fiftyone.pipeline.did 4.5.37 → 4.5.38

package/node_modules/owid/README.md

@@ -22,6 +22,12 @@ public key from their well known end point and verifies the ECDSA signature
 locally. When `crypto.subtle` is not available it falls back to the creator's
 remote verify end point.
 
+Both end points are versioned, `/owid/api/v<version>/creator` and
+`/owid/api/v<version>/verify`, and the version in the path is the version
+byte of the OWID being verified rather than a fixed number, because a
+creator serves each version of the format at its own path and returns 404
+for the others.
+
 The public key is requested for the OWID's own creation date
 (`?date=<minutes>`), so OWIDs signed before a signing-key rotation still
 verify. A creator that does not support the `date` parameter ignores it and
@@ -38,6 +44,12 @@ The headers are sent to every creator domain that a verification touches,
 so only set a credential that all the creators in the tree are meant to
 see.
 
+A custom header makes the key request a non simple cross origin request, so
+the browser sends a `OPTIONS` preflight first and the creator has to answer
+it with `Access-Control-Allow-Headers` naming that header. A creator that
+does not answer the preflight cannot be given a credential this way, and
+the request never leaves the browser.
+
 ## Reading answers instead of throwing
 
 An OWID is read from whatever a caller was handed, which on a public end

package/node_modules/owid/owid.crypto.test.js

@@ -45,6 +45,25 @@ const otherKeyPair = nodeCrypto.generateKeyPairSync('ec', {
 // 2021-04-06 12:59 UTC expressed as minutes since 2020-01-01 00:00 UTC.
 const testDateInMinutes = 664619;
 
+// The version byte every OWID built here is written with. The mocked
+// creator only answers the path for this version, and the expected URL is
+// built from the version the library read back out of the OWID, so the test
+// and the library take the version from the same place and a wrong version
+// in either one fails rather than passing quietly.
+const testVersion = 3;
+
+/**
+ * The creator key URL the library must request for an OWID. The version
+ * segment comes from the OWID's own version byte, which is the value the
+ * library uses, so this expectation cannot drift away from the code.
+ * @param {Object} o - the OWID that was read.
+ * @returns {string} the expected URL.
+ */
+function expectedCreatorUrl(o) {
+    return "//" + o.domain + "/owid/api/v" + o.version +
+        "/creator?date=" + o.date;
+}
+
 /**
  * Reads an OWID that the test expects to be valid, asserting the three facts
  * a read always reports before handing back the OWID itself.
@@ -64,8 +83,9 @@ const wrongKeyDomain = "wrong-key.swan-demo.uk";
 const emptyKeyDomain = "empty-key.swan-demo.uk";
 
 /**
- * Builds the unsigned portion of a version 3 OWID as a byte array in the
- * same form the library serializes for verification.
+ * Builds the unsigned portion of an OWID, at the version named by
+ * testVersion, as a byte array in the same form the library serializes for
+ * verification.
  * @param {string} domain - the creator domain.
  * @param {number} dateInMinutes - minutes since the OWID base date.
  * @param {Buffer} payload - the payload bytes.
@@ -77,7 +97,7 @@ function buildUnsignedOWID(domain, dateInMinutes, payload) {
     var length = Buffer.alloc(4);
     length.writeUInt32LE(payload.length);
     return Buffer.concat([
-        Buffer.from([3]),
+        Buffer.from([testVersion]),
         Buffer.from(domain, 'ascii'),
         Buffer.from([0]),
         date,
@@ -132,7 +152,10 @@ beforeEach(() => {
         }
         var url = new URL(urlString);
 
-        if (url.pathname.endsWith("/creator")) {
+        // A real creator serves each version of the format at its own
+        // path and returns 404 for the others, so answering any version
+        // here would hide a request sent to the wrong one.
+        if (url.pathname === "/owid/api/v" + testVersion + "/creator") {
             // This domain returns a header only PEM with no key body, which
             // exercises the empty public key guard in the library.
             if (url.hostname == emptyKeyDomain) {
@@ -169,8 +192,38 @@ test('crypto verify valid OWID passes', () => {
         // The library must have used the public key path, so the only
         // request is to the creator end point.
         expect(fetch.mock.calls.length).toBe(1);
+        expect(fetch.mock.calls[0][0]).toBe(expectedCreatorUrl(o));
+    });
+});
+
+test('crypto verify asks the end point for the version the OWID carries', () => {
+    // Every other OWID in this suite is version 3, the same value a constant
+    // in the path would give, so this is the test that catches a constant
+    // put back. A version 2 OWID must ask the version 2 end point, which
+    // the mocked creator does not serve, so the key is unavailable and the
+    // one request that was made names the right path.
+    var date = Buffer.alloc(4);
+    date.writeUInt32LE(testDateInMinutes);
+    var payload = Buffer.from("example");
+    var length = Buffer.alloc(4);
+    length.writeUInt32LE(payload.length);
+    var unsigned = Buffer.concat([
+        Buffer.from([2]),
+        Buffer.from(creatorDomain, 'ascii'),
+        Buffer.from([0]),
+        date,
+        length,
+        payload
+    ]);
+    var o = read(signOWID(unsigned, creatorKeyPair.privateKey));
+    expect(o.version).toBe(2);
+
+    return o.checkSignature().then(r => {
+        expect(r.status).toBe(owid.SignatureStatus.KEY_UNAVAILABLE);
+        expect(fetch.mock.calls.length).toBe(1);
         expect(fetch.mock.calls[0][0]).toBe(
-            "//" + creatorDomain + "/owid/api/v1/creator?date=" + testDateInMinutes);
+            "//" + creatorDomain + "/owid/api/v2/creator?date=" +
+            testDateInMinutes);
     });
 });
 

package/node_modules/owid/owid.interop.test.js

@@ -139,6 +139,18 @@ fixtures.forEach(f => {
     publicKeys[f.domain] = f.publicKeySPKI;
 });
 
+/**
+ * The creator key URL the library must request for an OWID. The version
+ * segment comes from the OWID's own version byte, which is the value the
+ * library uses, so this expectation cannot drift away from the code.
+ * @param {Object} o - the OWID that was read.
+ * @returns {string} the expected URL.
+ */
+function expectedCreatorUrl(o) {
+    return "//" + o.domain + "/owid/api/v" + o.version +
+        "/creator?date=" + o.date;
+}
+
 /**
  * Returns the base 64 string with a single byte changed at the given offset
  * of the decoded byte array.
@@ -164,7 +176,12 @@ beforeEach(() => {
         }
         var url = new URL(urlString);
 
-        if (url.pathname.endsWith("/creator") && publicKeys[url.hostname]) {
+        // Every fixture is a version 3 OWID and a real creator serves each
+        // version of the format at its own path, returning 404 for the
+        // others, so the key is only handed back on the path that names the
+        // version the OWID was written in.
+        if (url.pathname === "/owid/api/v3/creator" &&
+            publicKeys[url.hostname]) {
             return Promise.resolve(JSON.stringify({
                 publicKeySPKI: publicKeys[url.hostname]
             }));
@@ -186,8 +203,8 @@ fixtures.forEach(f => {
             // The library must have used the public key path, so the only
             // request is to the creator end point.
             expect(fetch.mock.calls.length).toBe(1);
-            expect(fetch.mock.calls[0][0]).toBe(
-                "//" + f.domain + "/owid/api/v1/creator?date=" + o.date);
+            expect(fetch.mock.calls[0][0]).toBe(expectedCreatorUrl(o));
+            expect(o.version).toBe(3);
         });
     });
 

package/node_modules/owid/owid.published-key.test.js

@@ -0,0 +1,253 @@
+/* ****************************************************************************
+ * Copyright 2021 51 Degrees Mobile Experts Limited (51degrees.com)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ * ***************************************************************************/
+
+// These tests verify a real identifier issued by a live creator against that
+// creator's real published signing key schedule, rather than against a key
+// pair the test made up for itself. The other suites build their own OWIDs,
+// so they prove the library is self consistent but they cannot prove it can
+// talk to a creator that actually exists.
+//
+// The test data in testdata was taken on 4 September 2026 from
+// cloud.51degrees.com, and the identifier names 51d.es as its creator. Both
+// files are public. An identifier is meant to be handed to anyone who asks,
+// and the key schedule is the set of public keys the creator publishes so
+// that anyone can check a signature, so neither carries a secret and neither
+// can be used to sign anything.
+//
+// The creator is stood in for here rather than called over the network, so
+// the suite stays offline and repeatable, but the stand in behaves the way
+// the real service does. It serves each version of the format at its own path
+// and returns 404 for the others, and it picks the signing key by the
+// creation date the request asks for. Both of those matter. Measured against
+// the live service on 4 September 2026, GET /owid/api/v1/creator and
+// /owid/api/v2/creator both answered 404 whilst /owid/api/v3/creator answered
+// 401, meaning it exists and wants a credential.
+
+const owid = require('./v1');
+const nodeCrypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+Object.defineProperty(global.self, 'crypto', {
+    value: {
+        subtle: nodeCrypto.webcrypto.subtle
+    }
+});
+
+// The identifier as it was handed out, together with the facts recorded
+// alongside it at the time it was taken.
+const fixture = JSON.parse(fs.readFileSync(
+    path.join(__dirname, 'testdata', '51did-identifier.json'), 'utf8'));
+
+// The creator's published signing key schedule, oldest first. A key runs from
+// its own start until the next key starts.
+const schedule = JSON.parse(fs.readFileSync(
+    path.join(__dirname, 'testdata', '51did-public-keys.json'), 'utf8'))
+    .slice()
+    .sort((a, b) => Date.parse(a.startsAt) - Date.parse(b.startsAt));
+
+// The facts the fixture was recorded with. The identifier is a version 3
+// OWID created on 4 September 2026 by 51d.es.
+const expectedVersion = 3;
+const expectedDomain = "51d.es";
+const expectedDate = 3510720;
+
+// The moment the stand in treats as now, in minutes since the OWID base
+// date, being 14 September 2026, ten days after the identifier was created
+// and in the week that followed. Every port's stand in uses this moment. A
+// real creator answers an undated request with the key in force at the
+// moment of the request, so by then that is no longer the key that signed
+// this identifier.
+const requestMoment = expectedDate + 10 * 24 * 60;
+
+// The OWID base date as a millisecond timestamp, so a date in minutes can be
+// compared with the start of a key's window.
+const owidBase = Date.UTC(2020, 0, 1);
+
+/**
+ * Returns the key from the published schedule that was in force at the
+ * creation date a creator request asks for, which is the way a real creator
+ * answers the date parameter.
+ * @param {number} dateInMinutes - minutes since the OWID base date.
+ * @returns {Object|null} the key, or null when the date falls before the
+ * schedule starts.
+ */
+function keyInForceAt(dateInMinutes) {
+    var at = owidBase + dateInMinutes * 60000;
+    var found = null;
+    schedule.forEach(k => {
+        if (Date.parse(k.startsAt) <= at) {
+            found = k;
+        }
+    });
+    return found;
+}
+
+/**
+ * Reads an OWID that the test expects to be valid, asserting the three facts
+ * a read always reports before handing back the OWID itself.
+ * @param {string} data - the OWID as base 64.
+ * @returns {Object} the OWID.
+ */
+function read(data) {
+    var r = owid.parse(data);
+    expect(r.ok).toBe(true);
+    expect(r.status).toBe(owid.ParseStatus.PARSED);
+    expect(r.owid).not.toBeNull();
+    return r.owid;
+}
+
+/**
+ * Stands in for the creator. Only the path naming the version given answers,
+ * every other path returns the 404 the live service returns, and the key
+ * handed back is the one in force at the date on the request unless the
+ * stand in is asked to ignore the date. As the live service does, a request
+ * naming no date is answered with the key in force at the moment of the
+ * request, a date later than that moment is read as that moment, and a date
+ * that is not a number is refused with a 400.
+ * @param {Object} [options] - servedVersion is the only version served, and
+ * ignoreDate set to true returns the key in force at requestMoment whatever
+ * date is asked for, which is what a creator that ignores the date does.
+ */
+function mockCreator(options) {
+    var servedVersion = options && options.servedVersion !== undefined
+        ? options.servedVersion
+        : expectedVersion;
+    var ignoreDate = options && options.ignoreDate === true;
+    fetchMock.mockResponse(req => {
+        var urlString = req.url;
+        if (urlString.startsWith("//")) {
+            urlString = "https:" + urlString;
+        }
+        var url = new URL(urlString);
+        if (url.hostname !== expectedDomain ||
+            url.pathname !== "/owid/api/v" + servedVersion + "/creator") {
+            return Promise.resolve({
+                status: 404,
+                body: "Status code: 404, method not found"
+            });
+        }
+        var asked = url.searchParams.get("date");
+        var at;
+        if (ignoreDate || asked === null) {
+            at = requestMoment;
+        } else if (/^\d+$/.test(asked) === false) {
+            return Promise.resolve({
+                status: 400,
+                body: "date must be the number of minutes since 2020-01-01"
+            });
+        } else {
+            at = Math.min(Number(asked), requestMoment);
+        }
+        var key = keyInForceAt(at);
+        if (key === null) {
+            return Promise.resolve({
+                status: 404,
+                body: "no published key covers that date"
+            });
+        }
+        return Promise.resolve(JSON.stringify({
+            publicKeySPKI: key.publicKey
+        }));
+    });
+}
+
+beforeEach(() => {
+    fetchMock.resetMocks();
+});
+
+test('the published identifier reads as the version 3 OWID it was ' +
+    'recorded as', () => {
+    var o = read(fixture.identifier);
+
+    expect(o.version).toBe(expectedVersion);
+    expect(o.domain).toBe(expectedDomain);
+    expect(o.date).toBe(expectedDate);
+    expect(o.signature.length).toBe(64);
+});
+
+test('the published identifier verifies against the published key schedule',
+    () => {
+    mockCreator();
+    var o = read(fixture.identifier);
+
+    return o.verify().then(valid => {
+        expect(valid).toBe(true);
+        // One request, to the end point that serves the version this
+        // identifier was written in, asking for the key that was in force
+        // when it was created.
+        expect(fetch.mock.calls.length).toBe(1);
+        expect(fetch.mock.calls[0][0]).toBe(
+            "//" + o.domain + "/owid/api/v" + o.version +
+            "/creator?date=" + o.date);
+    });
+});
+
+test('the published identifier reports a valid signature', () => {
+    mockCreator();
+    var o = read(fixture.identifier);
+
+    return o.checkSignature().then(r => {
+        expect(r.ok).toBe(true);
+        expect(r.status).toBe(owid.SignatureStatus.SIGNATURE_VALID);
+    });
+});
+
+test('a creator that only serves an older version leaves the signature ' +
+    'unjudged', () => {
+    // This is the outcome the library produced against the live service for
+    // as long as it asked for version 1 whatever version the OWID named.
+    // Nothing was forged and nothing was wrong with the identifier, the key
+    // simply could never be fetched.
+    mockCreator({ servedVersion: 1 });
+    var o = read(fixture.identifier);
+
+    return o.checkSignature().then(r => {
+        expect(r.ok).toBe(false);
+        expect(r.status).toBe(owid.SignatureStatus.KEY_UNAVAILABLE);
+    });
+});
+
+test('the key is chosen by the creation date, so the key in force in the ' +
+    'following week does not verify an older identifier', () => {
+    // The key that signed this identifier is not the key in force in the
+    // following week, so a creator that ignored the date and handed back the
+    // key in force at the moment of the request would report a genuine
+    // identifier as a forgery. That is what the date parameter is for.
+    var signing = keyInForceAt(expectedDate);
+    expect(signing).not.toBeNull();
+    expect(signing.startsAt).not.toBe(keyInForceAt(requestMoment).startsAt);
+
+    mockCreator({ ignoreDate: true });
+    var o = read(fixture.identifier);
+
+    return o.verify().then(valid => {
+        expect(valid).toBe(false);
+    });
+});
+
+test('the identifier verifies offline against the published key on its own',
+    () => {
+    // No network at all, which proves the fixture and the published schedule
+    // agree independently of how the creator URL is built.
+    var o = read(fixture.identifier);
+
+    return o.verifyWithPublicKey(keyInForceAt(o.date).publicKey)
+        .then(valid => {
+            expect(valid).toBe(true);
+            expect(fetch.mock.calls.length).toBe(0);
+        });
+});

package/node_modules/owid/owid.test.js

@@ -66,7 +66,12 @@ beforeEach(() => {
         }
         var url = new URL(urlString);
 
-        if (url.pathname.endsWith("/verify")) {
+        // Every OWID these tests read is version 2, and a real creator
+        // serves each version of the format at its own path, so only the
+        // version 2 verify path answers. A request to any other version
+        // path is the defect this guards against, and it falls through to
+        // the 404 below.
+        if (url.pathname === "/owid/api/v2/verify") {
             // The library sends the OWID being verified as form parameters
             // in the POST body, so read them from there.
             var body = new URLSearchParams(await req.text());

package/node_modules/owid/testdata/51did-identifier.json

@@ -0,0 +1,6 @@
+{
+  "version": "4.4.32-context.3",
+  "createdAt": "2026-09-04T20:37:00.4032665Z",
+  "identifier": "AzUxZC5lcwDAkTUAOAAAAAFkcBNhYL0rPISwcMhuxl0ezIe0Nywzr/lhMtzX5QjydfVQA40Aw6iylkIfGYQWecrhzDfF8g11B1KtuOBxa98MEyJZOXw3PB/EBuyOfGxZ/pu6rlt8zpCyIn1Prbu7V300bQBqrqyYfU0nNeZf/PCwLtXJRak76A==",
+  "source": "cloud.51degrees.com"
+}

package/node_modules/owid/testdata/51did-public-keys.json

@@ -0,0 +1,182 @@
+[
+  {
+    "startsAt": "2026-05-11T00:00:00Z",
+    "weekStart": "2026-05-11T00:00:00Z",
+    "created": "2026-05-13T07:53:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1S5u0ke8IvXO9tKBBjkNgUTLkMRR\nHcdbVUCYIDZbhOvvU2Sa7OTVfb/jDwcHwd/KVrl33uHBFHuH2E/UdBXBSw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-05-18T00:00:00Z",
+    "weekStart": "2026-05-18T00:00:00Z",
+    "created": "2026-05-18T05:31:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMaXEnA/hG6e9ZBIBxRnqaOspCS2f\nMDZ7MRaGMVo2CL0hcqdI4rP+KJll83xUxQq0nwwo11j/C2BwWfCbfcjFbw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-05-25T00:00:00Z",
+    "weekStart": "2026-05-25T00:00:00Z",
+    "created": "2026-05-25T05:41:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7GW67FrL7KfFZpxWt94xM4mgqtXB\n3jLL1gE/bcLaXVO7Myj5eo38oGTggos5iWAxlpY0bFUuqHSTkffQ+2jxog==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-06-01T00:00:00Z",
+    "weekStart": "2026-06-01T00:00:00Z",
+    "created": "2026-06-01T05:46:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOUaE86mCaq/kUcSbfdp6lIckGvPd\nnbDr++RVrj6WmJbOXpvdKk/nFfPb27TYz1P/mT0/YgGLsNRii/DK41Ag2g==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-06-08T00:00:00Z",
+    "weekStart": "2026-06-08T00:00:00Z",
+    "created": "2026-06-08T05:44:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6FK+7t+HkffkPe9Yhqtuy+lt8bgL\nPGUYty3nFid3mGub6QnIJFkyj9aAPe3VRcPY77Oaux78Xy+2tcdSBb91LA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-06-15T00:00:00Z",
+    "weekStart": "2026-06-15T00:00:00Z",
+    "created": "2026-06-15T05:57:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYU6uwIX2RJ6YtC516iCEITSs0W++\nRLM/Yo3ZmM2iCYe/HfSgqJwfy7ioVce3784+/YPgkmX8LBNwJTarVy/SmA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-06-22T00:00:00Z",
+    "weekStart": "2026-06-22T00:00:00Z",
+    "created": "2026-06-22T05:59:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJTOx47gMykTRMwsZq6xMrwO0+2ny\npeIxKfa6gvPWpBvDFFJMbNR9cUbHzrb0iFs1WzlKfEAjSrCtxaSfsNXkoA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-06-29T00:00:00Z",
+    "weekStart": "2026-06-29T00:00:00Z",
+    "created": "2026-06-29T05:44:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoKU47SHVpEjqD9txbXA4/StmOz2O\n1taTquaTes9lE+0jHB9/A8EUcodt8+oAG/YRRA6pjpe01/FlkgKIKWrhlw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-07-06T00:00:00Z",
+    "weekStart": "2026-07-06T00:00:00Z",
+    "created": "2026-07-06T05:33:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEx2jFmRxOqUH74IRCEPgNG0/e7FyN\neWstmBx0GVRNORYou5LtA++OlygptcuPRy/XqSy+/etiz6o8SzUiZ2F4qQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-07-13T00:00:00Z",
+    "weekStart": "2026-07-13T00:00:00Z",
+    "created": "2026-07-13T05:15:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhBOts6uqkfMIjfkNtoyYxNNAFtA1\nRvkx7ZdvbvlQDDgze7YadBUmvJwMNzBNeOeyAIshl8FklLB8R2VpyAkIRg==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-07-20T00:00:00Z",
+    "weekStart": "2026-07-20T00:00:00Z",
+    "created": "2026-07-20T05:19:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElZGKUk21yUH5DaJj41X3NiqDUoGa\niGgq/mZFQcTQkHQ2mr/Y6W6JbcSRiRFfTT21bpYd7BkatRotGtpHxXPuvQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-07-27T00:00:00Z",
+    "weekStart": "2026-07-27T00:00:00Z",
+    "created": "2026-07-27T05:22:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEayA4kh6boraOurRdy4epwDcW5Gay\ntuKdpqdLtcz5yEtH4bpmJxx74ZGbStWuilAWvLutBOWp0mAjpUu5JgPE3A==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-08-03T00:00:00Z",
+    "weekStart": "2026-08-03T00:00:00Z",
+    "created": "2026-08-03T05:18:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZMR1ut4GRhbc1dOxwXree/efQTtg\nDqzK2dicaCRO5Pz4E5ms3rDksBrv382MI0W7BgrSPR5VAtPEA93S/xcmFg==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-08-10T00:00:00Z",
+    "weekStart": "2026-08-10T00:00:00Z",
+    "created": "2026-08-10T04:35:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2UwwNdW+L68uziCcJUegj49Xi07P\nY4EGiGgMlESa2xoJfwVHoUc6oqRNqrPBnsrqQYsU2uYlR9QOWIomui5qEw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-08-17T00:00:00Z",
+    "weekStart": "2026-08-17T00:00:00Z",
+    "created": "2026-08-17T04:18:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpcTDCZlVsO1glWnDqfBiTOZysOIz\ndx2eFdPbrndBTWz7fu588pjZACM2CCs03dslwehiCuOHqJtdmHQv41V6Yw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-08-24T00:00:00Z",
+    "weekStart": "2026-08-24T00:00:00Z",
+    "created": "2026-08-24T04:19:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJ7YEHH6liCiSn6jmcZXXydRRiCAR\nHaZHkyazSq1bsUipbYOmz3kCrk1r3DmqrqiKBWZZS64yrGckLf5UkNsteg==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-08-31T00:00:00Z",
+    "weekStart": "2026-08-31T00:00:00Z",
+    "created": "2026-08-31T04:21:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEilbjpzqx8zx3oShIDgDoGTcBqivw\n08FKqFvRtX8rCS4Ftguvu2RwXDFLEwho0IhD/boxM1IwZ6u34hwkhf5AiQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-09-07T00:00:00Z",
+    "weekStart": "2026-09-07T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0KhXTjSD4xyW7Zc9d+kHWPzhx1yZ\n7c3gAMCF0iFHJokWejq9FrWSVEc9bMBJPv1Br/q/oIiPTfPuhiOJ1xMkFQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-09-14T00:00:00Z",
+    "weekStart": "2026-09-14T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEXKsoKyAZRkK9o1k4heQjAzUjHEP\nPWFnE0KKA5RI9wZHQffQcrK6rb2hcnObeZsYz7OQ/FneOMWpeiqK03OKHA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-09-21T00:00:00Z",
+    "weekStart": "2026-09-21T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFGOV57ItWDb76wzvzx+m2GWsJ+dX\n5OvtQFdPkAFV9OL4w0ntiVG0iUzZEGDRyCE5Xla82jhvA8YILz0gTdMFHQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-09-28T00:00:00Z",
+    "weekStart": "2026-09-28T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEi85ASgFPo4LerVK/QU3J5mdaW4o\nCYRzjqNqLzRjXWoiAQTyB7LB6MwDXSv4svsh7SNpjNmOFXcjVJ3CwwoNjA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-10-05T00:00:00Z",
+    "weekStart": "2026-10-05T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoRogg/dXpCiV3psJPu9ffND7JvBm\nFg9gOgRlXrCXFBIIoEWvGb/7q1MsquKoTF1uKkHy7HEJTkr9CUvSd83CcQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-10-12T00:00:00Z",
+    "weekStart": "2026-10-12T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBkAwOOX+Oykv6xHewe0CJuXzSGts\npAFEc82QhwzlanYJlY1lHLuP2D1xsEGOqsKXf9BOb/SesRjNHSTmi6ZGpw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-10-19T00:00:00Z",
+    "weekStart": "2026-10-19T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkkUuirYrxuFQmWjYZRWGSyvJuYcA\nOWz4zIP6c33VOKqEEtkvGJDoCV0Qm6EdgGJspDRQ2d7dtbKV2kMPnKW7UA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-10-26T00:00:00Z",
+    "weekStart": "2026-10-26T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnqgWDgDUXTqY2ZMOePx7qBFGgD/w\nepMX7HmpyRWr0XyZSUzeq2duV+VMJzNiZmQ0x34F1auNd+Dcf/3JkvXa/w==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-11-02T00:00:00Z",
+    "weekStart": "2026-11-02T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENlPq/5aO/kU6VbLMipaZMukRQFre\nMsE7Tp+8CqIZA7HPi/ikrgCOOeimi5QURTjXin8JoUiVNae3SFxBRwTsYQ==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-11-09T00:00:00Z",
+    "weekStart": "2026-11-09T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAET3UEAs41VZiXt+SmzEzL/4pyJJxV\nwoY+sD/haSnvyRUxSurp7ju8ACZm/bDKOPtM9xmZtRbmQaU2y221EB+Okw==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-11-16T00:00:00Z",
+    "weekStart": "2026-11-16T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgEbUOGc6d+rJNVrW6FSozCr3MXYr\njDf1ap19zD2pJZaRI0ORxs5A19mAEf11Nl64NT0gPI2ls9RVnMDY1tq8sg==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-11-23T00:00:00Z",
+    "weekStart": "2026-11-23T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKAazotnWdw0hbDJMRJjdCwa5Eaem\nMfwA2+Aks6g7NelJ4GsU4yLhITmrmcFWexSz3JzCa+wN255rZMqiIFSHIA==\n-----END PUBLIC KEY-----"
+  },
+  {
+    "startsAt": "2026-11-30T00:00:00Z",
+    "weekStart": "2026-11-30T00:00:00Z",
+    "created": "2026-09-01T10:54:00Z",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhDrkhpx28KTSNqXvs8vEXoUJEmLD\nqEyaVONFOZxgsnJehJqBtHVOevjptFfY6G1E6T4Opi4hH6m+/elwh8R2aA==\n-----END PUBLIC KEY-----"
+  }
+]

package/node_modules/owid/v1.js

@@ -1016,6 +1016,23 @@ var owid = (function () {
             });
     }
 
+    /**
+     * Builds the URL of one of the creator's end points for the OWID being
+     * verified. The version in the path is the OWID's own version byte,
+     * because a creator serves each version of the format at its own path
+     * and only the end point that understands the version an OWID was
+     * written in can answer for it. Both the key request and the fall back
+     * verify request are built here so the two cannot name different
+     * versions of the same creator.
+     * @param {Object} instance - the OWID being verified.
+     * @param {string} method - the end point, "creator" or "verify".
+     * @returns {string} the URL, with no query string.
+     */
+    function creatorApiUrl(instance, method) {
+        return "//" + instance.domain +
+            "/owid/api/v" + instance.version + "/" + method;
+    }
+
     /**
      * Fetches the creator's public key and checks the signature here. The key
      * is requested for the OWID's own creation date, so OWIDs signed before a
@@ -1027,7 +1044,7 @@ var owid = (function () {
      */
     function verifyWithCreatorKey(instance, unsigned, extra) {
         var subtle = getSubtle();
-        var url = "//" + instance.domain + "/owid/api/v1/creator";
+        var url = creatorApiUrl(instance, "creator");
         if (instance.date != null) {
             url += "?date=" + instance.date;
         }
@@ -1096,8 +1113,7 @@ var owid = (function () {
         var body = new URLSearchParams();
         body.append("parent", encodeBase64(joined));
         body.append("owid", instance.data);
-        var url = "//" + instance.domain +
-            "/owid/api/v" + instance.version + "/verify";
+        var url = creatorApiUrl(instance, "verify");
         return fetch(url, {
             method: "POST",
             mode: "cors",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fiftyone.pipeline.did",
-  "version": "4.5.37",
+  "version": "4.5.38",
   "description": "Strongly typed reader for the 51Did (51Degrees Identifier) value returned by the 51Degrees Cloud service. Parses the OWID envelope and exposes the Flags, License Id and match key plus the identifier type. Compare match keys, never envelopes.",
   "keywords": [
     "51degrees",
@@ -17,7 +17,7 @@
   "author": "51Degrees Engineering <engineering@51degrees.com>",
   "license": "EUPL-1.2",
   "dependencies": {
-    "owid": "github:51Degrees/owid-js#8363541e"
+    "owid": "github:51Degrees/owid-js#9aeb0d24"
   },
   "bundleDependencies": [
     "owid"

package/readme.md

@@ -158,7 +158,7 @@ and `FodId.checkSignature()` run without contacting a network endpoint.
 
 The library is not on the npm registry, so `package.json` names it as a
 GitHub reference, which npm resolves by cloning the repository. The reference
-is `github:51Degrees/owid-js#8363541e`, the merged hardening commit on `main`
+is `github:51Degrees/owid-js#9aeb0d24`, the commit on `main` that carries the key selection fix
 of the [51Degrees/owid-js](https://github.com/51Degrees/owid-js) fork. That
 applies only when working in this repository, because the published
 `fiftyone.pipeline.did` package carries the OWID source inside its own