@cauthyhq/node 1.1.0 → 1.2.1

package/dist/index.mjs

@@ -54,9 +54,12 @@ async function unseal(sealed, key) {
   }
 }
 async function unsealAny(sealed, ring) {
-  for (const key of ring) {
-    const value = await unseal(sealed, key);
-    if (value !== null) return value;
+  return (await unsealIndexed(sealed, ring))?.value ?? null;
+}
+async function unsealIndexed(sealed, ring) {
+  for (let index = 0; index < ring.length; index++) {
+    const value = await unseal(sealed, ring[index]);
+    if (value !== null) return { value, index };
   }
   return null;
 }
@@ -68,6 +71,14 @@ var CauthyConfigError = class extends Error {
     this.name = "CauthyConfigError";
   }
 };
+var CauthyKeyError = class extends CauthyConfigError {
+  constructor(reason, message) {
+    super(`CAUTHY_KEY: ${message} (${reason})`);
+    this.reason = reason;
+    this.name = "CauthyKeyError";
+  }
+  reason;
+};
 
 // src/url.ts
 function withoutTrailingSlashes(s) {
@@ -978,6 +989,7 @@ function createSystem(given = {}) {
   };
   const tokenEndpoint = `${issuer}/v1/oauth/token`;
   function configured() {
+    if (given.signer) return;
     if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
     if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
     if (given.keys) {
@@ -990,7 +1002,7 @@ function createSystem(given = {}) {
   }
   let imported;
   const signingKey = () => imported ??= loadKey(key);
-  async function fail(res, what) {
+  async function fail2(res, what) {
     const body = await res.json().catch(() => null);
     const first = body?.errors?.[0];
     const code = typeof body?.error === "string" ? body.error : first?.code;
@@ -1001,9 +1013,13 @@ function createSystem(given = {}) {
   let asking;
   async function ask() {
     configured();
-    const self = given.keys ? given.keysClientId : key?.clientId || clientId;
+    const self = given.signer ? given.signer.clientId : given.keys ? given.keysClientId : key?.clientId || clientId;
     const form = new URLSearchParams({ grant_type: "client_credentials", client_id: self });
-    if (given.keys || key) {
+    if (given.signer) {
+      const s = await given.signer.signer;
+      form.set("client_assertion_type", ASSERTION_TYPE);
+      form.set("client_assertion", await s.assertion(self, tokenEndpoint));
+    } else if (given.keys || key) {
       const signer = given.keys ? await given.keys.current() : { kid: key.keyId, privateKey: await signingKey() };
       const assertion = await new SignJWT({}).setProtectedHeader({ alg: "RS256", kid: signer.kid }).setIssuer(self).setSubject(self).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(signer.privateKey);
       form.set("client_assertion_type", ASSERTION_TYPE);
@@ -1012,7 +1028,7 @@ function createSystem(given = {}) {
       form.set("client_secret", clientSecret);
     }
     const res = await doFetch(tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
-    if (!res.ok) await fail(res, "the application's own token");
+    if (!res.ok) await fail2(res, "the application's own token");
     const t = await res.json();
     held = { value: t.access_token, until: Date.now() + t.expires_in * 1e3 - SKEW_MS };
     return t.access_token;
@@ -1034,7 +1050,7 @@ function createSystem(given = {}) {
       held = void 0;
       res = await send();
     }
-    if (!res.ok) await fail(res, `${method} ${path}`);
+    if (!res.ok) await fail2(res, `${method} ${path}`);
     return res.status === 204 ? void 0 : res.json();
   }
   const data = async (method, path, body, extra) => (await call(method, path, body, extra))?.data;
@@ -1108,7 +1124,7 @@ function createSystem(given = {}) {
       }
     },
     async check(q) {
-      const system = q.system ?? ownSystem;
+      const system = q.system ?? (ownSystem || given.currentSystem?.() || "");
       if (system === "") throw new CauthyConfigError("name the system to check in (system, or CAUTHY_SYSTEM)");
       return checkResultOf(await data("POST", `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }));
     },
@@ -1278,6 +1294,219 @@ function firstProblem(...checks) {
 
 // src/webhook.ts
 import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/sha256.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+function sha256(data) {
+  const h = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+  const len = data.length;
+  const padded = new Uint8Array(len + 9 + 63 >> 6 << 6);
+  padded.set(data);
+  padded[len] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(len / 536870912));
+  view.setUint32(padded.length - 4, len << 3 >>> 0);
+  const w = new Uint32Array(64);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 64; i++) {
+      const t1 = hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[i] + w[i] >>> 0;
+      const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    h[0] += a;
+    h[1] += b;
+    h[2] += c;
+    h[3] += d;
+    h[4] += e;
+    h[5] += f;
+    h[6] += g;
+    h[7] += hh;
+  }
+  const out2 = new Uint8Array(32);
+  const ov = new DataView(out2.buffer);
+  for (let i = 0; i < 8; i++) ov.setUint32(i * 4, h[i]);
+  return out2;
+}
+
+// src/cauthykey.ts
+var KEY_PREFIX = "cauthy1";
+var KEY_REPLACES = [
+  "CAUTHY_ISSUER",
+  "CAUTHY_CLIENT_ID",
+  "CAUTHY_CLIENT_SECRET",
+  "CAUTHY_SYSTEM",
+  "CAUTHY_TENANT",
+  "CAUTHY_SYSTEM_KEY",
+  "CAUTHY_SYSTEM_KEY_ID",
+  "CAUTHY_BASE_URL",
+  "CAUTHY_AUDIENCE",
+  "CAUTHY_TENANT_ID"
+];
+function refuseBesideKey(environment) {
+  const set = KEY_REPLACES.filter((n) => (environment?.[n] ?? "") !== "");
+  if (set.length > 0) {
+    throw new CauthyConfigError(`the application runs on CAUTHY_KEY, and ${set.join(", ")} ${set.length === 1 ? "is" : "are"} also set: remove ${set.length === 1 ? "it" : "them"} from the environment. Everything comes from the key.`);
+  }
+}
+var MAX_LEN = 512;
+var enc = new TextEncoder();
+var dec = new TextDecoder("utf-8", { fatal: true });
+function b64uEncode(b) {
+  let bin = "";
+  for (const x of b) bin += String.fromCharCode(x);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64uDecode(s) {
+  if (!/^[A-Za-z0-9_-]*$/.test(s) || s.length % 4 === 1) return null;
+  const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4));
+  const out2 = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  return b64uEncode(out2) === s ? out2 : null;
+}
+function checksum(body) {
+  return b64uEncode(sha256(enc.encode(body)).slice(0, 6));
+}
+function printableAscii(s) {
+  return /^[\x21-\x7e]*$/.test(s);
+}
+function validIssuer(s) {
+  if (s === "" || !printableAscii(s)) return false;
+  let u;
+  try {
+    u = new URL(s);
+  } catch {
+    return false;
+  }
+  if (u.origin !== s) return false;
+  if (/^\[::ffff:/i.test(u.host)) return false;
+  if (u.protocol === "https:") return true;
+  return u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname);
+}
+var fail = (reason, message) => {
+  throw new CauthyKeyError(reason, message);
+};
+var NOT_A_KEY = "not a Cauthy key (copy it again from the dashboard)";
+function parseKey(text2) {
+  const s = text2.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, "");
+  if (s === "" || s.length > MAX_LEN || !printableAscii(s)) fail("key_format", NOT_A_KEY);
+  const head = s.split(".", 1)[0];
+  if (head !== KEY_PREFIX) {
+    if (/^cauthy[0-9]+$/.test(head)) fail("key_version", `this key is for a newer SDK (${head}): update @cauthyhq/node`);
+    fail("key_format", NOT_A_KEY);
+  }
+  const parts = s.split(".");
+  if (parts.length !== 5 || parts.some((p) => p === "")) fail("key_format", NOT_A_KEY);
+  if (!constantTimeEqual(checksum(parts.slice(0, 4).join(".")), parts[4])) {
+    fail("key_checksum", "the key is damaged (part of it is missing or changed): copy it again from the dashboard");
+  }
+  const issuerBytes = b64uDecode(parts[1]);
+  let issuer = "";
+  try {
+    issuer = issuerBytes ? dec.decode(issuerBytes) : "";
+  } catch {
+    issuer = "";
+  }
+  if (!validIssuer(issuer)) fail("key_issuer", "the key names no valid Cauthy address");
+  const clientBytes = b64uDecode(parts[2]);
+  const clientId = clientBytes ? String.fromCharCode(...clientBytes) : "";
+  if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) fail("key_client", "the key names no valid client");
+  const secret = b64uDecode(parts[3]);
+  if (parts[3].length !== 43 || !secret || secret.length !== 32) fail("key_secret", "the key's secret is not 32 bytes");
+  return { issuer, clientId, secret: parts[3] };
+}
+function composeKey(issuer, clientId, secret) {
+  const body = `${KEY_PREFIX}.${b64uEncode(enc.encode(issuer))}.${b64uEncode(enc.encode(clientId))}.${secret}`;
+  const key = `${body}.${checksum(body)}`;
+  parseKey(key);
+  return key;
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return d === 0;
+}
+
+// src/webhook.ts
 var CauthyWebhookError = class extends Error {
   constructor(reason) {
     super(`@cauthyhq/node: webhook refused: ${reason}`);
@@ -1312,7 +1541,8 @@ function keysOf(issuer) {
 }
 var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
 async function verifyWebhook(request, options = {}) {
-  const env4 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const key = typeof process !== "undefined" ? process.env?.CAUTHY_KEY : void 0;
+  const env4 = key ? parseKey(key).issuer : typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
   const issuer = withoutTrailingSlashes(options.issuer ?? env4 ?? "");
   if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
   const signature = request.headers.get("x-cauthy-signature-jwt");
@@ -1441,7 +1671,7 @@ var LIMIT = 2n ** 53n;
 function parseStrict(text2, integerMembers = []) {
   let i = 0;
   let depth = 0;
-  const fail = (what) => {
+  const fail2 = (what) => {
     throw new SyntaxError(`${what} at ${i}`);
   };
   const skip = () => {
@@ -1460,19 +1690,19 @@ function parseStrict(text2, integerMembers = []) {
         return v;
       }
     }
-    return fail("unexpected character");
+    return fail2("unexpected character");
   };
   const string = () => {
     const start = i;
     i++;
     while (i < text2.length && text2[i] !== '"') i += text2[i] === "\\" ? 2 : 1;
-    if (text2[i] !== '"') fail("unterminated string");
+    if (text2[i] !== '"') fail2("unterminated string");
     i++;
     return JSON.parse(text2.slice(start, i));
   };
   const number = (integer) => {
     const m = /^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/.exec(text2.slice(i));
-    if (!m) return fail("bad number");
+    if (!m) return fail2("bad number");
     i += m[0].length;
     if (integer && (m[2] !== void 0 || m[3] !== void 0)) return Number.NaN;
     if (m[2] === void 0 && m[3] === void 0) {
@@ -1499,7 +1729,7 @@ function parseStrict(text2, integerMembers = []) {
         i++;
         depth--;
         return out2;
-      } else fail("expected , or ]");
+      } else fail2("expected , or ]");
     }
   };
   const object = () => {
@@ -1515,12 +1745,12 @@ function parseStrict(text2, integerMembers = []) {
     }
     for (; ; ) {
       skip();
-      if (text2[i] !== '"') fail("expected a name");
+      if (text2[i] !== '"') fail2("expected a name");
       const name = string();
-      if (seen.has(name)) fail(`repeated name ${JSON.stringify(name)}`);
+      if (seen.has(name)) fail2(`repeated name ${JSON.stringify(name)}`);
       seen.add(name);
       skip();
-      if (text2[i] !== ":") fail("expected :");
+      if (text2[i] !== ":") fail2("expected :");
       i++;
       Object.defineProperty(out2, name, { value: value(depth === 1 && integerMembers.includes(name)), enumerable: true, writable: true, configurable: true });
       skip();
@@ -1529,15 +1759,175 @@ function parseStrict(text2, integerMembers = []) {
         i++;
         depth--;
         return out2;
-      } else fail("expected , or }");
+      } else fail2("expected , or }");
     }
   };
   const result = value();
   skip();
-  if (i < text2.length) fail("trailing characters");
+  if (i < text2.length) fail2("trailing characters");
   return result;
 }
 
+// src/deprecate.ts
+var told = /* @__PURE__ */ new Set();
+function deprecated(what, instead) {
+  if (told.has(what)) return;
+  told.add(what);
+  const message = `@cauthyhq/node: ${what} is deprecated and leaves in 2.0. ${instead}`;
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(message, { type: "DeprecationWarning", code: "CAUTHY_DEPRECATED" });
+  } else {
+    console.warn(message);
+  }
+}
+
+// src/keyderive.ts
+var enc2 = new TextEncoder();
+var PKCS8_ED25519 = Uint8Array.from([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
+var ASSERTION_TYPE2 = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+async function seedOf(secret) {
+  const ikm = await crypto.subtle.importKey("raw", enc2.encode(secret), "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc2.encode("cauthy/sign/v1") },
+    ikm,
+    256
+  ));
+}
+async function thumbprint(x) {
+  return b64uEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", enc2.encode(`{"crv":"Ed25519","kty":"OKP","x":"${x}"}`))));
+}
+async function signerOf(secret) {
+  const seed = await seedOf(secret);
+  const der = new Uint8Array(PKCS8_ED25519.length + 32);
+  der.set(PKCS8_ED25519);
+  der.set(seed, PKCS8_ED25519.length);
+  const readable = await crypto.subtle.importKey("pkcs8", der, { name: "Ed25519" }, true, ["sign"]);
+  const { x } = await crypto.subtle.exportKey("jwk", readable);
+  const signing = await crypto.subtle.importKey("pkcs8", der, { name: "Ed25519" }, false, ["sign"]);
+  der.fill(0);
+  seed.fill(0);
+  const publicJwk = { kty: "OKP", crv: "Ed25519", x };
+  const kid = await thumbprint(publicJwk.x);
+  const header = b64uEncode(enc2.encode(JSON.stringify({ alg: "EdDSA", kid })));
+  return {
+    kid,
+    publicJwk,
+    async assertion(clientId, tokenEndpoint, jti = crypto.randomUUID(), iat = Math.floor(Date.now() / 1e3)) {
+      const claims = { iss: clientId, sub: clientId, aud: tokenEndpoint, jti, iat, exp: iat + 120 };
+      const input = `${header}.${b64uEncode(enc2.encode(JSON.stringify(claims)))}`;
+      const sig = new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, signing, enc2.encode(input)));
+      return `${input}.${b64uEncode(sig)}`;
+    }
+  };
+}
+function deriveFromKey(key, previous) {
+  const other = previous && previous.secret !== key.secret ? previous : void 0;
+  const rings = deriveKeys(key.secret, other?.secret);
+  return {
+    cookie: rings.cookie,
+    flow: rings.flow,
+    signer: signerOf(key.secret),
+    ...other ? { previousJwk: signerOf(other.secret).then((s) => ({ ...s.publicJwk, kid: s.kid })) } : {}
+  };
+}
+
+// src/identity.ts
+var REVALIDATE_MS = 3e5;
+var sleep = (ms) => new Promise((resolve2) => {
+  const t = setTimeout(resolve2, ms);
+  t.unref?.();
+});
+function createIdentity(o) {
+  const doFetch = o.fetch ?? globalThis.fetch;
+  const now = o.now ?? Date.now;
+  const retry = o.retryMs ?? [1e3, 2e3, 5e3, 1e4, 3e4];
+  let held;
+  let etag;
+  let checkedAt = 0;
+  let first;
+  let refused;
+  let refreshing;
+  let failed = false;
+  let attemptEnded;
+  let attemptOut;
+  const kid = () => (typeof o.kid === "function" ? o.kid() : o.kid) ?? "?";
+  async function ask() {
+    const headers = { authorization: `Bearer ${await o.token()}`, accept: "application/json" };
+    if (etag && held) headers["if-none-match"] = etag;
+    const res = await doFetch(`${o.issuer}/v1/connect/self`, { headers });
+    if (res.status === 304 && held) return "same";
+    if (res.status === 410) throw Object.assign(new Error("client_inactive"), { code: "client_inactive" });
+    if (!res.ok) throw new CauthyApiError(503, "unavailable", `Cauthy answered ${res.status} to /v1/connect/self`);
+    const body = await res.json();
+    if (!body?.data || typeof body.data.client_id !== "string") throw new CauthyApiError(503, "unavailable", "Cauthy's answer to /v1/connect/self has no identity");
+    etag = res.headers.get("etag") ?? void 0;
+    return body.data;
+  }
+  function refusalOf(e) {
+    const code = e?.code;
+    if (code !== "invalid_client" && code !== "client_inactive") return void 0;
+    const message = code === "client_inactive" ? `Cauthy says this application's client is no longer active (kid ${kid()}). Connect it again in Cauthy's dashboard.` : `Cauthy refuses this application's key (kid ${kid()}): it was revoked or never registered. Make a new key in Cauthy's dashboard.`;
+    return new CauthyApiError(503, "misconfigured", message);
+  }
+  function refuse(err) {
+    if (refused === void 0) o.log?.(err.message.replace(/^@cauthyhq\/node: /, ""));
+    refused = err;
+    checkedAt = now();
+    return err;
+  }
+  async function firstAnswer() {
+    for (let attempt = 0; ; attempt++) {
+      attemptOut = new Promise((resolve2) => {
+        attemptEnded = resolve2;
+      });
+      try {
+        const got = await ask();
+        if (got !== "same") held = got;
+        checkedAt = now();
+        failed = false;
+        attemptEnded?.(true);
+        return held;
+      } catch (e) {
+        const r = refusalOf(e);
+        failed = true;
+        attemptEnded?.(false);
+        if (r) throw refuse(r);
+        await sleep(retry[Math.min(attempt, retry.length - 1)]);
+      }
+    }
+  }
+  async function refresh() {
+    checkedAt = now();
+    try {
+      const got = await ask();
+      if (got !== "same") held = got;
+      refused = void 0;
+    } catch (e) {
+      const r = refusalOf(e);
+      if (r) refuse(r);
+    }
+  }
+  return {
+    ready() {
+      if ((held || refused) && now() - checkedAt >= REVALIDATE_MS) {
+        refreshing ??= refresh().finally(() => {
+          refreshing = void 0;
+        });
+      }
+      if (refused) return Promise.reject(refused);
+      if (held) return Promise.resolve(held);
+      first ??= firstAnswer();
+      return first;
+    },
+    current: () => held,
+    refresh: () => refreshing ??= refresh().finally(() => {
+      refreshing = void 0;
+    }),
+    failing: () => held === void 0 && failed && refused === void 0,
+    attempt: () => held !== void 0 ? Promise.resolve(true) : attemptOut ?? Promise.resolve(false)
+  };
+}
+
 // src/verify.ts
 var CauthyUnavailableError = class extends Error {
   constructor(detail) {
@@ -1680,6 +2070,10 @@ function decodeJson(segment) {
   return parseStrict(Buffer.from(padded, "base64").toString("utf8"));
 }
 function createTokenVerifier(options = {}) {
+  const fromEnv = ["CAUTHY_ISSUER", "CAUTHY_AUDIENCE", "CAUTHY_TENANT_ID"].filter((name, i) => [options.issuer, options.audience, options.tenantId][i] === void 0 && (env2(name) ?? "") !== "");
+  if (fromEnv.length > 0) {
+    deprecated("Reading CAUTHY_ISSUER, CAUTHY_AUDIENCE and CAUTHY_TENANT_ID to verify tokens", "Set CAUTHY_KEY and use createVerifierFromEnv().");
+  }
   const issuerGiven = options.issuer ?? env2("CAUTHY_ISSUER") ?? "";
   if (issuerGiven === "") throw new CauthyConfigError("issuer (CAUTHY_ISSUER) is not set");
   const issuer = issuerAddress(issuerGiven, "issuer");
@@ -1775,18 +2169,18 @@ function createTokenVerifier(options = {}) {
 async function verifyToken(from, options = {}) {
   return createTokenVerifier(options)(from);
 }
-
-// src/deprecate.ts
-var told = /* @__PURE__ */ new Set();
-function deprecated(what, instead) {
-  if (told.has(what)) return;
-  told.add(what);
-  const message = `@cauthyhq/node: ${what} is deprecated and leaves in 2.0. ${instead}`;
-  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
-    process.emitWarning(message, { type: "DeprecationWarning", code: "CAUTHY_DEPRECATED" });
-  } else {
-    console.warn(message);
+async function createVerifierFromEnv(options = {}) {
+  const text2 = options.key ?? env2("CAUTHY_KEY");
+  if (text2 === void 0 || text2 === "") return createTokenVerifier(options);
+  refuseBesideKey(typeof process !== "undefined" ? process.env : void 0);
+  for (const name of ["issuer", "audience", "tenantId"]) {
+    if (options[name] !== void 0) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`);
   }
+  const key = parseKey(text2);
+  const system = createSystem({ issuer: key.issuer, clientId: key.clientId, signer: { clientId: key.clientId, signer: deriveFromKey(key).signer }, fetch: options.fetch });
+  const id = await createIdentity({ issuer: key.issuer, token: () => system.token(), fetch: deadline(options.fetch, KEYS_TIMEOUT_MS) }).ready();
+  const { key: _, ...rest } = options;
+  return createTokenVerifier({ ...rest, issuer: id.issuer, audience: id.audience, tenantId: id.tenant.id });
 }
 
 // src/mount.ts
@@ -1879,6 +2273,64 @@ function redirect(location, cookies = []) {
 function conditionalOf(c) {
   return { resource: String(c?.resource ?? ""), action: String(c?.action ?? ""), effect: c?.effect === "deny" ? "deny" : "allow" };
 }
+function byKey(given) {
+  const text2 = given.key ?? env3("CAUTHY_KEY");
+  if (text2 === void 0 || text2 === "") return void 0;
+  refuseBesideKey(typeof process !== "undefined" ? process.env : void 0);
+  for (const [name, value] of [
+    ["issuer", given.issuer],
+    ["clientId", given.clientId],
+    ["clientSecret", given.clientSecret],
+    ["secret", given.secret],
+    ["system", given.system],
+    ["tenant", given.tenant],
+    ["audience", given.audience],
+    ["tenantId", given.tenantId],
+    ["systemKey", given.systemKey],
+    ["rootKey", given.rootKey]
+  ]) {
+    if (value !== void 0) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`);
+  }
+  const key = parseKey(text2);
+  const prevText = given.keyPrevious ?? env3("CAUTHY_KEY_PREVIOUS");
+  let previous;
+  if (prevText) {
+    try {
+      previous = parseKey(prevText);
+    } catch (e) {
+      if (e instanceof CauthyKeyError) throw new CauthyKeyError(e.reason, `CAUTHY_KEY_PREVIOUS is refused: ${e.message.replace(/^@cauthyhq\/node: CAUTHY_KEY: /, "").replace(/ \(key_[a-z_]+\)$/, "")}`);
+      throw e;
+    }
+  }
+  if (previous && (previous.issuer !== key.issuer || previous.clientId !== key.clientId)) {
+    throw new CauthyKeyError("key_previous_mismatch", "CAUTHY_KEY_PREVIOUS names another Cauthy or client than CAUTHY_KEY");
+  }
+  const legacySecret = env3("CAUTHY_SECRET") || void 0;
+  const legacyRoot = env3("PACT_ROOT_KEY") || void 0;
+  const legacyRootPrevious = legacyRoot ? env3("PACT_ROOT_KEY_PREVIOUS") || void 0 : void 0;
+  if (legacySecret) deprecated("CAUTHY_SECRET beside CAUTHY_KEY", "It is read only for sessions made before the move: remove it after the rotation window.");
+  if (legacyRoot) deprecated("PACT_ROOT_KEY beside CAUTHY_KEY", "It is read only for sessions made before the move: remove it, the keys option and its table after the rotation window.");
+  if (given.keys && !(legacyRoot && given.contract)) {
+    throw new CauthyConfigError("with CAUTHY_KEY the application keeps no key store: remove keys (it is read only beside PACT_ROOT_KEY and a contract, while moving)");
+  }
+  return { key, previous, legacySecret, legacyRoot, legacyRootPrevious };
+}
+var UnknownOriginError = class extends Error {
+  constructor(origin, registered) {
+    super(`${origin} is not one of the application's addresses in Cauthy (${registered.join(", ") || "none"}): add it on the application's card, or set baseURL`);
+    this.origin = origin;
+    this.registered = registered;
+  }
+  origin;
+  registered;
+};
+function contractOnKey(given, keyed) {
+  const contract = readContract(given.contract);
+  if (contract.issuer !== keyed.key.issuer) {
+    throw new CauthyKeyError("key_contract_issuer", `the key names ${keyed.key.issuer}, and the contract's Cauthy is ${contract.issuer}: make the key in that Cauthy's dashboard`);
+  }
+  return contract;
+}
 function byContract(given) {
   failClosed(typeof process !== "undefined" ? process.env : void 0);
   for (const [name, value] of [
@@ -1897,27 +2349,54 @@ function byContract(given) {
   if (contract.serviceClientId && !given.keys) {
     throw new CauthyConfigError(`the link ${contract.link} gives ${contract.system} its own identity: pass keys, where its key is kept (@cauthyhq/node/keys)`);
   }
+  deprecated("PACT_ROOT_KEY", "Make the application's CAUTHY_KEY in Cauthy's dashboard (the application's card), then remove PACT_ROOT_KEY, the keys option and its table.");
   return { contract, root, previous: given.rootKeyPrevious ?? env3("PACT_ROOT_KEY_PREVIOUS") };
 }
 var toldOfHeader = false;
+var toldOfUnopened = false;
+function toldUnopened() {
+  if (toldOfUnopened) return;
+  toldOfUnopened = true;
+  console.warn("@cauthyhq/node: a session cookie arrived that no key of this application opens; it was cleared and the person is signed out. Moving to CAUTHY_KEY, keep the secret that sealed the old sessions (CAUTHY_SECRET, or PACT_ROOT_KEY and PACT_ROOT_KEY_PREVIOUS) beside it for the rotation window; rotating the key, set CAUTHY_KEY_PREVIOUS.");
+}
 function createCauthy(given = {}) {
-  const pacted = given.contract ? byContract(given) : void 0;
-  const contract = pacted?.contract;
-  const issuer = withoutTrailingSlashes(given.issuer ?? contract?.issuer ?? env3("CAUTHY_ISSUER") ?? "");
-  const clientId = contract?.clientId ?? given.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
-  const clientSecret = contract ? void 0 : given.clientSecret ?? env3("CAUTHY_CLIENT_SECRET");
-  const secret = contract ? "" : given.secret ?? env3("CAUTHY_SECRET") ?? "";
-  const system = contract?.system ?? given.system ?? env3("CAUTHY_SYSTEM") ?? "";
-  const tenant = contract?.tenant ?? given.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const keyed = byKey(given);
+  const pacted = given.contract && !keyed ? byContract(given) : void 0;
+  const contract = keyed && given.contract ? contractOnKey(given, keyed) : pacted?.contract;
+  const issuer = withoutTrailingSlashes(keyed?.key.issuer ?? given.issuer ?? contract?.issuer ?? env3("CAUTHY_ISSUER") ?? "");
+  const clientId = contract?.clientId ?? keyed?.key.clientId ?? given.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = contract || keyed ? void 0 : given.clientSecret ?? env3("CAUTHY_CLIENT_SECRET");
+  const secret = contract || keyed ? "" : given.secret ?? env3("CAUTHY_SECRET") ?? "";
+  const askSelf = keyed !== void 0 && contract === void 0;
+  const system = askSelf ? "" : contract?.system ?? given.system ?? env3("CAUTHY_SYSTEM") ?? "";
+  const tenant = askSelf ? "" : contract?.tenant ?? given.tenant ?? env3("CAUTHY_TENANT") ?? "";
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
-  if (!contract && secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  if (!contract && !keyed && secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const fromKey = keyed ? deriveFromKey(keyed.key, keyed.previous) : void 0;
+  let signingKid;
+  fromKey?.signer.then((s) => {
+    signingKid = s.kid;
+  }, () => void 0);
   const derived = pacted ? deriveKeys(pacted.root, pacted.previous) : void 0;
-  const single = derived ? void 0 : keyOf(secret).then((k) => [k]);
-  const cookieKeys = derived?.cookie ?? single;
-  const flowKeys = derived?.flow ?? single;
-  const ownKeys = derived && given.keys ? pactKeys(given.keys, derived.seal) : void 0;
-  const baseURL = given.baseURL ?? env3("CAUTHY_BASE_URL");
+  const single = derived || fromKey ? void 0 : keyOf(secret).then((k) => [k]);
+  const legacyRings = keyed?.legacyRoot ? deriveKeys(keyed.legacyRoot, keyed.legacyRootPrevious) : void 0;
+  const legacySingle = keyed?.legacySecret ? keyOf(keyed.legacySecret) : void 0;
+  const withLegacy = async (own, purpose) => [
+    ...await own,
+    ...legacyRings ? await legacyRings[purpose] : [],
+    ...legacySingle ? [await legacySingle] : []
+  ];
+  const cookieKeys = fromKey ? withLegacy(fromKey.cookie, "cookie") : derived?.cookie ?? single;
+  const flowKeys = fromKey ? withLegacy(fromKey.flow, "flow") : derived?.flow ?? single;
+  if (!keyed && !pacted) {
+    deprecated(
+      "Configuring with CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET, CAUTHY_SECRET and the other CAUTHY_* variables (or their options)",
+      "Connect the application in Cauthy's dashboard and use the one variable CAUTHY_KEY."
+    );
+  }
+  const ownKeys = derived && given.keys ? pactKeys(given.keys, derived.seal) : legacyRings && contract && given.keys ? pactKeys(given.keys, legacyRings.seal) : void 0;
+  const baseURL = given.baseURL ?? (keyed ? void 0 : env3("CAUTHY_BASE_URL"));
   if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
     throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
   }
@@ -1953,18 +2432,65 @@ function createCauthy(given = {}) {
     acceptInviteUrl,
     fetch: given.fetch,
     timeoutMs: systemTimeout,
-    ...ownKeys ? { keys: ownKeys, keysClientId: contract?.serviceClientId } : {}
+    ...ownKeys ? { keys: ownKeys, keysClientId: contract?.serviceClientId } : {},
+    // With a contract the key proves the link's service client; without, the key's own client.
+    ...fromKey ? {
+      signer: { clientId: contract ? contract.serviceClientId ?? keyed.key.clientId : clientId, signer: fromKey.signer },
+      currentSystem: () => identity?.current()?.system ?? ""
+    } : {}
   });
-  const originOf = (request) => {
-    if (baseURL) return withoutTrailingSlashes(baseURL);
+  const selfOptions = () => ({
+    issuer,
+    token: () => ownSystem.token(),
+    fetch: deadline(given.fetch, requestTimeout),
+    kid: () => signingKid,
+    log: (m) => console.error(`@cauthyhq/node: ${m}`)
+  });
+  const identity = askSelf ? createIdentity({
+    issuer,
+    token: () => ownSystem.token(),
+    fetch: deadline(given.fetch, requestTimeout),
+    kid: () => signingKid,
+    log: (m) => console.error(`@cauthyhq/node: ${m}`)
+  }) : void 0;
+  identity?.ready().catch(() => {
+  });
+  const tenantNow = () => identity?.current()?.tenant.slug ?? tenant;
+  const systemNow = () => identity?.current()?.system ?? system;
+  const requestOrigin = (request) => {
     const url = new URL(request.url);
     const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
     return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
   };
-  const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
+  const originOf = (request) => {
+    if (baseURL) return withoutTrailingSlashes(baseURL);
+    const asked = requestOrigin(request);
+    if (!identity) return asked;
+    const urls2 = identity.current()?.app_urls ?? [];
+    if (urls2.includes(asked)) return asked;
+    if (urls2.length === 1) return urls2[0];
+    throw new UnknownOriginError(asked, urls2);
+  };
+  const safeOrigin = (request) => {
+    try {
+      return originOf(request);
+    } catch {
+      return requestOrigin(request);
+    }
+  };
+  const attrs = (request, maxAge) => ({ secure: safeOrigin(request).startsWith("https://"), maxAge });
+  async function clientAuth(form) {
+    if (fromKey && !contract) {
+      const s = await fromKey.signer;
+      form.set("client_assertion_type", ASSERTION_TYPE2);
+      form.set("client_assertion", await s.assertion(clientId, `${issuer}/v1/oauth/token`));
+    } else if (clientSecret) {
+      form.set("client_secret", clientSecret);
+    }
+    return form;
+  }
   async function token(form, proof = {}) {
-    const body2 = new URLSearchParams({ client_id: clientId, ...form });
-    if (clientSecret) body2.set("client_secret", clientSecret);
+    const body2 = await clientAuth(new URLSearchParams({ client_id: clientId, ...form }));
     try {
       const res = await doFetch(`${issuer}/v1/oauth/token`, {
         method: "POST",
@@ -2003,8 +2529,7 @@ function createCauthy(given = {}) {
   }
   const kindOf = (body2, was) => (typeof body2?.persistent === "boolean" ? body2.persistent : was?.p === 1) ? { p: 1 } : {};
   async function revoke(refreshToken) {
-    const form = new URLSearchParams({ client_id: clientId, token: refreshToken });
-    if (clientSecret) form.set("client_secret", clientSecret);
+    const form = await clientAuth(new URLSearchParams({ client_id: clientId, token: refreshToken }));
     await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
   }
   const unverified = (u) => contract?.requireVerifiedEmail === true && !u.emailVerified;
@@ -2025,10 +2550,11 @@ function createCauthy(given = {}) {
   async function read(request) {
     const had = readCookies(request.headers.get("cookie"));
     const raw = readParts(had, cookieName);
-    if (raw === null) return { had, value: null, present: false };
-    const value = await unsealAny(raw, await cookieKeys);
+    if (raw === null) return { had, value: null, present: false, stale: false };
+    const opened = await unsealIndexed(raw, await cookieKeys);
+    const value = opened?.value ?? null;
     const sound = value !== null && typeof value.at === "string" && typeof value.rt === "string" && typeof value.exp === "number";
-    return { had, value: sound ? value : null, present: true };
+    return { had, value: sound ? value : null, present: true, stale: sound && opened.index > 0 };
   }
   async function write(request, s, had) {
     return writeParts(cookieName, await seal(s, (await cookieKeys)[0]), attrs(request, s.p === 1 ? PERSISTENT_SECONDS : void 0), had);
@@ -2065,12 +2591,13 @@ function createCauthy(given = {}) {
     return running;
   }
   async function resolve2(request) {
-    const { had, value, present } = await read(request);
+    const { had, value, present, stale } = await read(request);
     if (value === null) {
+      if (present) toldUnopened();
       return { session: null, status: "unauthenticated", cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] };
     }
     if (unverified(value.u)) return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
-    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: [] };
+    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: stale ? await write(request, value, had) : [] };
     const renewed = await renew(value);
     if (renewed === "ended") {
       return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
@@ -2096,7 +2623,8 @@ function createCauthy(given = {}) {
   async function organizations(session) {
     const hit = orgCache.get(session.accessToken);
     if (hit && Date.now() - hit.at < ORGANIZATIONS_TTL_MS) return hit.value;
-    const url = `${issuer}/v1/oauth/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`;
+    const sys = systemNow();
+    const url = `${issuer}/v1/oauth/organizations${sys ? `?system=${encodeURIComponent(sys)}` : ""}`;
     const res = await doFetch(url, { headers: { authorization: `Bearer ${session.accessToken}` } });
     if (!res.ok) throw new Error(`@cauthyhq/node: reading organizations: ${res.status}`);
     const body2 = await res.json();
@@ -2250,8 +2778,7 @@ function createCauthy(given = {}) {
   async function logout(request) {
     const { had, value } = await read(request);
     if (value !== null) {
-      const body2 = new URLSearchParams({ client_id: clientId, token: value.rt });
-      if (clientSecret) body2.set("client_secret", clientSecret);
+      const body2 = await clientAuth(new URLSearchParams({ client_id: clientId, token: value.rt }));
       await doFetch(`${issuer}/v1/oauth/revoke`, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -2375,7 +2902,7 @@ function createCauthy(given = {}) {
       const res = await doFetch(`${issuer}${path}`, {
         method,
         headers: {
-          "x-tenant-key": tenant,
+          "x-tenant-key": tenantNow(),
           accept: "application/json",
           // A link Cauthy mails opens the application's page for it when it
           // has one; otherwise Cauthy's own. Either way in the reader's language.
@@ -2521,7 +3048,7 @@ function createCauthy(given = {}) {
     }
     if (route === "/sign-in/anonymous" || route === "/me/upgrade") deprecated(`POST ${route}`, "Guest sessions leave the auth-bff protocol in version 2.");
     if (route.startsWith("/me/upgrade/social/")) deprecated("GET /me/upgrade/social/{provider}", "Guest sessions leave the auth-bff protocol in version 2.");
-    if (tenant === "") {
+    if (tenantNow() === "") {
       return problem(500, "not_configured", "@cauthyhq/node: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
     }
     if (route === "/look" && !post) {
@@ -2756,7 +3283,7 @@ function createCauthy(given = {}) {
       let upstream;
       try {
         upstream = await doFetch(`${issuer}/v1/auth/mfa/push/events`, {
-          headers: { "x-tenant-key": tenant, "x-mfa-token": step.token, accept: "text/event-stream" },
+          headers: { "x-tenant-key": tenantNow(), "x-mfa-token": step.token, accept: "text/event-stream" },
           signal: request.signal
         });
       } catch {
@@ -2776,8 +3303,7 @@ function createCauthy(given = {}) {
     if (route === "/sign-out") {
       const { had, value } = await read(request);
       if (value !== null) {
-        const form = new URLSearchParams({ client_id: clientId, token: value.rt });
-        if (clientSecret) form.set("client_secret", clientSecret);
+        const form = await clientAuth(new URLSearchParams({ client_id: clientId, token: value.rt }));
         await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
         orgCache.delete(value.at);
       }
@@ -3176,14 +3702,38 @@ function createCauthy(given = {}) {
     const inside = url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);
     const route = inside ? withoutTrailingSlashes(url.pathname.slice(basePath.length)) || "/" : null;
     const published3 = pact !== void 0 && url.pathname === contract?.jwksPath && (request.method === "GET" || request.method === "HEAD");
+    if (identity && route !== null) {
+      const unready = await identityGate();
+      if (unready) return finish(unready, route);
+    }
     try {
       return finish(await serve(request), route, published3);
     } catch (err) {
+      if (err instanceof UnknownOriginError) return finish(problem(400, "unknown_origin", err.message), route);
       if (!(err instanceof CauthyApiError && err.code === "email_not_confirmed")) throw err;
       const wantsPage = request.method === "GET" && (request.headers.get("sec-fetch-mode") ?? "navigate") === "navigate";
       return finish(wantsPage ? new Response("Sign-in refused (email_not_confirmed). Confirm your email address first.", { status: 403, headers: { "content-type": "text/plain; charset=utf-8" } }) : problem(403, "email_not_confirmed", "Confirm your email address first."), route);
     }
   }
+  async function identityGate() {
+    if (!identity) return null;
+    const unavailable = () => problem(503, "unavailable", "Cauthy cannot be reached yet. Try again in a moment.");
+    if (identity.failing()) return unavailable();
+    let timer;
+    const waited = new Promise((resolve3) => {
+      timer = setTimeout(() => resolve3("timeout"), requestTimeout);
+    });
+    try {
+      const ready = identity.ready();
+      const got = await Promise.race([ready.then(() => "ok"), identity.attempt().then((ok) => ok ? "ok" : "failed"), waited]);
+      if (got === "failed") await Promise.race([ready, Promise.resolve()]);
+      return got === "ok" ? null : unavailable();
+    } catch (e) {
+      return e.code === "misconfigured" ? problem(503, "misconfigured", "Cauthy refuses this application's key: make a new one in Cauthy's dashboard.") : unavailable();
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   async function serve(request) {
     const url = new URL(request.url);
     if (pact && url.pathname === contract?.jwksPath && (request.method === "GET" || request.method === "HEAD")) return pact.jwks();
@@ -3266,7 +3816,28 @@ function createCauthy(given = {}) {
     return { response: redirect(to) };
   }
   const replay = given.webhookReplay ?? memoryReplayStore();
+  let lateSelf;
   const tokenVerifier = (o = {}) => {
+    if (keyed) {
+      if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
+        throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
+      }
+      let built;
+      return async (from) => {
+        const id = await (identity ?? (lateSelf ??= createIdentity(selfOptions()))).ready();
+        if (built?.from !== id) {
+          built = { from: id, verify: createTokenVerifier({
+            issuer,
+            tenantId: contract?.tenantId ?? id.tenant.id,
+            audience: id.audience,
+            fetch: given.fetch,
+            ...contract ? { clientId: contract.clientId } : {},
+            ...o
+          }) };
+        }
+        return built.verify(from);
+      };
+    }
     if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
       throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
     }
@@ -3280,7 +3851,30 @@ function createCauthy(given = {}) {
     });
   };
   const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay });
-  const pact = contract && ownKeys ? {
+  async function keyJwks() {
+    const s = await fromKey.signer;
+    const keys2 = [{ ...s.publicJwk, kid: s.kid, alg: "EdDSA", use: "sig" }];
+    if (fromKey.previousJwk) keys2.push({ ...await fromKey.previousJwk, alg: "EdDSA", use: "sig" });
+    if (ownKeys) keys2.push(...(await ownKeys.published()).keys);
+    return new Response(JSON.stringify({ keys: keys2 }), {
+      headers: { "content-type": "application/json; charset=utf-8", "cache-control": `public, max-age=${JWKS_MAX_AGE_S}` }
+    });
+  }
+  const noStore = () => {
+    throw new CauthyConfigError("on CAUTHY_KEY the application keeps no key of its own: make a new key on the application's card in Cauthy's dashboard");
+  };
+  const keyOnly = {
+    current: async () => noStore(),
+    published: async () => ({ keys: [] }),
+    rotate: async () => noStore(),
+    reseal: async () => 0
+  };
+  const pact = contract && fromKey ? {
+    contract,
+    keys: ownKeys ?? keyOnly,
+    jwks: keyJwks,
+    status: () => ownSystem.request("GET", `/v1/pact/status?system=${encodeURIComponent(contract.system)}`)
+  } : contract && ownKeys ? {
     contract,
     keys: ownKeys,
     async jwks() {
@@ -3290,8 +3884,25 @@ function createCauthy(given = {}) {
     },
     status: () => ownSystem.request("GET", `/v1/pact/status?system=${encodeURIComponent(contract.system)}`)
   } : void 0;
+  const configured = () => ({
+    issuer,
+    audience: given.audience ?? env3("CAUTHY_AUDIENCE") ?? "",
+    tenant: { id: contract?.tenantId ?? given.tenantId ?? env3("CAUTHY_TENANT_ID") ?? "", slug: tenant },
+    system,
+    client_id: clientId,
+    sign_in_client_id: clientId,
+    app_urls: baseURL ? [withoutTrailingSlashes(baseURL)] : [],
+    callback_path: `${basePath}/callback`,
+    key: null,
+    contract: contract ? { link: contract.link, system_proof: contract.systemProof, require_verified_email: contract.requireVerifiedEmail } : null
+  });
   return {
     handler,
+    ready: async () => {
+      if (identity) return identity.ready();
+      const id = configured();
+      return fromKey ? { ...id, key: { kid: (await fromKey.signer).kid, retires_at: null } } : id;
+    },
     checkMount: (target) => checkMount(basePath, target),
     webhook,
     tokenVerifier,
@@ -3381,10 +3992,12 @@ async function connectSystem(o) {
 export {
   CauthyApiError,
   CauthyConfigError,
+  CauthyKeyError,
   CauthyTokenError,
   CauthyUnavailableError,
   CauthyWebhookError,
   DEFAULT_PASSWORD_POLICY,
+  KEY_REPLACES,
   MIN_PASSWORD,
   PROTOCOL_VERSION,
   STANDARD_VARIABLES,
@@ -3394,15 +4007,18 @@ export {
   checkName,
   checkNewPassword,
   checkPassword,
+  composeKey,
   connectSystem,
   createCauthy,
   createSystem,
   createTokenVerifier,
+  createVerifierFromEnv,
   definePolicy,
   describePasswordPolicy,
   explainPasswordProblems,
   failClosed,
   memoryReplayStore,
+  parseKey,
   passwordPolicyOf,
   passwordProblems,
   policySource,