A whole AT Protocol network on one local server, for tests that need no network: the accounts given, each with a PDS, and every service an app asks (`configure(net.config)` points the library at it; `net.env`, an app's server). What it serves: Constellation's backlinks (`blue.microcosm.links.*`, `/links/all`), Slingshot's records and identities, the appview's profiles and typeahead, the image service, a PLC directory, and a PDS for each account (password sessions, records, blobs) with its OAuth authorization server (PAR, authorize, token; DPoP-bound tokens, nonces asked for, PKCE checked; authorizing signs in as the login hint at once, as if they'd said yes), its records signed (`com.atproto.sync.getRecord`'s CAR, with each account's `#atproto` key in its DID document: a P-256 `Multikey`, or a legacy uncompressed secp256k1 key, `legacyKey`), service-auth tokens signed by that key (`getServiceAuth`, as an OAuth sign-in's `rpc:` scope allows, or an app password's), a relay's `listReposByCollection`, the appview's follows (`app.bsky.graph.getFollows`, from `app.bsky.graph.follow` records), and a Jetstream (v2's `subscribeEvents`, a websocket) of every record written. Backlinks are every `{ uri }` a record holds, at its path (`subject.uri`). Allows any origin. OAuth clients must be loopback ones (an app on localhost). `close()` stops it.
A secp256k1 public key (compressed, as `exportPublicKey("raw")` gives it) as a legacy DID document writes it: uncompressed, in base58btc multibase (`z…`), for an `EcdsaSecp256k1VerificationKey2019` method.
A repository's proof of one record, as `com.atproto.sync.getRecord` sends it: a CAR whose root is a commit signed with `key`, over a tree of the one record at `path` (`collection/rkey`).