ctx-store 0.7.0__py3-none-any.whl

ctx_store-0.7.0.dist-info/METADATA

@@ -0,0 +1,129 @@
+Metadata-Version: 2.4
+Name: ctx-store
+Version: 0.7.0
+Summary: A markdown context store for coding agents: validated writes, budgeted reads, audit trail.
+License: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# ctx-store
+
+`ctx` is a markdown context store for coding agents: one folder of `*.md` rows with YAML frontmatter as
+the schema, a CLI with validated structured writes (`log`, `fm`, `new`, `move`), budgeted reads
+(`brief`, `find --budget`, `resolve`, `get --section --tail`), a per-actor audit trail and a maintenance
+pass (`init`, `validate`, `doctor`, `maintain`, `migrate`). The same core serves three front-ends: the CLI (Claude
+Code hooks and skills call it), an Anthropic memory-tool handler (`view create str_replace insert delete
+rename`) and an MCP server (stdio for Claude Desktop; HTTP with authentication for claude.ai, as a
+separate package).
+
+Production-grade by design: Python stdlib only (≥ 3.10), runs from a plain copy with no install, fixed
+exit-code table, `--json` envelope (`"api": 1`), temp + rename writes under a lock, secret guard on every
+payload, read-only store support, no writable state under the store for reads.
+
+## Interface first
+
+The interface is the contract: verbs, fixed errors and the doc model. Storage is a backend behind it.
+Markdown files are the default backend, so a store stays a folder you can read and edit; the same calls
+give the same answers on any other backend (`ctxstore/backend.py`, `ctx help backends`).
+
+## Try it
+
+```sh
+git clone https://github.com/MdaaaaO/ctx-store && cd ctx-store
+./ctx --version
+./ctx doctor --store tests/fixtures/store-v1
+./ctx help errors
+```
+
+No install step: `ctx` runs from a plain copy of the repo on Python ≥ 3.10. The interface (verbs, exit
+codes, error strings, `--json` envelope, environment) is [`docs/interface.md`](docs/interface.md);
+`ctx help` prints from the same file. Tests: `make ci`.
+
+## Hooks
+
+Every call a harness hook needs is one line. A write names its store; a read may find it by walking up.
+
+| When | Call |
+|---|---|
+| Setup on a new machine, or a schema upgrade | `ctx init --store <path> --settings <file> --types <folder>` (add `--upgrade` for a new version: files edited since are kept) |
+| After a change under the store | `ctx validate --changed` (add `--adopt` while writes still come from outside ctx) |
+| Heartbeat | `ctx touch --session <id>` |
+| Session start | `ctx brief --registry` |
+| After a compaction | `ctx brief --session <id>` |
+| A step landed | `ctx log <doc> "<what happened>"` |
+| Session end, or on a timer | `ctx maintain` |
+| CI, after a schema change | `ctx migrate --check` |
+
+## Claude Desktop
+
+```json
+{"mcpServers": {"ctx": {"command": "/path/to/ctx-store/ctx", "args": ["mcp"],
+  "env": {"CTX_STORE": "/path/to/store", "CTX_ACTOR": "desktop"}}}}
+```
+
+On Windows with the store and `ctx` inside WSL, Claude Desktop starts it through `wsl.exe`, and the
+environment goes into the arguments:
+
+```json
+{"mcpServers": {"ctx": {"command": "wsl.exe",
+  "args": ["-e", "env", "CTX_STORE=/home/you/store", "CTX_ACTOR=desktop", "CTX_NO_WALK=1",
+           "/home/you/ctx-store/ctx", "mcp"]}}}
+```
+
+| Install | `claude_desktop_config.json` is in |
+|---|---|
+| Windows, installer | `%APPDATA%\Claude\` |
+| Windows, Microsoft Store | `%LOCALAPPDATA%\Packages\Claude_*\LocalCache\Roaming\Claude\` |
+| macOS | `~/Library/Application Support/Claude/` |
+
+Tested with the Microsoft Store install on Windows with WSL2: the tools are listed, and `brief`, `find`
+and `log` work. The other two rows are where Claude Desktop documents its config; they were not tested
+here.
+
+Every built verb is a tool (`ctx_brief`, `ctx_find`, `ctx_log`, …). `ctx memory` takes the input of
+Anthropic's memory tool on stdin.
+
+## claude.ai
+
+`ctx-serve` puts the same tools behind HTTP with authentication (OAuth for claude.ai, a bearer token for
+Claude Code), for a store on your machine behind a tunnel: [`docs/connector.md`](docs/connector.md). It is
+a separate package; the core has no network.
+
+## Speed
+
+Milliseconds per call as a caller sees it: a fresh process each time, interpreter start included
+(about 40 ms of every number). Generated Markdown stores of 3.1 MB and 39.2 MB, 20 runs per call,
+Python 3.14 on Linux under WSL2. The two stores were measured in separate runs on a machine that was
+not idle: compare a row with the first row of its own column. `python3 bench/bench.py` reproduces it.
+
+| Call | 225 docs p50 | p95 | 3 000 docs p50 | p95 |
+|---|---:|---:|---:|---:|
+| start of the interpreter (`--version`) | 35 | 38 | 34 | 37 |
+| `brief <doc>` | 35 | 40 | 34 | 39 |
+| `get <doc> --section --tail 5` | 35 | 37 | 35 | 36 |
+| `view <doc>` | 34 | 35 | 35 | 39 |
+| `brief --registry` | 42 | 44 | 127 | 140 |
+| `brief --session <id>` | 42 | 50 | 127 | 134 |
+| `resolve <key>` | 41 | 46 | 103 | 107 |
+| `find <word in one doc>` | 44 | 45 | 155 | 163 |
+| `find <common word>` | 69 | 77 | 173 | 199 |
+| `find --tag` | 41 | 59 | 123 | 144 |
+| `validate` | 54 | 60 | 295 | 309 |
+| `validate --changed` | 49 | 55 | 184 | 194 |
+
+**No search cache.** The rule was: a cache enters only above 3 000 docs, with `find` over 200 ms at
+p95, or when a lookup needs ranked search a scan cannot give. At 3 000 docs every `find` stays under
+200 ms. `find` matches terms and ranks its hits as part of the same scan (`ctx help find`), which
+finds 17 of the 18 lookups in `bench/eval/` where the phrase match before it found 6; the one it
+misses is a paraphrase, which an index of words would miss too. A task described in a sentence
+or two finds its doc as well (7 of 7 in the eval). That is where the scan costs most: about 0.1 s for
+25 words on 225 docs, about 0.9 s on 3 000. So the store has no index to build,
+validate or lose. The question returns when a store passes 3 000 docs, or when lookups need
+synonyms.
+
+`validate --changed`, the call behind the after-write hook, stays under its 300 ms budget at 3 000 docs.
+
+**Status:** P4: every verb except `row` is built; measured; no cache. Design and phasing:
+[#1](https://github.com/MdaaaaO/ctx-store/issues/1). Licence: MIT.

ctx_store-0.7.0.dist-info/RECORD

@@ -0,0 +1,36 @@
+ctx_store-0.7.0.dist-info/licenses/LICENSE,sha256=QfqxBdBwsjJrZNNocQsz9Ni7_c2Xq3IDw7pFXq3O3Yc,1064
+ctxserve/__init__.py,sha256=gqIdwu3jlNJJRQ_D3_VaHryUROL7URPFWVnF_YC-bt8,178
+ctxserve/__main__.py,sha256=WAhr-TR-SUgzU8lRacTT70n91sBZgxPy6yff-Zyeu3E,55
+ctxserve/auth.py,sha256=Vm4sTbNMs-u0bzwuvvSNjVua-2CPUScfJfV0waoDESQ,10698
+ctxserve/server.py,sha256=FeoGtphbL1uOJAsRoi-ct8uASwRAe7zPuaqP-0H55AQ,14585
+ctxstore/VERSION,sha256=ln2a-xATRmZxZvLnboGRC8GQSI19QdUMoAcunZLwDjI,6
+ctxstore/__init__.py,sha256=MkyaMWFRN3wu6eN8j_lo-W_s13YlqY7pJaf78_5cBhI,155
+ctxstore/__main__.py,sha256=E6Gls0DNz8GQK2K-kOUIx8cYhgANW_CH54VKrfCfs14,52
+ctxstore/backend.py,sha256=tqh5gnSE8cCaAYiPWkBVKGwbsZSWr0EJjFwXdYt8qN8,9145
+ctxstore/bootstrap.py,sha256=-leR5k9qSRupiIAZrMjuBG0SaPoJG0gq8xnDP9kem2E,6699
+ctxstore/cli.py,sha256=BjGdF5QhhnYEnFW3004n_bJkMiBAJAtaSzl1faZB84k,11166
+ctxstore/clock.py,sha256=iB0rHTYv-Jk_ieo_QUq7tWI3fF5GsAxojF_iU0sgEHw,191
+ctxstore/config.py,sha256=zwJF-xLXYKWI_7plkX-Xp2GqS-hpLk6leR5c92r-XAg,1894
+ctxstore/contract.py,sha256=jVyUSgTZtfRH5dPESggIp6R9E6dJWvtHwceCd3efKU0,3326
+ctxstore/doctor.py,sha256=PuAIwXtApvMgncdyBy0Lo21zsv4-rkf2MfDgSRyy774,1710
+ctxstore/frontmatter.py,sha256=6UoSXi4jaZURMsIzk-X0Jj62yHDiJKHR0rQ-yC4QeFs,3676
+ctxstore/fs.py,sha256=nc_wKHsryHCR0C5cyRpeleWJ05XX3Ssvw2OdtbWh6iU,16014
+ctxstore/interface.md,sha256=2LSAM-K96hQkrBiVh7pj2fg7BVAylMHkJMverWrpL5w,31827
+ctxstore/links.py,sha256=NPJD9pwIqiwNX_zsLfP2mx2dJQ_XEHRC3t7w7jp5xPE,2129
+ctxstore/markdown.py,sha256=O4b4cVqZXYbftShGkcmlpBB5wL73dj8HWCgadl_jCoc,2594
+ctxstore/mcp.py,sha256=eLjkzZx_tRJwj7XhklwnYhczE5IjL38cCaGeqP6CmbE,12128
+ctxstore/memory_tool.py,sha256=Oz9F_MC8azRy5jiVwP-Fwl96SuPmP28XxPiXg9i2SGg,2574
+ctxstore/reads.py,sha256=BL4IySa1ecOf2fvb8raYiYsm07KbqDSYiYJhiHa-JtI,12951
+ctxstore/search.py,sha256=6hXexfaGiUmP34lYzhDV2zW_0SbSccH-_plxqMPbJGA,9102
+ctxstore/secrets.py,sha256=-GgFAJSQIFGIqh20USYvzt1NweCvmC0BJeNrJi4kOIc,763
+ctxstore/sections.py,sha256=Cn0kKq9osqLNh1K5HS6xhrBdbJVDIjYOyfhgAySchII,7435
+ctxstore/spec.py,sha256=SV-0p83RmQbX2acla0ne-HeNL6PsDdXp19k23RIP3Yw,1395
+ctxstore/store.py,sha256=vHLV5X2ZZGMVRAMufRdRTY9fPYA4YeDhpd7choPNUrA,16447
+ctxstore/upkeep.py,sha256=_El8OVAwAOAWVI3VtYxYJYhRXyC_N9h5A3DVLC6dkBk,12567
+ctxstore/verbs.py,sha256=rMr0LLOMMeyJ0inOsA2ItycUuEPF2TZHQfj-_CHXxIA,13475
+ctxstore/writes.py,sha256=LnSnra6qJOGR8VFFe3OwUQ77EZAFqMBOSwnP-ZwQfoQ,7729
+ctx_store-0.7.0.dist-info/METADATA,sha256=bNN1Q5ibyM2_2edmQR-Qc_NgmfkO0yhNOYfWhcx4zIU,6160
+ctx_store-0.7.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+ctx_store-0.7.0.dist-info/entry_points.txt,sha256=AfhG-KGmy0tkoTczBWT3oFnTTfwn9ZMVwJ_nsZlrbPA,75
+ctx_store-0.7.0.dist-info/top_level.txt,sha256=qg8AYNV6uf7hBN0L9iL-XhgLwN1qxcdvtpvR0-afE_4,18
+ctx_store-0.7.0.dist-info/RECORD,,

ctx_store-0.7.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

ctx_store-0.7.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+ctx = ctxstore.cli:main
+ctx-serve = ctxserve.server:main

ctx_store-0.7.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MdaaaaO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ctx_store-0.7.0.dist-info/top_level.txt

@@ -0,0 +1,2 @@
+ctxserve
+ctxstore

ctxserve/__init__.py

@@ -0,0 +1,3 @@
+"""ctx over HTTP: the MCP server of `ctx mcp` behind Streamable HTTP, with
+authentication. Not part of the core: the core has no network and no server.
+Standard library only."""

ctxserve/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .server import main
+
+sys.exit(main())

ctxserve/auth.py

@@ -0,0 +1,235 @@
+"""Who may call: a static bearer token, or OAuth 2.1 for one owner.
+
+The OAuth side is an authorization server small enough to read: dynamic
+client registration, the authorization code grant with PKCE (S256), refresh
+tokens that rotate. There is one resource owner. Consent is the owner's
+passphrase, typed into the page this server shows.
+
+Tokens, codes and the passphrase are never stored: the state file holds
+sha256 digests, and lives outside the store.
+"""
+import base64
+import hashlib
+import hmac
+import json
+import os
+import re
+import secrets
+import threading
+import time
+import urllib.parse
+
+CODE_SECONDS = 300
+ACCESS_SECONDS = 3600
+REFRESH_SECONDS = 30 * 86400
+FORM_SECONDS = 600
+ATTEMPTS, WINDOW = 5, 600  # wrong passphrases allowed per ten minutes
+CLIENTS = 200              # registered clients kept; the oldest go first
+CALLBACKS = (
+    re.compile(r"^https://claude\.ai/api/mcp/auth_callback$"),
+    re.compile(r"^https://claude\.com/api/mcp/auth_callback$"),
+    re.compile(r"^http://(localhost|127\.0\.0\.1)(:\d{1,5})?/callback$"),
+)
+
+
+def digest(value):
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def same(left, right):
+    return hmac.compare_digest(left.encode("utf-8"), right.encode("utf-8"))
+
+
+def allowed_callback(uri):
+    return isinstance(uri, str) and any(rule.match(uri) for rule in CALLBACKS)
+
+
+def challenge_of(verifier):
+    raw = hashlib.sha256(verifier.encode("ascii")).digest()
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
+
+
+class Refused(Exception):
+    """An OAuth error: (HTTP status, error code, description)."""
+
+    def __init__(self, status, code, text=""):
+        super().__init__(code)
+        self.status, self.code, self.text = status, code, text
+
+
+class State:
+    """The server's memory between requests, kept in one JSON file."""
+
+    def __init__(self, path, clock=time.time):
+        self.path, self.clock = path, clock
+        self.data = {"clients": {}, "codes": {}, "access": {}, "refresh": {}, "forms": {}, "failures": []}
+        if path and os.path.exists(path):
+            with open(path, encoding="utf-8") as handle:
+                self.data.update(json.load(handle))
+
+    def save(self):
+        now = self.clock()
+        for name in ("codes", "access", "refresh", "forms"):
+            self.data[name] = {k: v for k, v in self.data[name].items() if v["until"] > now}
+        self.data["failures"] = [at for at in self.data["failures"] if at > now - WINDOW]
+        clients = sorted(self.data["clients"].items(), key=lambda item: item[1]["at"])
+        self.data["clients"] = dict(clients[-CLIENTS:])
+        if not self.path:
+            return
+        os.makedirs(os.path.dirname(self.path), mode=0o700, exist_ok=True)
+        temp = f"{self.path}.{os.getpid()}.tmp"
+        handle = os.open(temp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(handle, "w", encoding="utf-8") as out:
+            json.dump(self.data, out)
+        os.replace(temp, self.path)
+
+
+class Auth:
+    def __init__(self, url, secret=None, token=None, state=None, clock=time.time):
+        self.url = url.rstrip("/")
+        self.secret, self.token = secret, token
+        self.clock = clock
+        self.state = state or State(None, clock)
+        self.lock = threading.RLock()  # requests run in threads; the state is one
+
+    # --- the resource: who may call /mcp ---
+
+    def allows(self, header):
+        """Whether an Authorization header carries a token this server gave
+        out, or the static one."""
+        with self.lock:
+            kind, _, value = (header or "").partition(" ")
+            if kind.lower() != "bearer" or not value.strip():
+                return False
+            value = value.strip()
+            if self.token and same(value, self.token):
+                return True
+            entry = self.state.data["access"].get(digest(value))
+            return bool(entry) and entry["until"] > self.clock()
+
+    def challenge(self):
+        return f'Bearer resource_metadata="{self.url}/.well-known/oauth-protected-resource"'
+
+    # --- discovery ---
+
+    def resource_metadata(self):
+        return {"resource": f"{self.url}/mcp", "authorization_servers": [self.url],
+                "bearer_methods_supported": ["header"]}
+
+    def server_metadata(self):
+        return {
+            "issuer": self.url,
+            "authorization_endpoint": f"{self.url}/authorize",
+            "token_endpoint": f"{self.url}/token",
+            "registration_endpoint": f"{self.url}/register",
+            "response_types_supported": ["code"],
+            "grant_types_supported": ["authorization_code", "refresh_token"],
+            "code_challenge_methods_supported": ["S256"],
+            "token_endpoint_auth_methods_supported": ["none"],
+        }
+
+    # --- registration ---
+
+    def register(self, body):
+        with self.lock:
+            uris = body.get("redirect_uris") if isinstance(body, dict) else None
+            if not isinstance(uris, list) or not uris or not all(allowed_callback(uri) for uri in uris):
+                raise Refused(400, "invalid_redirect_uri", "redirect_uris must be Claude's callback or a loopback callback")
+            name = body.get("client_name")
+            client = secrets.token_urlsafe(24)
+            self.state.data["clients"][client] = {
+                "redirect_uris": uris, "name": name[:80] if isinstance(name, str) else "", "at": self.clock()}
+            self.state.save()
+            return {"client_id": client, "redirect_uris": uris, "token_endpoint_auth_method": "none",
+                    "grant_types": ["authorization_code", "refresh_token"], "response_types": ["code"],
+                    "client_name": self.state.data["clients"][client]["name"]}
+
+    # --- authorization ---
+
+    def request(self, query):
+        """The checked parameters of an authorization request. A request whose
+        client or redirect cannot be trusted is refused here and never
+        redirected."""
+        with self.lock:
+            client = self.state.data["clients"].get(query.get("client_id", ""))
+            if not client:
+                raise Refused(400, "invalid_client", "unknown client_id")
+            redirect = query.get("redirect_uri", "")
+            if redirect not in client["redirect_uris"] or not allowed_callback(redirect):
+                raise Refused(400, "invalid_request", "redirect_uri is not the client's")
+            if query.get("response_type") != "code":
+                raise Refused(400, "unsupported_response_type")
+            challenge = query.get("code_challenge", "")
+            if query.get("code_challenge_method") != "S256" or not re.fullmatch(r"[A-Za-z0-9_-]{43}", challenge):
+                raise Refused(400, "invalid_request", "PKCE with S256 is required")
+            return {"client_id": query["client_id"], "redirect_uri": redirect, "code_challenge": challenge,
+                    "state": query.get("state", ""), "name": client["name"]}
+
+    def form(self, request):
+        """A one-time token that ties the consent page to the request it shows."""
+        with self.lock:
+            token = secrets.token_urlsafe(24)
+            self.state.data["forms"][digest(token)] = {"request": request, "until": self.clock() + FORM_SECONDS}
+            self.state.save()
+            return token
+
+    def consent(self, form, passphrase):
+        """The redirect that carries the code, once the owner's passphrase is
+        right."""
+        with self.lock:
+            if not self.secret:
+                raise Refused(503, "server_error", "no owner passphrase is set")
+            now = self.clock()
+            if len([at for at in self.state.data["failures"] if at > now - WINDOW]) >= ATTEMPTS:
+                raise Refused(429, "access_denied", "too many wrong passphrases; try again later")
+            entry = self.state.data["forms"].pop(digest(form or ""), None)
+            if not entry or entry["until"] <= now:
+                self.state.save()
+                raise Refused(400, "invalid_request", "the page has expired; start again from Claude")
+            request = entry["request"]
+            if not same(passphrase or "", self.secret):
+                self.state.data["failures"].append(now)
+                self.state.save()
+                raise Refused(403, "access_denied", "wrong passphrase")
+            code = secrets.token_urlsafe(32)
+            self.state.data["codes"][digest(code)] = {**request, "until": now + CODE_SECONDS}
+            self.state.save()
+            answer = {"code": code}
+            if request["state"]:
+                answer["state"] = request["state"]
+            joiner = "&" if "?" in request["redirect_uri"] else "?"
+            return request["redirect_uri"] + joiner + urllib.parse.urlencode(answer)
+
+    # --- tokens ---
+
+    def _issue(self, client):
+        now = self.clock()
+        access, refresh = secrets.token_urlsafe(32), secrets.token_urlsafe(32)
+        self.state.data["access"][digest(access)] = {"client_id": client, "until": now + ACCESS_SECONDS}
+        self.state.data["refresh"][digest(refresh)] = {"client_id": client, "until": now + REFRESH_SECONDS}
+        self.state.save()
+        return {"access_token": access, "token_type": "Bearer", "expires_in": ACCESS_SECONDS,
+                "refresh_token": refresh}
+
+    def exchange(self, form):
+        with self.lock:
+            grant = form.get("grant_type")
+            now = self.clock()
+            if grant == "authorization_code":
+                entry = self.state.data["codes"].pop(digest(form.get("code", "")), None)
+                self.state.save()  # a code is spent by its first use, right or wrong
+                verifier = form.get("code_verifier", "")
+                if (not entry or entry["until"] <= now
+                        or form.get("client_id") != entry["client_id"]
+                        or form.get("redirect_uri") != entry["redirect_uri"]
+                        or not re.fullmatch(r"[A-Za-z0-9._~-]{43,128}", verifier)
+                        or not same(challenge_of(verifier), entry["code_challenge"])):
+                    raise Refused(400, "invalid_grant")
+                return self._issue(entry["client_id"])
+            if grant == "refresh_token":
+                entry = self.state.data["refresh"].pop(digest(form.get("refresh_token", "")), None)
+                self.state.save()  # rotation: the old refresh token is gone either way
+                if not entry or entry["until"] <= now or form.get("client_id") != entry["client_id"]:
+                    raise Refused(400, "invalid_grant")
+                return self._issue(entry["client_id"])
+            raise Refused(400, "unsupported_grant_type")