@cauthyhq/node 1.2.0 → 1.3.0

package/dist/index.mjs

@@ -54,266 +54,14 @@ async function unseal(sealed, key) {
   }
 }
 async function unsealAny(sealed, ring) {
-  for (const key of ring) {
-    const value = await unseal(sealed, key);
-    if (value !== null) return value;
-  }
-  return null;
-}
-
-// src/types.ts
-var CauthyConfigError = class extends Error {
-  constructor(message) {
-    super(`@cauthyhq/node: ${message}`);
-    this.name = "CauthyConfigError";
-  }
-};
-var CauthyKeyError = class extends CauthyConfigError {
-  constructor(reason, message) {
-    super(`CAUTHY_KEY: ${message} (${reason})`);
-    this.reason = reason;
-    this.name = "CauthyKeyError";
-  }
-  reason;
-};
-
-// src/url.ts
-function withoutTrailingSlashes(s) {
-  let end = s.length;
-  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
-  return s.slice(0, end);
-}
-
-// src/contract.ts
-var STANDARD_VARIABLES = [
-  "CAUTHY_ISSUER",
-  "CAUTHY_CLIENT_ID",
-  "CAUTHY_CLIENT_SECRET",
-  "CAUTHY_SECRET",
-  "CAUTHY_SYSTEM",
-  "CAUTHY_TENANT",
-  "CAUTHY_SYSTEM_KEY",
-  "CAUTHY_SYSTEM_KEY_ID"
-];
-function failClosed(environment) {
-  const set = STANDARD_VARIABLES.filter((name) => (environment?.[name] ?? "") !== "");
-  if (set.length > 0) {
-    throw new CauthyConfigError(`the application runs by contract, and ${set.join(", ")} ${set.length === 1 ? "is" : "are"} also set: remove ` + (set.length === 1 ? "it" : "them") + " from the environment. Everything comes from the contract.");
-  }
-}
-var SLUG = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/;
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var NIL_UUID = "00000000-0000-0000-0000-000000000000";
-var text = (v) => typeof v === "string" ? v : "";
-function httpsAddress(raw, what) {
-  let u;
-  try {
-    u = new URL(raw);
-  } catch {
-    throw new CauthyConfigError(`the contract's ${what} is not an address: ${JSON.stringify(raw)}`);
-  }
-  const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
-  if (u.protocol !== "https:" && !(u.protocol === "http:" && local)) {
-    throw new CauthyConfigError(`the contract's ${what} must be https: ${raw}`);
-  }
-  return u;
-}
-function readContract(options) {
-  const { system } = options;
-  const provider = options.provider ?? "cauthy";
-  if (!SLUG.test(system ?? "")) throw new CauthyConfigError(`contract.system must be the system's id in the graph, e.g. "acme-crm"`);
-  const graph = options.graph && typeof options.graph === "object" && "default" in options.graph && !("edges" in options.graph) ? options.graph.default : options.graph;
-  if (!graph || !Array.isArray(graph.edges) || !Array.isArray(graph.nodes)) {
-    throw new CauthyConfigError("contract.graph is not a context graph: pass the graph.json that `cauthy contracts pull` writes");
-  }
-  const node = (id) => graph.nodes?.find((n) => n.type === "system" && n.id === id);
-  const own = node(system);
-  if (!own) throw new CauthyConfigError(`the graph has no system "${system}"`);
-  const cauthy = node(provider);
-  if (!cauthy) throw new CauthyConfigError(`the graph has no system "${provider}"`);
-  const links = graph.edges.filter((e2) => e2.relation === "links" && e2.from === system && e2.to === provider && e2.sign_in).filter((e2) => options.link === void 0 || e2.link === options.link);
-  if (links.length === 0) {
-    throw new CauthyConfigError(options.link ? `the graph has no link "${options.link}" from ${system} to ${provider} with sign_in` : `no link of the graph signs ${system}'s people in with ${provider}: merge one in the contracts repository, then pull the graph again`);
-  }
-  if (links.length > 1) {
-    throw new CauthyConfigError(`${system} has ${links.length} links to ${provider}: name the one to read (contract.link): ${links.map((l) => text(l.link)).join(", ")}`);
-  }
-  const e = links[0];
-  const link = text(e.link);
-  const named = text(e.identity?.tenant);
-  const pinned = text(e.identity?.tenant_id);
-  if (named === NIL_UUID || pinned === NIL_UUID) throw new CauthyConfigError(`the link ${link} names the nil UUID as its workspace: name the workspace by its slug`);
-  let tenantId;
-  let tenant;
-  if (UUID.test(named)) {
-    if (pinned !== "" && pinned.toLowerCase() !== named.toLowerCase()) {
-      throw new CauthyConfigError(`the link ${link} names the workspace ${named} and its tenant_id ${pinned} does not match: pull the graph again`);
-    }
-    tenantId = named;
-    tenant = text((cauthy.tenants ?? []).find((t) => t.id === named)?.slug);
-    if (tenant === "") throw new CauthyConfigError(`the graph does not name the slug of the workspace ${named} that the link ${link} uses`);
-  } else {
-    if (!SLUG.test(named)) throw new CauthyConfigError(`the link ${link} names no workspace: identity.tenant is a UUID or a slug`);
-    if (!UUID.test(pinned)) {
-      throw new CauthyConfigError(e.identity?.create_tenant === true ? `the link ${link} asks Cauthy for a new workspace "${named}", and the graph has no tenant_id for it yet: once Cauthy has created it and core-contracts lists it, pull the graph again` : `the link ${link} names the workspace "${named}" by its slug, and the graph carries no tenant_id for it: pull the graph again`);
-    }
-    tenantId = pinned;
-    tenant = named;
-  }
-  const issuer = withoutTrailingSlashes(httpsAddress(text(cauthy.url), `address of ${provider}`).href);
-  const signIn = e.sign_in ?? {};
-  const clientId = text(signIn.client_id) || `pact.${link}`;
-  const redirectUris = Array.isArray(signIn.redirect_uris) ? signIn.redirect_uris.map(text).filter(Boolean) : [];
-  if (redirectUris.length === 0) throw new CauthyConfigError(`the link ${link} names no redirect URI`);
-  const proof = text(signIn.system_proof);
-  if (signIn.system_proof !== void 0 && proof !== "off" && proof !== "auto" && proof !== "required") {
-    throw new CauthyConfigError(`the link ${link} has system_proof ${JSON.stringify(signIn.system_proof)}: it is off, auto or required. Update @cauthyhq/node, or pull the graph again`);
-  }
-  const systemProof = proof === "off" || proof === "auto" || proof === "required" ? proof : signIn.require_system_proof === true ? "required" : "off";
-  if (systemProof !== "off" && !e.service) {
-    throw new CauthyConfigError(`the link ${link} asks for the system's proof (${systemProof}) and gives ${system} no identity to make it with: it needs a service block`);
-  }
-  const out2 = {
-    system,
-    link,
-    issuer,
-    tenantId,
-    tenant,
-    clientId,
-    redirectUris,
-    requireSystemProof: systemProof === "required",
-    systemProof,
-    requireVerifiedEmail: signIn.require_verified_email === true,
-    persistentSessions: signIn.persistent_sessions === true
-  };
-  if (e.service) {
-    out2.serviceClientId = text(e.service.client_id) || `pact.${link}.service`;
-    const jwks = text(e.service.jwks_url) || text(own.jwks_url);
-    if (jwks === "") throw new CauthyConfigError(`the link ${link} gives ${system} its own identity, and ${system} names no jwks_url`);
-    out2.jwksUrl = httpsAddress(jwks, "jwks_url").href;
-    out2.jwksPath = new URL(out2.jwksUrl).pathname;
-  }
-  if (text(own.events_url) !== "") out2.eventsUrl = httpsAddress(text(own.events_url), "events_url").href;
-  return out2;
+  return (await unsealIndexed(sealed, ring))?.value ?? null;
 }
-
-// src/keys.ts
-import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from "jose";
-var RETIRE_AFTER_MS = 24 * 60 * 60 * 1e3;
-var FORGET_AFTER_MS = 7 * 24 * 60 * 60 * 1e3;
-var CURRENT_TTL_MS = 5 * 60 * 1e3;
-var JWKS_MAX_AGE_S = 300;
-var SIGN_AFTER_MS = (JWKS_MAX_AGE_S + 60) * 1e3;
-var SETTLING_TTL_MS = 5 * 1e3;
-var newestFirst = (keys2) => [...keys2].sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.kid.localeCompare(a.kid));
-function published(key) {
-  const { kty, n, e } = key.publicJwk;
-  return { kty, n, e, kid: key.kid, alg: "RS256", use: "sig" };
-}
-function pactKeys(store, sealKeys, now = Date.now) {
-  let remembered;
-  let making;
-  async function make(after) {
-    const { publicKey, privateKey } = await generateKeyPair("RS256", { modulusLength: 2048, extractable: true });
-    const publicJwk = await exportJWK(publicKey);
-    const kid = await calculateJwkThumbprint(publicJwk);
-    const at = Math.max(now(), after ? Date.parse(after.createdAt) + 1 : 0);
-    const key = { kid, publicJwk, sealed: await seal(await exportJWK(privateKey), (await sealKeys)[0]), createdAt: new Date(at).toISOString() };
-    if (!after && store.addFirst) await store.addFirst(key);
-    else await store.add(key);
-    return key;
-  }
-  const age = (key) => now() - Date.parse(key.createdAt);
-  function signer(kept) {
-    const ripe = kept.find((k) => age(k) >= SIGN_AFTER_MS);
-    if (!ripe) return { key: kept[kept.length - 1], until: now() + SETTLING_TTL_MS };
-    const until = ripe === kept[0] ? now() + CURRENT_TTL_MS : Math.min(now() + CURRENT_TTL_MS, Date.parse(kept[0].createdAt) + SIGN_AFTER_MS);
-    return { key: ripe, until };
-  }
-  async function open(key) {
-    const ring = await sealKeys;
-    for (let i = 0; i < ring.length; i++) {
-      const jwk = await unseal(key.sealed, ring[i]);
-      if (jwk !== null) return { jwk, fresh: i === 0 };
-    }
-    return null;
-  }
-  async function keptKeys() {
-    const kept = newestFirst(await store.list());
-    if (kept.length > 0) return kept;
-    making ??= make().finally(() => {
-      making = void 0;
-    });
-    await making;
-    const again = newestFirst(await store.list());
-    if (again.length === 0) throw new CauthyConfigError("the key store kept no key: check that it writes");
-    return again;
+async function unsealIndexed(sealed, ring) {
+  for (let index = 0; index < ring.length; index++) {
+    const value = await unseal(sealed, ring[index]);
+    if (value !== null) return { value, index };
   }
-  return {
-    async current() {
-      if (remembered && remembered.until > now()) return remembered;
-      const { key, until } = signer(await keptKeys());
-      if (remembered?.kid === key.kid) {
-        remembered.until = until;
-        return remembered;
-      }
-      const opened = await open(key);
-      if (opened === null) {
-        throw new CauthyConfigError(`the key ${key.kid} cannot be opened with the root key (PACT_ROOT_KEY): if the root key was rotated, set the previous one as PACT_ROOT_KEY_PREVIOUS`);
-      }
-      remembered = { kid: key.kid, privateKey: await importJWK(opened.jwk, "RS256"), until };
-      return remembered;
-    },
-    async published() {
-      const kept = await keptKeys();
-      const out2 = [];
-      for (let i = 0; i < kept.length; i++) {
-        if (i === 0 || now() - Date.parse(kept[i - 1].createdAt) < RETIRE_AFTER_MS) out2.push(published(kept[i]));
-        else if (now() - Date.parse(kept[i - 1].createdAt) > FORGET_AFTER_MS) await store.remove(kept[i].kid);
-      }
-      return { keys: out2 };
-    },
-    async rotate() {
-      const key = await make(newestFirst(await store.list())[0]);
-      remembered = void 0;
-      return key.kid;
-    },
-    async reseal() {
-      let changed = 0;
-      const ring = await sealKeys;
-      for (const key of await store.list()) {
-        const opened = await open(key);
-        if (opened === null || opened.fresh) continue;
-        await store.update({ ...key, sealed: await seal(opened.jwk, ring[0]) });
-        changed++;
-      }
-      return changed;
-    }
-  };
-}
-
-// src/rootkey.ts
-var encoder2 = new TextEncoder();
-var MIN_ROOT_KEY = 32;
-async function derive(root, purpose) {
-  const ikm = await crypto.subtle.importKey("raw", encoder2.encode(root), "HKDF", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: encoder2.encode(`pact/${purpose}/v1`) },
-    ikm,
-    256
-  );
-  return new Uint8Array(bits);
-}
-function deriveKeys(root, previous) {
-  if (root.length < MIN_ROOT_KEY) {
-    throw new CauthyConfigError(`rootKey (PACT_ROOT_KEY) must be at least ${MIN_ROOT_KEY} characters: 32 random bytes, e.g. openssl rand -base64 32`);
-  }
-  if (previous !== void 0 && previous !== "" && previous.length < MIN_ROOT_KEY) {
-    throw new CauthyConfigError(`the previous root key (PACT_ROOT_KEY_PREVIOUS) must be at least ${MIN_ROOT_KEY} characters`);
-  }
-  const roots = previous && previous !== root ? [root, previous] : [root];
-  const ring = (purpose) => Promise.all(roots.map((r) => derive(r, purpose)));
-  return { seal: ring("seal"), cookie: ring("cookie"), flow: ring("flow") };
+  return null;
 }
 
 // src/deadline.ts
@@ -349,6 +97,13 @@ function anySignal(signals) {
   return controller.signal;
 }
 
+// src/url.ts
+function withoutTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+
 // src/permissions.ts
 function matches(entry, resource, action) {
   const i = entry.lastIndexOf(":");
@@ -418,19 +173,19 @@ var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function policySource(system, read) {
   const roles = Array.isArray(read) ? read : read.roles;
   const catalog = Array.isArray(read) ? [] : read.catalog ?? [];
-  const text2 = (v) => JSON.stringify(v);
-  const key = (k) => IDENT.test(k) ? k : text2(k);
+  const text = (v) => JSON.stringify(v);
+  const key = (k) => IDENT.test(k) ? k : text(k);
   const one = (r, pad) => {
-    const parts = [`role: ${text2(r.role)}`];
-    if (r.name) parts.push(`name: ${text2(r.name)}`);
-    if (r.description) parts.push(`description: ${text2(r.description)}`);
-    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text2).join(", ")}]`);
+    const parts = [`role: ${text(r.role)}`];
+    if (r.name) parts.push(`name: ${text(r.name)}`);
+    if (r.description) parts.push(`description: ${text(r.description)}`);
+    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
     if (r.permissions?.length) {
       const list = r.permissions.map((p) => `${pad}      { ${[
-        ...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text2(p.kind)}`] : [],
-        `resource: ${text2(p.resource)}`,
-        `action: ${text2(p.action)}`,
-        ...p.condition ? [`condition: ${text2(p.condition)}`] : []
+        ...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [],
+        `resource: ${text(p.resource)}`,
+        `action: ${text(p.action)}`,
+        ...p.condition ? [`condition: ${text(p.condition)}`] : []
       ].join(", ")} },`);
       parts.push(`permissions: [
 ${list.join("\n")}
@@ -442,14 +197,14 @@ ${pad}    `)},
 ${pad}  },`;
   };
   const resource = (c) => {
-    const parts = [`resource: ${text2(c.resource)}`];
-    if (c.description) parts.push(`description: ${text2(c.description)}`);
-    parts.push(`actions: [${c.actions.map(text2).join(", ")}]`);
+    const parts = [`resource: ${text(c.resource)}`];
+    if (c.description) parts.push(`description: ${text(c.description)}`);
+    parts.push(`actions: [${c.actions.map(text).join(", ")}]`);
     const attrs = Object.entries(c.attributes ?? {});
-    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text2(v)}`).join(", ")} }`);
+    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text(v)}`).join(", ")} }`);
     return `    { ${parts.join(", ")} },`;
   };
-  const head = `// The catalog of roles of ${text2(system)}, as Cauthy has it.
+  const head = `// The catalog of roles of ${text(system)}, as Cauthy has it.
 // Written by \`pullPolicy\`: run it again after the catalog
 // changes, and do not edit this file by hand.
 `;
@@ -559,7 +314,7 @@ function organizationIdOf(o) {
 }
 
 // src/system.ts
-import { exportJWK as exportJWK2, importJWK as importJWK2, importPKCS8, SignJWT } from "jose";
+import { exportJWK, importJWK, importPKCS8, SignJWT } from "jose";
 
 // src/theme.ts
 var MAX_RADIUS = 40;
@@ -576,7 +331,7 @@ function withoutComments(css) {
   }
 }
 function declarations(css) {
-  const text2 = withoutComments(css);
+  const text = withoutComments(css);
   const out2 = [];
   const within = [];
   let chunk = "";
@@ -587,7 +342,7 @@ function declarations(css) {
     if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
     chunk = "";
   };
-  for (const ch of text2) {
+  for (const ch of text) {
     if (quote) {
       chunk += ch;
       if (ch === quote) quote = "";
@@ -923,6 +678,22 @@ async function pushTheme(o) {
   }
 }
 
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`@cauthyhq/node: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+var CauthyKeyError = class extends CauthyConfigError {
+  constructor(reason, message) {
+    super(`CAUTHY_KEY: ${message} (${reason})`);
+    this.reason = reason;
+    this.name = "CauthyKeyError";
+  }
+  reason;
+};
+
 // src/system.ts
 var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 var SKEW_MS = 3e4;
@@ -962,7 +733,7 @@ function asJwk(k) {
 }
 async function loadKey(k) {
   const jwk = asJwk(k);
-  return jwk ? importJWK2(jwk, "RS256") : importPKCS8(k.privateKey, "RS256", { extractable: true });
+  return jwk ? importJWK(jwk, "RS256") : importPKCS8(k.privateKey, "RS256", { extractable: true });
 }
 function createSystem(given = {}) {
   const issuer = withoutTrailingSlashes(given.issuer ?? env("CAUTHY_ISSUER") ?? "");
@@ -989,10 +760,6 @@ function createSystem(given = {}) {
     if (given.signer) return;
     if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
     if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
-    if (given.keys) {
-      if (!given.keysClientId) throw new CauthyConfigError("the contract gives the system no identity of its own: its link needs a service block");
-      return;
-    }
     if (key ? key.keyId === "" : clientSecret === "") {
       throw new CauthyConfigError(key ? "the key needs its id (CAUTHY_SYSTEM_KEY_ID)" : "to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)");
     }
@@ -1010,14 +777,14 @@ function createSystem(given = {}) {
   let asking;
   async function ask() {
     configured();
-    const self = given.signer ? given.signer.clientId : given.keys ? given.keysClientId : key?.clientId || clientId;
+    const self = given.signer ? given.signer.clientId : key?.clientId || clientId;
     const form = new URLSearchParams({ grant_type: "client_credentials", client_id: self });
     if (given.signer) {
       const s = await given.signer.signer;
       form.set("client_assertion_type", ASSERTION_TYPE);
       form.set("client_assertion", await s.assertion(self, tokenEndpoint));
-    } else if (given.keys || key) {
-      const signer = given.keys ? await given.keys.current() : { kid: key.keyId, privateKey: await signingKey() };
+    } else if (key) {
+      const signer = { kid: key.keyId, privateKey: await signingKey() };
       const assertion = await new SignJWT({}).setProtectedHeader({ alg: "RS256", kid: signer.kid }).setIssuer(self).setSubject(self).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(signer.privateKey);
       form.set("client_assertion_type", ASSERTION_TYPE);
       form.set("client_assertion", assertion);
@@ -1126,9 +893,8 @@ function createSystem(given = {}) {
       return checkResultOf(await data("POST", `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }));
     },
     async publicJwks() {
-      if (given.keys) return given.keys.published();
       if (!key) return { keys: [] };
-      const { kty, n, e } = asJwk(key) ?? await exportJWK2(await signingKey());
+      const { kty, n, e } = asJwk(key) ?? await exportJWK(await signingKey());
       return { keys: [{ kty, n, e, kid: key.keyId, alg: "RS256", use: "sig" }] };
     }
   };
@@ -1462,8 +1228,8 @@ var fail = (reason, message) => {
   throw new CauthyKeyError(reason, message);
 };
 var NOT_A_KEY = "not a Cauthy key (copy it again from the dashboard)";
-function parseKey(text2) {
-  const s = text2.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, "");
+function parseKey(text) {
+  const s = text.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, "");
   if (s === "" || s.length > MAX_LEN || !printableAscii(s)) fail("key_format", NOT_A_KEY);
   const head = s.split(".", 1)[0];
   if (head !== KEY_PREFIX) {
@@ -1646,10 +1412,10 @@ async function finish(res, route, cacheable = false) {
   if (!cacheable && !(headers.get("cache-control") ?? "").includes("no-store")) headers.set("cache-control", "no-store");
   let body = res.body;
   if (route !== null && SIGN_IN_ROUTES.has(route) && res.ok && (headers.get("content-type") ?? "").startsWith("application/json")) {
-    const text2 = await res.text();
-    body = text2;
+    const text = await res.text();
+    body = text;
     try {
-      const parsed = JSON.parse(text2);
+      const parsed = JSON.parse(text);
       const next = nextOf(route, parsed?.status);
       if (parsed !== null && next !== void 0) body = JSON.stringify({ ...parsed, next });
     } catch {
@@ -1665,24 +1431,24 @@ import { compactVerify, createLocalJWKSet } from "jose";
 // src/json.ts
 var SPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r"]);
 var LIMIT = 2n ** 53n;
-function parseStrict(text2, integerMembers = []) {
+function parseStrict(text, integerMembers = []) {
   let i = 0;
   let depth = 0;
   const fail2 = (what) => {
     throw new SyntaxError(`${what} at ${i}`);
   };
   const skip = () => {
-    while (i < text2.length && SPACE.has(text2[i])) i++;
+    while (i < text.length && SPACE.has(text[i])) i++;
   };
   const value = (integer = false) => {
     skip();
-    const c = text2[i];
+    const c = text[i];
     if (c === "{") return object();
     if (c === "[") return array();
     if (c === '"') return string();
     if (c === "-" || c >= "0" && c <= "9") return number(integer);
     for (const [word, v] of [["true", true], ["false", false], ["null", null]]) {
-      if (text2.startsWith(word, i)) {
+      if (text.startsWith(word, i)) {
         i += word.length;
         return v;
       }
@@ -1692,13 +1458,13 @@ function parseStrict(text2, integerMembers = []) {
   const string = () => {
     const start = i;
     i++;
-    while (i < text2.length && text2[i] !== '"') i += text2[i] === "\\" ? 2 : 1;
-    if (text2[i] !== '"') fail2("unterminated string");
+    while (i < text.length && text[i] !== '"') i += text[i] === "\\" ? 2 : 1;
+    if (text[i] !== '"') fail2("unterminated string");
     i++;
-    return JSON.parse(text2.slice(start, i));
+    return JSON.parse(text.slice(start, i));
   };
   const number = (integer) => {
-    const m = /^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/.exec(text2.slice(i));
+    const m = /^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/.exec(text.slice(i));
     if (!m) return fail2("bad number");
     i += m[0].length;
     if (integer && (m[2] !== void 0 || m[3] !== void 0)) return Number.NaN;
@@ -1713,7 +1479,7 @@ function parseStrict(text2, integerMembers = []) {
     depth++;
     const out2 = [];
     skip();
-    if (text2[i] === "]") {
+    if (text[i] === "]") {
       i++;
       depth--;
       return out2;
@@ -1721,8 +1487,8 @@ function parseStrict(text2, integerMembers = []) {
     for (; ; ) {
       out2.push(value());
       skip();
-      if (text2[i] === ",") i++;
-      else if (text2[i] === "]") {
+      if (text[i] === ",") i++;
+      else if (text[i] === "]") {
         i++;
         depth--;
         return out2;
@@ -1735,24 +1501,24 @@ function parseStrict(text2, integerMembers = []) {
     const out2 = {};
     const seen = /* @__PURE__ */ new Set();
     skip();
-    if (text2[i] === "}") {
+    if (text[i] === "}") {
       i++;
       depth--;
       return out2;
     }
     for (; ; ) {
       skip();
-      if (text2[i] !== '"') fail2("expected a name");
+      if (text[i] !== '"') fail2("expected a name");
       const name = string();
       if (seen.has(name)) fail2(`repeated name ${JSON.stringify(name)}`);
       seen.add(name);
       skip();
-      if (text2[i] !== ":") fail2("expected :");
+      if (text[i] !== ":") fail2("expected :");
       i++;
       Object.defineProperty(out2, name, { value: value(depth === 1 && integerMembers.includes(name)), enumerable: true, writable: true, configurable: true });
       skip();
-      if (text2[i] === ",") i++;
-      else if (text2[i] === "}") {
+      if (text[i] === ",") i++;
+      else if (text[i] === "}") {
         i++;
         depth--;
         return out2;
@@ -1761,7 +1527,7 @@ function parseStrict(text2, integerMembers = []) {
   };
   const result = value();
   skip();
-  if (i < text2.length) fail2("trailing characters");
+  if (i < text.length) fail2("trailing characters");
   return result;
 }
 
@@ -1782,6 +1548,15 @@ function deprecated(what, instead) {
 var enc2 = new TextEncoder();
 var PKCS8_ED25519 = Uint8Array.from([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
 var ASSERTION_TYPE2 = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+async function ringKey(secret, purpose) {
+  const ikm = await crypto.subtle.importKey("raw", enc2.encode(secret), "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc2.encode(`pact/${purpose}/v1`) },
+    ikm,
+    256
+  ));
+}
+var ringOf = (secrets, purpose) => Promise.all(secrets.map((s) => ringKey(s, purpose)));
 async function seedOf(secret) {
   const ikm = await crypto.subtle.importKey("raw", enc2.encode(secret), "HKDF", false, ["deriveBits"]);
   return new Uint8Array(await crypto.subtle.deriveBits(
@@ -1819,12 +1594,11 @@ async function signerOf(secret) {
 }
 function deriveFromKey(key, previous) {
   const other = previous && previous.secret !== key.secret ? previous : void 0;
-  const rings = deriveKeys(key.secret, other?.secret);
+  const secrets = other ? [key.secret, other.secret] : [key.secret];
   return {
-    cookie: rings.cookie,
-    flow: rings.flow,
-    signer: signerOf(key.secret),
-    ...other ? { previousJwk: signerOf(other.secret).then((s) => ({ ...s.publicJwk, kid: s.kid })) } : {}
+    cookie: ringOf(secrets, "cookie"),
+    flow: ringOf(secrets, "flow"),
+    signer: signerOf(key.secret)
   };
 }
 
@@ -1943,8 +1717,8 @@ var CauthyTokenError = class extends Error {
   detail;
 };
 var MAX_TOKEN_BYTES = 8192;
-var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var NIL_UUID2 = "00000000-0000-0000-0000-000000000000";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var NIL_UUID = "00000000-0000-0000-0000-000000000000";
 var SEGMENT = /^[A-Za-z0-9_-]+$/;
 var MAX_KEYS_BYTES = 64 * 1024;
 var KEYS_TIMEOUT_MS = 5e3;
@@ -2024,7 +1798,7 @@ async function readCapped(res, max) {
   }
   return out2;
 }
-var published2 = /* @__PURE__ */ new Map();
+var published = /* @__PURE__ */ new Map();
 var withFetch = /* @__PURE__ */ new WeakMap();
 function remoteKeysFor(issuer, fetchKeys) {
   let byIssuer = withFetch.get(fetchKeys);
@@ -2034,10 +1808,10 @@ function remoteKeysFor(issuer, fetchKeys) {
   return set;
 }
 function keysOf2(issuer) {
-  let set = published2.get(issuer);
+  let set = published.get(issuer);
   if (set === void 0) {
     set = remoteKeys(issuer);
-    published2.set(issuer, set);
+    published.set(issuer, set);
   }
   return set;
 }
@@ -2079,7 +1853,7 @@ function createTokenVerifier(options = {}) {
   if (audience === "") throw new CauthyConfigError("audience (CAUTHY_AUDIENCE) is not set: without it a token issued for another application would be accepted");
   const tenant = options.tenantId ?? env2("CAUTHY_TENANT_ID") ?? "";
   if (tenant === "") throw new CauthyConfigError("tenantId (CAUTHY_TENANT_ID) is not set: without it a token of another workspace would be accepted");
-  if (!UUID2.test(tenant) || tenant === NIL_UUID2) throw new CauthyConfigError("tenantId must be the workspace's id, a lowercase UUID that is not the nil UUID");
+  if (!UUID.test(tenant) || tenant === NIL_UUID) throw new CauthyConfigError("tenantId must be the workspace's id, a lowercase UUID that is not the nil UUID");
   const leeway = options.leeway ?? 30;
   if (!Number.isFinite(leeway) || leeway < 0 || leeway > 60) throw new CauthyConfigError("leeway must be 0 to 60 seconds");
   return async (from) => {
@@ -2128,8 +1902,8 @@ function createTokenVerifier(options = {}) {
       throw new CauthyTokenError("invalid_claim", name);
     };
     if (typeof claims.iss !== "string") bad("iss");
-    if (typeof claims.sub !== "string" || !UUID2.test(claims.sub)) bad("sub");
-    if (typeof claims.tid !== "string" || !UUID2.test(claims.tid)) bad("tid");
+    if (typeof claims.sub !== "string" || !UUID.test(claims.sub)) bad("sub");
+    if (typeof claims.tid !== "string" || !UUID.test(claims.tid)) bad("tid");
     const aud = claims.aud;
     if (!(typeof aud === "string" || Array.isArray(aud) && aud.length > 0 && aud.every((a) => typeof a === "string"))) bad("aud");
     for (const name of ["exp", "iat", "nbf"]) if (claims[name] !== void 0 && !Number.isInteger(claims[name])) bad(name);
@@ -2167,13 +1941,13 @@ async function verifyToken(from, options = {}) {
   return createTokenVerifier(options)(from);
 }
 async function createVerifierFromEnv(options = {}) {
-  const text2 = options.key ?? env2("CAUTHY_KEY");
-  if (text2 === void 0 || text2 === "") return createTokenVerifier(options);
+  const text = options.key ?? env2("CAUTHY_KEY");
+  if (text === void 0 || text === "") return createTokenVerifier(options);
   refuseBesideKey(typeof process !== "undefined" ? process.env : void 0);
   for (const name of ["issuer", "audience", "tenantId"]) {
     if (options[name] !== void 0) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`);
   }
-  const key = parseKey(text2);
+  const key = parseKey(text);
   const system = createSystem({ issuer: key.issuer, clientId: key.clientId, signer: { clientId: key.clientId, signer: deriveFromKey(key).signer }, fetch: options.fetch });
   const id = await createIdentity({ issuer: key.issuer, token: () => system.token(), fetch: deadline(options.fetch, KEYS_TIMEOUT_MS) }).ready();
   const { key: _, ...rest } = options;
@@ -2270,9 +2044,18 @@ function redirect(location, cookies = []) {
 function conditionalOf(c) {
   return { resource: String(c?.resource ?? ""), action: String(c?.action ?? ""), effect: c?.effect === "deny" ? "deny" : "allow" };
 }
+function refuseContracts(given) {
+  const options = given;
+  const set = [
+    ...["contract", "keys", "rootKey", "rootKeyPrevious"].filter((name) => options[name] !== void 0).map((name) => `the ${name} option`),
+    ...["PACT_ROOT_KEY", "PACT_ROOT_KEY_PREVIOUS"].filter((name) => (env3(name) ?? "") !== "")
+  ];
+  if (set.length === 0) return;
+  throw new CauthyConfigError(`contracts are retired: run on CAUTHY_KEY alone, and remove ${set.join(", ")}. An application without a key makes it on its card in Cauthy's dashboard; the same key keeps its people signed in. Protect sign-in with the "Protect sign-in" switches on that card. Sessions sealed with PACT_ROOT_KEY are no longer read.`);
+}
 function byKey(given) {
-  const text2 = given.key ?? env3("CAUTHY_KEY");
-  if (text2 === void 0 || text2 === "") return void 0;
+  const text = given.key ?? env3("CAUTHY_KEY");
+  if (text === void 0 || text === "") return void 0;
   refuseBesideKey(typeof process !== "undefined" ? process.env : void 0);
   for (const [name, value] of [
     ["issuer", given.issuer],
@@ -2283,12 +2066,11 @@ function byKey(given) {
     ["tenant", given.tenant],
     ["audience", given.audience],
     ["tenantId", given.tenantId],
-    ["systemKey", given.systemKey],
-    ["rootKey", given.rootKey]
+    ["systemKey", given.systemKey]
   ]) {
     if (value !== void 0) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`);
   }
-  const key = parseKey(text2);
+  const key = parseKey(text);
   const prevText = given.keyPrevious ?? env3("CAUTHY_KEY_PREVIOUS");
   let previous;
   if (prevText) {
@@ -2303,13 +2085,8 @@ function byKey(given) {
     throw new CauthyKeyError("key_previous_mismatch", "CAUTHY_KEY_PREVIOUS names another Cauthy or client than CAUTHY_KEY");
   }
   const legacySecret = env3("CAUTHY_SECRET") || void 0;
-  const legacyRoot = env3("PACT_ROOT_KEY") || void 0;
   if (legacySecret) deprecated("CAUTHY_SECRET beside CAUTHY_KEY", "It is read only for sessions made before the move: remove it after the rotation window.");
-  if (legacyRoot) deprecated("PACT_ROOT_KEY beside CAUTHY_KEY", "It is read only for sessions made before the move: remove it, the keys option and its table after the rotation window.");
-  if (given.keys && !(legacyRoot && given.contract)) {
-    throw new CauthyConfigError("with CAUTHY_KEY the application keeps no key store: remove keys (it is read only beside PACT_ROOT_KEY and a contract, while moving)");
-  }
-  return { key, previous, legacySecret, legacyRoot };
+  return { key, previous, legacySecret };
 }
 var UnknownOriginError = class extends Error {
   constructor(origin, registered) {
@@ -2320,72 +2097,41 @@ var UnknownOriginError = class extends Error {
   origin;
   registered;
 };
-function contractOnKey(given, keyed) {
-  const contract = readContract(given.contract);
-  if (contract.issuer !== keyed.key.issuer) {
-    throw new CauthyKeyError("key_contract_issuer", `the key names ${keyed.key.issuer}, and the contract's Cauthy is ${contract.issuer}: make the key in that Cauthy's dashboard`);
-  }
-  return contract;
-}
-function byContract(given) {
-  failClosed(typeof process !== "undefined" ? process.env : void 0);
-  for (const [name, value] of [
-    ["clientId", given.clientId],
-    ["clientSecret", given.clientSecret],
-    ["secret", given.secret],
-    ["system", given.system],
-    ["tenant", given.tenant],
-    ["systemKey", given.systemKey]
-  ]) {
-    if (value !== void 0) throw new CauthyConfigError(`with a contract, ${name} comes from the contract: do not pass it`);
-  }
-  const contract = readContract(given.contract);
-  const root = given.rootKey ?? env3("PACT_ROOT_KEY") ?? "";
-  if (root === "") throw new CauthyConfigError("rootKey (PACT_ROOT_KEY) is required with a contract: 32 random bytes, e.g. openssl rand -base64 32");
-  if (contract.serviceClientId && !given.keys) {
-    throw new CauthyConfigError(`the link ${contract.link} gives ${contract.system} its own identity: pass keys, where its key is kept (@cauthyhq/node/keys)`);
-  }
-  deprecated("PACT_ROOT_KEY", "Make the application's CAUTHY_KEY in Cauthy's dashboard (the application's card), then remove PACT_ROOT_KEY, the keys option and its table.");
-  return { contract, root, previous: given.rootKeyPrevious ?? env3("PACT_ROOT_KEY_PREVIOUS") };
-}
 var toldOfHeader = false;
+var toldOfUnopened = false;
+function toldUnopened() {
+  if (toldOfUnopened) return;
+  toldOfUnopened = true;
+  console.warn("@cauthyhq/node: a session cookie arrived that no key of this application opens; it was cleared and the person is signed out. Moving to CAUTHY_KEY, keep the secret that sealed the old sessions (CAUTHY_SECRET) beside it for the rotation window; rotating the key, set CAUTHY_KEY_PREVIOUS.");
+}
 function createCauthy(given = {}) {
+  refuseContracts(given);
   const keyed = byKey(given);
-  const pacted = given.contract && !keyed ? byContract(given) : void 0;
-  const contract = keyed && given.contract ? contractOnKey(given, keyed) : pacted?.contract;
-  const issuer = withoutTrailingSlashes(keyed?.key.issuer ?? given.issuer ?? contract?.issuer ?? env3("CAUTHY_ISSUER") ?? "");
-  const clientId = contract?.clientId ?? keyed?.key.clientId ?? given.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
-  const clientSecret = contract || keyed ? void 0 : given.clientSecret ?? env3("CAUTHY_CLIENT_SECRET");
-  const secret = contract || keyed ? "" : given.secret ?? env3("CAUTHY_SECRET") ?? "";
-  const askSelf = keyed !== void 0 && contract === void 0;
-  const system = askSelf ? "" : contract?.system ?? given.system ?? env3("CAUTHY_SYSTEM") ?? "";
-  const tenant = askSelf ? "" : contract?.tenant ?? given.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const issuer = withoutTrailingSlashes(keyed?.key.issuer ?? given.issuer ?? env3("CAUTHY_ISSUER") ?? "");
+  const clientId = keyed?.key.clientId ?? given.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = keyed ? void 0 : given.clientSecret ?? env3("CAUTHY_CLIENT_SECRET");
+  const secret = keyed ? "" : given.secret ?? env3("CAUTHY_SECRET") ?? "";
+  const system = keyed ? "" : given.system ?? env3("CAUTHY_SYSTEM") ?? "";
+  const tenant = keyed ? "" : given.tenant ?? env3("CAUTHY_TENANT") ?? "";
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
-  if (!contract && !keyed && secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  if (!keyed && secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
   const fromKey = keyed ? deriveFromKey(keyed.key, keyed.previous) : void 0;
   let signingKid;
   fromKey?.signer.then((s) => {
     signingKid = s.kid;
   }, () => void 0);
-  const derived = pacted ? deriveKeys(pacted.root, pacted.previous) : void 0;
-  const single = derived || fromKey ? void 0 : keyOf(secret).then((k) => [k]);
-  const legacyRings = keyed?.legacyRoot ? deriveKeys(keyed.legacyRoot) : void 0;
   const legacySingle = keyed?.legacySecret ? keyOf(keyed.legacySecret) : void 0;
-  const withLegacy = async (own, purpose) => [
-    ...await own,
-    ...legacyRings ? [(await legacyRings[purpose])[0]] : [],
-    ...legacySingle ? [await legacySingle] : []
-  ];
-  const cookieKeys = fromKey ? withLegacy(fromKey.cookie, "cookie") : derived?.cookie ?? single;
-  const flowKeys = fromKey ? withLegacy(fromKey.flow, "flow") : derived?.flow ?? single;
-  if (!keyed && !pacted) {
+  const withLegacy = async (own) => [...await own, ...legacySingle ? [await legacySingle] : []];
+  const single = fromKey ? Promise.resolve([]) : keyOf(secret).then((k) => [k]);
+  const cookieKeys = fromKey ? withLegacy(fromKey.cookie) : single;
+  const flowKeys = fromKey ? withLegacy(fromKey.flow) : single;
+  if (!keyed) {
     deprecated(
       "Configuring with CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET, CAUTHY_SECRET and the other CAUTHY_* variables (or their options)",
       "Connect the application in Cauthy's dashboard and use the one variable CAUTHY_KEY."
     );
   }
-  const ownKeys = derived && given.keys ? pactKeys(given.keys, derived.seal) : legacyRings && contract && given.keys ? pactKeys(given.keys, legacyRings.seal) : void 0;
   const baseURL = given.baseURL ?? (keyed ? void 0 : env3("CAUTHY_BASE_URL"));
   if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
     throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
@@ -2422,21 +2168,10 @@ function createCauthy(given = {}) {
     acceptInviteUrl,
     fetch: given.fetch,
     timeoutMs: systemTimeout,
-    ...ownKeys ? { keys: ownKeys, keysClientId: contract?.serviceClientId } : {},
-    // With a contract the key proves the link's service client; without, the key's own client.
-    ...fromKey ? {
-      signer: { clientId: contract ? contract.serviceClientId ?? keyed.key.clientId : clientId, signer: fromKey.signer },
-      currentSystem: () => identity?.current()?.system ?? ""
-    } : {}
+    // On CAUTHY_KEY the key proves the key's own client.
+    ...fromKey ? { signer: { clientId, signer: fromKey.signer }, currentSystem: () => identity?.current()?.system ?? "" } : {}
   });
-  const selfOptions = () => ({
-    issuer,
-    token: () => ownSystem.token(),
-    fetch: deadline(given.fetch, requestTimeout),
-    kid: () => signingKid,
-    log: (m) => console.error(`@cauthyhq/node: ${m}`)
-  });
-  const identity = askSelf ? createIdentity({
+  const identity = keyed ? createIdentity({
     issuer,
     token: () => ownSystem.token(),
     fetch: deadline(given.fetch, requestTimeout),
@@ -2446,6 +2181,8 @@ function createCauthy(given = {}) {
   identity?.ready().catch(() => {
   });
   const tenantNow = () => identity?.current()?.tenant.slug ?? tenant;
+  const signInClientNow = () => identity?.current()?.sign_in_client_id || clientId;
+  const signInClient = async () => identity ? (await identity.ready()).sign_in_client_id || clientId : clientId;
   const systemNow = () => identity?.current()?.system ?? system;
   const requestOrigin = (request) => {
     const url = new URL(request.url);
@@ -2470,7 +2207,7 @@ function createCauthy(given = {}) {
   };
   const attrs = (request, maxAge) => ({ secure: safeOrigin(request).startsWith("https://"), maxAge });
   async function clientAuth(form) {
-    if (fromKey && !contract) {
+    if (fromKey && form.get("client_id") === clientId) {
       const s = await fromKey.signer;
       form.set("client_assertion_type", ASSERTION_TYPE2);
       form.set("client_assertion", await s.assertion(clientId, `${issuer}/v1/oauth/token`));
@@ -2480,8 +2217,8 @@ function createCauthy(given = {}) {
     return form;
   }
   async function token(form, proof = {}) {
-    const body2 = await clientAuth(new URLSearchParams({ client_id: clientId, ...form }));
     try {
+      const body2 = await clientAuth(new URLSearchParams({ client_id: await signInClient(), ...form }));
       const res = await doFetch(`${issuer}/v1/oauth/token`, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", ...proof },
@@ -2519,18 +2256,16 @@ function createCauthy(given = {}) {
   }
   const kindOf = (body2, was) => (typeof body2?.persistent === "boolean" ? body2.persistent : was?.p === 1) ? { p: 1 } : {};
   async function revoke(refreshToken) {
-    const form = await clientAuth(new URLSearchParams({ client_id: clientId, token: refreshToken }));
-    await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
+    try {
+      const form = await clientAuth(new URLSearchParams({ client_id: await signInClient(), token: refreshToken }));
+      await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    } catch {
+    }
   }
-  const unverified = (u) => contract?.requireVerifiedEmail === true && !u.emailVerified;
   async function stored(body2, was) {
     if (typeof body2?.access_token !== "string" || typeof body2?.refresh_token !== "string") return null;
     const who = await userinfo(body2.access_token);
     if (who === null || who.u.id === "") return null;
-    if (unverified(who.u)) {
-      await revoke(body2.refresh_token);
-      throw new CauthyApiError(403, "email_not_confirmed", "Confirm your email address first.");
-    }
     const lifetime = typeof body2.expires_in === "number" && body2.expires_in > 0 ? body2.expires_in : 300;
     return { at: body2.access_token, rt: body2.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime, ...who, ...kindOf(body2, was) };
   }
@@ -2540,10 +2275,11 @@ function createCauthy(given = {}) {
   async function read(request) {
     const had = readCookies(request.headers.get("cookie"));
     const raw = readParts(had, cookieName);
-    if (raw === null) return { had, value: null, present: false };
-    const value = await unsealAny(raw, await cookieKeys);
+    if (raw === null) return { had, value: null, present: false, stale: false };
+    const opened = await unsealIndexed(raw, await cookieKeys);
+    const value = opened?.value ?? null;
     const sound = value !== null && typeof value.at === "string" && typeof value.rt === "string" && typeof value.exp === "number";
-    return { had, value: sound ? value : null, present: true };
+    return { had, value: sound ? value : null, present: true, stale: sound && opened.index > 0 };
   }
   async function write(request, s, had) {
     return writeParts(cookieName, await seal(s, (await cookieKeys)[0]), attrs(request, s.p === 1 ? PERSISTENT_SECONDS : void 0), had);
@@ -2557,13 +2293,7 @@ function createCauthy(given = {}) {
       running = (async () => {
         const res = await token({ grant_type: "refresh_token", refresh_token: rt });
         if (!res.ok) return res.ended ? "ended" : "unreachable";
-        let next;
-        try {
-          next = await stored(res.body, was);
-        } catch (err) {
-          if (err instanceof CauthyApiError && err.code === "email_not_confirmed") return "ended";
-          throw err;
-        }
+        const next = await stored(res.body, was);
         if (next !== null) return next;
         if (typeof res.body?.access_token !== "string" || typeof res.body?.refresh_token !== "string") return "unreachable";
         const lifetime = typeof res.body.expires_in === "number" && res.body.expires_in > 0 ? res.body.expires_in : 300;
@@ -2580,12 +2310,12 @@ function createCauthy(given = {}) {
     return running;
   }
   async function resolve2(request) {
-    const { had, value, present } = await read(request);
+    const { had, value, present, stale } = await read(request);
     if (value === null) {
+      if (present) toldUnopened();
       return { session: null, status: "unauthenticated", cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] };
     }
-    if (unverified(value.u)) return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
-    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: [] };
+    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: stale ? await write(request, value, had) : [] };
     const renewed = await renew(value);
     if (renewed === "ended") {
       return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
@@ -2596,7 +2326,7 @@ function createCauthy(given = {}) {
   async function getSession(request, responseHeaders) {
     if (responseHeaders === void 0) {
       const { value } = await read(request);
-      return value !== null && fresh(value) && !unverified(value.u) ? toSession(value) : null;
+      return value !== null && fresh(value) ? toSession(value) : null;
     }
     const r = await resolve2(request);
     for (const c of r.cookies) responseHeaders.append("set-cookie", c);
@@ -2604,7 +2334,7 @@ function createCauthy(given = {}) {
   }
   async function status(request) {
     const { value } = await read(request);
-    if (value === null || unverified(value.u)) return "unauthenticated";
+    if (value === null) return "unauthenticated";
     return fresh(value) ? "authenticated" : "expired";
   }
   const orgCache = /* @__PURE__ */ new Map();
@@ -2691,7 +2421,7 @@ function createCauthy(given = {}) {
     const flow = { state: random(), verifier: random(48), returnTo: localPath(url.searchParams.get("return_to"), afterSignIn) };
     const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(flow.verifier))));
     const q = new URLSearchParams({
-      client_id: clientId,
+      client_id: await signInClient(),
       redirect_uri: `${originOf(request)}${basePath}/callback`,
       response_type: "code",
       state: flow.state,
@@ -2753,28 +2483,17 @@ function createCauthy(given = {}) {
       );
     };
     if (!res.ok && res.code === "email_not_confirmed") return unconfirmed();
-    let s;
-    try {
-      s = res.ok ? await stored(res.body) : null;
-    } catch (err) {
-      if (!(err instanceof CauthyApiError && err.code === "email_not_confirmed")) throw err;
-      return unconfirmed();
-    }
+    const s = res.ok ? await stored(res.body) : null;
     if (s === null) return failed(request, "exchange_failed");
     return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0)), writeCookie(againCookie, "", attrs(request, 0))]);
   }
   async function logout(request) {
     const { had, value } = await read(request);
     if (value !== null) {
-      const body2 = await clientAuth(new URLSearchParams({ client_id: clientId, token: value.rt }));
-      await doFetch(`${issuer}/v1/oauth/revoke`, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: body2
-      }).catch(() => void 0);
+      await revoke(value.rt);
       orgCache.delete(value.at);
     }
-    const q = new URLSearchParams({ client_id: clientId, post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` });
+    const q = new URLSearchParams({ client_id: signInClientNow(), post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` });
     return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had));
   }
   const STEP_SECONDS = 600;
@@ -2792,7 +2511,7 @@ function createCauthy(given = {}) {
     createdAt: String(d?.created_at ?? ""),
     lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
   });
-  const UUID3 = /^[0-9a-f-]{36}$/i;
+  const UUID2 = /^[0-9a-f-]{36}$/i;
   const seatOf = (d) => ({
     id: String(d?.id ?? ""),
     system: String(d?.system ?? ""),
@@ -2897,10 +2616,10 @@ function createCauthy(given = {}) {
           ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}` } : { "x-cauthy-links": "hosted" },
           // Whose request it is: what Cauthy mails goes in this application's
           // name, under its logo.
-          ...clientId ? { "x-cauthy-client-id": clientId } : {},
+          ...signInClientNow() ? { "x-cauthy-client-id": signInClientNow() } : {},
           ...await passedOn(request),
           ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
-          // The person asked to stay signed in: Cauthy keeps the session long if the client allows it.
+          // The person asked to stay signed in: Cauthy keeps the session long if the workspace allows it.
           ...remember ? { "x-cauthy-remember": "1" } : {},
           // The answer to the workspace's Turnstile challenge, from the
           // person's browser: Cauthy checks it at the doors that ask for it.
@@ -3041,7 +2760,7 @@ function createCauthy(given = {}) {
     }
     if (route === "/look" && !post) {
       if (lookCache === null || lookCache.until < Date.now()) {
-        const res = await ask(request, "GET", `/v1/auth/look/${encodeURIComponent(clientId)}`);
+        const res = await ask(request, "GET", `/v1/auth/look/${encodeURIComponent(signInClientNow())}`);
         lookCache = { until: Date.now() + LOOK_TTL_MS, look: res.error ? {} : res.data ?? {} };
       }
       return json(lookCache.look);
@@ -3066,7 +2785,7 @@ function createCauthy(given = {}) {
         signUp: settings.data?.allow_signup !== false && settings.data?.signup?.mode !== "invite_only",
         // The application's system makes an organization per sign-up: the form asks the company's name.
         ...settings.data?.signup?.organization?.ask === true ? { organization: { ask: true, required: settings.data.signup.organization.required === true } } : {},
-        // Whether the person may ask to stay signed in: the client's choice in Cauthy.
+        // Whether the person may ask to stay signed in: the workspace's setting in Cauthy (persistent_sessions).
         ...typeof settings.data?.persistent_sessions === "boolean" ? { persistentSessions: settings.data.persistent_sessions } : {},
         // A sign-in link needs a page of the application to open.
         magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
@@ -3230,7 +2949,7 @@ function createCauthy(given = {}) {
       let path = "/v1/auth/me/organizations";
       if (route !== "/me/organizations") {
         const id = url.searchParams.get("id") ?? "";
-        if (!UUID3.test(id)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        if (!UUID2.test(id)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
         path += `/${id}/${route.endsWith("/roles") ? "roles" : "members"}`;
       } else if (url.searchParams.get("system")) {
         path += `?system=${encodeURIComponent(url.searchParams.get("system"))}`;
@@ -3291,8 +3010,7 @@ function createCauthy(given = {}) {
     if (route === "/sign-out") {
       const { had, value } = await read(request);
       if (value !== null) {
-        const form = await clientAuth(new URLSearchParams({ client_id: clientId, token: value.rt }));
-        await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
+        await revoke(value.rt);
         orgCache.delete(value.at);
       }
       const h = new Headers();
@@ -3519,7 +3237,7 @@ function createCauthy(given = {}) {
       }
       if (route === "/me/organizations/rename" || route === "/me/organizations/archive" || route === "/me/organizations/delete") {
         const org = typeof b.organizationId === "string" ? b.organizationId : "";
-        if (!UUID3.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        if (!UUID2.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
         const path = `/v1/auth/me/organizations/${org}`;
         if (route === "/me/organizations/rename") {
           const bad = checkOrganizationName(b.name);
@@ -3536,7 +3254,7 @@ function createCauthy(given = {}) {
       }
       if (route.startsWith("/me/organizations/members/")) {
         const org = typeof b.organizationId === "string" ? b.organizationId : "";
-        if (!UUID3.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        if (!UUID2.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
         const base = `/v1/auth/me/organizations/${org}/members`;
         if (route === "/me/organizations/members/add") {
           const bad = checkEmail(b.email);
@@ -3547,7 +3265,7 @@ function createCauthy(given = {}) {
             email: String(b.email).trim(),
             role,
             name: typeof b.name === "string" ? b.name.trim() : "",
-            client_id: clientId,
+            client_id: signInClientNow(),
             only_new: true,
             ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {}
           }, pages.acceptInvite, mine.token);
@@ -3556,7 +3274,7 @@ function createCauthy(given = {}) {
           return json({ status: "added", member: orgMemberOf(res.data) }, 200, mine.headers);
         }
         const user = typeof b.userId === "string" ? b.userId : "";
-        if (!UUID3.test(user)) return problem(400, "invalid_member", "Say which member.", void 0, mine.headers);
+        if (!UUID2.test(user)) return problem(400, "invalid_member", "Say which member.", void 0, mine.headers);
         if (route === "/me/organizations/members/role") {
           const role = typeof b.role === "string" ? b.role : "";
           if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
@@ -3571,7 +3289,7 @@ function createCauthy(given = {}) {
           return json({ status: "removed", userId: user }, 200, mine.headers);
         }
         if (route === "/me/organizations/members/invite") {
-          const res = await ask(request, "POST", `${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} }, pages.acceptInvite, mine.token);
+          const res = await ask(request, "POST", `${base}/${user}/invite`, { client_id: signInClientNow(), ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} }, pages.acceptInvite, mine.token);
           if (res.error) return refused(res);
           return json({ status: "sent", userId: user }, 200, mine.headers);
         }
@@ -3689,18 +3407,15 @@ function createCauthy(given = {}) {
     const url = new URL(request.url);
     const inside = url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);
     const route = inside ? withoutTrailingSlashes(url.pathname.slice(basePath.length)) || "/" : null;
-    const published3 = pact !== void 0 && url.pathname === contract?.jwksPath && (request.method === "GET" || request.method === "HEAD");
     if (identity && route !== null) {
       const unready = await identityGate();
       if (unready) return finish(unready, route);
     }
     try {
-      return finish(await serve(request), route, published3);
+      return finish(await serve(request), route);
     } catch (err) {
       if (err instanceof UnknownOriginError) return finish(problem(400, "unknown_origin", err.message), route);
-      if (!(err instanceof CauthyApiError && err.code === "email_not_confirmed")) throw err;
-      const wantsPage = request.method === "GET" && (request.headers.get("sec-fetch-mode") ?? "navigate") === "navigate";
-      return finish(wantsPage ? new Response("Sign-in refused (email_not_confirmed). Confirm your email address first.", { status: 403, headers: { "content-type": "text/plain; charset=utf-8" } }) : problem(403, "email_not_confirmed", "Confirm your email address first."), route);
+      throw err;
     }
   }
   async function identityGate() {
@@ -3724,7 +3439,6 @@ function createCauthy(given = {}) {
   }
   async function serve(request) {
     const url = new URL(request.url);
-    if (pact && url.pathname === contract?.jwksPath && (request.method === "GET" || request.method === "HEAD")) return pact.jwks();
     if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response("Not found", { status: 404 });
     const route = withoutTrailingSlashes(url.pathname.slice(basePath.length)) || "/";
     const get = request.method === "GET" || request.method === "HEAD";
@@ -3748,7 +3462,7 @@ function createCauthy(given = {}) {
       return redirect(back, r.cookies);
     }
     if (route === "/account" && get) {
-      const q = new URLSearchParams({ client_id: clientId });
+      const q = new URLSearchParams({ client_id: signInClientNow() });
       const back = localPath(url.searchParams.get("return_to"), "");
       if (back !== "") q.set("return_to", `${originOf(request)}${back}`);
       const locale = url.searchParams.get("locale");
@@ -3767,7 +3481,7 @@ function createCauthy(given = {}) {
     const asker = await signedInAs(request);
     if ("response" in asker) return asker.response;
     const org = typeof b.organizationId === "string" ? b.organizationId : "";
-    if (!UUID3.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, asker.headers);
+    if (!UUID2.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, asker.headers);
     const named = (v) => typeof v === "string" && v !== "" && v.length <= 200;
     if (!named(b.resource) || !named(b.action)) return problem(400, "bad_request", "Say which resource and action.", void 0, asker.headers);
     const attributes2 = b.attributes;
@@ -3790,8 +3504,7 @@ function createCauthy(given = {}) {
     }
   }
   async function protect(request) {
-    const read1 = await read(request);
-    const value = read1.value !== null && unverified(read1.value.u) ? null : read1.value;
+    const { value } = await read(request);
     if (value !== null && fresh(value)) return { session: toSession(value) };
     const url = new URL(request.url);
     const state = value === null ? "none" : "expired";
@@ -3804,85 +3517,36 @@ function createCauthy(given = {}) {
     return { response: redirect(to) };
   }
   const replay = given.webhookReplay ?? memoryReplayStore();
-  let lateSelf;
   const tokenVerifier = (o = {}) => {
-    if (keyed) {
-      if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
-        throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
-      }
+    if (identity) {
       let built;
       return async (from) => {
-        const id = await (identity ?? (lateSelf ??= createIdentity(selfOptions()))).ready();
+        const id = await identity.ready();
         if (built?.from !== id) {
-          built = { from: id, verify: createTokenVerifier({
-            issuer,
-            tenantId: contract?.tenantId ?? id.tenant.id,
-            audience: id.audience,
-            fetch: given.fetch,
-            ...contract ? { clientId: contract.clientId } : {},
-            ...o
-          }) };
+          built = { from: id, verify: createTokenVerifier({ issuer, tenantId: id.tenant.id, audience: id.audience, fetch: given.fetch, ...o }) };
         }
         return built.verify(from);
       };
     }
-    if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
-      throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
-    }
     return createTokenVerifier({
       issuer,
-      tenantId: contract?.tenantId ?? given.tenantId,
+      tenantId: given.tenantId,
       audience: given.audience,
       fetch: given.fetch,
-      ...contract ? { clientId: contract.clientId } : {},
       ...o
     });
   };
   const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay });
-  async function keyJwks() {
-    const s = await fromKey.signer;
-    const keys2 = [{ ...s.publicJwk, kid: s.kid, alg: "EdDSA", use: "sig" }];
-    if (fromKey.previousJwk) keys2.push({ ...await fromKey.previousJwk, alg: "EdDSA", use: "sig" });
-    if (ownKeys) keys2.push(...(await ownKeys.published()).keys);
-    return new Response(JSON.stringify({ keys: keys2 }), {
-      headers: { "content-type": "application/json; charset=utf-8", "cache-control": `public, max-age=${JWKS_MAX_AGE_S}` }
-    });
-  }
-  const noStore = () => {
-    throw new CauthyConfigError("on CAUTHY_KEY the application keeps no key of its own: make a new key on the application's card in Cauthy's dashboard");
-  };
-  const keyOnly = {
-    current: async () => noStore(),
-    published: async () => ({ keys: [] }),
-    rotate: async () => noStore(),
-    reseal: async () => 0
-  };
-  const pact = contract && fromKey ? {
-    contract,
-    keys: ownKeys ?? keyOnly,
-    jwks: keyJwks,
-    status: () => ownSystem.request("GET", `/v1/pact/status?system=${encodeURIComponent(contract.system)}`)
-  } : contract && ownKeys ? {
-    contract,
-    keys: ownKeys,
-    async jwks() {
-      return new Response(JSON.stringify(await ownKeys.published()), {
-        headers: { "content-type": "application/json; charset=utf-8", "cache-control": `public, max-age=${JWKS_MAX_AGE_S}` }
-      });
-    },
-    status: () => ownSystem.request("GET", `/v1/pact/status?system=${encodeURIComponent(contract.system)}`)
-  } : void 0;
   const configured = () => ({
     issuer,
     audience: given.audience ?? env3("CAUTHY_AUDIENCE") ?? "",
-    tenant: { id: contract?.tenantId ?? given.tenantId ?? env3("CAUTHY_TENANT_ID") ?? "", slug: tenant },
+    tenant: { id: given.tenantId ?? env3("CAUTHY_TENANT_ID") ?? "", slug: tenant },
     system,
     client_id: clientId,
     sign_in_client_id: clientId,
     app_urls: baseURL ? [withoutTrailingSlashes(baseURL)] : [],
     callback_path: `${basePath}/callback`,
-    key: null,
-    contract: contract ? { link: contract.link, system_proof: contract.systemProof, require_verified_email: contract.requireVerifiedEmail } : null
+    key: null
   });
   return {
     handler,
@@ -3904,7 +3568,6 @@ function createCauthy(given = {}) {
     check,
     toPublic,
     urls,
-    ...pact ? { pact } : {},
     options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
   };
 }
@@ -3988,7 +3651,6 @@ export {
   KEY_REPLACES,
   MIN_PASSWORD,
   PROTOCOL_VERSION,
-  STANDARD_VARIABLES,
   can,
   checkCode,
   checkEmail,
@@ -4004,7 +3666,6 @@ export {
   definePolicy,
   describePasswordPolicy,
   explainPasswordProblems,
-  failClosed,
   memoryReplayStore,
   parseKey,
   passwordPolicyOf,
@@ -4015,7 +3676,6 @@ export {
   pushCatalog,
   pushPolicy,
   pushTheme,
-  readContract,
   remoteKeys,
   themeFromStackmyth,
   tokensFromStackmyth,