@o2js/core 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gökhan Altun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,231 @@
-# Temporary Holding Version
+# o2js
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**A lightweight and provider-agnostic OAuth2 library for Node.js.**
+
+o2js provides the core OAuth2 authorization code and refresh token flows.
+
+It does not manage users, sessions, token storage, or database operations. It only handles OAuth2 mechanics and leaves the rest to your application.
+
+## Installation
+
+```bash
+npm install @o2js/core
+```
+
+## Quick Start
+
+First, define a provider:
+
+```typescript
+import type { Provider } from "@o2js/core";
+
+class MyProvider implements Provider {
+    authURL(): string {
+        return "https://example.com/oauth/authorize";
+    }
+
+    tokenURL(): string {
+        return "https://example.com/oauth/token";
+    }
+}
+```
+
+Create an OAuth2 client:
+
+```typescript
+import { OAuth2 } from "@o2js/core";
+
+const oauth = new OAuth2(
+    new MyProvider(),
+    {
+        clientID: "your-client-id",
+        clientSecret: "your-client-secret",
+        redirectURL: "https://yourapp.com/callback",
+    }
+);
+```
+
+Generate an authorization URL:
+
+```typescript
+const state = "your-random-state";
+const url = oauth.authCodeURL(state);
+```
+
+After the user authorizes your application, exchange the authorization code:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code);
+
+console.log(response.data);
+```
+
+Refresh an access token:
+
+```typescript
+const response = await oauth.exchangeRefreshToken(refreshToken);
+```
+
+## Configuration
+
+```typescript
+type ClientAuthMethod =
+    | "client_secret_basic"
+    | "client_secret_post";
+
+type Config = {
+    clientID: string;
+    clientSecret: string;
+    redirectURL: string;
+    clientAuthMethod?: ClientAuthMethod;
+};
+```
+
+- `clientID`: OAuth application client ID.
+- `clientSecret`: OAuth application client secret.
+- `redirectURL`: Registered callback URL.
+- `clientAuthMethod`: Client authentication method used at the token endpoint.
+
+Supported client authentication methods:
+
+- `client_secret_basic`: Sends client credentials using HTTP Basic Authentication. This is the default.
+- `client_secret_post`: Sends client credentials in the request body.
+
+Example using `client_secret_post`:
+
+```typescript
+const oauth = new OAuth2(provider, {
+    clientID: "your-client-id",
+    clientSecret: "your-client-secret",
+    redirectURL: "https://yourapp.com/callback",
+    clientAuthMethod: "client_secret_post",
+});
+```
+
+If `clientAuthMethod` is omitted, o2js uses `client_secret_basic`.
+
+
+## Custom Parameters
+
+OAuth providers may require additional parameters for scopes, PKCE, or other features.
+
+You can pass these parameters directly to the relevant methods.
+
+Additional authorization URL parameters:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    scope: "profile email",
+    prompt: "consent",
+});
+```
+
+Additional token request parameters:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code, {
+    code_verifier: "your-code-verifier",
+});
+```
+
+Refresh token requests also accept additional parameters:
+
+```typescript
+const response = await oauth.exchangeRefreshToken(refreshToken, {
+    custom_parameter: "value",
+});
+```
+
+Check your provider's documentation for supported parameters and their expected values.
+
+## State and PKCE
+
+o2js provides helpers for generating random state values and PKCE parameters.
+
+Generate a random state:
+
+```typescript
+import { generateRandomState } from "@o2js/core";
+
+const state = generateRandomState();
+```
+
+Generate PKCE parameters:
+
+```typescript
+import { generateRandomPKCE } from "@o2js/core";
+
+const pkce = generateRandomPKCE();
+```
+
+Use the generated values in the authorization URL:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    code_challenge: pkce.codeChallenge,
+    code_challenge_method: "S256",
+});
+```
+
+Send the code verifier when exchanging the authorization code:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code, {
+    code_verifier: pkce.codeVerifier,
+});
+```
+
+State and PKCE values must be stored and managed by your application. o2js does not handle their storage, verification, or lifecycle.
+
+## Response
+
+Token exchange methods return an `ExchangeResponse`:
+
+```typescript
+type ExchangeResponse = {
+    raw: string;
+    data: Record<string, unknown>;
+};
+```
+
+- `raw`: Raw response body.
+- `data`: Parsed JSON response.
+
+## Error Handling
+
+HTTP and response parsing errors are represented by `HTTPError`.
+
+```typescript
+import { HTTPError } from "@o2js/core";
+
+try {
+    const response = await oauth.exchangeAuthCode(code);
+} catch (error) {
+    if (error instanceof HTTPError) {
+        console.log("Message:", error.message);
+        console.log("Status:", error.status);
+        console.log("Body:", error.body);
+    }
+}
+```
+
+`body` contains the raw response body when available.
+
+## Providers
+
+o2js does not include provider implementations.
+
+You can implement the `Provider` interface yourself or use separate provider packages when available.
+
+A provider only needs to implement:
+
+```typescript
+export interface Provider {
+    authURL(): string;
+    tokenURL(): string;
+}
+```
+
+## License
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,8 @@
+export type ClientAuthMethod = "client_secret_basic" | "client_secret_post";
+export type Config = {
+    clientID: string;
+    clientSecret: string;
+    redirectURL: string;
+    clientAuthMethod?: ClientAuthMethod;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GACtB,qBAAqB,GACrB,oBAAoB,CAAC;AAE3B,MAAM,MAAM,MAAM,GAAG;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACvC,CAAC"}

package/dist/config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":""}

package/dist/crypto.d.ts

@@ -0,0 +1,7 @@
+export type PKCE = {
+    codeVerifier: string;
+    codeChallenge: string;
+};
+export declare function generateRandomState(): string;
+export declare function generateRandomPKCE(): PKCE;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GAAG;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAWzC"}

package/dist/crypto.js

@@ -0,0 +1,15 @@
+import { randomBytes, createHash } from "node:crypto";
+export function generateRandomState() {
+    return randomBytes(32).toString("hex");
+}
+export function generateRandomPKCE() {
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    return {
+        codeVerifier,
+        codeChallenge,
+    };
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOtD,MAAM,UAAU,mBAAmB;IAC/B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAC9B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzB,OAAO;QACH,YAAY;QACZ,aAAa;KAChB,CAAC;AACN,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class HTTPError extends Error {
+    readonly status?: number | undefined;
+    readonly body?: string | undefined;
+    constructor(message: string, status?: number | undefined, body?: string | undefined, options?: ErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;aAGZ,MAAM,CAAC,EAAE,MAAM;aACf,IAAI,CAAC,EAAE,MAAM;IAHjC,YACI,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,IAAI,CAAC,EAAE,MAAM,YAAA,EAC7B,OAAO,CAAC,EAAE,YAAY,EAIzB;CACJ"}

package/dist/errors.js

@@ -0,0 +1,11 @@
+export class HTTPError extends Error {
+    status;
+    body;
+    constructor(message, status, body, options) {
+        super(message, options);
+        this.status = status;
+        this.body = body;
+        this.name = "HTTPError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGZ,MAAM;IACN,IAAI;IAHxB,YACI,OAAe,EACC,MAAe,EACf,IAAa,EAC7B,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;sBAJR,MAAM;oBACN,IAAI;QAIpB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC5B,CAAC;CACJ"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { OAuth2 } from "./oauth2.js";
+export { HTTPError } from "./errors.js";
+export type { Provider } from "./provider.js";
+export type { Config, ClientAuthMethod } from "./config.js";
+export type { ExchangeResponse } from "./response.js";
+export { generateRandomState, generateRandomPKCE, type PKCE } from "./crypto.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACH,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,IAAI,EACZ,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { OAuth2 } from "./oauth2.js";
+export { HTTPError } from "./errors.js";
+export { generateRandomState, generateRandomPKCE } from "./crypto.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACH,mBAAmB,EACnB,kBAAkB,EAErB,MAAM,aAAa,CAAC"}

package/dist/oauth2.d.ts

@@ -0,0 +1,14 @@
+import type { Provider } from "./provider.js";
+import type { Config } from "./config.js";
+import type { ExchangeResponse } from "./response.js";
+export declare class OAuth2 {
+    private provider;
+    private config;
+    constructor(provider: Provider, config: Config);
+    authCodeURL(state: string, urlParams?: Record<string, string>): string;
+    exchangeAuthCode(code: string, tokenParams?: Record<string, string>): Promise<ExchangeResponse>;
+    exchangeRefreshToken(refreshToken: string, tokenParams?: Record<string, string>): Promise<ExchangeResponse>;
+    private exchange;
+    private validate;
+}
+//# sourceMappingURL=oauth2.d.ts.map

package/dist/oauth2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AActD,qBAAa,MAAM;IAEX,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,MAAM;IAFlB,YACY,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EAGzB;IAED,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0BrE;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBhH;YAEa,QAAQ;IAqGtB,OAAO,CAAC,QAAQ;CAoCnB"}

package/dist/oauth2.js

@@ -0,0 +1,135 @@
+import { HTTPError } from "./errors.js";
+import { parseParams, baseReservedParams, } from "./params.js";
+function encodeFormValue(value) {
+    return new URLSearchParams([["value", value]])
+        .toString()
+        .slice("value=".length);
+}
+export class OAuth2 {
+    provider;
+    config;
+    constructor(provider, config) {
+        this.provider = provider;
+        this.config = config;
+        this.validate();
+    }
+    authCodeURL(state, urlParams) {
+        const params = new URLSearchParams();
+        params.set("client_id", this.config.clientID);
+        params.set("redirect_uri", this.config.redirectURL);
+        params.set("response_type", "code");
+        parseParams(baseReservedParams(), urlParams ?? {}, (key, value) => {
+            params.set(key, value);
+        });
+        if (state !== "") {
+            params.set("state", state);
+        }
+        const url = new URL(this.provider.authURL());
+        params.forEach((value, key) => {
+            url.searchParams.set(key, value);
+        });
+        return url.toString();
+    }
+    async exchangeAuthCode(code, tokenParams) {
+        if (!code.trim()) {
+            throw new Error("Code cannot be empty");
+        }
+        const params = new URLSearchParams();
+        params.set("code", code);
+        params.set("redirect_uri", this.config.redirectURL);
+        params.set("grant_type", "authorization_code");
+        return this.exchange(params, baseReservedParams(), tokenParams);
+    }
+    async exchangeRefreshToken(refreshToken, tokenParams) {
+        if (!refreshToken.trim()) {
+            throw new Error("Refresh token cannot be empty");
+        }
+        const params = new URLSearchParams();
+        params.set("refresh_token", refreshToken);
+        params.set("redirect_uri", this.config.redirectURL);
+        params.set("grant_type", "refresh_token");
+        return this.exchange(params, baseReservedParams(), tokenParams);
+    }
+    async exchange(params, reservedParams, tokenParams) {
+        parseParams(reservedParams, tokenParams ?? {}, (key, value) => {
+            params.set(key, value);
+        });
+        const authMethod = this.config.clientAuthMethod ?? "client_secret_basic";
+        const headers = {
+            "Content-Type": "application/x-www-form-urlencoded",
+        };
+        if (authMethod === "client_secret_basic") {
+            const credentials = Buffer.from(`${encodeFormValue(this.config.clientID)}:${encodeFormValue(this.config.clientSecret)}`, "utf8").toString("base64");
+            headers["Authorization"] = `Basic ${credentials}`;
+        }
+        else {
+            params.set("client_id", this.config.clientID);
+            params.set("client_secret", this.config.clientSecret);
+        }
+        let response;
+        try {
+            response = await fetch(this.provider.tokenURL(), {
+                method: "POST",
+                headers,
+                body: params.toString(),
+            });
+        }
+        catch (error) {
+            throw new HTTPError("Exchange: failed to post token request", undefined, undefined, { cause: error });
+        }
+        let raw;
+        try {
+            raw = await response.text();
+        }
+        catch (error) {
+            throw new HTTPError("Exchange: failed to read token response", response.status, undefined, { cause: error });
+        }
+        if (!response.ok) {
+            throw new HTTPError(`Exchange: token request failed with status ${response.status}`, response.status, raw);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            throw new HTTPError("Exchange: failed to parse token response", response.status, raw, { cause: error });
+        }
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            throw new HTTPError("Exchange: token response must be a JSON object", response.status, raw);
+        }
+        return {
+            raw,
+            data: parsed,
+        };
+    }
+    validate() {
+        if (!this.provider) {
+            throw new Error("Provider cannot be null or undefined");
+        }
+        if (!this.config) {
+            throw new Error("Config cannot be null or undefined");
+        }
+        if (!this.provider.authURL().trim()) {
+            throw new Error("Provider authorization URL cannot be empty");
+        }
+        if (!this.provider.tokenURL().trim()) {
+            throw new Error("Provider token URL cannot be empty");
+        }
+        if (!this.config.clientID.trim()) {
+            throw new Error("Client ID cannot be empty");
+        }
+        if (!this.config.clientSecret.trim()) {
+            throw new Error("Client secret cannot be empty");
+        }
+        if (!this.config.redirectURL.trim()) {
+            throw new Error("Redirect URL cannot be empty");
+        }
+        if (this.config.clientAuthMethod !== undefined &&
+            !["client_secret_basic", "client_secret_post"].includes(this.config.clientAuthMethod)) {
+            throw new Error("Unsupported client authentication method");
+        }
+    }
+}
+//# sourceMappingURL=oauth2.js.map

package/dist/oauth2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACH,WAAW,EACX,kBAAkB,GACrB,MAAM,aAAa,CAAC;AAErB,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SACzC,QAAQ,EAAE;SACV,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,MAAM;IAEH,QAAQ;IACR,MAAM;IAFlB,YACY,QAAkB,EAClB,MAAc;wBADd,QAAQ;sBACR,MAAM;QAEd,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,SAAkC;QACzD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAEpC,WAAW,CACP,kBAAkB,EAAE,EACpB,SAAS,IAAI,EAAE,EACf,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,WAAoC;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,WAAoC;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,QAAQ,CAChB,MAAM,EACN,kBAAkB,EAAE,EACpB,WAAW,CACd,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,QAAQ,CAClB,MAAuB,EACvB,cAA2B,EAC3B,WAAoC;QAGpC,WAAW,CACP,cAAc,EACd,WAAW,IAAI,EAAE,EACjB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,qBAAqB,CAAC;QAEzE,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC3B,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EACvF,MAAM,CACT,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAErB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;aAC1B,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,wCAAwC,EACxC,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,GAAW,CAAC;QAEhB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,yCAAyC,EACzC,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACf,8CAA8C,QAAQ,CAAC,MAAM,EAAE,EAC/D,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,0CAA0C,EAC1C,QAAQ,CAAC,MAAM,EACf,GAAG,EACH,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IACI,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvB,CAAC;YACC,MAAM,IAAI,SAAS,CACf,gDAAgD,EAChD,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,OAAO;YACH,GAAG;YACH,IAAI,EAAE,MAAiC;SAC1C,CAAC;IACN,CAAC;IAEO,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;QAED,IACI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EACvF,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;CACJ"}

package/dist/params.d.ts

@@ -0,0 +1,6 @@
+type ParseParamsCallback = (key: string, value: string) => void;
+export declare function baseReservedParams(): Set<string>;
+export declare function extendReservedParams(extraReservedParams?: string[]): Set<string>;
+export declare function parseParams(reservedParams: Set<string>, paramsData: Record<string, string>, callback: ParseParamsCallback): void;
+export {};
+//# sourceMappingURL=params.d.ts.map

package/dist/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA,KAAK,mBAAmB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;AAEhE,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,CAAC,CAWhD;AAED,wBAAgB,oBAAoB,CAAC,mBAAmB,GAAE,MAAM,EAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAQpF;AAED,wBAAgB,WAAW,CACvB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,QAAQ,EAAE,mBAAmB,GAC9B,IAAI,CAQN"}

package/dist/params.js

@@ -0,0 +1,28 @@
+export function baseReservedParams() {
+    return new Set([
+        "client_id",
+        "client_secret",
+        "redirect_uri",
+        "code",
+        "refresh_token",
+        "state",
+        "response_type",
+        "grant_type"
+    ]);
+}
+export function extendReservedParams(extraReservedParams = []) {
+    const params = baseReservedParams();
+    for (const param of extraReservedParams) {
+        params.add(param);
+    }
+    return params;
+}
+export function parseParams(reservedParams, paramsData, callback) {
+    for (const [key, value] of Object.entries(paramsData)) {
+        if (reservedParams.has(key)) {
+            continue;
+        }
+        callback(key, value);
+    }
+}
+//# sourceMappingURL=params.js.map

package/dist/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,kBAAkB;IAC9B,OAAO,IAAI,GAAG,CAAC;QACX,WAAW;QACX,eAAe;QACf,cAAc;QACd,MAAM;QACN,eAAe;QACf,OAAO;QACP,eAAe;QACf,YAAY;KACf,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,mBAAmB,GAAa,EAAE;IACnE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CACvB,cAA2B,EAC3B,UAAkC,EAClC,QAA6B;IAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,SAAS;QACb,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACL,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,5 @@
+export interface Provider {
+    authURL(): string;
+    tokenURL(): string;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACrB,OAAO,IAAI,MAAM,CAAC;IAClB,QAAQ,IAAI,MAAM,CAAC;CACtB"}

package/dist/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":""}

package/dist/response.d.ts

@@ -0,0 +1,5 @@
+export type ExchangeResponse = {
+    raw: string;
+    data: Record<string, unknown>;
+};
+//# sourceMappingURL=response.d.ts.map

package/dist/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../src/response.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC"}

package/dist/response.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=response.js.map

package/dist/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../src/response.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,39 @@
 {
   "name": "@o2js/core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "A minimal, provider-agnostic OAuth 2.0 client for Node.js.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "oauth",
+    "oauth2",
+    "oauth-2.0",
+    "authentication",
+    "authorization",
+    "node",
+    "typescript"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.6",
+    "typescript": "^7.0.2"
+  }
+}