{
	"lexicon": 1,
	"id": "com.fedfork.exec.oauth.clientMetadata",
	"defs": {
		"main": {
			"type": "record",
			"key": "any",
			"description": "OAuth client metadata template for an integration. A site acting as this client rebases every URL on the template origin onto its own origin and serves the result as its own client metadata document.",
			"record": {
				"type": "object",
				"required": [
					"name",
					"clientMetadata",
					"createdAt"
				],
				"properties": {
					"name": {
						"type": "string",
						"maxLength": 2560,
						"maxGraphemes": 256
					},
					"description": {
						"type": "string",
						"maxLength": 30000,
						"maxGraphemes": 3000
					},
					"clientMetadata": {
						"type": "ref",
						"ref": "#clientMetadata"
					},
					"scopeGroups": {
						"type": "array",
						"maxLength": 256,
						"description": "Optional subsets of the declared scope that a user can grant progressively.",
						"items": {
							"type": "ref",
							"ref": "#scopeGroup"
						}
					},
					"app": {
						"type": "ref",
						"ref": "#app",
						"description": "The app's own identity, did:web:<the deployment's host>, and the records its read-only repo serves there for other services (dev.cocore.app.registration, ...), with the .well-known files they check. Strings on this record's client_id origin, and did:web:<that host>, become the deployment's when served."
					},
					"createdAt": {
						"type": "string",
						"format": "datetime"
					}
				}
			}
		},
		"clientMetadata": {
			"type": "object",
			"required": [
				"client_id",
				"redirect_uris",
				"scope"
			],
			"properties": {
				"client_id": {
					"type": "string",
					"format": "uri"
				},
				"client_name": {
					"type": "string",
					"maxLength": 2560
				},
				"client_uri": {
					"type": "string",
					"format": "uri"
				},
				"logo_uri": {
					"type": "string",
					"format": "uri"
				},
				"tos_uri": {
					"type": "string",
					"format": "uri"
				},
				"policy_uri": {
					"type": "string",
					"format": "uri"
				},
				"redirect_uris": {
					"type": "array",
					"items": {
						"type": "string",
						"format": "uri"
					}
				},
				"scope": {
					"type": "string",
					"maxLength": 65536
				},
				"grant_types": {
					"type": "array",
					"items": {
						"type": "string"
					}
				},
				"response_types": {
					"type": "array",
					"items": {
						"type": "string"
					}
				},
				"application_type": {
					"type": "string"
				},
				"token_endpoint_auth_method": {
					"type": "string"
				},
				"dpop_bound_access_tokens": {
					"type": "boolean"
				}
			}
		},
		"scopeGroup": {
			"type": "object",
			"required": [
				"key",
				"label",
				"scopes"
			],
			"properties": {
				"key": {
					"type": "string",
					"maxLength": 256
				},
				"label": {
					"type": "string",
					"maxLength": 2560,
					"maxGraphemes": 256
				},
				"scopes": {
					"type": "array",
					"maxLength": 1024,
					"items": {
						"type": "string",
						"maxLength": 8192
					}
				},
				"optional": {
					"type": "boolean",
					"description": "A session holds without these scopes: one signed in before they were added stays connected (it lacks only what they grant). A new sign-in asks for them."
				}
			}
		},
		"app": {
			"type": "object",
			"properties": {
				"records": {
					"type": "array",
					"maxLength": 256,
					"items": {
						"type": "ref",
						"ref": "#appRecord"
					}
				},
				"wellKnown": {
					"type": "unknown",
					"description": "file name -> the JSON served at /.well-known/<file> (not did.json or atproto-did)."
				}
			}
		},
		"appRecord": {
			"type": "object",
			"required": [
				"collection",
				"rkey",
				"value"
			],
			"properties": {
				"collection": {
					"type": "string",
					"format": "nsid"
				},
				"rkey": {
					"type": "string",
					"format": "record-key"
				},
				"value": {
					"type": "unknown",
					"description": "The record: plain JSON, no blobs or links."
				}
			}
		}
	}
}