suaveplan/openspec/archive/2026-04-19-enterprise-oauth-client/tasks.md

Tasks: enterprise-oauth-client

1. Scaffold

• 1.1 universal/auth/oauth-client/; 100/100/100/100; guard tests; CLAUDE/README/FOLDERS.

2. Errors + schemas

• 2.1 src/error-codes.ts — codes + side-effect register.
• 2.2 src/config-errors.ts — oauthConfigMissing helper.
• 2.3 Zod schemas for every type export.

3. PKCE

• 3.1 src/pkce/pkce.ts — verifier/challenge/nonce/state + Base64URL codec.
• 3.2 Property tests.

4. Provider presets

• 4.1 src/provider/provider.ts — built-in presets + factory functions.
• 4.2 Fixture tests against each preset's discovery document.

5. Discovery

• 5.1 src/discovery/discovery.ts — URL builder + fetch + validation.

6. Token operations

• 6.1 src/token/token.ts — exchangeCode, refreshAccessToken, revokeToken, decodeJwt, validateIdTokenClaims, normalizeTokenResponse, isTokenExpired, OAuthTokenError.

7. Client

• 7.1 src/client/client.ts — OAuthClient façade; uses injected FetchFunction for testability.

8. Docs / barrel / subpath exports / README

9. Benchmarks

• 9.1 exchangeCode.bench.ts, decodeJwt.bench.ts.

10. Ship gate

• 10.1 Verification sequence; fold + archive.