feat(sdk-typescript): add application-owned OAuth PKCE flow

[fuller]

Summary

Adds OAuth authorization-code + PKCE orchestration to the TypeScript SDK while keeping browser navigation, callback handling, and credential storage application-owned.

Scope: This PR is limited to packages/sdk-typescript/**; it contains no Go SDK changes.

• Adds public PKCE helpers, BrowserOAuthAuth, BearerAuth, and durable authorization transaction storage.
• Keeps token persistence optional and injectable; no browser opening, callback listener, or implicit credential persistence.
• Adds redirect/state/token validation, replay protection, refresh rotation, safe diagnostics, and documented OAuth revocation.
• Revocation targets the long-lived refresh token and current access token, preserves local state when either remote attempt fails, and emits sanitized lifecycle diagnostics.
• Adds durable-store authority checks so a caller-supplied transaction cannot replace the stored PKCE verifier.
• Adds endpoint authority validation so custom authorization/token endpoints require an explicit matching revocation endpoint.
• Extends browser/package verification and security regression coverage.

Verification

• 634 tests passing
• Typecheck and build passing
• Browser import and bundle checks passing
• Packed consumer verification passing
• API surface verification passing
• npm audit --omit=dev: 0 vulnerabilities

[nostradamus-bot]

Nostradamus Risk Rating — Critical

The PR introduces a complete new Go SDK (packages/sdk-go/) with fresh HMAC-SHA384 signing (auth/hmac.go), OAuth Bearer auth (auth/bearer.go), and financial transaction services (services/trading.go, services/transfers.go, services/account.go, services/margin.go) — all classified Critical or High in the repo security model; the 51,002 lines of new auth primitives and cross-trust-boundary financial API surface in a new language warrant full STRIDE analysis before merge.

High/Critical — a full threat model follows.

[nostradamus-bot]

Nostradamus Threat Model - Passed - APPSEC-1569

[sdlc-pr-bot]

Change Control Evidence Check

Authorization — ❌ Fail

Evidence:

• Linear ticket: ⚠️ No ticket linked
• Change owner: Andrew Fuller
• Type of change: Normal

Testing — ✅ Pass

Evidence:

• Tests from CI checks: ➖ No tests ran
• Security scans: ✅ Passed
• Testing summary: ✅ Found in PR description
  • Summary: All 634 tests passed, including typecheck, build, browser import/bundle checks, consumer verification, and API surface verification. Security audit identified zero vulnerabilities in production dependencies.
• Evidence link: View run

Approval — ✅ Pass

Evidence:

• Approver: Jimmy Huang
• Approval source: GitHub PR Review
• Approval timestamp: 2026-08-29 05:26 UTC

Segregation of Duties — ✅ Pass

Validated:

• PR author: Andrew Fuller
• Commit author(s): fuller
• Approver: Jimmy Huang
• Result: Implementer and approver are different people ✅

---

Last checked: 2026-08-29 13:48 UTC

↩ Re-run Clarissa if tickets, CI, or approvals have changed.

[ximt]

Request changes. I reviewed the pinned PR head against its base using focused Go auth/transport/WebSocket/services/generated, TypeScript OAuth/PKCE, and packaging slices. The inline comments contain one Critical and nine Important findings involving request lifecycle, token routing, order-book/account data integrity, pagination, numeric portability, cancellation safety, and release correctness.

Targeted go test -race ./auth ./transport ./websocket ./services ./types passes, and the SDK compiles for GOOS=linux/GOARCH=386; those checks do not cover the runtime wire-decoding and lifecycle cases called out here. Please fix these issues and re-review against the new head SHA.

[fuller]

Scope correction: this PR branch was rebuilt from origin/main and now contains only packages/sdk-typescript/**; no Go SDK changes are included. The earlier Go-focused automated threat model and review findings refer to the superseded head. The applicable TypeScript OAuth endpoint comment was addressed in e5183b2 with fail-closed partial-override validation, tests, and documentation.

[fuller]

The remaining Go changes were moved to PR #43 and are being addressed there. PR #44 is intentionally limited to the TypeScript SDK changes.

[ximt]

Found one critical production issue in the new OAuth revocation path. The package type/adapter contract permits an empty response body, and Gemini documents revocation success as HTTP 200 with an empty body. Please fix this before merge; the package checks and tests pass, but they do not cover the empty-body response.

[ximt]

Re-reviewed PR #44 at d4d72e0 in the isolated worktree. The previous critical OAuth revocation issue is fixed: successful 2xx responses are handled before body reads, empty 200/204 bodies are covered by regression tests, and response cleanup remains best-effort. Local typecheck, 635 tests, package verification, browser/bundle verification, API-surface verification, and diff checks pass. No remaining Critical or Important correctness or security findings.

[fuller]

@ximt Could you please confirm the review disposition on PR #44? The two TypeScript OAuth findings were fixed in e5183b2 and d4d72e0; the nine Go findings were moved to PR #43. All 11 inline threads are now replied to and resolved, and the PR is approved. The remaining SSDLC status is governance-only and needs a Linear change ticket.