Initial Commit

openspec/archive/2026-04-19-enterprise-oauth-client/tasks.md

@@ -0,0 +1,43 @@
+# Tasks: enterprise-oauth-client
+
+## 1. Scaffold
+
+- [x] 1.1 `universal/auth/oauth-client/`; 100/100/100/100; guard tests; CLAUDE/README/FOLDERS.
+
+## 2. Errors + schemas
+
+- [x] 2.1 `src/error-codes.ts` — codes + side-effect register.
+- [x] 2.2 `src/config-errors.ts` — `oauthConfigMissing` helper.
+- [x] 2.3 Zod schemas for every type export.
+
+## 3. PKCE
+
+- [x] 3.1 `src/pkce/pkce.ts` — verifier/challenge/nonce/state + Base64URL codec.
+- [x] 3.2 Property tests.
+
+## 4. Provider presets
+
+- [x] 4.1 `src/provider/provider.ts` — built-in presets + factory functions.
+- [x] 4.2 Fixture tests against each preset's discovery document.
+
+## 5. Discovery
+
+- [x] 5.1 `src/discovery/discovery.ts` — URL builder + fetch + validation.
+
+## 6. Token operations
+
+- [x] 6.1 `src/token/token.ts` — `exchangeCode`, `refreshAccessToken`, `revokeToken`, `decodeJwt`, `validateIdTokenClaims`, `normalizeTokenResponse`, `isTokenExpired`, `OAuthTokenError`.
+
+## 7. Client
+
+- [x] 7.1 `src/client/client.ts` — `OAuthClient` façade; uses injected `FetchFunction` for testability.
+
+## 8. Docs / barrel / subpath exports / README
+
+## 9. Benchmarks
+
+- [x] 9.1 `exchangeCode.bench.ts`, `decodeJwt.bench.ts`.
+
+## 10. Ship gate
+
+- [x] 10.1 Verification sequence; fold + archive.