# Tasks: enterprise-oauth-client

## 1. Scaffold

- [x] 1.1 `universal/auth/oauth-client/`; 100/100/100/100; guard tests; CLAUDE/README/FOLDERS.

## 2. Errors + schemas

- [x] 2.1 `src/error-codes.ts` — codes + side-effect register.
- [x] 2.2 `src/config-errors.ts` — `oauthConfigMissing` helper.
- [x] 2.3 Zod schemas for every type export.

## 3. PKCE

- [x] 3.1 `src/pkce/pkce.ts` — verifier/challenge/nonce/state + Base64URL codec.
- [x] 3.2 Property tests.

## 4. Provider presets

- [x] 4.1 `src/provider/provider.ts` — built-in presets + factory functions.
- [x] 4.2 Fixture tests against each preset's discovery document.

## 5. Discovery

- [x] 5.1 `src/discovery/discovery.ts` — URL builder + fetch + validation.

## 6. Token operations

- [x] 6.1 `src/token/token.ts` — `exchangeCode`, `refreshAccessToken`, `revokeToken`, `decodeJwt`, `validateIdTokenClaims`, `normalizeTokenResponse`, `isTokenExpired`, `OAuthTokenError`.

## 7. Client

- [x] 7.1 `src/client/client.ts` — `OAuthClient` façade; uses injected `FetchFunction` for testability.

## 8. Docs / barrel / subpath exports / README

## 9. Benchmarks

- [x] 9.1 `exchangeCode.bench.ts`, `decodeJwt.bench.ts`.

## 10. Ship gate

- [x] 10.1 Verification sequence; fold + archive.