@o2js/core 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gökhan Altun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,413 @@
-# Temporary Holding Version
+# o2js
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**A lightweight, provider-agnostic OAuth2 and OpenID Connect library for Node.js.**
+
+o2js provides the core OAuth2 Authorization Code and Refresh Token flows, along with OpenID Connect ID Token validation.
+
+It does not manage users, sessions, token storage, or database operations. It handles protocol mechanics and leaves application state and lifecycle management to your application.
+
+## Installation
+
+```bash
+npm install @o2js/core
+```
+
+## Quick Start
+
+First, define a provider:
+
+```typescript
+import type { Provider } from "@o2js/core";
+
+const provider: Provider = {
+    authURL: "https://example.com/oauth/authorize",
+    tokenURL: "https://example.com/oauth/token",
+};
+```
+
+Create an OAuth2 client:
+
+```typescript
+import { OAuth2 } from "@o2js/core";
+
+const oauth = new OAuth2(provider, {
+    clientID: "your-client-id",
+    clientSecret: "your-client-secret",
+    redirectURL: "https://yourapp.com/callback",
+});
+```
+
+Generate an authorization URL:
+
+```typescript
+const state = "your-random-state";
+const url = oauth.authCodeURL(state);
+```
+
+After the user authorizes your application, exchange the authorization code:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code);
+
+console.log(response.data);
+```
+
+Refresh an access token:
+
+```typescript
+const response = await oauth.exchangeRefreshToken(refreshToken);
+```
+
+## Configuration
+
+```typescript
+type ClientAuthMethod =
+    | "client_secret_basic"
+    | "client_secret_post";
+
+type Config = {
+    clientID: string;
+    clientSecret: string;
+    redirectURL: string;
+    clientAuthMethod?: ClientAuthMethod;
+};
+```
+
+- `clientID`: OAuth application client ID.
+- `clientSecret`: OAuth application client secret.
+- `redirectURL`: Registered callback URL.
+- `clientAuthMethod`: Client authentication method used at the token endpoint.
+
+Supported client authentication methods:
+
+- `client_secret_basic`: Sends client credentials using HTTP Basic Authentication. This is the default.
+- `client_secret_post`: Sends client credentials in the request body.
+
+Example using `client_secret_post`:
+
+```typescript
+const oauth = new OAuth2(provider, {
+    clientID: "your-client-id",
+    clientSecret: "your-client-secret",
+    redirectURL: "https://yourapp.com/callback",
+    clientAuthMethod: "client_secret_post",
+});
+```
+
+If `clientAuthMethod` is omitted, o2js uses `client_secret_basic`.
+
+## Custom Parameters
+
+OAuth providers may require additional parameters for scopes, PKCE, or other features.
+
+You can pass additional parameters directly to the relevant methods.
+
+Authorization URL parameters:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    scope: "profile email",
+    prompt: "consent",
+});
+```
+
+Token request parameters:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code, {
+    code_verifier: "your-code-verifier",
+});
+```
+
+Refresh token requests also accept additional parameters:
+
+```typescript
+const response = await oauth.exchangeRefreshToken(refreshToken, {
+    custom_parameter: "value",
+});
+```
+
+Check your provider's documentation for supported parameters and their expected values.
+
+## State, Nonce and PKCE
+
+o2js provides helpers for generating cryptographically secure random state, nonce, and PKCE values.
+
+### State
+
+Generate a random state value:
+
+```typescript
+import { generateRandomState } from "@o2js/core";
+
+const state = generateRandomState();
+```
+
+Pass it to the authorization URL:
+
+```typescript
+const url = oauth.authCodeURL(state);
+```
+
+Your application is responsible for storing the state and verifying the returned value during the callback.
+
+### Nonce
+
+Generate a random nonce:
+
+```typescript
+import { generateRandomNonce } from "@o2js/core";
+
+const nonce = generateRandomNonce();
+```
+
+Include it in the authorization request:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    nonce,
+});
+```
+
+After receiving the ID Token, pass the expected nonce to `parseClaims`:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    nonce,
+});
+```
+
+o2js verifies that the nonce in the ID Token matches the expected value.
+
+Your application is responsible for storing and managing the nonce throughout the authorization flow.
+
+### PKCE
+
+Generate PKCE parameters:
+
+```typescript
+import { generateRandomPKCE } from "@o2js/core";
+
+const pkce = generateRandomPKCE();
+```
+
+Use the generated values in the authorization URL:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    code_challenge: pkce.codeChallenge,
+    code_challenge_method: "S256",
+});
+```
+
+Send the code verifier when exchanging the authorization code:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code, {
+    code_verifier: pkce.codeVerifier,
+});
+```
+
+State, nonce, and PKCE values must be stored and managed by your application. Your application is also responsible for verifying the returned state and managing the lifecycle of these values.
+
+o2js does not store or manage these values.
+
+## OpenID Connect
+
+o2js supports OpenID Connect ID Token validation through the `parseClaims` method.
+
+To enable ID Token validation, provide the issuer and JWKS URLs in your provider configuration:
+
+```typescript
+import type { Provider } from "@o2js/core";
+
+const provider: Provider = {
+    authURL: "https://example.com/oauth/authorize",
+    tokenURL: "https://example.com/oauth/token",
+    issuerURL: "https://example.com",
+    jwksURL: "https://example.com/.well-known/jwks.json",
+};
+```
+
+The `issuerURL` and `jwksURL` properties are optional for OAuth2-only providers. They are required when using `parseClaims`.
+
+### ID Token Validation
+
+After exchanging the authorization code, retrieve the ID Token from the token response and validate it:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code);
+
+const idToken = response.data.id_token;
+
+if (typeof idToken !== "string") {
+    throw new Error("ID Token is missing");
+}
+
+const claims = await oauth.parseClaims(idToken);
+
+console.log(claims.sub);
+```
+
+`parseClaims` verifies the ID Token signature using the provider's JWKS and validates its issuer, audience, expiration, and required claims.
+
+### Validation Options
+
+The `parseClaims` method accepts an optional options object:
+
+```typescript
+type ParseClaimsOptions = {
+    nonce?: string;
+    maxAge?: number;
+    trustedAudiences?: string[];
+    algorithms?: (
+        | "RS256"
+        | "PS256"
+        | "ES256"
+        | "ES384"
+        | "ES512"
+    )[];
+};
+```
+
+**Nonce**
+
+If a nonce was included in the authorization request, pass the expected value when validating the ID Token:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    nonce: savedNonce,
+});
+```
+
+The nonce must match the value in the ID Token.
+
+**Maximum Authentication Age**
+
+If you request a maximum authentication age, include `max_age` in the authorization request:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    max_age: "300",
+});
+```
+
+Pass the same value to `parseClaims`:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    maxAge: 300,
+});
+```
+
+When `maxAge` is provided, `auth_time` is required and checked against the requested maximum age.
+
+**Trusted Audiences**
+
+By default, o2js accepts the configured client ID as a trusted audience.
+
+If your application expects additional audiences, specify them explicitly:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    trustedAudiences: [
+        "trusted-service",
+    ],
+});
+```
+
+Any audience not included in the client ID or the trusted audience list is rejected.
+
+**Signing Algorithms**
+
+The default signing algorithm is `RS256`.
+
+You can specify additional supported algorithms:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    algorithms: ["RS256", "PS256", "ES256"],
+});
+```
+
+Only use algorithms supported and expected by your identity provider.
+
+### ID Token Claims
+
+The `parseClaims` method returns an `IDTokenClaims` object:
+
+```typescript
+import type { IDTokenClaims } from "@o2js/core";
+```
+
+The type extends `JWTPayload` and includes the standard claims:
+
+- `iss`: Issuer identifier.
+- `sub`: Subject identifier.
+- `aud`: Intended audience.
+- `exp`: Expiration time.
+- `iat`: Issued-at time.
+
+Other claims provided by the identity provider are also available through the returned payload.
+
+## Response
+
+Token exchange methods return an `ExchangeResponse`:
+
+```typescript
+type ExchangeResponse = {
+    raw: string;
+    data: Record<string, unknown>;
+};
+```
+
+- `raw`: Raw response body.
+- `data`: Parsed JSON response.
+
+## Error Handling
+
+HTTP and token response parsing errors are represented by `HTTPError`.
+
+```typescript
+import { HTTPError } from "@o2js/core";
+
+try {
+    const response = await oauth.exchangeAuthCode(code);
+} catch (error) {
+    if (error instanceof HTTPError) {
+        console.log("Message:", error.message);
+        console.log("Status:", error.status);
+        console.log("Body:", error.body);
+    }
+}
+```
+
+`body` contains the raw response body when available.
+
+ID Token validation errors and JWT verification errors are also thrown by `parseClaims`. These may originate from the validation logic or the underlying `jose` library.
+
+## Providers
+
+o2js does not include provider implementations.
+
+You can define your own provider using the `Provider` interface:
+
+```typescript
+export interface Provider {
+    authURL: string;
+    tokenURL: string;
+    issuerURL?: string;
+    jwksURL?: string;
+}
+```
+
+- `authURL`: Authorization endpoint URL.
+- `tokenURL`: Token endpoint URL.
+- `issuerURL`: OpenID Connect issuer URL. Required for ID Token validation.
+- `jwksURL`: JSON Web Key Set endpoint URL. Required for ID Token validation.
+
+OAuth2-only providers do not need to define `issuerURL` or `jwksURL`.
+
+## License
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,8 @@
+export type ClientAuthMethod = "client_secret_basic" | "client_secret_post";
+export type Config = {
+    clientID: string;
+    clientSecret: string;
+    redirectURL: string;
+    clientAuthMethod?: ClientAuthMethod;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GACtB,qBAAqB,GACrB,oBAAoB,CAAC;AAE3B,MAAM,MAAM,MAAM,GAAG;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACvC,CAAC"}

package/dist/config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":""}

package/dist/crypto.d.ts

@@ -0,0 +1,8 @@
+export type PKCE = {
+    codeVerifier: string;
+    codeChallenge: string;
+};
+export declare function generateRandomState(): string;
+export declare function generateRandomNonce(): string;
+export declare function generateRandomPKCE(): PKCE;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GAAG;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAWzC"}

package/dist/crypto.js

@@ -0,0 +1,18 @@
+import { randomBytes, createHash } from "node:crypto";
+export function generateRandomState() {
+    return randomBytes(32).toString("hex");
+}
+export function generateRandomNonce() {
+    return generateRandomState();
+}
+export function generateRandomPKCE() {
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    return {
+        codeVerifier,
+        codeChallenge,
+    };
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOtD,MAAM,UAAU,mBAAmB;IAC/B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,OAAO,mBAAmB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAC9B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzB,OAAO;QACH,YAAY;QACZ,aAAa;KAChB,CAAC;AACN,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class HTTPError extends Error {
+    readonly status?: number | undefined;
+    readonly body?: string | undefined;
+    constructor(message: string, status?: number | undefined, body?: string | undefined, options?: ErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;aAGZ,MAAM,CAAC,EAAE,MAAM;aACf,IAAI,CAAC,EAAE,MAAM;IAHjC,YACI,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,IAAI,CAAC,EAAE,MAAM,YAAA,EAC7B,OAAO,CAAC,EAAE,YAAY,EAIzB;CACJ"}

package/dist/errors.js

@@ -0,0 +1,11 @@
+export class HTTPError extends Error {
+    status;
+    body;
+    constructor(message, status, body, options) {
+        super(message, options);
+        this.status = status;
+        this.body = body;
+        this.name = "HTTPError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGZ,MAAM;IACN,IAAI;IAHxB,YACI,OAAe,EACC,MAAe,EACf,IAAa,EAC7B,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;sBAJR,MAAM;oBACN,IAAI;QAIpB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC5B,CAAC;CACJ"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { OAuth2, type IDTokenClaims } from "./oauth2.js";
+export { HTTPError } from "./errors.js";
+export type { Provider } from "./provider.js";
+export type { Config, ClientAuthMethod } from "./config.js";
+export type { ExchangeResponse } from "./response.js";
+export { generateRandomState, generateRandomNonce, generateRandomPKCE, type PKCE } from "./crypto.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,IAAI,EACZ,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { OAuth2 } from "./oauth2.js";
+export { HTTPError } from "./errors.js";
+export { generateRandomState, generateRandomNonce, generateRandomPKCE } from "./crypto.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAsB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAErB,MAAM,aAAa,CAAC"}

package/dist/oauth2.d.ts

@@ -0,0 +1,29 @@
+import type { Provider } from "./provider.js";
+import type { Config } from "./config.js";
+import type { ExchangeResponse } from "./response.js";
+import { type JWTPayload } from "jose";
+export type IDTokenClaims = JWTPayload & {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+};
+export declare class OAuth2 {
+    private provider;
+    private config;
+    private jwks?;
+    constructor(provider: Provider, config: Config);
+    authCodeURL(state: string, urlParams?: Record<string, string>): string;
+    exchangeAuthCode(code: string, tokenParams?: Record<string, string>): Promise<ExchangeResponse>;
+    exchangeRefreshToken(refreshToken: string, tokenParams?: Record<string, string>): Promise<ExchangeResponse>;
+    private exchange;
+    parseClaims(idToken: string, options?: {
+        nonce?: string;
+        maxAge?: number;
+        trustedAudiences?: string[];
+        algorithms?: ("RS256" | "PS256" | "ES256" | "ES384" | "ES512")[];
+    }): Promise<IDTokenClaims>;
+    private validate;
+}
+//# sourceMappingURL=oauth2.d.ts.map

package/dist/oauth2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQtD,OAAO,EAGH,KAAK,UAAU,EAClB,MAAM,MAAM,CAAC;AAEd,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAQF,qBAAa,MAAM;IAIX,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,MAAM;IAJlB,OAAO,CAAC,IAAI,CAAC,CAAwC;IAErD,YACY,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EAGzB;IAED,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0BrE;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAehH;YAEa,QAAQ;IAqGhB,WAAW,CACb,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACN,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,UAAU,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;KACpE,GACF,OAAO,CAAC,aAAa,CAAC,CAmKxB;IAED,OAAO,CAAC,QAAQ;CAoCnB"}

package/dist/oauth2.js

@@ -0,0 +1,240 @@
+import { HTTPError } from "./errors.js";
+import { parseParams, baseReservedParams, } from "./params.js";
+import { createRemoteJWKSet, jwtVerify, } from "jose";
+function encodeFormValue(value) {
+    return new URLSearchParams([["value", value]])
+        .toString()
+        .slice("value=".length);
+}
+export class OAuth2 {
+    provider;
+    config;
+    jwks;
+    constructor(provider, config) {
+        this.provider = provider;
+        this.config = config;
+        this.validate();
+    }
+    authCodeURL(state, urlParams) {
+        const params = new URLSearchParams();
+        params.set("client_id", this.config.clientID);
+        params.set("redirect_uri", this.config.redirectURL);
+        params.set("response_type", "code");
+        parseParams(baseReservedParams(), urlParams ?? {}, (key, value) => {
+            params.set(key, value);
+        });
+        if (state !== "") {
+            params.set("state", state);
+        }
+        const url = new URL(this.provider.authURL);
+        params.forEach((value, key) => {
+            url.searchParams.set(key, value);
+        });
+        return url.toString();
+    }
+    async exchangeAuthCode(code, tokenParams) {
+        if (!code.trim()) {
+            throw new Error("Code cannot be empty");
+        }
+        const params = new URLSearchParams();
+        params.set("code", code);
+        params.set("redirect_uri", this.config.redirectURL);
+        params.set("grant_type", "authorization_code");
+        return this.exchange(params, baseReservedParams(), tokenParams);
+    }
+    async exchangeRefreshToken(refreshToken, tokenParams) {
+        if (!refreshToken.trim()) {
+            throw new Error("Refresh token cannot be empty");
+        }
+        const params = new URLSearchParams();
+        params.set("refresh_token", refreshToken);
+        params.set("grant_type", "refresh_token");
+        return this.exchange(params, baseReservedParams(), tokenParams);
+    }
+    async exchange(params, reservedParams, tokenParams) {
+        parseParams(reservedParams, tokenParams ?? {}, (key, value) => {
+            params.set(key, value);
+        });
+        const authMethod = this.config.clientAuthMethod ?? "client_secret_basic";
+        const headers = {
+            "Content-Type": "application/x-www-form-urlencoded",
+        };
+        if (authMethod === "client_secret_basic") {
+            const credentials = Buffer.from(`${encodeFormValue(this.config.clientID)}:${encodeFormValue(this.config.clientSecret)}`, "utf8").toString("base64");
+            headers["Authorization"] = `Basic ${credentials}`;
+        }
+        else {
+            params.set("client_id", this.config.clientID);
+            params.set("client_secret", this.config.clientSecret);
+        }
+        let response;
+        try {
+            response = await fetch(this.provider.tokenURL, {
+                method: "POST",
+                headers,
+                body: params.toString(),
+            });
+        }
+        catch (error) {
+            throw new HTTPError("Exchange: failed to post token request", undefined, undefined, { cause: error });
+        }
+        let raw;
+        try {
+            raw = await response.text();
+        }
+        catch (error) {
+            throw new HTTPError("Exchange: failed to read token response", response.status, undefined, { cause: error });
+        }
+        if (!response.ok) {
+            throw new HTTPError(`Exchange: token request failed with status ${response.status}`, response.status, raw);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            throw new HTTPError("Exchange: failed to parse token response", response.status, raw, { cause: error });
+        }
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            throw new HTTPError("Exchange: token response must be a JSON object", response.status, raw);
+        }
+        return {
+            raw,
+            data: parsed,
+        };
+    }
+    async parseClaims(idToken, options) {
+        if (!idToken.trim()) {
+            throw new Error("ID Token cannot be empty");
+        }
+        const issuer = this.provider.issuerURL;
+        const jwksURL = this.provider.jwksURL;
+        if (!issuer?.trim()) {
+            throw new Error("Provider issuer URL is required");
+        }
+        if (!jwksURL?.trim()) {
+            throw new Error("Provider JWKS URL is required");
+        }
+        if (options?.nonce !== undefined &&
+            !options.nonce.trim()) {
+            throw new Error("Nonce cannot be empty");
+        }
+        if (options?.maxAge !== undefined &&
+            (!Number.isFinite(options.maxAge) || options.maxAge < 0)) {
+            throw new Error("maxAge must be a non-negative number");
+        }
+        if (options?.trustedAudiences?.some((audience) => !audience.trim())) {
+            throw new Error("Trusted audiences cannot contain empty values");
+        }
+        const algorithms = options?.algorithms ?? ["RS256"];
+        if (algorithms.length === 0) {
+            throw new Error("At least one signing algorithm is required");
+        }
+        if (!this.jwks) {
+            this.jwks = createRemoteJWKSet(new URL(jwksURL));
+        }
+        const { payload } = await jwtVerify(idToken, this.jwks, {
+            issuer,
+            audience: this.config.clientID,
+            algorithms,
+            clockTolerance: 5,
+        });
+        // Subject
+        if (typeof payload.sub !== "string" ||
+            !payload.sub) {
+            throw new Error("Invalid ID Token: missing subject");
+        }
+        // Audience
+        const audiences = typeof payload.aud === "string"
+            ? [payload.aud]
+            : payload.aud;
+        if (!Array.isArray(audiences) ||
+            audiences.length === 0 ||
+            audiences.some((audience) => typeof audience !== "string" ||
+                !audience)) {
+            throw new Error("Invalid ID Token: invalid audience");
+        }
+        const trustedAudiences = new Set([
+            this.config.clientID,
+            ...(options?.trustedAudiences ?? []),
+        ]);
+        if (audiences.some((audience) => !trustedAudiences.has(audience))) {
+            throw new Error("Invalid ID Token: untrusted audience");
+        }
+        // Expiration
+        if (typeof payload.exp !== "number" ||
+            !Number.isFinite(payload.exp)) {
+            throw new Error("Invalid ID Token: invalid expiration");
+        }
+        // Issued at
+        if (typeof payload.iat !== "number" ||
+            !Number.isFinite(payload.iat) ||
+            payload.iat < 0) {
+            throw new Error("Invalid ID Token: invalid issued-at claim");
+        }
+        // Nonce
+        if (options?.nonce !== undefined) {
+            if (typeof payload.nonce !== "string" ||
+                payload.nonce !== options.nonce) {
+                throw new Error("Invalid ID Token: nonce mismatch");
+            }
+        }
+        // Authorized party
+        if (audiences.length > 1 && typeof payload.azp !== "string") {
+            throw new Error("Invalid ID Token: missing authorized party");
+        }
+        if (payload.azp !== undefined &&
+            (typeof payload.azp !== "string" ||
+                payload.azp !== this.config.clientID)) {
+            throw new Error("Invalid ID Token: authorized party mismatch");
+        }
+        // Authentication time
+        if (options?.maxAge !== undefined) {
+            if (typeof payload.auth_time !== "number") {
+                throw new Error("Invalid ID Token: missing authentication time");
+            }
+            const now = Math.floor(Date.now() / 1000);
+            const authTime = payload.auth_time;
+            if (!Number.isFinite(authTime) || authTime < 0) {
+                throw new Error("Invalid ID Token: invalid authentication time");
+            }
+            if (authTime > now + 5) {
+                throw new Error("Invalid ID Token: authentication time is in the future");
+            }
+            if (now - authTime > options.maxAge + 5) {
+                throw new Error("Invalid ID Token: authentication is too old");
+            }
+        }
+        return payload;
+    }
+    validate() {
+        if (!this.provider) {
+            throw new Error("Provider cannot be null or undefined");
+        }
+        if (!this.config) {
+            throw new Error("Config cannot be null or undefined");
+        }
+        if (!this.provider.authURL.trim()) {
+            throw new Error("Provider authorization URL cannot be empty");
+        }
+        if (!this.provider.tokenURL.trim()) {
+            throw new Error("Provider token URL cannot be empty");
+        }
+        if (!this.config.clientID.trim()) {
+            throw new Error("Client ID cannot be empty");
+        }
+        if (!this.config.clientSecret.trim()) {
+            throw new Error("Client secret cannot be empty");
+        }
+        if (!this.config.redirectURL.trim()) {
+            throw new Error("Redirect URL cannot be empty");
+        }
+        if (this.config.clientAuthMethod !== undefined &&
+            !["client_secret_basic", "client_secret_post"].includes(this.config.clientAuthMethod)) {
+            throw new Error("Unsupported client authentication method");
+        }
+    }
+}
+//# sourceMappingURL=oauth2.js.map

package/dist/oauth2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACH,WAAW,EACX,kBAAkB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACH,kBAAkB,EAClB,SAAS,GAEZ,MAAM,MAAM,CAAC;AAUd,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SACzC,QAAQ,EAAE;SACV,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,MAAM;IAIH,QAAQ;IACR,MAAM;IAJV,IAAI,CAAyC;IAErD,YACY,QAAkB,EAClB,MAAc;wBADd,QAAQ;sBACR,MAAM;QAEd,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,SAAkC;QACzD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAEpC,WAAW,CACP,kBAAkB,EAAE,EACpB,SAAS,IAAI,EAAE,EACf,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,WAAoC;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,WAAoC;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,QAAQ,CAChB,MAAM,EACN,kBAAkB,EAAE,EACpB,WAAW,CACd,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,QAAQ,CAClB,MAAuB,EACvB,cAA2B,EAC3B,WAAoC;QAGpC,WAAW,CACP,cAAc,EACd,WAAW,IAAI,EAAE,EACjB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,qBAAqB,CAAC;QAEzE,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC3B,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EACvF,MAAM,CACT,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAErB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;aAC1B,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,wCAAwC,EACxC,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,GAAW,CAAC;QAEhB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,yCAAyC,EACzC,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACf,8CAA8C,QAAQ,CAAC,MAAM,EAAE,EAC/D,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,0CAA0C,EAC1C,QAAQ,CAAC,MAAM,EACf,GAAG,EACH,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IACI,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvB,CAAC;YACC,MAAM,IAAI,SAAS,CACf,gDAAgD,EAChD,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,OAAO;YACH,GAAG;YACH,IAAI,EAAE,MAAiC;SAC1C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CACb,OAAe,EACf,OAKC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAEtC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,IACI,OAAO,EAAE,KAAK,KAAK,SAAS;YAC5B,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EACvB,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAED,IACI,OAAO,EAAE,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAC1D,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,IACI,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAC3B,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CACjC,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC/B,OAAO,EACP,IAAI,CAAC,IAAI,EACT;YACI,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,UAAU;YACV,cAAc,EAAE,CAAC;SACpB,CACJ,CAAC;QAEF,UAAU;QACV,IACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,OAAO,CAAC,GAAG,EACd,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,WAAW;QACX,MAAM,SAAS,GACX,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAEtB,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,SAAS,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CACT,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,CAAC,QAAQ,CAChB,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ;YACpB,GAAG,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;SACvC,CAAC,CAAC;QAEH,IACI,SAAS,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAChD,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,aAAa;QACb,IACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAC/B,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,YAAY;QACZ,IACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,EACjB,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACjE,CAAC;QAED,QAAQ;QACR,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IACI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBACjC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EACjC,CAAC;gBACC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IACI,OAAO,CAAC,GAAG,KAAK,SAAS;YACzB,CACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CACvC,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,QAAQ,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9E,CAAC;YAED,IAAI,GAAG,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACnE,CAAC;QACL,CAAC;QAED,OAAO,OAAwB,CAAC;IACpC,CAAC;IAEO,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;QAED,IACI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EACvF,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;CACJ"}

package/dist/params.d.ts

@@ -0,0 +1,6 @@
+type ParseParamsCallback = (key: string, value: string) => void;
+export declare function baseReservedParams(): Set<string>;
+export declare function extendReservedParams(extraReservedParams?: string[]): Set<string>;
+export declare function parseParams(reservedParams: Set<string>, paramsData: Record<string, string>, callback: ParseParamsCallback): void;
+export {};
+//# sourceMappingURL=params.d.ts.map

package/dist/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA,KAAK,mBAAmB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;AAEhE,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,CAAC,CAWhD;AAED,wBAAgB,oBAAoB,CAAC,mBAAmB,GAAE,MAAM,EAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAQpF;AAED,wBAAgB,WAAW,CACvB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,QAAQ,EAAE,mBAAmB,GAC9B,IAAI,CAQN"}

package/dist/params.js

@@ -0,0 +1,28 @@
+export function baseReservedParams() {
+    return new Set([
+        "client_id",
+        "client_secret",
+        "redirect_uri",
+        "code",
+        "refresh_token",
+        "state",
+        "response_type",
+        "grant_type"
+    ]);
+}
+export function extendReservedParams(extraReservedParams = []) {
+    const params = baseReservedParams();
+    for (const param of extraReservedParams) {
+        params.add(param);
+    }
+    return params;
+}
+export function parseParams(reservedParams, paramsData, callback) {
+    for (const [key, value] of Object.entries(paramsData)) {
+        if (reservedParams.has(key)) {
+            continue;
+        }
+        callback(key, value);
+    }
+}
+//# sourceMappingURL=params.js.map

package/dist/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,kBAAkB;IAC9B,OAAO,IAAI,GAAG,CAAC;QACX,WAAW;QACX,eAAe;QACf,cAAc;QACd,MAAM;QACN,eAAe;QACf,OAAO;QACP,eAAe;QACf,YAAY;KACf,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,mBAAmB,GAAa,EAAE;IACnE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CACvB,cAA2B,EAC3B,UAAkC,EAClC,QAA6B;IAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,SAAS;QACb,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACL,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,7 @@
+export interface Provider {
+    authURL: string;
+    tokenURL: string;
+    issuerURL?: string;
+    jwksURL?: string;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":""}

package/dist/response.d.ts

@@ -0,0 +1,5 @@
+export type ExchangeResponse = {
+    raw: string;
+    data: Record<string, unknown>;
+};
+//# sourceMappingURL=response.d.ts.map

package/dist/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../src/response.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC"}

package/dist/response.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=response.js.map

package/dist/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../src/response.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "@o2js/core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "A minimal, provider-agnostic OAuth 2.0 client for Node.js.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "oauth",
+    "oauth2",
+    "oauth-2.0",
+    "openid",
+    "openid-connect",
+    "oidc",
+    "pkce",
+    "authorization-code",
+    "refresh-token",
+    "authentication",
+    "authorization",
+    "node",
+    "nodejs",
+    "typescript"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.6",
+    "typescript": "^7.0.2"
+  },
+  "dependencies": {
+    "jose": "^6.2.15"
+  }
 }