[Feature] Complete OAuthTypes: AT Protocol modules, Sendable, client_id, canonical hardening (Phase 1)

[systemblueio]

What this does

Phase 1 of the OAuthTypes completion (#2): the remaining AT Protocol modules, Sendable across the public surface, the client_id requirement on the authorization request query, and a hardened canonical-form check.

• New modules, each with a conversion doc, following @atproto/oauth-types@0.7.x: ATProtoOAuthScope, the loopback client redirect URIs and client-id build/parse, ATProtoTokenResponse, OAuthIntrospectionResponse, and a small supporting ATProtoDID.
• Sendable: every public OAuthTypes value type conforms to Sendable (checked, not @unchecked), proven by a compile-time test.
• client_id on every form: AuthorizationRequestQuery models the TypeScript intersection, so client_id is required and woven into the JAR and request-URI cases (the JAR form decodes {client_id, request}, not a bare string), surfaced through a computed clientID.
• Canonical-form hardening: the discoverable client-ID check reads the raw path with extractURLPath and normalizes dot segments itself, treating %2e/%2E as dots and folding backslashes to /, matching the WHATWG URL parser. The previous check leaned on URL.standardized, which leaves %2e and \ unresolved, so https://host/%2e%2e/... and https://host/a\..\.. could pass and behaved differently across platforms.
• Wire-format fixes found while porting: authorization_details decodes as an array (it is z.array(...)) on ATProtoTokenResponse and the introspection response, and an empty aud array is rejected (the claim is string | [string, ...string[]]).

README and DocC files are left untouched per #2, and every public, internal, and private declaration carries inline docs.

Stacked on #3

This sits on the validator fixes in #3, so its diff carries those commits until #3 merges. Please take #3 first; I will rebase this onto main after.

A few calls for you

• Base loopback leniency: ATProtoLoopbackClient.parseClientID rejects an invalid redirect_uri to match parseOAuthLoopbackClientId, rather than building on ClientIDLoopback.parse, which silently drops them. Worth tightening the base the same way if you agree.
• ATProtoDID validates did:plc (24 base32) and did:web (bare hostname, no port or path) syntax only, standing in for @atproto/did. It does not resolve identities; that belongs to a later phase, and I am happy to wire it to ATProtoKit's DID type when it lands.
• Swift 6.0 floor: one call used a trailing comma (a 6.1 feature), so it did not build on the declared 6.0 floor. I dropped the comma; raising the tools version to 6.1 is the alternative if you would rather keep them.

Follow-up review pass

A second pass against @atproto/oauth-types surfaced four more reference mismatches in the validators, each fixed here with accept and reject tests:

• authorization_details on the request parameters decoded as a single object, but oauthAuthorizationRequestParametersSchema references oauthAuthorizationDetailsSchema (z.array(...)), so a real request with authorization_details failed to decode. Now [AuthorizationDetail]?, matching the token and introspection responses.
• validateHTTPSURI compared the host case-sensitively, so https://printer.LOCAL slipped past the .local check; new URL() lowercases the host, so the host is lowercased before the loopback, IP, and .local checks.
• The issuer canonical-form check rebuilt from urlComponents.path, which keeps dot segments, so https://auth.example.com/a/../b was accepted; it now resolves dot segments with the same extractURLPath + canonicalizedURLPath the discoverable check uses, matching new URL(value).href.
• The IPv4 host check used a strict 0-255 regex, so a malformed quad like 300.1.2.3 passed as a domain name and a https://300.1.2.3/... client ID was accepted; it now matches the reference's broad ^\d+\.\d+\.\d+\.\d+$, so out-of-range octets are still barred as IP hosts.

A pass over the new public surface against the API design guidelines (#2) also landed: ATProtoTokenResponse.sub is now subject (full word, matching OAuthIntrospectionResponse.Active.subject; the sub wire key is unchanged), ATProtoLoopbackClient.buildClientID is now makeClientID (the make factory convention, matching makeATProtoLoopbackClientMetadata), and three doc comments were reflowed to the 100-character limit.

Base-code items for your call

A few things turned up in base code that I left unchanged for you to decide on, rather than touch your public API:

• http://localhost redirect URIs. OAuthRedirectURI accepts one through its oauthHTTPSRedirectURI case, but oauthRedirectUriSchema is https web / http loopback (explicit IP, localhost excluded per RFC 8252) / private-use. Dropping that case would match the reference.
• Redirect-URI case names. The OAuthRedirectURI cases repeat the type name (oauthWebRedirectURI); .web / .loopback / .privateUse would read cleaner per the Swift API Design Guidelines.
• OpenIDConnectUserInfo.audience. Typed [String]?, but oidcUserinfoSchema types aud as string | [string, ...string[]], so a single-string aud fails to decode. Could reuse OAuthIntrospectionResponse.Audience.

Happy to implement any of these if you would like.

Verification

• macOS (Swift 6.3): swift build clean, zero warnings; swift test green: 127 tests in 20 suites.
• Linux (Swift 6.0 and 6.1): green via the added GitHub Actions workflow (run). Android and Windows are not in CI; this target uses only Foundation and the standard library, no platform-specific APIs.

[systemblueio]

Reopening to keep refining this; it stays in draft until it is genuinely solid.