cauthy-auth 0.3.0 → 0.4.0

package/dist/{cauthy-C5_lopMQ.d.ts → cauthy--iqtLWNa.d.ts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, f as SessionStatus, e as SessionOrganization, c as CauthySystem, P as PublicSession, b as CauthyOptions } from './system-BWLddIt2.js';
+import { J as JsonValue, S as Session, f as SessionStatus, e as SessionOrganization, c as CauthySystem, P as PublicSession, b as CauthyOptions } from './system-CL3Q30FT.js';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/{cauthy-mNADGlNl.d.mts → cauthy-Dg-DNIo9.d.mts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, f as SessionStatus, e as SessionOrganization, c as CauthySystem, P as PublicSession, b as CauthyOptions } from './system-BWLddIt2.mjs';
+import { J as JsonValue, S as Session, f as SessionStatus, e as SessionOrganization, c as CauthySystem, P as PublicSession, b as CauthyOptions } from './system-CdvktS7x.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/cli.js

@@ -266,10 +266,14 @@ function toWire(theme) {
     radius: "radius",
     buttonRadius: "button_radius",
     fontFamily: "font_family",
-    logoUrl: "logo_url"
+    logoUrl: "logo_url",
+    fonts: "fonts"
   };
   const wire = {};
-  for (const [k, v] of Object.entries(theme)) if (v !== void 0 && v !== "") wire[names[k]] = v;
+  for (const [k, v] of Object.entries(theme)) {
+    if (v === void 0 || v === "" || Array.isArray(v) && v.length === 0) continue;
+    wire[names[k]] = v;
+  }
   return wire;
 }
 async function pushTheme(o) {

package/dist/fastify.d.mts

@@ -1,7 +1,8 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { C as Cauthy } from './cauthy-mNADGlNl.mjs';
-import { S as Session } from './system-BWLddIt2.mjs';
+import { C as Cauthy } from './cauthy-Dg-DNIo9.mjs';
+import { S as Session } from './system-CdvktS7x.mjs';
 import 'jose';
+import './theme.mjs';
 
 declare module 'fastify' {
     interface FastifyRequest {

package/dist/fastify.d.ts

@@ -1,7 +1,8 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { C as Cauthy } from './cauthy-C5_lopMQ.js';
-import { S as Session } from './system-BWLddIt2.js';
+import { C as Cauthy } from './cauthy--iqtLWNa.js';
+import { S as Session } from './system-CL3Q30FT.js';
 import 'jose';
+import './theme.js';
 
 declare module 'fastify' {
     interface FastifyRequest {

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-mNADGlNl.mjs';
-export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PublicSession, S as Session, e as SessionOrganization, f as SessionStatus, g as SessionUser, h as SystemKey, i as SystemOptions, j as createSystem } from './system-BWLddIt2.mjs';
-export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, pushTheme, themeFromStackmyth } from './theme.mjs';
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-Dg-DNIo9.mjs';
+export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PublicSession, S as Session, e as SessionOrganization, f as SessionStatus, g as SessionUser, h as SystemKey, i as SystemOptions, j as createSystem } from './system-CdvktS7x.mjs';
+export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, ThemeFont, pushTheme, themeFromStackmyth } from './theme.mjs';
 export { P as Permitted, a as PolicyPermission, b as PolicyRole, c as PushPolicyOptions, d as can, p as pushPolicy } from './permissions-B-a3eN0h.mjs';
 import 'jose';
 

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-C5_lopMQ.js';
-export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PublicSession, S as Session, e as SessionOrganization, f as SessionStatus, g as SessionUser, h as SystemKey, i as SystemOptions, j as createSystem } from './system-BWLddIt2.js';
-export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, pushTheme, themeFromStackmyth } from './theme.js';
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy--iqtLWNa.js';
+export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PublicSession, S as Session, e as SessionOrganization, f as SessionStatus, g as SessionUser, h as SystemKey, i as SystemOptions, j as createSystem } from './system-CL3Q30FT.js';
+export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, ThemeFont, pushTheme, themeFromStackmyth } from './theme.js';
 export { P as Permitted, a as PolicyPermission, b as PolicyRole, c as PushPolicyOptions, d as can, p as pushPolicy } from './permissions-B-a3eN0h.js';
 import 'jose';
 

package/dist/index.js

@@ -93,6 +93,254 @@ async function unseal(sealed, key) {
 // src/system.ts
 var import_jose2 = require("jose");
 
+// src/theme.ts
+var MAX_RADIUS = 40;
+function declarations(css) {
+  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
+  const out2 = [];
+  const within = [];
+  let chunk = "";
+  let quote = "";
+  let depth = 0;
+  const flush = () => {
+    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
+    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
+    chunk = "";
+  };
+  for (const ch of text) {
+    if (quote) {
+      chunk += ch;
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      chunk += ch;
+    } else if (ch === "(") {
+      depth++;
+      chunk += ch;
+    } else if (ch === ")") {
+      depth = Math.max(0, depth - 1);
+      chunk += ch;
+    } else if (ch === "{" && depth === 0) {
+      within.push(chunk.trim().replace(/\s+/g, " "));
+      chunk = "";
+    } else if (ch === "}" && depth === 0) {
+      flush();
+      within.pop();
+    } else if (ch === ";" && depth === 0) {
+      flush();
+    } else {
+      chunk += ch;
+    }
+  }
+  return out2;
+}
+var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
+var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
+var NAMED = /data-theme=["']?([\w-]+)/i;
+function applies(d, o) {
+  for (const scope of d.within) {
+    if (o.mode === "light" && DARK.test(scope)) return false;
+    if (o.mode === "dark" && LIGHT.test(scope)) return false;
+    const named = NAMED.exec(scope);
+    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
+  }
+  return true;
+}
+function resolve(value, vars, seen = 0) {
+  if (seen > 16) return null;
+  let unresolved = false;
+  let out2 = value;
+  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
+    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+      const known = vars.get(name);
+      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
+      if (next === null) unresolved = true;
+      return next ?? "";
+    });
+    if (unresolved) return null;
+  }
+  return /var\(/.test(out2) ? null : out2.trim();
+}
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
+var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
+function out(r, g, b, a = 1) {
+  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
+  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
+}
+var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
+var KEYWORDS = { white: "#ffffff", black: "#000000" };
+function toColor(value) {
+  const v = value.trim().toLowerCase();
+  if (KEYWORDS[v]) return KEYWORDS[v];
+  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
+  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
+    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
+  }
+  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const h = (parseFloat(m[1]) % 360 + 360) % 360;
+    const s = parseFloat(m[2]) / 100;
+    const l = parseFloat(m[3]) / 100;
+    const f = (n) => {
+      const k = (n + h / 30) % 12;
+      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
+    };
+    return out(f(0), f(8), f(4), alpha(m[4]));
+  }
+  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
+    const H = parseFloat(m[3]) * Math.PI / 180;
+    const a = C * Math.cos(H);
+    const b = C * Math.sin(H);
+    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
+    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
+    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
+    return out(
+      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
+      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
+      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
+      alpha(m[4])
+    );
+  }
+  return null;
+}
+function toRadius(value) {
+  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
+  if (!m) return null;
+  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
+  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
+}
+function toFont(value) {
+  const v = value.trim();
+  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
+}
+var COLORS = [
+  ["background", ["--sm-bg-surface", "--sm-surface"]],
+  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
+  ["text", ["--sm-text-primary", "--sm-surface-text"]],
+  ["textMuted", ["--sm-text-secondary"]],
+  ["border", ["--sm-border-default", "--sm-surface-border"]],
+  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
+  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
+  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
+  ["error", ["--sm-error-soft-text", "--sm-error"]],
+  ["errorBackground", ["--sm-error-soft"]],
+  ["success", ["--sm-success-soft-text", "--sm-success"]],
+  ["successBackground", ["--sm-success-soft"]]
+];
+function themeFromStackmyth(css, options = {}) {
+  const o = { mode: options.mode ?? "light", theme: options.theme };
+  const vars = /* @__PURE__ */ new Map();
+  for (const sheet of Array.isArray(css) ? css : [css]) {
+    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
+  }
+  const theme = {};
+  const warnings = [];
+  const read = (tokens, to, what) => {
+    for (const token of tokens) {
+      const raw = vars.get(token);
+      if (raw === void 0) continue;
+      const value = resolve(raw, vars);
+      const got = value === null ? null : to(value);
+      if (got !== null) return got;
+      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
+    }
+    return void 0;
+  };
+  for (const [field, tokens] of COLORS) {
+    const c = read(tokens, toColor, "a colour");
+    if (c !== void 0) theme[field] = c;
+  }
+  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
+  if (radius !== void 0) theme.radius = radius;
+  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
+  if (button !== void 0) theme.buttonRadius = button;
+  const font = read(["--sm-font-family"], toFont, "a font list");
+  if (font !== void 0) theme.fontFamily = font;
+  if (options.logoUrl) theme.logoUrl = options.logoUrl;
+  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
+  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
+  return { theme, warnings };
+}
+function toWire(theme) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    textMuted: "text_muted",
+    border: "border",
+    primary: "primary",
+    primaryText: "primary_text",
+    accent: "accent",
+    error: "error",
+    errorBackground: "error_background",
+    success: "success",
+    successBackground: "success_background",
+    radius: "radius",
+    buttonRadius: "button_radius",
+    fontFamily: "font_family",
+    logoUrl: "logo_url",
+    fonts: "fonts"
+  };
+  const wire = {};
+  for (const [k, v] of Object.entries(theme)) {
+    if (v === void 0 || v === "" || Array.isArray(v) && v.length === 0) continue;
+    wire[names[k]] = v;
+  }
+  return wire;
+}
+function fromWire(wire) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    text_muted: "textMuted",
+    border: "border",
+    primary: "primary",
+    primary_text: "primaryText",
+    accent: "accent",
+    error: "error",
+    error_background: "errorBackground",
+    success: "success",
+    success_background: "successBackground",
+    radius: "radius",
+    button_radius: "buttonRadius",
+    font_family: "fontFamily",
+    logo_url: "logoUrl",
+    fonts: "fonts"
+  };
+  const theme = {};
+  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== void 0 && v !== null && v !== "") theme[names[k]] = v;
+  return theme;
+}
+async function pushTheme(o) {
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify(toWire(o.theme))
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
 // src/types.ts
 var CauthyConfigError = class extends Error {
   constructor(message) {
@@ -253,6 +501,15 @@ function createSystem(given = {}) {
       const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
       return { id: u.id, email: u.email };
     },
+    theme: {
+      async get(of = clientId) {
+        return fromWire(await data("GET", `/v1/oauth/clients/${id(of)}/theme`));
+      },
+      async set(theme, of = clientId) {
+        if (theme === null) await call("DELETE", `/v1/oauth/clients/${id(of)}/theme`);
+        else await call("PUT", `/v1/oauth/clients/${id(of)}/theme`, toWire(theme));
+      }
+    },
     async publicJwks() {
       if (!key) return { keys: [] };
       const { kty, n, e } = asJwk(key) ?? await (0, import_jose2.exportJWK)(await signingKey());
@@ -649,226 +906,6 @@ function createCauthy(given = {}) {
   };
 }
 
-// src/theme.ts
-var MAX_RADIUS = 40;
-function declarations(css) {
-  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
-  const out2 = [];
-  const within = [];
-  let chunk = "";
-  let quote = "";
-  let depth = 0;
-  const flush = () => {
-    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
-    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
-    chunk = "";
-  };
-  for (const ch of text) {
-    if (quote) {
-      chunk += ch;
-      if (ch === quote) quote = "";
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      chunk += ch;
-    } else if (ch === "(") {
-      depth++;
-      chunk += ch;
-    } else if (ch === ")") {
-      depth = Math.max(0, depth - 1);
-      chunk += ch;
-    } else if (ch === "{" && depth === 0) {
-      within.push(chunk.trim().replace(/\s+/g, " "));
-      chunk = "";
-    } else if (ch === "}" && depth === 0) {
-      flush();
-      within.pop();
-    } else if (ch === ";" && depth === 0) {
-      flush();
-    } else {
-      chunk += ch;
-    }
-  }
-  return out2;
-}
-var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
-var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
-var NAMED = /data-theme=["']?([\w-]+)/i;
-function applies(d, o) {
-  for (const scope of d.within) {
-    if (o.mode === "light" && DARK.test(scope)) return false;
-    if (o.mode === "dark" && LIGHT.test(scope)) return false;
-    const named = NAMED.exec(scope);
-    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
-    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
-  }
-  return true;
-}
-function resolve(value, vars, seen = 0) {
-  if (seen > 16) return null;
-  let unresolved = false;
-  let out2 = value;
-  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
-    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
-      const known = vars.get(name);
-      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
-      if (next === null) unresolved = true;
-      return next ?? "";
-    });
-    if (unresolved) return null;
-  }
-  return /var\(/.test(out2) ? null : out2.trim();
-}
-var clamp01 = (n) => Math.min(1, Math.max(0, n));
-var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
-var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
-function out(r, g, b, a = 1) {
-  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
-  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
-}
-var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
-var KEYWORDS = { white: "#ffffff", black: "#000000" };
-function toColor(value) {
-  const v = value.trim().toLowerCase();
-  if (KEYWORDS[v]) return KEYWORDS[v];
-  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
-  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
-  if (m) {
-    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
-    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
-  }
-  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
-  if (m) {
-    const h = (parseFloat(m[1]) % 360 + 360) % 360;
-    const s = parseFloat(m[2]) / 100;
-    const l = parseFloat(m[3]) / 100;
-    const f = (n) => {
-      const k = (n + h / 30) % 12;
-      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
-    };
-    return out(f(0), f(8), f(4), alpha(m[4]));
-  }
-  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
-  if (m) {
-    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
-    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
-    const H = parseFloat(m[3]) * Math.PI / 180;
-    const a = C * Math.cos(H);
-    const b = C * Math.sin(H);
-    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
-    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
-    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
-    return out(
-      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
-      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
-      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
-      alpha(m[4])
-    );
-  }
-  return null;
-}
-function toRadius(value) {
-  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
-  if (!m) return null;
-  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
-  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
-}
-function toFont(value) {
-  const v = value.trim();
-  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
-}
-var COLORS = [
-  ["background", ["--sm-bg-surface", "--sm-surface"]],
-  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
-  ["text", ["--sm-text-primary", "--sm-surface-text"]],
-  ["textMuted", ["--sm-text-secondary"]],
-  ["border", ["--sm-border-default", "--sm-surface-border"]],
-  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
-  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
-  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
-  ["error", ["--sm-error-soft-text", "--sm-error"]],
-  ["errorBackground", ["--sm-error-soft"]],
-  ["success", ["--sm-success-soft-text", "--sm-success"]],
-  ["successBackground", ["--sm-success-soft"]]
-];
-function themeFromStackmyth(css, options = {}) {
-  const o = { mode: options.mode ?? "light", theme: options.theme };
-  const vars = /* @__PURE__ */ new Map();
-  for (const sheet of Array.isArray(css) ? css : [css]) {
-    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
-  }
-  const theme = {};
-  const warnings = [];
-  const read = (tokens, to, what) => {
-    for (const token of tokens) {
-      const raw = vars.get(token);
-      if (raw === void 0) continue;
-      const value = resolve(raw, vars);
-      const got = value === null ? null : to(value);
-      if (got !== null) return got;
-      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
-    }
-    return void 0;
-  };
-  for (const [field, tokens] of COLORS) {
-    const c = read(tokens, toColor, "a colour");
-    if (c !== void 0) theme[field] = c;
-  }
-  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
-  if (radius !== void 0) theme.radius = radius;
-  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
-  if (button !== void 0) theme.buttonRadius = button;
-  const font = read(["--sm-font-family"], toFont, "a font list");
-  if (font !== void 0) theme.fontFamily = font;
-  if (options.logoUrl) theme.logoUrl = options.logoUrl;
-  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
-  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
-  return { theme, warnings };
-}
-function toWire(theme) {
-  const names = {
-    background: "background",
-    surface: "surface",
-    text: "text",
-    textMuted: "text_muted",
-    border: "border",
-    primary: "primary",
-    primaryText: "primary_text",
-    accent: "accent",
-    error: "error",
-    errorBackground: "error_background",
-    success: "success",
-    successBackground: "success_background",
-    radius: "radius",
-    buttonRadius: "button_radius",
-    fontFamily: "font_family",
-    logoUrl: "logo_url"
-  };
-  const wire = {};
-  for (const [k, v] of Object.entries(theme)) if (v !== void 0 && v !== "") wire[names[k]] = v;
-  return wire;
-}
-async function pushTheme(o) {
-  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = o.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
-  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
-  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
-    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
-  }
-  const res = await (o.fetch ?? fetch)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
-    body: JSON.stringify(toWire(o.theme))
-  });
-  if (!res.ok) {
-    const body = await res.json().catch(() => null);
-    throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
-  }
-}
-
 // src/permissions.ts
 function matches(entry, resource, action) {
   const i = entry.lastIndexOf(":");