok(Value::Object(remote_attestation))
-}
-
-/// Attach a remote attestation entry (strongRef) to the record.
+/// - The record or metadata are not valid JSON objects
+/// - The metadata is missing the `cid` field
+/// - The computed CID doesn't match the claimed CID in the metadata
+/// - The metadata is missing required attestation fields
 ///
-/// The `attestation` value must be an object containing:
-/// - `$type`: The type of the proof record
-/// - `cid`: The CID of the attested content
+/// # Type Parameters
 ///
-/// # Arguments
+/// * `R` - The record type (must implement Serialize + LexiconType + PartialEq + Clone)
+/// * `A` - The attestation type (must implement Serialize + LexiconType + PartialEq + Clone)
 ///
-/// * `record` - The record to add the attestation to
-/// * `attestation` - The proof record that will be referenced
-/// * `did` - The DID where the proof record is stored
+/// # Example
 ///
-/// # Returns
+/// ```ignore
+/// use atproto_attestation::{append_remote_attestation, input::AnyInput};
+/// use serde_json::json;
 ///
-/// The record with a strongRef attestation in the `signatures` array
+/// let record = json!({
+///     "$type": "app.bsky.feed.post",
+///     "text": "Hello world!"
+/// });
 ///
-/// # Errors
+/// // This is the proof record that was previously created and stored
+/// let proof_metadata = json!({
+///     "$type": "com.example.attestation",
+///     "issuer": "did:plc:issuer",
+///     "cid": "bafyrei...",  // Content CID computed from record+metadata+repository
+///     // ... other attestation fields
+/// });
 ///
-/// Returns an error if:
-/// - The record or attestation are not JSON objects
-/// - The attestation is missing required fields
-pub fn create_remote_attestation_reference(
-    record: &Value,
-    attestation: &Value,
-    did: &str,
-) -> Result<Value, AttestationError> {
-    let mut result = record
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::RecordMustBeObject)?;
+/// let repository_did = "did:plc:repo123";
+/// let attestation_uri = "at://did:plc:attestor456/com.example.attestation/abc123";
+///
+/// let signed_record = append_remote_attestation(
+///     AnyInput::Serialize(record),
+///     AnyInput::Serialize(proof_metadata),
+///     repository_did,
+///     attestation_uri
+/// )?;
+/// ```
+pub fn append_remote_attestation<R, A>(
+    record_input: AnyInput<R>,
+    metadata_input: AnyInput<A>,
+    repository: &str,
+    attestation_uri: &str,
+) -> Result<Value, AttestationError>
+where
+    R: Serialize + Clone,
+    A: Serialize + Clone,
+{
+    // Step 1: Compute the content CID (same as create_remote_attestation)
+    let content_cid =
+        create_attestation_cid(record_input.clone(), metadata_input.clone(), repository)?;
 
-    let attestation = attestation
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::MetadataMustBeObject)?;
+    // Step 2: Convert metadata to JSON and extract the claimed CID
+    let metadata_obj: Map<String, Value> = metadata_input
+        .try_into()
+        .map_err(|_| AttestationError::MetadataMustBeObject)?;
 
-    let remote_object_type = attestation
-        .get("$type")
+    let claimed_cid = metadata_obj
+        .get("cid")
         .and_then(Value::as_str)
         .filter(|value| !value.is_empty())
-        .ok_or(AttestationError::RemoteAttestationMissingCid)?;
+        .ok_or(AttestationError::SignatureMissingField {
+            field: "cid".to_string(),
+        })?;
 
-    let tid = Tid::new();
+    // Step 3: Verify the claimed CID matches the computed content CID
+    if content_cid.to_string() != claimed_cid {
+        return Err(AttestationError::RemoteAttestationCidMismatch {
+            expected: claimed_cid.to_string(),
+            actual: content_cid.to_string(),
+        });
+    }
 
-    let attestation_cid = create_plain_cid(&serde_json::Value::Object(attestation.clone()))?;
+    // Step 4: Compute the proof record's DAG-CBOR CID
+    let proof_record_cid = create_dagbor_cid(&metadata_obj)?;
 
-    let remote_object = json!({
-        "$type": STRONG_REF_TYPE,
-        "uri": format!("at://{did}/{remote_object_type}/{tid}"),
-        "cid": attestation_cid.to_string()
+    // Step 5: Create the strongRef
+    let strongref = json!({
+        "$type": STRONG_REF_NSID,
+        "uri": attestation_uri,
+        "cid": proof_record_cid.to_string()
     });
 
-    let mut signatures = extract_signatures_vec(&mut result)?;
-    signatures.push(remote_object);
-    result.insert("signatures".to_string(), Value::Array(signatures));
+    // Step 6: Convert record to JSON object and append the strongRef
+    let record_obj: Map<String, Value> = record_input
+        .try_into()
+        .map_err(|_| AttestationError::RecordMustBeObject)?;
 
-    Ok(Value::Object(result))
+    append_signature_to_record(record_obj, strongref)
 }
 
-/// Attach an inline attestation entry containing signature bytes.
+/// Validates an inline attestation and appends it to a record's signatures array.
 ///
-/// The `attestation` value must be an object containing:
-/// - `$type`: union discriminator (must NOT be `com.atproto.repo.strongRef`)
-/// - `key`: verification method reference used to sign
-/// - `signature`: object with `$bytes` base64 signature
+/// Inline attestations contain cryptographic signatures embedded directly in the record.
+/// This function validates the attestation signature against the record and repository,
+/// then appends it if validation succeeds.
+///
+/// # Security
 ///
-/// Additional custom fields are preserved for `$sig` metadata.
+/// - **Repository binding validation**: Ensures the attestation was created for the specified repository DID
+/// - **CID verification**: Validates the CID in the attestation matches the computed CID
+/// - **Signature verification**: Cryptographically verifies the ECDSA signature
+/// - **Key resolution**: Resolves and validates the verification key
 ///
 /// # Arguments
 ///
-/// * `record` - The record to add the attestation to
-/// * `attestation` - The inline attestation object with signature
+/// * `record_input` - The record to append the attestation to (as AnyInput)
+/// * `attestation_input` - The inline attestation to validate and append (as AnyInput)
+/// * `repository` - The repository DID where this record is stored (for replay attack prevention)
+/// * `key_resolver` - Resolver for looking up verification keys from DIDs
 ///
 /// # Returns
 ///
-/// The record with an inline attestation in the `signatures` array
+/// The modified record with the validated attestation appended to its `signatures` array
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - The record or attestation are not JSON objects
-/// - The attestation is missing required fields or has invalid type
-/// - The signature bytes are malformed
-pub fn create_inline_attestation_reference(
-    record: &Value,
-    attestation: &Value,
-) -> Result<Value, AttestationError> {
-    let mut result = record
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::RecordMustBeObject)?;
+/// - The record or attestation are not valid JSON objects
+/// - The attestation is missing required fields (`$type`, `key`, `cid`, `signature`)
+/// - The attestation CID doesn't match the computed CID for the record
+/// - The signature bytes are invalid or not base64-encoded
+/// - Signature verification fails
+/// - Key resolution fails
+///
+/// # Type Parameters
+///
+/// * `R` - The record type (must implement Serialize + LexiconType + PartialEq + Clone)
+/// * `A` - The attestation type (must implement Serialize + LexiconType + PartialEq + Clone)
+/// * `KR` - The key resolver type (must implement KeyResolver)
+///
+/// # Example
+///
+/// ```ignore
+/// use atproto_attestation::{append_inline_attestation, input::AnyInput};
+/// use serde_json::json;
+///
+/// let record = json!({
+///     "$type": "app.bsky.feed.post",
+///     "text": "Hello world!"
+/// });
+///
+/// let attestation = json!({
+///     "$type": "com.example.inlineSignature",
+///     "key": "did:key:zQ3sh...",
+///     "cid": "bafyrei...",
+///     "signature": {"$bytes": "base64-signature-bytes"}
+/// });
+///
+/// let repository_did = "did:plc:repo123";
+/// let key_resolver = /* your KeyResolver implementation */;
+///
+/// let signed_record = append_inline_attestation(
+///     AnyInput::Serialize(record),
+///     AnyInput::Serialize(attestation),
+///     repository_did,
+///     key_resolver
+/// ).await?;
+/// ```
+pub async fn append_inline_attestation<R, A, KR>(
+    record_input: AnyInput<R>,
+    attestation_input: AnyInput<A>,
+    repository: &str,
+    key_resolver: KR,
+) -> Result<Value, AttestationError>
+where
+    R: Serialize + Clone,
+    A: Serialize + Clone,
+    KR: KeyResolver,
+{
+    // Step 1: Create a content CID
+    let content_cid =
+        create_attestation_cid(record_input.clone(), attestation_input.clone(), repository)?;
 
-    let inline_object = attestation
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::MetadataMustBeObject)?;
+    let record_obj: Map<String, Value> = record_input
+        .try_into()
+        .map_err(|_| AttestationError::RecordMustBeObject)?;
 
-    let signature_type = inline_object
-        .get("$type")
-        .and_then(Value::as_str)
-        .ok_or_else(|| AttestationError::MetadataMissingField {
-            field: "$type".to_string(),
-        })?;
+    let attestation_obj: Map<String, Value> = attestation_input
+        .try_into()
+        .map_err(|_| AttestationError::MetadataMustBeObject)?;
 
-    if signature_type == STRONG_REF_TYPE {
-        return Err(AttestationError::InlineAttestationTypeInvalid);
-    }
-
-    inline_object
+    let key = attestation_obj
         .get("key")
         .and_then(Value::as_str)
         .filter(|value| !value.is_empty())
-        .ok_or_else(|| AttestationError::SignatureMissingField {
+        .ok_or(AttestationError::SignatureMissingField {
             field: "key".to_string(),
         })?;
+    let key_data =
+        key_resolver
+            .resolve(key)
+            .await
+            .map_err(|error| AttestationError::KeyResolutionFailed {
+                key: key.to_string(),
+                error,
+            })?;
 
-    let signature_bytes = inline_object
+    let signature_bytes = attestation_obj
         .get("signature")
         .and_then(Value::as_object)
         .and_then(|object| object.get("$bytes"))
         .and_then(Value::as_str)
-        .filter(|value| !value.is_empty())
         .ok_or(AttestationError::SignatureBytesFormatInvalid)?;
 
-    // Ensure the signature bytes decode cleanly to catch malformed input early.
-    let _ = BASE64
+    let signature_bytes = BASE64
         .decode(signature_bytes)
         .map_err(|error| AttestationError::SignatureDecodingFailed { error })?;
 
-    let mut signatures = extract_signatures_vec(&mut result)?;
-    signatures.push(Value::Object(inline_object));
-    result.insert("signatures".to_string(), Value::Array(signatures));
-    result.remove("$sig");
+    let computed_cid_bytes = content_cid.to_bytes();
+
+    validate(&key_data, &signature_bytes, &computed_cid_bytes)
+        .map_err(|error| AttestationError::SignatureValidationFailed { error })?;
 
-    Ok(Value::Object(result))
+    // Step 6: Append the validated attestation to the signatures array
+    append_signature_to_record(record_obj, json!(attestation_obj))
 }
 
 #[cfg(test)]
···
     use serde_json::json;
 
     #[test]
-    fn prepare_signing_record_removes_signatures() -> Result<(), AttestationError> {
-        let repository_did = "did:plc:test";
-        let record = json!({
-            "$type": "app.bsky.feed.post",
-            "text": "hello",
-            "signatures": [
-                {"$type": "example.sig", "signature": {"$bytes": "dGVzdA=="}, "key": "did:key:zabc"}
-            ]
-        });
+    fn create_remote_attestation_produces_both_records() -> Result<(), Box<dyn std::error::Error>> {
 
-        let metadata = json!({
-            "$type": "com.example.inlineSignature",
-            "key": "did:key:zabc",
-            "purpose": "demo",
-            "signature": {"$bytes": "trim"},
-            "cid": "bafyignored"
-        });
-
-        let prepared = prepare_signing_record(&record, &metadata, repository_did)?;
-        let object = prepared.as_object().unwrap();
-        assert!(object.get("signatures").is_none());
-        assert!(object.get("sigs").is_none());
-        assert!(object.get("$sig").is_some());
-
-        let sig_object = object.get("$sig").unwrap().as_object().unwrap();
-        assert_eq!(
-            sig_object.get("$type").and_then(Value::as_str),
-            Some("com.example.inlineSignature")
-        );
-        assert_eq!(
-            sig_object.get("repository").and_then(Value::as_str),
-            Some(repository_did)
-        );
-        assert_eq!(
-            sig_object.get("purpose").and_then(Value::as_str),
-            Some("demo")
-        );
-        assert!(sig_object.get("signature").is_none());
-        assert!(sig_object.get("cid").is_none());
-
-        Ok(())
-    }
-
-    #[test]
-    fn create_inline_attestation_appends_signature() -> Result<(), AttestationError> {
-        let record = json!({
-            "$type": "app.example.record",
-            "body": "Important content"
-        });
-
-        let inline = json!({
-            "$type": "com.example.inlineSignature",
-            "key": "did:key:zabc",
-            "signature": {"$bytes": "ZHVtbXk="}
-        });
-
-        let updated = create_inline_attestation_reference(&record, &inline)?;
-        let signatures = updated
-            .get("signatures")
-            .and_then(Value::as_array)
-            .expect("signatures array should exist");
-        assert_eq!(signatures.len(), 1);
-        assert_eq!(
-            signatures[0].get("$type").and_then(Value::as_str),
-            Some("com.example.inlineSignature")
-        );
-
-        Ok(())
-    }
-
-    #[test]
-    fn create_remote_attestation_produces_proof_record() -> Result<(), Box<dyn std::error::Error>> {
         let record = json!({
             "$type": "app.example.record",
             "body": "remote attestation"
···
             "$type": "com.example.attestation"
         });
 
-        let proof_record = create_remote_attestation(&record, &metadata, "did:plc:test")?;
+        let source_repository = "did:plc:test";
+        let attestation_repository = "did:plc:attestor";
+
+        let (attested_record, proof_record) =
+            create_remote_attestation(
+                AnyInput::Serialize(record.clone()),
+                AnyInput::Serialize(metadata),
+                source_repository,
+                attestation_repository,
+            )?;
 
-        let proof_object = proof_record
-            .as_object()
-            .expect("proof should be an object");
+        // Verify proof record structure
+        let proof_object = proof_record.as_object().expect("proof should be an object");
         assert_eq!(
             proof_object.get("$type").and_then(Value::as_str),
             Some("com.example.attestation")
···
             "repository should not be in final proof record"
         );
 
-        Ok(())
-    }
-
-    #[test]
-    fn prepare_signing_record_enforces_repository() -> Result<(), AttestationError> {
-        let record = json!({
-            "$type": "app.example.record",
-            "text": "Test content"
-        });
-
-        let metadata = json!({
-            "$type": "com.example.attestationType",
-            "purpose": "test"
-        });
-
-        let repository_did = "did:plc:testrepo123";
+        // Verify attested record has strongRef
+        let attested_object = attested_record
+            .as_object()
+            .expect("attested record should be an object");
+        let signatures = attested_object
+            .get("signatures")
+            .and_then(Value::as_array)
+            .expect("attested record should have signatures array");
+        assert_eq!(signatures.len(), 1, "should have one signature");
 
-        // Prepare with repository field
-        let prepared = prepare_signing_record(&record, &metadata, repository_did)?;
-        let prepared_obj = prepared.as_object().unwrap();
-        let sig_obj = prepared_obj.get("$sig").unwrap().as_object().unwrap();
-
-        // Verify repository field is set correctly
+        let signature = &signatures[0];
         assert_eq!(
-            sig_obj.get("repository").and_then(Value::as_str),
-            Some(repository_did)
+            signature.get("$type").and_then(Value::as_str),
+            Some("com.atproto.repo.strongRef"),
+            "signature should be a strongRef"
         );
-
-        // Verify $type is preserved
-        assert_eq!(
-            sig_obj.get("$type").and_then(Value::as_str),
-            Some("com.example.attestationType")
+        assert!(
+            signature.get("uri").and_then(Value::as_str).is_some(),
+            "strongRef must contain a uri"
         );
-
-        // Verify original metadata fields are preserved
-        assert_eq!(
-            sig_obj.get("purpose").and_then(Value::as_str),
-            Some("test")
+        assert!(
+            signature.get("cid").and_then(Value::as_str).is_some(),
+            "strongRef must contain a cid"
         );
 
         Ok(())
···
         });
 
         let signed = create_inline_attestation(
-            &base_record,
-            &sig_metadata,
+            AnyInput::Serialize(base_record),
+            AnyInput::Serialize(sig_metadata),
             repository_did,
             &private_key,
         )?;
···
         );
         assert!(sig.get("signature").is_some());
         assert!(sig.get("key").is_some());
-        assert!(sig.get("repository").is_none());  // Should not be in final signature
+        assert!(sig.get("repository").is_none()); // Should not be in final signature
 
         Ok(())
     }
-}
+}

crates/atproto-attestation/src/bin/atproto-attestation-sign.rs

···
 
 use anyhow::{Context, Result, anyhow};
 use atproto_attestation::{
-    create_inline_attestation, create_remote_attestation, create_remote_attestation_reference,
+    create_inline_attestation, create_remote_attestation,
+    input::AnyInput,
 };
 use atproto_identity::key::identify_key;
 use clap::{Parser, Subcommand};
···
             source_record,
             attestation_repository_did,
             metadata_record,
-        } => {
-            handle_remote_attestation(&source_record, &source_repository_did, &metadata_record, &attestation_repository_did)?
-        }
+        } => handle_remote_attestation(
+            &source_record,
+            &source_repository_did,
+            &metadata_record,
+            &attestation_repository_did,
+        )?,
 
         Commands::Inline {
             source_record,
             repository_did,
             signing_key,
             metadata_record,
-        } => handle_inline_attestation(&source_record, &repository_did, &signing_key, &metadata_record)?,
+        } => handle_inline_attestation(
+            &source_record,
+            &repository_did,
+            &signing_key,
+            &metadata_record,
+        )?,
     }
 
     Ok(())
···
         ));
     }
 
-    // Create the remote attestation proof record with source repository binding
-    let proof_record = create_remote_attestation(&record_json, &metadata_json, source_repository_did)
-        .context("Failed to create remote attestation proof record")?;
-
-    // Create the source record with strongRef reference pointing to attestation repository
-    let attested_record =
-        create_remote_attestation_reference(&record_json, &proof_record, attestation_repository_did)
-            .context("Failed to create remote attestation reference")?;
+    // Create the remote attestation using v2 API
+    // This creates both the attested record with strongRef and the proof record in one call
+    let (attested_record, proof_record) =
+        create_remote_attestation(
+            AnyInput::Serialize(record_json),
+            AnyInput::Serialize(metadata_json),
+            source_repository_did,
+            attestation_repository_did,
+        )
+        .context("Failed to create remote attestation")?;
 
     // Output both records
     println!("=== Proof Record (store in repository) ===");
···
     let key_data = identify_key(signing_key)
         .with_context(|| format!("Failed to parse signing key: {}", signing_key))?;
 
-    // Create inline attestation with repository binding
-    let signed_record =
-        create_inline_attestation(&record_json, &metadata_json, repository_did, &key_data)
-            .context("Failed to create inline attestation")?;
+    // Create inline attestation with repository binding using v2 API
+    let signed_record = create_inline_attestation(
+        AnyInput::Serialize(record_json),
+        AnyInput::Serialize(metadata_json),
+        repository_did,
+        &key_data,
+    )
+    .context("Failed to create inline attestation")?;
 
     // Output the signed record
     println!("{}", serde_json::to_string_pretty(&signed_record)?);

crates/atproto-attestation/src/bin/atproto-attestation-verify.rs

···
 //! ```
 
 use anyhow::{Context, Result, anyhow};
-use atproto_attestation::VerificationStatus;
+use atproto_attestation::AnyInput;
+use atproto_identity::key::{KeyData, KeyResolver};
 use clap::Parser;
 use serde_json::Value;
 use std::{
···
 
 USAGE:
   atproto-attestation-verify <record> <repository_did>                      Verify all signatures
-  atproto-attestation-verify <record> <repository_did> <attestation>        Verify specific attestation
 
 PARAMETER FORMATS:
   Each parameter accepts JSON strings, file paths, or AT-URIs:
···
     attestation: Option<String>,
 }
 
+struct FakeKeyResolver {}
+
+#[async_trait::async_trait]
+impl KeyResolver for FakeKeyResolver {
+    async fn resolve(&self, _subject: &str) -> Result<KeyData> {
+        todo!()
+    }
+}
+
 #[tokio::main]
 async fn main() -> Result<()> {
     let args = Args::parse();
···
     }
 
     // Determine verification mode
-    match args.attestation {
-        None => {
-            // Mode 1: Verify all signatures in the record
-            verify_all_mode(&record, &args.repository_did).await
-        }
-        Some(attestation_input) => {
-            // Mode 2: Verify specific attestation against record
-            let attestation = load_input(&attestation_input, false)
-                .await
-                .context("Failed to load attestation")?;
-
-            if !attestation.is_object() {
-                return Err(anyhow!("Attestation must be a JSON object"));
-            }
-
-            verify_attestation_mode(&record, &attestation, &args.repository_did).await
-        }
-    }
+    verify_all_mode(&record, &args.repository_did).await
 }
 
 /// Mode 1: Verify all signatures contained in the record.
···
         identity_resolver,
     };
 
-    let reports = atproto_attestation::verify_all_signatures_with_resolver(
-        record,
-        repository_did,
-        None,
-        Some(&record_resolver),
-    )
-    .await
-    .context("Failed to verify signatures")?;
-
-    if reports.is_empty() {
-        return Err(anyhow!("No signatures found in record"));
-    }
-
-    let mut all_valid = true;
-    let mut has_errors = false;
-
-    for report in &reports {
-        match &report.status {
-            VerificationStatus::Valid { cid } => {
-                let key_info = report
-                    .key
-                    .as_deref()
-                    .map(|k| format!(" (key: {})", truncate_did(k)))
-                    .unwrap_or_default();
-                println!(
-                    "✓ Signature {} valid{} [CID: {}]",
-                    report.index, key_info, cid
-                );
-            }
-            VerificationStatus::Invalid { error } => {
-                println!("✗ Signature {} invalid: {}", report.index, error);
-                all_valid = false;
-                has_errors = true;
-            }
-            VerificationStatus::Unverified { reason } => {
-                println!("? Signature {} unverified: {}", report.index, reason);
-                all_valid = false;
-            }
-        }
-    }
-
-    println!();
-    println!(
-        "Summary: {} total, {} valid",
-        reports.len(),
-        reports
-            .iter()
-            .filter(|r| matches!(r.status, VerificationStatus::Valid { .. }))
-            .count()
-    );
-
-    if has_errors {
-        Err(anyhow!("One or more signatures are invalid"))
-    } else if !all_valid {
-        Err(anyhow!("One or more signatures could not be verified"))
-    } else {
-        Ok(())
-    }
-}
-
-/// Mode 2: Verify a specific attestation record against the provided record.
-///
-/// The attestation should be a standalone attestation object (e.g., from a remote proof record)
-/// that will be verified against the record's content.
-async fn verify_attestation_mode(
-    record: &Value,
-    attestation: &Value,
-    repository_did: &str,
-) -> Result<()> {
-    // The attestation should have a CID field that we can use to verify
-    let attestation_obj = attestation
-        .as_object()
-        .ok_or_else(|| anyhow!("Attestation must be a JSON object"))?;
-
-    // Get the CID from the attestation
-    let cid_str = attestation_obj
-        .get("cid")
-        .and_then(Value::as_str)
-        .ok_or_else(|| anyhow!("Attestation must contain a 'cid' field"))?;
+    let key_resolver = FakeKeyResolver {};
 
-    // Prepare the signing record with the attestation metadata and repository DID
-    let mut signing_metadata = attestation_obj.clone();
-    signing_metadata.remove("cid");
-    signing_metadata.remove("signature");
-
-    let signing_record = atproto_attestation::prepare_signing_record(
-        record,
-        &Value::Object(signing_metadata),
+    atproto_attestation::verify_record(
+        AnyInput::Serialize(record.clone()),
         repository_did,
+        key_resolver,
+        record_resolver,
     )
-    .context("Failed to prepare signing record")?;
-
-    // Generate the CID from the signing record
-    let computed_cid =
-        atproto_attestation::create_cid(&signing_record).context("Failed to generate CID")?;
-
-    // Compare CIDs
-    if computed_cid.to_string() != cid_str {
-        return Err(anyhow!(
-            "CID mismatch: attestation claims {}, but computed {}",
-            cid_str,
-            computed_cid
-        ));
-    }
-
-    println!("OK");
-    println!("CID: {}", computed_cid);
-
-    Ok(())
+    .await
+    .context("Failed to verify signatures")
 }
 
 /// Load input from various sources: JSON string, file path, AT-URI, or stdin.
···
         atproto_client::com::atproto::repo::GetRecordResponse::Error(error) => {
             Err(anyhow!("Failed to fetch record: {}", error.error_message()))
         }
-    }
-}
-
-/// Truncate a DID or did:key for display purposes.
-fn truncate_did(did: &str) -> String {
-    if did.len() > 40 {
-        format!("{}...{}", &did[..20], &did[did.len() - 12..])
-    } else {
-        did.to_string()
     }
 }
 

crates/atproto-attestation/src/cid.rs

···
 //! This module implements the CID-first attestation workflow, generating
 //! deterministic content identifiers using DAG-CBOR serialization and SHA-256 hashing.
 
-use crate::errors::AttestationError;
+use crate::{errors::AttestationError, input::AnyInput};
+#[cfg(test)]
+use atproto_record::typed::LexiconType;
 use cid::Cid;
 use multihash::Multihash;
-use serde_json::Value;
+use serde::Serialize;
+use serde_json::{Value, Map};
 use sha2::{Digest, Sha256};
+use std::convert::TryInto;
 
-/// Create a deterministic CID for a record prepared with `prepare_signing_record`.
+/// DAG-CBOR codec identifier used in AT Protocol CIDs.
+///
+/// This codec (0x71) indicates that the data is encoded using DAG-CBOR,
+/// a deterministic subset of CBOR designed for content-addressable systems.
+pub const DAG_CBOR_CODEC: u64 = 0x71;
+
+/// SHA-256 multihash code used in AT Protocol CIDs.
+///
+/// This code (0x12) identifies SHA-256 as the hash function used to generate
+/// the content identifier. SHA-256 provides 256-bit cryptographic security.
+pub const MULTIHASH_SHA256: u64 = 0x12;
+
+/// Create a CID from any serializable data using DAG-CBOR encoding.
 ///
-/// The record **must** contain a `$sig` object with at least a `$type` string
-/// to scope the signature and a `repository` field to prevent replay attacks.
-/// The returned CID uses the blessed parameters:
-/// CIDv1, dag-cbor codec (0x71), and sha2-256 multihash.
+/// This function generates a content identifier (CID) for arbitrary data by:
+/// 1. Serializing the input to DAG-CBOR format
+/// 2. Computing a SHA-256 hash of the serialized bytes
+/// 3. Creating a CIDv1 with dag-cbor codec (0x71)
 ///
 /// # Arguments
 ///
-/// * `record` - The prepared record containing a `$sig` metadata object
+/// * `record` - The data to generate a CID for (must implement `Serialize`)
 ///
 /// # Returns
 ///
-/// The generated CID for the record
+/// The generated CID for the data using CIDv1 with dag-cbor codec (0x71) and sha2-256 hash
+///
+/// # Type Parameters
+///
+/// * `T` - Any type that implements `Serialize` and is compatible with DAG-CBOR encoding
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - The record is not a JSON object
-/// - The `$sig` field is missing or not an object
-/// - The `$sig` object is missing the required `$type` field
-/// - The `$sig` object is missing the required `repository` field
-pub fn create_cid(record: &Value) -> Result<Cid, AttestationError> {
-    let record_object = record
-        .as_object()
-        .ok_or(AttestationError::RecordMustBeObject)?;
+/// - DAG-CBOR serialization fails
+/// - Multihash wrapping fails
+///
+/// # Example
+///
+/// ```rust
+/// use atproto_attestation::cid::create_dagbor_cid;
+/// use serde_json::json;
+///
+/// # fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// let data = json!({"text": "Hello, world!"});
+/// let cid = create_dagbor_cid(&data)?;
+/// assert_eq!(cid.codec(), 0x71); // dag-cbor codec
+/// # Ok(())
+/// # }
+/// ```
+pub fn create_dagbor_cid<T: Serialize>(record: &T) -> Result<Cid, AttestationError> {
+    let dag_cbor_bytes = serde_ipld_dagcbor::to_vec(record)?;
+    let digest = Sha256::digest(&dag_cbor_bytes);
+    let multihash = Multihash::wrap(MULTIHASH_SHA256, &digest)
+        .map_err(|error| AttestationError::MultihashWrapFailed { error })?;
 
-    let sig_value = record_object
-        .get("$sig")
-        .ok_or(AttestationError::SigMetadataMissing)?;
+    Ok(Cid::new_v1(DAG_CBOR_CODEC, multihash))
+}
 
-    let sig_object = sig_value
-        .as_object()
-        .ok_or(AttestationError::SigMetadataNotObject)?;
+/// Create a CID for an attestation with automatic `$sig` metadata preparation.
+///
+/// This is the high-level function used internally by attestation creation functions.
+/// It handles the full workflow of preparing a signing record with `$sig` metadata
+/// and generating the CID.
+///
+/// # Arguments
+///
+/// * `record_input` - The record to attest (as AnyInput: String, Json, or TypedLexicon)
+/// * `metadata_input` - The attestation metadata (must include `$type`)
+/// * `repository` - The repository DID to bind the attestation to (prevents replay attacks)
+///
+/// # Returns
+///
+/// The generated CID for the prepared attestation record
+///
+/// # Errors
+///
+/// Returns an error if:
+/// - The record or metadata are not valid JSON objects
+/// - The record is missing the required `$type` field
+/// - The metadata is missing the required `$type` field
+/// - DAG-CBOR serialization fails
+pub fn create_attestation_cid<
+    R: Serialize + Clone,
+    M: Serialize + Clone,
+>(
+    record_input: AnyInput<R>,
+    metadata_input: AnyInput<M>,
+    repository: &str,
+) -> Result<Cid, AttestationError> {
+    let mut record_obj: Map<String, Value> = record_input
+        .try_into()
+        .map_err(|_| AttestationError::RecordMustBeObject)?;
 
-    if sig_object
+    if record_obj
         .get("$type")
         .and_then(Value::as_str)
-        .filter(|value| !value.is_empty()).is_none()
+        .filter(|value| !value.is_empty())
+        .is_none()
     {
-        return Err(AttestationError::SigMetadataMissingType);
+        return Err(AttestationError::RecordMissingType);
     }
 
-    if sig_object
-        .get("repository")
+    let mut metadata_obj: Map<String, Value> = metadata_input
+        .try_into()
+        .map_err(|_| AttestationError::MetadataMustBeObject)?;
+
+    if metadata_obj
+        .get("$type")
         .and_then(Value::as_str)
-        .filter(|value| !value.is_empty()).is_none()
+        .filter(|value| !value.is_empty())
+        .is_none()
     {
-        return Err(AttestationError::SigMetadataMissingType);
+        return Err(AttestationError::MetadataMissingSigType);
     }
 
-    let dag_cbor_bytes = serde_ipld_dagcbor::to_vec(record)?;
-    let digest = Sha256::digest(&dag_cbor_bytes);
-    let multihash = Multihash::wrap(0x12, &digest)
-        .map_err(|error| AttestationError::MultihashWrapFailed { error })?;
+    record_obj.remove("signatures");
 
-    Ok(Cid::new_v1(0x71, multihash))
+    metadata_obj.remove("cid");
+    metadata_obj.remove("signature");
+    metadata_obj.insert(
+        "repository".to_string(),
+        Value::String(repository.to_string()),
+    );
+
+    record_obj.insert("$sig".to_string(), Value::Object(metadata_obj.clone()));
+
+    // Directly pass the Map<String, Value> - no need to wrap in Value::Object
+    create_dagbor_cid(&record_obj)
 }
 
-/// Create a CID for a plain record without `$sig` validation.
+/// Validates that a CID string conforms to AT Protocol attestation requirements.
+///
+/// This function performs strict validation to ensure the CID meets the exact
+/// specifications required for AT Protocol attestations:
+///
+/// 1. **Valid format**: The string must be a parseable CID
+/// 2. **Version**: Must be CIDv1 (not CIDv0)
+/// 3. **Codec**: Must use DAG-CBOR codec (0x71)
+/// 4. **Hash algorithm**: Must use SHA-256 (multihash code 0x12)
+/// 5. **Hash length**: Must have exactly 32 bytes (SHA-256 standard)
 ///
-/// This is used internally for generating CIDs of attestation records themselves.
+/// These requirements ensure consistency and security across the AT Protocol
+/// ecosystem, particularly for content addressing and attestation verification.
 ///
 /// # Arguments
 ///
-/// * `record` - The record to generate a CID for
+/// * `cid` - A string slice containing the CID to validate
 ///
 /// # Returns
 ///
-/// The generated CID for the record
-pub(crate) fn create_plain_cid(record: &Value) -> Result<Cid, AttestationError> {
-    let dag_cbor_bytes = serde_ipld_dagcbor::to_vec(record)?;
-    let digest = Sha256::digest(&dag_cbor_bytes);
-    let multihash = Multihash::wrap(0x12, &digest)
-        .map_err(|error| AttestationError::MultihashWrapFailed { error })?;
+/// * `true` if the CID meets all AT Protocol requirements
+/// * `false` if the CID is invalid or doesn't meet any requirement
+///
+/// # Examples
+///
+/// ```rust
+/// use atproto_attestation::cid::validate_cid_format;
+///
+/// // Valid AT Protocol CID (CIDv1, DAG-CBOR, SHA-256)
+/// let valid_cid = "bafyreigw5bqvbz6m3c3zjpqhxwl4njlnbbnw5xvptbx6dzfxjqcde6lt3y";
+/// assert!(validate_cid_format(valid_cid));
+///
+/// // Invalid: Empty string
+/// assert!(!validate_cid_format(""));
+///
+/// // Invalid: Not a CID
+/// assert!(!validate_cid_format("not-a-cid"));
+///
+/// // Invalid: CIDv0 (starts with Qm)
+/// let cid_v0 = "QmYwAPJzv5CZsnA625ub3XtLxT3Tz5Lno5Wqv9eKewWKjE";
+/// assert!(!validate_cid_format(cid_v0));
+/// ```
+///
+/// # Use Cases
+///
+/// This function is typically used to:
+/// - Validate CIDs in attestation signatures before verification
+/// - Ensure CIDs in remote attestations match expected format
+/// - Validate user-provided CIDs in API requests
+/// - Verify CIDs generated by external systems conform to AT Protocol standards
+pub fn validate_cid_format(cid: &str) -> bool {
+    if cid.is_empty() {
+        return false
+    }
+
+    // Parse the CID using the cid crate for proper validation
+    let parsed_cid = match Cid::try_from(cid) {
+        Ok(value) => value,
+        Err(_) => return false,
+    };
+
+    // Verify it's CIDv1 (version 1)
+    if parsed_cid.version() != cid::Version::V1 {
+        return false;
+    }
+
+    // Verify it uses DAG-CBOR codec (0x71)
+    if parsed_cid.codec() != DAG_CBOR_CODEC {
+        return false;
+    }
+
+    // Get the multihash and verify it uses SHA-256
+    let multihash = parsed_cid.hash();
+
+    // SHA-256 code is 0x12
+    if multihash.code() != MULTIHASH_SHA256 {
+        return false;
+    }
+
+    // Verify the hash digest is 32 bytes (SHA-256 standard)
+    if multihash.digest().len() != 32 {
+        return false;
+    }
 
-    Ok(Cid::new_v1(0x71, multihash))
+    true
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use serde_json::json;
+    use atproto_record::typed::TypedLexicon;
+    use serde::Deserialize;
+    
+
+    #[tokio::test]
+    async fn test_create_attestation_cid() -> Result<(), AttestationError> {
+        use atproto_record::datetime::format as datetime_format;
+        use chrono::{DateTime, Utc};
+
+        // Define test record type with createdAt and text fields
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        #[cfg_attr(debug_assertions, derive(Debug))]
+        struct TestRecord {
+            #[serde(rename = "createdAt", with = "datetime_format")]
+            created_at: DateTime<Utc>,
+            text: String,
+        }
 
-    #[test]
-    fn create_cid_produces_expected_codec_and_length() -> Result<(), AttestationError> {
-        let prepared = json!({
-            "$type": "app.example.record",
-            "text": "cid demo",
-            "$sig": {
-                "$type": "com.example.inlineSignature",
-                "key": "did:key:zabc",
-                "repository": "did:plc:test"
+        impl LexiconType for TestRecord {
+            fn lexicon_type() -> &'static str {
+                "com.example.testrecord"
             }
-        });
+        }
 
-        let cid = create_cid(&prepared)?;
-        assert_eq!(cid.codec(), 0x71);
-        assert_eq!(cid.hash().code(), 0x12);
-        assert_eq!(cid.hash().digest().len(), 32);
-        assert_eq!(cid.to_bytes().len(), 36);
+        // Define test metadata type
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        #[cfg_attr(debug_assertions, derive(Debug))]
+        struct TestMetadata {
+            #[serde(rename = "createdAt", with = "datetime_format")]
+            created_at: DateTime<Utc>,
+            purpose: String,
+        }
+
+        impl LexiconType for TestMetadata {
+            fn lexicon_type() -> &'static str {
+                "com.example.testmetadata"
+            }
+        }
+
+        // Create test data
+        let created_at = DateTime::parse_from_rfc3339("2025-01-15T14:00:00.000Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let record = TestRecord {
+            created_at,
+            text: "Hello, AT Protocol!".to_string(),
+        };
+
+        let metadata_created_at = DateTime::parse_from_rfc3339("2025-01-15T14:05:00.000Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let metadata = TestMetadata {
+            created_at: metadata_created_at,
+            purpose: "attestation".to_string(),
+        };
+
+        let repository = "did:plc:test123";
+
+        // Create typed lexicons
+        let typed_record = TypedLexicon::new(record);
+        let typed_metadata = TypedLexicon::new(metadata);
+
+        // Call the function
+        let cid = create_attestation_cid(
+            AnyInput::Serialize(typed_record),
+            AnyInput::Serialize(typed_metadata),
+            repository,
+        )?;
+
+        // Verify CID properties
+        assert_eq!(cid.codec(), 0x71, "CID should use dag-cbor codec");
+        assert_eq!(cid.hash().code(), 0x12, "CID should use sha2-256 hash");
+        assert_eq!(
+            cid.hash().digest().len(),
+            32,
+            "Hash digest should be 32 bytes"
+        );
+        assert_eq!(cid.to_bytes().len(), 36, "CID should be 36 bytes total");
 
         Ok(())
     }
 
-    #[test]
-    fn create_cid_requires_sig_type() {
-        let record = json!({
-            "$type": "app.example.record",
-            "$sig": {
-                "repository": "did:plc:test"
+    #[tokio::test]
+    async fn test_create_attestation_cid_deterministic() -> Result<(), AttestationError> {
+        use atproto_record::datetime::format as datetime_format;
+        use chrono::{DateTime, Utc};
+
+        // Define simple test types
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        struct SimpleRecord {
+            #[serde(rename = "createdAt", with = "datetime_format")]
+            created_at: DateTime<Utc>,
+            text: String,
+        }
+
+        impl LexiconType for SimpleRecord {
+            fn lexicon_type() -> &'static str {
+                "com.example.simple"
+            }
+        }
+
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        struct SimpleMetadata {
+            #[serde(rename = "createdAt", with = "datetime_format")]
+            created_at: DateTime<Utc>,
+        }
+
+        impl LexiconType for SimpleMetadata {
+            fn lexicon_type() -> &'static str {
+                "com.example.meta"
             }
-        });
+        }
+
+        let created_at = DateTime::parse_from_rfc3339("2025-01-01T00:00:00.000Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let record1 = SimpleRecord {
+            created_at,
+            text: "test".to_string(),
+        };
+        let record2 = SimpleRecord {
+            created_at,
+            text: "test".to_string(),
+        };
+
+        let metadata1 = SimpleMetadata { created_at };
+        let metadata2 = SimpleMetadata { created_at };
+
+        let repository = "did:plc:same";
+
+        // Create CIDs for identical records
+        let cid1 = create_attestation_cid(
+            AnyInput::Serialize(TypedLexicon::new(record1)),
+            AnyInput::Serialize(TypedLexicon::new(metadata1)),
+            repository,
+        )?;
+
+        let cid2 = create_attestation_cid(
+            AnyInput::Serialize(TypedLexicon::new(record2)),
+            AnyInput::Serialize(TypedLexicon::new(metadata2)),
+            repository,
+        )?;
 
-        let result = create_cid(&record);
-        assert!(matches!(result, Err(AttestationError::SigMetadataMissingType)));
+        // Verify determinism: identical inputs produce identical CIDs
+        assert_eq!(
+            cid1, cid2,
+            "Identical records should produce identical CIDs"
+        );
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_create_attestation_cid_different_repositories() -> Result<(), AttestationError> {
+        use atproto_record::datetime::format as datetime_format;
+        use chrono::{DateTime, Utc};
+
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        struct RepoRecord {
+            #[serde(rename = "createdAt", with = "datetime_format")]
+            created_at: DateTime<Utc>,
+            text: String,
+        }
+
+        impl LexiconType for RepoRecord {
+            fn lexicon_type() -> &'static str {
+                "com.example.repo"
+            }
+        }
+
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        struct RepoMetadata {
+            #[serde(rename = "createdAt", with = "datetime_format")]
+            created_at: DateTime<Utc>,
+        }
+
+        impl LexiconType for RepoMetadata {
+            fn lexicon_type() -> &'static str {
+                "com.example.repometa"
+            }
+        }
+
+        let created_at = DateTime::parse_from_rfc3339("2025-01-01T12:00:00.000Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let record = RepoRecord {
+            created_at,
+            text: "content".to_string(),
+        };
+        let metadata = RepoMetadata { created_at };
+
+        // Same record and metadata, different repositories
+        let cid1 = create_attestation_cid(
+            AnyInput::Serialize(TypedLexicon::new(record.clone())),
+            AnyInput::Serialize(TypedLexicon::new(metadata.clone())),
+            "did:plc:repo1",
+        )?;
+
+        let cid2 = create_attestation_cid(
+            AnyInput::Serialize(TypedLexicon::new(record)),
+            AnyInput::Serialize(TypedLexicon::new(metadata)),
+            "did:plc:repo2",
+        )?;
+
+        // Different repositories should produce different CIDs (prevents replay attacks)
+        assert_ne!(
+            cid1, cid2,
+            "Different repository DIDs should produce different CIDs"
+        );
+
+        Ok(())
     }
 
     #[test]
-    fn create_cid_requires_repository() {
-        let record = json!({
-            "$type": "app.example.record",
-            "$sig": {
-                "$type": "com.example.sig"
+    fn test_validate_cid_format() {
+        // Test valid CID (generated from our own create_dagbor_cid function)
+        let valid_data = serde_json::json!({"test": "data"});
+        let valid_cid = create_dagbor_cid(&valid_data).unwrap();
+        let valid_cid_str = valid_cid.to_string();
+        assert!(validate_cid_format(&valid_cid_str), "Valid CID should pass validation");
+
+        // Test empty string
+        assert!(!validate_cid_format(""), "Empty string should fail validation");
+
+        // Test invalid CID string
+        assert!(!validate_cid_format("not-a-cid"), "Invalid string should fail validation");
+        assert!(!validate_cid_format("abc123"), "Invalid string should fail validation");
+
+        // Test CIDv0 (starts with Qm, uses different format)
+        let cid_v0 = "QmYwAPJzv5CZsnA625ub3XtLxT3Tz5Lno5Wqv9eKewWKjE";
+        assert!(!validate_cid_format(cid_v0), "CIDv0 should fail validation");
+
+        // Test valid CID base32 format but wrong codec (not DAG-CBOR)
+        // This is a valid CID but uses raw codec (0x55) instead of DAG-CBOR (0x71)
+        let wrong_codec = "bafkreigw5bqvbz6m3c3zjpqhxwl4njlnbbnw5xvptbx6dzfxjqcde6lt3y";
+        assert!(!validate_cid_format(wrong_codec), "CID with wrong codec should fail");
+
+        // Test that our constants match what we're checking
+        assert_eq!(DAG_CBOR_CODEC, 0x71, "DAG-CBOR codec constant should be 0x71");
+        assert_eq!(MULTIHASH_SHA256, 0x12, "SHA-256 multihash code should be 0x12");
+    }
+
+    #[tokio::test]
+    async fn phantom_data_test() -> Result<(), AttestationError> {
+        let repository = "did:web:example.com";
+
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        struct FooRecord {
+            text: String,
+        }
+
+        impl LexiconType for FooRecord {
+            fn lexicon_type() -> &'static str {
+                "com.example.foo"
+            }
+        }
+
+        #[derive(Serialize, Deserialize, PartialEq, Clone)]
+        struct BarRecord {
+            text: String,
+        }
+
+        impl LexiconType for BarRecord {
+            fn lexicon_type() -> &'static str {
+                "com.example.bar"
             }
-        });
+        }
+
+        let foo = FooRecord {
+            text: "foo".to_string(),
+        };
+        let typed_foo = TypedLexicon::new(foo);
+
+        let bar = BarRecord {
+            text: "bar".to_string(),
+        };
+        let typed_bar = TypedLexicon::new(bar);
 
-        let result = create_cid(&record);
-        assert!(matches!(result, Err(AttestationError::SigMetadataMissingType)));
+        let cid1 = create_attestation_cid(
+            AnyInput::Serialize(typed_foo.clone()),
+            AnyInput::Serialize(typed_bar.clone()),
+            repository,
+        )?;
+
+        let value_bar = serde_json::to_value(typed_bar).expect("bar serde_json::Value conversion");
+
+        let cid2 = create_attestation_cid(
+            AnyInput::Serialize(typed_foo),
+            AnyInput::Serialize(value_bar),
+            repository,
+        )?;
+
+        assert_eq!(
+            cid1, cid2,
+            "Different repository DIDs should produce different CIDs"
+        );
+
+        Ok(())
     }
-}
+}

crates/atproto-attestation/src/errors.rs

···
     #[error("error-atproto-attestation-1 Record must be a JSON object")]
     RecordMustBeObject,
 
+    /// Error when the record omits the `$type` discriminator.
+    #[error("error-atproto-attestation-1 Record must include a string `$type` field")]
+    RecordMissingType,
+
     /// Error when attestation metadata is not a JSON object.
     #[error("error-atproto-attestation-2 Attestation metadata must be a JSON object")]
     MetadataMustBeObject,
···
     /// Error when `$sig` metadata omits the `$type` discriminator.
     #[error("error-atproto-attestation-16 `$sig` metadata must include a string `$type` field")]
     SigMetadataMissingType,
+
+    /// Error when metadata omits the `$type` discriminator.
+    #[error("error-atproto-attestation-18 Metadata must include a string `$type` field")]
+    MetadataMissingType,
 
     /// Error when a key resolver is required but not provided.
     #[error("error-atproto-attestation-17 Key resolver required to resolve key reference: {key}")]

crates/atproto-attestation/src/input.rs

···
+//! Input types for attestation functions supporting multiple input formats.
+
+use serde::Serialize;
+use serde_json::{Map, Value};
+use std::convert::TryFrom;
+use std::str::FromStr;
+use thiserror::Error;
+
+/// Flexible input type for attestation functions.
+///
+/// Allows passing records and metadata as JSON strings or any serde serializable types.
+#[derive(Clone)]
+pub enum AnyInput<S: Serialize + Clone> {
+    /// JSON string representation
+    String(String),
+    /// Serializable types
+    Serialize(S),
+}
+
+/// Error types for AnyInput parsing and transformation operations.
+///
+/// This enum provides specific error types for various failure modes when working
+/// with `AnyInput`, including JSON parsing errors, type conversion errors, and
+/// serialization failures.
+#[derive(Debug, Error)]
+pub enum AnyInputError {
+    /// Error when parsing JSON from a string fails.
+    #[error("Failed to parse JSON from string: {0}")]
+    JsonParseError(#[from] serde_json::Error),
+
+    /// Error when the value is not a JSON object.
+    #[error("Expected JSON object, but got {value_type}")]
+    NotAnObject {
+        /// The actual type of the value.
+        value_type: String,
+    },
+
+    /// Error when the string contains invalid JSON.
+    #[error("Invalid JSON string: {message}")]
+    InvalidJson {
+        /// Error message describing what's wrong with the JSON.
+        message: String,
+    },
+}
+
+impl AnyInputError {
+    /// Creates a new `NotAnObject` error with the actual type information.
+    pub fn not_an_object(value: &Value) -> Self {
+        let value_type = match value {
+            Value::Null => "null".to_string(),
+            Value::Bool(_) => "boolean".to_string(),
+            Value::Number(_) => "number".to_string(),
+            Value::String(_) => "string".to_string(),
+            Value::Array(_) => "array".to_string(),
+            Value::Object(_) => "object".to_string(), // Should not happen
+        };
+
+        AnyInputError::NotAnObject { value_type }
+    }
+}
+
+/// Implementation of `FromStr` for `AnyInput` that deserializes JSON strings.
+///
+/// This allows parsing JSON strings directly into `AnyInput<serde_json::Value>` using
+/// the standard `FromStr` trait. The string is deserialized using `serde_json::from_str`
+/// and wrapped in `AnyInput::Serialize`.
+///
+/// # Errors
+///
+/// Returns `AnyInputError::JsonParseError` if the string contains invalid JSON.
+///
+/// # Example
+///
+/// ```
+/// use atproto_attestation::input::AnyInput;
+/// use std::str::FromStr;
+///
+/// let input: AnyInput<serde_json::Value> = r#"{"type": "post", "text": "Hello"}"#.parse().unwrap();
+/// ```
+impl FromStr for AnyInput<serde_json::Value> {
+    type Err = AnyInputError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let value = serde_json::from_str(s)?;
+        Ok(AnyInput::Serialize(value))
+    }
+}
+
+impl<S: Serialize + Clone> From<S> for AnyInput<S> {
+    fn from(value: S) -> Self {
+        AnyInput::Serialize(value)
+    }
+}
+
+/// Implementation of `TryFrom` for converting `AnyInput` into a JSON object map.
+///
+/// This allows converting any `AnyInput` into a `serde_json::Map<String, Value>`, which
+/// represents a JSON object. Both string and serializable inputs are converted to JSON
+/// objects, with appropriate error handling for non-object values.
+///
+/// # Example
+///
+/// ```
+/// use atproto_attestation::input::AnyInput;
+/// use serde_json::{json, Map, Value};
+/// use std::convert::TryInto;
+///
+/// let input = AnyInput::Serialize(json!({"type": "post", "text": "Hello"}));
+/// let map: Map<String, Value> = input.try_into().unwrap();
+/// assert_eq!(map.get("type").unwrap(), "post");
+/// ```
+impl<S: Serialize + Clone> TryFrom<AnyInput<S>> for Map<String, Value> {
+    type Error = AnyInputError;
+
+    fn try_from(input: AnyInput<S>) -> Result<Self, Self::Error> {
+        match input {
+            AnyInput::String(value) => {
+                // Parse string as JSON
+                let json_value = serde_json::from_str::<Value>(&value)?;
+
+                // Extract as object
+                json_value
+                    .as_object()
+                    .cloned()
+                    .ok_or_else(|| AnyInputError::not_an_object(&json_value))
+            }
+            AnyInput::Serialize(value) => {
+                // Convert to JSON value
+                let json_value = serde_json::to_value(value)?;
+
+                // Extract as object
+                json_value
+                    .as_object()
+                    .cloned()
+                    .ok_or_else(|| AnyInputError::not_an_object(&json_value))
+            }
+        }
+    }
+}
+
+/// Default phantom type for AnyInput when no specific lexicon type is needed.
+///
+/// This type serves as the default generic parameter for `AnyInput`, allowing
+/// for simpler usage when working with untyped JSON values.
+#[derive(Serialize, PartialEq, Clone)]
+pub struct PhantomSignature {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_from_str_valid_json() {
+        let json_str = r#"{"type": "post", "text": "Hello", "count": 42}"#;
+        let result: Result<AnyInput<serde_json::Value>, _> = json_str.parse();
+
+        assert!(result.is_ok());
+
+        let input = result.unwrap();
+        match input {
+            AnyInput::Serialize(value) => {
+                assert_eq!(value["type"], "post");
+                assert_eq!(value["text"], "Hello");
+                assert_eq!(value["count"], 42);
+            }
+            _ => panic!("Expected AnyInput::Serialize variant"),
+        }
+    }
+
+    #[test]
+    fn test_from_str_invalid_json() {
+        let invalid_json = r#"{"type": "post", "text": "Hello" invalid json"#;
+        let result: Result<AnyInput<serde_json::Value>, _> = invalid_json.parse();
+
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_from_str_array() {
+        let json_array = r#"[1, 2, 3, "four"]"#;
+        let result: Result<AnyInput<serde_json::Value>, _> = json_array.parse();
+
+        assert!(result.is_ok());
+
+        let input = result.unwrap();
+        match input {
+            AnyInput::Serialize(value) => {
+                assert!(value.is_array());
+                let array = value.as_array().unwrap();
+                assert_eq!(array.len(), 4);
+                assert_eq!(array[0], 1);
+                assert_eq!(array[3], "four");
+            }
+            _ => panic!("Expected AnyInput::Serialize variant"),
+        }
+    }
+
+    #[test]
+    fn test_from_str_null() {
+        let null_str = "null";
+        let result: Result<AnyInput<serde_json::Value>, _> = null_str.parse();
+
+        assert!(result.is_ok());
+
+        let input = result.unwrap();
+        match input {
+            AnyInput::Serialize(value) => {
+                assert!(value.is_null());
+            }
+            _ => panic!("Expected AnyInput::Serialize variant"),
+        }
+    }
+
+    #[test]
+    fn test_from_str_with_use() {
+        // Test using the parse method directly with type inference
+        let input: AnyInput<serde_json::Value> = r#"{"$type": "app.bsky.feed.post"}"#
+            .parse()
+            .expect("Failed to parse JSON");
+
+        match input {
+            AnyInput::Serialize(value) => {
+                assert_eq!(value["$type"], "app.bsky.feed.post");
+            }
+            _ => panic!("Expected AnyInput::Serialize variant"),
+        }
+    }
+
+    #[test]
+    fn test_try_into_from_string() {
+        use std::convert::TryInto;
+
+        let input = AnyInput::<Value>::String(r#"{"type": "post", "text": "Hello"}"#.to_string());
+        let result: Result<Map<String, Value>, _> = input.try_into();
+
+        assert!(result.is_ok());
+        let map = result.unwrap();
+        assert_eq!(map.get("type").unwrap(), "post");
+        assert_eq!(map.get("text").unwrap(), "Hello");
+    }
+
+    #[test]
+    fn test_try_into_from_serialize() {
+        use serde_json::json;
+        use std::convert::TryInto;
+
+        let input = AnyInput::Serialize(json!({"$type": "app.bsky.feed.post", "count": 42}));
+        let result: Result<Map<String, Value>, _> = input.try_into();
+
+        assert!(result.is_ok());
+        let map = result.unwrap();
+        assert_eq!(map.get("$type").unwrap(), "app.bsky.feed.post");
+        assert_eq!(map.get("count").unwrap(), 42);
+    }
+
+    #[test]
+    fn test_try_into_string_not_object() {
+        use std::convert::TryInto;
+
+        let input = AnyInput::<Value>::String(r#"["array", "not", "object"]"#.to_string());
+        let result: Result<Map<String, Value>, AnyInputError> = input.try_into();
+
+        assert!(result.is_err());
+        match result.unwrap_err() {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "array");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+    }
+
+    #[test]
+    fn test_try_into_serialize_not_object() {
+        use serde_json::json;
+        use std::convert::TryInto;
+
+        let input = AnyInput::Serialize(json!([1, 2, 3]));
+        let result: Result<Map<String, Value>, AnyInputError> = input.try_into();
+
+        assert!(result.is_err());
+        match result.unwrap_err() {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "array");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+    }
+
+    #[test]
+    fn test_try_into_invalid_json_string() {
+        use std::convert::TryInto;
+
+        let input = AnyInput::<Value>::String("not valid json".to_string());
+        let result: Result<Map<String, Value>, AnyInputError> = input.try_into();
+
+        assert!(result.is_err());
+        match result.unwrap_err() {
+            AnyInputError::JsonParseError(_) => {}
+            _ => panic!("Expected JsonParseError"),
+        }
+    }
+
+    #[test]
+    fn test_try_into_null() {
+        use serde_json::json;
+        use std::convert::TryInto;
+
+        let input = AnyInput::Serialize(json!(null));
+        let result: Result<Map<String, Value>, AnyInputError> = input.try_into();
+
+        assert!(result.is_err());
+        match result.unwrap_err() {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "null");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+    }
+
+    #[test]
+    fn test_any_input_error_not_an_object() {
+        use serde_json::json;
+
+        // Test null
+        let err = AnyInputError::not_an_object(&json!(null));
+        match err {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "null");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+
+        // Test boolean
+        let err = AnyInputError::not_an_object(&json!(true));
+        match err {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "boolean");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+
+        // Test number
+        let err = AnyInputError::not_an_object(&json!(42));
+        match err {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "number");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+
+        // Test string
+        let err = AnyInputError::not_an_object(&json!("hello"));
+        match err {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "string");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+
+        // Test array
+        let err = AnyInputError::not_an_object(&json!([1, 2, 3]));
+        match err {
+            AnyInputError::NotAnObject { value_type } => {
+                assert_eq!(value_type, "array");
+            }
+            _ => panic!("Expected NotAnObject error"),
+        }
+    }
+
+    #[test]
+    fn test_error_display() {
+        use serde_json::json;
+
+        // Test NotAnObject error display
+        let err = AnyInputError::not_an_object(&json!(42));
+        assert_eq!(err.to_string(), "Expected JSON object, but got number");
+
+        // Test InvalidJson display
+        let err = AnyInputError::InvalidJson {
+            message: "unexpected token".to_string()
+        };
+        assert_eq!(err.to_string(), "Invalid JSON string: unexpected token");
+    }
+}

crates/atproto-attestation/src/lib.rs

···
 //! AT Protocol record attestation utilities based on the CID-first specification.
 //!
-//! This crate implements helpers for constructing deterministic signing payloads,
-//! creating inline and remote attestation references, and verifying signatures
-//! against DID verification methods. It follows the requirements documented in
-//! `bluesky-attestation-tee/documentation/spec/attestation.md`.
+//! This crate implements helpers for creating inline and remote attestations
+//! and verifying signatures against DID verification methods. It follows the
+//! requirements documented in `bluesky-attestation-tee/documentation/spec/attestation.md`.
 //!
-//! The workflow for inline attestations is:
-//! 1. Prepare a signing record with [`prepare_signing_record`].
-//! 2. Generate the content identifier using [`create_cid`].
-//! 3. Sign the CID bytes externally and embed the attestation with
-//!    [`create_inline_attestation_reference`].
-//! 4. Verify signatures with [`verify_signature`] or [`verify_all_signatures`].
+//! ## Inline Attestations
+//!
+//! Use `create_inline_attestation` to create a signed record with an embedded signature:
+//!
+//! ```no_run
+//! use atproto_attestation::{create_inline_attestation, AnyInput};
+//! use atproto_identity::key::{generate_key, KeyType};
+//! use serde_json::json;
+//!
+//! # fn main() -> Result<(), Box<dyn std::error::Error>> {
+//! let key = generate_key(KeyType::P256Private)?;
+//! let record = json!({"$type": "app.example.post", "text": "Hello!"});
+//! let metadata = json!({"$type": "com.example.sig", "key": "did:key:..."});
+//!
+//! let signed = create_inline_attestation(
+//!     AnyInput::Serialize(record),
+//!     AnyInput::Serialize(metadata),
+//!     "did:plc:repository",
+//!     &key
+//! )?;
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! ## Remote Attestations
 //!
-//! Remote attestations follow the same `$sig` preparation process but store the
-//! generated CID in a proof record and reference it with
-//! [`create_remote_attestation_reference`].
+//! Use `create_remote_attestation` to generate both the proof record and the
+//! attested record with strongRef in a single call.
 
 #![forbid(unsafe_code)]
 #![warn(missing_docs)]
 
 // Public modules
+pub mod cid;
 pub mod errors;
+pub mod input;
 
 // Internal modules
 mod attestation;
-mod cid;
 mod signature;
-mod types;
 mod utils;
 mod verification;
 
 // Re-export error type
 pub use errors::AttestationError;
 
-// Re-export types
-pub use types::{AttestationKind, VerificationReport, VerificationStatus};
-
-// Re-export CID generation
-pub use cid::create_cid;
+// Re-export CID generation functions
+pub use cid::{create_dagbor_cid};
 
 // Re-export signature normalization
 pub use signature::normalize_signature;
 
 // Re-export attestation functions
 pub use attestation::{
-    create_inline_attestation,
-    create_inline_attestation_reference,
+    append_inline_attestation, append_remote_attestation, create_inline_attestation,
     create_remote_attestation,
-    create_remote_attestation_reference,
-    prepare_signing_record,
 };
 
+// Re-export input types
+pub use input::{AnyInput, AnyInputError};
+
 // Re-export verification functions
-pub use verification::{
-    verify_all_signatures,
-    verify_all_signatures_with_resolver,
-    verify_signature,
-    verify_signature_with_resolver,
-};
+pub use verification::verify_record;
 
 /// Resolver trait for retrieving remote attestation records by AT URI.
 ///
 /// This trait is re-exported from atproto_client for convenience.
-pub use atproto_client::record_resolver::RecordResolver;
+pub use atproto_client::record_resolver::RecordResolver;

crates/atproto-attestation/src/signature.rs

···
-//! ECDSA signature normalization and validation.
+//! ECDSA signature normalization.
 //!
 //! This module handles signature normalization to the low-S form required by
 //! the AT Protocol attestation specification, preventing signature malleability attacks.
 
 use crate::errors::AttestationError;
-use atproto_identity::key::{KeyData, KeyType};
-use elliptic_curve::scalar::IsHigh;
+use atproto_identity::key::KeyType;
 use k256::ecdsa::Signature as K256Signature;
 use p256::ecdsa::Signature as P256Signature;
 
···
         KeyType::P256Private | KeyType::P256Public => normalize_p256(signature),
         KeyType::K256Private | KeyType::K256Public => normalize_k256(signature),
         other => Err(AttestationError::UnsupportedKeyType {
-            key_type: other.clone(),
+            key_type: (*other).clone(),
         }),
     }
 }
 
-/// Ensure a signature is in normalized low-S form.
-///
-/// Used during verification to reject non-normalized signatures.
-///
-/// # Arguments
-///
-/// * `key_data` - The key data containing the key type
-/// * `signature` - The signature bytes to validate
-///
-/// # Returns
-///
-/// Ok if the signature is normalized, error otherwise
-pub(crate) fn ensure_normalized_signature(
-    key_data: &KeyData,
-    signature: &[u8],
-) -> Result<(), AttestationError> {
-    match key_data.key_type() {
-        KeyType::P256Private | KeyType::P256Public => {
-            if signature.len() != 64 {
-                return Err(AttestationError::SignatureLengthInvalid {
-                    expected: 64,
-                    actual: signature.len(),
-                });
-            }
-
-            let parsed = P256Signature::from_slice(signature).map_err(|_| {
-                AttestationError::SignatureLengthInvalid {
-                    expected: 64,
-                    actual: signature.len(),
-                }
-            })?;
-
-            if bool::from(parsed.s().is_high()) {
-                return Err(AttestationError::SignatureNotNormalized);
-            }
-        }
-        KeyType::K256Private | KeyType::K256Public => {
-            if signature.len() != 64 {
-                return Err(AttestationError::SignatureLengthInvalid {
-                    expected: 64,
-                    actual: signature.len(),
-                });
-            }
-
-            let parsed = K256Signature::from_slice(signature).map_err(|_| {
-                AttestationError::SignatureLengthInvalid {
-                    expected: 64,
-                    actual: signature.len(),
-                }
-            })?;
-
-            if bool::from(parsed.s().is_high()) {
-                return Err(AttestationError::SignatureNotNormalized);
-            }
-        }
-        other => {
-            return Err(AttestationError::UnsupportedKeyType {
-                key_type: other.clone(),
-            });
-        }
-    }
-
-    Ok(())
-}
-
 /// Normalize a P-256 signature to low-S form.
 fn normalize_p256(signature: Vec<u8>) -> Result<Vec<u8>, AttestationError> {
     if signature.len() != 64 {
···
 #[cfg(test)]
 mod tests {
     use super::*;
-    use atproto_identity::key::{generate_key, sign, to_public};
-
-    #[test]
-    fn normalize_p256_signature() -> Result<(), Box<dyn std::error::Error>> {
-        // Create a real signature using P-256 key
-        let private_key = generate_key(KeyType::P256Private)?;
-        let message = b"test message";
-        let signature = sign(&private_key, message)?;
-
-        let result = normalize_p256(signature.clone())?;
-        assert_eq!(result.len(), 64);
-
-        // Verify the signature is normalized (low-S)
-        let parsed = P256Signature::from_slice(&result)?;
-        assert!(!bool::from(parsed.s().is_high()));
-
-        Ok(())
-    }
-
-    #[test]
-    fn normalize_k256_signature() -> Result<(), Box<dyn std::error::Error>> {
-        // Create a real signature using K-256 key
-        let private_key = generate_key(KeyType::K256Private)?;
-        let message = b"test message";
-        let signature = sign(&private_key, message)?;
-
-        let result = normalize_k256(signature.clone())?;
-        assert_eq!(result.len(), 64);
-
-        // Verify the signature is normalized (low-S)
-        let parsed = K256Signature::from_slice(&result)?;
-        assert!(!bool::from(parsed.s().is_high()));
-
-        Ok(())
-    }
 
     #[test]
     fn reject_invalid_signature_length() {
···
             Err(AttestationError::SignatureLengthInvalid { expected: 64, .. })
         ));
     }
-
-    #[test]
-    fn ensure_normalized_accepts_low_s() -> Result<(), Box<dyn std::error::Error>> {
-        // Create a valid, normalized signature
-        let key = generate_key(KeyType::K256Private)?;
-        let public_key = to_public(&key)?;
-        let message = b"test message";
-        let signature = sign(&key, message)?;
-
-        // Normalize it first to ensure low-S
-        let normalized = normalize_k256(signature)?;
-
-        // This should succeed because the signature is normalized
-        let result = ensure_normalized_signature(&public_key, &normalized);
-        assert!(result.is_ok());
-
-        Ok(())
-    }
-}
+}

crates/atproto-attestation/src/types.rs

···
-//! Type definitions for AT Protocol attestations.
-//!
-//! This module defines the core types used throughout the attestation framework,
-//! including attestation kinds, verification statuses, and report structures.
-
-use crate::errors::AttestationError;
-use cid::Cid;
-
-/// Kind of attestation represented within the `signatures` array.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum AttestationKind {
-    /// Inline attestation containing signature bytes.
-    Inline,
-    /// Remote attestation referencing a proof record via strongRef.
-    Remote,
-}
-
-/// Result of verifying a single attestation entry.
-#[derive(Debug)]
-pub enum VerificationStatus {
-    /// Signature is valid for the reconstructed signing payload.
-    Valid {
-        /// CID produced for the reconstructed record.
-        cid: Cid,
-    },
-    /// Signature verification or metadata validation failed.
-    Invalid {
-        /// Failure reason.
-        error: AttestationError,
-    },
-    /// Attestation cannot be verified locally (e.g., remote references).
-    Unverified {
-        /// Explanation for why verification was skipped.
-        reason: String,
-    },
-}
-
-/// Structured verification report for a single attestation entry.
-#[derive(Debug)]
-pub struct VerificationReport {
-    /// Zero-based index of the signature in the record's `signatures` array.
-    pub index: usize,
-    /// Detected attestation kind.
-    pub kind: AttestationKind,
-    /// `$type` discriminator from the attestation entry, if present.
-    pub signature_type: Option<String>,
-    /// Key reference for inline signatures (if available).
-    pub key: Option<String>,
-    /// Verification outcome.
-    pub status: VerificationStatus,
-}

crates/atproto-attestation/src/utils.rs

···
 //! Utility functions and constants for attestation operations.
 //!
 //! This module provides common utilities used throughout the attestation framework,
-//! including signature array manipulation and base64 encoding/decoding.
+//! including base64 encoding/decoding with flexible padding support.
 
-use crate::errors::AttestationError;
 use base64::{
     alphabet::STANDARD as STANDARD_ALPHABET,
     engine::{
···
         general_purpose::{GeneralPurpose, GeneralPurposeConfig},
     },
 };
-use serde_json::{Map, Value};
 
 /// Base64 engine that accepts both padded and unpadded input for maximum compatibility
 /// with various AT Protocol implementations. Uses standard encoding with padding for output,
···
         .with_encode_padding(true)
         .with_decode_padding_mode(DecodePaddingMode::Indifferent),
 );
-
-/// Type identifier for AT Protocol strongRef objects.
-pub(crate) const STRONG_REF_TYPE: &str = "com.atproto.repo.strongRef";
-
-/// Extract the signatures array from a record for verification.
-///
-/// Returns an error if the signatures field is missing or not an array.
-pub(crate) fn extract_signatures_array(record: &Value) -> Result<&Vec<Value>, AttestationError> {
-    let signatures = record.get("signatures");
-
-    match signatures {
-        Some(value) => value
-            .as_array()
-            .ok_or(AttestationError::SignaturesFieldInvalid),
-        None => Err(AttestationError::SignaturesArrayMissing),
-    }
-}
-
-/// Extract and remove the signatures array from a record for modification.
-///
-/// Returns the existing signatures array or an empty vector if not present.
-/// The signatures field is removed from the record map.
-pub(crate) fn extract_signatures_vec(record: &mut Map<String, Value>) -> Result<Vec<Value>, AttestationError> {
-    let existing = record.remove("signatures");
-
-    match existing {
-        Some(Value::Array(array)) => Ok(array),
-        Some(_) => Err(AttestationError::SignaturesFieldInvalid),
-        None => Ok(Vec::new()),
-    }
-}

crates/atproto-attestation/src/verification.rs

···
 //! Signature verification for AT Protocol attestations.
 //!
-//! This module provides comprehensive verification functions for both inline
-//! and remote attestations, with support for custom key and record resolvers.
+//! This module provides verification functions for AT Protocol record attestations.
 
-use crate::attestation::prepare_signing_record;
-use crate::cid::{create_cid, create_plain_cid};
+use crate::cid::create_attestation_cid;
 use crate::errors::AttestationError;
-use crate::signature::ensure_normalized_signature;
-use crate::types::{AttestationKind, VerificationReport, VerificationStatus};
-use crate::utils::{extract_signatures_array, BASE64, STRONG_REF_TYPE};
-use atproto_identity::key::{KeyData, KeyResolver, identify_key, validate};
+use crate::input::AnyInput;
+use crate::utils::BASE64;
+use atproto_identity::key::{KeyResolver, validate};
+use atproto_record::lexicon::com::atproto::repo::STRONG_REF_NSID;
 use base64::Engine;
-use cid::Cid;
-use serde_json::{Map, Value};
+use serde::Serialize;
+use serde_json::{Value, Map};
+use std::convert::TryInto;
 
-/// Verify a single attestation entry with repository binding.
-///
-/// Validates that the attestation was created for the specified repository DID
-/// to prevent replay attacks.
-///
-/// # Arguments
-///
-/// * `record` - The record containing signatures to verify
-/// * `index` - Zero-based index of the signature to verify
-/// * `repository_did` - The DID of the repository housing this record
-/// * `key_resolver` - Optional resolver for DID document keys
-///
-/// # Returns
-///
-/// A verification report with the validation outcome
-pub async fn verify_signature(
-    record: &Value,
-    index: usize,
-    repository_did: &str,
-    key_resolver: Option<&dyn KeyResolver>,
-) -> Result<VerificationReport, AttestationError> {
-    verify_signature_with_resolver::<atproto_client::record_resolver::HttpRecordResolver>(
-        record,
-        index,
-        repository_did,
-        key_resolver,
-        None,
-    )
-    .await
+/// Helper function to extract and validate signatures array from a record
+fn extract_signatures(record_object: &Map<String, Value>) -> Result<Vec<Value>, AttestationError> {
+    match record_object.get("signatures") {
+        Some(value) => value
+            .as_array()
+            .ok_or(AttestationError::SignaturesFieldInvalid)
+            .cloned(),
+        None => Ok(vec![]),
+    }
 }
 
-/// Verify a single attestation entry with repository binding and optional record resolver.
+/// Verify all signatures in a record with flexible input types.
 ///
-/// Validates that the attestation was created for the specified repository DID
-/// to prevent replay attacks across different repositories.
+/// This is a high-level verification function that accepts records in multiple formats
+/// (String, Json, or TypedLexicon) and verifies all signatures with custom resolvers.
 ///
 /// # Arguments
 ///
-/// * `record` - The record containing signatures to verify
-/// * `index` - Zero-based index of the signature to verify
-/// * `repository_did` - The DID of the repository housing this record
-/// * `key_resolver` - Optional resolver for DID document keys
-/// * `record_resolver` - Optional resolver for fetching remote attestation records
+/// * `verify_input` - The record to verify (as AnyInput: String, Json, or TypedLexicon)
+/// * `repository` - The repository DID to validate against (prevents replay attacks)
+/// * `key_resolver` - Resolver for looking up verification keys from DIDs
+/// * `record_resolver` - Resolver for fetching remote attestation proof records
 ///
 /// # Returns
 ///
-/// A verification report with the validation outcome
-pub async fn verify_signature_with_resolver<R>(
-    record: &Value,
-    index: usize,
-    repository_did: &str,
-    key_resolver: Option<&dyn KeyResolver>,
-    record_resolver: Option<&R>,
-) -> Result<VerificationReport, AttestationError>
-where
-    R: atproto_client::record_resolver::RecordResolver,
-{
-    let signatures_array = extract_signatures_array(record)?;
-    let signature_entry = signatures_array
-        .get(index)
-        .ok_or(AttestationError::SignatureIndexOutOfBounds { index })?;
-
-    let signature_map =
-        signature_entry
-            .as_object()
-            .ok_or_else(|| AttestationError::SignatureMissingField {
-                field: "object".to_string(),
-            })?;
-
-    let signature_type = signature_map
-        .get("$type")
-        .and_then(Value::as_str)
-        .map(ToOwned::to_owned);
-
-    let report_kind = match signature_type.as_deref() {
-        Some(STRONG_REF_TYPE) => AttestationKind::Remote,
-        _ => AttestationKind::Inline,
-    };
-
-    let key_reference = signature_map
-        .get("key")
-        .and_then(Value::as_str)
-        .map(ToOwned::to_owned);
-
-    let status = match report_kind {
-        AttestationKind::Remote => {
-            match record_resolver {
-                Some(resolver) => {
-                    match verify_remote_attestation(record, signature_map, repository_did, resolver).await {
-                        Ok(cid) => VerificationStatus::Valid { cid },
-                        Err(error) => VerificationStatus::Invalid { error },
-                    }
-                }
-                None => VerificationStatus::Unverified {
-                    reason: "Remote attestations require a record resolver to fetch the proof record via strongRef.".to_string(),
-                },
-            }
-        }
-        AttestationKind::Inline => {
-            match verify_inline_attestation(record, signature_map, repository_did, key_resolver).await {
-                Ok(cid) => VerificationStatus::Valid { cid },
-                Err(error) => VerificationStatus::Invalid { error },
-            }
-        }
-    };
-
-    Ok(VerificationReport {
-        index,
-        kind: report_kind,
-        signature_type,
-        key: key_reference,
-        status,
-    })
-}
-
-/// Verify all attestation entries with repository binding.
+/// Returns `Ok(())` if all signatures are valid, or an error if any verification fails.
 ///
-/// Validates that attestations were created for the specified repository DID
-/// to prevent replay attacks.
+/// # Errors
 ///
-/// # Arguments
+/// Returns an error if:
+/// - The input is not a valid record object
+/// - Any signature verification fails
+/// - Key or record resolution fails
 ///
-/// * `record` - The record containing signatures to verify
-/// * `repository_did` - The DID of the repository housing this record
-/// * `key_resolver` - Optional resolver for DID document keys
+/// # Type Parameters
 ///
-/// # Returns
-///
-/// A vector of verification reports, one for each signature
-pub async fn verify_all_signatures(
-    record: &Value,
-    repository_did: &str,
-    key_resolver: Option<&dyn KeyResolver>,
-) -> Result<Vec<VerificationReport>, AttestationError> {
-    verify_all_signatures_with_resolver::<atproto_client::record_resolver::HttpRecordResolver>(
-        record,
-        repository_did,
-        key_resolver,
-        None,
-    )
-    .await
-}
-
-/// Verify all attestation entries with repository binding and optional record resolver.
-///
-/// Validates that all attestations were created for the specified repository DID
-/// to prevent replay attacks across different repositories.
-///
-/// # Arguments
-///
-/// * `record` - The record containing signatures to verify
-/// * `repository_did` - The DID of the repository housing this record
-/// * `key_resolver` - Optional resolver for DID document keys
-/// * `record_resolver` - Optional resolver for fetching remote attestation records
-///
-/// # Returns
-///
-/// A vector of verification reports, one for each signature
-pub async fn verify_all_signatures_with_resolver<R>(
-    record: &Value,
-    repository_did: &str,
-    key_resolver: Option<&dyn KeyResolver>,
-    record_resolver: Option<&R>,
-) -> Result<Vec<VerificationReport>, AttestationError>
+/// * `R` - The record type (must implement Serialize + LexiconType + PartialEq + Clone)
+/// * `RR` - The record resolver type (must implement RecordResolver)
+/// * `KR` - The key resolver type (must implement KeyResolver)
+pub async fn verify_record<R, RR, KR>(
+    verify_input: AnyInput<R>,
+    repository: &str,
+    key_resolver: KR,
+    record_resolver: RR,
+) -> Result<(), AttestationError>
 where
-    R: atproto_client::record_resolver::RecordResolver,
+    R: Serialize + Clone,
+    RR: atproto_client::record_resolver::RecordResolver,
+    KR: KeyResolver,
 {
-    let signatures_array = extract_signatures_array(record)?;
-    let mut reports = Vec::with_capacity(signatures_array.len());
+    let record_object: Map<String, Value> = verify_input
+        .clone()
+        .try_into()
+        .map_err(|_| AttestationError::RecordMustBeObject)?;
 
-    for index in 0..signatures_array.len() {
-        reports.push(
-            verify_signature_with_resolver(
-                record,
-                index,
-                repository_did,
-                key_resolver,
-                record_resolver
-            ).await?,
-        );
-    }
+    let signatures = extract_signatures(&record_object)?;
 
-    Ok(reports)
-}
-
-/// Verify a remote attestation by fetching and validating the proof record.
-async fn verify_remote_attestation<R>(
-    record: &Value,
-    signature_object: &Map<String, Value>,
-    repository_did: &str,
-    record_resolver: &R,
-) -> Result<Cid, AttestationError>
-where
-    R: atproto_client::record_resolver::RecordResolver,
-{
-    // Extract the strongRef URI and CID
-    let uri = signature_object
-        .get("uri")
-        .and_then(Value::as_str)
-        .ok_or_else(|| AttestationError::SignatureMissingField {
-            field: "uri".to_string(),
-        })?;
-
-    let expected_cid_str = signature_object
-        .get("cid")
-        .and_then(Value::as_str)
-        .ok_or_else(|| AttestationError::SignatureMissingField {
-            field: "cid".to_string(),
-        })?;
-
-    // Fetch the proof record from the URI
-    let proof_record: Value = record_resolver.resolve(uri).await.map_err(|error| {
-        AttestationError::RemoteAttestationFetchFailed {
-            uri: uri.to_string(),
-            error,
-        }
-    })?;
-
-    // Verify the proof record CID matches
-    let proof_cid = create_plain_cid(&proof_record)?;
-    if proof_cid.to_string() != expected_cid_str {
-        return Err(AttestationError::RemoteAttestationCidMismatch {
-            expected: expected_cid_str.to_string(),
-            actual: proof_cid.to_string(),
-        });
+    if signatures.is_empty() {
+        return Ok(());
     }
 
-    // Extract the CID from the proof record
-    let attestation_cid_str = proof_record
-        .get("cid")
-        .and_then(Value::as_str)
-        .ok_or_else(|| AttestationError::SignatureMissingField {
-            field: "cid".to_string(),
-        })?;
+    for signature in signatures {
+        let signature_refernce_type = signature
+            .get("$type")
+            .and_then(Value::as_str)
+            .filter(|value| !value.is_empty())
+            .ok_or(AttestationError::SigMetadataMissingType)?;
 
-    // Parse the attestation CID
-    let attestation_cid =
-        attestation_cid_str
-            .parse::<Cid>()
-            .map_err(|_| AttestationError::InvalidCid {
-                cid: attestation_cid_str.to_string(),
-            })?;
-
-    // Prepare the signing record using the proof record as metadata (without the CID field)
-    let mut proof_metadata = proof_record
-        .as_object()
-        .cloned()
-        .ok_or(AttestationError::RecordMustBeObject)?;
-    proof_metadata.remove("cid");
+        let metadata = if signature_refernce_type == STRONG_REF_NSID {
+            let aturi = signature
+                .get("uri")
+                .and_then(Value::as_str)
+                .filter(|value| !value.is_empty())
+                .ok_or(AttestationError::SignatureMissingField {
+                    field: "uri".to_string(),
+                })?;
 
-    let signing_record = prepare_signing_record(record, &Value::Object(proof_metadata), repository_did)?;
-    let computed_cid = create_cid(&signing_record)?;
+            record_resolver
+                .resolve::<serde_json::Value>(aturi)
+                .await
+                .map_err(|error| AttestationError::RemoteAttestationFetchFailed {
+                    uri: aturi.to_string(),
+                    error,
+                })?
+        } else {
+            signature.clone()
+        };
 
-    // Verify the CID matches
-    if computed_cid != attestation_cid {
-        return Err(AttestationError::RemoteAttestationCidMismatch {
-            expected: attestation_cid.to_string(),
-            actual: computed_cid.to_string(),
-        });
-    }
-
-    Ok(computed_cid)
-}
-
-/// Verify an inline attestation by validating the signature.
-async fn verify_inline_attestation(
-    record: &Value,
-    signature_object: &Map<String, Value>,
-    repository_did: &str,
-    key_resolver: Option<&dyn KeyResolver>,
-) -> Result<Cid, AttestationError> {
-    let key_reference = signature_object
-        .get("key")
-        .and_then(Value::as_str)
-        .ok_or_else(|| AttestationError::SignatureMissingField {
-            field: "key".to_string(),
-        })?;
-
-    let key_data = resolve_key_reference(key_reference, key_resolver).await?;
-
-    let signature_bytes = signature_object
-        .get("signature")
-        .and_then(Value::as_object)
-        .and_then(|object| object.get("$bytes"))
-        .and_then(Value::as_str)
-        .ok_or(AttestationError::SignatureBytesFormatInvalid)?;
-
-    let signature_bytes = BASE64
-        .decode(signature_bytes)
-        .map_err(|error| AttestationError::SignatureDecodingFailed { error })?;
-
-    ensure_normalized_signature(&key_data, &signature_bytes)?;
-
-    let mut sig_metadata = signature_object.clone();
-    sig_metadata.remove("signature");
-
-    let signing_record = prepare_signing_record(record, &Value::Object(sig_metadata), repository_did)?;
-    let cid = create_cid(&signing_record)?;
-    let cid_bytes = cid.to_bytes();
-
-    validate(&key_data, &signature_bytes, &cid_bytes)
-        .map_err(|error| AttestationError::SignatureValidationFailed { error })?;
-
-    Ok(cid)
-}
-
-/// Resolve a key reference to key data using available resolution methods.
-async fn resolve_key_reference(
-    key_reference: &str,
-    key_resolver: Option<&dyn KeyResolver>,
-) -> Result<KeyData, AttestationError> {
-    // Try to parse as did:key directly
-    if let Some(base) = key_reference.split('#').next()
-        && let Ok(key_data) = identify_key(base) {
-            return Ok(key_data);
-        }
-
-    // Try the full reference as did:key
-    if let Ok(key_data) = identify_key(key_reference) {
-        return Ok(key_data);
-    }
-
-    // Fall back to key resolver for DID document keys
-    let resolver = key_resolver.ok_or_else(|| AttestationError::KeyResolverRequired {
-        key: key_reference.to_string(),
-    })?;
-
-    resolver
-        .resolve(key_reference)
-        .await
-        .map_err(|error| AttestationError::KeyResolutionFailed {
-            key: key_reference.to_string(),
-            error,
-        })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::attestation::create_inline_attestation;
-    use atproto_identity::key::{IdentityDocumentKeyResolver, KeyType, generate_key, to_public};
-    use atproto_identity::model::{Document, DocumentBuilder, VerificationMethod};
-    use atproto_identity::resolve::IdentityResolver;
-    use serde_json::json;
-    use std::sync::Arc;
-
-    struct StaticResolver {
-        document: Document,
-    }
-
-    #[async_trait::async_trait]
-    impl IdentityResolver for StaticResolver {
-        async fn resolve(&self, _subject: &str) -> anyhow::Result<Document> {
-            Ok(self.document.clone())
-        }
-    }
-
-    #[tokio::test]
-    async fn verify_inline_signature_with_did_key() -> Result<(), Box<dyn std::error::Error>> {
-        let private_key = generate_key(KeyType::K256Private)?;
-        let public_key = to_public(&private_key)?;
-        let key_reference = format!("{}", &public_key);
-        let repository_did = "did:plc:testrepository123";
-
-        let base_record = json!({
-            "$type": "app.example.record",
-            "body": "Sign me"
-        });
-
-        let sig_metadata = json!({
-            "$type": "com.example.inlineSignature",
-            "key": key_reference,
-            "purpose": "unit-test"
-        });
-
-        let signed = create_inline_attestation(
-            &base_record,
-            &sig_metadata,
-            repository_did,
-            &private_key,
+        let computed_cid = create_attestation_cid(
+            verify_input.clone(),
+            AnyInput::Serialize(metadata.clone()),
+            repository,
         )?;
 
-        let report = verify_signature(&signed, 0, repository_did, None).await?;
-        match report.status {
-            VerificationStatus::Valid { .. } => {}
-            other => panic!("expected valid signature, got {:?}", other),
-        }
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn verify_inline_signature_with_resolver() -> Result<(), Box<dyn std::error::Error>> {
-        let private_key = generate_key(KeyType::P256Private)?;
-        let public_key = to_public(&private_key)?;
-        let key_multibase = format!("{}", &public_key);
-        let key_reference = "did:plc:resolvertest#atproto".to_string();
-        let repository_did = "did:plc:resolvertest";
-
-        let document = DocumentBuilder::new()
-            .id("did:plc:resolvertest")
-            .add_verification_method(VerificationMethod::Multikey {
-                id: key_reference.clone(),
-                controller: "did:plc:resolvertest".to_string(),
-                public_key_multibase: key_multibase
-                    .strip_prefix("did:key:")
-                    .unwrap_or(&key_multibase)
-                    .to_string(),
-                extra: std::collections::HashMap::new(),
-            })
-            .build()
-            .unwrap();
-
-        let identity_resolver = Arc::new(StaticResolver { document });
-        let key_resolver = IdentityDocumentKeyResolver::new(identity_resolver.clone());
-
-        let base_record = json!({
-            "$type": "app.example.record",
-            "body": "resolver test"
-        });
-
-        let sig_metadata = json!({
-            "$type": "com.example.inlineSignature",
-            "key": key_reference,
-            "scope": "resolver"
-        });
+        if signature_refernce_type == STRONG_REF_NSID {
+            let attestation_cid = metadata
+                .get("cid")
+                .and_then(Value::as_str)
+                .filter(|value| !value.is_empty())
+                .ok_or(AttestationError::SignatureMissingField {
+                    field: "cid".to_string(),
+                })?;
 
-        let signed = create_inline_attestation(
-            &base_record,
-            &sig_metadata,
-            repository_did,
-            &private_key,
-        )?;
-
-        let report =
-            verify_signature(&signed, 0, repository_did, Some(&key_resolver))
-                .await?;
-        match report.status {
-            VerificationStatus::Valid { .. } => {}
-            other => panic!("expected valid signature, got {:?}", other),
+            if computed_cid.to_string() != attestation_cid {
+                return Err(AttestationError::RemoteAttestationCidMismatch {
+                    expected: attestation_cid.to_string(),
+                    actual: computed_cid.to_string(),
+                });
+            }
+            continue;
         }
 
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn verify_all_signatures_reports_remote() -> Result<(), Box<dyn std::error::Error>> {
-        let repository_did = "did:plc:example";
-        let record = json!({
-            "$type": "app.example.record",
-            "signatures": [
-                {
-                    "$type": STRONG_REF_TYPE,
-                    "cid": "bafyreid473y2gjzvzgjwdj3vpbk2bdzodf5hvbgxncjc62xmy3zsmb3pxq",
-                    "uri": "at://did:plc:example/com.example.attestation/abc123"
-                }
-            ]
-        });
-
-        let reports = verify_all_signatures(&record, repository_did, None).await?;
-        assert_eq!(reports.len(), 1);
-        match &reports[0].status {
-            VerificationStatus::Unverified { reason } => {
-                assert!(reason.contains("Remote attestations"));
+        let key = metadata
+            .get("key")
+            .and_then(Value::as_str)
+            .filter(|value| !value.is_empty())
+            .ok_or(AttestationError::SignatureMissingField {
+                field: "key".to_string(),
+            })?;
+        let key_data = key_resolver.resolve(key).await.map_err(|error| {
+            AttestationError::KeyResolutionFailed {
+                key: key.to_string(),
+                error,
             }
-            other => panic!("expected unverified status, got {:?}", other),
-        }
+        })?;
 
-        Ok(())
-    }
+        let signature_bytes = metadata
+            .get("signature")
+            .and_then(Value::as_object)
+            .and_then(|object| object.get("$bytes"))
+            .and_then(Value::as_str)
+            .ok_or(AttestationError::SignatureBytesFormatInvalid)?;
 
-    #[tokio::test]
-    async fn verify_detects_tampering() -> Result<(), Box<dyn std::error::Error>> {
-        let private_key = generate_key(KeyType::K256Private)?;
-        let public_key = to_public(&private_key)?;
-        let key_reference = format!("{}", &public_key);
-        let repository_did = "did:plc:tampertest";
+        let signature_bytes = BASE64
+            .decode(signature_bytes)
+            .map_err(|error| AttestationError::SignatureDecodingFailed { error })?;
 
-        let base_record = json!({
-            "$type": "app.example.record",
-            "body": "original"
-        });
+        let computed_cid_bytes = computed_cid.to_bytes();
 
-        let sig_metadata = json!({
-            "$type": "com.example.inlineSignature",
-            "key": key_reference
-        });
-
-        let mut signed = create_inline_attestation(
-            &base_record,
-            &sig_metadata,
-            repository_did,
-            &private_key,
-        )?;
-        if let Some(object) = signed.as_object_mut() {
-            object.insert("body".to_string(), json!("tampered"));
-        }
-
-        let report = verify_signature(&signed, 0, repository_did, None).await?;
-        match report.status {
-            VerificationStatus::Invalid { .. } => {}
-            other => panic!("expected invalid signature, got {:?}", other),
-        }
-
-        Ok(())
+        validate(&key_data, &signature_bytes, &computed_cid_bytes)
+            .map_err(|error| AttestationError::SignatureValidationFailed { error })?;
     }
 
-    #[tokio::test]
-    async fn verify_repository_field_prevents_replay_attack(
-    ) -> Result<(), Box<dyn std::error::Error>> {
-        let private_key = generate_key(KeyType::K256Private)?;
-        let public_key = to_public(&private_key)?;
-        let key_reference = format!("{}", &public_key);
-        let original_repository = "did:plc:originalrepo";
-        let attacker_repository = "did:plc:attackerrepo";
-
-        let base_record = json!({
-            "$type": "app.example.record",
-            "body": "Important content"
-        });
-
-        let sig_metadata = json!({
-            "$type": "com.example.inlineSignature",
-            "key": key_reference,
-            "purpose": "original-attestation"
-        });
-
-        // Create attestation for original repository
-        let signed = create_inline_attestation(
-            &base_record,
-            &sig_metadata,
-            original_repository,
-            &private_key,
-        )?;
-
-        // Verify succeeds with correct repository
-        let report =
-            verify_signature(&signed, 0, original_repository, None).await?;
-        match report.status {
-            VerificationStatus::Valid { .. } => {}
-            other => panic!("expected valid signature for original repo, got {:?}", other),
-        }
-
-        // Verify FAILS with different repository (simulating replay attack)
-        let report =
-            verify_signature(&signed, 0, attacker_repository, None).await?;
-        match report.status {
-            VerificationStatus::Invalid { .. } => {}
-            other => panic!(
-                "expected invalid signature for attacker repo, got {:?}",
-                other
-            ),
-        }
-
-        Ok(())
-    }
-}
+    Ok(())
+}