@cauthyhq/node 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+## 1.1.0 — security release
+
+Cauthy now marks the tokens a machine holds, and names the client a person's token was issued through. This release makes `verifyToken` use those marks. Refusing a machine's token where a person is expected is a fix, not a break, so it ships as a minor version: upgrade.
+
+### Security
+
+- **A client's own token no longer passes as a person's.** A `client_credentials` token carries `token_use: "client"` and the client's public `client_id`. `verifyToken`, `createTokenVerifier`, `auth.verifyToken` and `auth.tokenVerifier` now refuse it with the reason `client_token` (rule R13 of the spec's `verification/rules.md`), by the claim's presence, whatever its value. In 1.0 such a token was accepted as a person whose `userId` was the client's id.
+- **By contract, a person's token issued through another client is refused** with `wrong_client` (rule R15): `auth.verifyToken` and `auth.tokenVerifier` check the token's `azp` against the link's sign-in client. A token with no `azp` passes. A call that names another `clientId` in contract mode is a `CauthyConfigError`.
+- `token_use` and `azp`, when present, must be strings (`invalid_claim` otherwise, rule R8).
+
+### Backends that serve machines
+
+If an endpoint is called by machines with a `client_credentials` token, pass `allowClientTokens: true` to the verifier that guards it:
+
+```ts
+const verifyMachine = auth.tokenVerifier({ allowClientTokens: true })
+const who = await verifyMachine(request)
+who.clientId // the client's public id; who.userId is its internal id
+```
+
+Without it those calls get `client_token` (answer 401) after the upgrade.
+
+### Added
+
+- `TokenIdentity.authorizedParty`: the token's `azp`, the client a person's token was issued through; absent when none was named.
+- `TokenIdentity.clientId`: the token's `client_id` (a client's own token, with `allowClientTokens`; an AI agent's).
+- `VerifyTokenOptions.allowClientTokens` (default `false`) and `VerifyTokenOptions.clientId` (default none; by contract, the link's sign-in client).
+- `TokenRefusal` gains `client_token` and `wrong_client`.
+
+### Notes
+
+- Cauthy now answers its JWKS with `max-age=300` and publishes a key at least that long before it signs with it. Nothing changes here: the keys are kept for the answer's `max-age` and fetched again on an unknown `kid`.
+- A session that began through a client renews only through it. The SDK already renews with the `clientId` it signed in with, and sends that `clientId` on its own screens' calls: keep one `clientId` per deployment.
+
+### Development
+
+- vitest 4.1.12, fastify 5.12.8 (tests), and postcss 8.5.32 and esbuild 0.28.2 by override: every open advisory was in development dependencies only. `npm audit` reports none.
+
+## 1.0.0
+
+First release: the server half of `cauthy-auth` 0.42 (see the README, "Moving from cauthy-auth").

package/README.md

@@ -91,6 +91,7 @@ import { auth } from './auth'
 //   issuer   the instance's own (CAUTHY_ISSUER, or the contract)
 //   tenantId by contract, the link's tenant_id; otherwise the `tenantId` option or CAUTHY_TENANT_ID
 //   audience the `audience` option or CAUTHY_AUDIENCE: your Cauthy's JWT_AUDIENCE (Cauthy has no default for it)
+//   clientId by contract, the link's sign-in client: a person's token issued through another is refused (wrong_client)
 const verify = auth.tokenVerifier()          // throws CauthyConfigError now if one is missing
 const who = await verify(request)            // or: await auth.verifyToken(request)
 ```
@@ -106,6 +107,8 @@ const verify = createTokenVerifier({ issuer: 'https://id.example.com', audience:
 
 - **The audience and the workspace are required.** Without them a token issued for another application or workspace would be accepted.
 - A system's own token (`sys` claim, whatever its value) and a guest's token (`anon: true`) are refused where a person is expected. Pass `allowSystem` or `allowAnonymous` for an endpoint that takes them.
+- A client's own token (a `client_credentials` grant: `token_use: "client"`, whatever the value) is refused with `client_token` where a person is expected. A backend that serves machines too passes `allowClientTokens: true`; the identity then carries `clientId`, the client's public id (its `userId` is the client's internal id).
+- `authorizedParty` is the token's `azp`: the client a person's token was issued through, absent when none was named. With `clientId` (by contract, always the link's sign-in client), a token whose `azp` names another client is refused with `wrong_client`; a token with no `azp` passes.
 - Clock tolerance is 30 seconds (`leeway`, 0 to 60). A token over 8192 bytes, with a repeated JSON name, a fractional date or a wrongly typed claim is refused.
 - Keys are fetched from `<issuer>/.well-known/jwks.json` with no redirect, within 5 seconds, at most 64 KiB, and kept for the answer's `max-age`.
 
@@ -171,6 +174,7 @@ It refuses to start when any `CAUTHY_*` variable of the standard mode is also se
 CI runs the auth-bff conformance suite at level `strict` against `examples/acme-crm` on an in-memory Cauthy, and the spec's token vectors against `verifyToken`:
 
     SPEC_DIR=../cauthy-sdk-spec LEVEL=strict npm run conformance
+    SPEC_DIR=../cauthy-sdk-spec LEVEL=switches npm run conformance   # also the dashboard switches, on the in-memory Cauthy
     SPEC_DIR=../cauthy-sdk-spec npm run vectors
 
 ## Security

package/dist/{cauthy-ClP5orP4.d.mts → cauthy-Bn-i7cKD.d.mts}

@@ -832,13 +832,20 @@ interface TokenIdentity {
     system?: string;
     /** Set when the token is a guest's (only with `allowAnonymous`). */
     anonymous?: true;
+    /** The client a person's token was issued through (`azp`); absent when none was named. */
+    authorizedParty?: string;
+    /**
+     * The token's `client_id`: on a client's own token (only with
+     * `allowClientTokens`), the client's public id; on an AI agent's, the agent's.
+     */
+    clientId?: string;
     /** UTC, ISO 8601. */
     expiresAt: string;
     /** The token as it arrived, to pass on. */
     token: string;
 }
 /** Why a token was refused: the closed list of verification/rules.md, and `no_token` when none was given. */
-type TokenRefusal = 'no_token' | 'too_large' | 'malformed' | 'alg_not_allowed' | 'unsupported_header' | 'missing_kid' | 'unknown_kid' | 'weak_key' | 'bad_signature' | 'missing_claim' | 'invalid_claim' | 'wrong_issuer' | 'wrong_audience' | 'expired' | 'not_yet_valid' | 'issued_in_future' | 'wrong_tenant' | 'system_token' | 'anonymous_token';
+type TokenRefusal = 'no_token' | 'too_large' | 'malformed' | 'alg_not_allowed' | 'unsupported_header' | 'missing_kid' | 'unknown_kid' | 'weak_key' | 'bad_signature' | 'missing_claim' | 'invalid_claim' | 'wrong_issuer' | 'wrong_audience' | 'expired' | 'not_yet_valid' | 'issued_in_future' | 'wrong_tenant' | 'system_token' | 'client_token' | 'anonymous_token' | 'wrong_client';
 /**
  * Cauthy's keys could not be fetched (or are not a key set): the token may be
  * good, and the application cannot tell. Answer 503, not 401. It is not a
@@ -880,6 +887,20 @@ interface VerifyTokenOptions {
     allowSystem?: boolean;
     /** Accept a guest's token (`anon: true`). Default: false (rule R14). */
     allowAnonymous?: boolean;
+    /**
+     * Accept a client's own token (a `token_use` claim, from a
+     * `client_credentials` grant) too: for a backend that serves machines as
+     * well as people. Default: false, so a machine never passes as a person
+     * (rule R13). The identity then carries `clientId`.
+     */
+    allowClientTokens?: boolean;
+    /**
+     * The client this backend signs people in through. When set, a person's
+     * token issued through another client (an `azp` naming another) is refused
+     * with `wrong_client` (rule R15); a token with no `azp` passes. In contract
+     * mode it is the link's sign-in client. Default: none, and `azp` is not checked.
+     */
+    clientId?: string;
 }
 /**
  * Cauthy's published keys (K1 to K5 of verification/rules.md): fetched with a
@@ -990,6 +1011,8 @@ interface Cauthy {
      * an API of this application: `verifyToken` with this instance's issuer, its
      * workspace (by contract, the link's `tenant_id`; otherwise `tenantId` or
      * `CAUTHY_TENANT_ID`) and its audience (`audience` or `CAUTHY_AUDIENCE`).
+     * By contract it also refuses a person's token issued through another
+     * client than the link's (`wrong_client`).
      */
     verifyToken(from: string | Request | Headers, options?: Partial<VerifyTokenOptions>): Promise<TokenIdentity>;
     /** The same, built once: throws `CauthyConfigError` now if the audience or the workspace is missing. */

package/dist/{cauthy-B6Sm3T8M.d.ts → cauthy-Wy-YDGrM.d.ts}

@@ -832,13 +832,20 @@ interface TokenIdentity {
     system?: string;
     /** Set when the token is a guest's (only with `allowAnonymous`). */
     anonymous?: true;
+    /** The client a person's token was issued through (`azp`); absent when none was named. */
+    authorizedParty?: string;
+    /**
+     * The token's `client_id`: on a client's own token (only with
+     * `allowClientTokens`), the client's public id; on an AI agent's, the agent's.
+     */
+    clientId?: string;
     /** UTC, ISO 8601. */
     expiresAt: string;
     /** The token as it arrived, to pass on. */
     token: string;
 }
 /** Why a token was refused: the closed list of verification/rules.md, and `no_token` when none was given. */
-type TokenRefusal = 'no_token' | 'too_large' | 'malformed' | 'alg_not_allowed' | 'unsupported_header' | 'missing_kid' | 'unknown_kid' | 'weak_key' | 'bad_signature' | 'missing_claim' | 'invalid_claim' | 'wrong_issuer' | 'wrong_audience' | 'expired' | 'not_yet_valid' | 'issued_in_future' | 'wrong_tenant' | 'system_token' | 'anonymous_token';
+type TokenRefusal = 'no_token' | 'too_large' | 'malformed' | 'alg_not_allowed' | 'unsupported_header' | 'missing_kid' | 'unknown_kid' | 'weak_key' | 'bad_signature' | 'missing_claim' | 'invalid_claim' | 'wrong_issuer' | 'wrong_audience' | 'expired' | 'not_yet_valid' | 'issued_in_future' | 'wrong_tenant' | 'system_token' | 'client_token' | 'anonymous_token' | 'wrong_client';
 /**
  * Cauthy's keys could not be fetched (or are not a key set): the token may be
  * good, and the application cannot tell. Answer 503, not 401. It is not a
@@ -880,6 +887,20 @@ interface VerifyTokenOptions {
     allowSystem?: boolean;
     /** Accept a guest's token (`anon: true`). Default: false (rule R14). */
     allowAnonymous?: boolean;
+    /**
+     * Accept a client's own token (a `token_use` claim, from a
+     * `client_credentials` grant) too: for a backend that serves machines as
+     * well as people. Default: false, so a machine never passes as a person
+     * (rule R13). The identity then carries `clientId`.
+     */
+    allowClientTokens?: boolean;
+    /**
+     * The client this backend signs people in through. When set, a person's
+     * token issued through another client (an `azp` naming another) is refused
+     * with `wrong_client` (rule R15); a token with no `azp` passes. In contract
+     * mode it is the link's sign-in client. Default: none, and `azp` is not checked.
+     */
+    clientId?: string;
 }
 /**
  * Cauthy's published keys (K1 to K5 of verification/rules.md): fetched with a
@@ -990,6 +1011,8 @@ interface Cauthy {
      * an API of this application: `verifyToken` with this instance's issuer, its
      * workspace (by contract, the link's `tenant_id`; otherwise `tenantId` or
      * `CAUTHY_TENANT_ID`) and its audience (`audience` or `CAUTHY_AUDIENCE`).
+     * By contract it also refuses a person's token issued through another
+     * client than the link's (`wrong_client`).
      */
     verifyToken(from: string | Request | Headers, options?: Partial<VerifyTokenOptions>): Promise<TokenIdentity>;
     /** The same, built once: throws `CauthyConfigError` now if the audience or the workspace is missing. */

package/dist/express.d.mts

@@ -1,5 +1,5 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { S as Session, C as Cauthy } from './cauthy-ClP5orP4.mjs';
+import { S as Session, C as Cauthy } from './cauthy-Bn-i7cKD.mjs';
 import './keys-D5k0omTb.mjs';
 import 'jose';
 import './theme.mjs';

package/dist/express.d.ts

@@ -1,5 +1,5 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { S as Session, C as Cauthy } from './cauthy-B6Sm3T8M.js';
+import { S as Session, C as Cauthy } from './cauthy-Wy-YDGrM.js';
 import './keys-D5k0omTb.js';
 import 'jose';
 import './theme.js';

package/dist/fastify.d.mts

@@ -1,5 +1,5 @@
 import { FastifyReply, FastifyPluginAsync, FastifyInstance } from 'fastify';
-import { S as Session, C as Cauthy } from './cauthy-ClP5orP4.mjs';
+import { S as Session, C as Cauthy } from './cauthy-Bn-i7cKD.mjs';
 import './keys-D5k0omTb.mjs';
 import 'jose';
 import './theme.mjs';

package/dist/fastify.d.ts

@@ -1,5 +1,5 @@
 import { FastifyReply, FastifyPluginAsync, FastifyInstance } from 'fastify';
-import { S as Session, C as Cauthy } from './cauthy-B6Sm3T8M.js';
+import { S as Session, C as Cauthy } from './cauthy-Wy-YDGrM.js';
 import './keys-D5k0omTb.js';
 import 'jose';
 import './theme.js';

package/dist/hono.d.mts

@@ -1,5 +1,5 @@
 import { MiddlewareHandler } from 'hono';
-import { S as Session, C as Cauthy } from './cauthy-ClP5orP4.mjs';
+import { S as Session, C as Cauthy } from './cauthy-Bn-i7cKD.mjs';
 import './keys-D5k0omTb.mjs';
 import 'jose';
 import './theme.mjs';

package/dist/hono.d.ts

@@ -1,5 +1,5 @@
 import { MiddlewareHandler } from 'hono';
-import { S as Session, C as Cauthy } from './cauthy-B6Sm3T8M.js';
+import { S as Session, C as Cauthy } from './cauthy-Wy-YDGrM.js';
 import './keys-D5k0omTb.js';
 import 'jose';
 import './theme.js';

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-export { A as AttributeType, a as CatalogResource, C as Cauthy, b as CauthyApiError, c as CauthyConfigError, d as CauthyEvent, e as CauthyOptions, f as CauthyPact, g as CauthySystem, h as CauthyTokenError, i as CauthyUnavailableError, j as CauthyWebhookError, k as CheckOf, l as CheckQuestion, m as CheckResult, n as CheckRule, o as ConditionalPermission, p as ContractOptions, J as JsonValue, M as MountTarget, N as NewMember, O as Organization, q as OrganizationMember, r as OrganizationRef, P as PactItem, s as PactStatus, t as PermissionOf, u as Permitted, v as Policy, w as PolicyDefinition, x as PolicyPermission, y as PolicyRole, z as PublicSession, B as PushPolicyOptions, R as ReplayStore, D as Resolved, E as ResolvedContract, F as RoleOf, G as STANDARD_VARIABLES, S as Session, H as SessionOrganization, I as SessionStatus, K as SessionUser, L as SystemKey, Q as SystemOptions, T as SystemPolicy, U as TokenIdentity, V as TokenRefusal, W as VerifyTokenOptions, X as VerifyWebhookOptions, Y as can, Z as createCauthy, _ as createSystem, $ as createTokenVerifier, a0 as definePolicy, a1 as failClosed, a2 as memoryReplayStore, a3 as policySource, a4 as pullCatalog, a5 as pullPolicy, a6 as pushCatalog, a7 as pushPolicy, a8 as readContract, a9 as remoteKeys, aa as verifyToken, ab as verifyWebhook } from './cauthy-ClP5orP4.mjs';
+export { A as AttributeType, a as CatalogResource, C as Cauthy, b as CauthyApiError, c as CauthyConfigError, d as CauthyEvent, e as CauthyOptions, f as CauthyPact, g as CauthySystem, h as CauthyTokenError, i as CauthyUnavailableError, j as CauthyWebhookError, k as CheckOf, l as CheckQuestion, m as CheckResult, n as CheckRule, o as ConditionalPermission, p as ContractOptions, J as JsonValue, M as MountTarget, N as NewMember, O as Organization, q as OrganizationMember, r as OrganizationRef, P as PactItem, s as PactStatus, t as PermissionOf, u as Permitted, v as Policy, w as PolicyDefinition, x as PolicyPermission, y as PolicyRole, z as PublicSession, B as PushPolicyOptions, R as ReplayStore, D as Resolved, E as ResolvedContract, F as RoleOf, G as STANDARD_VARIABLES, S as Session, H as SessionOrganization, I as SessionStatus, K as SessionUser, L as SystemKey, Q as SystemOptions, T as SystemPolicy, U as TokenIdentity, V as TokenRefusal, W as VerifyTokenOptions, X as VerifyWebhookOptions, Y as can, Z as createCauthy, _ as createSystem, $ as createTokenVerifier, a0 as definePolicy, a1 as failClosed, a2 as memoryReplayStore, a3 as policySource, a4 as pullCatalog, a5 as pullPolicy, a6 as pushCatalog, a7 as pushPolicy, a8 as readContract, a9 as remoteKeys, aa as verifyToken, ab as verifyWebhook } from './cauthy-Bn-i7cKD.mjs';
 export { K as KeyStore, P as PactKeys, S as StoredKey } from './keys-D5k0omTb.mjs';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.mjs';
 import 'jose';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AttributeType, a as CatalogResource, C as Cauthy, b as CauthyApiError, c as CauthyConfigError, d as CauthyEvent, e as CauthyOptions, f as CauthyPact, g as CauthySystem, h as CauthyTokenError, i as CauthyUnavailableError, j as CauthyWebhookError, k as CheckOf, l as CheckQuestion, m as CheckResult, n as CheckRule, o as ConditionalPermission, p as ContractOptions, J as JsonValue, M as MountTarget, N as NewMember, O as Organization, q as OrganizationMember, r as OrganizationRef, P as PactItem, s as PactStatus, t as PermissionOf, u as Permitted, v as Policy, w as PolicyDefinition, x as PolicyPermission, y as PolicyRole, z as PublicSession, B as PushPolicyOptions, R as ReplayStore, D as Resolved, E as ResolvedContract, F as RoleOf, G as STANDARD_VARIABLES, S as Session, H as SessionOrganization, I as SessionStatus, K as SessionUser, L as SystemKey, Q as SystemOptions, T as SystemPolicy, U as TokenIdentity, V as TokenRefusal, W as VerifyTokenOptions, X as VerifyWebhookOptions, Y as can, Z as createCauthy, _ as createSystem, $ as createTokenVerifier, a0 as definePolicy, a1 as failClosed, a2 as memoryReplayStore, a3 as policySource, a4 as pullCatalog, a5 as pullPolicy, a6 as pushCatalog, a7 as pushPolicy, a8 as readContract, a9 as remoteKeys, aa as verifyToken, ab as verifyWebhook } from './cauthy-B6Sm3T8M.js';
+export { A as AttributeType, a as CatalogResource, C as Cauthy, b as CauthyApiError, c as CauthyConfigError, d as CauthyEvent, e as CauthyOptions, f as CauthyPact, g as CauthySystem, h as CauthyTokenError, i as CauthyUnavailableError, j as CauthyWebhookError, k as CheckOf, l as CheckQuestion, m as CheckResult, n as CheckRule, o as ConditionalPermission, p as ContractOptions, J as JsonValue, M as MountTarget, N as NewMember, O as Organization, q as OrganizationMember, r as OrganizationRef, P as PactItem, s as PactStatus, t as PermissionOf, u as Permitted, v as Policy, w as PolicyDefinition, x as PolicyPermission, y as PolicyRole, z as PublicSession, B as PushPolicyOptions, R as ReplayStore, D as Resolved, E as ResolvedContract, F as RoleOf, G as STANDARD_VARIABLES, S as Session, H as SessionOrganization, I as SessionStatus, K as SessionUser, L as SystemKey, Q as SystemOptions, T as SystemPolicy, U as TokenIdentity, V as TokenRefusal, W as VerifyTokenOptions, X as VerifyWebhookOptions, Y as can, Z as createCauthy, _ as createSystem, $ as createTokenVerifier, a0 as definePolicy, a1 as failClosed, a2 as memoryReplayStore, a3 as policySource, a4 as pullCatalog, a5 as pullPolicy, a6 as pushCatalog, a7 as pushPolicy, a8 as readContract, a9 as remoteKeys, aa as verifyToken, ab as verifyWebhook } from './cauthy-Wy-YDGrM.js';
 export { K as KeyStore, P as PactKeys, S as StoredKey } from './keys-D5k0omTb.js';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
 import 'jose';

package/dist/index.js

@@ -1808,6 +1808,7 @@ function createTokenVerifier(options = {}) {
     if (claims.roles !== void 0 && claims.roles !== null && !(Array.isArray(claims.roles) && claims.roles.every((r) => typeof r === "string"))) bad("roles");
     if (claims.email !== void 0 && typeof claims.email !== "string") bad("email");
     for (const name of ["email_verified", "anon"]) if (claims[name] !== void 0 && typeof claims[name] !== "boolean") bad(name);
+    for (const name of ["token_use", "azp"]) if (claims[name] !== void 0 && typeof claims[name] !== "string") bad(name);
     if (!issuers.includes(claims.iss)) throw new CauthyTokenError("wrong_issuer");
     if (!(Array.isArray(aud) ? aud.includes(audience) : aud === audience)) throw new CauthyTokenError("wrong_audience");
     const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
@@ -1816,7 +1817,9 @@ function createTokenVerifier(options = {}) {
     if (now < claims.iat - leeway) throw new CauthyTokenError("issued_in_future");
     if (claims.tid !== tenant) throw new CauthyTokenError("wrong_tenant");
     if ("sys" in claims && !options.allowSystem) throw new CauthyTokenError("system_token");
+    if ("token_use" in claims && !options.allowClientTokens) throw new CauthyTokenError("client_token");
     if (claims.anon === true && !options.allowAnonymous) throw new CauthyTokenError("anonymous_token");
+    if (options.clientId && typeof claims.azp === "string" && claims.azp !== "" && claims.azp !== options.clientId) throw new CauthyTokenError("wrong_client");
     return {
       userId: claims.sub,
       tenantId: claims.tid,
@@ -1825,6 +1828,8 @@ function createTokenVerifier(options = {}) {
       roles: Array.isArray(claims.roles) ? claims.roles : [],
       ...typeof claims.sys === "string" && claims.sys !== "" ? { system: claims.sys } : {},
       ...claims.anon === true ? { anonymous: true } : {},
+      ...typeof claims.azp === "string" && claims.azp !== "" ? { authorizedParty: claims.azp } : {},
+      ...typeof claims.client_id === "string" && claims.client_id !== "" ? { clientId: claims.client_id } : {},
       expiresAt: new Date(claims.exp * 1e3).toISOString(),
       token
     };
@@ -3324,13 +3329,19 @@ function createCauthy(given = {}) {
     return { response: redirect(to) };
   }
   const replay = given.webhookReplay ?? memoryReplayStore();
-  const tokenVerifier = (o = {}) => createTokenVerifier({
-    issuer,
-    tenantId: contract?.tenantId ?? given.tenantId,
-    audience: given.audience,
-    fetch: given.fetch,
-    ...o
-  });
+  const tokenVerifier = (o = {}) => {
+    if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
+      throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
+    }
+    return createTokenVerifier({
+      issuer,
+      tenantId: contract?.tenantId ?? given.tenantId,
+      audience: given.audience,
+      fetch: given.fetch,
+      ...contract ? { clientId: contract.clientId } : {},
+      ...o
+    });
+  };
   const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay });
   const pact = contract && ownKeys ? {
     contract,