@cauthyhq/node 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 1.3.0
+
+Contracts are retired, and contract mode is removed (not deprecated): an application once connected by contract runs on its `CAUTHY_KEY` alone, and its people stay signed in. Protect sign-in with the **Protect sign-in** switches on the application's card in Cauthy's dashboard.
+
+### Changed
+
+- **On `CAUTHY_KEY`, people sign in through the client Cauthy names** (`sign_in_client_id` of `GET /v1/connect/self`, read at startup and every 5 minutes). An application once connected by contract has its key on the link's service client (`pact.<link>.service`) and its people, and their refresh tokens, on the link's sign-in client (`pact.<link>`): the authorize redirect, the code exchange, renewals, revocation, sign-out, the account page, the look and the hosted-page and invitation calls now go as that client. It is a public client: the key's assertion (`private_key_jwt`) proves the key's own client only, and the code exchange uses PKCE and carries the system's proof (`X-Cauthy-System-Token`). A renewal outside the handler waits for Cauthy's answer first, so a refresh token is never spent on the wrong client. When the two clients are the same, nothing changes.
+- **The same key keeps every session**: a cookie sealed by 1.2.1 by contract on `CAUTHY_KEY` is read and renewed by 1.3 on the same key, without the `contract` option. `CAUTHY_KEY_PREVIOUS` still names the key's client.
+- **`@cauthyhq/node/testing`**: `FakeCauthy.signInClients` (the key's client → the sign-in client `GET /v1/connect/self` names). The fake now binds a code to the client that asked for it and a refresh token to the client it was issued to, as Cauthy does.
+- **"Keep me signed in" is the workspace's setting** (`persistent_sessions` of `GET /v1/auth/settings`, set with `PUT /v1/settings/auth`): `/methods.persistentSessions` follows it. `FakeCauthy` keeps it as a workspace setting and, as Cauthy does, refuses `allow_persistent_sessions` on a client with `400 persistent_sessions_moved`. The conformance script no longer passes the runner's ignored `--client-id`.
+
+### Removed
+
+- **Contract mode**: the `contract` option, `auth.pact` (its JWKS route at the contract's `jwks_url` path, `keys` and `status()`), and the SDK-side `require_verified_email` check of a link (Cauthy enforces the client's switch at the token endpoint).
+- **The 1.1 way of contracts**: `PACT_ROOT_KEY`, `PACT_ROOT_KEY_PREVIOUS`, the `keys` store and the `rootKey` / `rootKeyPrevious` options, including the read-only readers of 1.2 beside `CAUTHY_KEY`. Sessions sealed with `PACT_ROOT_KEY` and not read during the 1.2 rotation window are no longer read. `CAUTHY_SECRET` beside `CAUTHY_KEY` is still read-only for the window.
+- **Exports**: `readContract`, `failClosed`, `STANDARD_VARIABLES` and the types `ContractOptions`, `ResolvedContract`, `PactItem`, `PactStatus`, `CauthyPact`, `KeyStore`, `PactKeys`, `StoredKey`; the whole `@cauthyhq/node/keys` entry (`memoryKeyStore`, `postgresKeyStore`, `fileKeyStore`, `pactKeysTableSql`, `Query`); `Identity.contract`, `FakeCauthy.contract` and the `CauthyKeyReason` `key_contract_issuer`.
+
+### Refused at startup
+
+A `CauthyConfigError` ("contracts are retired: run on CAUTHY_KEY alone, and remove …"), on `CAUTHY_KEY` and on the variables alike, naming everything to remove: the `contract`, `keys`, `rootKey` or `rootKeyPrevious` option, or `PACT_ROOT_KEY` or `PACT_ROOT_KEY_PREVIOUS` set in the environment. A deploy still configured for contracts never runs half-configured.
+
+## 1.2.1
+
+### Fixed
+
+- **Moving to `CAUTHY_KEY`**: a session sealed with `CAUTHY_SECRET`, `PACT_ROOT_KEY` or `CAUTHY_KEY_PREVIOUS` is sealed again with the key on the first request that reads it through the handler or an adapter (`GET <basePath>/session`, `req.cauthy()`, …), not only when its access token is renewed. A session read during the window now outlives the old secret's removal.
+- `PACT_ROOT_KEY_PREVIOUS` beside `CAUTHY_KEY` and `PACT_ROOT_KEY` is read too: sessions sealed before a root rotation that was still open at the move stay readable. 1.2.0 read the current root only.
+- A session cookie that no configured key opens is still cleared, and is now said once per process (`console.warn`), naming the secret to keep beside `CAUTHY_KEY` for the window.
+- Covered end to end with the published packages: sessions signed in by `cauthy-auth` 0.41.0 and 0.42.0 (contract, `PACT_ROOT_KEY`, `keys`) and by `@cauthyhq/node` 1.1.0 (`CAUTHY_SECRET`), read by 1.2 at `GET /api/id/session`, fresh and renewed.
+
 ## 1.2.0
 
 One variable for every application: `CAUTHY_KEY`.

package/README.md

@@ -1,6 +1,6 @@
 # @cauthyhq/node
 
-Cauthy for Node.js backends: sign-in, cookie sessions, organizations, Pact contract mode and token verification, served as the [auth-bff protocol](https://github.com/vennet-developers/cauthy-sdk-spec) version 1, level `strict`.
+Cauthy for Node.js backends: sign-in, cookie sessions, organizations and token verification, served as the [auth-bff protocol](https://github.com/vennet-developers/cauthy-sdk-spec) version 1, level `strict`.
 
 The browser never holds a token. Your server mounts one route, keeps the session in an encrypted HttpOnly cookie, and every security setting (sign-in methods, second factors, session length) is a switch in Cauthy's dashboard, not code.
 
@@ -110,9 +110,11 @@ new is written with it.
 
 **Moving from the variables of 1.1:** on the application's card, **Move to
 CAUTHY_KEY**. Deploy with `CAUTHY_KEY` and keep `CAUTHY_SECRET` for the window
-(old sessions stay readable; one warning says to remove it), remove the other
-variables, then **Remove the secret**. The variables of 1.1 and `PACT_ROOT_KEY`
-still work in 1.x with one `DeprecationWarning` per process and leave in 2.0.
+(old sessions stay readable, and each is sealed again with the key the first
+time it is read; one warning says to remove it), remove the other variables,
+then **Remove the secret**. A session nobody used during the window is lost
+with the secret. The variables of 1.1 still work in 1.x with one
+`DeprecationWarning` per process and leave in 2.0.
 
 ## Verifying a token
 
@@ -122,10 +124,9 @@ For an API that receives Cauthy access tokens from somewhere other than the brow
 import { auth } from './auth'
 
 // Where each value comes from:
-//   issuer   the instance's own (CAUTHY_KEY, or the contract; deprecated: CAUTHY_ISSUER)
-//   tenantId by contract, the link's tenant_id; on CAUTHY_KEY, Cauthy's answer; otherwise `tenantId` or CAUTHY_TENANT_ID (deprecated)
+//   issuer   the instance's own (CAUTHY_KEY; deprecated: CAUTHY_ISSUER)
+//   tenantId on CAUTHY_KEY, Cauthy's answer; otherwise `tenantId` or CAUTHY_TENANT_ID (deprecated)
 //   audience on CAUTHY_KEY, Cauthy's answer; otherwise `audience` or CAUTHY_AUDIENCE (deprecated): your Cauthy's JWT_AUDIENCE
-//   clientId by contract, the link's sign-in client: a person's token issued through another is refused (wrong_client)
 const verify = auth.tokenVerifier()          // throws CauthyConfigError now if one is missing
 const who = await verify(request)            // or: await auth.verifyToken(request)
 ```
@@ -149,7 +150,7 @@ const verify = createTokenVerifier({ issuer: 'https://id.example.com', audience:
 - **The audience and the workspace are required.** Without them a token issued for another application or workspace would be accepted.
 - A system's own token (`sys` claim, whatever its value) and a guest's token (`anon: true`) are refused where a person is expected. Pass `allowSystem` or `allowAnonymous` for an endpoint that takes them.
 - A client's own token (a `client_credentials` grant: `token_use: "client"`, whatever the value) is refused with `client_token` where a person is expected. A backend that serves machines too passes `allowClientTokens: true`; the identity then carries `clientId`, the client's public id (its `userId` is the client's internal id).
-- `authorizedParty` is the token's `azp`: the client a person's token was issued through, absent when none was named. With `clientId` (by contract, always the link's sign-in client), a token whose `azp` names another client is refused with `wrong_client`; a token with no `azp` passes.
+- `authorizedParty` is the token's `azp`: the client a person's token was issued through, absent when none was named. With `clientId`, a token whose `azp` names another client is refused with `wrong_client`; a token with no `azp` passes.
 - Clock tolerance is 30 seconds (`leeway`, 0 to 60). A token over 8192 bytes, with a repeated JSON name, a fractional date or a wrongly typed claim is refused.
 - Keys are fetched from `<issuer>/.well-known/jwks.json` with no redirect, within 5 seconds, at most 64 KiB, and kept for the answer's `max-age`.
 
@@ -160,7 +161,8 @@ const verify = createTokenVerifier({ issuer: 'https://id.example.com', audience:
 | cauthy-auth 0.42 | @cauthyhq/node 1.0 |
 | --- | --- |
 | `cauthy-auth` | `@cauthyhq/node` |
-| `cauthy-auth/express`, `/fastify`, `/hono`, `/next`, `/mcp`, `/keys`, `/theme` | `@cauthyhq/node/express`, … (same names) |
+| `cauthy-auth/express`, `/fastify`, `/hono`, `/next`, `/mcp`, `/theme` | `@cauthyhq/node/express`, … (same names) |
+| Contract mode (`contract`, `PACT_ROOT_KEY`, `cauthy-auth/keys`) | Removed in 1.3: run on `CAUTHY_KEY` (see [Contracts are retired](#contracts-are-retired)) |
 | `cauthy-auth/react`, `/styles.css` | `@cauthyhq/react`, `@cauthyhq/react/styles.css` |
 | `cauthy-auth/client` | `@cauthyhq/js` |
 | `cauthy-auth/vue`, `/svelte` | No 1.0 wrapper yet: keep `cauthy-auth` 0.43 in the browser (security fixes until 2027-02-06) |
@@ -176,28 +178,14 @@ Everything that behaves differently from 0.42:
 6. **http issuers are refused** except for `localhost`, `127.0.0.1`, `*.localhost` and `*.test`.
 7. **Calls to Cauthy have a deadline**: 2 seconds for `auth.system` and the sign-in proof, 5 seconds for the sign-in screens' calls and for the code, refresh and userinfo calls (`timeouts`, below). 0.42 waited forever. `pushTheme`, `pushPolicy`, `pullPolicy`, `pushCatalog`, `pullCatalog` and `connectSystem` take `timeoutMs`.
 8. **The Fastify plugin checks its mount on `onReady`** and fails startup when another route answers under the base path. It is skipped when `NODE_ENV=test`; `checkMount: false` turns it off.
-9. **Contract mode stops at startup** on an unknown `system_proof`, and on a workspace named by id whose `tenant_id` says another (see below).
-10. **A person whose address Cauthy says is not confirmed** (`email_not_confirmed`, when the link or client requires it) gets no session: the hosted callback redirects to your sign-in page with `auth_error=email_not_confirmed`, and the refresh token Cauthy had just issued is revoked. A session made before the requirement is treated as signed out.
-11. **Error messages start with `@cauthyhq/node:`** instead of `cauthy-auth:`. Classes and codes are the same.
+9. **A person whose address is not confirmed** gets no session when the application's **Protect sign-in** switch requires a verified email: Cauthy refuses the code exchange (`email_not_confirmed`), and the hosted callback redirects to your sign-in page with `auth_error=email_not_confirmed`.
+10. **Error messages start with `@cauthyhq/node:`** instead of `cauthy-auth:`. Classes and codes are the same.
 
 `/sign-in/anonymous`, `/me/upgrade` and `connectSystem` are deprecated: one `DeprecationWarning` per process, removed in 2.0.
 
-## Contract mode
+## Contracts are retired
 
-A contract is a layer on top of an application that runs on `CAUTHY_KEY`: the environment stays that one line, and the vendored graph adds the link (system proof, drift, the link's policies). No key store and no table:
-
-```ts
-import { createCauthy } from '@cauthyhq/node'
-import graph from './contracts/graph.json'
-
-export const auth = createCauthy({ contract: { graph, system: 'acme-crm' } })   // and CAUTHY_KEY in the environment
-```
-
-The key proves the link's service client (`pact.<link>.service`); people sign in through its public client (`pact.<link>`). The key must name the graph's Cauthy (`key_contract_issuer` otherwise). The application publishes the key's public half at the contract's `jwks_url` path (`/.well-known/pact-jwks.json` by default), and the previous key's too during a rotation. The Express, Hono and Fastify adapters route that path to the handler as they do `/api/auth`, so those need no route of their own for it. **Next.js and TanStack Start still need a route file** for it that calls `auth.handler(request)`.
-
-The 1.1 way (`PACT_ROOT_KEY` and `keys: postgresKeyStore(query)`) keeps working through 1.x with a deprecation warning. Moving: generate `CAUTHY_KEY` on the application's card, deploy it with `PACT_ROOT_KEY` and the `keys` option still beside it for the window (old sessions stay readable, its RS256 keys stay published beside the new Ed25519 key), then remove `PACT_ROOT_KEY`, the option and the table.
-
-It refuses to start when any variable `CAUTHY_KEY` replaces is also set, when the link names its workspace by slug and the graph has no `tenant_id` for it yet, when a workspace named by id is pinned to a different `tenant_id`, when `system_proof` is not `off`, `auto` or `required`, or when the link asks for a system proof without a `service` block. When the link sets `require_verified_email`, a person whose address is not confirmed gets no session. See [`contract/pact.md`](https://github.com/vennet-developers/cauthy-sdk-spec/blob/main/contract/pact.md).
+Contract mode is removed in 1.3: run on `CAUTHY_KEY` alone, and protect sign-in with the **Protect sign-in** switches on the application's card in Cauthy's dashboard. The `contract`, `keys`, `rootKey` and `rootKeyPrevious` options, and `PACT_ROOT_KEY` or `PACT_ROOT_KEY_PREVIOUS` in the environment, refuse to start with a `CauthyConfigError` naming them.
 
 ## Options added in 1.0
 
@@ -207,7 +195,7 @@ It refuses to start when any variable `CAUTHY_KEY` replaces is also set, when th
 | `timeouts.system` | `2000` | Deadline in milliseconds of the application's own calls to Cauthy (`auth.system`, the sign-in proof) |
 | `timeouts.request` | `5000` | Deadline in milliseconds of the sign-in screens' calls and of the code, refresh and userinfo calls |
 | `audience` | `CAUTHY_AUDIENCE` | The audience `auth.verifyToken` accepts |
-| `tenantId` | `CAUTHY_TENANT_ID` | The workspace id `auth.verifyToken` accepts (by contract, the link's) |
+| `tenantId` | `CAUTHY_TENANT_ID` | The workspace id `auth.verifyToken` accepts |
 
 ## Testing your application
 

package/dist/{cauthy-CCSSj3Lg.d.mts → cauthy-CsWUgyv_.d.mts}

@@ -1,95 +1,5 @@
-import { K as KeyStore, P as PactKeys } from './keys-D5k0omTb.mjs';
 import { JWTVerifyGetKey, JWK } from 'jose';
 import { CauthyTheme } from './theme.mjs';
-import { I as Identity } from './identity-BTJ8NB_w.mjs';
-
-/** What createCauthy is given to run by contract. */
-interface ContractOptions {
-    /** The context graph, as `cauthy contracts pull` writes it (contracts/graph.json). */
-    graph: unknown;
-    /** This application's system in the graph: `"acme-crm"`. */
-    system: string;
-    /** The link to read, when the system has more than one with Cauthy. */
-    link?: string;
-    /** Cauthy's system in the graph. Default: `"cauthy"`. */
-    provider?: string;
-}
-/** What an application reads of its contract. */
-interface ResolvedContract {
-    system: string;
-    link: string;
-    /** Cauthy's public address. */
-    issuer: string;
-    /** The workspace's id, and its slug (what the application's own screens send). */
-    tenantId: string;
-    tenant: string;
-    /** The public client people sign in with: `pact.<link>`. */
-    clientId: string;
-    /** Where people may return after signing in. */
-    redirectUris: string[];
-    /** Whether Cauthy asks the system's proof on the code exchange now (`systemProof` is `required`). */
-    requireSystemProof: boolean;
-    /** How the link asks for the proof: never, from the first proved sign-in on (`auto`), or always. */
-    systemProof: 'off' | 'auto' | 'required';
-    /** Whether Cauthy issues no token through this link before the address is confirmed. */
-    requireVerifiedEmail: boolean;
-    /** Whether the link lets its people ask to stay signed in. */
-    persistentSessions: boolean;
-    /** The system's own client, when the link gives it one: `pact.<link>.service`. */
-    serviceClientId?: string;
-    /** Where the system publishes its keys, and the path of that address. */
-    jwksUrl?: string;
-    jwksPath?: string;
-    /** Where the system receives Cauthy's events, when it says. */
-    eventsUrl?: string;
-}
-/**
- * The variables of the standard mode. With a contract none may be set: two
- * sources of the same thing, one silently winning, is how a system ends up
- * signing people in through a client nobody meant.
- */
-declare const STANDARD_VARIABLES: readonly ["CAUTHY_ISSUER", "CAUTHY_CLIENT_ID", "CAUTHY_CLIENT_SECRET", "CAUTHY_SECRET", "CAUTHY_SYSTEM", "CAUTHY_TENANT", "CAUTHY_SYSTEM_KEY", "CAUTHY_SYSTEM_KEY_ID"];
-/** Refuses to run by contract with a variable of the standard mode set: names it. */
-declare function failClosed(environment: Record<string, string | undefined> | undefined): void;
-/** Reads what the graph says of the system's link with Cauthy. */
-declare function readContract(options: ContractOptions): ResolvedContract;
-/** One difference between a contract and what Cauthy holds. */
-interface PactItem {
-    kind: 'client' | 'redirect_uri' | 'grant_type' | 'role' | 'organization' | 'require_system_proof' | 'persistent_sessions' | 'jwks_url';
-    client_id?: string;
-    value: string;
-    detail?: string;
-}
-/** How the system stands against its contract, as Cauthy checks it (GET /v1/pact/status). Moments are UTC. */
-interface PactStatus {
-    system: string;
-    tenant_id: string;
-    checked_at: string;
-    /** When Cauthy's daily reconciliation last checked it; null before the first. */
-    reconciled_at: string | null;
-    in_step: boolean;
-    /** In Cauthy, and the contract does not name it. Nothing is ever deleted for it. */
-    outside: PactItem[];
-    /** Named by the contract, and Cauthy does not hold it as it says. */
-    missing: PactItem[];
-    contract: {
-        clients: {
-            client_id: string;
-            link: string;
-            purpose: 'sign_in' | 'service';
-            redirect_uris?: string[];
-            grant_types: string[];
-            require_system_proof?: boolean;
-            jwks_url?: string;
-        }[];
-        roles?: Record<string, string[]>;
-    };
-    held: {
-        clients: Record<string, unknown>[];
-        roles: string[];
-        organizations: Record<string, number>;
-    };
-}
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */
 interface CauthyEvent {
@@ -157,7 +67,7 @@ interface CauthyOptions {
      * `CAUTHY_KEY`. With it nothing else is read: the workspace, the system and
      * the application's addresses come from Cauthy (`GET /v1/connect/self`),
      * and passing `issuer`, `clientId`, `clientSecret`, `secret`, `system`,
-     * `tenant`, `audience`, `tenantId`, `systemKey` or `rootKey` is refused.
+     * `tenant`, `audience`, `tenantId` or `systemKey` is refused.
      */
     key?: string;
     /** The key being replaced, during a rotation: read, never written with. Default: `CAUTHY_KEY_PREVIOUS`. */
@@ -203,8 +113,8 @@ interface CauthyOptions {
      */
     audience?: string;
     /**
-     * The workspace's id (a lowercase UUID) for `auth.verifyToken`. By contract
-     * it comes from the link's `tenant_id`; otherwise: this, or `CAUTHY_TENANT_ID`.
+     * The workspace's id (a lowercase UUID) for `auth.verifyToken`. On
+     * CAUTHY_KEY it is Cauthy's answer; otherwise: this, or `CAUTHY_TENANT_ID`.
      */
     tenantId?: string;
     /**
@@ -268,23 +178,18 @@ interface CauthyOptions {
         request?: number;
     };
     /**
-     * Run by contract: the issuer, the workspace, the clients and where the
-     * application's keys are published all come from its link in the network's
-     * context graph, and none of the CAUTHY_* variables may be set. See
-     * "Connect a system by contract".
-     *
-     *   createCauthy({ contract: { graph, system: 'acme-crm' }, keys: postgresKeyStore(query) })
-     */
-    contract?: ContractOptions;
-    /** Where the application keeps its own key, with a contract (@cauthyhq/node/keys). */
-    keys?: KeyStore;
-    /**
-     * The one secret of a contracted application: every key it needs is
-     * derived from it. 32 random bytes or more. Default: `PACT_ROOT_KEY`.
+     * Removed in 1.3: contracts are retired. Given, `createCauthy` refuses to
+     * start (as it does with `PACT_ROOT_KEY` or `PACT_ROOT_KEY_PREVIOUS` set):
+     * run on CAUTHY_KEY alone, and protect sign-in with the "Protect sign-in"
+     * switches on the application's card in Cauthy's dashboard.
      */
-    rootKey?: string;
-    /** The root key before the current one, while rotating it. Default: `PACT_ROOT_KEY_PREVIOUS`. */
-    rootKeyPrevious?: string;
+    contract?: never;
+    /** Removed in 1.3 with contracts: given, `createCauthy` refuses to start. */
+    keys?: never;
+    /** Removed in 1.3 with contracts (it was `PACT_ROOT_KEY`): given, `createCauthy` refuses to start. */
+    rootKey?: never;
+    /** Removed in 1.3 with contracts (it was `PACT_ROOT_KEY_PREVIOUS`): given, `createCauthy` refuses to start. */
+    rootKeyPrevious?: never;
     /**
      * Where `auth.webhook` remembers the deliveries it took, so one sent twice
      * is refused. Default: this process's memory. Give a shared one (a table)
@@ -411,7 +316,7 @@ declare class CauthyConfigError extends Error {
     constructor(message: string);
 }
 /** Why a CAUTHY_KEY was refused (key/cauthy-key.md §3, §8, §9). */
-type CauthyKeyReason = 'key_format' | 'key_version' | 'key_checksum' | 'key_issuer' | 'key_client' | 'key_secret' | 'key_contract_issuer' | 'key_previous_mismatch';
+type CauthyKeyReason = 'key_format' | 'key_version' | 'key_checksum' | 'key_issuer' | 'key_client' | 'key_secret' | 'key_previous_mismatch';
 /** A refused CAUTHY_KEY. The message names the reason, never the key. */
 declare class CauthyKeyError extends CauthyConfigError {
     readonly reason: CauthyKeyReason;
@@ -703,17 +608,10 @@ interface SystemOptions {
      * client registered to be sent back to. Default: `CAUTHY_ACCEPT_INVITE_URL`.
      */
     acceptInviteUrl?: string;
-    /**
-     * The application's own keys, kept in its database (contract mode): it
-     * signs with the newest and publishes them. Takes the place of `key`.
-     */
-    keys?: PactKeys;
-    /** The client the keys prove: the system's own, beside the sign-in client. */
-    keysClientId?: string;
     /**
      * CAUTHY_KEY's Ed25519 key (key/cauthy-key.md §6) and the client it proves:
-     * every token is asked with an EdDSA assertion. Takes the place of `key`,
-     * `keys` and the secret.
+     * every token is asked with an EdDSA assertion. Takes the place of `key`
+     * and the secret.
      */
     signer?: {
         clientId: string;
@@ -939,8 +837,8 @@ interface VerifyTokenOptions {
     /**
      * The client this backend signs people in through. When set, a person's
      * token issued through another client (an `azp` naming another) is refused
-     * with `wrong_client` (rule R15); a token with no `azp` passes. In contract
-     * mode it is the link's sign-in client. Default: none, and `azp` is not checked.
+     * with `wrong_client` (rule R15); a token with no `azp` passes. Default:
+     * none, and `azp` is not checked.
      */
     clientId?: string;
 }
@@ -988,6 +886,25 @@ declare function createVerifierFromEnv(options?: Omit<VerifyTokenOptions, 'issue
  */
 type MountTarget = string | ((request: Request) => Response | Promise<Response>);
 
+/** What `GET /v1/connect/self` answers. */
+interface Identity {
+    issuer: string;
+    audience: string;
+    tenant: {
+        id: string;
+        slug: string;
+    };
+    system: string;
+    client_id: string;
+    sign_in_client_id: string;
+    app_urls: string[];
+    callback_path: string;
+    key: {
+        kid: string;
+        retires_at: string | null;
+    } | null;
+}
+
 /** What `resolve` answers: who is there, and the cookies that must go back. */
 interface Resolved {
     session: Session | null;
@@ -1071,10 +988,9 @@ interface Cauthy {
     /**
      * Verifies a Cauthy access token (or a request's `Authorization: Bearer`) for
      * an API of this application: `verifyToken` with this instance's issuer, its
-     * workspace (by contract, the link's `tenant_id`; otherwise `tenantId` or
-     * `CAUTHY_TENANT_ID`) and its audience (`audience` or `CAUTHY_AUDIENCE`).
-     * By contract it also refuses a person's token issued through another
-     * client than the link's (`wrong_client`).
+     * workspace (on CAUTHY_KEY, Cauthy's answer; otherwise `tenantId` or
+     * `CAUTHY_TENANT_ID`) and its audience (on CAUTHY_KEY, Cauthy's answer;
+     * otherwise `audience` or `CAUTHY_AUDIENCE`).
      */
     verifyToken(from: string | Request | Headers, options?: Partial<VerifyTokenOptions>): Promise<TokenIdentity>;
     /** The same, built once: throws `CauthyConfigError` now if the audience or the workspace is missing. */
@@ -1085,11 +1001,6 @@ interface Cauthy {
      * `systemKey`.
      */
     system: CauthySystem;
-    /**
-     * The application's contract, when it runs by one: what its link says,
-     * its own keys, and how it stands against its contract in Cauthy.
-     */
-    pact?: CauthyPact;
     /** What the browser may be told of a session. */
     toPublic(session: Session): Promise<PublicSession>;
     /** Paths of this application that start a sign-in, a sign-out, or open the account page. */
@@ -1101,20 +1012,6 @@ interface Cauthy {
     };
     options: Readonly<Required<Pick<CauthyOptions, 'issuer' | 'clientId' | 'basePath' | 'afterSignIn' | 'afterSignOut' | 'cookieName'>>>;
 }
-/** A contracted application's view of its contract (`auth.pact`). */
-interface CauthyPact {
-    /** What its link in the graph says. */
-    contract: ResolvedContract;
-    /** Its own keys: the one that signs, the ones published, rotating them. */
-    keys: PactKeys;
-    /**
-     * The response for its jwks_url: the published keys. `handler` serves it
-     * at that path too, when the route reaches it.
-     */
-    jwks(): Promise<Response>;
-    /** How it stands against its contract, as Cauthy checks it now. For a health endpoint. */
-    status(): Promise<PactStatus>;
-}
 declare function createCauthy(given?: CauthyOptions): Cauthy;
 
-export { createCauthy as $, type AttributeType as A, type PolicyRole as B, type Cauthy as C, type PublicSession as D, type PushPolicyOptions as E, type Resolved as F, type ResolvedContract as G, type RoleOf as H, STANDARD_VARIABLES as I, type JsonValue as J, type SessionOrganization as K, type SessionStatus as L, type MountTarget as M, type NewMember as N, type Organization as O, type PactItem as P, type SessionUser as Q, type ReplayStore as R, type Session as S, type SystemKey as T, type SystemOptions as U, type SystemPolicy as V, type TokenIdentity as W, type TokenRefusal as X, type VerifyTokenOptions as Y, type VerifyWebhookOptions as Z, can as _, type CatalogResource as a, createSystem as a0, createTokenVerifier as a1, createVerifierFromEnv as a2, definePolicy as a3, failClosed as a4, memoryReplayStore as a5, policySource as a6, pullCatalog as a7, pullPolicy as a8, pushCatalog as a9, pushPolicy as aa, readContract as ab, remoteKeys as ac, verifyToken as ad, verifyWebhook as ae, CauthyApiError as b, CauthyConfigError as c, type CauthyEvent as d, CauthyKeyError as e, type CauthyKeyReason as f, type CauthyOptions as g, type CauthyPact as h, type CauthySystem as i, CauthyTokenError as j, CauthyUnavailableError as k, CauthyWebhookError as l, type CheckOf as m, type CheckQuestion as n, type CheckResult as o, type CheckRule as p, type ConditionalPermission as q, type ContractOptions as r, type OrganizationMember as s, type OrganizationRef as t, type PactStatus as u, type PermissionOf as v, type Permitted as w, type Policy as x, type PolicyDefinition as y, type PolicyPermission as z };
+export { memoryReplayStore as $, type AttributeType as A, type RoleOf as B, type Cauthy as C, type SessionOrganization as D, type SessionStatus as E, type SessionUser as F, type SystemKey as G, type SystemOptions as H, type Identity as I, type JsonValue as J, type SystemPolicy as K, type TokenRefusal as L, type MountTarget as M, type NewMember as N, type Organization as O, type PermissionOf as P, type VerifyWebhookOptions as Q, type ReplayStore as R, type Session as S, type TokenIdentity as T, can as U, type VerifyTokenOptions as V, createCauthy as W, createSystem as X, createTokenVerifier as Y, createVerifierFromEnv as Z, definePolicy as _, type CatalogResource as a, policySource as a0, pullCatalog as a1, pullPolicy as a2, pushCatalog as a3, pushPolicy as a4, remoteKeys as a5, verifyToken as a6, verifyWebhook as a7, CauthyApiError as b, CauthyConfigError as c, type CauthyEvent as d, CauthyKeyError as e, type CauthyKeyReason as f, type CauthyOptions as g, type CauthySystem as h, CauthyTokenError as i, CauthyUnavailableError as j, CauthyWebhookError as k, type CheckOf as l, type CheckQuestion as m, type CheckResult as n, type CheckRule as o, type ConditionalPermission as p, type OrganizationMember as q, type OrganizationRef as r, type Permitted as s, type Policy as t, type PolicyDefinition as u, type PolicyPermission as v, type PolicyRole as w, type PublicSession as x, type PushPolicyOptions as y, type Resolved as z };