@did-btcr2/method 0.55.0 → 0.58.0

package/src/core/beacon/beacon.ts

@@ -544,8 +544,19 @@ export abstract class SinglePartyBeacon {
    */
   readonly service: BeaconService;
 
-  constructor(service: BeaconService) {
+  /**
+   * The absolute did:btcr2 identifier this beacon instance serves.
+   *
+   * Injected by the caller rather than recovered from {@link service}. A beacon
+   * service `id` is permitted to be a relative DID URL (`#beacon-1`), which
+   * carries no DID to strip a fragment from, so deriving the subject from it is
+   * only correct for the absolute spelling.
+   */
+  readonly did: string;
+
+  constructor(service: BeaconService, did: string) {
     this.service = service;
+    this.did = did;
   }
 
   /**

package/src/core/beacon/cas-beacon.ts

@@ -57,9 +57,10 @@ export class CASBeacon extends SinglePartyBeacon {
   /**
    * Creates an instance of CASBeacon.
    * @param {BeaconService} service The service of the Beacon.
+   * @param {string} did The absolute did:btcr2 identifier this beacon serves.
    */
-  constructor(service: BeaconService) {
-    super({ ...service, type: 'CASBeacon' });
+  constructor(service: BeaconService, did: string) {
+    super({ ...service, type: 'CASBeacon' }, did);
   }
 
   /**
@@ -82,8 +83,8 @@ export class CASBeacon extends SinglePartyBeacon {
     const updates = new Array<[SignedBTCR2Update, BlockMetadata]>();
     const needs = new Array<DataNeed>();
 
-    // Extract the DID from the beacon service id (strip the #fragment)
-    const did = this.service.id.split('#')[0];
+    // The DID under resolution keys this beacon's announcement entry.
+    const did = this.did;
 
     for(const signal of signals) {
       // Signal bytes are hex, matches hex-keyed sidecar maps directly
@@ -160,8 +161,8 @@ export class CASBeacon extends SinglePartyBeacon {
     bitcoin: BitcoinConnection,
     options?: CASBroadcastOptions
   ): Promise<BroadcastResult> {
-    // Extract the DID from the beacon service id (strip the #fragment)
-    const did = this.service.id.split('#')[0];
+    // The DID this beacon serves keys its announcement entry.
+    const did = this.did;
 
     // Hash the signed update (base64urlnopad for the CAS Announcement entry per spec)
     const updateHash = canonicalHash(signedUpdate);

package/src/core/beacon/factory.ts

@@ -14,16 +14,18 @@ export class BeaconFactory {
   /**
    * Establish a Beacon instance based on the provided service and optional sidecar data.
    * @param {BeaconService} service The beacon service configuration.
+   * @param {string} did The absolute did:btcr2 identifier the beacon serves. Supplied
+   *   by the caller because a beacon service `id` may be a relative DID URL.
    * @returns {SinglePartyBeacon} The established Beacon instance.
    */
-  static establish(service: BeaconService): SinglePartyBeacon {
+  static establish(service: BeaconService, did: string): SinglePartyBeacon {
     switch (service.type) {
       case 'SingletonBeacon':
-        return new SingletonBeacon(service);
+        return new SingletonBeacon(service, did);
       case 'CASBeacon':
-        return new CASBeacon(service);
+        return new CASBeacon(service, did);
       case 'SMTBeacon':
-        return new SMTBeacon(service);
+        return new SMTBeacon(service, did);
       default:
         throw new MethodError('Invalid Beacon Type', 'INVALID_BEACON_ERROR', service);
     }

package/src/core/beacon/interfaces.ts

@@ -76,4 +76,4 @@ export interface BeaconSignal {
  *
  * @param announcement The CAS Announcement object (DID to update hash mapping).
  */
-export type CasPublishFn = (announcement: Record<string, string>) => Promise<void>;
+export type CasPublishFn = (announcement: Record<string, string>) => Promise<void>;

package/src/core/beacon/signal-discovery.ts

@@ -1,6 +1,7 @@
 import type {
   BitcoinConnection,
   BlockV3,
+  RawTransactionRest,
   RawTransactionV2} from '@did-btcr2/bitcoin';
 import {
   GENESIS_TX_ID,
@@ -11,37 +12,44 @@ import type { BeaconService, BeaconSignal } from './interfaces.js';
 import { BeaconUtils } from './utils.js';
 
 /**
- * Parses a scriptPubKey asm string and returns the beacon signal hash if and only
- * if the output is exactly `OP_RETURN OP_PUSHBYTES_32 <32-byte hex>`.
+ * The serialized form of a Beacon Signal output: `OP_RETURN` (`0x6a`), the 32-byte push
+ * opcode (`0x20`), then the 32-byte hash. This is the exact inverse of `opReturnScript`,
+ * which encodes signals as `0x6a 0x20 <32 bytes>` and is pinned byte for byte by
+ * `op-return-script.spec.ts`.
+ */
+const BEACON_SIGNAL_SCRIPT = /^6a20([0-9a-f]{64})$/i;
+
+/**
+ * Parses a serialized scriptPubKey and returns the beacon signal hash if and only if the
+ * output is exactly `OP_RETURN OP_PUSHBYTES_32 <32-byte hash>`.
  *
- * Beacon signals encode a single 32-byte update or announcement hash in an
- * OP_RETURN data push. Any other shape (a bare `OP_RETURN`, a push of the wrong
- * size, or a non-hex payload) is not a valid signal and returns `null`, so a
- * malformed or adversarial on-chain output cannot be mistaken for a real signal
- * downstream.
+ * Beacon signals encode a single 32-byte update or announcement hash in an OP_RETURN data
+ * push. Any other shape (a bare `OP_RETURN`, a push of the wrong size, a second push, or a
+ * non-canonical push opcode such as `OP_PUSHDATA1`) is not a valid signal and returns
+ * `null`, so a malformed or adversarial on-chain output cannot be mistaken for a real
+ * signal downstream.
  *
- * @param {string | undefined} asm The scriptPubKey asm string to parse.
+ * The input is the script itself, not a rendered `asm` string, because `asm` is a
+ * human-readable rendering whose dialect differs per backend: Bitcoin Core prints
+ * `OP_RETURN <hash>` while Esplora prints `OP_RETURN OP_PUSHBYTES_32 <hash>`. Both return
+ * the identical serialized script (Esplora as `scriptpubkey`, Core as `scriptPubKey.hex`),
+ * so decoding the script is backend-agnostic and matches the bytes actually committed to
+ * the chain.
+ *
+ * @param {string | undefined} scriptPubKey Hex-encoded scriptPubKey of the output to parse.
  * @returns {string | null} The lowercased 32-byte hex hash, or `null` if not a valid signal.
  */
-export function extractOpReturnSignal(asm: string | undefined): string | null {
-  if(!asm) {
-    return null;
-  }
-
-  // A standard NULL_DATA beacon output is exactly three asm tokens: the OP_RETURN
-  // opcode, the 32-byte push opcode, and the 64-character hex payload.
-  const tokens = asm.trim().split(/\s+/);
-  if(tokens.length !== 3 || tokens[0] !== 'OP_RETURN' || tokens[1] !== 'OP_PUSHBYTES_32') {
+export function extractOpReturnSignalHash(scriptPubKey: string | undefined): string | null {
+  if(!scriptPubKey) {
     return null;
   }
 
-  // The payload must be exactly 32 bytes of hex (64 hex characters).
-  const signalHash = tokens[2];
-  if(!/^[0-9a-fA-F]{64}$/.test(signalHash)) {
+  const signal = BEACON_SIGNAL_SCRIPT.exec(scriptPubKey.trim());
+  if(!signal) {
     return null;
   }
 
-  return signalHash.toLowerCase();
+  return signal[1].toLowerCase();
 }
 
 /**
@@ -52,6 +60,52 @@ export function extractOpReturnSignal(asm: string | undefined): string | null {
  */
 export class BeaconSignalDiscovery {
 
+  /**
+   * Determines whether a candidate transaction spends an output controlled by the given
+   * beacon address.
+   *
+   * A Beacon Signal is a transaction that *spends from* a Beacon Address, but an address
+   * transaction listing returns every transaction touching the address in either
+   * direction. Without this check, anyone able to pay dust to a beacon address could
+   * attach an arbitrary 32-byte OP_RETURN and have it read as a signal, so the input side
+   * has to be inspected before a transaction is treated as one.
+   *
+   * Esplora embeds the spent output in `vin[].prevout`; when a backend omits it the
+   * funding transaction is fetched instead, so a missing field cannot silently drop a
+   * real signal.
+   *
+   * @param {RawTransactionRest} tx The candidate transaction.
+   * @param {string} address The beacon address the transaction must spend from.
+   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for REST calls.
+   * @returns {Promise<boolean>} True if at least one input spends an output of the beacon address.
+   */
+  private static async spendsFromAddress(
+    tx: RawTransactionRest,
+    address: string,
+    bitcoin: BitcoinConnection
+  ): Promise<boolean> {
+    for(const vin of tx.vin ?? []) {
+      // A coinbase input spends no prior output, so it can never spend from a beacon.
+      if(vin.is_coinbase) {
+        continue;
+      }
+
+      let prevout = vin.prevout;
+
+      // Fall back to the funding transaction when the backend does not embed the prevout.
+      if(!prevout && vin.txid) {
+        const fundingTx = await bitcoin.rest.transaction.get(vin.txid);
+        prevout = fundingTx?.vout?.[vin.vout];
+      }
+
+      if(prevout?.scriptpubkey_address === address) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
   /**
    * Retrieves the beacon signals for the given array of BeaconService objects
    * using an esplora/electrs REST API connection via a bitcoin I/O driver.
@@ -71,10 +125,9 @@ export class BeaconSignalDiscovery {
     // Iterate over each beacon
     for (const beaconService of beaconServices) {
       beaconServiceSignals.set(beaconService, []);
+      const beaconAddress = BeaconUtils.parseBitcoinAddress(beaconService.serviceEndpoint as string);
       // Get the transactions for the beacon address via REST
-      const beaconSignals = await bitcoin.rest.address.getTxs(
-        BeaconUtils.parseBitcoinAddress(beaconService.serviceEndpoint as string)
-      );
+      const beaconSignals = await bitcoin.rest.address.getTxs(beaconAddress);
 
       // If no signals are found, continue
       if (!beaconSignals || !beaconSignals.length) {
@@ -84,10 +137,11 @@ export class BeaconSignalDiscovery {
       // Iterate over each signal
       for (const beaconSignal of beaconSignals) {
         // Get the last vout in the transaction
-        const signalVout = beaconSignal.vout.slice(-1)[0];
+        const lastSignalVout = beaconSignal.vout.slice(-1)[0];
 
         /**
-         * Look for OP_RETURN in last vout scriptpubkey_asm
+         * Decode the signal from the serialized script, not from `scriptpubkey_asm`: the
+         * asm rendering is backend-specific, the script is not.
          * Vout (rest) format:
          * {
          *  scriptpubkey: '6a20570f177c65e64fb5cf61180b664cdddf09ab76153c2b192e22006e5b22a3917a',
@@ -96,18 +150,24 @@ export class BeaconSignalDiscovery {
          *  value: 0
          * }
          */
-        if(!signalVout) {
+        if(!lastSignalVout) {
           continue;
         }
 
         // A beacon signal output must be exactly `OP_RETURN OP_PUSHBYTES_32 <32-byte hash>`.
         // Reject any other shape (bare OP_RETURN, wrong push size, non-hex payload) so a
         // malformed on-chain output cannot masquerade as a phantom signal downstream.
-        const updateHash = extractOpReturnSignal(signalVout.scriptpubkey_asm);
+        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptpubkey);
         if(!updateHash) {
           continue;
         }
 
+        // The address listing returns inbound payments too, so require the transaction to
+        // spend from the beacon before treating its OP_RETURN as a signal.
+        if(!await BeaconSignalDiscovery.spendsFromAddress(beaconSignal, beaconAddress, bitcoin)) {
+          continue;
+        }
+
         // Use the pre-fetched block count instead of calling per-signal
         const confirmations = currentBlockCount - beaconSignal.status.block_height + 1;
 
@@ -154,8 +214,16 @@ export class BeaconSignalDiscovery {
     // Get the current block height once before the loop
     const targetHeight = await rpc.getBlockCount();
 
-    // Hoist the beacon services map before the loop
-    const beaconServicesMap = BeaconUtils.getBeaconServicesMap(beaconServices);
+    /**
+     * Hoist the beacon address lookup before the loop, mapping each address to the caller's
+     * own service object. The results below are keyed by object identity, so the map has to
+     * hold those exact instances rather than copies of them. Addresses are parsed the same
+     * way as on the indexer path, so a BIP21 endpoint carrying query parameters resolves to
+     * the bare address a spent output reports.
+     */
+    const beaconServicesMap = new Map<string, BeaconService>(
+      beaconServices.map(service => [BeaconUtils.parseBitcoinAddress(service.serviceEndpoint as string), service])
+    );
 
     // Set genesis height
     let height = 0;
@@ -167,11 +235,50 @@ export class BeaconSignalDiscovery {
     while (block.height <= targetHeight) {
       // Iterate over each transaction in the block
       for (const tx of block.tx) {
-        // If the txid is a coinbase, continue ...
+        // If the txid is a genesis transaction, continue ...
         if (tx.txid === GENESIS_TX_ID) {
           continue;
         }
 
+        /**
+         * A Beacon Signal announces its update hash in the last output of the *spending*
+         * transaction, so the hash is resolved once per transaction, before the input side
+         * is inspected. The output being spent carries a plain locking script and never a
+         * signal. A beacon signal output must be exactly
+         * `OP_RETURN OP_PUSHBYTES_32 <32-byte hash>`; rejecting any other shape here also
+         * keeps the free filter ahead of the prevout lookups below.
+         *
+         * The signal is decoded from `scriptPubKey.hex`, the same serialized script the
+         * indexer path reads as `scriptpubkey`. Core's `asm` renders a data push as bare
+         * hex (`OP_RETURN <hash>`) where Esplora names the push opcode
+         * (`OP_RETURN OP_PUSHBYTES_32 <hash>`), so an asm-shaped check written against one
+         * backend silently discards every signal from the other.
+         * Vout (rpc) format:
+         * {
+         *  value: 0,
+         *  n: 1,
+         *  scriptPubKey: {
+         *    asm: "OP_RETURN 7af2be9fcb371dfcc5465a74373d499c11b1f7bba47e0507fce892ea12ec1cd6",
+         *    desc: "raw(6a207af2be9fcb371dfcc5465a74373d499c11b1f7bba47e0507fce892ea12ec1cd6)#g064zwfr",
+         *    hex: "6a207af2be9fcb371dfcc5465a74373d499c11b1f7bba47e0507fce892ea12ec1cd6",
+         *    type: "nulldata",
+         *  },
+         * }
+         */
+        const lastSignalVout = tx.vout.slice(-1)[0];
+        if (!lastSignalVout) {
+          continue;
+        }
+
+        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptPubKey?.hex);
+        if (!updateHash) {
+          continue;
+        }
+
+        // One transaction is one signal per beacon, however many of that beacon's UTXOs
+        // it spends, so track the services already credited with this transaction.
+        const signaled = new Set<BeaconService>();
+
         // Iterate over each input in the transaction
         for (const vin of tx.vin) {
 
@@ -213,21 +320,13 @@ export class BeaconSignalDiscovery {
 
           // Use the hoisted beaconServicesMap instead of rebuilding per-vin
           const beaconService = beaconServicesMap.get(scriptPubKey.address);
-          if (!beaconService) {
-            continue;
-          }
-
-          // A beacon signal output must be exactly `OP_RETURN OP_PUSHBYTES_32 <32-byte hash>`.
-          // Reject any other shape so a malformed on-chain output cannot masquerade as a
-          // phantom signal downstream.
-          const txVoutScriptPubkeyAsm = prevout.vout[vin.vout].scriptPubKey.asm;
-          const updateHash = extractOpReturnSignal(txVoutScriptPubkeyAsm);
-          if(!updateHash) {
+          if (!beaconService || signaled.has(beaconService)) {
             continue;
           }
+          signaled.add(beaconService);
 
           // Log the found txid and beacon
-          console.info(`Tx ${tx.txid} contains beacon service address ${scriptPubKey.address} and OP_RETURN!`, tx);
+          console.info(`Tx ${tx.txid} contains beacon address ${scriptPubKey.address}`);
 
           // Push the beacon signal object to the beacon signals array for that beacon service
           beaconServiceSignals.get(beaconService)?.push({

package/src/core/beacon/singleton-beacon.ts

@@ -20,8 +20,8 @@ export class SingletonBeacon extends SinglePartyBeacon {
    * Creates an instance of SingletonBeacon.
    * @param {BeaconService} service The BeaconService object representing the funded beacon to announce the update to.
    */
-  constructor(service: BeaconService) {
-    super({ ...service, type: 'SingletonBeacon' });
+  constructor(service: BeaconService, did: string) {
+    super({ ...service, type: 'SingletonBeacon' }, did);
   }
 
   /**

package/src/core/beacon/smt-beacon.ts

@@ -27,9 +27,10 @@ export class SMTBeacon extends SinglePartyBeacon {
   /**
    * Creates an instance of SMTBeacon.
    * @param {BeaconService} service The Beacon service.
+   * @param {string} did The absolute did:btcr2 identifier this beacon serves.
    */
-  constructor(service: BeaconService) {
-    super({ ...service, type: 'SMTBeacon' });
+  constructor(service: BeaconService, did: string) {
+    super({ ...service, type: 'SMTBeacon' }, did);
   }
 
   /**
@@ -52,8 +53,8 @@ export class SMTBeacon extends SinglePartyBeacon {
     const updates = new Array<[SignedBTCR2Update, BlockMetadata]>();
     const needs = new Array<DataNeed>();
 
-    // Extract the DID from the beacon service id (strip the #fragment)
-    const did = this.service.id.split('#')[0];
+    // The DID under resolution keys this beacon's leaf index.
+    const did = this.did;
 
     for(const signal of signals) {
       // Signal bytes are the hex-encoded SMT root hash; smtMap is keyed by proof.id (also hex)
@@ -144,8 +145,8 @@ export class SMTBeacon extends SinglePartyBeacon {
     bitcoin: BitcoinConnection,
     options?: BroadcastOptions
   ): Promise<BroadcastResult> {
-    // Extract the DID from the beacon service id (strip the #fragment)
-    const did = this.service.id.split('#')[0];
+    // The DID keys this beacon's leaf index in the tree.
+    const did = this.did;
 
     // Build a single-entry SMT from the signed update
     const canonicalBytes = new TextEncoder().encode(canonicalize(signedUpdate));

package/src/core/beacon/utils.ts

@@ -172,19 +172,6 @@ export class BeaconUtils {
     return { ...beacon, serviceEndpoint: beacon.serviceEndpoint.replace('bitcoin:', '')};
   }
 
-  /**
-   * Create a map of address => beaconService with address field.
-   * @param {Array<BeaconService>} beacons The list of beacon services.
-   * @returns {Map<string, BeaconService>} A map of address => beaconService.
-   */
-  static getBeaconServicesMap(beacons: Array<BeaconService>): Map<string, BeaconService> {
-    return new Map<string, BeaconService>(
-      beacons
-        .map(this.parseBeaconServiceEndpoint)
-        .map((beacon) => ([beacon.serviceEndpoint as string, beacon]))
-    );
-  }
-
   /**
    * Get the beacon service ids from a list of beacon services.
    * @param {DidDocument} didDocument The DID Document to extract the services from.

package/src/core/did-sender-resolver.ts

@@ -1,6 +1,7 @@
 import { DidDocumentError, INVALID_DID_DOCUMENT } from '@did-btcr2/common';
 import { SchnorrMultikey } from '@did-btcr2/cryptosuite';
 import { CompressedSecp256k1PublicKey } from '@did-btcr2/keypair';
+import { Appendix } from '../utils/appendix.js';
 import type { DidDocument, DidVerificationMethod } from '../utils/did-document.js';
 import { Identifier } from './identifier.js';
 import { Resolver } from './resolver.js';
@@ -40,9 +41,16 @@ export function getAggregationCommunicationKey(
   // Resolve capabilityInvocation[0] to a verification method: a string reference is
   // dereferenced by id against verificationMethod; an embedded method is used directly.
   // A local id lookup is used rather than getSigningMethod, which defaults to #initialKey
-  // and does not resolve embedded methods.
+  // and does not resolve embedded methods. Reference and method id are each resolved to an
+  // absolute DID URL first, because either may be spelled as a relative DID URL; an
+  // unusable reference resolves to nothing rather than to the first unusable method id.
+  const invocationId = Appendix.absoluteDidUrl(invocation, document.id);
   const vm: DidVerificationMethod | undefined = typeof invocation === 'string'
-    ? document.verificationMethod?.find(method => method.id === invocation)
+    ? (invocationId === undefined
+      ? undefined
+      : document.verificationMethod?.find(
+        method => Appendix.absoluteDidUrl(method.id, document.id) === invocationId
+      ))
     : invocation;
 
   if(!vm) {

package/src/core/interfaces.ts

@@ -46,6 +46,7 @@ export interface ResolutionOptions extends DidResolutionOptions {
    * document is well-formed, the resolver simply stopped at the caller's limit.
    */
   maxDiscoveryRounds?: number;
+
 }
 
 /**

package/src/core/resolver.ts

@@ -225,6 +225,7 @@ export class Resolver {
   /** Count of beacon-discovery passes driven by updates adding new beacon services. */
   #discoveryRounds = 0;
 
+
   /**
    * @internal Use {@link DidBtcr2.resolve} to create instances.
    */
@@ -232,7 +233,12 @@ export class Resolver {
     didComponents: DidComponents,
     sidecarData: SidecarData,
     currentDocument: DidDocument | null,
-    options?: { versionId?: string; versionTime?: string; genesisDocument?: object; maxDiscoveryRounds?: number }
+    options?: {
+      versionId?: string;
+      versionTime?: string;
+      genesisDocument?: object;
+      maxDiscoveryRounds?: number;
+    }
   ) {
     this.#didComponents = didComponents;
     this.#sidecarData = sidecarData;
@@ -601,6 +607,29 @@ export class Resolver {
       throw new ResolveError('No verificationMethod found in update', INVALID_DID_UPDATE, update);
     }
 
+    // Spec "Check update.proof": raise INVALID_DID_UPDATE if
+    // currentDocument.capabilityInvocation does not contain
+    // update.proof.verificationMethod. Locating the method in verificationMethod[] and
+    // verifying its signature is not sufficient on its own: a key the controller
+    // published only for authentication (or for no relationship at all) must not be
+    // able to authorize a DID update. The write path enforces this in DidBtcr2.update();
+    // without it here the read path applies an update signed by any key in the document.
+    // Checked before the method is located so an unauthorized method always fails with
+    // this typed error, whether or not it also appears in verificationMethod[].
+    const authorizedMethodId = Appendix.relationshipMethodId(verificationMethodId, currentDocument.id);
+    const authorized = authorizedMethodId !== undefined && currentDocument.capabilityInvocation?.some(
+      entry => Appendix.relationshipMethodId(entry, currentDocument.id) === authorizedMethodId
+    );
+    if(!authorized) {
+      throw new ResolveError(
+        'Invalid update: verificationMethod is not authorized for capabilityInvocation',
+        INVALID_DID_UPDATE, {
+          verificationMethodId,
+          capabilityInvocation : currentDocument.capabilityInvocation
+        }
+      );
+    }
+
     // Get the verificationMethod from the DID Document using the verificationMethodId.
     const vm = DidBtcr2.getSigningMethod(currentDocument, verificationMethodId);
 
@@ -724,7 +753,9 @@ export class Resolver {
             if(this.#processedServices.has(service.id) || !signals.length) continue;
 
             // Establish a typed beacon and process its signals
-            const beacon = BeaconFactory.establish(service);
+            // The beacon is bound to the DID under resolution: a beacon service
+            // `id` may be a relative DID URL, so it cannot supply the subject.
+            const beacon = BeaconFactory.establish(service, this.#currentDocument!.id);
             const result = beacon.processSignals(signals, this.#sidecarData);
 
             if(result.needs.length > 0) {

package/src/core/updater.ts

@@ -58,8 +58,8 @@ export interface FundingProof {
  * The updater needs the caller to broadcast the signed update via the beacon.
  *
  * The caller decides how: for single-party beacons, call
- * `Updater.announce(beaconService, signedUpdate, signer, bitcoin, options?)` or
- * `BeaconFactory.establish(beaconService).broadcastSignal(...)`. For multi-party
+ * `Updater.announce(beaconService, did, signedUpdate, signer, bitcoin, options?)` or
+ * `BeaconFactory.establish(beaconService, did).broadcastSignal(...)`. For multi-party
  * aggregate beacons, hand off to the aggregation protocol.
  *
  * Both single-party paths return a `BroadcastResult`; capture it. Beyond the txid,
@@ -76,6 +76,11 @@ export interface NeedBroadcast {
   readonly beaconService: BeaconService;
   /** The signed update ready for broadcast. */
   readonly signedUpdate: SignedBTCR2Update;
+  /**
+   * The DID being updated. Supplied because a beacon service `id` may be a
+   * relative DID URL and so cannot be used to recover the subject.
+   */
+  readonly did: string;
 }
 
 /** Discriminated union of all data needs the updater may request from the caller. */
@@ -148,7 +153,7 @@ export interface UpdaterParams {
  *         // Capture the BroadcastResult: broadcast.txid, plus broadcast.announcement
  *         // (CAS beacons) and broadcast.proof (SMT beacons; must be retained, the
  *         // proof's nonce exists nowhere else).
- *         const broadcast = await Updater.announce(need.beaconService, need.signedUpdate, signer, bitcoin);
+ *         const broadcast = await Updater.announce(need.beaconService, need.did, need.signedUpdate, signer, bitcoin);
  *         updater.provide(need);
  *         break;
  *       }
@@ -278,6 +283,12 @@ export class Updater {
     const id = verificationMethod.id.slice(hashIdx);
     const multikey = SchnorrMultikey.fromSigner(id, controller, signer);
 
+    // The absolute spelling of the method id, for the proof to name it by. `hashIdx === 0`
+    // means the document writes this method's own id as a relative DID URL, which per DID
+    // Core denotes that fragment of the document's `id`: the same rule as
+    // Appendix.absoluteDidUrl, whose `undefined` case the fragment check above excludes.
+    const absoluteMethodId = hashIdx === 0 ? `${did}${id}` : verificationMethod.id;
+
     // Fail fast if the signer's public key is not the key published in the named
     // verification method. Signing with the wrong key yields a Data Integrity
     // proof that cannot verify against the method, so the resulting on-chain
@@ -308,7 +319,12 @@ export class Updater {
       ],
       cryptosuite        : 'bip340-jcs-2025',
       type               : 'DataIntegrityProof',
-      verificationMethod : verificationMethod.id,
+      // The proof names the signing method by absolute DID URL, even when the document
+      // spells that method's own id relatively: a proof travels apart from the document
+      // that defines the method, so a bare `#initialKey` in it resolves against nothing.
+      // For a document that already spells its ids absolutely this is the id unchanged,
+      // so proofs over such documents are byte-identical to before.
+      verificationMethod : absoluteMethodId,
       proofPurpose       : 'capabilityInvocation',
       capability         : `urn:zcap:root:${encodeURIComponent(did)}`,
       capabilityAction   : 'Write',
@@ -323,6 +339,8 @@ export class Updater {
    * Announces a signed update to the Bitcoin blockchain via the specified beacon.
    *
    * @param {BeaconService} beaconService The beacon service to broadcast through.
+   * @param {string} did The DID being updated. Required because a beacon service
+   *   `id` may be a relative DID URL and so cannot supply the subject.
    * @param {SignedBTCR2Update} update The signed update to announce.
    * @param {Signer} signer Signer that produces the ECDSA signature for the Bitcoin transaction.
    * @param {BitcoinConnection} bitcoin The Bitcoin network connection.
@@ -334,12 +352,13 @@ export class Updater {
    */
   static async announce(
     beaconService: BeaconService,
+    did: string,
     update: SignedBTCR2Update,
     signer: Signer,
     bitcoin: BitcoinConnection,
     options?: CASBroadcastOptions
   ): Promise<BroadcastResult> {
-    const beacon = BeaconFactory.establish(beaconService);
+    const beacon = BeaconFactory.establish(beaconService, did);
     return beacon.broadcastSignal(update, signer, bitcoin, options);
   }
 
@@ -406,6 +425,7 @@ export class Updater {
               kind          : 'NeedBroadcast',
               beaconService : this.#beaconService,
               signedUpdate  : this.#state.signedUpdate,
+              did           : this.#sourceDocument.id,
             }],
           };
         }