diff --git a/OpenTDFKit/KASDiscovery.swift b/OpenTDFKit/KASDiscovery.swift
index 6bad181..0b83260 100644
--- a/OpenTDFKit/KASDiscovery.swift
+++ b/OpenTDFKit/KASDiscovery.swift
@@ -97,7 +97,9 @@ public struct OpenTDFConfiguration: Codable, Sendable {
     /// present (even if they would fail later SSRF/scheme validation).
     var needsKasEndpointSynthesis: Bool {
         guard let kas else { return true }
-        if kas.uri.isEmpty { return true }
+        if kas.uri.isEmpty {
+            return true
+        }
         let hasConnect = kas.connectRewrapURL != nil && kas.connectPublicKeyURL != nil
         let hasRest = kas.rewrapURL != nil && kas.publicKeyURL != nil
         return !hasConnect && !hasRest
@@ -225,7 +227,9 @@ private func classifyIP(_ host: String) -> IPLiteral? {
 private func isLoopbackHost(_ host: String) -> Bool {
     // Normalize a trailing FQDN dot ("localhost." resolves to loopback too).
     let host = host.hasSuffix(".") ? String(host.dropLast()) : host
-    if host == "localhost" { return true }
+    if host == "localhost" {
+        return true
+    }
     switch classifyIP(host) {
     case let .v4(o): return o[0] == 127 // 127.0.0.0/8
     case let .v6(b): return b.dropLast() == ArraySlice(repeating: 0, count: 15) && b[15] == 1 // ::1
@@ -234,11 +238,26 @@ private func isLoopbackHost(_ host: String) -> Bool {
 }
 
 private func isBlockedV4(_ o: [UInt8]) -> Bool {
-    if o[0] == 10 { return true } // 10.0.0.0/8
-    if o[0] == 172, (o[1] & 0xF0) == 16 { return true } // 172.16.0.0/12
-    if o[0] == 192, o[1] == 168 { return true } // 192.168.0.0/16
-    if o[0] == 169, o[1] == 254 { return true } // 169.254.0.0/16
-    if o == [0, 0, 0, 0] { return true } // 0.0.0.0
+    // 10.0.0.0/8
+    if o[0] == 10 {
+        return true
+    }
+    // 172.16.0.0/12
+    if o[0] == 172, (o[1] & 0xF0) == 16 {
+        return true
+    }
+    // 192.168.0.0/16
+    if o[0] == 192, o[1] == 168 {
+        return true
+    }
+    // 169.254.0.0/16
+    if o[0] == 169, o[1] == 254 {
+        return true
+    }
+    // 0.0.0.0
+    if o == [0, 0, 0, 0] {
+        return true
+    }
     return false
 }
 
@@ -251,7 +270,10 @@ private func isBlockedIP(_ ip: IPLiteral) -> Bool {
         if b[0 ..< 10].allSatisfy({ $0 == 0 }), b[10] == 0xFF, b[11] == 0xFF {
             return isBlockedV4(Array(b[12 ..< 16]))
         }
-        if b.allSatisfy({ $0 == 0 }) { return true } // :: unspecified
+        // :: unspecified
+        if b.allSatisfy({ $0 == 0 }) {
+            return true
+        }
         let first = (UInt16(b[0]) << 8) | UInt16(b[1])
         return (first & 0xFE00) == 0xFC00 || (first & 0xFFC0) == 0xFE80 // fc00::/7, fe80::/10
     }
diff --git a/OpenTDFKit/TDF/TDFCBORFormat.swift b/OpenTDFKit/TDF/TDFCBORFormat.swift
index a637e2d..fe79819 100644
--- a/OpenTDFKit/TDF/TDFCBORFormat.swift
+++ b/OpenTDFKit/TDF/TDFCBORFormat.swift
@@ -604,7 +604,9 @@ extension TDFCBOREnvelope {
             throw TDFCBORError.missingField("version")
         }
         let version: [UInt8] = versionArray.compactMap { cbor -> UInt8? in
-            if case let .unsignedInt(v) = cbor { return UInt8(v) }
+            if case let .unsignedInt(v) = cbor {
+                return UInt8(v)
+            }
             return nil
         }
 
@@ -659,7 +661,9 @@ extension TDFCBOREnvelope {
                 }
             }
             // Fall back to string key (legacy)
-            if let v = payloadMap["type"], case let .utf8String(s) = v { return s }
+            if let v = payloadMap["type"], case let .utf8String(s) = v {
+                return s
+            }
             return "inline"
         }()
 
@@ -677,7 +681,9 @@ extension TDFCBOREnvelope {
                 }
             }
             // Fall back to string key (legacy)
-            if let v = payloadMap["protocol"], case let .utf8String(s) = v { return s }
+            if let v = payloadMap["protocol"], case let .utf8String(s) = v {
+                return s
+            }
             return "binary"
         }()
 
@@ -689,7 +695,9 @@ extension TDFCBOREnvelope {
                 return s
             }
             // Fall back to string key (legacy)
-            if let v = payloadMap["mimeType"], case let .utf8String(s) = v { return s }
+            if let v = payloadMap["mimeType"], case let .utf8String(s) = v {
+                return s
+            }
             return nil
         }()
 
@@ -701,7 +709,9 @@ extension TDFCBOREnvelope {
                 return b
             }
             // Fall back to string key (legacy)
-            if let v = payloadMap["isEncrypted"], case let .boolean(b) = v { return b }
+            if let v = payloadMap["isEncrypted"], case let .boolean(b) = v {
+                return b
+            }
             return true
         }()