cauthy-auth 0.2.0 → 0.4.0

package/dist/system-CL3Q30FT.d.ts

@@ -0,0 +1,243 @@
+import { JWK } from 'jose';
+import { CauthyTheme } from './theme.js';
+
+/** How an application is set up to sign its people in with Cauthy. */
+interface CauthyOptions {
+    /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */
+    clientSecret?: string;
+    /**
+     * The key the session cookie is encrypted with: any string of 32 characters
+     * or more, kept on the server. Default: `CAUTHY_SECRET`.
+     */
+    secret?: string;
+    /**
+     * The system this application is, as its organizations are filed under in
+     * Cauthy (`"pondari"`). When set, a session's organizations are that
+     * system's. Default: `CAUTHY_SYSTEM`.
+     */
+    system?: string;
+    /** Where the routes are mounted. Default: `/api/auth`. */
+    basePath?: string;
+    /**
+     * The application's own public origin (`https://app.example.com`), for the
+     * redirect URI. Default: the origin of each request, which is right unless
+     * a proxy hides it.
+     */
+    baseURL?: string;
+    /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */
+    afterSignIn?: string;
+    /** Where a person lands after signing out. Default: `/`. */
+    afterSignOut?: string;
+    /** Name of the session cookie. Default: `cauthy_session`. */
+    cookieName?: string;
+    /**
+     * A key the application proves who it is with when it acts on its own
+     * (`auth.system`), instead of its secret. Default: `CAUTHY_SYSTEM_KEY` and
+     * `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    systemKey?: SystemKey;
+    /** `fetch` to reach Cauthy with. Default: the global one. */
+    fetch?: typeof fetch;
+}
+/** The person signed in. Every moment is UTC. */
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    /**
+     * True when the account ran out of time to confirm its address: let it read
+     * and refuse its writes.
+     */
+    restricted: boolean;
+    /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */
+    emailVerifyBy?: string;
+    /** The language the person reads in ("es", "en-US"), when Cauthy knows it. */
+    locale?: string;
+}
+/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** An organization the person belongs to, with their role in it. */
+interface SessionOrganization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    externalId?: string;
+    role: string;
+    /** What the system keeps about the organization, as it filed it in Cauthy. */
+    metadata: Record<string, JsonValue>;
+    /**
+     * What the person may do here, as "resource:action" entries ("*" is any):
+     * their role's permissions, what it inherits, and anything given to them
+     * apart from it. Absent when the system keeps no catalog of roles in Cauthy.
+     * Check with `can(organization, resource, action)`.
+     */
+    permissions?: string[];
+    /** What the person is denied here, whatever else allows it. */
+    denied?: string[];
+}
+/** A signed-in person, as the server sees them. */
+interface Session {
+    user: SessionUser;
+    /** The Cauthy tenant the account is of. */
+    tenantId: string;
+    /** The roles the account holds in that tenant. */
+    roles: string[];
+    /**
+     * Cauthy's access token for this person: send it as `Authorization: Bearer`
+     * to another service that verifies Cauthy's tokens. Never give it to the browser.
+     */
+    accessToken: string;
+    /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */
+    expiresAt: string;
+}
+/** What the browser is told of a session: who, and their organizations — never a token. */
+interface PublicSession {
+    user: SessionUser;
+    tenantId: string;
+    roles: string[];
+    organizations: SessionOrganization[];
+    expiresAt: string;
+}
+/** Why there is no session. */
+type SessionStatus = 'authenticated' | 'unauthenticated' | 'expired';
+declare class CauthyConfigError extends Error {
+    constructor(message: string);
+}
+
+/** The key an application signs its assertions with. */
+interface SystemKey {
+    /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */
+    privateKey: string | JWK;
+    /** The id the public key is published under (`kid`). */
+    keyId: string;
+}
+interface SystemOptions {
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret. Default: `CAUTHY_CLIENT_SECRET`. Not needed with `key`. */
+    clientSecret?: string;
+    /**
+     * The key to prove who the application is with, instead of the secret.
+     * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    key?: SystemKey;
+    fetch?: typeof fetch;
+}
+/** Cauthy refused a request of the application's own. */
+declare class CauthyApiError extends Error {
+    readonly status: number;
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    readonly code: string;
+    constructor(status: number, 
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    code: string, message: string);
+}
+/** An organization of the application's system. Every moment is UTC. */
+interface Organization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    /** The id the application knows it by. */
+    externalId?: string;
+    status: 'active' | 'archived';
+    metadata: Record<string, JsonValue>;
+    members: number;
+    createdAt: string;
+    updatedAt: string;
+}
+interface OrganizationMember {
+    userId: string;
+    email: string;
+    name: string;
+    /** The account's status: a disabled member is still listed. */
+    status: string;
+    role: string;
+    /** True when the address had no account: one was made and invited. */
+    invited?: boolean;
+}
+/** Who to add: an account by its id, or anybody by their address (invited when new). */
+type NewMember = {
+    role: string;
+    name?: string;
+    locale?: string;
+} & ({
+    userId: string;
+    email?: undefined;
+} | {
+    email: string;
+    userId?: undefined;
+});
+interface CauthySystem {
+    /** The application's own token, asked for when needed and kept until it is about to run out. */
+    token(): Promise<string>;
+    /** Any route the application's token may call; answers what Cauthy put under `data`. */
+    request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>;
+    organizations: {
+        list(query?: {
+            q?: string;
+            status?: 'active' | 'archived';
+            limit?: number;
+            offset?: number;
+        }): Promise<{
+            items: Organization[];
+            total: number;
+        }>;
+        create(input: {
+            name: string;
+            kind?: string;
+            externalId?: string;
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        get(id: string): Promise<Organization>;
+        update(id: string, patch: {
+            name?: string;
+            kind?: string;
+            status?: 'active' | 'archived';
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        /** Removes the organization and every membership of it, for good. */
+        remove(id: string): Promise<void>;
+    };
+    members: {
+        list(organizationId: string): Promise<OrganizationMember[]>;
+        add(organizationId: string, member: NewMember): Promise<OrganizationMember>;
+        setRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember>;
+        remove(organizationId: string, userId: string): Promise<void>;
+    };
+    /** Invites a person who has no account yet; answers the account made for them. */
+    invite(person: {
+        email: string;
+        name?: string;
+        locale?: string;
+    }): Promise<{
+        id: string;
+        email: string;
+    }>;
+    /**
+     * How the application looks on Cauthy's pages: read it, set it, or take it
+     * back to Cauthy's own with `null`. Of its own sign-in client — this one,
+     * unless another is named (a system whose identity is a separate client).
+     */
+    theme: {
+        get(clientId?: string): Promise<CauthyTheme>;
+        set(theme: CauthyTheme | null, clientId?: string): Promise<void>;
+    };
+    /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
+    publicJwks(): Promise<{
+        keys: JWK[];
+    }>;
+}
+declare function createSystem(given?: SystemOptions): CauthySystem;
+
+export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PublicSession as P, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type SessionOrganization as e, type SessionStatus as f, type SessionUser as g, type SystemKey as h, type SystemOptions as i, createSystem as j };

package/dist/system-CdvktS7x.d.mts

@@ -0,0 +1,243 @@
+import { JWK } from 'jose';
+import { CauthyTheme } from './theme.mjs';
+
+/** How an application is set up to sign its people in with Cauthy. */
+interface CauthyOptions {
+    /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */
+    clientSecret?: string;
+    /**
+     * The key the session cookie is encrypted with: any string of 32 characters
+     * or more, kept on the server. Default: `CAUTHY_SECRET`.
+     */
+    secret?: string;
+    /**
+     * The system this application is, as its organizations are filed under in
+     * Cauthy (`"pondari"`). When set, a session's organizations are that
+     * system's. Default: `CAUTHY_SYSTEM`.
+     */
+    system?: string;
+    /** Where the routes are mounted. Default: `/api/auth`. */
+    basePath?: string;
+    /**
+     * The application's own public origin (`https://app.example.com`), for the
+     * redirect URI. Default: the origin of each request, which is right unless
+     * a proxy hides it.
+     */
+    baseURL?: string;
+    /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */
+    afterSignIn?: string;
+    /** Where a person lands after signing out. Default: `/`. */
+    afterSignOut?: string;
+    /** Name of the session cookie. Default: `cauthy_session`. */
+    cookieName?: string;
+    /**
+     * A key the application proves who it is with when it acts on its own
+     * (`auth.system`), instead of its secret. Default: `CAUTHY_SYSTEM_KEY` and
+     * `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    systemKey?: SystemKey;
+    /** `fetch` to reach Cauthy with. Default: the global one. */
+    fetch?: typeof fetch;
+}
+/** The person signed in. Every moment is UTC. */
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    /**
+     * True when the account ran out of time to confirm its address: let it read
+     * and refuse its writes.
+     */
+    restricted: boolean;
+    /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */
+    emailVerifyBy?: string;
+    /** The language the person reads in ("es", "en-US"), when Cauthy knows it. */
+    locale?: string;
+}
+/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** An organization the person belongs to, with their role in it. */
+interface SessionOrganization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    externalId?: string;
+    role: string;
+    /** What the system keeps about the organization, as it filed it in Cauthy. */
+    metadata: Record<string, JsonValue>;
+    /**
+     * What the person may do here, as "resource:action" entries ("*" is any):
+     * their role's permissions, what it inherits, and anything given to them
+     * apart from it. Absent when the system keeps no catalog of roles in Cauthy.
+     * Check with `can(organization, resource, action)`.
+     */
+    permissions?: string[];
+    /** What the person is denied here, whatever else allows it. */
+    denied?: string[];
+}
+/** A signed-in person, as the server sees them. */
+interface Session {
+    user: SessionUser;
+    /** The Cauthy tenant the account is of. */
+    tenantId: string;
+    /** The roles the account holds in that tenant. */
+    roles: string[];
+    /**
+     * Cauthy's access token for this person: send it as `Authorization: Bearer`
+     * to another service that verifies Cauthy's tokens. Never give it to the browser.
+     */
+    accessToken: string;
+    /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */
+    expiresAt: string;
+}
+/** What the browser is told of a session: who, and their organizations — never a token. */
+interface PublicSession {
+    user: SessionUser;
+    tenantId: string;
+    roles: string[];
+    organizations: SessionOrganization[];
+    expiresAt: string;
+}
+/** Why there is no session. */
+type SessionStatus = 'authenticated' | 'unauthenticated' | 'expired';
+declare class CauthyConfigError extends Error {
+    constructor(message: string);
+}
+
+/** The key an application signs its assertions with. */
+interface SystemKey {
+    /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */
+    privateKey: string | JWK;
+    /** The id the public key is published under (`kid`). */
+    keyId: string;
+}
+interface SystemOptions {
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret. Default: `CAUTHY_CLIENT_SECRET`. Not needed with `key`. */
+    clientSecret?: string;
+    /**
+     * The key to prove who the application is with, instead of the secret.
+     * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    key?: SystemKey;
+    fetch?: typeof fetch;
+}
+/** Cauthy refused a request of the application's own. */
+declare class CauthyApiError extends Error {
+    readonly status: number;
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    readonly code: string;
+    constructor(status: number, 
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    code: string, message: string);
+}
+/** An organization of the application's system. Every moment is UTC. */
+interface Organization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    /** The id the application knows it by. */
+    externalId?: string;
+    status: 'active' | 'archived';
+    metadata: Record<string, JsonValue>;
+    members: number;
+    createdAt: string;
+    updatedAt: string;
+}
+interface OrganizationMember {
+    userId: string;
+    email: string;
+    name: string;
+    /** The account's status: a disabled member is still listed. */
+    status: string;
+    role: string;
+    /** True when the address had no account: one was made and invited. */
+    invited?: boolean;
+}
+/** Who to add: an account by its id, or anybody by their address (invited when new). */
+type NewMember = {
+    role: string;
+    name?: string;
+    locale?: string;
+} & ({
+    userId: string;
+    email?: undefined;
+} | {
+    email: string;
+    userId?: undefined;
+});
+interface CauthySystem {
+    /** The application's own token, asked for when needed and kept until it is about to run out. */
+    token(): Promise<string>;
+    /** Any route the application's token may call; answers what Cauthy put under `data`. */
+    request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>;
+    organizations: {
+        list(query?: {
+            q?: string;
+            status?: 'active' | 'archived';
+            limit?: number;
+            offset?: number;
+        }): Promise<{
+            items: Organization[];
+            total: number;
+        }>;
+        create(input: {
+            name: string;
+            kind?: string;
+            externalId?: string;
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        get(id: string): Promise<Organization>;
+        update(id: string, patch: {
+            name?: string;
+            kind?: string;
+            status?: 'active' | 'archived';
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        /** Removes the organization and every membership of it, for good. */
+        remove(id: string): Promise<void>;
+    };
+    members: {
+        list(organizationId: string): Promise<OrganizationMember[]>;
+        add(organizationId: string, member: NewMember): Promise<OrganizationMember>;
+        setRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember>;
+        remove(organizationId: string, userId: string): Promise<void>;
+    };
+    /** Invites a person who has no account yet; answers the account made for them. */
+    invite(person: {
+        email: string;
+        name?: string;
+        locale?: string;
+    }): Promise<{
+        id: string;
+        email: string;
+    }>;
+    /**
+     * How the application looks on Cauthy's pages: read it, set it, or take it
+     * back to Cauthy's own with `null`. Of its own sign-in client — this one,
+     * unless another is named (a system whose identity is a separate client).
+     */
+    theme: {
+        get(clientId?: string): Promise<CauthyTheme>;
+        set(theme: CauthyTheme | null, clientId?: string): Promise<void>;
+    };
+    /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
+    publicJwks(): Promise<{
+        keys: JWK[];
+    }>;
+}
+declare function createSystem(given?: SystemOptions): CauthySystem;
+
+export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PublicSession as P, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type SessionOrganization as e, type SessionStatus as f, type SessionUser as g, type SystemKey as h, type SystemOptions as i, createSystem as j };

package/dist/theme.d.mts

@@ -1,4 +1,13 @@
 /** How an application looks on Cauthy's hosted pages. Every value is optional. */
+/** One font file the application serves: a family in one weight (or a range) and one style. */
+interface ThemeFont {
+    family: string;
+    /** An https address of a `.woff2` file. It must answer with `Access-Control-Allow-Origin` for Cauthy's origin. */
+    url: string;
+    /** `400`, or `"100 900"` for a variable font. Default: 400. */
+    weight?: number | string;
+    style?: 'normal' | 'italic';
+}
 interface CauthyTheme {
     /** The page. Colours are `#rrggbb` or `rgba(r, g, b, a)`. */
     background?: string;
@@ -22,8 +31,10 @@ interface CauthyTheme {
     radius?: number;
     /** Corners of buttons, in pixels (0–40). */
     buttonRadius?: number;
-    /** A CSS font-family list. Cauthy loads no font files: put a system font after the application's own. */
+    /** A CSS font-family list: the application's typeface first, a system font after it. */
     fontFamily?: string;
+    /** The files of the typefaces `fontFamily` names, for people who do not have them installed. */
+    fonts?: ThemeFont[];
     /** An image shown where "Cauthy" is, over https. */
     logoUrl?: string;
 }
@@ -56,7 +67,9 @@ declare function toColor(value: string): string | null;
  */
 declare function themeFromStackmyth(css: string | string[], options?: StackmythThemeOptions): ImportedTheme;
 /** A theme as Cauthy's API names its values. */
-declare function toWire(theme: CauthyTheme): Record<string, string | number>;
+declare function toWire(theme: CauthyTheme): Record<string, string | number | ThemeFont[]>;
+/** A theme as Cauthy answers it, in this package's names. */
+declare function fromWire(wire: Record<string, unknown>): CauthyTheme;
 interface PushThemeOptions {
     /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
     issuer?: string;
@@ -79,4 +92,4 @@ interface PushThemeOptions {
  */
 declare function pushTheme(o: PushThemeOptions): Promise<void>;
 
-export { type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, pushTheme, themeFromStackmyth, toColor, toWire };
+export { type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type ThemeFont, fromWire, pushTheme, themeFromStackmyth, toColor, toWire };

package/dist/theme.d.ts

@@ -1,4 +1,13 @@
 /** How an application looks on Cauthy's hosted pages. Every value is optional. */
+/** One font file the application serves: a family in one weight (or a range) and one style. */
+interface ThemeFont {
+    family: string;
+    /** An https address of a `.woff2` file. It must answer with `Access-Control-Allow-Origin` for Cauthy's origin. */
+    url: string;
+    /** `400`, or `"100 900"` for a variable font. Default: 400. */
+    weight?: number | string;
+    style?: 'normal' | 'italic';
+}
 interface CauthyTheme {
     /** The page. Colours are `#rrggbb` or `rgba(r, g, b, a)`. */
     background?: string;
@@ -22,8 +31,10 @@ interface CauthyTheme {
     radius?: number;
     /** Corners of buttons, in pixels (0–40). */
     buttonRadius?: number;
-    /** A CSS font-family list. Cauthy loads no font files: put a system font after the application's own. */
+    /** A CSS font-family list: the application's typeface first, a system font after it. */
     fontFamily?: string;
+    /** The files of the typefaces `fontFamily` names, for people who do not have them installed. */
+    fonts?: ThemeFont[];
     /** An image shown where "Cauthy" is, over https. */
     logoUrl?: string;
 }
@@ -56,7 +67,9 @@ declare function toColor(value: string): string | null;
  */
 declare function themeFromStackmyth(css: string | string[], options?: StackmythThemeOptions): ImportedTheme;
 /** A theme as Cauthy's API names its values. */
-declare function toWire(theme: CauthyTheme): Record<string, string | number>;
+declare function toWire(theme: CauthyTheme): Record<string, string | number | ThemeFont[]>;
+/** A theme as Cauthy answers it, in this package's names. */
+declare function fromWire(wire: Record<string, unknown>): CauthyTheme;
 interface PushThemeOptions {
     /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
     issuer?: string;
@@ -79,4 +92,4 @@ interface PushThemeOptions {
  */
 declare function pushTheme(o: PushThemeOptions): Promise<void>;
 
-export { type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, pushTheme, themeFromStackmyth, toColor, toWire };
+export { type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type ThemeFont, fromWire, pushTheme, themeFromStackmyth, toColor, toWire };

package/dist/theme.js

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/theme.ts
 var theme_exports = {};
 __export(theme_exports, {
+  fromWire: () => fromWire,
   pushTheme: () => pushTheme,
   themeFromStackmyth: () => themeFromStackmyth,
   toColor: () => toColor,
@@ -219,12 +220,40 @@ function toWire(theme) {
     radius: "radius",
     buttonRadius: "button_radius",
     fontFamily: "font_family",
-    logoUrl: "logo_url"
+    logoUrl: "logo_url",
+    fonts: "fonts"
   };
   const wire = {};
-  for (const [k, v] of Object.entries(theme)) if (v !== void 0 && v !== "") wire[names[k]] = v;
+  for (const [k, v] of Object.entries(theme)) {
+    if (v === void 0 || v === "" || Array.isArray(v) && v.length === 0) continue;
+    wire[names[k]] = v;
+  }
   return wire;
 }
+function fromWire(wire) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    text_muted: "textMuted",
+    border: "border",
+    primary: "primary",
+    primary_text: "primaryText",
+    accent: "accent",
+    error: "error",
+    error_background: "errorBackground",
+    success: "success",
+    success_background: "successBackground",
+    radius: "radius",
+    button_radius: "buttonRadius",
+    font_family: "fontFamily",
+    logo_url: "logoUrl",
+    fonts: "fonts"
+  };
+  const theme = {};
+  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== void 0 && v !== null && v !== "") theme[names[k]] = v;
+  return theme;
+}
 async function pushTheme(o) {
   const env = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
   const issuer = (o.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
@@ -246,6 +275,7 @@ async function pushTheme(o) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  fromWire,
   pushTheme,
   themeFromStackmyth,
   toColor,