@zgeoff/atc 2.8.2 → 2.9.0

package/src/mcp/mcp-tools.ts

@@ -0,0 +1,278 @@
+import { z } from 'zod';
+import { REQUEST_PARAM_SCHEMAS } from '../protocol/request-param-schemas';
+import type { GrantScope } from '../shared/grant-scope';
+
+const NO_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(z.strictObject({}));
+
+/**
+ * The session id shape MCP tool schemas require: present and described.
+ * The daemon's wire request schemas share a defaulted-session shape
+ * instead, since they tolerate an absent session by defaulting it to an
+ * empty string.
+ */
+const SESSION_ID_BASE = z.object({
+  session: z.string().describe('The atc session id, from atc_session_list'),
+});
+
+const SESSION_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(SESSION_ID_BASE.strict());
+const SPAWN_SCHEMA = REQUEST_PARAM_SCHEMAS['session.spawn'];
+
+const SPAWN_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
+  z.strictObject({
+    cwd: SPAWN_SCHEMA.shape.cwd.describe('Absolute path of the working directory'),
+    name: SPAWN_SCHEMA.shape.name.describe('Session name; defaults to the directory basename'),
+    prompt: SPAWN_SCHEMA.shape.prompt.describe('First message for the session'),
+    agent: SPAWN_SCHEMA.shape.agent.describe(
+      'Which registered agent id to spawn; defaults to claude',
+    ),
+    detached: z
+      .boolean()
+      .optional()
+      .describe(
+        'Spawn a top-level session. By default a spawn from inside an atc session becomes a sub-session of it: listed under it, pinned with it, killed with it.',
+      ),
+  }),
+  { io: 'input' },
+);
+
+const SESSION_READ_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
+  SESSION_ID_BASE.extend({
+    cursor: z
+      .string()
+      .optional()
+      .describe(
+        'The cursor a previous atc_session_read returned; omit to read from the start of the conversation',
+      ),
+    limit: z
+      .number()
+      .int()
+      .min(1)
+      .max(200)
+      .optional()
+      .describe('Most rows to return; defaults to 50'),
+  }).strict(),
+  { io: 'input' },
+);
+
+const EVENTS_READ_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
+  z.strictObject({
+    cursor: z
+      .string()
+      .optional()
+      .describe(
+        'The cursor a previous atc_events_read returned; omit to get the most recent events',
+      ),
+    limit: z
+      .number()
+      .int()
+      .min(1)
+      .max(200)
+      .optional()
+      .describe('Most events to return; defaults to 50'),
+    waitMs: z
+      .number()
+      .int()
+      .min(0)
+      .max(30_000)
+      .optional()
+      .describe(
+        'How long to wait for a new event when none is pending, in milliseconds; defaults to 0, capped at 30000. Keep it short.',
+      ),
+  }),
+  { io: 'input' },
+);
+
+interface MCPToolAnnotations {
+  readonly readOnlyHint: boolean;
+  readonly destructiveHint: boolean;
+  readonly openWorldHint: boolean;
+}
+
+interface MCPToolDefinition {
+  readonly name: string;
+  readonly description: string;
+  readonly inputSchema: Readonly<Record<string, unknown>>;
+  readonly annotations: MCPToolAnnotations;
+  readonly scope: GrantScope;
+}
+
+const READ_ONLY: MCPToolAnnotations = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  openWorldHint: false,
+};
+
+const ADDITIVE: MCPToolAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  openWorldHint: false,
+};
+
+const DESTRUCTIVE: MCPToolAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  openWorldHint: false,
+};
+
+// A tool that starts an agent or puts text in front of one reaches past atc: the agent acts on
+// what it reads, outside atc's control.
+const AGENT_FACING: MCPToolAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  openWorldHint: true,
+};
+
+const AGENT_FACING_DESTRUCTIVE: MCPToolAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  openWorldHint: true,
+};
+
+export const MCP_TOOLS: readonly MCPToolDefinition[] = [
+  {
+    name: 'atc_session_list',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      'List every session the atc daemon hosts: id, name, working directory, state (running, needs_you, done, exited), unread flag, and last activity.',
+    inputSchema: NO_INPUT,
+  },
+  {
+    name: 'atc_session_spawn',
+    annotations: AGENT_FACING,
+    scope: 'spawn',
+    description:
+      'Spawn a new session in a directory. Optional agent is an agent id the daemon has registered, such as claude, grok, or codex; omitted agent is always Claude, never the TUI last-used value. An unregistered id is rejected. Called from inside an atc session, the new session is a sub-session of the caller unless detached is true. Returns the new session descriptor. Give it a prompt to start it working immediately.',
+    inputSchema: SPAWN_INPUT,
+  },
+  {
+    name: 'atc_session_input',
+    annotations: AGENT_FACING_DESTRUCTIVE,
+    scope: 'spawn',
+    description:
+      'Type a line of text into a running session, as if the operator typed it and pressed enter. Use it to answer a session that is waiting on input.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        session: { type: 'string', description: 'The atc session id' },
+        text: { type: 'string', description: 'The line to type; a newline is appended' },
+      },
+      required: ['session', 'text'],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: 'atc_session_screen',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      'Read the current terminal screen of a session as plain text, without attaching to it. Use it to see what a session printed or what it is waiting on before answering it with atc_session_input. A killed session keeps its last screen.',
+    inputSchema: SESSION_INPUT,
+  },
+  {
+    name: 'atc_session_update',
+    annotations: ADDITIVE,
+    scope: 'message',
+    description:
+      'Rename and/or pin a session. Renames stick against auto-summaries; pinned sessions lead every list. A sub-session pins with its parent, so pin the parent instead. Use this to organise the fleet: name sessions after their task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        session: { type: 'string', description: 'The atc session id' },
+        name: { type: 'string', description: 'New display name; omit to keep' },
+        pinned: { type: 'boolean', description: 'Pin or unpin; omit to keep' },
+      },
+      required: ['session'],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: 'atc_session_kill',
+    annotations: DESTRUCTIVE,
+    scope: 'kill',
+    description: 'Kill a session. A second kill on a dead session removes it from the list.',
+    inputSchema: SESSION_INPUT,
+  },
+  {
+    name: 'atc_session_ack',
+    annotations: ADDITIVE,
+    scope: 'message',
+    description: 'Clear a session unread flag without attaching to it.',
+    inputSchema: SESSION_INPUT,
+  },
+  {
+    name: 'atc_resume_command',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      'Build the shell command that reopens a session outside atc (cd into its directory and claude --resume its id).',
+    inputSchema: SESSION_INPUT,
+  },
+  {
+    name: 'atc_dirs_list',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description: 'List directories sessions were previously spawned from, most recent first.',
+    inputSchema: NO_INPUT,
+  },
+  {
+    name: 'atc_session_get',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      'Read one session in a single call: its descriptor (state, unread flag, last activity message), the prompt it was spawned with, when it last reported activity, the prompt or question it is waiting on while it needs you (read-only; answer it with atc_session_input), and the final message of its latest finished turn.',
+    inputSchema: SESSION_INPUT,
+  },
+  {
+    name: 'atc_session_read',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      "Read a session's conversation a page at a time, oldest first: user and assistant messages with tool uses summarised. Pass the returned cursor to continue where you left off; more is true when the page stopped before the end. Claude sessions only; other agents answer unsupported.",
+    inputSchema: SESSION_READ_INPUT,
+  },
+  {
+    name: 'atc_events_read',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      'Catch up on the fleet: session events (started, prompt-submitted, needs-input, turn-done, ended), message events (message-accepted, message-delivered, message-answered), and reports (report) since a cursor, oldest first, each with the session id and name. A message event carries the message id; read the full message with atc_message_get. A report event carries its label. Without a cursor it returns the most recent events. Pass the returned cursor next time. waitMs holds the call open until an event arrives.',
+    inputSchema: EVENTS_READ_INPUT,
+  },
+  {
+    name: 'atc_session_message',
+    annotations: AGENT_FACING,
+    scope: 'message',
+    description:
+      "Send a session a message and get its id back. Follow up by polling atc_message_get with the id until its status is answered, which returns the session's final reply; don't read the session's screen or transcript to check on it. The message waits in the session inbox until the session takes it, and its status moves accepted, delivered, answered. A message is refused as unsupported when the session's agent has no message tap (Grok, Codex), or when a Claude session reported SessionStart more than 15 seconds ago and no tap has attached since. It is refused as session_dead when the session has no live process and as no_such_session for an unknown id. Otherwise it queues, including while a session restores or after its tap dropped. The message is never typed into the terminal.",
+    inputSchema: {
+      type: 'object',
+      properties: {
+        session: { type: 'string', description: 'The atc session id, from atc_session_list' },
+        text: { type: 'string', description: 'The message text' },
+        from: {
+          type: 'string',
+          description:
+            'Who the message is from; defaults to the calling session id, or mcp outside a session. Ignored for a remote client, whose messages are always from its own name',
+        },
+      },
+      required: ['session', 'text'],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: 'atc_message_get',
+    annotations: READ_ONLY,
+    scope: 'read',
+    description:
+      'Read one message sent with atc_session_message: its id, session, from, text, status (accepted, delivered, or answered), the answer once answered, and the sentAt, deliveredAt, and answeredAt timestamps. Poll it until the status is answered.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        message: { type: 'string', description: 'The message id atc_session_message returned' },
+      },
+      required: ['message'],
+      additionalProperties: false,
+    },
+  },
+];

package/src/mcp/mint-approval-code.ts

@@ -0,0 +1,13 @@
+import { randomInt } from 'node:crypto';
+
+// Crockford base32: no I, L, O, or U, so a code read off a terminal is never
+// ambiguous.
+const ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+
+/**
+ * A fresh 8-character approval code in Crockford base32, which the operator
+ * reads off the terminal and types into the approval page.
+ */
+export function mintApprovalCode(): string {
+  return Array.from({ length: 8 }, () => ALPHABET[randomInt(ALPHABET.length)]).join('');
+}

package/src/mcp/normalize-approval-code.ts

@@ -0,0 +1,8 @@
+/**
+ * Folds a typed approval code to the form it was minted in: upper case, with
+ * spaces and dashes dropped, and the letters Crockford base32 reads as digits
+ * (I and L as 1, O as 0) replaced.
+ */
+export function normalizeApprovalCode(typed: string): string {
+  return typed.toUpperCase().replaceAll(/[\s-]/g, '').replaceAll(/[IL]/g, '1').replaceAll('O', '0');
+}

package/src/mcp/normalize-public-url.ts

@@ -0,0 +1,33 @@
+import { isLoopbackHost } from './is-loopback-host';
+
+/**
+ * Reduces a configured public URL to the bare origin the server is reached
+ * at: https, or http only on a loopback host, with no path, query, or
+ * fragment. The origin is the OAuth issuer, and `<origin>/mcp` is the
+ * resource every grant is bound to.
+ */
+export function normalizePublicURL(raw: string): string {
+  let url: URL;
+
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`the public URL '${raw}' is not a URL`);
+  }
+
+  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopbackHost(url.hostname))) {
+    throw new Error(`the public URL '${raw}' must use https unless its host is loopback`);
+  }
+
+  if ((url.pathname !== '/' && url.pathname !== '') || url.search !== '' || url.hash !== '') {
+    throw new Error(
+      `the public URL '${raw}' must be a bare origin, with no path, query, or fragment`,
+    );
+  }
+
+  if (url.username !== '' || url.password !== '') {
+    throw new Error(`the public URL '${raw}' must not carry credentials`);
+  }
+
+  return url.origin;
+}

package/src/mcp/open-mcp-auth.ts

@@ -0,0 +1,145 @@
+import { Database } from 'bun:sqlite';
+import { randomBytes } from 'node:crypto';
+import { chmodSync, closeSync, openSync } from 'node:fs';
+import { mcp } from '@better-auth/mcp';
+import { oauthProvider } from '@better-auth/oauth-provider';
+import type { OAuthOptions, Scope } from '@better-auth/oauth-provider';
+import { betterAuth } from 'better-auth';
+import type { BetterAuthPlugin } from 'better-auth';
+import { getMigrations } from 'better-auth/db/migration';
+import { Kysely, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, sql } from 'kysely';
+import { GRANT_SCOPES } from '../shared/grant-scope';
+import { BunSqliteDriver } from '../store/bun-sqlite-driver';
+import { buildOwnerPlugin } from './build-owner-plugin';
+import { deriveTokenHash } from './derive-token-hash';
+import type { MCPAuthSchema } from './types';
+
+interface MCPAuthOptions {
+  readonly dbPath: string;
+
+  // The public origin: the issuer, with `<origin>/mcp` the one resource tokens
+  // are bound to. Null opens the store to manage clients and grants only, with
+  // no resource served.
+  readonly origin: string | null;
+
+  // How long a rotated refresh token still answers with its successor; 0
+  // treats any reuse as replay.
+  readonly refreshReuseSeconds?: number;
+}
+
+// How long an approval page, its signed query, and an authorization code each
+// stay valid.
+const APPROVAL_SECONDS = 600;
+
+// The owner's session lives only to carry one approval from the code page
+// through consent to the code exchange, which every token detaches from.
+const OWNER_SESSION_SECONDS = 3 * APPROVAL_SECONDS;
+
+/**
+ * Opens the authorization server's SQLite database and the better-auth
+ * instance over it, creating or updating its tables, with the file readable
+ * and writable by its owner only. better-auth runs the OAuth 2.1 flows: fixed
+ * public clients, PKCE, opaque access tokens, rotating refresh tokens, and
+ * revocation. Telemetry stays off whatever the environment says.
+ */
+export async function openMCPAuth(options: MCPAuthOptions) {
+  // better-auth reads these when it builds its context; an empty endpoint
+  // turns its telemetry into a no-op.
+  process.env['BETTER_AUTH_TELEMETRY'] = '0';
+  process.env['BETTER_AUTH_TELEMETRY_ENDPOINT'] = '';
+
+  // The file holds token hashes and owner sessions, so only its owner may
+  // read it. SQLite gives the WAL and shared-memory files the main file's
+  // mode, so the mode is set before SQLite opens it.
+  closeSync(openSync(options.dbPath, 'a', 0o600));
+  chmodSync(options.dbPath, 0o600);
+
+  const sqlite = new Database(options.dbPath, { create: true });
+
+  sqlite.run('PRAGMA journal_mode = WAL;');
+  sqlite.run('PRAGMA busy_timeout = 5000;');
+
+  // The schema declares cascades from a client to its tokens and consent,
+  // which SQLite enforces only with foreign keys on.
+  sqlite.run('PRAGMA foreign_keys = ON;');
+
+  const db = new Kysely<MCPAuthSchema>({
+    dialect: {
+      createAdapter: () => new SqliteAdapter(),
+      createDriver: () => new BunSqliteDriver(sqlite),
+      createIntrospector: (kysely) => new SqliteIntrospector(kysely),
+      createQueryCompiler: () => new SqliteQueryCompiler(),
+    },
+  });
+
+  const providerOptions: OAuthOptions<Scope[]> = {
+    loginPage: '/login',
+    consentPage: '/consent',
+    scopes: [...GRANT_SCOPES, 'offline_access'],
+    disableJwtPlugin: true,
+    allowDynamicClientRegistration: false,
+    grantTypes: ['authorization_code', 'refresh_token'],
+
+    // atc serves one resource, so every client may request it.
+    enforcePerClientResources: false,
+    accessTokenExpiresIn: 3600,
+    codeExpiresIn: APPROVAL_SECONDS,
+    refreshTokenReuseInterval: options.refreshReuseSeconds ?? 0,
+    storeTokens: { hash: (token: string) => Promise.resolve(deriveTokenHash(token)) },
+  };
+
+  const provider =
+    options.origin === null
+      ? oauthProvider(providerOptions)
+      : mcp({ ...providerOptions, resource: `${options.origin}/mcp` });
+
+  const baseURL = options.origin ?? 'http://127.0.0.1';
+
+  const auth = betterAuth({
+    baseURL,
+    basePath: '/',
+    secret: randomBytes(32).toString('base64url'),
+    database: { db, type: 'sqlite' },
+    telemetry: { enabled: false },
+    logger: { level: 'error' },
+    rateLimit: { enabled: false },
+
+    // Every open runs the migrations itself, so the startup schema check
+    // would only report the tables a fresh database has yet to get.
+    advanced: { database: { validateSchema: false } },
+    trustedOrigins: [baseURL],
+    session: { expiresIn: OWNER_SESSION_SECONDS, disableSessionRefresh: true },
+
+    // The provider's own endpoint types do not satisfy the plugin type under
+    // exactOptionalPropertyTypes, so atc reaches them over HTTP-shaped requests.
+    // oxlint-disable-next-line no-unsafe-type-assertion -- the plugin is a BetterAuthPlugin at runtime; only its endpoint option types disagree with the stricter compiler settings
+    plugins: [provider as BetterAuthPlugin, buildOwnerPlugin()],
+  });
+
+  const migrations = await getMigrations(auth.options);
+
+  await migrations.runMigrations();
+
+  await sql`create table if not exists atc_grant_use (grant_id text primary key not null, last_used_at text not null)`.execute(
+    db,
+  );
+
+  // A resource served under an earlier public URL stays a valid token target
+  // until its row goes.
+  if (options.origin !== null) {
+    await db
+      .deleteFrom('oauthResource')
+      .where('identifier', '!=', `${options.origin}/mcp`)
+      .execute();
+  }
+
+  return {
+    auth,
+    db,
+    async close(): Promise<void> {
+      await db.destroy();
+
+      sqlite.close();
+    },
+  };
+}

package/src/mcp/pick-error-message.ts

@@ -0,0 +1,22 @@
+// The error codes better-auth sends to the error page, each with the fixed
+// sentence atc shows for it.
+const ERROR_MESSAGES: Readonly<Record<string, string>> = {
+  invalid_client: 'the client is not one added to atc.',
+  client_disabled: 'the client is disabled.',
+  invalid_redirect: 'the redirect URI is not one the client was added with.',
+  unauthorized_client: 'the client may not use the authorization code grant.',
+  unsupported_response_type: 'atc supports only the authorization code response type.',
+  invalid_request: 'the request is malformed.',
+};
+
+/**
+ * The sentence the error page shows for an error code, or a generic one for
+ * a code atc does not know. The page never shows text from the request, so a
+ * link to it cannot make atc's origin display words an attacker chose.
+ */
+export function pickErrorMessage(code: string | null): string {
+  const reason =
+    code !== null && Object.hasOwn(ERROR_MESSAGES, code) ? ERROR_MESSAGES[code] : undefined;
+
+  return `atc refused this authorization request: ${reason ?? 'the request is not valid.'}`;
+}

package/src/mcp/pick-protocol-version.ts

@@ -0,0 +1,9 @@
+import { isSupportedProtocolVersion } from './is-supported-protocol-version';
+
+export function pickProtocolVersion(requested: unknown): string {
+  if (isSupportedProtocolVersion(requested)) {
+    return requested;
+  }
+
+  return '2025-11-25';
+}

package/src/mcp/reconnecting-caller.ts

@@ -0,0 +1,121 @@
+import { DaemonClient } from '../client/daemon-client';
+import type { FleetCaller } from './types';
+
+// The daemon requests the read-only tools send. Each only reads, so running
+// one twice is harmless.
+const RETRYABLE_METHODS: ReadonlySet<string> = new Set([
+  'dirs.list',
+  'events.read',
+  'message.get',
+  'session.get',
+  'session.list',
+  'session.read',
+  'session.resumeCommand',
+  'session.screen',
+]);
+
+/**
+ * A daemon caller that survives a daemon restart: once the connection ends,
+ * the next request opens and handshakes a fresh one. A request that was in
+ * flight when the connection ended is retried once on a fresh connection only
+ * when it is read-only; any other fails, because a spawn or a message must not
+ * run twice.
+ */
+export class ReconnectingCaller implements FleetCaller {
+  private readonly socketPath: string;
+
+  private readonly build: string;
+
+  private client: Promise<DaemonClient> | null = null;
+
+  private readonly closed = new WeakSet<DaemonClient>();
+
+  constructor(socketPath: string, build: string) {
+    this.socketPath = socketPath;
+    this.build = build;
+  }
+
+  async sendRequest(
+    m: string,
+    p?: Readonly<Record<string, unknown>>,
+  ): Promise<Readonly<Record<string, unknown>>> {
+    const client = await this.openClient();
+
+    try {
+      return await client.sendRequest(m, p);
+    } catch (error) {
+      if (!this.closed.has(client) || !RETRYABLE_METHODS.has(m)) {
+        throw error;
+      }
+
+      const fresh = await this.openClient();
+
+      return fresh.sendRequest(m, p);
+    }
+  }
+
+  async stop(): Promise<void> {
+    const current = this.client;
+
+    this.client = null;
+
+    if (current === null) {
+      return;
+    }
+
+    try {
+      const client = await current;
+
+      client.stop();
+    } catch {
+      // A connection that never opened has nothing to close.
+    }
+  }
+
+  private openClient(): Promise<DaemonClient> {
+    if (this.client === null) {
+      const opening: Promise<DaemonClient> = this.openFreshClient(() => this.client === opening);
+
+      this.client = opening;
+    }
+
+    return this.client;
+  }
+
+  // isCurrent returns true while this connection is still the one later requests
+  // reuse: a connection that ends after a newer one replaced it must leave
+  // the newer one in place.
+  private async openFreshClient(isCurrent: () => boolean): Promise<DaemonClient> {
+    const resetClient = () => {
+      if (isCurrent()) {
+        this.client = null;
+      }
+    };
+
+    let client: DaemonClient;
+
+    try {
+      client = await DaemonClient.open(this.socketPath);
+    } catch (error) {
+      resetClient();
+      throw error;
+    }
+
+    client.onClose = () => {
+      this.closed.add(client);
+
+      resetClient();
+    };
+
+    try {
+      await client.sendHello(this.build);
+    } catch (error) {
+      client.stop();
+
+      resetClient();
+      throw error;
+    }
+
+    return client;
+  }
+}

package/src/mcp/remove-client.ts

@@ -0,0 +1,36 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './types';
+
+/**
+ * Removes a client and everything it holds: its access and refresh tokens,
+ * its consent, and when its grants were last used. Returns false for an
+ * unknown client id.
+ */
+export function removeClient(db: Kysely<MCPAuthSchema>, clientID: string): Promise<boolean> {
+  return db.transaction().execute(async (trx) => {
+    const grants = await trx
+      .selectFrom('oauthRefreshToken')
+      .select('authorizationCodeId')
+      .where('clientId', '=', clientID)
+      .execute();
+
+    const grantIDs = grants.flatMap((grant) =>
+      grant.authorizationCodeId === null ? [] : [grant.authorizationCodeId],
+    );
+
+    if (grantIDs.length > 0) {
+      await trx.deleteFrom('atc_grant_use').where('grant_id', 'in', grantIDs).execute();
+    }
+
+    await trx.deleteFrom('oauthAccessToken').where('clientId', '=', clientID).execute();
+    await trx.deleteFrom('oauthRefreshToken').where('clientId', '=', clientID).execute();
+    await trx.deleteFrom('oauthConsent').where('clientId', '=', clientID).execute();
+
+    const removed = await trx
+      .deleteFrom('oauthClient')
+      .where('clientId', '=', clientID)
+      .executeTakeFirst();
+
+    return removed.numDeletedRows > 0n;
+  });
+}