cauthy-auth 0.2.0 → 0.4.0

package/dist/index.js

@@ -20,10 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  CauthyApiError: () => CauthyApiError,
   CauthyConfigError: () => CauthyConfigError,
   CauthyWebhookError: () => CauthyWebhookError,
   can: () => can,
+  connectSystem: () => connectSystem,
   createCauthy: () => createCauthy,
+  createSystem: () => createSystem,
   pushPolicy: () => pushPolicy,
   pushTheme: () => pushTheme,
   themeFromStackmyth: () => themeFromStackmyth,
@@ -87,8 +90,436 @@ async function unseal(sealed, key) {
   }
 }
 
-// src/webhook.ts
+// src/system.ts
 var import_jose2 = require("jose");
+
+// src/theme.ts
+var MAX_RADIUS = 40;
+function declarations(css) {
+  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
+  const out2 = [];
+  const within = [];
+  let chunk = "";
+  let quote = "";
+  let depth = 0;
+  const flush = () => {
+    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
+    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
+    chunk = "";
+  };
+  for (const ch of text) {
+    if (quote) {
+      chunk += ch;
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      chunk += ch;
+    } else if (ch === "(") {
+      depth++;
+      chunk += ch;
+    } else if (ch === ")") {
+      depth = Math.max(0, depth - 1);
+      chunk += ch;
+    } else if (ch === "{" && depth === 0) {
+      within.push(chunk.trim().replace(/\s+/g, " "));
+      chunk = "";
+    } else if (ch === "}" && depth === 0) {
+      flush();
+      within.pop();
+    } else if (ch === ";" && depth === 0) {
+      flush();
+    } else {
+      chunk += ch;
+    }
+  }
+  return out2;
+}
+var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
+var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
+var NAMED = /data-theme=["']?([\w-]+)/i;
+function applies(d, o) {
+  for (const scope of d.within) {
+    if (o.mode === "light" && DARK.test(scope)) return false;
+    if (o.mode === "dark" && LIGHT.test(scope)) return false;
+    const named = NAMED.exec(scope);
+    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
+  }
+  return true;
+}
+function resolve(value, vars, seen = 0) {
+  if (seen > 16) return null;
+  let unresolved = false;
+  let out2 = value;
+  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
+    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+      const known = vars.get(name);
+      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
+      if (next === null) unresolved = true;
+      return next ?? "";
+    });
+    if (unresolved) return null;
+  }
+  return /var\(/.test(out2) ? null : out2.trim();
+}
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
+var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
+function out(r, g, b, a = 1) {
+  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
+  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
+}
+var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
+var KEYWORDS = { white: "#ffffff", black: "#000000" };
+function toColor(value) {
+  const v = value.trim().toLowerCase();
+  if (KEYWORDS[v]) return KEYWORDS[v];
+  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
+  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
+    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
+  }
+  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const h = (parseFloat(m[1]) % 360 + 360) % 360;
+    const s = parseFloat(m[2]) / 100;
+    const l = parseFloat(m[3]) / 100;
+    const f = (n) => {
+      const k = (n + h / 30) % 12;
+      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
+    };
+    return out(f(0), f(8), f(4), alpha(m[4]));
+  }
+  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
+    const H = parseFloat(m[3]) * Math.PI / 180;
+    const a = C * Math.cos(H);
+    const b = C * Math.sin(H);
+    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
+    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
+    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
+    return out(
+      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
+      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
+      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
+      alpha(m[4])
+    );
+  }
+  return null;
+}
+function toRadius(value) {
+  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
+  if (!m) return null;
+  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
+  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
+}
+function toFont(value) {
+  const v = value.trim();
+  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
+}
+var COLORS = [
+  ["background", ["--sm-bg-surface", "--sm-surface"]],
+  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
+  ["text", ["--sm-text-primary", "--sm-surface-text"]],
+  ["textMuted", ["--sm-text-secondary"]],
+  ["border", ["--sm-border-default", "--sm-surface-border"]],
+  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
+  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
+  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
+  ["error", ["--sm-error-soft-text", "--sm-error"]],
+  ["errorBackground", ["--sm-error-soft"]],
+  ["success", ["--sm-success-soft-text", "--sm-success"]],
+  ["successBackground", ["--sm-success-soft"]]
+];
+function themeFromStackmyth(css, options = {}) {
+  const o = { mode: options.mode ?? "light", theme: options.theme };
+  const vars = /* @__PURE__ */ new Map();
+  for (const sheet of Array.isArray(css) ? css : [css]) {
+    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
+  }
+  const theme = {};
+  const warnings = [];
+  const read = (tokens, to, what) => {
+    for (const token of tokens) {
+      const raw = vars.get(token);
+      if (raw === void 0) continue;
+      const value = resolve(raw, vars);
+      const got = value === null ? null : to(value);
+      if (got !== null) return got;
+      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
+    }
+    return void 0;
+  };
+  for (const [field, tokens] of COLORS) {
+    const c = read(tokens, toColor, "a colour");
+    if (c !== void 0) theme[field] = c;
+  }
+  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
+  if (radius !== void 0) theme.radius = radius;
+  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
+  if (button !== void 0) theme.buttonRadius = button;
+  const font = read(["--sm-font-family"], toFont, "a font list");
+  if (font !== void 0) theme.fontFamily = font;
+  if (options.logoUrl) theme.logoUrl = options.logoUrl;
+  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
+  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
+  return { theme, warnings };
+}
+function toWire(theme) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    textMuted: "text_muted",
+    border: "border",
+    primary: "primary",
+    primaryText: "primary_text",
+    accent: "accent",
+    error: "error",
+    errorBackground: "error_background",
+    success: "success",
+    successBackground: "success_background",
+    radius: "radius",
+    buttonRadius: "button_radius",
+    fontFamily: "font_family",
+    logoUrl: "logo_url",
+    fonts: "fonts"
+  };
+  const wire = {};
+  for (const [k, v] of Object.entries(theme)) {
+    if (v === void 0 || v === "" || Array.isArray(v) && v.length === 0) continue;
+    wire[names[k]] = v;
+  }
+  return wire;
+}
+function fromWire(wire) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    text_muted: "textMuted",
+    border: "border",
+    primary: "primary",
+    primary_text: "primaryText",
+    accent: "accent",
+    error: "error",
+    error_background: "errorBackground",
+    success: "success",
+    success_background: "successBackground",
+    radius: "radius",
+    button_radius: "buttonRadius",
+    font_family: "fontFamily",
+    logo_url: "logoUrl",
+    fonts: "fonts"
+  };
+  const theme = {};
+  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== void 0 && v !== null && v !== "") theme[names[k]] = v;
+  return theme;
+}
+async function pushTheme(o) {
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify(toWire(o.theme))
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`cauthy-auth: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+
+// src/system.ts
+var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var SKEW_MS = 3e4;
+var CauthyApiError = class extends Error {
+  constructor(status, code, message) {
+    super(`cauthy-auth: ${message}`);
+    this.status = status;
+    this.code = code;
+    this.name = "CauthyApiError";
+  }
+  status;
+  code;
+};
+function env(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function toOrganization(o) {
+  return {
+    id: o.id,
+    system: o.system,
+    name: o.name,
+    kind: o.kind,
+    externalId: o.external_id,
+    status: o.status,
+    metadata: o.metadata ?? {},
+    members: o.members,
+    createdAt: o.created_at,
+    updatedAt: o.updated_at
+  };
+}
+function toMember(m) {
+  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...m.invited === void 0 ? {} : { invited: m.invited } };
+}
+function asJwk(k) {
+  if (typeof k.privateKey !== "string") return k.privateKey;
+  return k.privateKey.includes("BEGIN") ? void 0 : JSON.parse(k.privateKey);
+}
+async function loadKey(k) {
+  const jwk = asJwk(k);
+  return jwk ? (0, import_jose2.importJWK)(jwk, "RS256") : (0, import_jose2.importPKCS8)(k.privateKey, "RS256", { extractable: true });
+}
+function createSystem(given = {}) {
+  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
+  const envKey = env("CAUTHY_SYSTEM_KEY");
+  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const tokenEndpoint = `${issuer}/v1/oauth/token`;
+  function configured() {
+    if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
+    if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+    if (key ? key.keyId === "" : clientSecret === "") {
+      throw new CauthyConfigError(key ? "the key needs its id (CAUTHY_SYSTEM_KEY_ID)" : "to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)");
+    }
+  }
+  let imported;
+  const signingKey = () => imported ??= loadKey(key);
+  async function fail(res, what) {
+    const body = await res.json().catch(() => null);
+    const first = body?.errors?.[0];
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  let held;
+  let asking;
+  async function ask() {
+    configured();
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    if (key) {
+      const assertion = await new import_jose2.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      form.set("client_assertion_type", ASSERTION_TYPE);
+      form.set("client_assertion", assertion);
+    } else {
+      form.set("client_secret", clientSecret);
+    }
+    const res = await doFetch(tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    if (!res.ok) await fail(res, "the application's own token");
+    const t = await res.json();
+    held = { value: t.access_token, until: Date.now() + t.expires_in * 1e3 - SKEW_MS };
+    return t.access_token;
+  }
+  function token() {
+    if (held && Date.now() < held.until) return Promise.resolve(held.value);
+    return asking ??= ask().finally(() => {
+      asking = void 0;
+    });
+  }
+  async function call(method, path, body) {
+    const send = async () => doFetch(`${issuer}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    let res = await send();
+    if (res.status === 401 && held) {
+      held = void 0;
+      res = await send();
+    }
+    if (!res.ok) await fail(res, `${method} ${path}`);
+    return res.status === 204 ? void 0 : res.json();
+  }
+  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const id = encodeURIComponent;
+  return {
+    token,
+    request: data,
+    organizations: {
+      async list(query = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(query)) if (v !== void 0) q.set(k, String(v));
+        const out2 = await call("GET", `/v1/organizations${q.size ? `?${q}` : ""}`);
+        return { items: out2.data.map(toOrganization), total: out2.total_count };
+      },
+      async create(input) {
+        return toOrganization(await data(
+          "POST",
+          "/v1/organizations",
+          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }
+        ));
+      },
+      async get(orgId) {
+        return toOrganization(await data("GET", `/v1/organizations/${id(orgId)}`));
+      },
+      async update(orgId, patch) {
+        return toOrganization(await data("PATCH", `/v1/organizations/${id(orgId)}`, patch));
+      },
+      async remove(orgId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}`);
+      }
+    },
+    members: {
+      async list(orgId) {
+        return (await data("GET", `/v1/organizations/${id(orgId)}/members`)).map(toMember);
+      },
+      async add(orgId, m) {
+        return toMember(await data(
+          "POST",
+          `/v1/organizations/${id(orgId)}/members`,
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+        ));
+      },
+      async setRole(orgId, userId, role) {
+        return toMember(await data("PUT", `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }));
+      },
+      async remove(orgId, userId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}/members/${id(userId)}`);
+      }
+    },
+    async invite(person) {
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      return { id: u.id, email: u.email };
+    },
+    theme: {
+      async get(of = clientId) {
+        return fromWire(await data("GET", `/v1/oauth/clients/${id(of)}/theme`));
+      },
+      async set(theme, of = clientId) {
+        if (theme === null) await call("DELETE", `/v1/oauth/clients/${id(of)}/theme`);
+        else await call("PUT", `/v1/oauth/clients/${id(of)}/theme`, toWire(theme));
+      }
+    },
+    async publicJwks() {
+      if (!key) return { keys: [] };
+      const { kty, n, e } = asJwk(key) ?? await (0, import_jose2.exportJWK)(await signingKey());
+      return { keys: [{ kty, n, e, kid: key.keyId, alg: "RS256", use: "sig" }] };
+    }
+  };
+}
+
+// src/webhook.ts
+var import_jose3 = require("jose");
 var CauthyWebhookError = class extends Error {
   constructor(reason) {
     super(`cauthy-auth: webhook refused: ${reason}`);
@@ -101,15 +532,15 @@ var keys = /* @__PURE__ */ new Map();
 function keysOf(issuer) {
   let set = keys.get(issuer);
   if (set === void 0) {
-    set = (0, import_jose2.createRemoteJWKSet)(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
+    set = (0, import_jose3.createRemoteJWKSet)(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
     keys.set(issuer, set);
   }
   return set;
 }
 var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
 async function verifyWebhook(request, options = {}) {
-  const env2 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
-  const issuer = (options.issuer ?? env2 ?? "").replace(/\/+$/, "");
+  const env3 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const issuer = (options.issuer ?? env3 ?? "").replace(/\/+$/, "");
   if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
   const signature = request.headers.get("x-cauthy-signature-jwt");
   if (!signature) throw new CauthyWebhookError("no signature");
@@ -117,7 +548,7 @@ async function verifyWebhook(request, options = {}) {
   const audience = options.url ?? request.url.split("?")[0];
   let claims;
   try {
-    const verified = await (0, import_jose2.jwtVerify)(signature, options.jwks ?? keysOf(issuer), {
+    const verified = await (0, import_jose3.jwtVerify)(signature, options.jwks ?? keysOf(issuer), {
       algorithms: ["RS256"],
       issuer,
       audience,
@@ -158,20 +589,12 @@ async function verifyWebhook(request, options = {}) {
   };
 }
 
-// src/types.ts
-var CauthyConfigError = class extends Error {
-  constructor(message) {
-    super(`cauthy-auth: ${message}`);
-    this.name = "CauthyConfigError";
-  }
-};
-
 // src/cauthy.ts
 var SESSION_DAYS = 30;
 var FLOW_SECONDS = 600;
 var SKEW_SECONDS = 30;
 var ORGANIZATIONS_TTL_MS = 6e4;
-function env(name) {
+function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
 function b64url(bytes) {
@@ -198,11 +621,11 @@ function redirect(location, cookies = []) {
   return new Response(null, { status: 302, headers: h });
 }
 function createCauthy(given = {}) {
-  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
-  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET");
-  const secret = given.secret ?? env("CAUTHY_SECRET") ?? "";
-  const system = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const issuer = (given.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env2("CAUTHY_CLIENT_SECRET");
+  const secret = given.secret ?? env2("CAUTHY_SECRET") ?? "";
+  const system = given.system ?? env2("CAUTHY_SYSTEM") ?? "";
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
@@ -471,6 +894,7 @@ function createCauthy(given = {}) {
   return {
     handler,
     webhook,
+    system: createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch }),
     getSession,
     status,
     resolve: resolve2,
@@ -482,226 +906,6 @@ function createCauthy(given = {}) {
   };
 }
 
-// src/theme.ts
-var MAX_RADIUS = 40;
-function declarations(css) {
-  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
-  const out2 = [];
-  const within = [];
-  let chunk = "";
-  let quote = "";
-  let depth = 0;
-  const flush = () => {
-    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
-    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
-    chunk = "";
-  };
-  for (const ch of text) {
-    if (quote) {
-      chunk += ch;
-      if (ch === quote) quote = "";
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      chunk += ch;
-    } else if (ch === "(") {
-      depth++;
-      chunk += ch;
-    } else if (ch === ")") {
-      depth = Math.max(0, depth - 1);
-      chunk += ch;
-    } else if (ch === "{" && depth === 0) {
-      within.push(chunk.trim().replace(/\s+/g, " "));
-      chunk = "";
-    } else if (ch === "}" && depth === 0) {
-      flush();
-      within.pop();
-    } else if (ch === ";" && depth === 0) {
-      flush();
-    } else {
-      chunk += ch;
-    }
-  }
-  return out2;
-}
-var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
-var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
-var NAMED = /data-theme=["']?([\w-]+)/i;
-function applies(d, o) {
-  for (const scope of d.within) {
-    if (o.mode === "light" && DARK.test(scope)) return false;
-    if (o.mode === "dark" && LIGHT.test(scope)) return false;
-    const named = NAMED.exec(scope);
-    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
-    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
-  }
-  return true;
-}
-function resolve(value, vars, seen = 0) {
-  if (seen > 16) return null;
-  let unresolved = false;
-  let out2 = value;
-  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
-    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
-      const known = vars.get(name);
-      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
-      if (next === null) unresolved = true;
-      return next ?? "";
-    });
-    if (unresolved) return null;
-  }
-  return /var\(/.test(out2) ? null : out2.trim();
-}
-var clamp01 = (n) => Math.min(1, Math.max(0, n));
-var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
-var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
-function out(r, g, b, a = 1) {
-  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
-  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
-}
-var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
-var KEYWORDS = { white: "#ffffff", black: "#000000" };
-function toColor(value) {
-  const v = value.trim().toLowerCase();
-  if (KEYWORDS[v]) return KEYWORDS[v];
-  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
-  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
-  if (m) {
-    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
-    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
-  }
-  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
-  if (m) {
-    const h = (parseFloat(m[1]) % 360 + 360) % 360;
-    const s = parseFloat(m[2]) / 100;
-    const l = parseFloat(m[3]) / 100;
-    const f = (n) => {
-      const k = (n + h / 30) % 12;
-      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
-    };
-    return out(f(0), f(8), f(4), alpha(m[4]));
-  }
-  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
-  if (m) {
-    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
-    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
-    const H = parseFloat(m[3]) * Math.PI / 180;
-    const a = C * Math.cos(H);
-    const b = C * Math.sin(H);
-    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
-    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
-    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
-    return out(
-      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
-      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
-      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
-      alpha(m[4])
-    );
-  }
-  return null;
-}
-function toRadius(value) {
-  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
-  if (!m) return null;
-  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
-  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
-}
-function toFont(value) {
-  const v = value.trim();
-  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
-}
-var COLORS = [
-  ["background", ["--sm-bg-surface", "--sm-surface"]],
-  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
-  ["text", ["--sm-text-primary", "--sm-surface-text"]],
-  ["textMuted", ["--sm-text-secondary"]],
-  ["border", ["--sm-border-default", "--sm-surface-border"]],
-  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
-  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
-  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
-  ["error", ["--sm-error-soft-text", "--sm-error"]],
-  ["errorBackground", ["--sm-error-soft"]],
-  ["success", ["--sm-success-soft-text", "--sm-success"]],
-  ["successBackground", ["--sm-success-soft"]]
-];
-function themeFromStackmyth(css, options = {}) {
-  const o = { mode: options.mode ?? "light", theme: options.theme };
-  const vars = /* @__PURE__ */ new Map();
-  for (const sheet of Array.isArray(css) ? css : [css]) {
-    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
-  }
-  const theme = {};
-  const warnings = [];
-  const read = (tokens, to, what) => {
-    for (const token of tokens) {
-      const raw = vars.get(token);
-      if (raw === void 0) continue;
-      const value = resolve(raw, vars);
-      const got = value === null ? null : to(value);
-      if (got !== null) return got;
-      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
-    }
-    return void 0;
-  };
-  for (const [field, tokens] of COLORS) {
-    const c = read(tokens, toColor, "a colour");
-    if (c !== void 0) theme[field] = c;
-  }
-  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
-  if (radius !== void 0) theme.radius = radius;
-  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
-  if (button !== void 0) theme.buttonRadius = button;
-  const font = read(["--sm-font-family"], toFont, "a font list");
-  if (font !== void 0) theme.fontFamily = font;
-  if (options.logoUrl) theme.logoUrl = options.logoUrl;
-  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
-  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
-  return { theme, warnings };
-}
-function toWire(theme) {
-  const names = {
-    background: "background",
-    surface: "surface",
-    text: "text",
-    textMuted: "text_muted",
-    border: "border",
-    primary: "primary",
-    primaryText: "primary_text",
-    accent: "accent",
-    error: "error",
-    errorBackground: "error_background",
-    success: "success",
-    successBackground: "success_background",
-    radius: "radius",
-    buttonRadius: "button_radius",
-    fontFamily: "font_family",
-    logoUrl: "logo_url"
-  };
-  const wire = {};
-  for (const [k, v] of Object.entries(theme)) if (v !== void 0 && v !== "") wire[names[k]] = v;
-  return wire;
-}
-async function pushTheme(o) {
-  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = o.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
-  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
-  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
-    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
-  }
-  const res = await (o.fetch ?? fetch)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
-    body: JSON.stringify(toWire(o.theme))
-  });
-  if (!res.ok) {
-    const body = await res.json().catch(() => null);
-    throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
-  }
-}
-
 // src/permissions.ts
 function matches(entry, resource, action) {
   const i = entry.lastIndexOf(":");
@@ -716,11 +920,11 @@ function can(organization, resource, action) {
   return organization.permissions.some((p) => matches(p, resource, action));
 }
 async function pushPolicy(o) {
-  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const system = o.system ?? env2("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env3("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
   }
@@ -734,12 +938,59 @@ async function pushPolicy(o) {
     throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
   }
 }
+
+// src/connect.ts
+function sessionSecret() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function connectSystem(o) {
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to connect a system`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/connect`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({
+      system: o.system,
+      app_url: o.appUrl,
+      name: o.name,
+      callback_path: o.callbackPath,
+      events_url: o.eventsUrl,
+      events: o.events,
+      jwks_uri: o.jwksUri
+    })
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.data) {
+    const why = (body?.errors ?? []).map((e) => e.message).filter(Boolean).join("; ") || res.statusText;
+    throw new Error(`cauthy-auth: Cauthy did not connect the system (${res.status}): ${why}`);
+  }
+  const d = body.data;
+  return {
+    system: d.system,
+    clientId: d.client.client_id,
+    clientSecret: d.client_secret,
+    redirectUris: d.client.redirect_uris,
+    webhook: d.webhook,
+    env: { ...d.env, CAUTHY_SECRET: sessionSecret() }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CauthyApiError,
   CauthyConfigError,
   CauthyWebhookError,
   can,
+  connectSystem,
   createCauthy,
+  createSystem,
   pushPolicy,
   pushTheme,
   themeFromStackmyth,