@capybara-hq/kernel 0.1.0-rc.13 → 0.1.0-rc.15

package/dist/platform/ops/setup.ops.js

@@ -0,0 +1,212 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { CatalogGuidePathParams, CatalogGuideQuery } from "../../catalog/org-catalog.schemas.js";
+import { ApiError } from "../../errors.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { SetupCheckPathParams, SetupCheckRunBody, SetupChecksQuery, SetupGuidePathParams, } from "../../setup/setup-checks.schemas.js";
+import { SetupChecksService } from "../../setup/setup-checks.service.js";
+import { SetupGuidesQuery } from "../../setup/setup-guides.schemas.js";
+import { SetupGuidesService } from "../../setup/setup-guides.service.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { roleOf } from "./role.js";
+const ITEM = "00000000-0000-4000-8000-000000000000";
+const CONNECTION = "00000000-0000-4000-8000-000000000001";
+/**
+ * Setup guide operations of the `Platform` tool (spec 2026-11-09-setup-guides-v2-design.md §12),
+ * the `setup` domain: the guides a person may see, one guide rendered as Markdown, the cached check
+ * states of a guide and running one check. All are reads (a check never writes anywhere; its cost
+ * is bounded by the cache, the cooldown and the org's concurrency cap) and use the routes'
+ * services, so a guide carries no secret (§6.3) and check results only the fixed, redacted fields.
+ * Entering a secret, OAuth consent and the guide ack stay with the person on the web (`human-only`
+ * and `secret` exclusions); no setup operation takes a value.
+ */
+let SetupOperations = class SetupOperations {
+    registry;
+    checks;
+    guides;
+    kdb;
+    constructor(registry, checks, guides, kdb) {
+        this.registry = registry;
+        this.checks = checks;
+        this.guides = guides;
+        this.kdb = kdb;
+    }
+    /** The actor as the routes see a caller: the org, their role there now and their account. */
+    async caller(ctx) {
+        const role = await roleOf(this.kdb.db, ctx.orgId, ctx.actorAccountId);
+        if (role === null)
+            throw new ApiError("forbidden", "Insufficient organization role");
+        return { orgId: ctx.orgId, role, accountId: ctx.actorAccountId };
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "setup.guides",
+                description: "List the plugin setup guides this person may help with in the org: per guide its targets (channel connections, connectors made from a template, templates switched on without a connector yet), whether the guide changed since a target was set up (drift), a count of the cached check states and the web page where the person does the setup. Org admins get the admin guides; members get the guides for connecting their own account. Read a guide with setup.read.",
+                input: SetupGuidesQuery,
+                example: {},
+                authz: { orgAction: "catalog.read" },
+                mirrors: ["GET /api/v1/orgs/:orgId/setup-guides"],
+                confirm: "read",
+                run: async (input, ctx) => ({
+                    guides: await this.guides.list(await this.caller(ctx), input),
+                }),
+            }),
+            defineOperation({
+                id: "setup.read",
+                description: "Read one plugin setup guide rendered for a target as a Markdown document: the steps, the app manifest and URLs to paste at the third-party platform, and the checks as '- [check <id>] <label>' lines (run them with setup.check), with the modes, the variables that have no value yet and why, and the web page of the target. Explain the step the person is on. Secrets are never in the guide: ask the person to paste each token or secret into its field on the returned webPath, never into the conversation.",
+                input: CatalogGuidePathParams.extend(CatalogGuideQuery.shape).strict(),
+                example: { itemId: ITEM, guideId: "slack-app", connectionId: CONNECTION },
+                authz: { orgAction: "catalog.read" },
+                mirrors: ["GET /api/v1/orgs/:orgId/catalog/:itemId/guides/:guideId"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "The plugin is not in this org's catalog; list the guides with setup.guides.",
+                    },
+                    {
+                        code: "catalog.guide_not_found",
+                        next: "The plugin has no setup guide with that id; list the guides with setup.guides.",
+                    },
+                    {
+                        code: "channel.not_found",
+                        next: "No channel connection with that id in this org; list the targets with setup.guides.",
+                    },
+                    {
+                        code: "connector.not_found",
+                        next: "No connector made from this guide's template with that id in this org; list the targets with setup.guides.",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "Pass a mode and audience the guide has (setup.guides lists the audience) and the target of its place: connectionId for a channel guide, connectorId for a connector template guide.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: {
+                            member: "Only org admins read the admin guides; members read the member section of a connector template guide (audience member).",
+                        },
+                    },
+                ],
+                run: async (input, ctx) => {
+                    const { itemId, guideId, ...q } = input;
+                    return { guide: await this.guides.read(await this.caller(ctx), itemId, guideId, q) };
+                },
+            }),
+            defineOperation({
+                id: "setup.status",
+                description: "Read the cached state of every check of a plugin's setup guide for one target (a channel connection or a connector made from a template), by check id: ok, failing, unknown, running or not_run, with the reason and fix to show the person. Runs nothing; run a check with setup.check.",
+                input: SetupGuidePathParams.extend(SetupChecksQuery.shape).strict(),
+                example: { itemId: ITEM, guideId: "slack-app", connectionId: CONNECTION },
+                authz: { orgAction: "catalog.read" },
+                mirrors: ["GET /api/v1/orgs/:orgId/catalog/:itemId/guides/:guideId/checks"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "The plugin is not in this org's catalog; check the item id on the plugin's page.",
+                    },
+                    {
+                        code: "catalog.guide_not_found",
+                        next: "The plugin has no setup guide with that id; read the guide id from the connection or connector page.",
+                    },
+                    {
+                        code: "channel.not_found",
+                        next: "No channel connection with that id in this org; list the targets with setup.guides.",
+                    },
+                    {
+                        code: "connector.not_found",
+                        next: "No connector made from this guide's template with that id in this org; list the targets with setup.guides.",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "Checks need a saved target: pass connectionId for a channel guide or connectorId for a connector template guide, and a mode and audience the guide has.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: {
+                            member: "Only org admins run the admin checks of a guide; members run the member checks (audience member).",
+                        },
+                    },
+                ],
+                run: async (input, ctx) => {
+                    const { itemId, guideId, ...q } = input;
+                    return { results: await this.checks.states(await this.caller(ctx), itemId, guideId, q) };
+                },
+            }),
+            defineOperation({
+                id: "setup.check",
+                description: "Run one check of a plugin's setup guide for one target (a channel connection or a connector made from a template) and return its state: ok, failing (with a reason and a fix to explain), unknown, or running (try again in a moment). A fresh cached result is returned as is; force reruns it, at most once per 10 seconds per check and target. A check only reads; run it after the person says they finished a step.",
+                input: SetupCheckPathParams.extend(SetupCheckRunBody.shape).strict(),
+                example: {
+                    itemId: ITEM,
+                    guideId: "slack-app",
+                    checkId: "bot-token",
+                    connectionId: CONNECTION,
+                },
+                authz: { orgAction: "catalog.read" },
+                mirrors: ["POST /api/v1/orgs/:orgId/catalog/:itemId/guides/:guideId/checks/:checkId/run"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "The plugin is not in this org's catalog; check the item id on the plugin's page.",
+                    },
+                    {
+                        code: "catalog.guide_not_found",
+                        next: "The plugin has no setup guide with that id; read the guide id from the connection or connector page.",
+                    },
+                    {
+                        code: "channel.not_found",
+                        next: "No channel connection with that id in this org; list the targets with setup.guides.",
+                    },
+                    {
+                        code: "connector.not_found",
+                        next: "No connector made from this guide's template with that id in this org; list the targets with setup.guides.",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "Checks need a saved target: pass connectionId for a channel guide or connectorId for a connector template guide, and a mode and audience the guide has.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: {
+                            member: "Only org admins run the admin checks of a guide; members run the member checks (audience member).",
+                        },
+                    },
+                    {
+                        code: "catalog.check_not_found",
+                        next: "That check is not in the guide for this mode and audience; read the check ids with setup.status.",
+                    },
+                    {
+                        code: "rate_limited",
+                        next: "This person ran 30 checks in the last minute; wait a minute before running another, and read the cached states with setup.status meanwhile.",
+                    },
+                ],
+                run: async (input, ctx) => {
+                    const { itemId, guideId, checkId, ...body } = input;
+                    return {
+                        result: await this.checks.run(await this.caller(ctx), itemId, guideId, checkId, body),
+                    };
+                },
+            }),
+        ]);
+    }
+};
+SetupOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(SetupChecksService)),
+    __param(2, Inject(SetupGuidesService)),
+    __param(3, Inject(KernelDb))
+], SetupOperations);
+export { SetupOperations };

package/dist/platform/ops/ui.ops.js

@@ -22,7 +22,7 @@ let UiOperations = class UiOperations {
         this.registry.register([
             defineOperation({
                 id: "ui.slots",
-                description: "List the UI slots an extension can contribute to (id, version, where it is, scope and args, accepted kinds view / embed, minimum role, anchors). Use a slot id as a ui contribution's `slot` in a plugin manifest.",
+                description: "List the UI slots an extension can contribute to (id, version, where it is, scope and args, accepted kinds view / embed / component, cardinality list or single, minimum role, anchors). Use a slot id as a ui contribution's `slot` in a plugin manifest.",
                 input: z.object({}).strict(),
                 example: {},
                 // any signed-in person may call the route; every run's actor is a member of this org

package/dist/platform/platform-ops.module.d.ts

@@ -24,6 +24,7 @@ import { PlatformOperationsProvider } from "./ops/platform.ops.js";
 import { PluginsOperations } from "./ops/plugins.ops.js";
 import { PreviewersOperations } from "./ops/previewers.ops.js";
 import { RequestsOperations } from "./ops/requests.ops.js";
+import { SetupOperations } from "./ops/setup.ops.js";
 import { SkillsOperations } from "./ops/skills.ops.js";
 import { ThemesOperations } from "./ops/themes.ops.js";
 import { UiOperations } from "./ops/ui.ops.js";
@@ -31,7 +32,7 @@ import { UiOperations } from "./ops/ui.ops.js";
  * One provider per domain, each taking `PlatformOperations` as its first constructor argument:
  * the parity test in `tools/checks` builds the operations from it without a Nest app.
  */
-export declare const PLATFORM_OPERATION_PROVIDERS: readonly [typeof PlatformOperationsProvider, typeof SkillsOperations, typeof AgentsOperations, typeof AgentTemplatesOperations, typeof PluginsOperations, typeof MarketplacesOperations, typeof RequestsOperations, typeof ConnectorsOperations, typeof ExtensionsOperations, typeof ConversationsOperations, typeof ComponentsOperations, typeof AccountsOperations, typeof OrgsOperations, typeof AdminOperations, typeof CatalogAdminOperations, typeof OrgPluginsOperations, typeof ExtensionsAdminOperations, typeof ModelsOperations, typeof InboxOperations, typeof ApprovalsOperations, typeof ChannelsOperations, typeof OrgSettingsOperations, typeof EvalsOperations, typeof BackgroundOperations, typeof PreviewersOperations, typeof DevicesOperations, typeof AgentSkillsOperations, typeof ThemesOperations, typeof UiOperations];
+export declare const PLATFORM_OPERATION_PROVIDERS: readonly [typeof PlatformOperationsProvider, typeof SkillsOperations, typeof AgentsOperations, typeof AgentTemplatesOperations, typeof PluginsOperations, typeof MarketplacesOperations, typeof RequestsOperations, typeof ConnectorsOperations, typeof ExtensionsOperations, typeof ConversationsOperations, typeof ComponentsOperations, typeof AccountsOperations, typeof OrgsOperations, typeof AdminOperations, typeof CatalogAdminOperations, typeof OrgPluginsOperations, typeof ExtensionsAdminOperations, typeof ModelsOperations, typeof InboxOperations, typeof ApprovalsOperations, typeof ChannelsOperations, typeof OrgSettingsOperations, typeof EvalsOperations, typeof BackgroundOperations, typeof PreviewersOperations, typeof DevicesOperations, typeof AgentSkillsOperations, typeof ThemesOperations, typeof SetupOperations, typeof UiOperations];
 /**
  * The `Platform` tool's operations (ruling P2): one provider per domain, each registering its
  * operations into `PlatformOperations` from `onModuleInit`. It imports the domain modules, which

package/dist/platform/platform-ops.module.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 import { Module } from "@nestjs/common";
 import { AgentsModule } from "../agents/agents.module.js";
 import { BackgroundModule } from "../background/background.module.js";
+import { AppearanceModule } from "../catalog/appearance.service.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
 import { ChannelsModule } from "../channels/channels.module.js";
 import { ConversationsModule } from "../conversations/conversations.module.js";
@@ -19,6 +20,7 @@ import { InboxModule } from "../inbox/inbox.module.js";
 import { ModelsModule } from "../models/models.module.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
 import { ProvidersModule } from "../runtime/providers.js";
+import { SetupModule } from "../setup/setup.module.js";
 import { SkillsModule } from "../skills/skills.module.js";
 import { ThemesModule } from "../themes/themes.module.js";
 import { ToolsModule } from "../tools/tools.module.js";
@@ -48,6 +50,7 @@ import { PlatformOperationsProvider } from "./ops/platform.ops.js";
 import { PluginsOperations } from "./ops/plugins.ops.js";
 import { PreviewersOperations } from "./ops/previewers.ops.js";
 import { RequestsOperations } from "./ops/requests.ops.js";
+import { SetupOperations } from "./ops/setup.ops.js";
 import { SkillsOperations } from "./ops/skills.ops.js";
 import { ThemesOperations } from "./ops/themes.ops.js";
 import { UiOperations } from "./ops/ui.ops.js";
@@ -92,6 +95,8 @@ export const PLATFORM_OPERATION_PROVIDERS = [
     AgentSkillsOperations,
     // themes (themes spec §9)
     ThemesOperations,
+    // setup guide checks (setup guides v2 §12; plan task 13 adds the rest of the domain)
+    SetupOperations,
     // UI slot catalog (UI slots spec §3)
     UiOperations,
 ];
@@ -110,6 +115,7 @@ PlatformOpsModule = __decorate([
             AgentsModule,
             OrgsModule,
             CatalogModule,
+            AppearanceModule,
             ExtensionsModule,
             ToolsModule,
             ConversationsModule,
@@ -123,6 +129,7 @@ PlatformOpsModule = __decorate([
             BackgroundModule,
             FilesModule,
             ThemesModule,
+            SetupModule,
         ],
         providers: [...PLATFORM_OPERATION_PROVIDERS],
     })

package/dist/platform/route-schemas.js

@@ -4,6 +4,7 @@ import { AGENT_ROUTES } from "../agents/agents.schemas.js";
 import { AGENT_TEMPLATE_ROUTES } from "../agents/templates.schemas.js";
 import { BACKGROUND_ROUTES } from "../background/background.schemas.js";
 import { ADMIN_CATALOG_ROUTES } from "../catalog/admin-catalog.schemas.js";
+import { APPEARANCE_ROUTES } from "../catalog/appearance.schemas.js";
 import { COMPONENT_SCOPE_ROUTES } from "../catalog/component-scope.schemas.js";
 import { MARKETPLACE_ROUTES } from "../catalog/marketplaces.schemas.js";
 import { ORG_CATALOG_ROUTES } from "../catalog/org-catalog.schemas.js";
@@ -19,6 +20,8 @@ import { ME_ROUTES } from "../identity/me.schemas.js";
 import { INBOX_ROUTES } from "../inbox/inbox.schemas.js";
 import { ORG_MODEL_ROUTES } from "../models/org-models.schemas.js";
 import { ORG_ROUTES, ORG_SETTINGS_ROUTES } from "../orgs/orgs.schemas.js";
+import { SETUP_CHECK_ROUTES } from "../setup/setup-checks.schemas.js";
+import { SETUP_GUIDE_ROUTES } from "../setup/setup-guides.schemas.js";
 import { SKILL_ROUTES } from "../skills/skills.schemas.js";
 import { THEME_ROUTES } from "../themes/themes.schemas.js";
 import { APPROVAL_ROUTES } from "../tools/approvals.schemas.js";
@@ -64,6 +67,11 @@ export const ROUTE_SCHEMAS = [
     ...ME_ROUTES,
     // themes (themes spec §9)
     ...THEME_ROUTES,
+    // a plugin's suggested appearance (client extensions spec §6.5)
+    ...APPEARANCE_ROUTES,
+    // setup guide checks (setup guides v2 §10.3, §12)
+    ...SETUP_CHECK_ROUTES,
+    ...SETUP_GUIDE_ROUTES,
     // UI slots (UI slots spec §3)
     ...UI_ROUTES,
 ];

package/dist/roles/worker.module.js

@@ -14,6 +14,8 @@ import { PlatformMigration } from "../catalog/platform-migration.js";
 import { PluginScopeWorkersModule } from "../catalog/scope-sync-workers.js";
 import { ChannelsModule, ChannelWorkersModule } from "../channels/channels.module.js";
 import { GatewayCheckJob } from "../channels/supervisor.js";
+import { ClientModule } from "../client/client.module.js";
+import { ClientReportsCron } from "../client/client-reports.cron.js";
 import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { AttachmentCleanupJob } from "../conversations/attachments.service.js";
 import { EventLogModule } from "../conversations/event-log.js";
@@ -55,6 +57,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
             module: WorkerModule_1,
             imports: [
                 KernelScheduleModule,
+                ClientModule,
                 // the queue consumers (their worker options come from the startup config)
                 RuntimeWorkersModule.forRoot(config),
                 EvalWorkersModule.forRoot(config),
@@ -87,6 +90,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 BackgroundTaskPollJob,
                 ToolJobs,
                 InitialPasswordCleanupJob,
+                ClientReportsCron,
                 CatalogJobs,
                 PlatformMigration,
                 DirectoryScanJob,

package/dist/setup/kernel-checks.d.ts

@@ -0,0 +1,91 @@
+import { type SetupCheckResult, type SetupCheckText } from "@capybara-hq/plugin-sdk";
+import { type OnModuleInit } from "@nestjs/common";
+import type { Redis } from "ioredis";
+import { webhookBase } from "../channels/webhook-url.js";
+import type { KernelConfig } from "../config/schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { Credentials } from "../tools/credentials.js";
+import { SetupCheckRegistry } from "./setup-check-registry.js";
+/** The fixed texts of the kernel checks (only `last_error` and a time are ever interpolated). */
+export declare const KERNEL_CHECK_TEXTS: {
+    readonly publicUrlSet: SetupCheckText;
+    readonly publicUrlMissing: SetupCheckText;
+    readonly publicUrlFix: SetupCheckText;
+    readonly webhookPublic: SetupCheckText;
+    readonly webhookBaseMissing: SetupCheckText;
+    readonly webhookBaseFix: SetupCheckText;
+    readonly webhookNone: SetupCheckText;
+    readonly connectionGone: SetupCheckText;
+    readonly connectionDisabled: SetupCheckText;
+    readonly connectionEnableFix: SetupCheckText;
+    readonly connectionFailed: SetupCheckText;
+    readonly connectionFix: SetupCheckText;
+    readonly connectionPending: SetupCheckText;
+    readonly connectionActive: SetupCheckText;
+    readonly connectorGone: SetupCheckText;
+    readonly notOAuthCode: SetupCheckText;
+    readonly dcr: SetupCheckText;
+    readonly clientStored: SetupCheckText;
+    readonly clientMissing: SetupCheckText;
+    readonly clientFix: SetupCheckText;
+    readonly noClient: SetupCheckText;
+    readonly toolsRead: SetupCheckText;
+    readonly toolsPending: SetupCheckText;
+    readonly connected: SetupCheckText;
+    readonly notConnected: SetupCheckText;
+    readonly connectFix: SetupCheckText;
+    readonly publicUrlFirst: SetupCheckText;
+};
+/** `capybara:public-url`: `http.publicUrl` is set. */
+export declare function publicUrlCheck(config: Pick<KernelConfig, "http">): SetupCheckResult;
+/**
+ * `capybara:webhook-public`: webhook callback URLs have a usable https base. The kernel builds
+ * them from `channels.webhookBaseUrl` only (`webhook-url.ts`), never from `http.publicUrl`, so
+ * that is what is checked; a loopback http base (tests only) is not public.
+ */
+export declare function webhookPublicCheck(config: Parameters<typeof webhookBase>[0]): SetupCheckResult;
+/** `capybara:webhook-received`: the marker the gateway sets on an accepted webhook, or none. */
+export declare function webhookReceivedResult(seenAt: string | null): SetupCheckResult;
+/**
+ * `capybara:connection-active`: active with a bot identity and no recorded error is ok. A recorded
+ * `last_error` (status `error`, or a failure an active connection keeps retrying) is failing with
+ * that text, redacted by every secret the result is redacted by and kept only when the result
+ * with it passes the result validation (control, bidi and lone surrogate rules, length);
+ * otherwise the reason leaves it out. The kernel pipeline validates and redacts the result again.
+ */
+export declare function connectionActiveResult(row: {
+    status: string;
+    botUserId: string | null;
+    lastError: string | null;
+} | undefined, secrets: readonly string[]): SetupCheckResult;
+/**
+ * Registers the kernel checks on module init (static code, the same on every replica). Each reads
+ * only the target the service resolved (ids of the caller's org, after authorization) and never
+ * writes; `capybara:oauth-token-endpoint` is the only one that leaves the kernel (§10.6).
+ */
+export declare class KernelChecks implements OnModuleInit {
+    private readonly registry;
+    private readonly config;
+    private readonly db;
+    private readonly redis;
+    private readonly credentials;
+    constructor(registry: SetupCheckRegistry, config: Pick<KernelConfigService, "get">, db: KernelDb, redis: Pick<Redis, "get">, credentials: Pick<Credentials, "oauthClient" | "status">);
+    onModuleInit(): void;
+    private webhookReceived;
+    private connectionActive;
+    /** The connector's auth settings (a live connector of the caller's org), or undefined. */
+    private connectorAuth;
+    private oauthClient;
+    private connectorTools;
+    /** The caller's own credential (cached per account, as every kernel check). */
+    private connectorConnected;
+    /**
+     * The token endpoint probe for a manual OAuth client (`oauth-token-probe.ts`): the stored
+     * client record is the connect flow's (its `tokenEndpoint` came from discovery or the
+     * template's `tokenUrl` at install, its auth method from `tokenAuthMethod`), the redirect URI
+     * is the connect flow's callback URL. Runs per admin (kernel checks are cached per account);
+     * each run is one token request, inside the per-account rate limit and the org's cap.
+     */
+    private tokenEndpoint;
+}