cauthy-auth 0.5.2 → 0.8.0

package/dist/cli.js

@@ -12,10 +12,10 @@ function sessionSecret() {
   return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function connectSystem(o) {
-  const env = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const tenant = o.tenant ?? env("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env("CAUTHY_TOKEN") ?? "";
+  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to connect a system`);
   }
@@ -47,17 +47,67 @@ async function connectSystem(o) {
     env: { ...d.env, CAUTHY_SECRET: sessionSecret() }
   };
 }
-function envFile(env) {
-  return Object.entries(env).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
+function envFile(env2) {
+  return Object.entries(env2).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
 }
 
 // src/permissions.ts
+var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function policySource(system, roles) {
+  const text = (v) => JSON.stringify(v);
+  const key = (k) => IDENT.test(k) ? k : text(k);
+  const one = (r) => {
+    const parts = [`role: ${text(r.role)}`];
+    if (r.name) parts.push(`name: ${text(r.name)}`);
+    if (r.description) parts.push(`description: ${text(r.description)}`);
+    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
+    if (r.permissions?.length) {
+      const list = r.permissions.map((p) => `      { ${[...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [], `resource: ${text(p.resource)}`, `action: ${text(p.action)}`].join(", ")} },`);
+      parts.push(`permissions: [
+${list.join("\n")}
+    ]`);
+    }
+    return `  {
+    ${parts.join(",\n    ")},
+  },`;
+  };
+  return `// The catalog of roles of ${text(system)}, as Cauthy has it.
+// Written by \`cauthy-auth policy --pull\`: run it again after the catalog
+// changes, and do not edit this file by hand.
+
+import { definePolicy, type PermissionOf, type RoleOf } from 'cauthy-auth'
+
+export const policy = definePolicy([
+${roles.map(one).join("\n")}
+])
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+`;
+}
+async function pullPolicy(o = {}) {
+  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env2("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to read a policy`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, accept: "application/json" }
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok) throw new Error(`cauthy-auth: Cauthy refused to give the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  return body?.data?.roles ?? [];
+}
 async function pushPolicy(o) {
-  const env = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const system = o.system ?? env("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env("CAUTHY_TOKEN") ?? "";
+  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env2("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
   }
@@ -72,6 +122,9 @@ async function pushPolicy(o) {
   }
 }
 
+// src/system.ts
+var import_jose = require("jose");
+
 // src/theme.ts
 var MAX_RADIUS = 40;
 function declarations(css) {
@@ -124,10 +177,92 @@ function applies(d, o) {
     if (o.mode === "dark" && LIGHT.test(scope)) return false;
     const named = NAMED.exec(scope);
     if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
-    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host|^\.(dark|light)\b/.test(scope)) return false;
   }
   return true;
 }
+var TOKEN_CHARS = /^[A-Za-z0-9 #%.,()/'"_+*-]+$/;
+var TOKEN_FUNCS = /* @__PURE__ */ new Set([
+  "var",
+  "calc",
+  "min",
+  "max",
+  "clamp",
+  "rgb",
+  "rgba",
+  "hsl",
+  "hsla",
+  "hwb",
+  "lab",
+  "lch",
+  "oklab",
+  "oklch",
+  "color",
+  "color-mix",
+  "light-dark",
+  "cubic-bezier",
+  "steps",
+  "linear",
+  "linear-gradient",
+  "radial-gradient",
+  "conic-gradient",
+  "repeating-linear-gradient",
+  "repeating-radial-gradient",
+  "drop-shadow",
+  "blur",
+  "translate",
+  "translatex",
+  "translatey",
+  "scale",
+  "rotate"
+]);
+function tokenValue(value) {
+  const v = value.replace(/\s+/g, " ").trim();
+  if (v === "" || v.length > 400 || !TOKEN_CHARS.test(v)) return null;
+  for (const m of v.matchAll(/([A-Za-z-]+)\(/g)) if (!TOKEN_FUNCS.has(m[1].toLowerCase())) return null;
+  if (/^\(|[ ,(]\(/.test(v)) return null;
+  return v;
+}
+var THEME_SCOPE = /^(?:\s*(?::root|html|body|\[data-(?:theme|mode|color-scheme)(?:=["']?[\w-]+["']?)?\])\s*,?)+$/i;
+function tokensFromStackmyth(css, options = {}) {
+  const mode = options.mode ?? "light";
+  const all = (Array.isArray(css) ? css : [css]).flatMap(declarations);
+  const named = options.theme ?? all.map((d) => d.within.map((w) => NAMED.exec(w)?.[1]).find((n) => n && !/^(dark|light)$/i.test(n))).find(Boolean);
+  const vars = /* @__PURE__ */ new Map();
+  for (const d of all) {
+    if (!applies(d, { mode, theme: named })) continue;
+    if (!d.within.every((w) => w.startsWith("@") || THEME_SCOPE.test(w))) continue;
+    vars.set(d.name, d.value);
+  }
+  const inline = (value, depth = 0) => {
+    if (depth > 16) return null;
+    let failed = false;
+    let out2 = value;
+    for (let guard = 0; guard < 64; guard++) {
+      const next = out2.replace(/var\(\s*(--(?!sm-)[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+        const known = vars.get(name);
+        const got = known !== void 0 ? inline(known, depth + 1) : fallback !== void 0 ? inline(fallback.trim(), depth + 1) : null;
+        if (got === null) failed = true;
+        return got ?? "";
+      });
+      if (failed) return null;
+      if (next === out2) break;
+      out2 = next;
+    }
+    return out2;
+  };
+  const tokens = {};
+  const warnings = [];
+  for (const [name, raw] of vars) {
+    if (!/^--sm-[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) continue;
+    const written = inline(raw);
+    const value = written === null ? null : tokenValue(written);
+    if (value === null) warnings.push(`${name}: "${raw.length > 60 ? raw.slice(0, 57) + "\u2026" : raw}" is not a value Cauthy takes`);
+    else tokens[name] = value;
+  }
+  if (Object.keys(tokens).length === 0) warnings.push("no --sm-* token was found in these stylesheets");
+  return { tokens, warnings };
+}
 function resolve(value, vars, seen = 0) {
   if (seen > 16) return null;
   let unresolved = false;
@@ -249,6 +384,63 @@ function themeFromStackmyth(css, options = {}) {
   else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
   return { theme, warnings };
 }
+var RADII = ["radius", "buttonRadius"];
+var SHADCN = [
+  ["background", ["--background", "--color-background"]],
+  ["surface", ["--card", "--color-card", "--popover", "--color-popover"]],
+  ["text", ["--foreground", "--color-foreground"]],
+  ["textMuted", ["--muted-foreground", "--color-muted-foreground"]],
+  ["border", ["--border", "--color-border"]],
+  ["inputBorder", ["--input", "--color-input"]],
+  ["primary", ["--primary", "--color-primary"]],
+  ["primaryText", ["--primary-foreground", "--color-primary-foreground"]],
+  ["accent", ["--ring", "--color-ring", "--primary", "--color-primary"]],
+  ["error", ["--destructive", "--color-destructive"]],
+  ["radius", ["--radius"]],
+  ["buttonRadius", ["--radius"]],
+  ["fontFamily", ["--font-sans", "--font-family"]]
+];
+function shadcnColor(value) {
+  return /^[\d.]+(?:deg)?\s+[\d.]+%\s+[\d.]+%(?:\s*\/\s*[\d.]+%?)?$/.test(value.trim()) ? toColor(`hsl(${value.trim()})`) : toColor(value);
+}
+function pageVariables(css, mode, theme) {
+  const vars = /* @__PURE__ */ new Map();
+  for (const sheet of Array.isArray(css) ? css : [css]) {
+    for (const d of declarations(sheet)) if (applies(d, { mode, theme })) vars.set(d.name, d.value);
+  }
+  return vars;
+}
+function themeFromCss(css, options = {}) {
+  const mode = options.mode ?? "light";
+  const vars = pageVariables(css, mode, options.theme);
+  const names = [...vars.keys()];
+  let format;
+  if (options.format && options.format !== "auto") format = options.format;
+  else if (options.map && Object.keys(options.map).length > 0) format = "custom";
+  else if (names.some((n) => n.startsWith("--sm-"))) format = "stackmyth";
+  else if (names.some((n) => /^--(color-)?(primary|background|foreground)$/.test(n))) format = "shadcn";
+  else format = "custom";
+  if (format === "stackmyth") return { ...themeFromStackmyth(css, { mode, theme: options.theme }), format };
+  const spec = format === "shadcn" ? SHADCN : Object.entries(options.map ?? {}).filter(([, v]) => v).map(([k, v]) => [k, [String(v).startsWith("--") ? String(v) : `--${v}`]]);
+  const theme = {};
+  const warnings = [];
+  for (const [field, tokens] of spec) {
+    for (const token of tokens) {
+      const raw = vars.get(token);
+      if (raw === void 0) continue;
+      const value = resolve(raw, vars);
+      const got = value === null ? null : RADII.includes(field) ? toRadius(value) : field === "fontFamily" ? toFont(value) : format === "shadcn" ? shadcnColor(value) : toColor(value);
+      if (got !== null) {
+        theme[field] = got;
+        break;
+      }
+      warnings.push(`${token}: "${raw.length > 60 ? raw.slice(0, 57) + "\u2026" : raw}" is not ${RADII.includes(field) ? "a length" : field === "fontFamily" ? "a font list" : "a colour"} Cauthy can take`);
+    }
+  }
+  if (vars.size === 0) warnings.push("no custom properties were found in these stylesheets");
+  else if (format === "custom" && spec.length === 0) warnings.push("these stylesheets use names of their own: say which variable each value is read from");
+  return { theme, warnings, format };
+}
 function toWire(theme) {
   const names = {
     background: "background",
@@ -274,7 +466,8 @@ function toWire(theme) {
     panelIconUrl: "panel_icon_url",
     texts: "texts",
     inputBackground: "input_background",
-    inputBorder: "input_border"
+    inputBorder: "input_border",
+    tokens: "tokens"
   };
   const wire = {};
   for (const [k, v] of Object.entries(theme)) {
@@ -283,12 +476,44 @@ function toWire(theme) {
   }
   return wire;
 }
+function fromWire(wire) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    text_muted: "textMuted",
+    border: "border",
+    primary: "primary",
+    primary_text: "primaryText",
+    accent: "accent",
+    error: "error",
+    error_background: "errorBackground",
+    success: "success",
+    success_background: "successBackground",
+    radius: "radius",
+    button_radius: "buttonRadius",
+    font_family: "fontFamily",
+    logo_url: "logoUrl",
+    fonts: "fonts",
+    layout: "layout",
+    panel_colors: "panelColors",
+    panel_text: "panelText",
+    panel_icon_url: "panelIconUrl",
+    texts: "texts",
+    input_background: "inputBackground",
+    input_border: "inputBorder",
+    tokens: "tokens"
+  };
+  const theme = {};
+  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== void 0 && v !== null && v !== "") theme[names[k]] = v;
+  return theme;
+}
 async function pushTheme(o) {
-  const env = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = o.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
-  const tenant = o.tenant ?? env("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env("CAUTHY_TOKEN") ?? "";
+  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
   }
@@ -303,6 +528,184 @@ async function pushTheme(o) {
   }
 }
 
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`cauthy-auth: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+
+// src/system.ts
+var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var SKEW_MS = 3e4;
+var CauthyApiError = class extends Error {
+  constructor(status, code, message) {
+    super(`cauthy-auth: ${message}`);
+    this.status = status;
+    this.code = code;
+    this.name = "CauthyApiError";
+  }
+  status;
+  code;
+};
+function env(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function toOrganization(o) {
+  return {
+    id: o.id,
+    system: o.system,
+    name: o.name,
+    kind: o.kind,
+    externalId: o.external_id,
+    status: o.status,
+    metadata: o.metadata ?? {},
+    members: o.members,
+    createdAt: o.created_at,
+    updatedAt: o.updated_at
+  };
+}
+function toMember(m) {
+  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...m.invited === void 0 ? {} : { invited: m.invited } };
+}
+function asJwk(k) {
+  if (typeof k.privateKey !== "string") return k.privateKey;
+  return k.privateKey.includes("BEGIN") ? void 0 : JSON.parse(k.privateKey);
+}
+async function loadKey(k) {
+  const jwk = asJwk(k);
+  return jwk ? (0, import_jose.importJWK)(jwk, "RS256") : (0, import_jose.importPKCS8)(k.privateKey, "RS256", { extractable: true });
+}
+function createSystem(given = {}) {
+  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
+  const envKey = env("CAUTHY_SYSTEM_KEY");
+  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const tokenEndpoint = `${issuer}/v1/oauth/token`;
+  function configured() {
+    if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
+    if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+    if (key ? key.keyId === "" : clientSecret === "") {
+      throw new CauthyConfigError(key ? "the key needs its id (CAUTHY_SYSTEM_KEY_ID)" : "to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)");
+    }
+  }
+  let imported;
+  const signingKey = () => imported ??= loadKey(key);
+  async function fail2(res, what) {
+    const body = await res.json().catch(() => null);
+    const first = body?.errors?.[0];
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  let held;
+  let asking;
+  async function ask() {
+    configured();
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    if (key) {
+      const assertion = await new import_jose.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      form.set("client_assertion_type", ASSERTION_TYPE);
+      form.set("client_assertion", assertion);
+    } else {
+      form.set("client_secret", clientSecret);
+    }
+    const res = await doFetch(tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    if (!res.ok) await fail2(res, "the application's own token");
+    const t = await res.json();
+    held = { value: t.access_token, until: Date.now() + t.expires_in * 1e3 - SKEW_MS };
+    return t.access_token;
+  }
+  function token() {
+    if (held && Date.now() < held.until) return Promise.resolve(held.value);
+    return asking ??= ask().finally(() => {
+      asking = void 0;
+    });
+  }
+  async function call(method, path, body) {
+    const send = async () => doFetch(`${issuer}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    let res = await send();
+    if (res.status === 401 && held) {
+      held = void 0;
+      res = await send();
+    }
+    if (!res.ok) await fail2(res, `${method} ${path}`);
+    return res.status === 204 ? void 0 : res.json();
+  }
+  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const id = encodeURIComponent;
+  return {
+    token,
+    request: data,
+    organizations: {
+      async list(query = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(query)) if (v !== void 0) q.set(k, String(v));
+        const out2 = await call("GET", `/v1/organizations${q.size ? `?${q}` : ""}`);
+        return { items: out2.data.map(toOrganization), total: out2.total_count };
+      },
+      async create(input) {
+        return toOrganization(await data(
+          "POST",
+          "/v1/organizations",
+          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }
+        ));
+      },
+      async get(orgId) {
+        return toOrganization(await data("GET", `/v1/organizations/${id(orgId)}`));
+      },
+      async update(orgId, patch) {
+        return toOrganization(await data("PATCH", `/v1/organizations/${id(orgId)}`, patch));
+      },
+      async remove(orgId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}`);
+      }
+    },
+    members: {
+      async list(orgId) {
+        return (await data("GET", `/v1/organizations/${id(orgId)}/members`)).map(toMember);
+      },
+      async add(orgId, m) {
+        return toMember(await data(
+          "POST",
+          `/v1/organizations/${id(orgId)}/members`,
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+        ));
+      },
+      async setRole(orgId, userId, role) {
+        return toMember(await data("PUT", `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }));
+      },
+      async remove(orgId, userId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}/members/${id(userId)}`);
+      }
+    },
+    async invite(person) {
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      return { id: u.id, email: u.email };
+    },
+    theme: {
+      async get(of = clientId) {
+        return fromWire(await data("GET", `/v1/oauth/clients/${id(of)}/theme`));
+      }
+    },
+    policy: {
+      async get(system) {
+        return (await data("GET", `/v1/systems/${id(system)}/policy`)).roles ?? [];
+      }
+    },
+    async publicJwks() {
+      if (!key) return { keys: [] };
+      const { kty, n, e } = asJwk(key) ?? await (0, import_jose.exportJWK)(await signingKey());
+      return { keys: [{ kty, n, e, kid: key.keyId, alg: "RS256", use: "sig" }] };
+    }
+  };
+}
+
 // src/cli.ts
 var INIT_HELP = `cauthy-auth init --system <name> --app-url <address> [options]
 
@@ -375,7 +778,23 @@ Then, in the application:
 and serve auth.handler(request) under ${(given["--callback-path"] ?? "/api/auth/callback").replace(/\/callback$/, "")}/*.
 `);
 }
-var POLICY_HELP = `cauthy-auth policy --file <roles.json> [--system <name>] [--push]
+var POLICY_HELP = `cauthy-auth policy --pull [--out <file.ts>] [--system <name>]
+cauthy-auth policy --file <roles.json> [--system <name>] [--push]
+
+--pull writes the catalog Cauthy has as a TypeScript module, so the
+application's roles and permissions are typed from it:
+
+  import { can, hasRole } from './policy'
+  can(organization, 'ledger:write')
+
+  --pull            Read the catalog from Cauthy.
+  --out <file>      Write the module there. Without it, it is printed.
+
+To pull: CAUTHY_ISSUER, CAUTHY_SYSTEM, and either the application's own
+identity (CAUTHY_CLIENT_ID with CAUTHY_CLIENT_SECRET) or CAUTHY_TENANT with
+CAUTHY_TOKEN (a personal access token with organizations:manage).
+
+--file does the opposite, once:
 
 Loads a system's catalog of roles into Cauthy from a file:
 
@@ -402,16 +821,34 @@ async function policy(argv) {
   let file;
   let system;
   let push = false;
+  let pull = false;
+  let out2;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const value = () => argv[++i] ?? fail(`${arg} needs a value`);
     if (arg === "--file") file = value();
     else if (arg === "--system") system = value();
     else if (arg === "--push") push = true;
+    else if (arg === "--pull") pull = true;
+    else if (arg === "--out") out2 = value();
     else fail(`unknown option ${arg}
 
 ${POLICY_HELP}`);
   }
+  if (pull) {
+    const of = system ?? process.env.CAUTHY_SYSTEM ?? fail("name the system with --system or CAUTHY_SYSTEM");
+    const read = process.env.CAUTHY_TOKEN ? await pullPolicy({ system: of }) : await createSystem().policy.get(of);
+    if (read.length === 0) fail(`Cauthy has no catalog of roles for "${of}"`);
+    const source = policySource(of, read);
+    if (out2) {
+      (0, import_node_fs.writeFileSync)(out2, source);
+      process.stdout.write(`${read.length} roles written to ${out2}: ${read.map((r) => r.role).join(", ")}
+`);
+    } else {
+      process.stdout.write(source);
+    }
+    return;
+  }
   if (!file) fail("give the catalog with --file\n\n" + POLICY_HELP);
   let roles;
   try {
@@ -436,11 +873,20 @@ var HELP = `cauthy-auth init \u2026     connect an application to Cauthy (cauthy
 cauthy-auth policy \u2026   load a system's catalog of roles (cauthy-auth policy --help)
 cauthy-auth theme [options]
 
-Reads the application's Stackmyth theme and gives it to Cauthy's hosted pages.
+Reads the application's look out of its stylesheets and gives it to Cauthy:
+its hosted pages, and cauthy-auth's ready-made forms. The dashboard (Sign-in
+Page Look) does the same with a preview.
 
-  --css <file>      A stylesheet that declares --sm-* tokens. Repeat it, in the
-                    order the application loads them: Stackmyth's own first,
-                    the application's brand file after.
+  --css <file>      A stylesheet that sets the application's colours. Repeat it,
+                    in the order the application loads them.
+  --format <name>   auto (default), shadcn (shadcn/ui and Tailwind), stackmyth,
+                    or custom with --map.
+  --map <v>=<var>   For custom: which variable a value is read from, e.g.
+                    --map primary=--brand --map radius=--corner. Values:
+                    primary, primaryText, accent, background, surface, text,
+                    textMuted, border, inputBackground, inputBorder, error,
+                    errorBackground, success, successBackground, radius,
+                    buttonRadius, fontFamily.
   --theme <name>    The named theme to read, for a sheet with [data-theme=\u2026].
   --mode <mode>     light (default) or dark.
   --logo <url>      An https image shown where "Cauthy" is.
@@ -468,6 +914,8 @@ async function main(argv) {
   let logoUrl;
   let push = false;
   let clear = false;
+  let format = "auto";
+  const map = {};
   for (let i = 1; i < argv.length; i++) {
     const arg = argv[i];
     const value = () => argv[++i] ?? fail(`${arg} needs a value`);
@@ -477,6 +925,14 @@ async function main(argv) {
       const m = value();
       if (m !== "light" && m !== "dark") fail("--mode is light or dark");
       mode = m;
+    } else if (arg === "--format") {
+      const f = value();
+      if (!["auto", "shadcn", "stackmyth", "custom"].includes(f)) fail("--format is auto, shadcn, stackmyth or custom");
+      format = f;
+    } else if (arg === "--map") {
+      const m = /^(\w+)=(.+)$/.exec(value());
+      if (!m) fail("--map is <value>=<variable>, e.g. primary=--brand");
+      map[m[1]] = m[2];
     } else if (arg === "--logo") logoUrl = value();
     else if (arg === "--push") push = true;
     else if (arg === "--clear") clear = true;
@@ -497,8 +953,17 @@ ${HELP}`);
       return fail(`cannot read ${f}`);
     }
   });
-  const imported = themeFromStackmyth(sheets, { theme, mode, logoUrl });
-  for (const w of imported.warnings) process.stderr.write(`warning: ${w}
+  const imported = themeFromCss(sheets, { format, theme, mode, map: Object.keys(map).length > 0 ? map : void 0 });
+  if (logoUrl) imported.theme.logoUrl = logoUrl;
+  const warnings = [...imported.warnings];
+  if (imported.format === "stackmyth") {
+    const read = tokensFromStackmyth(sheets, { theme, mode });
+    if (Object.keys(read.tokens).length > 0) imported.theme.tokens = read.tokens;
+    warnings.push(...read.warnings);
+  }
+  process.stderr.write(`read as: ${imported.format}
+`);
+  for (const w of warnings) process.stderr.write(`warning: ${w}
 `);
   if (Object.keys(imported.theme).length === 0) fail("no theme could be read from these stylesheets");
   process.stdout.write(JSON.stringify(toWire(imported.theme), null, 2) + "\n");