@boopkit/cap-oauth-server 0.1.0

package/dist/token-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-service.js","sourceRoot":"","sources":["../src/token-service.ts"],"names":[],"mappings":";;;AAoMA,4CAEC;AAED,gDAwMC;AAhZD,kDAA8D;AAE9D,2CAIqB;AACrB,iDAAuD;AAGvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,+DAA+D;AAClD,QAAA,iBAAiB,GAAG,YAAY,CAAC;AACjC,QAAA,mBAAmB,GAAG,cAAc,CAAC;AACrC,QAAA,oBAAoB,GAAG,eAAe,CAAC;AAOpD,uEAAuE;AACvE,MAAM,SAAS,GAAqC;IAClD,CAAC,yBAAiB,CAAC,EAAE,IAAI;IACzB,CAAC,2BAAmB,CAAC,EAAE,IAAI;IAC3B,CAAC,4BAAoB,CAAC,EAAE,IAAI;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACU,QAAA,8BAA8B,GAAG,GAAG,CAAC;AA2GlD,oEAAoE;AACpE,SAAgB,gBAAgB,CAAC,cAAsB,EAAE,QAAgB;IACvE,OAAO,GAAG,cAAc,IAAI,IAAA,qBAAS,EAAC,QAAQ,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC,CAAC;IAEvF,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAqC;QACnD,CAAC,2BAAmB,CAAC,EAAE,IAAA,2BAAe,EACpC,OAAO,CAAC,qBAAqB,EAC7B,mCAAuB,EACvB,gCAAgC,EAChC,IAAI,CACL;QACD,CAAC,4BAAoB,CAAC,EAAE,IAAA,2BAAe,EACrC,OAAO,CAAC,sBAAsB,EAC9B,oCAAwB,EACxB,iCAAiC,EACjC,IAAI,CACL;QACD,4EAA4E;QAC5E,2DAA2D;QAC3D,CAAC,yBAAiB,CAAC,EAAE,OAAO,CAAC,2BAA2B,IAAI,sCAA8B;KAC3F,CAAC;IAEF,SAAS,WAAW,CAAC,cAAsB,EAAE,MAAc;QACzD,OAAO,GAAG,cAAc,IAAI,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,SAAS,UAAU,CAAC,GAAW;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,wEAAwE;QACxE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAClC,yEAAyE;QACzE,6EAA6E;QAC7E,eAAe;QACf,IAAI,CAAC,IAAA,oCAAqB,EAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,SAAS,cAAc,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,gBAAgB,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,SAAS,QAAQ,CAAC,MAAwB,EAAE,SAAe;QACzD,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,mBAAmB,CAChC,MAAc,EACd,cAAsB;QAEtB,MAAM,MAAM,GAAG,GAAG,cAAc,GAAG,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,MAAM,KAAK,2BAAmB,IAAI,GAAG,CAAC,MAAM,KAAK,4BAAoB,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,oBAAoB,CAAC,cAAsB;QACxD,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,gCAAgC;QAChC,IAAI,CAAC,IAAA,oCAAqB,EAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CACjB,uCAAuC,cAAc,iDAAiD;gBACpG,qFAAqF,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,cAAc,GAAG,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,2EAA2E;QAC3E,mEAAmE;QACnE,KAAK,MAAM,MAAM,IAAI,CAAC,2BAAmB,EAAE,4BAAoB,CAAU,EAAE,CAAC;YAC1E,IAAI,KAAyB,CAAC;YAC9B,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE;oBAC3E,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,kBAAkB;oBACzB,KAAK;iBACN,CAAC,CAAC;gBACH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1B,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;oBAAE,MAAM;gBACnC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,WAAW;QACX,UAAU;QACV,cAAc;QAEd,aAAa,CAAC,MAAM;YAClB,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,EAAE,IAAA,yBAAa,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,gBAAgB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAEzE,OAAO;gBACL,KAAK;gBACL,WAAW;gBACX,cAAc;gBACd,MAAM;gBACN,QAAQ;gBACR,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;aAChD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;YACvB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC7E,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,QAAQ;YACR,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE3B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,6DAA6D;gBAC7D,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,QAAQ;gBACR,SAAS;aACV,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW;YACnC,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QAED,mBAAmB;QACnB,oBAAoB;QAEpB,KAAK,CAAC,qBAAqB,CAAC,MAAM,EAAE,cAAc;YAChD,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The client registry's vocabulary.
+ *
+ * Everything here describes a piece of *software* that asks to act on a user's
+ * behalf. Nothing here describes a user or an account — those live in cap-users
+ * and are reached only through its public surface. Keeping the two vocabularies
+ * apart is what stops OAuth from becoming a parallel identity system.
+ */
+/** Where a client's authoritative metadata lives. */
+export type ClientMode = 'dynamic' | 'metadata_document' | 'static';
+/** Whether the registry will let a client through the token path at all. */
+export type ClientStatus = 'enabled' | 'suspended';
+export declare const CLIENT_MODES: readonly ClientMode[];
+/**
+ * A registry row, as the rest of the capability reads it.
+ *
+ * The JSON columns arrive from Prisma as `JsonValue`; the service casts them to
+ * these shapes on the way out, so no consumer has to.
+ */
+export interface OauthClient {
+    id: number;
+    /** The token prefix. See `src/public-id.ts`. */
+    publicId: string;
+    /** What the client sends as `client_id`. A URL, for `metadata_document`. */
+    clientId: string;
+    mode: ClientMode;
+    status: ClientStatus;
+    name: string | null;
+    description: string | null;
+    logoUri: string | null;
+    clientUri: string | null;
+    contacts: string[];
+    softwareId: string | null;
+    softwareVersion: string | null;
+    policyUri: string | null;
+    tosUri: string | null;
+    redirectUris: string[];
+    grantTypes: string[];
+    responseTypes: string[];
+    scopes: string[];
+    tokenEndpointAuthMethod: string;
+    metadataUri: string | null;
+    metadataFetchedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** The RFC 7591 fields a registration request may carry. */
+export interface ClientMetadataInput {
+    client_name?: unknown;
+    client_uri?: unknown;
+    logo_uri?: unknown;
+    contacts?: unknown;
+    software_id?: unknown;
+    software_version?: unknown;
+    policy_uri?: unknown;
+    tos_uri?: unknown;
+    redirect_uris?: unknown;
+    grant_types?: unknown;
+    response_types?: unknown;
+    scope?: unknown;
+    token_endpoint_auth_method?: unknown;
+    [key: string]: unknown;
+}
+/** What an operator hands `registerStaticClient`. Typed, because it is code. */
+export interface StaticClientInput {
+    /** The `client_id` the operator wants this client to present. */
+    clientId: string;
+    name: string;
+    redirectUris: string[];
+    description?: string;
+    logoUri?: string;
+    clientUri?: string;
+    contacts?: string[];
+    policyUri?: string;
+    tosUri?: string;
+    softwareId?: string;
+    softwareVersion?: string;
+    grantTypes?: string[];
+    responseTypes?: string[];
+    scopes?: string[];
+}
+/**
+ * A Client ID Metadata Document, as fetched.
+ *
+ * Every field is `unknown` on arrival: the document is written by whoever owns
+ * the URL, which is to say by someone who is not us.
+ */
+export interface ClientIdMetadataDocument {
+    client_id?: unknown;
+    client_name?: unknown;
+    client_uri?: unknown;
+    logo_uri?: unknown;
+    contacts?: unknown;
+    policy_uri?: unknown;
+    tos_uri?: unknown;
+    redirect_uris?: unknown;
+    grant_types?: unknown;
+    response_types?: unknown;
+    scope?: unknown;
+    token_endpoint_auth_method?: unknown;
+    [key: string]: unknown;
+}
+/**
+ * The slice of Prisma's `oauthClient` delegate this capability uses.
+ *
+ * Declared structurally rather than imported from `@prisma/client`, for the
+ * same reason cap-users declares its own: the package must build without a
+ * generated client, and the identity-boundary audit reads the import list.
+ */
+export interface OauthClientDelegate {
+    create(args: {
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    findUnique(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown> | null>;
+    findFirst(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown> | null>;
+    findMany(args?: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    update(args: {
+        where: Record<string, unknown>;
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    delete(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    count(args?: Record<string, unknown>): Promise<number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD"}

package/dist/types.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * The client registry's vocabulary.
+ *
+ * Everything here describes a piece of *software* that asks to act on a user's
+ * behalf. Nothing here describes a user or an account — those live in cap-users
+ * and are reached only through its public surface. Keeping the two vocabularies
+ * apart is what stops OAuth from becoming a parallel identity system.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_MODES = void 0;
+exports.CLIENT_MODES = ['dynamic', 'metadata_document', 'static'];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAQU,QAAA,YAAY,GAA0B,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC"}

package/dist/user-store.d.ts

@@ -0,0 +1,110 @@
+/**
+ * The two cap-users services this capability calls, declared structurally.
+ *
+ * ## Why these are interfaces here rather than imports
+ *
+ * The identity boundary says every user-, account- or identity-shaped read goes
+ * through cap-users' public surface. It does *not* say this package should link
+ * against cap-users' concrete service types — and for the property service it
+ * says the opposite. The import audit
+ * (`tests/packages/cap-oauth-server-import-audit.test.ts`) forbids importing
+ * `UserPropertyService` from cap-users by name, because that surface can read
+ * cap-users' own `authentication` and `profile` properties, and a capability
+ * that reads those with a schema of its own has created a second definition of
+ * the user.
+ *
+ * So the ports below name **exactly the calls this capability makes, on exactly
+ * the two properties it owns** — `oauth-grants` and `oauth-codes` — and the
+ * application's real `identityService` and `userPropertyService` are injected
+ * into them by the scaffold binding. cap-users stays the only implementation;
+ * what narrows is what this package is able to ask for.
+ *
+ * The same reasoning produced `OauthClientDelegate` in `types.ts`, and it is
+ * the reasoning cap-users itself uses for its own Prisma delegates.
+ */
+/** A `user_identities` row, as cap-users' identity service returns it. */
+export interface StoredIdentity {
+    id: number;
+    userId: number;
+    domain: string;
+    key: string;
+    /** The tombstone. Never a scheduled expiry — see `token-service.ts`. */
+    endedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** One page of cap-users' key-prefix scan. */
+export interface StoredIdentityPage {
+    identities: StoredIdentity[];
+    /** Pass back as `after`. `null` when the scan is finished. */
+    nextCursor: number | null;
+}
+/** The slice of cap-users' `IdentityService` the OAuth token paths call. */
+export interface IdentityStore {
+    create(userId: number, domain: string, key: string): Promise<StoredIdentity>;
+    /** Active-only: a row with `endedAt` set reads as absent. */
+    findByDomainAndKey(domain: string, key: string): Promise<StoredIdentity | null>;
+    findAllByUser(userId: number, opts?: {
+        includeEnded?: boolean;
+    }): Promise<StoredIdentity[]>;
+    /**
+     * One page of the rows in `domain` whose key starts with `keyPrefix`, for any
+     * user — cap-users' `findAllByDomainAndKeyPrefix`.
+     *
+     * The only read on this port that is not bounded by a user id, and the only
+     * one client-wide revocation could not be built without: a token key is
+     * `"<publicId>|<hash>"`, so everybody one client ever reached is a
+     * left-anchored prefix away. It stays cap-users' query rather than becoming
+     * ours — the identity boundary is the same whether the read is by id or by
+     * prefix.
+     */
+    findAllByDomainAndKeyPrefix(domain: string, keyPrefix: string, opts?: {
+        includeEnded?: boolean;
+        limit?: number;
+        after?: number;
+    }): Promise<StoredIdentityPage>;
+    endDate(domain: string, key: string): Promise<StoredIdentity>;
+}
+/** A `user_properties` row, as cap-users' property service returns it. */
+export interface StoredProperty<T = unknown> {
+    id: number;
+    property: string;
+    info: T;
+    infoSchema: string;
+    /** Bumped on every write. The token in the read-modify-write discipline. */
+    revision: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface PropertyWriteOptions {
+    infoSchema?: string;
+    /**
+     * The revision the caller read. The write is refused if the stored row has
+     * moved on — which is the whole reason `oauth-grants` and `oauth-codes` are
+     * user properties rather than columns.
+     */
+    expectedRevision?: number;
+}
+/**
+ * The slice of cap-users' user-property service the grant and code services
+ * call — and deliberately only `get` and `put`.
+ *
+ * `patch` is absent by design. It shallow-merges, and every value this
+ * capability stores is an **array**; merging two arrays by key index is how
+ * boop-zj8 destroyed fields a write never named. Every write here replaces the
+ * whole array under `expectedRevision`, following cap-users' `setAuthorization`
+ * and never its `addAuthenticationMethod`.
+ */
+export interface PropertyStore {
+    get<T = unknown>(userId: number, property: string): Promise<StoredProperty<T> | null>;
+    put<T = unknown>(userId: number, property: string, info: T, opts?: PropertyWriteOptions): Promise<StoredProperty<T>>;
+}
+/**
+ * Was this write refused because somebody else got there first?
+ *
+ * cap-services throws `StaleEntityError`; matched by `name` rather than by
+ * `instanceof` because the class is not on this package's import allowlist and
+ * because `instanceof` across two copies of a module is a false negative.
+ */
+export declare function isStaleWriteError(err: unknown): boolean;
+//# sourceMappingURL=user-store.d.ts.map

package/dist/user-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.d.ts","sourceRoot":"","sources":["../src/user-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,6DAA6D;IAC7D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAChF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5F;;;;;;;;;;OAUG;IACH,2BAA2B,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/D;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtF,GAAG,CAAC,CAAC,GAAG,OAAO,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,CAAC,EACP,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAMvD"}

package/dist/user-store.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * The two cap-users services this capability calls, declared structurally.
+ *
+ * ## Why these are interfaces here rather than imports
+ *
+ * The identity boundary says every user-, account- or identity-shaped read goes
+ * through cap-users' public surface. It does *not* say this package should link
+ * against cap-users' concrete service types — and for the property service it
+ * says the opposite. The import audit
+ * (`tests/packages/cap-oauth-server-import-audit.test.ts`) forbids importing
+ * `UserPropertyService` from cap-users by name, because that surface can read
+ * cap-users' own `authentication` and `profile` properties, and a capability
+ * that reads those with a schema of its own has created a second definition of
+ * the user.
+ *
+ * So the ports below name **exactly the calls this capability makes, on exactly
+ * the two properties it owns** — `oauth-grants` and `oauth-codes` — and the
+ * application's real `identityService` and `userPropertyService` are injected
+ * into them by the scaffold binding. cap-users stays the only implementation;
+ * what narrows is what this package is able to ask for.
+ *
+ * The same reasoning produced `OauthClientDelegate` in `types.ts`, and it is
+ * the reasoning cap-users itself uses for its own Prisma delegates.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isStaleWriteError = isStaleWriteError;
+/**
+ * Was this write refused because somebody else got there first?
+ *
+ * cap-services throws `StaleEntityError`; matched by `name` rather than by
+ * `instanceof` because the class is not on this package's import allowlist and
+ * because `instanceof` across two copies of a module is a false negative.
+ */
+function isStaleWriteError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        err.name === 'StaleEntityError');
+}
+//# sourceMappingURL=user-store.js.map

package/dist/user-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.js","sourceRoot":"","sources":["../src/user-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AA+FH,8CAMC;AAbD;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,kBAAkB,CACxD,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@boopkit/cap-oauth-server",
+  "version": "0.1.0",
+  "description": "Make a boop app an OAuth 2.1 authorization server and resource server, so an MCP client can act on behalf of one of its users",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/",
+    "scaffold/",
+    "skills/",
+    "capability.json"
+  ],
+  "boopkit": {
+    "capability": true,
+    "scaffoldDir": "scaffold",
+    "skillsDir": "skills",
+    "manifest": "capability.json"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@boopkit/cap-users": "^0.8.0",
+    "@boopkit/logger": "^0.4.0"
+  },
+  "peerDependencies": {
+    "express": ">=4.0.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "typescript": "^5.9.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "ISC"
+}

package/scaffold/prisma/schema/oauth-clients.prisma

@@ -0,0 +1,80 @@
+// @boopkit/cap-oauth-server — OAuth client registry
+// Scaffolded by boop. Modify freely — this file is developer-owned.
+//
+// One table with a `mode` discriminator, not three tables. The three
+// registration modes — open dynamic registration (RFC 7591), a Client ID
+// Metadata Document, and an operator-configured static client — differ in
+// almost nothing except which column is authoritative for `redirectUris` (the
+// local JSON array, or the document at `metadataUri`) and what the consent page
+// says about provenance.
+//
+// This is the capability's own table. It holds nothing user- or account-shaped:
+// a client is a piece of software, not a person, and the grant that ties a
+// client to a user lives in cap-users' `user_properties` under `oauth-grants`.
+
+model OauthClient {
+  id Int @id @default(autoincrement())
+
+  // The token prefix, assigned by us at registration in *every* mode.
+  // Twelve lowercase base36 characters: no `.`, `|`, `/` or `:`, so
+  // `<publicId>.<token>` and `<publicId>|<sha256>` both split unambiguously.
+  // varchar(16) rather than (12) so a future format change does not need a
+  // migration to widen the column.
+  publicId String @unique @map("public_id") @db.VarChar(16)
+
+  // What the client sends as `client_id`. Equals `publicId` for `dynamic` and
+  // `static`; is the metadata-document URL for `metadata_document`, which is
+  // why this column is wide and `publicId` is not.
+  clientId String @unique @map("client_id") @db.VarChar(512)
+
+  // `dynamic` | `metadata_document` | `static`. Reaches the consent view, which
+  // says something different about a client whose metadata we hold than about
+  // one whose metadata lives at a URL the client controls.
+  mode String @db.VarChar(32)
+
+  // `enabled` | `suspended`. Suspending a compromised client must not delete a
+  // row that live tokens still carry the prefix of.
+  status String @default("enabled") @db.VarChar(32)
+
+  // The display fields the consent screen cannot render without.
+  name        String? @db.VarChar(255)
+  description String?
+  logoUri     String? @map("logo_uri") @db.VarChar(2048)
+
+  // RFC 7591 metadata, echoed on the registration response.
+  clientUri       String? @map("client_uri") @db.VarChar(2048)
+  contacts        Json?
+  softwareId      String? @map("software_id") @db.VarChar(255)
+  softwareVersion String? @map("software_version") @db.VarChar(255)
+  policyUri       String? @map("policy_uri") @db.VarChar(2048)
+  tosUri          String? @map("tos_uri") @db.VarChar(2048)
+
+  // Authoritative for `dynamic` and `static`; a *cache* for
+  // `metadata_document`, refreshed from `metadataUri`.
+  redirectUris Json @map("redirect_uris")
+
+  // What this client may request.
+  grantTypes    Json @map("grant_types")
+  responseTypes Json @map("response_types")
+  scopes        Json
+
+  // `none` is the only value v1 supports — every Claude-ecosystem client is a
+  // public client, and a public client that sent a secret would be sending one
+  // it shipped to its users.
+  tokenEndpointAuthMethod String @default("none") @map("token_endpoint_auth_method") @db.VarChar(64)
+
+  // Client ID Metadata Document only. `metadataUri` equals `clientId`, but is
+  // kept as its own column so the fetch target is explicit rather than inferred
+  // from a mode check at every call site.
+  metadataUri       String?   @map("metadata_uri") @db.VarChar(512)
+  metadataFetchedAt DateTime? @map("metadata_fetched_at") @db.Timestamptz(6)
+
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  // Garbage collection walks `dynamic` rows by age; suspension checks read
+  // `status` on the token path.
+  @@index([mode, createdAt])
+  @@index([status])
+  @@map("oauth_clients")
+}