commit 57637840a55abe6ea591d313558a0a8d3127136a
Author: Andy Dixon <andy@andydixon.com>
Date:   Tue Feb 10 09:17:22 2026 +0000

    Initial Commit

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..afbbad7
--- /dev/null
+++ b/README.md
@@ -0,0 +1,125 @@
+# BlackWall Auth SDK (PHP)
+
+A distributable PHP SDK for integrating applications with BlackWall OAuth 2.1 and OpenID Connect.
+
+This package provides:
+- OAuth authorisation URL generation with PKCE (`S256`)
+- Code-for-token exchange
+- Refresh token exchange
+- UserInfo retrieval
+- Session helpers for `state` and `code_verifier`
+- Typed API (`AuthClient`, `TokenSet`) and specific exception classes
+
+## Requirements
+
+- PHP 8.1+
+- cURL extension (`ext-curl`)
+
+## Installation
+
+### 1. Install as a Composer package
+
+If this repository is published and tagged:
+
+```bash
+composer require dixon/blackwall-auth-sdk
+```
+
+### 2. Install from local path (during development)
+
+In the consuming application's `composer.json`:
+
+```json
+{
+  "repositories": [
+    {
+      "type": "path",
+      "url": "../test.dixon.cx"
+    }
+  ],
+  "require": {
+    "dixon/blackwall-auth-sdk": "*"
+  }
+}
+```
+
+Then run:
+
+```bash
+composer update dixon/blackwall-auth-sdk
+```
+
+## Quick start
+
+```php
+<?php
+
+declare(strict_types=1);
+
+session_start();
+
+require __DIR__ . '/vendor/autoload.php';
+
+use BlackWall\Auth\AuthClient;
+use BlackWall\Auth\Config;
+
+$config = Config::fromArray([
+    'clientId' => 'your-client-id',
+    'authorizeUrl' => 'https://blackwall.dixon.cx/oauth/authorize',
+    'tokenUrl' => 'https://blackwall.dixon.cx/oauth/token',
+    'userInfoUrl' => 'https://blackwall.dixon.cx/oauth/userinfo',
+    'redirectUri' => 'https://your-app.example/callback.php',
+    'scope' => 'openid profile email offline_access',
+]);
+
+$client = new AuthClient($config);
+
+// Step 1: redirect user to provider
+$auth = $client->buildAuthorisationUrl();
+header('Location: ' . $auth['url']);
+exit;
+```
+
+For callback handling, see `docs/INTEGRATION_GUIDE.md`.
+
+## Backwards compatibility
+
+A wrapper class is retained for older integrations:
+
+```php
+use BlackWallSDK\BlackWallAuth;
+```
+
+This wrapper now delegates to `BlackWall\Auth\AuthClient`.
+
+## Public API
+
+- `BlackWall\Auth\Config`
+- `BlackWall\Auth\AuthClient`
+- `BlackWall\Auth\TokenSet`
+- `BlackWall\Auth\AuthResult`
+- `BlackWall\Auth\Http\HttpClientInterface`
+- `BlackWall\Auth\Http\CurlHttpClient`
+- `BlackWall\Auth\Exception\*`
+
+## Security notes
+
+- Always validate OAuth `state` in callback handlers.
+- Always use HTTPS in production.
+- Store refresh tokens securely.
+- Keep access tokens out of logs and browser-visible output.
+- Use short session lifetimes where possible.
+
+## Repository layout
+
+- `src/Auth/` - main SDK classes
+- `src/Auth/Http/` - HTTP transport abstraction
+- `src/Auth/Exception/` - typed exceptions
+- `src/BlackWallAuth.php` - legacy compatibility wrapper
+- `src/legacy_autoload.php` - fallback non-Composer loader
+- `public_html/` - demonstration application
+- `docs/` - integration documentation
+
+## Licence
+
+Proprietary (internal distribution by default).
diff --git a/composer.json b/composer.json
new file mode 100644
index 0000000..1be7060
--- /dev/null
+++ b/composer.json
@@ -0,0 +1,27 @@
+{
+  "name": "dixon/blackwall-auth-sdk",
+  "description": "PHP SDK for integrating with BlackWall OAuth 2.1 and OpenID Connect",
+  "type": "library",
+  "license": "proprietary",
+  "require": {
+    "php": ">=8.1",
+    "ext-curl": "*"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^10.5"
+  },
+  "autoload": {
+    "psr-4": {
+      "BlackWall\\Auth\\": "src/Auth/",
+      "BlackWallSDK\\": "src/"
+    }
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "BlackWall\\Auth\\Tests\\": "tests/"
+    }
+  },
+  "scripts": {
+    "test": "phpunit --colors=always"
+  }
+}
diff --git a/composer.lock b/composer.lock
new file mode 100644
index 0000000..0e11d8b
--- /dev/null
+++ b/composer.lock
@@ -0,0 +1,1691 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "8996a6b83d3218dbba108998572f6d36",
+    "packages": [],
+    "packages-dev": [
+        {
+            "name": "myclabs/deep-copy",
+            "version": "1.13.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/myclabs/DeepCopy.git",
+                "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a",
+                "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.1 || ^8.0"
+            },
+            "conflict": {
+                "doctrine/collections": "<1.6.8",
+                "doctrine/common": "<2.13.3 || >=3 <3.2.2"
+            },
+            "require-dev": {
+                "doctrine/collections": "^1.6.8",
+                "doctrine/common": "^2.13.3 || ^3.2.2",
+                "phpspec/prophecy": "^1.10",
+                "phpunit/phpunit": "^7.5.20 || ^8.5.23 || ^9.5.13"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "src/DeepCopy/deep_copy.php"
+                ],
+                "psr-4": {
+                    "DeepCopy\\": "src/DeepCopy/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "Create deep copies (clones) of your objects",
+            "keywords": [
+                "clone",
+                "copy",
+                "duplicate",
+                "object",
+                "object graph"
+            ],
+            "support": {
+                "issues": "https://github.com/myclabs/DeepCopy/issues",
+                "source": "https://github.com/myclabs/DeepCopy/tree/1.13.4"
+            },
+            "funding": [
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/myclabs/deep-copy",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-08-01T08:46:24+00:00"
+        },
+        {
+            "name": "nikic/php-parser",
+            "version": "v5.7.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/nikic/PHP-Parser.git",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-json": "*",
+                "ext-tokenizer": "*",
+                "php": ">=7.4"
+            },
+            "require-dev": {
+                "ircmaxell/php-yacc": "^0.0.7",
+                "phpunit/phpunit": "^9.0"
+            },
+            "bin": [
+                "bin/php-parse"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PhpParser\\": "lib/PhpParser"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Nikita Popov"
+                }
+            ],
+            "description": "A PHP parser written in PHP",
+            "keywords": [
+                "parser",
+                "php"
+            ],
+            "support": {
+                "issues": "https://github.com/nikic/PHP-Parser/issues",
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.7.0"
+            },
+            "time": "2025-12-06T11:56:16+00:00"
+        },
+        {
+            "name": "phar-io/manifest",
+            "version": "2.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/phar-io/manifest.git",
+                "reference": "54750ef60c58e43759730615a392c31c80e23176"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/phar-io/manifest/zipball/54750ef60c58e43759730615a392c31c80e23176",
+                "reference": "54750ef60c58e43759730615a392c31c80e23176",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-libxml": "*",
+                "ext-phar": "*",
+                "ext-xmlwriter": "*",
+                "phar-io/version": "^3.0.1",
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0.x-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Arne Blankerts",
+                    "email": "arne@blankerts.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Heuer",
+                    "email": "sebastian@phpeople.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Component for reading phar.io manifest information from a PHP Archive (PHAR)",
+            "support": {
+                "issues": "https://github.com/phar-io/manifest/issues",
+                "source": "https://github.com/phar-io/manifest/tree/2.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/theseer",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-03T12:33:53+00:00"
+        },
+        {
+            "name": "phar-io/version",
+            "version": "3.2.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/phar-io/version.git",
+                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
+                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Arne Blankerts",
+                    "email": "arne@blankerts.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Heuer",
+                    "email": "sebastian@phpeople.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Library for handling version information and constraints",
+            "support": {
+                "issues": "https://github.com/phar-io/version/issues",
+                "source": "https://github.com/phar-io/version/tree/3.2.1"
+            },
+            "time": "2022-02-21T01:04:05+00:00"
+        },
+        {
+            "name": "phpunit/php-code-coverage",
+            "version": "10.1.16",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-code-coverage.git",
+                "reference": "7e308268858ed6baedc8704a304727d20bc07c77"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/7e308268858ed6baedc8704a304727d20bc07c77",
+                "reference": "7e308268858ed6baedc8704a304727d20bc07c77",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-libxml": "*",
+                "ext-xmlwriter": "*",
+                "nikic/php-parser": "^4.19.1 || ^5.1.0",
+                "php": ">=8.1",
+                "phpunit/php-file-iterator": "^4.1.0",
+                "phpunit/php-text-template": "^3.0.1",
+                "sebastian/code-unit-reverse-lookup": "^3.0.0",
+                "sebastian/complexity": "^3.2.0",
+                "sebastian/environment": "^6.1.0",
+                "sebastian/lines-of-code": "^2.0.2",
+                "sebastian/version": "^4.0.1",
+                "theseer/tokenizer": "^1.2.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.1"
+            },
+            "suggest": {
+                "ext-pcov": "PHP extension that provides line coverage",
+                "ext-xdebug": "PHP extension that provides line coverage as well as branch and path coverage"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "10.1.x-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library that provides collection, processing, and rendering functionality for PHP code coverage information.",
+            "homepage": "https://github.com/sebastianbergmann/php-code-coverage",
+            "keywords": [
+                "coverage",
+                "testing",
+                "xunit"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-code-coverage/issues",
+                "security": "https://github.com/sebastianbergmann/php-code-coverage/security/policy",
+                "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/10.1.16"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-08-22T04:31:57+00:00"
+        },
+        {
+            "name": "phpunit/php-file-iterator",
+            "version": "4.1.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-file-iterator.git",
+                "reference": "a95037b6d9e608ba092da1b23931e537cadc3c3c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/a95037b6d9e608ba092da1b23931e537cadc3c3c",
+                "reference": "a95037b6d9e608ba092da1b23931e537cadc3c3c",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "FilterIterator implementation that filters files based on a list of suffixes.",
+            "homepage": "https://github.com/sebastianbergmann/php-file-iterator/",
+            "keywords": [
+                "filesystem",
+                "iterator"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-file-iterator/issues",
+                "security": "https://github.com/sebastianbergmann/php-file-iterator/security/policy",
+                "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/4.1.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-08-31T06:24:48+00:00"
+        },
+        {
+            "name": "phpunit/php-invoker",
+            "version": "4.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-invoker.git",
+                "reference": "f5e568ba02fa5ba0ddd0f618391d5a9ea50b06d7"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-invoker/zipball/f5e568ba02fa5ba0ddd0f618391d5a9ea50b06d7",
+                "reference": "f5e568ba02fa5ba0ddd0f618391d5a9ea50b06d7",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "ext-pcntl": "*",
+                "phpunit/phpunit": "^10.0"
+            },
+            "suggest": {
+                "ext-pcntl": "*"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Invoke callables with a timeout",
+            "homepage": "https://github.com/sebastianbergmann/php-invoker/",
+            "keywords": [
+                "process"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-invoker/issues",
+                "source": "https://github.com/sebastianbergmann/php-invoker/tree/4.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T06:56:09+00:00"
+        },
+        {
+            "name": "phpunit/php-text-template",
+            "version": "3.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-text-template.git",
+                "reference": "0c7b06ff49e3d5072f057eb1fa59258bf287a748"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/0c7b06ff49e3d5072f057eb1fa59258bf287a748",
+                "reference": "0c7b06ff49e3d5072f057eb1fa59258bf287a748",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Simple template engine.",
+            "homepage": "https://github.com/sebastianbergmann/php-text-template/",
+            "keywords": [
+                "template"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-text-template/issues",
+                "security": "https://github.com/sebastianbergmann/php-text-template/security/policy",
+                "source": "https://github.com/sebastianbergmann/php-text-template/tree/3.0.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-08-31T14:07:24+00:00"
+        },
+        {
+            "name": "phpunit/php-timer",
+            "version": "6.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-timer.git",
+                "reference": "e2a2d67966e740530f4a3343fe2e030ffdc1161d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-timer/zipball/e2a2d67966e740530f4a3343fe2e030ffdc1161d",
+                "reference": "e2a2d67966e740530f4a3343fe2e030ffdc1161d",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "6.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Utility class for timing",
+            "homepage": "https://github.com/sebastianbergmann/php-timer/",
+            "keywords": [
+                "timer"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-timer/issues",
+                "source": "https://github.com/sebastianbergmann/php-timer/tree/6.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T06:57:52+00:00"
+        },
+        {
+            "name": "phpunit/phpunit",
+            "version": "10.5.63",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/phpunit.git",
+                "reference": "33198268dad71e926626b618f3ec3966661e4d90"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/33198268dad71e926626b618f3ec3966661e4d90",
+                "reference": "33198268dad71e926626b618f3ec3966661e4d90",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-json": "*",
+                "ext-libxml": "*",
+                "ext-mbstring": "*",
+                "ext-xml": "*",
+                "ext-xmlwriter": "*",
+                "myclabs/deep-copy": "^1.13.4",
+                "phar-io/manifest": "^2.0.4",
+                "phar-io/version": "^3.2.1",
+                "php": ">=8.1",
+                "phpunit/php-code-coverage": "^10.1.16",
+                "phpunit/php-file-iterator": "^4.1.0",
+                "phpunit/php-invoker": "^4.0.0",
+                "phpunit/php-text-template": "^3.0.1",
+                "phpunit/php-timer": "^6.0.0",
+                "sebastian/cli-parser": "^2.0.1",
+                "sebastian/code-unit": "^2.0.0",
+                "sebastian/comparator": "^5.0.5",
+                "sebastian/diff": "^5.1.1",
+                "sebastian/environment": "^6.1.0",
+                "sebastian/exporter": "^5.1.4",
+                "sebastian/global-state": "^6.0.2",
+                "sebastian/object-enumerator": "^5.0.0",
+                "sebastian/recursion-context": "^5.0.1",
+                "sebastian/type": "^4.0.0",
+                "sebastian/version": "^4.0.1"
+            },
+            "suggest": {
+                "ext-soap": "To be able to generate mocks based on WSDL files"
+            },
+            "bin": [
+                "phpunit"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "10.5-dev"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "src/Framework/Assert/Functions.php"
+                ],
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "The PHP Unit Testing framework.",
+            "homepage": "https://phpunit.de/",
+            "keywords": [
+                "phpunit",
+                "testing",
+                "xunit"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
+                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.63"
+            },
+            "funding": [
+                {
+                    "url": "https://phpunit.de/sponsors.html",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/phpunit/phpunit",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-01-27T05:48:37+00:00"
+        },
+        {
+            "name": "sebastian/cli-parser",
+            "version": "2.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/cli-parser.git",
+                "reference": "c34583b87e7b7a8055bf6c450c2c77ce32a24084"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/cli-parser/zipball/c34583b87e7b7a8055bf6c450c2c77ce32a24084",
+                "reference": "c34583b87e7b7a8055bf6c450c2c77ce32a24084",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library for parsing CLI options",
+            "homepage": "https://github.com/sebastianbergmann/cli-parser",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/cli-parser/issues",
+                "security": "https://github.com/sebastianbergmann/cli-parser/security/policy",
+                "source": "https://github.com/sebastianbergmann/cli-parser/tree/2.0.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-02T07:12:49+00:00"
+        },
+        {
+            "name": "sebastian/code-unit",
+            "version": "2.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/code-unit.git",
+                "reference": "a81fee9eef0b7a76af11d121767abc44c104e503"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/code-unit/zipball/a81fee9eef0b7a76af11d121767abc44c104e503",
+                "reference": "a81fee9eef0b7a76af11d121767abc44c104e503",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Collection of value objects that represent the PHP code units",
+            "homepage": "https://github.com/sebastianbergmann/code-unit",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/code-unit/issues",
+                "source": "https://github.com/sebastianbergmann/code-unit/tree/2.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T06:58:43+00:00"
+        },
+        {
+            "name": "sebastian/code-unit-reverse-lookup",
+            "version": "3.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/code-unit-reverse-lookup.git",
+                "reference": "5e3a687f7d8ae33fb362c5c0743794bbb2420a1d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/5e3a687f7d8ae33fb362c5c0743794bbb2420a1d",
+                "reference": "5e3a687f7d8ae33fb362c5c0743794bbb2420a1d",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Looks up which function or method a line of code belongs to",
+            "homepage": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/issues",
+                "source": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/tree/3.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T06:59:15+00:00"
+        },
+        {
+            "name": "sebastian/comparator",
+            "version": "5.0.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/comparator.git",
+                "reference": "55dfef806eb7dfeb6e7a6935601fef866f8ca48d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/55dfef806eb7dfeb6e7a6935601fef866f8ca48d",
+                "reference": "55dfef806eb7dfeb6e7a6935601fef866f8ca48d",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-mbstring": "*",
+                "php": ">=8.1",
+                "sebastian/diff": "^5.0",
+                "sebastian/exporter": "^5.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.5"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "5.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Jeff Welch",
+                    "email": "whatthejeff@gmail.com"
+                },
+                {
+                    "name": "Volker Dusch",
+                    "email": "github@wallbash.com"
+                },
+                {
+                    "name": "Bernhard Schussek",
+                    "email": "bschussek@2bepublished.at"
+                }
+            ],
+            "description": "Provides the functionality to compare PHP values for equality",
+            "homepage": "https://github.com/sebastianbergmann/comparator",
+            "keywords": [
+                "comparator",
+                "compare",
+                "equality"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/comparator/issues",
+                "security": "https://github.com/sebastianbergmann/comparator/security/policy",
+                "source": "https://github.com/sebastianbergmann/comparator/tree/5.0.5"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/comparator",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-01-24T09:25:16+00:00"
+        },
+        {
+            "name": "sebastian/complexity",
+            "version": "3.2.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/complexity.git",
+                "reference": "68ff824baeae169ec9f2137158ee529584553799"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/complexity/zipball/68ff824baeae169ec9f2137158ee529584553799",
+                "reference": "68ff824baeae169ec9f2137158ee529584553799",
+                "shasum": ""
+            },
+            "require": {
+                "nikic/php-parser": "^4.18 || ^5.0",
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.2-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library for calculating the complexity of PHP code units",
+            "homepage": "https://github.com/sebastianbergmann/complexity",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/complexity/issues",
+                "security": "https://github.com/sebastianbergmann/complexity/security/policy",
+                "source": "https://github.com/sebastianbergmann/complexity/tree/3.2.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-12-21T08:37:17+00:00"
+        },
+        {
+            "name": "sebastian/diff",
+            "version": "5.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/diff.git",
+                "reference": "c41e007b4b62af48218231d6c2275e4c9b975b2e"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/c41e007b4b62af48218231d6c2275e4c9b975b2e",
+                "reference": "c41e007b4b62af48218231d6c2275e4c9b975b2e",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0",
+                "symfony/process": "^6.4"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "5.1-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Kore Nordmann",
+                    "email": "mail@kore-nordmann.de"
+                }
+            ],
+            "description": "Diff implementation",
+            "homepage": "https://github.com/sebastianbergmann/diff",
+            "keywords": [
+                "diff",
+                "udiff",
+                "unidiff",
+                "unified diff"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/diff/issues",
+                "security": "https://github.com/sebastianbergmann/diff/security/policy",
+                "source": "https://github.com/sebastianbergmann/diff/tree/5.1.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-02T07:15:17+00:00"
+        },
+        {
+            "name": "sebastian/environment",
+            "version": "6.1.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/environment.git",
+                "reference": "8074dbcd93529b357029f5cc5058fd3e43666984"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/environment/zipball/8074dbcd93529b357029f5cc5058fd3e43666984",
+                "reference": "8074dbcd93529b357029f5cc5058fd3e43666984",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "suggest": {
+                "ext-posix": "*"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "6.1-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Provides functionality to handle HHVM/PHP environments",
+            "homepage": "https://github.com/sebastianbergmann/environment",
+            "keywords": [
+                "Xdebug",
+                "environment",
+                "hhvm"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/environment/issues",
+                "security": "https://github.com/sebastianbergmann/environment/security/policy",
+                "source": "https://github.com/sebastianbergmann/environment/tree/6.1.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-23T08:47:14+00:00"
+        },
+        {
+            "name": "sebastian/exporter",
+            "version": "5.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/exporter.git",
+                "reference": "0735b90f4da94969541dac1da743446e276defa6"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/0735b90f4da94969541dac1da743446e276defa6",
+                "reference": "0735b90f4da94969541dac1da743446e276defa6",
+                "shasum": ""
+            },
+            "require": {
+                "ext-mbstring": "*",
+                "php": ">=8.1",
+                "sebastian/recursion-context": "^5.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.5"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "5.1-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Jeff Welch",
+                    "email": "whatthejeff@gmail.com"
+                },
+                {
+                    "name": "Volker Dusch",
+                    "email": "github@wallbash.com"
+                },
+                {
+                    "name": "Adam Harvey",
+                    "email": "aharvey@php.net"
+                },
+                {
+                    "name": "Bernhard Schussek",
+                    "email": "bschussek@gmail.com"
+                }
+            ],
+            "description": "Provides the functionality to export PHP variables for visualization",
+            "homepage": "https://www.github.com/sebastianbergmann/exporter",
+            "keywords": [
+                "export",
+                "exporter"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/exporter/issues",
+                "security": "https://github.com/sebastianbergmann/exporter/security/policy",
+                "source": "https://github.com/sebastianbergmann/exporter/tree/5.1.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/exporter",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-09-24T06:09:11+00:00"
+        },
+        {
+            "name": "sebastian/global-state",
+            "version": "6.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/global-state.git",
+                "reference": "987bafff24ecc4c9ac418cab1145b96dd6e9cbd9"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/global-state/zipball/987bafff24ecc4c9ac418cab1145b96dd6e9cbd9",
+                "reference": "987bafff24ecc4c9ac418cab1145b96dd6e9cbd9",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
+                "sebastian/object-reflector": "^3.0",
+                "sebastian/recursion-context": "^5.0"
+            },
+            "require-dev": {
+                "ext-dom": "*",
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "6.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Snapshotting of global state",
+            "homepage": "https://www.github.com/sebastianbergmann/global-state",
+            "keywords": [
+                "global state"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/global-state/issues",
+                "security": "https://github.com/sebastianbergmann/global-state/security/policy",
+                "source": "https://github.com/sebastianbergmann/global-state/tree/6.0.2"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-02T07:19:19+00:00"
+        },
+        {
+            "name": "sebastian/lines-of-code",
+            "version": "2.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/lines-of-code.git",
+                "reference": "856e7f6a75a84e339195d48c556f23be2ebf75d0"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/856e7f6a75a84e339195d48c556f23be2ebf75d0",
+                "reference": "856e7f6a75a84e339195d48c556f23be2ebf75d0",
+                "shasum": ""
+            },
+            "require": {
+                "nikic/php-parser": "^4.18 || ^5.0",
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library for counting the lines of code in PHP source code",
+            "homepage": "https://github.com/sebastianbergmann/lines-of-code",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/lines-of-code/issues",
+                "security": "https://github.com/sebastianbergmann/lines-of-code/security/policy",
+                "source": "https://github.com/sebastianbergmann/lines-of-code/tree/2.0.2"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-12-21T08:38:20+00:00"
+        },
+        {
+            "name": "sebastian/object-enumerator",
+            "version": "5.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/object-enumerator.git",
+                "reference": "202d0e344a580d7f7d04b3fafce6933e59dae906"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/202d0e344a580d7f7d04b3fafce6933e59dae906",
+                "reference": "202d0e344a580d7f7d04b3fafce6933e59dae906",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
+                "sebastian/object-reflector": "^3.0",
+                "sebastian/recursion-context": "^5.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "5.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Traverses array structures and object graphs to enumerate all referenced objects",
+            "homepage": "https://github.com/sebastianbergmann/object-enumerator/",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/object-enumerator/issues",
+                "source": "https://github.com/sebastianbergmann/object-enumerator/tree/5.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T07:08:32+00:00"
+        },
+        {
+            "name": "sebastian/object-reflector",
+            "version": "3.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/object-reflector.git",
+                "reference": "24ed13d98130f0e7122df55d06c5c4942a577957"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/object-reflector/zipball/24ed13d98130f0e7122df55d06c5c4942a577957",
+                "reference": "24ed13d98130f0e7122df55d06c5c4942a577957",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Allows reflection of object attributes, including inherited and non-public ones",
+            "homepage": "https://github.com/sebastianbergmann/object-reflector/",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/object-reflector/issues",
+                "source": "https://github.com/sebastianbergmann/object-reflector/tree/3.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T07:06:18+00:00"
+        },
+        {
+            "name": "sebastian/recursion-context",
+            "version": "5.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/recursion-context.git",
+                "reference": "47e34210757a2f37a97dcd207d032e1b01e64c7a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/47e34210757a2f37a97dcd207d032e1b01e64c7a",
+                "reference": "47e34210757a2f37a97dcd207d032e1b01e64c7a",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.5"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "5.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Jeff Welch",
+                    "email": "whatthejeff@gmail.com"
+                },
+                {
+                    "name": "Adam Harvey",
+                    "email": "aharvey@php.net"
+                }
+            ],
+            "description": "Provides functionality to recursively process PHP variables",
+            "homepage": "https://github.com/sebastianbergmann/recursion-context",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/recursion-context/issues",
+                "security": "https://github.com/sebastianbergmann/recursion-context/security/policy",
+                "source": "https://github.com/sebastianbergmann/recursion-context/tree/5.0.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/recursion-context",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-08-10T07:50:56+00:00"
+        },
+        {
+            "name": "sebastian/type",
+            "version": "4.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/type.git",
+                "reference": "462699a16464c3944eefc02ebdd77882bd3925bf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/type/zipball/462699a16464c3944eefc02ebdd77882bd3925bf",
+                "reference": "462699a16464c3944eefc02ebdd77882bd3925bf",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^10.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Collection of value objects that represent the types of the PHP type system",
+            "homepage": "https://github.com/sebastianbergmann/type",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/type/issues",
+                "source": "https://github.com/sebastianbergmann/type/tree/4.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T07:10:45+00:00"
+        },
+        {
+            "name": "sebastian/version",
+            "version": "4.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/version.git",
+                "reference": "c51fa83a5d8f43f1402e3f32a005e6262244ef17"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/version/zipball/c51fa83a5d8f43f1402e3f32a005e6262244ef17",
+                "reference": "c51fa83a5d8f43f1402e3f32a005e6262244ef17",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library that helps with managing the version number of Git-hosted PHP projects",
+            "homepage": "https://github.com/sebastianbergmann/version",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/version/issues",
+                "source": "https://github.com/sebastianbergmann/version/tree/4.0.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-07T11:34:05+00:00"
+        },
+        {
+            "name": "theseer/tokenizer",
+            "version": "1.3.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/theseer/tokenizer.git",
+                "reference": "b7489ce515e168639d17feec34b8847c326b0b3c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/theseer/tokenizer/zipball/b7489ce515e168639d17feec34b8847c326b0b3c",
+                "reference": "b7489ce515e168639d17feec34b8847c326b0b3c",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-tokenizer": "*",
+                "ext-xmlwriter": "*",
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Arne Blankerts",
+                    "email": "arne@blankerts.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "A small library for converting tokenized PHP source code into XML and potentially other formats",
+            "support": {
+                "issues": "https://github.com/theseer/tokenizer/issues",
+                "source": "https://github.com/theseer/tokenizer/tree/1.3.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/theseer",
+                    "type": "github"
+                }
+            ],
+            "time": "2025-11-17T20:03:58+00:00"
+        }
+    ],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": [],
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": {
+        "php": ">=8.1",
+        "ext-curl": "*"
+    },
+    "platform-dev": [],
+    "plugin-api-version": "2.6.0"
+}
diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md
new file mode 100644
index 0000000..690292c
--- /dev/null
+++ b/docs/INTEGRATION_GUIDE.md
@@ -0,0 +1,115 @@
+# Integration Guide (British English)
+
+This guide shows a complete OAuth/OIDC login flow using `BlackWall\Auth\AuthClient`.
+
+## 1. Start login
+
+```php
+<?php
+
+declare(strict_types=1);
+
+session_start();
+require __DIR__ . '/vendor/autoload.php';
+
+use BlackWall\Auth\AuthClient;
+use BlackWall\Auth\Config;
+
+$client = new AuthClient(Config::fromArray([
+    'clientId' => 'your-client-id',
+    'authorizeUrl' => 'https://blackwall.dixon.cx/oauth/authorize',
+    'tokenUrl' => 'https://blackwall.dixon.cx/oauth/token',
+    'userInfoUrl' => 'https://blackwall.dixon.cx/oauth/userinfo',
+    'redirectUri' => 'https://your-app.example/callback.php',
+    'scope' => 'openid profile email offline_access',
+]));
+
+if (!isset($_SESSION['user'])) {
+    $auth = $client->buildAuthorisationUrl();
+    header('Location: ' . $auth['url']);
+    exit;
+}
+
+echo 'Already signed in.';
+```
+
+## 2. Handle callback
+
+```php
+<?php
+
+declare(strict_types=1);
+
+session_start();
+require __DIR__ . '/vendor/autoload.php';
+
+use BlackWall\Auth\AuthClient;
+use BlackWall\Auth\Config;
+
+$client = new AuthClient(Config::fromArray([
+    'clientId' => 'your-client-id',
+    'authorizeUrl' => 'https://blackwall.dixon.cx/oauth/authorize',
+    'tokenUrl' => 'https://blackwall.dixon.cx/oauth/token',
+    'userInfoUrl' => 'https://blackwall.dixon.cx/oauth/userinfo',
+    'redirectUri' => 'https://your-app.example/callback.php',
+]));
+
+if (!isset($_GET['code'], $_GET['state'])) {
+    http_response_code(400);
+    echo 'Missing code/state';
+    exit;
+}
+
+$client->assertStateMatches((string) $_GET['state']);
+$tokens = $client->exchangeCodeForTokens((string) $_GET['code']);
+$user = $client->getUserInfo($tokens->accessToken);
+
+$_SESSION['user'] = $user;
+$_SESSION['access_token'] = $tokens->accessToken;
+$_SESSION['refresh_token'] = $tokens->refreshToken;
+
+$client->clearPkceSessionState();
+
+header('Location: /');
+exit;
+```
+
+## 3. Refresh token (optional)
+
+```php
+<?php
+
+$tokens = $client->refreshAccessToken($_SESSION['refresh_token']);
+$_SESSION['access_token'] = $tokens->accessToken;
+if ($tokens->refreshToken !== null) {
+    $_SESSION['refresh_token'] = $tokens->refreshToken;
+}
+```
+
+## Exceptions
+
+Catch specific exceptions for clearer handling:
+
+- `BlackWall\Auth\Exception\StateMismatchException`
+- `BlackWall\Auth\Exception\TokenExchangeException`
+- `BlackWall\Auth\Exception\UserInfoException`
+- `BlackWall\Auth\Exception\TransportException`
+
+Example:
+
+```php
+try {
+    $tokens = $client->exchangeCodeForTokens($code);
+} catch (\BlackWall\Auth\Exception\TokenExchangeException $e) {
+    error_log('Token exchange failed: ' . $e->getMessage());
+    http_response_code(502);
+}
+```
+
+## Operational guidance
+
+- Keep provider URLs in environment variables, not hard-coded.
+- Avoid printing tokens in production pages.
+- Rotate client secrets for confidential clients.
+- Validate `state` on every callback request.
+- Use secure session cookies (`Secure`, `HttpOnly`, `SameSite=Lax` or stricter).
diff --git a/docs/MIGRATION.md b/docs/MIGRATION.md
new file mode 100644
index 0000000..c74c154
--- /dev/null
+++ b/docs/MIGRATION.md
@@ -0,0 +1,35 @@
+# Migration Guide
+
+## Moving from `BlackWallSDK\BlackWallAuth` to `BlackWall\Auth\AuthClient`
+
+### Before
+
+```php
+$auth = new BlackWallSDK\BlackWallAuth($config);
+$authData = $auth->getAuthorizationUrl();
+$tokens = $auth->exchangeCodeForTokens($code);
+$user = $auth->getUserInfo($tokens['access_token']);
+```
+
+### After
+
+```php
+use BlackWall\Auth\AuthClient;
+use BlackWall\Auth\Config;
+
+$client = new AuthClient(Config::fromArray($config));
+$authData = $client->buildAuthorisationUrl();
+$tokens = $client->exchangeCodeForTokens($code);
+$user = $client->getUserInfo($tokens->accessToken);
+```
+
+## Key differences
+
+- Method spelling uses British English in the new API: `buildAuthorisationUrl()`.
+- Token responses are strongly typed via `TokenSet`.
+- Errors are represented by specific exception classes.
+- HTTP transport is swappable via `HttpClientInterface`.
+
+## Compatibility status
+
+`BlackWallSDK\BlackWallAuth` remains available and delegates to the new client. Existing applications can upgrade gradually.
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
new file mode 100644
index 0000000..37b2d6b
--- /dev/null
+++ b/phpunit.xml.dist
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+    bootstrap="src/legacy_autoload.php"
+    colors="true"
+    cacheDirectory=".phpunit.cache"
+>
+    <testsuites>
+        <testsuite name="BlackWall Auth SDK Test Suite">
+            <directory>tests</directory>
+        </testsuite>
+    </testsuites>
+</phpunit>
diff --git a/public_html/callback.php b/public_html/callback.php
new file mode 100644
index 0000000..9c2ee85
--- /dev/null
+++ b/public_html/callback.php
@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+session_start();
+
+$autoloadCandidates = [
+    __DIR__ . '/../vendor/autoload.php',
+    __DIR__ . '/../src/legacy_autoload.php',
+];
+
+foreach ($autoloadCandidates as $file) {
+    if (is_file($file)) {
+        require_once $file;
+    }
+}
+
+use BlackWallSDK\BlackWallAuth;
+
+$auth = new BlackWallAuth([
+    'clientId' => '94d228c4-d4c6-4479-9b02-793e6a73e3f2',
+    'authorizeUrl' => 'https://blackwall.dixon.cx/oauth/authorize',
+    'tokenUrl' => 'https://blackwall.dixon.cx/oauth/token',
+    'userInfoUrl' => 'https://blackwall.dixon.cx/oauth/userinfo',
+    'redirectUri' => 'https://test.dixon.cx/callback.php',
+]);
+
+if (!isset($_GET['code'], $_GET['state'])) {
+    http_response_code(400);
+    echo 'Missing code/state';
+    exit;
+}
+
+if (isset($_SESSION['blackwall_oauth_state']) && $_GET['state'] !== $_SESSION['blackwall_oauth_state']) {
+    http_response_code(400);
+    echo 'Invalid state';
+    exit;
+}
+
+try {
+    $tokens = $auth->exchangeCodeForTokens($_GET['code']);
+    $_SESSION['access_token'] = $tokens['access_token'] ?? null;
+    $_SESSION['refresh_token'] = $tokens['refresh_token'] ?? null;
+
+    if (isset($_SESSION['access_token']) && is_string($_SESSION['access_token'])) {
+        $_SESSION['user'] = $auth->getUserInfo($_SESSION['access_token']);
+    }
+
+    unset($_SESSION['blackwall_oauth_state'], $_SESSION['blackwall_oauth_code_verifier']);
+
+    header('Location: /');
+    exit;
+} catch (Throwable $e) {
+    http_response_code(500);
+    echo 'Auth failed: ' . htmlspecialchars($e->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}
diff --git a/public_html/index.php b/public_html/index.php
new file mode 100644
index 0000000..b18b2d3
--- /dev/null
+++ b/public_html/index.php
@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+session_start();
+
+$autoloadCandidates = [
+    __DIR__ . '/../vendor/autoload.php',
+    __DIR__ . '/../src/legacy_autoload.php',
+];
+
+foreach ($autoloadCandidates as $file) {
+    if (is_file($file)) {
+        require_once $file;
+    }
+}
+
+use BlackWallSDK\BlackWallAuth;
+
+$auth = new BlackWallAuth([
+    'clientId' => '94d228c4-d4c6-4479-9b02-793e6a73e3f2',
+    'authorizeUrl' => 'https://blackwall.dixon.cx/oauth/authorize',
+    'tokenUrl' => 'https://blackwall.dixon.cx/oauth/token',
+    'userInfoUrl' => 'https://blackwall.dixon.cx/oauth/userinfo',
+    'redirectUri' => 'https://test.dixon.cx/callback.php',
+    'scope' => 'openid profile email offline_access',
+]);
+
+if (isset($_GET['logout'])) {
+    unset(
+        $_SESSION['access_token'],
+        $_SESSION['refresh_token'],
+        $_SESSION['user'],
+        $_SESSION['blackwall_oauth_state'],
+        $_SESSION['blackwall_oauth_code_verifier']
+    );
+    header('Location: /');
+    exit;
+}
+
+if (!isset($_SESSION['user'])) {
+    $authData = $auth->getAuthorizationUrl();
+    header('Location: ' . $authData['url']);
+    exit;
+}
+
+header('Content-Type: text/plain; charset=utf-8');
+echo "Authenticated (session)\n\n";
+echo "User:\n";
+echo json_encode($_SESSION['user'], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n\n";
+echo "Tokens (truncated):\n";
+echo json_encode([
+    'access_token' => isset($_SESSION['access_token']) ? substr((string) $_SESSION['access_token'], 0, 16) . '...' : null,
+    'refresh_token' => isset($_SESSION['refresh_token']) ? substr((string) $_SESSION['refresh_token'], 0, 8) . '...' : null,
+], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n\n";
+echo "Logout: /?logout=1\n";
diff --git a/src/Auth/AuthClient.php b/src/Auth/AuthClient.php
new file mode 100644
index 0000000..c08b965
--- /dev/null
+++ b/src/Auth/AuthClient.php
@@ -0,0 +1,176 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth;
+
+use BlackWall\Auth\Exception\StateMismatchException;
+use BlackWall\Auth\Exception\TokenExchangeException;
+use BlackWall\Auth\Exception\UserInfoException;
+use BlackWall\Auth\Http\CurlHttpClient;
+use BlackWall\Auth\Http\HttpClientInterface;
+
+final class AuthClient
+{
+    public function __construct(
+        private readonly Config $config,
+        private readonly HttpClientInterface $httpClient = new CurlHttpClient()
+    ) {
+    }
+
+    /**
+     * @param array<string, mixed> $options
+     * @return array{url:string,state:string,code_verifier:string,code_challenge:string}
+     */
+    public function buildAuthorisationUrl(array $options = []): array
+    {
+        $state = isset($options['state']) ? (string) $options['state'] : bin2hex(random_bytes(16));
+        $codeVerifier = isset($options['code_verifier']) ? (string) $options['code_verifier'] : $this->randomUrlSafe(43);
+        $codeChallenge = $this->base64Url(hash('sha256', $codeVerifier, true));
+        $scope = isset($options['scope']) ? (string) $options['scope'] : $this->config->defaultScope;
+        $extra = isset($options['extra']) && is_array($options['extra']) ? $options['extra'] : [];
+        $persist = !isset($options['persist']) || (bool) $options['persist'];
+
+        if ($persist && session_status() === PHP_SESSION_ACTIVE) {
+            $_SESSION['blackwall_oauth_state'] = $state;
+            $_SESSION['blackwall_oauth_code_verifier'] = $codeVerifier;
+        }
+
+        $query = array_merge([
+            'response_type' => 'code',
+            'client_id' => $this->config->clientId,
+            'redirect_uri' => $this->config->redirectUri,
+            'scope' => $scope,
+            'state' => $state,
+            'code_challenge' => $codeChallenge,
+            'code_challenge_method' => 'S256',
+        ], $extra);
+
+        $url = $this->config->authorizeUrl . '?' . http_build_query($query, '', '&', PHP_QUERY_RFC3986);
+
+        return [
+            'url' => $url,
+            'state' => $state,
+            'code_verifier' => $codeVerifier,
+            'code_challenge' => $codeChallenge,
+        ];
+    }
+
+    public function assertStateMatches(string $state): void
+    {
+        $sessionState = $_SESSION['blackwall_oauth_state'] ?? null;
+        if (!is_string($sessionState) || $state !== $sessionState) {
+            throw new StateMismatchException('The OAuth state did not match the session value');
+        }
+    }
+
+    public function exchangeCodeForTokens(string $code, ?string $codeVerifier = null): TokenSet
+    {
+        $verifier = $codeVerifier ?? ($_SESSION['blackwall_oauth_code_verifier'] ?? null);
+        if (!is_string($verifier) || $verifier === '') {
+            throw new TokenExchangeException('Missing code verifier; pass one explicitly or persist it in session.');
+        }
+
+        $payload = [
+            'grant_type' => 'authorization_code',
+            'code' => $code,
+            'redirect_uri' => $this->config->redirectUri,
+            'client_id' => $this->config->clientId,
+            'code_verifier' => $verifier,
+        ];
+
+        if ($this->config->clientSecret !== null && $this->config->clientSecret !== '') {
+            $payload['client_secret'] = $this->config->clientSecret;
+        }
+
+        $result = $this->httpClient->postForm($this->config->tokenUrl, $payload);
+        $data = json_decode($result['body'], true);
+
+        if ($result['status'] >= 400) {
+            $message = is_array($data) ? json_encode($data) : $result['body'];
+            throw new TokenExchangeException('Token endpoint error (' . $result['status'] . '): ' . $message);
+        }
+
+        if (!is_array($data)) {
+            throw new TokenExchangeException('Token endpoint returned invalid JSON');
+        }
+
+        return TokenSet::fromArray($data);
+    }
+
+    public function refreshAccessToken(string $refreshToken): TokenSet
+    {
+        $payload = [
+            'grant_type' => 'refresh_token',
+            'refresh_token' => $refreshToken,
+            'client_id' => $this->config->clientId,
+        ];
+
+        if ($this->config->clientSecret !== null && $this->config->clientSecret !== '') {
+            $payload['client_secret'] = $this->config->clientSecret;
+        }
+
+        $result = $this->httpClient->postForm($this->config->tokenUrl, $payload);
+        $data = json_decode($result['body'], true);
+
+        if ($result['status'] >= 400) {
+            $message = is_array($data) ? json_encode($data) : $result['body'];
+            throw new TokenExchangeException('Refresh token error (' . $result['status'] . '): ' . $message);
+        }
+
+        if (!is_array($data)) {
+            throw new TokenExchangeException('Refresh token response was not valid JSON');
+        }
+
+        return TokenSet::fromArray($data);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function getUserInfo(string $accessToken): array
+    {
+        if ($this->config->userInfoUrl === null || $this->config->userInfoUrl === '') {
+            throw new UserInfoException('UserInfo URL has not been configured');
+        }
+
+        $result = $this->httpClient->get($this->config->userInfoUrl, [
+            'Authorization' => 'Bearer ' . $accessToken,
+        ]);
+
+        $data = json_decode($result['body'], true);
+        if ($result['status'] >= 400) {
+            $message = is_array($data) ? json_encode($data) : $result['body'];
+            throw new UserInfoException('UserInfo endpoint error (' . $result['status'] . '): ' . $message);
+        }
+
+        if (!is_array($data)) {
+            throw new UserInfoException('UserInfo response was not valid JSON');
+        }
+
+        return $data;
+    }
+
+    public function exchangeCodeAndFetchUser(string $code, ?string $codeVerifier = null): AuthResult
+    {
+        $tokens = $this->exchangeCodeForTokens($code, $codeVerifier);
+        $user = $this->getUserInfo($tokens->accessToken);
+
+        return new AuthResult($tokens, $user);
+    }
+
+    public function clearPkceSessionState(): void
+    {
+        unset($_SESSION['blackwall_oauth_state'], $_SESSION['blackwall_oauth_code_verifier']);
+    }
+
+    private function base64Url(string $binary): string
+    {
+        return rtrim(strtr(base64_encode($binary), '+/', '-_'), '=');
+    }
+
+    private function randomUrlSafe(int $length): string
+    {
+        return $this->base64Url(random_bytes($length));
+    }
+}
diff --git a/src/Auth/AuthResult.php b/src/Auth/AuthResult.php
new file mode 100644
index 0000000..53b30f9
--- /dev/null
+++ b/src/Auth/AuthResult.php
@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth;
+
+final class AuthResult
+{
+    /**
+     * @param array<string, mixed> $user
+     */
+    public function __construct(
+        public readonly TokenSet $tokens,
+        public readonly array $user
+    ) {
+    }
+}
diff --git a/src/Auth/Config.php b/src/Auth/Config.php
new file mode 100644
index 0000000..1043488
--- /dev/null
+++ b/src/Auth/Config.php
@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth;
+
+final class Config
+{
+    public function __construct(
+        public readonly string $clientId,
+        public readonly string $authorizeUrl,
+        public readonly string $tokenUrl,
+        public readonly string $redirectUri,
+        public readonly ?string $userInfoUrl = null,
+        public readonly ?string $clientSecret = null,
+        public readonly string $defaultScope = 'openid profile email'
+    ) {
+    }
+
+    /**
+     * @param array<string, mixed> $config
+     */
+    public static function fromArray(array $config): self
+    {
+        foreach (['clientId', 'authorizeUrl', 'tokenUrl', 'redirectUri'] as $required) {
+            if (empty($config[$required]) || !is_string($config[$required])) {
+                throw new \InvalidArgumentException("{$required} is required");
+            }
+        }
+
+        return new self(
+            clientId: $config['clientId'],
+            authorizeUrl: rtrim($config['authorizeUrl'], '/'),
+            tokenUrl: rtrim($config['tokenUrl'], '/'),
+            redirectUri: $config['redirectUri'],
+            userInfoUrl: isset($config['userInfoUrl']) ? rtrim((string) $config['userInfoUrl'], '/') : null,
+            clientSecret: isset($config['clientSecret']) ? (string) $config['clientSecret'] : null,
+            defaultScope: isset($config['scope']) ? (string) $config['scope'] : 'openid profile email'
+        );
+    }
+}
diff --git a/src/Auth/Exception/AuthException.php b/src/Auth/Exception/AuthException.php
new file mode 100644
index 0000000..a4dd04a
--- /dev/null
+++ b/src/Auth/Exception/AuthException.php
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Exception;
+
+class AuthException extends \RuntimeException
+{
+}
diff --git a/src/Auth/Exception/StateMismatchException.php b/src/Auth/Exception/StateMismatchException.php
new file mode 100644
index 0000000..e6951dd
--- /dev/null
+++ b/src/Auth/Exception/StateMismatchException.php
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Exception;
+
+class StateMismatchException extends AuthException
+{
+}
diff --git a/src/Auth/Exception/TokenExchangeException.php b/src/Auth/Exception/TokenExchangeException.php
new file mode 100644
index 0000000..a32efac
--- /dev/null
+++ b/src/Auth/Exception/TokenExchangeException.php
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Exception;
+
+class TokenExchangeException extends AuthException
+{
+}
diff --git a/src/Auth/Exception/TransportException.php b/src/Auth/Exception/TransportException.php
new file mode 100644
index 0000000..bf2e628
--- /dev/null
+++ b/src/Auth/Exception/TransportException.php
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Exception;
+
+class TransportException extends AuthException
+{
+}
diff --git a/src/Auth/Exception/UserInfoException.php b/src/Auth/Exception/UserInfoException.php
new file mode 100644
index 0000000..10e5411
--- /dev/null
+++ b/src/Auth/Exception/UserInfoException.php
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Exception;
+
+class UserInfoException extends AuthException
+{
+}
diff --git a/src/Auth/Http/CurlHttpClient.php b/src/Auth/Http/CurlHttpClient.php
new file mode 100644
index 0000000..4772fd9
--- /dev/null
+++ b/src/Auth/Http/CurlHttpClient.php
@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Http;
+
+use BlackWall\Auth\Exception\TransportException;
+
+final class CurlHttpClient implements HttpClientInterface
+{
+    public function __construct(private readonly int $timeoutSeconds = 20)
+    {
+    }
+
+    public function postForm(string $url, array $fields, array $headers = []): array
+    {
+        $ch = curl_init($url);
+        if ($ch === false) {
+            throw new TransportException('Unable to initialise cURL for POST request');
+        }
+
+        $headerLines = $this->normaliseHeaders(array_merge([
+            'Content-Type' => 'application/x-www-form-urlencoded',
+            'Accept' => 'application/json',
+        ], $headers));
+
+        curl_setopt_array($ch, [
+            CURLOPT_POST => true,
+            CURLOPT_POSTFIELDS => http_build_query($fields, '', '&', PHP_QUERY_RFC3986),
+            CURLOPT_HTTPHEADER => $headerLines,
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT => $this->timeoutSeconds,
+        ]);
+
+        $body = curl_exec($ch);
+        $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
+        $error = curl_error($ch);
+        curl_close($ch);
+
+        if ($body === false) {
+            throw new TransportException($error !== '' ? $error : 'Unknown cURL POST error');
+        }
+
+        return ['status' => $status, 'body' => $body];
+    }
+
+    public function get(string $url, array $headers = []): array
+    {
+        $ch = curl_init($url);
+        if ($ch === false) {
+            throw new TransportException('Unable to initialise cURL for GET request');
+        }
+
+        $headerLines = $this->normaliseHeaders(array_merge([
+            'Accept' => 'application/json',
+        ], $headers));
+
+        curl_setopt_array($ch, [
+            CURLOPT_HTTPHEADER => $headerLines,
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT => $this->timeoutSeconds,
+        ]);
+
+        $body = curl_exec($ch);
+        $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
+        $error = curl_error($ch);
+        curl_close($ch);
+
+        if ($body === false) {
+            throw new TransportException($error !== '' ? $error : 'Unknown cURL GET error');
+        }
+
+        return ['status' => $status, 'body' => $body];
+    }
+
+    /**
+     * @param array<string, string> $headers
+     * @return string[]
+     */
+    private function normaliseHeaders(array $headers): array
+    {
+        $result = [];
+        foreach ($headers as $name => $value) {
+            $result[] = sprintf('%s: %s', $name, $value);
+        }
+
+        return $result;
+    }
+}
diff --git a/src/Auth/Http/HttpClientInterface.php b/src/Auth/Http/HttpClientInterface.php
new file mode 100644
index 0000000..fa7e4e0
--- /dev/null
+++ b/src/Auth/Http/HttpClientInterface.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Http;
+
+interface HttpClientInterface
+{
+    /**
+     * @param array<string, string> $headers
+     * @return array{status:int, body:string}
+     */
+    public function postForm(string $url, array $fields, array $headers = []): array;
+
+    /**
+     * @param array<string, string> $headers
+     * @return array{status:int, body:string}
+     */
+    public function get(string $url, array $headers = []): array;
+}
diff --git a/src/Auth/TokenSet.php b/src/Auth/TokenSet.php
new file mode 100644
index 0000000..eb83589
--- /dev/null
+++ b/src/Auth/TokenSet.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth;
+
+final class TokenSet
+{
+    /**
+     * @param array<string, mixed> $raw
+     */
+    public function __construct(
+        public readonly string $accessToken,
+        public readonly ?string $refreshToken,
+        public readonly ?string $idToken,
+        public readonly string $tokenType,
+        public readonly ?int $expiresIn,
+        public readonly ?string $scope,
+        public readonly array $raw
+    ) {
+    }
+
+    /**
+     * @param array<string, mixed> $payload
+     */
+    public static function fromArray(array $payload): self
+    {
+        if (empty($payload['access_token']) || !is_string($payload['access_token'])) {
+            throw new \InvalidArgumentException('Token payload does not include access_token');
+        }
+
+        return new self(
+            accessToken: $payload['access_token'],
+            refreshToken: isset($payload['refresh_token']) && is_string($payload['refresh_token']) ? $payload['refresh_token'] : null,
+            idToken: isset($payload['id_token']) && is_string($payload['id_token']) ? $payload['id_token'] : null,
+            tokenType: isset($payload['token_type']) && is_string($payload['token_type']) ? $payload['token_type'] : 'Bearer',
+            expiresIn: isset($payload['expires_in']) ? (int) $payload['expires_in'] : null,
+            scope: isset($payload['scope']) && is_string($payload['scope']) ? $payload['scope'] : null,
+            raw: $payload
+        );
+    }
+}
diff --git a/src/BlackWallAuth.php b/src/BlackWallAuth.php
new file mode 100644
index 0000000..0423b5a
--- /dev/null
+++ b/src/BlackWallAuth.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWallSDK;
+
+use BlackWall\Auth\AuthClient;
+use BlackWall\Auth\Config;
+
+/**
+ * Backwards-compatible wrapper for existing integrations.
+ *
+ * Prefer using BlackWall\Auth\AuthClient directly for new projects.
+ */
+class BlackWallAuth
+{
+    private AuthClient $client;
+
+    /**
+     * @param array<string, mixed> $config
+     */
+    public function __construct(array $config)
+    {
+        $this->client = new AuthClient(Config::fromArray($config));
+    }
+
+    /**
+     * @param array<string, mixed> $opts
+     * @return array{url:string,state:string,code_verifier:string,code_challenge:string}
+     */
+    public function getAuthorizationUrl(array $opts = []): array
+    {
+        return $this->client->buildAuthorisationUrl($opts);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function exchangeCodeForTokens(string $code, ?string $codeVerifier = null): array
+    {
+        return $this->client->exchangeCodeForTokens($code, $codeVerifier)->raw;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function refreshAccessToken(string $refreshToken): array
+    {
+        return $this->client->refreshAccessToken($refreshToken)->raw;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function getUserInfo(string $accessToken): array
+    {
+        return $this->client->getUserInfo($accessToken);
+    }
+}
diff --git a/src/legacy_autoload.php b/src/legacy_autoload.php
new file mode 100644
index 0000000..fa318d0
--- /dev/null
+++ b/src/legacy_autoload.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/Auth/Config.php';
+require_once __DIR__ . '/Auth/TokenSet.php';
+require_once __DIR__ . '/Auth/AuthResult.php';
+require_once __DIR__ . '/Auth/Http/HttpClientInterface.php';
+require_once __DIR__ . '/Auth/Http/CurlHttpClient.php';
+require_once __DIR__ . '/Auth/Exception/AuthException.php';
+require_once __DIR__ . '/Auth/Exception/TokenExchangeException.php';
+require_once __DIR__ . '/Auth/Exception/UserInfoException.php';
+require_once __DIR__ . '/Auth/Exception/StateMismatchException.php';
+require_once __DIR__ . '/Auth/Exception/TransportException.php';
+require_once __DIR__ . '/Auth/AuthClient.php';
+require_once __DIR__ . '/BlackWallAuth.php';
diff --git a/tests/AuthClientTest.php b/tests/AuthClientTest.php
new file mode 100644
index 0000000..d3398d3
--- /dev/null
+++ b/tests/AuthClientTest.php
@@ -0,0 +1,150 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Tests;
+
+use BlackWall\Auth\AuthClient;
+use BlackWall\Auth\Config;
+use BlackWall\Auth\Exception\StateMismatchException;
+use BlackWall\Auth\Exception\TokenExchangeException;
+use BlackWall\Auth\Exception\UserInfoException;
+use PHPUnit\Framework\TestCase;
+
+final class AuthClientTest extends TestCase
+{
+    private Config $config;
+    private FakeHttpClient $http;
+    private AuthClient $client;
+
+    protected function setUp(): void
+    {
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            @session_start();
+        }
+
+        $_SESSION = [];
+
+        $this->config = Config::fromArray([
+            'clientId' => 'client-123',
+            'authorizeUrl' => 'https://provider.example/oauth/authorize',
+            'tokenUrl' => 'https://provider.example/oauth/token',
+            'userInfoUrl' => 'https://provider.example/oauth/userinfo',
+            'redirectUri' => 'https://app.example/callback.php',
+            'scope' => 'openid profile email',
+            'clientSecret' => 'secret-abc',
+        ]);
+
+        $this->http = new FakeHttpClient();
+        $this->client = new AuthClient($this->config, $this->http);
+    }
+
+    public function testBuildAuthorisationUrlPersistsStateAndVerifier(): void
+    {
+        $result = $this->client->buildAuthorisationUrl();
+
+        self::assertArrayHasKey('url', $result);
+        self::assertArrayHasKey('state', $result);
+        self::assertArrayHasKey('code_verifier', $result);
+        self::assertArrayHasKey('code_challenge', $result);
+        self::assertSame($result['state'], $_SESSION['blackwall_oauth_state']);
+        self::assertSame($result['code_verifier'], $_SESSION['blackwall_oauth_code_verifier']);
+        self::assertStringContainsString('code_challenge_method=S256', $result['url']);
+    }
+
+    public function testAssertStateMatchesThrowsOnMismatch(): void
+    {
+        $_SESSION['blackwall_oauth_state'] = 'expected';
+
+        $this->expectException(StateMismatchException::class);
+        $this->client->assertStateMatches('actual');
+    }
+
+    public function testExchangeCodeForTokensReturnsTypedTokenSet(): void
+    {
+        $_SESSION['blackwall_oauth_code_verifier'] = 'verifier-123';
+
+        $this->http->queuePost([
+            'status' => 200,
+            'body' => json_encode([
+                'access_token' => 'access-1',
+                'refresh_token' => 'refresh-1',
+                'id_token' => 'id-1',
+                'token_type' => 'Bearer',
+                'expires_in' => 3600,
+                'scope' => 'openid profile email',
+            ], JSON_THROW_ON_ERROR),
+        ]);
+
+        $tokens = $this->client->exchangeCodeForTokens('code-1');
+
+        self::assertSame('access-1', $tokens->accessToken);
+        self::assertSame('refresh-1', $tokens->refreshToken);
+        self::assertSame('id-1', $tokens->idToken);
+        self::assertSame(3600, $tokens->expiresIn);
+        self::assertCount(1, $this->http->postCalls);
+        self::assertSame('authorization_code', $this->http->postCalls[0]['fields']['grant_type']);
+        self::assertSame('verifier-123', $this->http->postCalls[0]['fields']['code_verifier']);
+    }
+
+    public function testExchangeCodeForTokensThrowsWhenVerifierMissing(): void
+    {
+        $this->expectException(TokenExchangeException::class);
+        $this->client->exchangeCodeForTokens('code-2');
+    }
+
+    public function testExchangeCodeForTokensThrowsOnEndpointError(): void
+    {
+        $_SESSION['blackwall_oauth_code_verifier'] = 'verifier-123';
+
+        $this->http->queuePost([
+            'status' => 400,
+            'body' => '{"error":"invalid_grant"}',
+        ]);
+
+        $this->expectException(TokenExchangeException::class);
+        $this->expectExceptionMessage('Token endpoint error (400)');
+        $this->client->exchangeCodeForTokens('bad-code');
+    }
+
+    public function testRefreshAccessTokenCallsRefreshGrant(): void
+    {
+        $this->http->queuePost([
+            'status' => 200,
+            'body' => '{"access_token":"access-2","refresh_token":"refresh-2","token_type":"Bearer"}',
+        ]);
+
+        $tokens = $this->client->refreshAccessToken('refresh-1');
+
+        self::assertSame('access-2', $tokens->accessToken);
+        self::assertSame('refresh_token', $this->http->postCalls[0]['fields']['grant_type']);
+        self::assertSame('refresh-1', $this->http->postCalls[0]['fields']['refresh_token']);
+        self::assertSame('client-123', $this->http->postCalls[0]['fields']['client_id']);
+    }
+
+    public function testGetUserInfoReturnsPayload(): void
+    {
+        $this->http->queueGet([
+            'status' => 200,
+            'body' => '{"sub":"user-1","name":"Example User"}',
+        ]);
+
+        $user = $this->client->getUserInfo('access-3');
+
+        self::assertSame('user-1', $user['sub']);
+        self::assertCount(1, $this->http->getCalls);
+        self::assertSame('Bearer access-3', $this->http->getCalls[0]['headers']['Authorization']);
+    }
+
+    public function testGetUserInfoThrowsOnErrorResponse(): void
+    {
+        $this->http->queueGet([
+            'status' => 401,
+            'body' => '{"error":"invalid_token"}',
+        ]);
+
+        $this->expectException(UserInfoException::class);
+        $this->expectExceptionMessage('UserInfo endpoint error (401)');
+        $this->client->getUserInfo('expired-token');
+    }
+}
diff --git a/tests/FakeHttpClient.php b/tests/FakeHttpClient.php
new file mode 100644
index 0000000..15469b6
--- /dev/null
+++ b/tests/FakeHttpClient.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Tests;
+
+use BlackWall\Auth\Http\HttpClientInterface;
+
+final class FakeHttpClient implements HttpClientInterface
+{
+    /** @var list<array{status:int,body:string}> */
+    private array $postQueue = [];
+
+    /** @var list<array{status:int,body:string}> */
+    private array $getQueue = [];
+
+    /** @var list<array{url:string,fields:array<string,string>,headers:array<string,string>}> */
+    public array $postCalls = [];
+
+    /** @var list<array{url:string,headers:array<string,string>}> */
+    public array $getCalls = [];
+
+    /**
+     * @param array{status:int,body:string} $response
+     */
+    public function queuePost(array $response): void
+    {
+        $this->postQueue[] = $response;
+    }
+
+    /**
+     * @param array{status:int,body:string} $response
+     */
+    public function queueGet(array $response): void
+    {
+        $this->getQueue[] = $response;
+    }
+
+    public function postForm(string $url, array $fields, array $headers = []): array
+    {
+        /** @var array<string, string> $fields */
+        /** @var array<string, string> $headers */
+        $this->postCalls[] = ['url' => $url, 'fields' => $fields, 'headers' => $headers];
+
+        if ($this->postQueue === []) {
+            throw new \RuntimeException('No fake POST response queued');
+        }
+
+        return array_shift($this->postQueue);
+    }
+
+    public function get(string $url, array $headers = []): array
+    {
+        /** @var array<string, string> $headers */
+        $this->getCalls[] = ['url' => $url, 'headers' => $headers];
+
+        if ($this->getQueue === []) {
+            throw new \RuntimeException('No fake GET response queued');
+        }
+
+        return array_shift($this->getQueue);
+    }
+}