cauthy-auth 0.5.2 → 0.8.0

package/dist/{system-DvcQjORr.d.ts → system-DhRr_WxR.d.ts}

@@ -1,6 +1,113 @@
 import { JWK } from 'jose';
 import { CauthyTheme } from './theme.js';
 
+/** The part of an organization that says what its member may do. */
+interface Permitted {
+    /** "resource:action" entries the person is allowed; "*" is any. Absent when the system keeps no catalog in Cauthy. */
+    permissions?: string[];
+    /** Entries the person is denied whatever else allows them. */
+    denied?: string[];
+}
+/**
+ * Whether the person may do an action on a resource in an organization:
+ * allowed by some entry, and denied by none. A denial wins.
+ *
+ * An organization of a system that keeps no catalog in Cauthy carries no
+ * permissions, and the answer is `false`: decide by its `role` instead.
+ *
+ *   if (!can(organization, 'invoicing', 'write')) return forbidden()
+ */
+declare function can(organization: Permitted | null | undefined, resource: string, action: string): boolean;
+/** Something a role may do: an action on a resource, in organizations of a kind ("*", the default, is every kind). */
+interface PolicyPermission {
+    kind?: string;
+    resource: string;
+    action: string;
+}
+interface PolicyRole {
+    role: string;
+    name?: string;
+    description?: string;
+    /** Roles whose permissions this one has as well. */
+    inherits?: string[];
+    permissions?: PolicyPermission[];
+}
+/** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */
+type RoleShape = {
+    readonly role: string;
+    readonly name?: string;
+    readonly description?: string;
+    readonly inherits?: readonly string[];
+    readonly permissions?: readonly {
+        readonly kind?: string;
+        readonly resource: string;
+        readonly action: string;
+    }[];
+};
+type Named<S extends string> = S extends '*' ? string : S;
+type PermissionsIn<R> = R extends {
+    readonly permissions: readonly (infer P)[];
+} ? P extends {
+    readonly resource: infer Res extends string;
+    readonly action: infer Act extends string;
+} ? `${Named<Res>}:${Named<Act>}` : never : never;
+/** The roles a catalog names: `RoleOf<typeof policy>`. */
+type RoleOf<P> = P extends Policy<infer R, string> ? R : never;
+/** The "resource:action" permissions a catalog names: `PermissionOf<typeof policy>`. */
+type PermissionOf<P> = P extends Policy<string, infer X> ? X : never;
+interface Policy<Role extends string = string, Permission extends string = string> {
+    /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */
+    roles: PolicyRole[];
+    /** Every role's name. */
+    roleNames: Role[];
+    /** Every permission some role has, as "resource:action". */
+    permissions: Permission[];
+    /**
+     * Whether the person may do this in the organization: `can(org, 'ledger:write')`.
+     * It reads what Cauthy sent with the session, so a catalog edited in Cauthy
+     * since this file was written is still what decides.
+     */
+    can(organization: Permitted | null | undefined, permission: Permission): boolean;
+    /** Whether the person's role in the organization is one of these. */
+    hasRole(organization: {
+        role: string;
+    } | null | undefined, ...roles: Role[]): boolean;
+    /**
+     * What a role may do by this catalog, with what it inherits: for showing a
+     * role, never for deciding about a person (their exceptions are not here).
+     */
+    permissionsOf(role: Role): Permission[];
+}
+/** Gives a catalog of roles its types. See the top of this section. */
+declare function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>;
+/**
+ * A TypeScript module that defines the catalog given, for `cauthy-auth policy
+ * --pull` to write: the application's types then come from the catalog
+ * Cauthy has.
+ */
+declare function policySource(system: string, roles: PolicyRole[]): string;
+/** Reads a system's catalog of roles from Cauthy, with a personal access token. */
+declare function pullPolicy(o?: Omit<PushPolicyOptions, 'roles'>): Promise<PolicyRole[]>;
+interface PushPolicyOptions {
+    /** The system whose catalog this is. Default: `CAUTHY_SYSTEM`. */
+    system?: string;
+    roles: PolicyRole[];
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The workspace's slug. Default: `CAUTHY_TENANT`. */
+    tenant?: string;
+    /** A personal access token with `organizations:manage`. Default: `CAUTHY_TOKEN`. */
+    token?: string;
+    fetch?: typeof fetch;
+}
+/**
+ * Gives Cauthy a system's catalog of roles, replacing the one it has. It is
+ * the way to load a first catalog from what a system already had; from then on
+ * the catalog is Cauthy's, edited in its dashboard, and pushing again would
+ * overwrite what was edited there.
+ */
+declare function pushPolicy(o: PushPolicyOptions): Promise<void>;
+
 /** How an application is set up to sign its people in with Cauthy. */
 interface CauthyOptions {
     /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
@@ -20,6 +127,12 @@ interface CauthyOptions {
      * system's. Default: `CAUTHY_SYSTEM`.
      */
     system?: string;
+    /**
+     * The workspace's slug in Cauthy. Needed for the application's own sign-in
+     * screens (`signIn.email`, `signUp.email`…), which sign people in through
+     * the application's server instead of Cauthy's page. Default: `CAUTHY_TENANT`.
+     */
+    tenant?: string;
     /** Where the routes are mounted. Default: `/api/auth`. */
     basePath?: string;
     /**
@@ -40,6 +153,27 @@ interface CauthyOptions {
      * `CAUTHY_SYSTEM_KEY_ID`.
      */
     systemKey?: SystemKey;
+    /**
+     * The application's own pages for what arrives by mail. A link Cauthy mails
+     * opens the page named here, with a `token` to give back; with none, it
+     * opens Cauthy's own page.
+     *
+     *   signIn         where `<SignIn />` is: a sign-in link opens it
+     *   resetPassword  where `<ResetPassword />` is
+     *   verifyEmail    where `<VerifyEmail />` is
+     */
+    pages?: {
+        signIn?: string;
+        resetPassword?: string;
+        verifyEmail?: string;
+    };
+    /**
+     * The address of the person a request comes from, passed on to Cauthy so
+     * its limits on attempts count the person and not this server. Default: the
+     * last address in `X-Forwarded-For`, which is the one the proxy in front of
+     * the application wrote. With several proxies, or none, give your own.
+     */
+    clientIp?: (request: Request) => string | undefined;
     /** `fetch` to reach Cauthy with. Default: the global one. */
     fetch?: typeof fetch;
 }
@@ -231,6 +365,10 @@ interface CauthySystem {
     theme: {
         get(clientId?: string): Promise<CauthyTheme>;
     };
+    /** The catalog of roles of one of the application's systems, as Cauthy has it. */
+    policy: {
+        get(system: string): Promise<PolicyRole[]>;
+    };
     /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
     publicJwks(): Promise<{
         keys: JWK[];
@@ -238,4 +376,4 @@ interface CauthySystem {
 }
 declare function createSystem(given?: SystemOptions): CauthySystem;
 
-export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PublicSession as P, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type SessionOrganization as e, type SessionStatus as f, type SessionUser as g, type SystemKey as h, type SystemOptions as i, createSystem as j };
+export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PermissionOf as P, type RoleOf as R, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type Permitted as e, type Policy as f, type PolicyPermission as g, type PolicyRole as h, type PublicSession as i, type PushPolicyOptions as j, type SessionOrganization as k, type SessionStatus as l, type SessionUser as m, type SystemKey as n, type SystemOptions as o, can as p, createSystem as q, definePolicy as r, policySource as s, pullPolicy as t, pushPolicy as u };

package/dist/{system-CR8p4BjB.d.mts → system-ZD_Wa8Bm.d.mts}

@@ -1,6 +1,113 @@
 import { JWK } from 'jose';
 import { CauthyTheme } from './theme.mjs';
 
+/** The part of an organization that says what its member may do. */
+interface Permitted {
+    /** "resource:action" entries the person is allowed; "*" is any. Absent when the system keeps no catalog in Cauthy. */
+    permissions?: string[];
+    /** Entries the person is denied whatever else allows them. */
+    denied?: string[];
+}
+/**
+ * Whether the person may do an action on a resource in an organization:
+ * allowed by some entry, and denied by none. A denial wins.
+ *
+ * An organization of a system that keeps no catalog in Cauthy carries no
+ * permissions, and the answer is `false`: decide by its `role` instead.
+ *
+ *   if (!can(organization, 'invoicing', 'write')) return forbidden()
+ */
+declare function can(organization: Permitted | null | undefined, resource: string, action: string): boolean;
+/** Something a role may do: an action on a resource, in organizations of a kind ("*", the default, is every kind). */
+interface PolicyPermission {
+    kind?: string;
+    resource: string;
+    action: string;
+}
+interface PolicyRole {
+    role: string;
+    name?: string;
+    description?: string;
+    /** Roles whose permissions this one has as well. */
+    inherits?: string[];
+    permissions?: PolicyPermission[];
+}
+/** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */
+type RoleShape = {
+    readonly role: string;
+    readonly name?: string;
+    readonly description?: string;
+    readonly inherits?: readonly string[];
+    readonly permissions?: readonly {
+        readonly kind?: string;
+        readonly resource: string;
+        readonly action: string;
+    }[];
+};
+type Named<S extends string> = S extends '*' ? string : S;
+type PermissionsIn<R> = R extends {
+    readonly permissions: readonly (infer P)[];
+} ? P extends {
+    readonly resource: infer Res extends string;
+    readonly action: infer Act extends string;
+} ? `${Named<Res>}:${Named<Act>}` : never : never;
+/** The roles a catalog names: `RoleOf<typeof policy>`. */
+type RoleOf<P> = P extends Policy<infer R, string> ? R : never;
+/** The "resource:action" permissions a catalog names: `PermissionOf<typeof policy>`. */
+type PermissionOf<P> = P extends Policy<string, infer X> ? X : never;
+interface Policy<Role extends string = string, Permission extends string = string> {
+    /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */
+    roles: PolicyRole[];
+    /** Every role's name. */
+    roleNames: Role[];
+    /** Every permission some role has, as "resource:action". */
+    permissions: Permission[];
+    /**
+     * Whether the person may do this in the organization: `can(org, 'ledger:write')`.
+     * It reads what Cauthy sent with the session, so a catalog edited in Cauthy
+     * since this file was written is still what decides.
+     */
+    can(organization: Permitted | null | undefined, permission: Permission): boolean;
+    /** Whether the person's role in the organization is one of these. */
+    hasRole(organization: {
+        role: string;
+    } | null | undefined, ...roles: Role[]): boolean;
+    /**
+     * What a role may do by this catalog, with what it inherits: for showing a
+     * role, never for deciding about a person (their exceptions are not here).
+     */
+    permissionsOf(role: Role): Permission[];
+}
+/** Gives a catalog of roles its types. See the top of this section. */
+declare function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>;
+/**
+ * A TypeScript module that defines the catalog given, for `cauthy-auth policy
+ * --pull` to write: the application's types then come from the catalog
+ * Cauthy has.
+ */
+declare function policySource(system: string, roles: PolicyRole[]): string;
+/** Reads a system's catalog of roles from Cauthy, with a personal access token. */
+declare function pullPolicy(o?: Omit<PushPolicyOptions, 'roles'>): Promise<PolicyRole[]>;
+interface PushPolicyOptions {
+    /** The system whose catalog this is. Default: `CAUTHY_SYSTEM`. */
+    system?: string;
+    roles: PolicyRole[];
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The workspace's slug. Default: `CAUTHY_TENANT`. */
+    tenant?: string;
+    /** A personal access token with `organizations:manage`. Default: `CAUTHY_TOKEN`. */
+    token?: string;
+    fetch?: typeof fetch;
+}
+/**
+ * Gives Cauthy a system's catalog of roles, replacing the one it has. It is
+ * the way to load a first catalog from what a system already had; from then on
+ * the catalog is Cauthy's, edited in its dashboard, and pushing again would
+ * overwrite what was edited there.
+ */
+declare function pushPolicy(o: PushPolicyOptions): Promise<void>;
+
 /** How an application is set up to sign its people in with Cauthy. */
 interface CauthyOptions {
     /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
@@ -20,6 +127,12 @@ interface CauthyOptions {
      * system's. Default: `CAUTHY_SYSTEM`.
      */
     system?: string;
+    /**
+     * The workspace's slug in Cauthy. Needed for the application's own sign-in
+     * screens (`signIn.email`, `signUp.email`…), which sign people in through
+     * the application's server instead of Cauthy's page. Default: `CAUTHY_TENANT`.
+     */
+    tenant?: string;
     /** Where the routes are mounted. Default: `/api/auth`. */
     basePath?: string;
     /**
@@ -40,6 +153,27 @@ interface CauthyOptions {
      * `CAUTHY_SYSTEM_KEY_ID`.
      */
     systemKey?: SystemKey;
+    /**
+     * The application's own pages for what arrives by mail. A link Cauthy mails
+     * opens the page named here, with a `token` to give back; with none, it
+     * opens Cauthy's own page.
+     *
+     *   signIn         where `<SignIn />` is: a sign-in link opens it
+     *   resetPassword  where `<ResetPassword />` is
+     *   verifyEmail    where `<VerifyEmail />` is
+     */
+    pages?: {
+        signIn?: string;
+        resetPassword?: string;
+        verifyEmail?: string;
+    };
+    /**
+     * The address of the person a request comes from, passed on to Cauthy so
+     * its limits on attempts count the person and not this server. Default: the
+     * last address in `X-Forwarded-For`, which is the one the proxy in front of
+     * the application wrote. With several proxies, or none, give your own.
+     */
+    clientIp?: (request: Request) => string | undefined;
     /** `fetch` to reach Cauthy with. Default: the global one. */
     fetch?: typeof fetch;
 }
@@ -231,6 +365,10 @@ interface CauthySystem {
     theme: {
         get(clientId?: string): Promise<CauthyTheme>;
     };
+    /** The catalog of roles of one of the application's systems, as Cauthy has it. */
+    policy: {
+        get(system: string): Promise<PolicyRole[]>;
+    };
     /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
     publicJwks(): Promise<{
         keys: JWK[];
@@ -238,4 +376,4 @@ interface CauthySystem {
 }
 declare function createSystem(given?: SystemOptions): CauthySystem;
 
-export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PublicSession as P, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type SessionOrganization as e, type SessionStatus as f, type SessionUser as g, type SystemKey as h, type SystemOptions as i, createSystem as j };
+export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PermissionOf as P, type RoleOf as R, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type Permitted as e, type Policy as f, type PolicyPermission as g, type PolicyRole as h, type PublicSession as i, type PushPolicyOptions as j, type SessionOrganization as k, type SessionStatus as l, type SessionUser as m, type SystemKey as n, type SystemOptions as o, can as p, createSystem as q, definePolicy as r, policySource as s, pullPolicy as t, pushPolicy as u };

package/dist/theme.d.mts

@@ -68,6 +68,12 @@ interface CauthyTheme {
     panelIconUrl?: string;
     /** The application's own words on the sign-in page, by language (`en`, `es`). */
     texts?: Record<string, ThemeTexts>;
+    /**
+     * The application's Stackmyth tokens (`--sm-*`), from `tokensFromStackmyth`.
+     * Cauthy's pages are drawn with Stackmyth's components, so these make its
+     * buttons and fields the application's own. They are laid over the named values.
+     */
+    tokens?: Record<string, string>;
 }
 interface StackmythThemeOptions {
     /**
@@ -85,6 +91,22 @@ interface ImportedTheme {
     /** Tokens that were there and could not be carried over, and why. */
     warnings: string[];
 }
+interface StackmythTokens {
+    /** Every `--sm-*` token the stylesheets set for the page, ready for `theme.tokens`. */
+    tokens: Record<string, string>;
+    /** Tokens that were there and Cauthy would not take, and why. */
+    warnings: string[];
+}
+/**
+ * Reads an application's Stackmyth tokens out of its stylesheets: every
+ * `--sm-*` custom property its theme sets, in the order the sheets are given
+ * (a later one wins). Its own names — a brand palette the tokens point at —
+ * are written in, so what comes out stands on Stackmyth's names alone.
+ *
+ * Cauthy's sign-in pages are drawn with Stackmyth's components: these tokens
+ * are what makes them look like the application.
+ */
+declare function tokensFromStackmyth(css: string | string[], options?: StackmythThemeOptions): StackmythTokens;
 /** A colour as Cauthy takes it — `#rrggbb` or `rgba(…)` — or null when it is none it can read. */
 declare function toColor(value: string): string | null;
 /**
@@ -97,6 +119,39 @@ declare function toColor(value: string): string | null;
  * application's dark mode is left out unless asked for.
  */
 declare function themeFromStackmyth(css: string | string[], options?: StackmythThemeOptions): ImportedTheme;
+/** The values of a theme a stylesheet can say. */
+type ThemeField = 'background' | 'surface' | 'text' | 'textMuted' | 'border' | 'inputBackground' | 'inputBorder' | 'primary' | 'primaryText' | 'accent' | 'error' | 'errorBackground' | 'success' | 'successBackground' | 'radius' | 'buttonRadius' | 'fontFamily';
+/** How a stylesheet names its look: Stackmyth's tokens, shadcn/ui's (and Tailwind's), or the application's own. */
+type CssFormat = 'stackmyth' | 'shadcn' | 'custom';
+interface CssThemeOptions {
+    /** Which names to read. Default: `auto`, told from the stylesheet itself. */
+    format?: CssFormat | 'auto';
+    /** Which of the application's two modes to take. Default: `light`. */
+    mode?: 'light' | 'dark';
+    /** The named theme to read, when the stylesheet keeps several under `[data-theme=…]`. */
+    theme?: string;
+    /** For `custom`: the variable each value is read from, `{ primary: '--brand' }`. */
+    map?: Partial<Record<ThemeField, string>>;
+}
+interface CssImportedTheme extends ImportedTheme {
+    /** The names that were read. */
+    format: CssFormat;
+}
+/** The custom properties a stylesheet sets for the page, by name: what a person picks from to map their own. */
+declare function cssVariables(css: string | string[], options?: Pick<CssThemeOptions, 'mode' | 'theme'>): string[];
+/**
+ * Reads an application's look out of its stylesheets, whatever names it uses:
+ * Stackmyth's tokens, shadcn/ui's (`--primary`, `--radius`, on Tailwind 3 or
+ * 4), or the application's own variables given in `map`. What comes out is a
+ * theme of named values, never CSS.
+ */
+declare function themeFromCss(css: string | string[], options?: CssThemeOptions): CssImportedTheme;
+/**
+ * A theme as the CSS variables of `cauthy-auth/styles.css` (`--cauthy-*`), for
+ * the forms an application shows on its own pages. The page's own background,
+ * the layout and the words are Cauthy's pages' matter, and left out.
+ */
+declare function themeVariables(theme: CauthyTheme): Record<string, string>;
 /** A theme as Cauthy's API names its values. */
 declare function toWire(theme: CauthyTheme): Record<string, unknown>;
 /** A theme as Cauthy answers it, in this package's names. */
@@ -123,4 +178,4 @@ interface PushThemeOptions {
  */
 declare function pushTheme(o: PushThemeOptions): Promise<void>;
 
-export { type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type ThemeFont, type ThemeTexts, fromWire, pushTheme, themeFromStackmyth, toColor, toWire };
+export { type CauthyTheme, type CssFormat, type CssImportedTheme, type CssThemeOptions, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type StackmythTokens, type ThemeField, type ThemeFont, type ThemeTexts, cssVariables, fromWire, pushTheme, themeFromCss, themeFromStackmyth, themeVariables, toColor, toWire, tokensFromStackmyth };

package/dist/theme.d.ts

@@ -68,6 +68,12 @@ interface CauthyTheme {
     panelIconUrl?: string;
     /** The application's own words on the sign-in page, by language (`en`, `es`). */
     texts?: Record<string, ThemeTexts>;
+    /**
+     * The application's Stackmyth tokens (`--sm-*`), from `tokensFromStackmyth`.
+     * Cauthy's pages are drawn with Stackmyth's components, so these make its
+     * buttons and fields the application's own. They are laid over the named values.
+     */
+    tokens?: Record<string, string>;
 }
 interface StackmythThemeOptions {
     /**
@@ -85,6 +91,22 @@ interface ImportedTheme {
     /** Tokens that were there and could not be carried over, and why. */
     warnings: string[];
 }
+interface StackmythTokens {
+    /** Every `--sm-*` token the stylesheets set for the page, ready for `theme.tokens`. */
+    tokens: Record<string, string>;
+    /** Tokens that were there and Cauthy would not take, and why. */
+    warnings: string[];
+}
+/**
+ * Reads an application's Stackmyth tokens out of its stylesheets: every
+ * `--sm-*` custom property its theme sets, in the order the sheets are given
+ * (a later one wins). Its own names — a brand palette the tokens point at —
+ * are written in, so what comes out stands on Stackmyth's names alone.
+ *
+ * Cauthy's sign-in pages are drawn with Stackmyth's components: these tokens
+ * are what makes them look like the application.
+ */
+declare function tokensFromStackmyth(css: string | string[], options?: StackmythThemeOptions): StackmythTokens;
 /** A colour as Cauthy takes it — `#rrggbb` or `rgba(…)` — or null when it is none it can read. */
 declare function toColor(value: string): string | null;
 /**
@@ -97,6 +119,39 @@ declare function toColor(value: string): string | null;
  * application's dark mode is left out unless asked for.
  */
 declare function themeFromStackmyth(css: string | string[], options?: StackmythThemeOptions): ImportedTheme;
+/** The values of a theme a stylesheet can say. */
+type ThemeField = 'background' | 'surface' | 'text' | 'textMuted' | 'border' | 'inputBackground' | 'inputBorder' | 'primary' | 'primaryText' | 'accent' | 'error' | 'errorBackground' | 'success' | 'successBackground' | 'radius' | 'buttonRadius' | 'fontFamily';
+/** How a stylesheet names its look: Stackmyth's tokens, shadcn/ui's (and Tailwind's), or the application's own. */
+type CssFormat = 'stackmyth' | 'shadcn' | 'custom';
+interface CssThemeOptions {
+    /** Which names to read. Default: `auto`, told from the stylesheet itself. */
+    format?: CssFormat | 'auto';
+    /** Which of the application's two modes to take. Default: `light`. */
+    mode?: 'light' | 'dark';
+    /** The named theme to read, when the stylesheet keeps several under `[data-theme=…]`. */
+    theme?: string;
+    /** For `custom`: the variable each value is read from, `{ primary: '--brand' }`. */
+    map?: Partial<Record<ThemeField, string>>;
+}
+interface CssImportedTheme extends ImportedTheme {
+    /** The names that were read. */
+    format: CssFormat;
+}
+/** The custom properties a stylesheet sets for the page, by name: what a person picks from to map their own. */
+declare function cssVariables(css: string | string[], options?: Pick<CssThemeOptions, 'mode' | 'theme'>): string[];
+/**
+ * Reads an application's look out of its stylesheets, whatever names it uses:
+ * Stackmyth's tokens, shadcn/ui's (`--primary`, `--radius`, on Tailwind 3 or
+ * 4), or the application's own variables given in `map`. What comes out is a
+ * theme of named values, never CSS.
+ */
+declare function themeFromCss(css: string | string[], options?: CssThemeOptions): CssImportedTheme;
+/**
+ * A theme as the CSS variables of `cauthy-auth/styles.css` (`--cauthy-*`), for
+ * the forms an application shows on its own pages. The page's own background,
+ * the layout and the words are Cauthy's pages' matter, and left out.
+ */
+declare function themeVariables(theme: CauthyTheme): Record<string, string>;
 /** A theme as Cauthy's API names its values. */
 declare function toWire(theme: CauthyTheme): Record<string, unknown>;
 /** A theme as Cauthy answers it, in this package's names. */
@@ -123,4 +178,4 @@ interface PushThemeOptions {
  */
 declare function pushTheme(o: PushThemeOptions): Promise<void>;
 
-export { type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type ThemeFont, type ThemeTexts, fromWire, pushTheme, themeFromStackmyth, toColor, toWire };
+export { type CauthyTheme, type CssFormat, type CssImportedTheme, type CssThemeOptions, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type StackmythTokens, type ThemeField, type ThemeFont, type ThemeTexts, cssVariables, fromWire, pushTheme, themeFromCss, themeFromStackmyth, themeVariables, toColor, toWire, tokensFromStackmyth };